Private LTE/5G networks: how to ensure service continuity with public networks?

35 minutes ago

6 min read

By Benoit Mathian, CTO, Halys

At a port, factory or base, a private 5G network provides coverage across the site: devices perform well, business applications respond quickly, and your data stays within your environment.

That changes when a field worker passes through the gate while a scan is in progress, a group call is active or a business application is open. Once outside private network coverage, the device may connect to another network without regaining the network environment and services available on site. At best, service deteriorates; at worst, the device becomes unreachable.

Regaining a signal outside the site is therefore not enough. Services must also remain available when the device switches to another network.

From private to public networks: what happens to services?

A private network provides control; a public network provides coverage. Combining them makes sense when users work both on site and elsewhere. However, what happens when a device moves between the two must also be addressed.

Take a field tablet: its business application, group voice communications, security policies and monitoring are configured within the private core. When the worker leaves the coverage area, the device may regain a signal through a public 4G network, Wi-Fi or, in the future, satellite access.

Several arrangements can support this transition, each with its own merits:

Two subscriber identities on the SIM card, with a switch from one to the other when leaving the site. If the operator links both identities to the same phone number, calls and SMS remain available and the user stays reachable.
A single identity associated with a public operator’s core network, with traffic routed back to the site over a dedicated connection.
Full anchoring in the private core: outside the site, the public network treats the device as a roaming subscriber and forwards its traffic to the private core, which continues to manage its identity, sessions and services.

The number of identities is not the deciding factor. What matters is who manages them and who links them together. When the public operator does so, reachability is maintained, but the telecom identity remains under its control. Switching identities takes a few seconds and interrupts the current session: the number is retained, but the ongoing communication may not be.

Depending on the arrangement, a tablet that has regained a signal may therefore not have regained its policies, services or monitoring. For a sensor transmitting a reading, this may be sufficient. For a worker who relies on business applications, restoring connectivity is not enough if the services associated with the private network do not remain available.

Routing data back to the site does not mean that the telecom identity is also managed there. Data can travel over a dedicated connection and remain isolated, while the phone number (MSISDN) and voice, SMS and MMS services remain associated with the network that issued the SIM card. Data sovereignty and identity sovereignty are two distinct matters. “Regaining a signal” alone therefore tells you little about what actually happens to the services.

Connectivity continuity and anchoring continuity: what’s the difference?

One device, multiple access networks, a single anchor point in the private core.

Connectivity continuity maintains a signal: the device remains reachable, regardless of the access network used.

Anchoring continuity keeps the device connected to your core: the access network simply provides transport, while identity, services and security remain managed within your environment.

When assessing a continuity solution, the key question to ask the provider is: when the device leaves the site, where is it anchored? This applies to data, but also to the phone number and communications.

Continuity depends on the core network

Keeping the anchor point stable as the access network changes is not enough. The private core must also be connected to public networks.

A private network does not automatically communicate with a public network. Interconnection is required to route traffic from a device using public 4G or Wi-Fi back to the private core rather than directly to the Internet. The principle is the same as roaming between operators. In practice, the private network must be able to interface with public networks as an operator would, using the same interfaces, signalling and interconnection points.

This is the role of the mediation layer. It provides the private core with an operator-grade gateway to the public network and translates the signalling required to make the transition between networks seamless from the device’s perspective. This layer is not limited to individual sites: an operator can provide it for its customers, and an integrator can incorporate it into its offering.

Continuity between private and public networks: questions to ask before choosing a solution

Not every use case requires the same level of continuity: a sensor that occasionally transmits a reading has different requirements from a worker on a group call. Several architectures can connect private and public networks, each with its own trade-offs. The outcome depends on the configuration choices and the provider selected. Before choosing a solution, clarify the following points with the provider:

Are subscriber identities, both the IMSI and the phone number (MSISDN) managed within your environment or by the provider? If the device has multiple identities, who links them so that the same number is retained?
Does the user retain the same number and services (voice, SMS, MMS) when leaving the site? What happens when they return? Does the ongoing communication survive the switch, or is only the number retained?
Are these services provided by your core network or by a third party?
If the connection to the provider is lost, can the site continue to operate independently?
Does continuity cover only data, or also telecom services such as voice, messaging and reachability?
Who is responsible for regulatory obligations, including lawful interception, and where is subscriber data stored?
Is a specific SIM card or identity required, and who owns it?

Continuity requirements vary according to your critical services. The issue is whether the solution simply allows you to “regain a signal” or to “retain control of your network”.

What remains under the private core’s control

When the anchor point remains in the private core, the elements that define the network continue to be managed there: subscriber identities, access rights, security and the traffic egress point. Subscriber data is the clearest example: the private core holds this data and authenticates the subscribers.

For a sensitive industrial site, a strategic port or a defence facility, this enables the organisation to retain control of its network when users move beyond its radio coverage. The organisation can then decide what remains local, what communicates with the public network and what never leaves the private environment.

Note: when a private network manages its own subscriber identities, it becomes an operator in telecom terms. It must then comply with the associated obligations, particularly those relating to lawful interception. We will revisit these obligations in a future article.

How Halys can help

There is no single architecture that fits every project. The choice depends on your critical services, sovereignty requirements and access provider. Halys, part of the Dakkom group, helps you address the questions above, then design and operate an architecture that meets those requirements.

Depending on the arrangement, Halys can provide these three building blocks, individually or together:

A 4G/5G core to maintain the anchor point. Devices remain connected to the private core when the access network changes.
A mediation layer to interconnect networks. It enables the private core to communicate with the networks used by the devices.
Centralised management. Identities, access rights, security and monitoring are managed within a single environment.

The building blocks remain the same; what changes is the architecture in which they are integrated, who hosts it and who operates it. An enterprise or an operator of vital importance (OIV, a French regulatory designation) deploys this architecture on site or in a dedicated hosted environment. An operator or MVNO hosts it within its infrastructure and adapts it to each customer to offer continuity between private and public networks as a service. An integrator adds it to its private network offering without having to develop the interconnection with public networks itself.

Halys works with you to define which services must remain available off site, which functions must remain local and which exchanges with the public network are required. The architecture is then designed with your operator or access provider where the project requires it.