# 5G Network Slice Isolation
## 3 Network Slice Isolation As a Security Measure
### Decomposition of Network Slicing Security Complexity  
In this subsection, we present a multi-level model of the network slicing security decomposition. Basically, this model also represents a network construction sequence that starts from deciding the type of devices available in the supply chain. Once installed in the network, those devices become physical resources that formulate the infrastructure. In order to be fully utilized, they can be transferred into virtual resources by applying virtualization and containerization technologies. Consequently, those formulated virtual resources should be managed by an information management platform, e.g., NFV. After the physical and virtual infrastructures are fully established, we start to consider the protocol and service chain's protection methodologies and the appropriate isolation points in the network slice. Finally, from the MNO's point of view, it is essential to consider a network slice platform to manage the network slice tenants by means of tenant identities, access rights, services, etc. Note that the above description is simplified regarding the deployment consideration and sequence of architectural design decisions. Furthermore, between every two layers, there is a tight relationship and logical link in the deployment of a network slice. Furthermore, each of the layers and elements has a specific protection method, which we are going to discuss in this subsection. As illustrated in Figure 1, the lowest three levels in our model are inherited from the traditional network security model, which concerns the fundamental telecommunication equipment supply chain security, physical resource security and physical infrastructure, respectively. The fourth layer to the top layer are the logical and information security concerns, which are considered to deal with a wider attack surface every layer. Furthermore, the complexity of defense in each layer will also increase layer-by-layer from the bottom to the top layer. We further describe each of the layer's characteristics in the following. Layer I Supply Chain--Usually, it is a first line of defense and is considered a physical active electronic component and passive electronic component. Software components or entities shall be included within the supply chain. Those components' software is often employed with malicious code. Therefore, we have to have certain level of control over the supply chain when deploying NSaaS. ISO 28000 specification has a well-established supply chain security management control framework that can be applied. NIST has also suggested supply chains' life-cycle management [14]. Furthermore, supply chain security management is not just to deliver control and assurance to the overall system, it also requires defining the level of control processes, certifications of the product within the best practice in the current time and the trustworthiness of the protocol applied to test the products. GSMA provides a supply chain toolbox to give a guideline of this first line of defense [15], and NSCs also provides 12 principles to ensure the first line of defense under control within the appropriate stage of the overall supply chain [16]. Layer II Physical Resources--Often, the MNO unifies the physical network elements and license's components as physical resources that will increase the flexibility of the overall mobile network infrastructure and refine the productivity by applying different service management methodologies. Furthermore, the MNO also constantly searches various methods and techniques to fully utilize all available resources in their network infrastructure. Furthermore, by deploying a network slice, the second line of defense is to manage different types of physical resources that apply to a particular network slice. For example, a critical infrastructure network slice can only be deployed in a few specific locations with selected spectrum threats, and the local breakout may also require being deployed with an air-gap isolated server rack, switch and the internet gateway.