On end-to-end approach for slice isolation in 5G networks. Fundamental challenges

Abstract

Abstract-There are several reports and white papers which attempt to precise 5G architectural requirements presenting them from different points of view, including techno-socio-economic impacts and technological constraints. Most of them deal with network slicing aspects as a central point, often strengthening slices with slice isolation. The goal of this paper is to present and examine the isolation capabilities and selected approaches for its realization in network slicing context. As the 5G architecture is still evolving, the specification of isolated slices operation and management brings new requirements that need to be addressed, especially in a context of End-to-End (E2E) security. Thus, an outline of recent trends in slice isolation and a set of challenges are proposed, which (if properly addressed) could be a step to E2E user's security based on slices isolation.

Towards constructive approach to end-to-end slice isolation in 5G networks

“…The slice multiplexer and demultiplexer works on multiple links on one side (the Nto1 or 1toN relationship). It is not assumed here that source or target link(s) are from a single slice (the slice chaining concept is allowed described in [72], based on [73]). The slice's switch can combine two slice's links from the same layer in the common protocol stack.…”

Orchestration and Control in Software‐Defined 5G Networks: Research Challenges

“…First, it is important to notice that isolation is a set of several tools that can be selected and tuned in order to achieve the isolation desired on the different use cases. Isolation can be classified in 4 different areas [62]: traffic, bandwidth, processing, and storage isolation. Some of the methods available for achieving isolation are as follows: language and sandbox based isolation for service instances and network slice instance and, for lower levels, approaches such as virtual machine and kernel based isolation, Physical Resource Block (PRB) scheduling, Channel Access Control, SDN-based isolation, hardware and physical isolation, etc.…”

“…Some of the methods available for achieving isolation are as follows: language and sandbox based isolation for service instances and network slice instance and, for lower levels, approaches such as virtual machine and kernel based isolation, Physical Resource Block (PRB) scheduling, Channel Access Control, SDN-based isolation, hardware and physical isolation, etc. [62]. In this context, the main challenge is the orchestration and control tasks that need to be implemented in order to harmonize the different isolation techniques in the different domains, in order to fulfil the requirements of each specific slice.…”

“…This is even more complex due to the fact that there is not a holistic and final standardized network slice architecture, which keeps open the control and orchestration of unknown isolation techniques. Also, isolation techniques significantly rely considerably on SDN functionalities, but as it is explained in [62]; some of these functions are not yet mature. Security and access control are also some of the isolation requirements that need to be enhanced, since, for instance, devices from group 1 should have access to slices A and B, but never to slice C, which in practice demands diverse architectural and security considerations.…”

Optimal Slice Allocation in 5G Core Networks

“…However, if the there is some level of intra-slice isolation, the slice operator might be able to recover from partial compromise/unavailability of the network slice. We note that our aim does not include inter-slice isolation where other aspects need to be taken into consideration including but not limited to physical isolation, hardware-based isolation, virtual machine based isolation [5]. However, our focus is on providing on-demand physical isolation between different VNFs of a slice for added reliability and security.…”