Public Land Mobile Network Trust Domain

Description

The PLMN trust domain is a security concept introduced in 3GPP Release 15 as part of the 5G security architecture. It is defined in specifications 23.222 and 29.222, which cover the Common API Framework (CAPIF) for 3GPP northbound APIs. The trust domain represents a set of network entities and functions that are protected by adequate security measures and are under the control of the PLMN operator or a trusted third party. Entities within the same trust domain can communicate with each other with a certain level of implicit trust, while communication with entities outside the domain requires additional security measures such as authentication and authorization.

The primary purpose of the PLMN trust domain is to enable secure exposure of network capabilities and services to external application functions (AFs) and to facilitate interconnection between different PLMNs. In the 5G Service Based Architecture (SBA), network functions (NFs) within the same PLMN trust domain can interact directly using internal interfaces, often without additional security beyond transport layer protection. However, when an NF from another PLMN or an external AF needs to access services, it must go through security edge protection proxies (SEPPs) and other security functions that enforce the trust boundary.

The trust domain concept is closely tied to the CAPIF, which provides a framework for API exposure. CAPIF defines an API provider domain, which is a logical grouping of API provider functions that are managed by a single administrative entity. This API provider domain can be considered a trust domain. The CAPIF core function (CCF) authenticates and authorizes API invokers, and it ensures that only trusted entities can access the APIs. The trust domain boundaries are enforced through mutual authentication, authorization tokens, and secure channels.

In a multi-PLMN environment, each PLMN constitutes its own trust domain. When a user equipment (UE) roams into a visited PLMN (VPLMN), the home PLMN (HPLMN) and VPLMN establish a trust relationship through the SEPP. The SEPP acts as a gateway that protects the PLMN's internal network functions from external attacks and enforces security policies at the interconnect. The trust domain concept ensures that even though the VPLMN is a separate administrative domain, appropriate security measures are in place to protect the HPLMN's assets.

The trust domain is also relevant for network slicing and multi-tenancy. In a network slice, the slice owner may be a third party that is trusted by the PLMN operator. The slice's management and control functions may reside within the PLMN trust domain if they are adequately protected. This allows for flexible deployment models where third parties can manage their own slices while relying on the PLMN's security infrastructure.

Overall, the PLMN trust domain provides a clear and standardized way to define security boundaries in 5G networks. It enables secure service exposure, inter-PLMN interconnection, and multi-party business models by establishing where trust is assumed and where it must be explicitly established and verified.

Purpose & Motivation

The PLMN trust domain was created to address the security challenges of the 5G Service Based Architecture, where network functions are exposed as services and can be accessed by external entities. In previous generations, security was primarily focused on the radio interface and core network elements were considered inherently trusted. However, with 5G's emphasis on openness, network slicing, and edge computing, the trust boundaries became more complex. The PLMN trust domain provides a formal way to define which entities are trusted and under what conditions.

The concept solves the problem of secure service exposure. When a PLMN wants to offer its capabilities (e.g., location services, QoS on demand) to external application providers, it needs a way to authenticate and authorize those providers without exposing its internal network to unnecessary risk. The trust domain allows the PLMN to define a perimeter within which security is managed according to its policies, and outside of which all access must be mediated by security gateways like the SEPP. This enables new business models while maintaining a strong security posture.

Additionally, the trust domain facilitates inter-PLMN cooperation. In roaming scenarios, the VPLMN and HPLMN need to exchange signaling and user data securely. The trust domain concept, along with the SEPP, ensures that each PLMN can protect its internal functions while still allowing necessary interworking. This is particularly important for 5G roaming, where the number of interconnected networks and services is much larger than in previous generations.