White Paper

5G Non-Public Networks
for Industrial Scenarios

July 2019
5G Alliance for Connected Industries and Automation
5G Non-Public Networks for Industrial Scenarios
Contact:
Email: [email protected]
www.5g-acia.org
Published by:
ZVEI – German Electrical and
Electronic Manufacturers’ Association
5G Alliance for Connected Industries and Automation
(5G-ACIA), a Working Party of ZVEI
Lyoner Strasse 9
60528 Frankfurt am Main, Germany
www.zvei.org
July 2019
Graphics: ZVEI
The work, including all of its parts, is protected
by copyright. Any use outside the strict limits of
copyright law without the consent of the publisher is
prohibited. This applies in particular to reproduction,
translation, microfilming and storage and processing
in electronic systems.
Despite the utmost care, ZVEI accepts no
liability for the content.
Contents
1 Introduction 4

2 3GPP 4

3 5G-ACIA 4

4 Non-public networks 5

5 Network deployment scenarios 5

5.1 Notation 6
5.2 Standalone non-public network (isolated deployment) 7
5.3 Non-public network in conjunction with public networks 8
5.3.1 Shared radio access network 8
5.3.2 Shared radio access network and control plane 9
5.3.3 NPN hosted by the public network 10

6 Selected 3GPP-defined service attributes 11

6.1 Device connectivity 11
6.2 Quality of service (QoS) 12
6.3 Operation and management 12
6.4 Privacy and Security 13

7 Conclusions 14

8 Keywords and abbreviations 15

9 References 16

10 Annex 1 - Mapping of logical network elements 17

to the 3GPP-defined architecture
11 5G-ACIA members 18

3
1 Introduction
This paper describes four industrial (IIoT) deployment scenarios for 3GPP-defined 5G non-
public networks. The paper also considers key aspects, in particular service attributes that
can help to highlight the differences between these scenarios.

The primary target audience is any organisation considering 5G deployment for IIoT. At the
very least, these include operational technology (OT) companies – in other words, those
user organisations that will need to apply 5G technologies to their own real-world require-
ments – and ICT companies, who are considering IIoT as part of their 5G offering.

Some of the terminology and notation employed by 3GPP has been modified to make it
more easily understood.

2 3GPP
The 3rd Generation Partnership Project (3GPP) is a collaborative project that brings
together standardisation organisations from around the world to create globally accept-
able specifications for mobile networks.

As its name implies, it was first created to establish such specifications for the third genera-
tion (3G) of mobile systems. It has continued its work for subsequent generations, includ-
ing the one considered here, the fifth generation (5G).

This paper refers to technical specifications (TSs) published by 3GPP, i.e. the 5G standards.

3 5G-ACIA
The 5G Alliance for Connected Industries and Automation (5G-ACIA) was established to
serve as the central and global forum for addressing, discussing, and evaluating relevant
technical, regulatory, and business aspects with respect to 5G for the industrial domain. It
reflects the entire ecosystem and all relevant stakeholder groups, ranging from operational
industry (OT) players (industrial automation companies, engineering companies, produc-
tion system manufacturers, end users, etc.), the ICT industry (chip manufacturers, network
infrastructure vendors, mobile network operators, etc.), academia and other groups.

The paramount objective of 5G-ACIA is to ensure the best possible applicability of 5G tech-
nology and 5G networks for connected industries, particularly the manufacturing and the
process industry. 5G-ACIA’s mission is to ensure that the interests and needs of the indus-
trial domain are adequately considered in 5G standardisation and regulation. 5G-ACIA will
further ensure that ongoing 5G developments are understood by and effectively trans-
ferred to the industrial domain.

4
4 Non-public networks
In contrast to a network that offers mobile network services to the general public, a 5G
non-public network (NPN, also sometimes called a private network) provides 5G network
services to a clearly defined user organisation or group of organisations. The 5G non-public
network is deployed on the organisation’s defined premises, such as a campus or a factory.

