An NE is typically connected to the operator's network according to one of the following scenarios: In Figure 4.1.2.1-1, the NE is connected directly to a network controlled by the operator. The NE can use IP Infrastructure services (DHCP Server, DNS Server, etc.) in the Non-secure Operator Network. The Operator has full control of these nodes. One or more Security Gateways protect the Secure Operator Network from malicious NEs. Within the Secure Operator Network, there are also IP Infrastructure nodes.

In Figure 4.1.2.2-1, the NE is connected to a network controlled by an entity external to the Operator. In contrast to the first scenario, the IP Infrastructure nodes in the External Network are not fully controlled by the operator. In both cases, the NE needs to traverse the Security Gateway(s) to access the nodes in the Secure Operator Network.

In accordance to clause 9.2 of TS 33.310 there are two options how to obtain the operator root certificate: The required pre-provisioning in option 1 is against the basic idea of PnC to minimize pre-provisioning. Therefore from the PnC perspective Option 2 is more interesting. From a security point of view the following considerations are relevant:

• Option 2 has the risk that during the CMP initialisation a man-in the middle attack could take place. In order to be successful, such an attack happens timely during the actual CMP initialization run and the attacker has access to the access network between NE and RA/CA.
  This risk can be assessed as acceptable, given (a) the risks which are present at Options 1's prior provisioning - see below, (b) the short time window of vulnerability, (c) the closed access networks of many operators. In addition, most attacks will only lead to inability of the NE to connect to the network, or to misuse of the new NE by the attacker. The operator should notice it soon if the NE does not connect and will investigate the issue.
• Option 1 avoids the above "time window of vulnerability". On the other hand, it requires pre-provisioning of the operator root certificate, either in factory or on-site by service personnel. There is the risk of a security leak during the provisioning of the root certificate within the vendor / commissioning environment.

It seems questionable from a security point of view to allow option 2 also in public Internet (without operator-trusted access network). There the attacks stated above are more probable, and an attacker may even install some (static) catching or spoofing equipment in the public Internet to always capture such "initialization requests". It is up to the network operator to choose the option with is preferable from his point of view (risk assessment, Plug and Connect importance). The enrolment of NE shall use the CMPv2 protocol as specified in RFC 4210 and RFC 4211. Security mechanism is further specified in clause 9.3 of TS 33.310.

There could be one or more RA/CA server, e.g. one per NE vendor. If more than one RA/CA server is deployed with one RA/CA server per vendor then the vendor identification would be needed either in the FQDN of the RA server or in the information from the IP AutoConfiguration Service carrying the information about RA/CA server.

There could be one or more OAM SeGW, e.g. one per NE vendor. If more than one OAM SeGW is deployed with one OAM SeGW per vendor then the vendor identification would be needed either in the FQDN of the OAM SeGW or in the information from the IP AutoConfiguration Service carrying the information about OAM SeGW.