# How to Isolate Non-Public Networks in B5G: A Review
## 5 CN Isolation  
CN isolation means that an NPN should not set up signal and data sessions for the subscribers of other NPNs, and it runs the software of its CN with logical-isolated computing resources, where the infrastructures are shared among multiple NPNs. With CN isolation, multiple logical standalone links between the CNs can be established and operated economically. In spite of this, there are two serious challenges: distinguishing data from different NPNs and their terminals and assigning the minimum computing resources to meet the QoS requirements of the CNs. To achieve this, there are two key aspects. One is to identify the NPN and its subscribers. The other is calculating the minimum resource demand of one CN, then assigning the minimum computing resources using virtualization technologies, such as KVM, VMware and Docker. For the first aspect, 3 GPP defines a new identifier for each S-NPN, which can be a combination of a public land mobile network identity (PLMN ID) and a network identifier (NID). Then, the identifications of subscribers and S-NPNs are configured and stored in both the terminal and the CN sides. Thus, an S-NPN can recognize the subscribers and vice versa. Furthermore, a cell access group (CAG) can also be designed for PNI-NPNs, where the CAG represents a group of subscribers that can access one or more CAG cells, and the CAG cell is one kind of cell that only its subscribers can access. Then, one CAG can be identified by the combination of the PLMN ID and CAG ID, and the CAG information is stored at the CN side to recognize the subscribers of each PNI-NPN. At the same time, each terminal also stores one list of CAG cells it can access. Thus, one PNI-NPN can recognize its subscribers and vice versa. Using the identifier of the S-NPN and the CAG of the PNI-NPN, the terminals will only be served by the subscribed NPNs. Then, virtualization of general computing resources, such as the CPU, is undertaken to run the tasks of CNs, which are usually time-insensitive. Virtualization technologies, such as KVM, VMware and Docker, can be used to map physical resources into logical resources [9]. Then, the CNs of different NPNs can own dedicated virtualized computing resources, which are assigned according to the resource demands and the virtualization overheads [9]. Thus, the resource demand of one CN needs to be calculated, and this equals the sum of the resources needed by all the function modules of this CN. To calculate the minimal resource demand of one function modularly, the QoS requirements should be considered jointly since they are independent [29]. We can use the calculation of a  
Figure 4: Virtualization of RAN based on DAG model. UPF's resource demand as an example, where two QoS requirements--i.e., forwarding throughput and delay--are considered. Since higher forwarding throughput is helpful to decrease delay, part of the resource demanded by a UPF to meet the forwarding throughput requirement can be used to fulfill the delay requirement, which is called redundant resource, as shown in Figure 5. To remove the redundancy, two weights for the resource demands corresponding to the two QoS requirements are derived using the method of the Person correlation coefficient [30], and these are smaller than one. Then, the resource demand of the UPF can calculated as the weighted sum of the two resource demands. Thus, the resource demand of an NPN's CN can be obtained. Then, the system decides whether the CN resources for one NPN should be shared with others according to the available resources after virtualization. If there are enough resources to meet the resource demands of the multiple CNs of the NPNs, the resource will be shared among the CNs; otherwise, more private or sharing infrastructures need to be deployed and turned on to serve the NPNs' CNs. If there is no more infrastructure, the system needs to deny requests to serve some of the NPNs until the available resources are enough for all the CNs.