Non-public networks can be desirable for several reasons:

• High quality-of-service requirements
• High security requirements, met by dedicated security credentials
• Isolation from other networks, as a form of protection against malfunctions in the public
mobile network. Also, isolation may be desirable for reasons of performance, security,
privacy, and safety
• Accountability. A non-public network makes it easier to identify responsibility for avail-
ability, maintenance, and operation

5 Network deployment scenarios

3GPP specifications foresee a variety of NPN deployment scenarios. 5G-ACIA’s primary
interest is in the use of NPNs in industrial/IIoT scenarios. However, this still comprises a
wide range of use cases, with a corresponding variety of network configurations. This sec-
tion focuses on the main configurations in terms of the structure of their logical architec-
ture components.

At the highest level, NPNs can be divided into two categories:

• NPNs deployed as isolated, standalone networks, and
• NPNs deployed in conjunction with a public network.

The first category comprises a single configuration, while the second comprises three, each
differing in terms of the degree of interaction and infrastructure sharing with the public
network. For all scenarios, it is assumed that all networks provide all services and capabili-
ties required by the NPN at the defined level, and that corresponding service level agree-
ments are in place between the NPN operator and one or more public network operators.

There are many other factors to be considered when deploying NPNs. These include, for
instance, what frequencies are to be used, who owns and operates each network, and what
level of trust exists between the NPN operator and the public network operator. In addition,
consideration needs to be given to the availability of solution components and economic
feasibility, e.g. in terms of total cost of ownership. While these factors are very important,
and some of them may be implicitly addressed in the scenarios given, they are beyond the
scope of this paper. Spectrum aspects are discussed in 5G-ACIA “5G for Connected Indus-
tries and Automation” white paper [1].

5
5.1 Notation
Table 1 below lists and describes the logical elements used to depict network configura-
tions. These are mapped to the 3GPP-defined architecture in Annex 1.

Table 1: Legend for figures in this document

Device that can communicate via a radio network

Radio network only accessible to non-public network devices

Radio network hosted by a public network

Radio network accessible to both public and non-public network device

User plane gateway only accessible in a non-public network

User plane gateway in a public network

Control plane functions in a non-public network

Control plane functions in a public network

Firewall

Subscriber database for non-public network subscribers

Subscriber database for public network

Subscriber database for both non-public and public network subscribers

Services offered via a public network, such as voice and mobile

broadband

Services on a defined premises, such as a factory, e.g. for control and

automation systems

Physical perimeter of the defined premises, and therefore the minimum

coverage area of the non-public network

Overlay coverage of the public network, i.e. in all likelihood also

available throughout the defined premises

Path for payload data traffic, i.e. the user plane (solid line).
Blue = non-public network, pink = public network

Path for the wireless network control signals, i.e. the control plane
(dashed line). Blue = non-public network, pink = public network
Source: 5G-ACIA

6
5.2 Standalone non-public network (isolated deployment)
In this scenario, the NPN is deployed as an independent, standalone network. As shown
in Figure 1, all network functions are located inside the logical perimeter of the defined
premises (e.g. factory) and the NPN is separate from the public network.

The only communication path between the NPN and the public network is via a firewall.
The firewall is a clearly defined and identifiable demarcation point. The OT company has
sole and exclusive responsibility for operating the NPN and for all service attributes up to
this point.

Fig. 1: Deployment as isolated network

Public
network
services

Public network

Optional
connection
Local path

Non-public
network
services

Source: 5G-ACIA

The NPN is based on 3GPP-defined technologies and is entirely independent with its own
dedicated NPN ID. An optional connection to the public network services via the firewall,
as shown in Figure 1, can be employed to enable access to public network services, such as
voice, while within NPN coverage.

Alternatively, NPN devices can subscribe directly to the public network to access its services
(dual subscription). If desired, the optional connection can be leveraged to access NPN
services via the public network.

Furthermore, the NPN operator can conclude roaming agreements with one or more public
network operators, and the optional connection also be used for this purpose. Roaming
agreements with public networks may entail technical constraints. This will depend on the
specific case.

7
5.3 Non-public network in conjunction with public networks
These deployments are a combination of public and non-public networks. These scenarios
assume that certain use cases on the defined premises can be supported entirely by the
public network, whereas others require a dedicated NPN.

