# ZSM Framework for Autonomous Security Service Level Agreement Life-Cycle Management in B5G Networks
## 4 ETSI PoC
### 5G Core E2E Security Slice Deployment and Configuration  
In this section, we focus on how intent-driven security is utilized in the PoC, as described in Section 3.1, and aligned with the closed-loop operations presented in Section 3.2. Intent-driven security is employed to instantiate a cross-domain slice. In the PoC scenario depicted in Figure 7, a customer requests a private 5G network to interconnect employees and devices across different geographic areas with internal services. To achieve this, the deployment leverages a public gNB, dynamically establishing synchronization with 5G core NFs to enable on-demand cross-domain connectivity. Regarding security, the customer and the infrastructure provider establish an SSLA for the private 5G network. The SSLA specifies the following security objectives: data confidentiality and integrity for external connectivity with the RAN, protection against inappropriate use of resources in the 5G core, and some contextual information such as the geographical area where employees require coverage.  
Figure 8 maps the PoC scenario into the ZSM architecture. Two distinct SMDs are identified: one managed by TID and the other by UMU. Each SMD possesses unique properties and varying security assets. While some capabilities are shared, others are specific to each domain. SSLA deployment involves the creation of a cross-domain slice that spans both SMDs, coordinated via the E2E SMD. The defined SSLA is refined into channel protection with minimum key length and encryption algorithms, Security Traffic Analysis capabilities, and monitoring capabilities to autonomously enable SSLA compliance analysis. The 5G core, combined with these security capabilities, forms a refined MSPL-OP. This MSPL-OP is subsequently passed through the SMD selection and customization phase, where the appropriate domains are determined. For this, the geographical location of users is considered to select the serving RAN SMD. During this step, additional adaptations are made, such as selecting the available channel protection protocol for the selected domains to prevent conflicts caused by protocol incompatibilities.  
The refined MSPL-OPs are dispatched to the SMD orchestrators, triggering policy translation, sub-slice deployment, and configuration enforcement. For TID, the MSPL-OP is translated into a sub-slice that includes Free5 GC as the fully containerized 5G core, STA for traffic analysis and monitoring to protect against abnormal resource use in cryptomining situations, I2 NSF for IPsec channel protection, and PoT for monitoring the IPsec tunnel.  
Figure 8: Proactive ZSM-aligned E2E B5G security slice orchestration solution.  
Meanwhile, in the UMU SMD, the MSPL-OP is translated into a sub-slice providing the IPsec tunnel endpoint and its associated PoT monitoring capabilities, specifically within the RAN domain. Table 1 outlines the capabilities included in each MSPL-OP sent to the respective domains.  
Once the slice components are prepared, the Security Orchestrator enforces the configurations as explained in Security Assets (Section 4.1). This enforcement process prioritizes dependencies and ensures that the security capabilities are consistently applied across the entire infrastructure. Briefly summarizing, once the IPsec tunnel is established, the 5G core can securely communicate with the RAN. Subsequently, the 5G core agent configures the 5G core NFs and sends a PLMN broadcast request to the gNB. Upon acceptance, the gNB starts irradiating the requested PLMN and registers the serving AMF, thereby establishing the control plane for 5G communication through the protected channel. Monitoring and analysis probes are activated only after their dependency on operational components are satisfied.