Public Network Integrated Non-Public Network Operational domain

Description

The PNI-NPN Operational domain is a concept introduced in 3GPP Release 19, defined in TS 33.501 and TS 33.757. It refers to the dedicated network entities of a Non-Public Network (NPN) that are deployed outside the Public Land Mobile Network (PLMN) operator's security domain, but with the support of a PLMN operator. This domain is part of the Public Network Integrated NPN (PNI-NPN) architecture, where an NPN is integrated with a PLMN to leverage the PLMN's infrastructure and spectrum.

In a PNI-NPN deployment, the NPN can be owned and operated by an enterprise or a third party, but it relies on the PLMN operator for certain services, such as spectrum access, authentication, and mobility management. The PNI-NPN Operational domain specifically addresses the scenario where some NPN entities are not under the direct control of the PLMN operator and reside outside its security domain. These entities are typically deployed on the enterprise premises or in a private cloud, and they are managed by the NPN owner. However, they are deployed with the support of the PLMN operator, which may provide connectivity, security credentials, or other assistance.

The distinction between the PLMN Operational domain and the PNI-NPN Operational domain is crucial for security and management. In the PLMN Operational domain, NPN entities are within the PLMN operator's security domain, meaning the PLMN operator is responsible for their security. In the PNI-NPN Operational domain, the NPN entities are outside the PLMN operator's security domain, so the NPN owner is responsible for their security, although the PLMN operator may provide support. This separation allows for flexible deployment models where the enterprise can maintain control over its data and security policies while still benefiting from the PLMN's infrastructure.

The security architecture for the PNI-NPN Operational domain is specified in TS 33.501, which outlines the security requirements for 5G systems, including NPNs. TS 33.757 provides further details on the security management for NPNs, including the handling of credentials and key management. The concept is also referenced in TS 22.261, which defines the service requirements for 5G, including NPNs.

Architecturally, the PNI-NPN Operational domain may include entities such as the NPN's User Plane Function (UPF), which could be deployed at the enterprise premises to keep user data local, while the control plane functions may reside in the PLMN. The NPN owner is responsible for the security of these entities, including physical security, access control, and data encryption. The PLMN operator supports the deployment by providing, for example, the authentication credentials for the NPN's devices or the necessary spectrum resources.

The PNI-NPN Operational domain enables a wide range of deployment scenarios, from fully integrated NPNs where all entities are in the PLMN domain, to hybrid models where some entities are outside. This flexibility is essential for meeting the diverse requirements of enterprises, such as data privacy, low latency, and high availability. It also allows PLMN operators to offer differentiated services and new business models, such as NPN-as-a-service with varying levels of management and security responsibility.

In summary, the PNI-NPN Operational domain is a key concept for understanding the security and management boundaries in PNI-NPN deployments. It defines the scope of NPN entities that are outside the PLMN operator's security domain but deployed with its support, enabling flexible and secure NPN deployments.

Purpose & Motivation

The PNI-NPN Operational domain was introduced to address the need for a clear security and management framework for NPN entities that are not under the direct control of the PLMN operator but are deployed with its support. As enterprises demand private 5G networks with specific requirements for data privacy, latency, and control, PLMN operators seek to offer NPN services that can be tailored to these needs. However, not all NPN entities can or should be hosted within the PLMN operator's infrastructure. Some entities, such as user plane functions or local application servers, may need to be deployed on the enterprise premises to meet performance or regulatory requirements.

The PNI-NPN Operational domain defines that such entities are outside the PLMN operator's security domain, meaning the enterprise is responsible for their security. This clarity is essential for trust models, liability, and regulatory compliance. It allows the enterprise to maintain control over its data and security policies while still benefiting from the PLMN's infrastructure, such as spectrum access and mobility management.

Previously, NPN deployments were primarily standalone or had limited integration with PLMNs. The introduction of PNI-NPNs in Release 16 allowed NPNs to be integrated with PLMNs, but the security and operational aspects of deploying NPN entities outside the PLMN's security domain were not fully specified. The PNI-NPN Operational domain fills this gap by providing a standardized way to describe and manage such deployments. It enables PLMN operators to offer flexible NPN solutions that can be customized to the enterprise's needs, while ensuring that security responsibilities are clearly defined.

The concept also supports multi-vendor and multi-operator scenarios, where NPN entities from different vendors or operators may coexist. By defining the domain, 3GPP ensures that security policies and procedures are consistently applied, reducing the risk of misconfiguration and security breaches. Overall, the PNI-NPN Operational domain is a foundational concept for the commercial deployment of hybrid NPNs, driving the growth of private 5G networks with varying levels of PLMN integration.