Non-Public Networks (SNPN & PNI-NPN) in 5G NR

Introduction

A Non-Public Network is a 5G network scoped to one organisation instead of the general public. 3GPP introduced NPNs in Release 16 (and extended them in Release 17) to serve the "private 5G" market: factories, ports, mines, hospitals, campuses and public-safety agencies that want the determinism, security and data-sovereignty of a network they govern themselves. Nothing about the radio changes — an NPN uses the same NR air interface, the same SSB, RACH and PDSCH — what changes is who owns the core, who is allowed to attach, and where the user-plane data flows.

The concept sits at the architecture and subscription layer, and it shows up in the UE's lifecycle at two moments: network selection (does this device even look for, or accept, this network?) and access control (is this device allowed on this cell?). Everything else — sessions, QoS, mobility — then runs as normal 5G once the device is admitted.

3GPP defines exactly two ways to build an NPN, and the entire topic hangs off telling them apart: a fully independent Standalone NPN (SNPN) with its own core and credentials, or a Public Network Integrated NPN (PNI-NPN) carved out of a public operator's network using slicing and access-group gating. This page walks both, the identifiers that distinguish them, how the UE selects and is admitted, and how each keeps data on site.

Why a Non-Public Network is needed

An NPN is a 5G network intended for the exclusive use of a defined organisation — an enterprise, an industrial site, a public-safety agency — rather than for the general public. The point is not just private ownership; it is control: over who may attach, over where the user-plane data flows, and over the radio and QoS the site's own devices receive. A consumer PLMN optimises for coverage and subscriber volume; an NPN optimises for one campus and one set of machines.

The whole subject collapses into one question: does the enterprise run its own core network, or does it ride on an operator's public core? The answer splits every NPN into one of two families. A Standalone Non-Public Network (SNPN) is a self-contained island — its own 5GC, its own NG-RAN, its own subscription and credential store, deployed and operated independently of any public PLMN. A Public Network Integrated NPN (PNI-NPN) is realised on top of a public PLMN, using a network slice for logical separation and a Closed Access Group to control which cells the enterprise's devices may camp on. Same goal — a private network for one organisation — reached by opposite means.

SNPN — the Standalone Island

An SNPN is a complete 5G System owned and run by the NPN operator. It has its own NG-RAN and its own 5GC — AMF, SMF, UPF, AUSF, UDM and the rest — and it does not depend on any public network to authenticate its devices or forward their data. Because it is a standalone system, it cannot be identified by a public PLMN ID alone; instead it is identified by the combination of a PLMN ID and a Network Identifier (NID). That PLMN ID may be a value reserved for private use (3GPP/ITU set aside MCC 999 for private networks, so SNPNs need not collide with public operators), and the NID distinguishes one SNPN from another sharing the same PLMN ID.

The NID is a 44-bit value carried alongside the PLMN ID in the cell's broadcast, and it comes in one of two assignment modes (TS 23.003). In assignment mode 0 (self-assignment) the operator picks the NID itself and uniqueness is not guaranteed — fine for an isolated site. In assignment mode 1 (coordinated assignment) the NID is drawn from a coordinated pool so that PLMN ID+NID is globally unique — needed when SNPNs must interwork or avoid clashes. A cell can broadcast up to twelve PLMN ID+NID combinations, so one radio can advertise several SNPNs at once.

SNPN operation is a distinct mode in the UE. A device that supports it holds an SNPN access mode; when that mode is on, the UE selects and registers only on SNPNs — it uses NID-aware selection rather than ordinary public PLMN selection, and it will not treat public cells as candidates. The UE keeps a list of subscribed SNPNs (each entry a PLMN ID + NID with its associated credentials) and chooses among them. This is why a phone bought for the public network does not simply wander onto a factory's SNPN: without SNPN access mode and a matching subscription, the SNPN is invisible to it.

Credentials and subscriptions in an SNPN belong to the SNPN. The device authenticates against the SNPN's own UDM/AUSF using the SNPN's key material. 3GPP allows this to be a normal 5G-AKA credential on a USIM, but it also explicitly supports non-AKA methods — for example EAP-AKA', or certificate-based EAP-TLS with key material held outside a USIM — because many enterprises want to issue their own certificates or use their existing identity systems rather than provision SIM cards. Any key-generating EAP method that fits the framework is permitted for SNPN primary authentication.

The result is a network an enterprise can own end to end: it decides who is provisioned, it runs the authentication, and — as the next section shows — it keeps the traffic on site.

PNI-NPN — Private on Top of a Public Network

A PNI-NPN takes the opposite approach: instead of building a separate core, the enterprise's private network is hosted on a public PLMN. The operator carves out a network slice (one or more S-NSSAIs) dedicated to the enterprise, so the private traffic gets its own logical set of functions, QoS and — often — a dedicated UPF. Slicing gives logical separation, but slicing alone does not stop a random public subscriber's device from camping on the enterprise's cells. That is the job of the Closed Access Group.

A Closed Access Group (CAG) identifies a group of subscribers who are permitted to access one or more CAG cells. Each CAG is named by a CAG ID (a 32-bit identifier). A cell that is part of a PNI-NPN broadcasts one or more CAG IDs (in SIB1, within the cell-access-related info); a UE authorised for the enterprise carries a CAG list (the Allowed CAG list) in its subscription, delivered from the UDM. The UE may select and access a CAG cell only if one of that cell's broadcast CAG IDs appears in its allowed list. The subscription can also carry an indication that the UE is allowed to access only CAG cells — preventing an enterprise-only device from attaching to ordinary public cells at all.

