# 5G Network Slice Isolation
## 3 Network Slice Isolation As a Security Measure
### Precision of Network Slice Isolation Point  
Identifying an adequate network slice isolation point and applying the right network slice isolation mechanism and policy at those isolation points are the main challenges in deploying multi-network slicing to a mobile operator network. Network slices are designed to support the co-existence of multiple tenants on an MNO physical network with independent, isolated and fully secured network services. Furthermore, one tenant would not know another tenants' existence in the network. A similar strategy has been proposed on the Internet to isolate services or applications using a service-oriented architecture [18]. However, it might need abnormal detection to protect the behavior of the network slice from faults, e.g., an inappropriate selection of isolation points. In the case of such faults, the anomaly detection algorithm can also be invoked to obtain the score of isolation points behavior [19], which may be further exploited by machine learning techniques to isolate the faults [20] and to model the slice behavioral patterns under a particular setup of isolation points. GSMA has defined eight types of network slice use cases, and each of the network slice types could have different network configurations, network performance requirements, traffic criteria and security control, etc. All these characteristics would ultimately lead to delivering the service experience to the subscriber and fulfilling the network slice's Service Level Agreement (SLA) securely [21]. In particular, multi-network slice deployment involves different network technologies, resource migration and resource optimization at the runtime. Either an inappropriate selection of the isolation points or wrongly applying an isolation mechanism and policy in each of the isolation points can cause network performance degradation or service delivery interruption after resource optimization and migration. Therefore, we shall identify each of the possible isolation points and adequate security mechanisms and policies applied to those isolation points. By appropriately specifying these features, it helps not only by securing the network slice but also by enhancing the network performance without affecting the subscriber's experience or violating the SLA. Figures 2-5 provide illustrations of some phenomena when deploying a network slice. Figure 2 is divided into three parts: on the right and left sides, two options are illustrated where the tenant requests for a network slice with the most tenant control and minimal influence from the MNO (left) or balanced control shared between the tenant and the MNO (right), respectively. In the earlier case, the MNO only provides physical resources (e.g., spectrum etc. ); in the latter case, several layers of the protocol stack and some specific network functions are defined and controlled by the MNO. In the middle, Figure 2 shows how the level of isolation matters to the cost of deployment when considering network slice isolation. In particular, Figure 2 indicates the minimal and maximal cost of isolation that would start on a positive manner due to the physical resources (e.g., spectrum etc.) that belong to the MNO. The graph also indicates the characteristics of the isolation relationship in between the level of control a tenant can gain when deciding to purchase a network slice. Furthermore, the graph indicates that is not directly proportional to each other due to the vast number of isolation techniques that can be applied to deliver similar protection. Figure 3 provides an overview of controlling a network slice by the tenant. When the tenant has minimal control of a network slice, which implies the tenant fully relies on the MNO to manage the network slice, and the MNO has less responsibility to apply isolation in order to protect the network slice. On the other hand, when the tenant has maximal control of the network slice, the MNO is responsible for applying isolation to the network slice for protecting the other tenant's privacy.