Towards Secure Slicing: Using Slice Isolation to Mitigate DDoS Attacks on 5G Core Network Slices

Abstract

In this paper, we propose a solution to proactively mitigate Distributed Denial-of-Service attacks in 5G core network slicing using slice isolation. Network slicing is one of the key technologies that allow 5G networks to offer dedicated resources to different industries (services). However, a Distributed Denialof-Service attack could severely impact the performance and availability of the slices as they could share the same physical resources in a multi-tenant virtualized networking infrastructure. Slice isolation is an essential requirement for 5G network slicing.In this paper, we use network isolation to tackle the challenging problem of Distributed Denial-of-Service attacks in 5G network slicing. We propose the use of a mathematical model that can provide on-demand slice isolation as well as guarantee end-to-end delay for 5G core network slices. We evaluate the proposed work with a mix of simulation and experimental work. Our results show that the proposed isolation could mitigate Distributed Denial-of-Service attacks as well as increase the availability of the slices. We believe this work will encourage further research in securing 5G network slicing.

Mitigating Security Problems in Virtualized Networks Through Resource Management

“…The impact of slice-initiated attacks could have been worse if other hosted slices were using some CPU intensive applications. The results for both scenarios are consistent with our previous work [59].…”

“…The sharing of common physical resources between slices could lead to information leakage and side-channel attacks [63,64]. The side-channel attacks can be used to determine co-residency and extract valuable information (e.g., cryptographic keys [65]) from the victim slices or perform Denial-of-Service attacks [59]. Several types of side-channel attacks can be used to determine co-residency by using different shared resources such as CPU cache, main memory, and network traffic [65].…”

5G Network Slicing: A Security Overview

“…We highlight here the need for authenticity and integrity verification for the network slice, to prevent fake or modified instances [16]. Specific mitigation techniques against Distributed DoS (DDoS) by slice isolation have been considered [38]. Dynamic NFV that enables ondemand security mechanisms needs still to be studied but is a good candidate for mitigating security issues at runtime [16].…”

Side Channel Attack-Aware Resource Allocation for URLLC and eMBB Slices in 5G RAN

“…They formulated an Integer Linear Programming (ILP) model and designed a heuristic algorithm to realize efficient and secure 5G core network slice provisioning. The authors in [25] used slice isolation to mitigate the impact of DDoS attacks on slice authentication and the solution was evaluated by a combination of simulation and an experimental testbed. However, the solutions proposed in [24], [25] are only suitable for core network slicing.…”