There are therefore two network parts, one public and one non-public, with traffic assigned
to the appropriate part.

5.3.1 Shared radio access network

In these scenarios, the NPN and the public network share part of the radio access network,
while other network functions remain segregated. All data flows related to the NPN traffic
portion are within the logical perimeter of the defined premises, e.g. factory, and the pub-
lic network traffic portion is transferred to the public network. 3GPP specifications include
functionality that enables RAN sharing [2].

For the sake of simplicity, Figure 2 only shows a single shared base station for the RAN
on the defined premises. It is possible to configure additional base stations that are only
accessible to NPN users.

Fig. 2: Deployment with shared RAN

Public
network
services

Public network

Local path

Non-public
network
services

Source: 5G-ACIA

The NPN is based on 3GPP-defined technologies and has its own dedicated NPN ID. How-
ever, there is a RAN sharing agreement with a public network operator.

As discussed in section 5.2, it is possible to have an optional connection between the NPN
and the public network via a firewall (not shown in Figure 2), and the same considerations
as described in section 5.2 apply.

8
5.3.2 Shared radio access network and control plane
In this scenario, the NPN and the public network share the radio access network for the
defined premises, and network control tasks are always performed in the public network.
Nevertheless, all NPN traffic flows remain within the logical perimeter of the defined prem-
ises, while the public network traffic portion is transferred to the public network.

This can be implemented by means of network slicing, i.e. the creation of logically inde-
pendent networks within a single, shared physical infrastructure. Segregation of the public
and the private networks is achieved by employing different network slice identifiers.

This scenario can also be implemented by means of a 3GPP-defined feature called access
point name (APN). The APN denotes the final target network (where to route traffic), allow-
ing differentiation between traffic portions.

Figure 3 shows a single shared base station for the factory RAN but it is also possible to
configure additional base stations accessible only to NPN users.

Fig. 3: Deployment with shared RAN and control plane

Public
network
services

Public network

Local path

Non-public
network
services

Source: 5G-ACIA

In this scenario, the NPN is hosted by the public network, and NPN devices are public net-
work subscribers. This makes the contractual relationship between the NPN and the public
network operator more straightforward. It allows NPN devices to connect directly to the
public network and its services, including roaming.

9
There may also be an optional connection from the private network services to public net-
work services, as shown in Figure 1 in section 5.2. It is possible to harness this optional
connection to connect NPN devices to private network services via the public network when
the device is outside NPN coverage, but within public network coverage. If public network
services are accessed directly via the public network, the optional connection is not needed
for this purpose.

5.3.3 NPN hosted by the public network

In this scenario, both the public network traffic portion and the NPN traffic portion are
external to the defined premises, but treated as if they were parts of completely different
networks. This is achieved through virtualisation of network functions in a (generic) cloud
environment. These functions can then be used for both public and for private network
purposes.

This scenario can be implemented by means of network slicing or APN (access point name)
functionality.

Fig. 4: NPN deployed in public network

Public
network
services

Public network

Non-public
network
services

Source: 5G-ACIA

In this scenario NPN subscribers are, by definition, also public network subscribers. Since
all data is routed via the public network, access to public network services and the ability to
roam can be implemented easily in accordance with the agreement between the NPN and
the public network operator. The optional connection depicted in Figure 1 in section 5.2 is
not needed in this scenario.

10
6 Selected 3GPP-defined service attributes
This paper focuses on selected service attributes of 3GPP-defined 5G non-public networks,
i.e. those attributes of greatest significance to industrial (IIoT) use cases. The degree of
compliance with these attributes should be considered when evaluating the suitability of
an NPN deployment scenario for a planned IIoT use case.

6.1 Device connectivity

Device connectivity describes the ability of NPN devices to connect to other networks, such
as public networks, to access desired services. This ability is needed in order to make use
of services external to the NPN, or to continue the NPN service when devices move out of
the NPN, or to remain within the same NPN but to move to another geographic location.

A public network can provide connectivity when a device leaves NPN coverage, i.e. it
extends the NPN to other geographical locations. The public network can also be used to
access public network services while remaining connected to the NPN.

