# 5G Network Slice Isolation
## 3 Network Slice Isolation As a Security Measure
### Decomposition of Network Slicing Security Complexity
Layer III Physical Infrastructure--Facility infrastructure resiliency gives service reliability to the MNO's mobile network infrastructure. There are a number of international data center control frameworks [17] to protect this third line of the network slice's defense service's availability and reliability. For example, a utility smart grid network slice may request a wide area deployment and require a certain level of service availability and reliability. Hence, the MNO may need to pick the right level of the data center for such network slice deployment. Often, the mobile network infrastructure is constructed by different data centers, which different data center management teams and companies are often employed to manage. In maintaining the data center service reliability and ensuring the different levels of data center security, data center security is not only facility security but also includes identity and access management, etc. Layer IV Virtual Resources--Generally, network slicing is based on virtualization and containerization technologies as its foundation. Network slices can be constructed under virtual machines, containers or a combination of virtual machines and containers, and each network slice can be specifically restricted on the number of vCPU or vRAM and the type of storage. The MNO requires managing its virtual resources so that it does not exceed the maximum level of physical resource limitation and cause service interruptions. Layer V Virtual Infrastructure--The level of complexity in this layer has been significantly increased. We have to consider the implementation virtual machine and container  
Figure 1: Network slice basic elements. isolation techniques to avoid co-residency attack. The typical technique that would be applied is the hypervisor introspections or serverless container isolation technique at the kernel level. The virtualized infrastructure can have an access control list for a particular application to secure the entire network segment using microsegmentation, which automatically applies network segregation. Therefore, the virtualization and containerization network security would be the main consideration in this layer since this layer's defense is across different areas of technology implementation, from application to virtual network segmentation and from infrastructure access control to the CPU firmware trust model. All these techniques are trying to keep network slices isolated from each other. Layer VI Protocol and Service Chain--In this layer, a formulated network slice shall have a specific service to deliver. Usually, the MNO formulates those services that may use a service chain approach. Service chains are often in a sequential manner of network functions that can also split into multi-locations, and the traffic will propagate from one network location to another in a specific sequence. Due to the network service chain's sequential structure, we can collect network intelligence data that can be used to increase the virtual network infrastructure visibility and threat intelligence protection on different levels of the network slice's defense. However, we have to avoid the inappropriate virtual resource manipulations; therefore, we can use the appropriate security protocol and API security to prevent malicious manipulations. Layer VII Radio Access Network, Transmission Network and Core Network--When deploying a network slice, we need to identify various isolation points as network defense perimeters, where different isolation techniques can be applied. Those isolation points must be carefully selected; otherwise, the service performance can be easily affected. Therefore, mapping the isolation points with adequate technology under different network slice types is an important process in deploying network slices. Layer VIII Administrative Domain--Consequently, there is a possibility that the tenant may have purchased multiple network slices across different MNOs, and the tenant may share all resources across multiple network slices.