# 5G Network Slice Isolation
## 1 Introduction  
Network slicing [1] is a revolutionary concept of enabling mobile networks on-demand. It extends the business model of the mobile networking from the traditional tariff subscription to the new cloud computing paradigm: network slice as a service (NSaaS). The basic principle of network security, such as authentication, authorization, confidentiality, integrity and availability, can be found in [2]. The new business model and service opportunities are motivating vertical industries to join and develop their own mobile networks and specify the network infrastructure capabilities and performance to align with their business and application characteristics. To achieve this aim, it requires adequately defining the defense mechanisms that protect all deployed network slices of various types with different network performance and security requirements [3]. In particular, these defending mechanisms have to be considered not only for the traditional physical network infrastructures but also in a nested virtualized network environment. Formerly, the traditional network infrastructure had been considered as a secure environment because it was operated under a single administrative domain and fully maintained by an operator. However, this has been changed in NSaaS, where the mobile network operator (MNO) or network slicing service provider offers network slices of various types for leashes, which coexist over a shared physical infrastructure [4]. [PERSON] et al. [5] pointed out that multi-tenancy requires a multi-domain security and risk management embedded into the design. Furthermore, the current trust models and existing defense methodologies might not be appropriate to the operation of NSaaS. Those network slices may have different levels of security demands and various specifications of tailored network protection measures. In such an emerging networkenvironment, the defending and attacking surfaces become much wider than those in legacy systems, and the security problem becomes more complex than the mobile industry had anticipated. Therefore, it calls for an effective isolation mechanism and policy approaches that can protect the network from attacks and infections over these new wide surfaces. For example, [PERSON] et al. [6] discussed security control and policies to protect those network perimeters, and [PERSON] et al. [7] developed a scheme for cross-network slice authentication to protect against attackers who aim to impersonate users, network operators or network slices by providing a secure session key exchange. For developing security solutions to protect the complex network environment when deploying NSaaS, it is seriously important to identify the possible attacking vectors, the adequate defending mechanisms and the appropriate security technologies. This identification process also helps us gain practical security knowledge and increase the security awareness. Basically, NSaaS shall provide various levels of isolation, e.g., application segmentation isolation, virtual machine isolation, network segmentation isolation and resource isolation, to secure the infrastructure of the mobile network operator (MNO) and to protect the tenant's privacy as well as their services. On the other hand, a typical network slice tenant generally expects its network slice to run as a standalone and fully independent mobile network. Neither a network slice nor the data of its tenant shall be accessed by other unauthorized tenants. Unfortunately, a network slice is based on virtualization, containerization and software-defined network technologies; therefore, faults and mistakes can be propagated to other network slices via the virtualized environment, and attackers may cross network slices to misuse the networks for their desired purposes. This is the main reason resolving network slice isolation has become the primary goal of the mobile industry in order to deploy a secure NSaaS.In their survey in 2018 [8], [PERSON] et al.