Domain Segmentation, Trust Federation and Performance Trade-offs for the Future Railway Mobile Communication System

The Future Railway Mobile Communication System (FRMCS) will replace the Global System for Mobile Communications – Railway (GSM-R) as the communication backbone of the European Rail Traffic Management System (ERTMS). FRMCS inherits strong 5G security mechanisms: concealed subscriber identities, mutual authentication, and secure inter-domain signalling; however, its deployment across national and infrastructure-manager boundaries introduces architectural and governance trade-offs. This paper combines architectural analysis with quantitative modelling of (i) domain segmentation as a containment control, (ii) roaming architectures (home-routed vs. visited-routed/local breakout), and (iii) boundary-driven rekeying overhead. Results show that segmentation materially limits lateral compromise propagation, while visited-routed roaming substantially reduces latency compared to home routing. However, excessive fragmentation increases boundary crossings and rekeying events, yielding a measurable resilience–operational-complexity trade-off. These findings are discussed in the context of wider implementation and motivation for a federated Railway Trust Framework for cross-domain assurance.