Whether or not an NPN is implemented as part of or as an extension to a public network,

or if an NPN has the capability to interact with public networks can have an impact on:
• Global connectivity, i.e. an NPN device can utilize public network services whenever it is
not in the service area of the NPN. It is inherently available in scenarios based on public
network subscription, whereas it otherwise requires a secondary public network subscrip-
tion. NPN devices need to be configured to automatically select the correct network
considering whether only NPN selection, or in addition public network selection applies.
In all cases, 3GPP-defined network selection processes apply.
• Service continuity, i.e. the ability of the NPN and the public network to act together to
provide seamless service continuity, such as non-interrupted streaming video, when a
device moves between the NPN and public network.

6.2 Quality of Service (QoS)

QoS requirements vary according to the deployment scenario (see ref [3] and [1] for more
detailed definitions):
• Latency (maximum permissible end-to-end latency, i.e. from the device to the data net-
work interface), ranging from highly stringent values (e.g. 1 ms or below) to modest
values (e.g. 100 ms). This is the maximum end-to-end latency permissible for the 5G
system to deliver the service where latency is completely attributable to the 5G system.
• Availability (the availability of a service that satisfies the defined QoS as a percentage of
time), ranging from stringent values (e.g. 99.999999%) to modest values (e.g. 99.9%).
The communication service is considered unavailable if it does not meet the applicable
QoS requirements (for instance, the system is considered unavailable if an anticipated
message is not received within a specified time).

In many deployment scenarios, the NPN and the public network will use the same infra-
structure and resources. Due to this sharing, traffic in one network may impact the traffic
in the other network unless proper traffic isolation is provided through isolation of network
resources. It is therefore necessary to consider the following two possible forms of isolation
to achieve the above mentioned QoS requirements:

11
1. Logical network resource isolation means that the NPN and the public network func-
tions, although sharing a common physical network infrastructure, cannot communicate
with each other. This can be achieved thanks to efficient resource allocation mechanisms
(e.g. through network slicing).
2. Physical network resource isolation indicates that the network resources for the NPN and
for the public network are physically segregated from each other.

Since the QoS in both networks are influenced by the degree of traffic isolation as described
above, the different deployment scenarios are evaluated from an isolation point of view.

6.3 Operation and Management (O&M)

The specific NPN deployment scenario can impact how OTs can operate and manage the
NPN, i.e. whether and how they can statically or dynamically create, configure, scale and
operate network functions, and the ability to capture important network and service infor-
mation. This might be needed e.g. to meet the specific needs of an automated factory
process. Operation and management (O&M) functions to be addressed include:
• Access to monitoring data: This refers to the ability of OTs to monitor the NPN in real
time. It may include e.g. monitoring the QoS of traffic for critical applications, the com-
munication and connectivity status and general service availability of devices and net-
work equipment, etc. The information captured may be used for observance of agreed
QoS, data analytics, safety management, and troubleshooting. Isolated NPN operated by
the OT provides direct access to this data. When the NPN and the public network share
the same infrastructure, it may be necessary to expose 3rd party Application Program-
ming Interfaces (APIs) in the network to provide access to this information.
• Access to O&M functions: This refers to how much control and freedom the OT has to
operate and manage the NPN and its functions, such as the ability to create, delete,
configure, monitor and troubleshoot dedicated NPN functions in order to meet the OTs’
service needs. OT operating an Isolated NPN is responsible for the O&M and has full con-
trol of all functions. Consideration also needs to be given to the simplicity and feasibility
of the operation and management functions in real time. Again, when the NPN and the
public network share the same infrastructure, it may be necessary to expose APIs in the
network to provide access to these functionalities.

6.4 Privacy & Security

Strong privacy and security are important for industrial deployment scenarios to ensure
data confidentiality and data integrity, including authentication and access authorisation,
as well as dependability and trustworthiness. In this context privacy means, to decide what
information goes where. Security offers the ability to be confident that those decisions are
respected. In different branches and industries, security and privacy policies differ. Several
policies can be driven with different deployment scenarios. The degree of privacy is mainly
influenced by the degree of isolation (physical as well as logical) of data, control and man-
agement. Therefore, isolation of data, control and management are considered as service
aspects to assess the privacy compliance of the different deployment scenarios. Additional
consideration is also needed on how the selection of security mechanisms and network
deployment scenarios relate.

