Standalone Non-Public Network Credential Provider

Description

The SNPN Credential Provider (SNPN CP) is a functional entity introduced in 3GPP Release 19 to support authentication and authorization for Standalone Non-Public Networks (SNPNs). An SNPN is a 5G network deployed for private use, such as in factories, campuses, or enterprises, and it may be isolated from public land mobile networks (PLMNs). The SNPN CP is responsible for creating, managing, and providing authentication credentials for devices (UEs) that need to access the SNPN. It acts as a trusted third party that issues and validates identity information, ensuring that only authorized devices can connect to the SNPN.

The SNPN CP operates within the 5G core network architecture. It interfaces with the SNPN's authentication, authorization, and accounting (AAA) framework, and may interact with the Unified Data Management (UDM) or a dedicated authentication server. When a UE attempts to register with an SNPN, the SNPN CP verifies the UE's credentials, which could be based on certificates, SIM-based credentials, or other identity modules. The SNPN CP may also support the provisioning of credentials to UEs, enabling dynamic onboarding of devices into the SNPN.

Key components of the SNPN CP include an identity management function, a credential generation and storage function, and an authentication service function. The identity management function handles the lifecycle of identities, from creation to revocation. The credential generation function produces secure credentials, such as public-private key pairs or symmetric keys, and stores them securely. The authentication service function validates credentials presented by UEs during network access attempts. The SNPN CP may also support federated identity models, where credentials from external providers are accepted.

The SNPN CP is crucial for enabling scalable and secure SNPN deployments. It allows SNPN operators to manage their own subscriber base without relying on public network operators, which is essential for private networks with specific security and privacy requirements. It also facilitates roaming between SNPNs and with PLMNs, as the SNPN CP can act as a bridge for authentication across domains. In Release 19, the SNPN CP is defined in specifications such as 3GPP TS 22.261 (Service requirements for the 5G system) and TS 22.848 (Study on enhancement of 5G SNPN).

In Release 20, the definition remains unchanged, indicating that the functional scope and architecture of the SNPN CP are stable. However, ongoing work may focus on integration with other network functions and support for new use cases, such as industrial IoT and mission-critical applications. The SNPN CP is a key enabler for the vision of flexible, private 5G networks that can be tailored to specific vertical industries.

Purpose & Motivation

The SNPN Credential Provider exists to address the need for secure and manageable authentication in Standalone Non-Public Networks (SNPNs). Traditional public mobile networks rely on centralized subscriber databases and SIM-based authentication managed by mobile network operators. However, SNPNs are often deployed by enterprises or industries that require full control over their network and subscriber management. Without a dedicated credential provider, SNPN operators would have to rely on external entities for authentication, which may not meet their security, privacy, or operational requirements.

The SNPN CP solves this by providing a self-contained authentication framework within the SNPN. It allows the SNPN operator to issue and manage credentials for its devices, ensuring that only authorized devices can access the network. This is particularly important for industrial IoT scenarios where devices may be deployed in large numbers and need to be onboarded securely and efficiently. The SNPN CP also enables the SNPN to operate independently of public networks, which is essential for applications requiring high availability and isolation.

Historically, private networks were often based on technologies like Wi-Fi or 4G LTE, which had limitations in terms of security, QoS, and scalability. The introduction of 5G SNPNs in 3GPP Release 16 provided a standardized framework for private 5G networks, but authentication mechanisms were still tied to the public network's infrastructure. The SNPN CP, introduced in Release 19, fills this gap by defining a dedicated entity for credential management and authentication, thus empowering SNPN operators with full control over their security domain. This evolution reflects the growing demand for private 5G networks in vertical industries and the need for flexible, secure, and scalable authentication solutions.