FS.61 5G核心网资源池细分指南：1.0版

Security Classification: Non-Confidential Access to and distribution of this document is restricted to the persons permitted by the security classification. This document is subject tocopyright protection. This document is to be used only for the purposes for which it has been supplied and information contained in it must not bedisclosed or in any other way made available, in whole or in part, to persons other than those permitted under the security classification withoutthe prior written approval of the Association. Copyright Notice Copyright ©2025GSM Association Disclaimer The GSMA makes no representation, warranty or undertaking (express or implied) with respect to and does not accept any responsibility for, andhereby disclaims liability for the accuracy or completeness or timeliness of the information contained in this document. The information containedin this document may be subject to change without prior notice. Compliance Notice The information contained herein is in full compliance with the GSMA Antitrust Compliance Policy. This Permanent Reference Document is classified by GSMA as an Industry Specification, as such it has been developed and is maintained byGSMA in accordance with the provisions set out GSMA AA.35-Procedures for Industry Specifications. GSMAOfficial Document FS.61 Table of Contents 1Introduction41.1Overview41.2Scope51.3Definitions61.4Abbreviations61.5References71.6Conventions72Threat Analysis of East-West Traffic82.1East-west Traffic82.2Use Case 1: Virtual Network Function (VNF) Deployment92.2.1Management Plane92.2.2Service Plane112.3Use Case 2: Container Network Function (CNF) Deployment122.3.1Management Plane122.3.2Service Plane133Recommendations for Micro-segmentation in 5G Core Networks133.15G Core Network Micro-segmentation Framework133.2RecommendedFunctionalAttributes143.2.1Security Policy Management Recommended Attributes143.2.2Security Control Recommended Attributes163.2.3Traffic Report Recommended Attributes163.2.4Traffic Capture FeatureRecommended Attributes163.2.5Asset Management Recommended Attributes173.2.6Security Monitoring Recommended Attributes173.2.7Traffic Visualisation Recommended Attributes183.3Deployment And OperationRecommended Attributes184.CandidateMicro-segmentation Solutions194.1Solution #1 Network-BasedMicro-segmentation194.1.1Solution Description194.1.2Advantages204.1.3Disadvantages214.2Solution #2 Local FirewallMicro-segmentation214.2.1Solution Description214.2.2Advantages224.2.3Disadvantages224.3Solution #3: Agent-BasedMicro-segmentation224.3.1Solution #3a:Micro-segmentation Component Highly Coupled to VNF224.3.2Solution #3b:Micro-segmentation Component Loosely Coupled To VNF254.3.3Solution #3c: Data Analysis Function-Based Solution274.3.4Solution #3d: Optimise for Inter-Operability Solution Based on Solution #3a304.4Comparison of solutions325Recommendations34 GSMAOfficial Document FS.61 AnnexADocument HistoryA.1Other Information 1Introduction 1.1Overview With 5G core networks becoming virtualised, they not only face attacks from outside of the5G core network but also security challenges from east-west traffic inside the core network(see GSMA FS.33[1]risk 27 & risk 36). If a virtualised network function (VNF) iscompromised, anadversarymay attempt further enumeration or attacks within theenvironment, known as moving laterally or lateral movement, which could affect otherfunctions deployed in the same core network resource pool. To prevent attacks in east-westtraffic, it is essentialto have clear visibility and an appropriate capability to inspect the east-west traffic, identify the attack source and then take corresponding mitigation actions. One of the techniques for east-west network traffic protection is micro-segmentation.Micro-segmentation is a security strategy that divides a network intosmallersegments, allowingtraffic in and out of each segment to be monitored and controlled. The main goal is to limitthe impact from a breach by isolating segments and improving visibility, enabling granularaccess control through defined policies. Micro-segmentation can be implemented at thenetwork level, host level, hypervisor level, or workload level. It is easiest and most familiar tocreate network level micro-segmentation, however it offers the least flexibility and granularityfor access control and telemetry. On the other end of the spectrum, workload identity basedmicro-segmentation offers the most granularity in terms of control and visibility but requiresagent software and management software to orchestrate and implement segmentation. Micro-segmentationhelps prevent unauthorised lateral movement within the network,whether from external breaches or internal threats.Withmicro-segmentation, mobile networkoperators (MNOs) can create policies that segregate traffic between virtual machines orcontainers based on a zero-trust approach. Only permitted services can communicate witheach other if there is a specific functional requirement for a5G