12
The chosen deployment scenario impacts the following privacy and security aspects:
• Data privacy through isolation: Data in the NPN and the public network need to be seg-
regated (physically or logically) and processed separately, in order to fulfil the security
and privacy requirements of both networks. Note that the OT data includes not only the
user payload data, but also operational data such as subscriber identities, number of
active devices, devices identities etc. Network resource isolation (physical and/or logical)
as described in the above sub-section, can be a means to provide the isolation of user
payload data but not necessarily the operational data. Consideration also has to be given
to the infrastructure used to transmit and possibly store data in the NPN, and to safe-
guarding the privacy of the OT company and other users of the public network, especially
with regard to possible visibility into the volume of data traffic in the NPN, and when
this traffic is taking place.
• Control and management privacy through isolation: This service aspect relates to the
degree of segregation/isolation of the control and management plane functions of both
networks for privacy and security reasons. This isolation can be provided through network
resource isolation (physical and/or logical) as described in the above sub-section and/or
through 3rd party APIs.
• Flexibility in choice of security mechanisms: There is a need for flexibility in terms of
selecting and administering security mechanisms. The degree of flexibility depends upon
the network type, i.e. public or non-public. With NPNs, attention needs to be given to
the use of USIM and/or certificates for device authentication and identification, and for
access authorisation. Dedicated NPN certificates can be administered locally, and may
allow greater security customisation whereas USIM-based authentication allows devices
to also access public networks. The same considerations apply to the selection of algo-
rithms for data confidentiality and integrity. Additionally, it may be necessary to enable
lawful interception, depending on the deployment scenario and country of operation.
• Global availability of security mechanisms: There may be a need for a globally avail-
able single security mechanism to minimize administration, and to aid interoperability.
The selected deployment scenario affects how universally security mechanisms can be
assumed to be available.

13
7 Conclusions
This paper describes a number of network implementation options for NPNs based on 3GPP
specifications. These range from completely self-contained standalone NPNs (section 5.2)
that have no connection to the public network, to NPNs that are hosted entirely by public
network operators (section 5.3.3). Between these two extremes, there are a number of
other options.

It is important to highlight that all 3GPP-specified services are available in all deploy-
ment scenarios presented in this paper, but the service attributes are delivered to varying
degrees of compliance in each scenario.

Parties (in most instances, OT companies) interested in implementing or using NPNs should,
through careful analysis, identify which use cases are business-critical for them, and what
service requirements those use cases have. It is also essential to consider what effort and
resources they are willing to invest in implementing and operating an NPN, and to identify
the degree of security needed for their mission-critical data in the long term.

Any interested party should address the following questions:

1. What is the maximum round-trip delay my data can tolerate?
2. Is it acceptable for my data to leave my defined premises / my IT environment, i.e. can an
external network operator be trusted with my data?
3. Is it acceptable for an external party, i.e. a network operator, to know the number and
location of my devices even if my data are kept within my defined premises / my IT envi-
ronment?
4. Do I need device connectivity within my premises (and immediate surroundings) only, or
globally as well, e.g. in road vehicles / trains, in other countries, at my customer’s site,
etc.?
5. Do I have the financial resources and manpower to build / operate an NPN network on
my own, or would buying it in the form of a service be a better option?
6. Can I secure adequate guarantees (SLAs and transparency) to ensure my service require-
ments are met end-to-end, across all network resources, e.g. radio resources, network
nodes, communication links, etc.?

This list is not exhaustive, but answering these questions may help potential user organi-
sations to draw up a shortlist of viable options, and to evaluate the shortlisted options in
collaboration with network service providers.

Annex 2 provides a more thorough analysis on the degree of compliance with each service
attribute in the deployment scenarios.

