Architecting and managing secure access in private 5G networks : role-based network slicing, data-plane security, and observability
Loading...
Date
2026-10-08
Authors
Ξαγοραράκης, Γεώργιος
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Network slicing enables 5G Standalone (SA) networks to support services with different requirements on shared physical infrastructure. Separating these services and restricting access according to user roles requires routing and security controls that prevent unauthorized communication between network segments.The experimental network combines an Open5GS core with a Kamailio-based IP Multimedia Subsystem (IMS) for sending administrative alerts through mobile-terminated SMS (MT-SMS). Linux Network Namespaces (NetNS) and Virtual Routing and Forwarding (VRF) provide traffic separation between role-based segments. Network namespaces isolate interfaces and network stacks, while VRFs maintain separate routing tables. Access between segments is controlled through routing and firewall policies. Administrative alerts use a dedicated IMS PDU session, allowing message delivery to continue when a device’s ordinary data traffic is blocked.Dynamic blocking is handled by extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP) programs attached to the User Plane Function (UPF) virtual interfaces. These programs drop traffic from blocked devices within the kernel. Network Address Translation (NAT) is performed at the outbound gateway, so device IP addresses remain visible within the internal network. Zeek monitors network activity, and a central FastAPI application associates assigned IP addresses with subscriber identities and manages network configuration and blocking actions.Functional and security tests verified traffic separation between the role-based segments, blocking of selected devices, and continued delivery of administrative alerts. The implementation brings these functions together under centralized management while preserving the information needed to associate monitored traffic with individual subscriptions.
Description
Keywords
5G standalone, Network slicing, Role-based access control, Open5GS, Virtual routing and forwarding (VRF), Linux network namespaces, eBPF/XDP, IP multimedia subsystem (IMS), Network security