Because a PNI-NPN reuses the public core, the enterprise does not have to operate AMFs, UDMs or authentication — the operator does. Subscribers use their normal public PLMN credentials; there is no separate NID. The trade is control for convenience: less to run, but the core is the operator's, and separation rests on the slice and CAG configuration rather than on a physically independent network.

SNPN vs PNI-NPN, Side by Side

The two flavours differ on every axis that matters to an enterprise architect — identity, who owns the core, where credentials live, how access is controlled, and therefore when to choose each. This table is the heart of the topic.

Read the table top to bottom and a theme emerges. Everything in the SNPN column is owned by the enterprise; everything in the PNI-NPN column is borrowed from the operator with a fence around it. Neither is universally better. A defence site or a mine with no reliable public coverage leans SNPN. A retailer or a warehouse chain that wants a private slice but no telecom operations team leans PNI-NPN.

The Identifiers: PLMN+NID, CAG ID and Selection

NPNs add a small vocabulary of identifiers on top of the ones you already know from public 5G. Getting them straight is most of understanding how selection and access control actually work.

Selection differs sharply between the two. In an SNPN, the UE in SNPN access mode performs network selection over PLMN ID+NID pairs it is subscribed to (or GIN-based selection when using a Credentials Holder) — automatic (from its subscribed SNPN list) or manual (choosing a broadcast SNPN name). Public PLMN selection rules do not apply while in SNPN access mode. In a PNI-NPN, ordinary PLMN selection still runs — the UE finds the public PLMN as usual — but cell (re)selection and access are then filtered by CAG: the UE evaluates each cell's broadcast CAG ID(s) against its Allowed CAG list, and if the subscription says "CAG-only" it refuses non-CAG cells entirely.

Isolation, Local Data and the Edge

The reason enterprises want an NPN at all usually comes down to two words: keep it here. Keep the data on the premises, and keep outsiders off the network. NPNs deliver both, though by slightly different mechanisms in each flavour.

For data locality, the tool is the UPF. In an SNPN the entire core — including the UPF — sits on site, so by construction the user-plane traffic for a factory's machines never leaves the factory; it goes UE → gNB → local UPF (over N3) → the on-prem data network over N6. In a PNI-NPN, the control plane may live in the operator's core, but the operator can place a local UPF at the enterprise site and configure the slice for local breakout (a PDU-session anchor or ULCL/branching-point UPF on site), so the enterprise's application traffic exits to an on-premises DN without back-hauling to a central data centre. Either way the outcome the enterprise cares about is the same: low, deterministic latency to local applications, and sensitive data that physically stays on the campus.

For isolation, the SNPN gets it for free — a separate network is separate. The PNI-NPN builds it from the slicing toolkit: a dedicated S-NSSAI gives separate logical functions and QoS, the CAG keeps unauthorised UEs off the cells, and transport-network techniques (VLANs, segment routing) isolate the path between site and core. This is exactly the isolation stack from network slicing, applied to one enterprise tenant.

Use Cases: Factory, Campus, Port

The theory lands hard in a few concrete settings, and the choice between SNPN and PNI-NPN usually follows the site's constraints rather than a doctrine.

The smart factory. Automated guided vehicles, robot arms and machine-vision cameras need low, predictable latency and cannot tolerate a control command being delayed behind someone's video stream. The factory also does not want production data on an operator's servers. This is the canonical SNPN case: a self-contained core on site, a local UPF anchoring the control loop, and enterprise-issued credentials (often certificate-based via EAP-TLS) for thousands of devices. If the site prefers not to run its own core, the same factory can be a PNI-NPN: a URLLC slice with a local UPF for breakout and a CAG keeping the AGVs on the private cells.

The enterprise or hospital campus. A large campus wants private, high-quality indoor coverage for staff devices, badge readers, medical equipment and asset trackers, plus seamless movement onto the public network when people leave the site. Because wide-area interworking matters and the enterprise would rather not operate telecom, this often suits a PNI-NPN: the operator runs the core, a dedicated S-NSSAI isolates the campus traffic, and a CAG gates the on-campus small cells. Sensitive clinical data still stays local through an on-site UPF.

The port or mine. Ports and mines are large, often in areas with poor public coverage, and run cranes, straddle carriers and remote-controlled equipment that must not lose their link. Independence from public networks is a feature, not a bug — so these lean SNPN, with the whole system on site and no reliance on an operator being reachable. The NID cleanly names the site's network, and on-prem data locality is automatic.

Summary

An NPN is a 5G network for one organisation, and the whole topic reduces to one fork: own the core or borrow it. An SNPN is a standalone island — its own 5GC and NG-RAN, identified by PLMN ID+NID (a 44-bit identifier, self- or coordinated-assigned), entered only by a UE in SNPN access mode, with credentials the enterprise controls (5G-AKA or non-AKA EAP, optionally via an external Credentials Holder, bootstrapped through ON-SNPN/PVS onboarding). A PNI-NPN is a private slice on a public PLMN: an S-NSSAI for logical separation and a Closed Access Group (CAG ID broadcast vs the UE's Allowed CAG list) for cell-level access control.

Keep the identifiers in their lanes: NID answers "which private network?"; CAG ID answers "may this UE use this cell?"; S-NSSAI answers "which logical slice/QoS?". Data locality is delivered the same way in spirit — a UPF on site — but for free in an SNPN (the whole core is local) and via a configured local breakout in a PNI-NPN.

Choosing between them is a governance decision, not a technical one: sovereignty, isolation and independence from public coverage push toward SNPN; operator-run simplicity and wide-area interworking push toward PNI-NPN. Both ride the same NR air interface underneath.