14
8 Keywords and abbreviations
3GPP The 3rd Generation Partnership Project (international body
responsible for defining 5G specifications/standards)
5G-ACIA 5G Alliance for Connected Industries and Automation
API Application programming interface (a defined interface between two
software systems. In this context between networks for information
exchange and control purposes)
APN Access point name (identifier for the data network, where connection
through 5G system is provided)
Control plane Logically separate area of a 3GPP system, where control functions
and interfaces operate. These are used for controlling the service
provided to devices, such as connectivity.
ICT Information and communications technology
IoT Internet of Things
IIoT Industrial Internet of Things
IT Information technology
Management plane A logically separate area of 3GPP system where O&M functions and
interfaces operate
Mobile broadband Broadband connectivity service provided by a 5G system
Network slicing Network slicing is a means of providing “a network within a
network” for the delivery of specific services, and to achieve
varying degrees of segregation between the various service traffic
types and the network functions associated with those services.
NPN Non-public network (a 5G network that is used to provide dedicated
services to defined, closed group of devices)
NPN ID NPN identity (identifier assigned to the NPN)
O&M Operation and management (a set of 3GPP system functions
and interfaces for configuring, managing and operating
the 5G system)
OT Operational technology
Public network Network employed to provide services for devices used by the
general public
QoS Quality of service
RAN Radio access network
SLA Service level agreement
TS Technical specification (the normative and binding specifications
defined and published by 3GPP)
User plane A logically separate area of a 3GPP system, where functions and inter-
faces for transferring payload data sent to and from devices operate
USIM A universal subscriber identity module (an application on a
physically secured device that is used to access network services in a
secure way)

15
9 References
[1] 5G for Connected Industries and Automation, White Paper, 5G Alliance for Con-
nected Industries and Automation (5G-ACIA), November 2018
[2] 3GPP TS 23.251 v15.1.0 Network sharing; Architecture and functional description.
Latest version available at: http://www.3gpp.org/ftp/specs/archive/23_series/23.251/
[3] 3GPP TS 22.104 v16.0.0, Service requirements for cyber-physical control applica-
tions in vertical domains, Stage 1. Latest version available at: http://www.3gpp.org/
ftp/SPecs/archive/22_series/22.104/
[4] 3GPP TS 23.501 v15.4.0. System architecture for the 5G System, Stage 2. Latest
version available at: http://www.3gpp.org/ftp/Specs/archive/23_series/23.501/

16
10 Annex 1 - Mapping of logical network elements to the
3GPP-defined architecture

For the sake of simplicity, the logical network elements shown and described in this paper
are an abstraction of the architecture defined in 3GPP TS 23.501 [4]. Figure 5 below shows
how these relate to each other. The 3GPP architecture is depicted by black lines. The beige
lines surround multiple 3GPP functions and build a visual link to the corresponding single
logical element used in this paper. Please refer to section 5.1 for further explanations of
the notation used.

Fig. 5: Mapping to 3GPP system architecture

NSSF NEF NRF PCF AF UDM

Nnssf Nnef Nnrf Npcf Naf Nudm

Nausf Namf Nsmf

AUSF AMF SMF

N1 N2 N4

UE (R)AN N3 UPF N6 DN
N9

Source: 5G-ACIA

It should be noted that the 3GPP-defined architecture shown here is itself a simplification.

17
11 Annex 2 - Service attribute degree of compliance in net
work scenarios
The degree of compliance with the service attributes described in section 6 is given in a
table for each scenario. The degree is either “high”, “medium” or “low”. High compliance
indicates that the service in question is fully supported with existing standardized network
and device functions without further adaptations. Low compliance indicates that the service
is either not supported or only supported with significant adaptations. Such adaptations
are e.g. deployment and configuration of multiple NPN IDs and credentials on devices
and networks, integration of security gateways to interconnect networks, administration
and deployment of non-USIM based security mechanisms, or roaming agreements between
two or more parties. Medium compliance indicates that a service is supported under cer-
tain conditions or with some adaptations. Clarifying comments are given in the evaluation
table explaining the conditions and adaptations needed to reach the respective degree of
compliance.

