Virtual Network

Description

In 3GPP terminology, a Virtual Network (VN) is a logical network instantiated over shared physical and virtual resources, offering a defined set of connectivity, performance, and management characteristics to a specific set of users or services. It is closely related to—and sometimes used interchangeably with—the concept of a network slice, but VN emphasizes the virtualization aspect: the physical infrastructure (RAN, transport, core, and cloud resources) is partitioned into multiple independent logical networks, each with its own topology, addressing, policy, and control functions. VN concepts appear in Release 19 and Release 20 studies captured in TR 22.870 and security work in TS 33.127, where the isolation and threat model for virtualized deployments are examined.

Architecturally, a VN can be built using Network Function Virtualization (NFV) and Software-Defined Networking (SDN): core network functions such as AMF, SMF, and UPF are deployed as virtual network functions (VNFs) or containerized network functions (CNFs) on a shared NFV infrastructure (NFVI). The VN comprises these functions plus the virtual links and forwarding rules that connect them. Management and orchestration (MANO) creates, scales, and tears down the VN, while the 3GPP management system (e.g., via the Network Resource Model) models the VN and its constituent resources. In the RAN, a VN may be realized through slicing of radio resources, with separate scheduling policies, QoS profiles, and possibly separate gNB instances or RAN slices.

Security and isolation are central concerns. TS 33.127 addresses lawful interception and security assurance for virtualized and sliced networks, and the VN concept raises questions about inter-VN isolation, secure multi-tenancy, and the trust boundary between infrastructure provider and VN operator. A VN operated by a third party on an operator's infrastructure requires mechanisms for authentication, authorization, and policy enforcement so that one VN's traffic or management actions cannot affect another's.

The relationship between VN and network slicing is nuanced: a network slice is a 3GPP-defined complete logical network with specific Service Level Agreements (SLAs) and slice identifiers (S-NSSAI), while a VN is the underlying virtualized realization. A single slice may be deployed as one VN, or multiple slices may share a VN; conversely, a VN may host several slices or a private network. The term is also used in the context of non-public networks (NPN) and dedicated virtual networks for enterprises, where a customer receives a logically separate network experience over a public operator's infrastructure.

In summary, VN in 3GPP describes the virtualized, logically isolated network constructs that enable flexible, multi-tenant, SLA-driven service delivery. It underpins network slicing, private networks, and the move toward cloud-native 5G-Advanced and 6G core architectures, and its study in Rel-19 and Rel-20 reflects the industry's shift toward fully virtualized, programmable mobile networks.

Purpose & Motivation

Virtual Networks exist to allow multiple logical networks with different performance, security, and functional requirements to coexist on a single physical infrastructure. Before virtualization, deploying a dedicated network for a customer or service required dedicated hardware, which was costly and inflexible. NFV and SDN changed that, but 3GPP needed a standardized way to describe, manage, and secure these logical networks within the mobile system.

The motivation in Rel-19 and Rel-20 studies, including TR 22.870, is to support diverse use cases—industrial private networks, public safety, massive IoT, and enhanced broadband—each with distinct SLAs, without building separate physical networks. TS 33.127 addresses the security and lawful interception aspects, ensuring that virtualization does not weaken isolation or regulatory compliance. The VN concept thus provides the vocabulary and architectural enablers for multi-tenancy, rapid service creation, and efficient resource utilization in 5G-Advanced and 6G.