5G Network Slice Security
Table of Contents
5G Network Slice Security
Conceptual information about 5G network slice security.
Network slicing is about transforming
the system from a static, one-size-fits-all paradigm to a new paradigm
where logical networks and partitions are created with appropriate isolation,
resources, and optimized topology to serve a particular purpose,
service category, or individual customer.
From a mobile operator’s point of view, a network slice is an
independent, end-to-end, logical network that runs on a shared physical
infrastructure, capable of providing an agreed service quality.
The technology enabling network slicing is transparent to business
customers for whom 5G networks, in combination with network slicing,
allow connectivity and data processing tailored to the specific
business requirements. The customizable network capabilities include
data speed, quality, latency, reliability, security, and services.
These capabilities are always provided based on a Service Level
Agreement (SLA) between the mobile operator and the business customer.
A network slice could span multiple parts of the network (for example, access
network, core network, and transport network) and could be deployed
across multiple operators.
A network slice comprises dedicated and/or shared resources (for
example, processing power, storage, and bandwidth), and has isolation
from other network slices. Mobile network operators could deploy
a single network slice type that satisfies the needs of multiple
verticals, as well as multiple network slices of different types
that are packaged as a single product targeting business customers
(a business bundle) who have multiple, diverse requirements. For
example, a vehicle may simultaneously need a high bandwidth slice
for infotainment and an ultra-reliable slice for telemetry and assisted
driving.
You can apply network security to
an enterprise or customer from a vertical industry that is using
a fifth generation cellular wireless (5G) network by creating Security policy
rules based on network Slice/Service Type (SST). 5G network functions
communicate with each other using the HTTP/2 protocol over service-based
interfaces. Traffic from User Equipment (UE) or IoT devices is carried
in GTP-U tunnels in the 5G network.
The firewall is positioned at N3 and N11 interfaces; the firewall
monitors the exchange of control and signaling messages at the N11
interface, which uses HTTP/2 as the application layer protocol.
At the N3 interface, the firewall decapsulates the GTP-U tunnels,
which carry the user traffic. The firewall correlates the Single
Network Slice Selection Assistance Information (S-NSSAI) with the
IP traffic inside the GTP-U tunnels in a 5G network. The following
topology illustrates a deployment option in a 5G network.
PAN-OS® supports HTTP/2 control
messages on an N11 interface.
You can inspect HTTP/2 messages in a 3GPP 5G Service Based Architecture
(SBA) to extract S-NSSAI. An S-NSSAI consists of a Slice/Service
Type (SST) and optionally a Slice Differentiator (SD), which is
information that supplements the SST(s) to differentiate among multiple
network slices of the same SST.
You can also provide a way to secure dedicated network slices
for IoT customers. You configure Security policy rules for a 5G
network based on Network Slice/Service Type (SST) in two categories
within a single rule: standardized and operator-specific:
- Network Slice SST - Standardized—There are standardized
(predefined) slices, which are defined in 3GPP TS 23.501. PAN-OS® delivers
standardized values to you in dynamic Content Updates:
- eMBB (enhanced Mobile Broadband)—For faster speeds and high data rates, such as video streaming.
- URLLC (Ultra-Reliable Low-Latency Communications)—For mission-critical applications that are sensitive to latency, such as critical IoT (health care, wireless payments, home control, and vehicle communication).
- MIoT (Massive Internet of Things)—For smart metering, smart waste management, anti-theft, asset management, location tracking, and so on.
- Network Slice SST—Operator-specific—You name and specify the slice. The format of the slice name is text, followed by a comma (,) and a number in the range 128 to 255. For example, Enterprise Oil Company,145.
You can apply the following security per network slice or group
of network slices: application control, Antivirus, Anti-Spyware,
URL filtering, intrusion prevention, and advanced threat prevention
with WildFire®. You can log Network Slice ID SST and
Network Slice ID SD in traffic logs and GTP logs. In all other log
types, including URL Filtering, WildFire Submissions, Threat, Data
Filtering, and Unified logs, you can log Network Slice ID SST.