Degree of compliance

Standalone non-public Non-public network in conjunction with public networks

network

Service attribute Isolated deployment Shared radio access Shared radio access NPN hosted by the public
network network and control plane network

Global Low / high Low / high High High

Device connectivity

connectivity
Low when devices can Low when devices can Public network subscripti- Public network subscription
connect to the NPN only, connect to the NPN only, on can be used for global can be used for global con-
and there is no direct and there is no direct connectivity, e.g. via nectivity, i.e. via roaming.
connection to the public connection to the public roaming.
network. network.
High when an optional High when an optional
connection to the public connection to the public
network and a public network and a public
network subscription are network subscription are
in place. This requires in place. This requires
additional configuration additional configuration
in NPN devices for auto- in NPN devices for auto-
matic network selection. matic network selection.

Service Low / medium Low / medium High High

continuity Low when devices can Low when devices can Because the public net- Because the public network
connect to the NPN only connect to the NPN work hosts both networks, hosts both networks, service
only and cannot directly and cannot directly service continuity can be continuity can be achieved
connect to the public connect to the public achieved relatively easily relatively easily.
network. network. between the NPN and the
Medium when optional host public network.
connection to the public Medium when there is an
network and a public optional connection to
network subscription are the public network and
in place. The service must the device has a public
support device mobility. network subscription.
The service must support
device mobility.

18
 Latency and High High / medium High / medium High / medium /low
QoS

availability
High because this deploy- High if traffic isolation is High if traffic isolation is This deployment scenario
ment scenario provides provided through logical provided through logical provides traffic isolation
traffic isolation through network resource isolati- network resource isolation through logical network
physical network resource on in the shared RAN (via in the shared RAN (via ef- resource isolation on all
isolation. efficient resource alloca- ficient resource allocation network segments (via
tion mechanisms). mechanisms and network end-to-end network slicing).
slicing), or if a dedicated Because NPN data and net-
Medium if the resource
RAN is used to allow phy- work functions are external
allocation mechanisms
sical isolation and traffic to the defined premises, i.e.
in the shared RAN do not
isolation for the user factory, this may result in
fully take into account
plane traffic. an inevitable degradation
the QoS requirements of
in latency (which – among
both networks. Medium if the resource
other factors – depends on
allocation mechanisms
Note that in this de- the distance between the
in the shared RAN do not
ployment scenario, the factory and the public net-
fully take into account the
network segments other work premises). The degree
QoS requirements of both
than RAN provide traffic of compliancy for latency
networks.
isolation through phy- depends on the service
sical network resource Note that in this deploy- requirement level. For very
isolation. ment scenario, the net- stringent latency require-
work segments other than ments (e.g. 1ms) it is low.
RAN and control plane However for moderate to
provide traffic isolation modest latency values (e.g.
through physical network 10-100ms) it may be consi-
resource isolation. dered as medium to high.
The degree of compliancy
for a very stringent avai-
lability requirement may
be considered to be low
if required in combinati-
on with a very stringent
latency requirement, and
medium to high if required
in combination with a mo-
derate to modest latency
requirements.
For a moderate to modest
availability requirement,
compliancy may be medium
or high, depending on the
latency requirement.

19
 Access to High / medium High / medium High / medium High / medium
Operation and management

monitoring
High when NPN operator High when the NPN ope- High when the NPN ope- High when the NPN ope-
data and
has full access to its mo- rator has full access to rator has full access to rator has full access to its
O&M
nitoring data and O&M its monitoring data and its monitoring data and monitoring data and O&M
functions
functions/tasks, e.g. in O&M functions/tasks. In a O&M functions/tasks. In a functions through 3rd party
the case an isolated NPN shared infrastructure, this shared infrastructure, this APIs deployed in the public
is operated by the OT. can be achieved through can be achieved through network.
3rd party APIs deployed 3rd party APIs deployed in
Medium when the NPN Medium when the NPN
in the network. the public network.
operator has only de- operator has delayed access
layed or limited access to Medium when the NPN Medium when the NPN to required information and
required information and operator has delayed ac- operator has delayed ac- functions, e.g. due to lack
functions, e.g. due to a cess to required informa- cess to required informati- of support because of the
lack of support from the tion and functions, e.g. on and functions, e.g. due way the network has been
NPN or lack of adequate due to lack of adequate to the conditions of the implemented (lack of 3rd
remote access. remote access or due to network sharing agree- party APIs).
the conditions of the RAN ment between the NPN
Note that with network
sharing agreement bet- operator and the public
slicing, the NPN operator
ween the NPN operator network operator.
may be responsible for
and the public network
some or all network slice
operator.
management tasks. The
choice of network slice ma-
nagement model depends
on the bilateral agreement
between the operator of the
NPN and the operator of
the public network.

