Private 5G Security

Private 5G — formally a Non-Public Network (NPN) in 3GPP terminology, either Stand-alone (SNPN) or Public-Network-Integrated (PNI-NPN) — is a 5G standalone deployment owned and operated by an enterprise, campus, industrial site, port, mine, military base or critical-infrastructure operator. The architecture is the same Service-Based Architecture as a public 5G core (AMF, SMF, AUSF, UDM, NRF, NSSF, UPF and optionally SEPP), but the trust model and the integration boundary are very different from a Tier-1 carrier deployment.

The risks worth taking seriously fall into four buckets. SBA hardening: the NFs are HTTP/2 + JSON services protected by TLS and OAuth2, deployed in a small operations team's environment rather than a Tier-1 SOC, so misconfiguration of NRF service discovery, AMF/SMF API exposure and AUSF/UDM credential handling is the dominant failure mode. Identity and authentication: SNPNs use 5G-AKA or EAP-AKA' / EAP-TLS, often with credentials provisioned outside the traditional SIM-vendor chain — getting SUPI / SUCI handling right matters as much here as on a public network. Slice and tenant isolation: where multiple business units, OT vendors or applications share the same private core via network slicing, slice-isolation gaps become cross-tenant compromise paths. Integration boundary: PNI-NPNs integrate with a public MNO over standardised interfaces (roaming, neutral-host, AMF relocation), and the perimeter — typically a SEPP for N32 — has to be treated with the same rigour as a public carrier's interconnect.

The reference baselines are 3GPP TS 33.501 (5G security architecture, applicable to public and private 5G alike), TS 23.501 (NPN deployment models), and the GSMA 5G security guidelines for the public-integration boundary. Validation under real attacker traffic is covered in 5G Penetration Testing; the underlying architecture is in the 5G Security hub; the broader Open RAN angle, relevant when the private 5G RAN is disaggregated, is in Open RAN Security.