# 5G Network Slice Isolation
## 5 Conclusions and Outlooks  
When deploying NSaaS, the MNO must resolve various levels of complex deployment and operation issues in order to provide a secure service to the vertical industries (tenants). Although, 3 GPP has thoroughly laid out the 5G standalone architecture and provides network slice application functions, it has not yet identified the common practice and security design in operating the NSaaS. With its main functions based on virtualization and containerization technologies, NSaaS provides flexibility and agility for the telecommunication infrastructure; however, it also introduces a number of new risk factors and widens the attack surface simultaneously. In this paper, we have explored and addressed the complexity and challenges of risk factors and the attack surface in eight layers of NSaaS, which allow MNOs and tenants to identify the defense mechanisms on each of the particular network slices. In particular, for an NSaaS platform in operation, each of the network slices should apply a certain level of isolation that reflects the level of protocol stack control from either the MNO or the tenant. Furthermore, these deployed isolation methods are related to the overall protection of the network infrastructure, and defense mechanisms should be embedded within the network architecture, e.g., microsegmentation, etc. We have also developed a mathematical model to represent the relationship between isolation level and the control distribution over the MNO and tenant. This model can be used to guide the MNO and tenant in designing the SLA regarding their control levels and the isolation cost of the deployed network slice. The results show that air-gap isolation  
Figure 6: How to select the appropriate NS isolation plan: (**a**) check the QoS satisfaction under different isolation plans, and (**b**) select the isolation plan with regards to the trade-off between security and cost.  
provides the ideal performance of network slice deployment, but it also has the highest cost due to the under-utilization of resources. As a possible research direction for our future work, it is of great interest to evolve the qualitative models we have developed in this article into quantitative ones. To do so, case studies of specific deployment scenarios and practical applications must be carried out.  
Conceptualization, S.W.; methodology, S.W.; formal analysis, B.H.; investigation, S.W., B.H.; resources, S.W. and H.D.S.; writing--original draft preparation, S.W. and B.H.; writing--review and editing, B.H., S.W. and H.D.S.; visualization, S.W. and B.H.; project administration, H.D.S. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The authors declare no conflict of interest.  
The following abbreviations are used in this manuscript:  
\begin{tabular}{l l}
3 GPP & Third-Generation Partnership Project \\ AD & Administrative Domain \\ eMBB & enhanced Mobile Broadband \\ GSMA & GSM Association \\ ITU & International Telecommunication Union \\ mMTC & Massive Machine-Type Communications \\ MNO & Mobile Network Operator \\ NFV & Network Function Virtualization \\ NSaaS & Network Slice as a Service \\ QoS & Quality of Service \\ SDN & Software-Defined Network \\ SLA & Service Level Agreement \\ VNF & Virtual Network Function \\ URLLC & Ultra-Reliable Low-Latency Communications \\ \end{tabular}