Data High High Medium Medium

Privacy & Security

privacy
Complete physical isolati- High since logical network Medium because the NPN’s Medium because the sub-
through
on. The NPN data is phy- resource and hence data user subscription and ope- scription data (e.g. profiles
isolation
sically isolated from the isolation can be provided rational data (e.g. active of OT active assets) of both
public network data. in the shared RAN. assets) are accommodated networks share the same
in the public network core. database accommodated in
Note that the data of both
Note that the data of both the public network although
networks shares the RAN
networks share the RAN RAN and core network are
through a logical isolation
and the control plane logically isolated.
but not a physical isola-
through a logical isolation
tion. Still, it´s difficult to
and that the user plane
get information on pro-
data of both networks are
duction activities based on
physically isolated.
data on RAN level without
subscription and operatio-
nal data. Note also that in
this deployment scenario,
the network segments
other than RAN provide
physical data isolation.

20
Privacy & Security

Control and High High High / medium High / medium / low

management
Complete physical isola- High since logical network High when control and Degree of compliance de-
privacy
tion. resource isolation in the management planes for pends on the way the public
through
shared RAN enables the the NPN (resp. for the network is implemented,
isolation
possibility of providing PLMN) are exclusively especially the segregation
a logical isolation of the deployed and used for the of network functions for the
control and management NPN (resp. by the PLMN). NPN and the public network
functions. This can typically be achie- as well as the setting up of
ved through 3rd party 3rd party APIs deployed in
Application Programming the public network.
Interfaces (APIs) deployed
For network slicing, the
in the public network.
choice of slice management
Medium if control and model depends on the bi-
management functions lateral agreement between
are performed by a single the operator of the NPN and
operator for both networks. the operator of the public
Most naturally, this would network.
be the public network
operator.

Flexibility High / low Low Low Low

in choice
High when accessing only Low when devices only Low because USIM-based Low because USIM-based
of security
the NPN since either USIM access the NPN or also credentials are always credentials are always re-
mechanisms
or non-USIM-based me- utilise public network required when devices quired when devices connect
thods can be employed. services since, due to the connect to the public net- to the NPN and/or to the
shared RAN, a mandatory work and/or to the NPN. It public network. It may also
Low when devices utilise
authentication method may also be necessary to be necessary to enable law-
also the public network
(USIM-based) needs to be enable lawful interception, ful interception, depending
services since a mandato-
deployed for each device. depending on regulatory on regulatory imperatives
ry authentication method
It may also be necessary imperatives for the specific for the specific deployment
(USIM-based) is employed
to enable lawful inter- deployment scenario. Note scenario.
for each device. It may
ception, depending on that NPN’s user subscripti-
also be necessary to allow
regulatory imperatives for on data (e.g. active assets)
lawful interception, de-
the specific deployment are accommodated in the
pending on the regulatory
scenario. public network core.
imperatives for the speci-
fic deployment scenario.

Global Medium / high High High High

availability
Medium when accessing Public network security Public network security Public network security fea-
of security
only the NPN since the features are available features are globally avai- tures are globally available.
mechanisms
NPN operator can select globally. lable.
customized security me-
chanisms, but these may
only be available locally.
High when using public
network security mecha-
nisms that need to be
used for accessing public
networks, which are glo-
bally available.

21
11 5G-ACIA members

TM

TM

HHI IIS

TM

22
5G Alliance for Connected Industries and
Automation (5G-ACIA),
a Working Party of ZVEI
Lyoner Strasse 9
60528 Frankfurt am Main, Germany
Phone: +49 69 6302-424
Fax: +49 69 6302-319
Email: [email protected]
www.5g-acia.org