ZERO TRUST ARCHITECTURES IN TELECOM CORE NETWORKS

Аннотация

The core of modern telecommunication networks has evolved into a complex, distributed, and software-defined environment. This evolution introduces new security challenges that traditional perimeter-based models can no longer effectively address. Zero Trust Architecture (ZTA), which assumes no implicit trust within or outside the network perimeter, offers a promising approach for securing telecom infrastructures. This paper investigates the implementation of ZTA principles in the core of 5G and next-generation telecommunication networks. We propose an architecture that integrates identity-aware access control, continuous verification, micro-segmentation, and policy enforcement into network functions. A testbed was created to evaluate the performance and security benefits of ZTA under realistic telecom conditions. Results show that ZTA significantly improves threat detection and isolation while maintaining acceptable levels of performance. 1.Introduction With the advent of 5G and the anticipated deployment of 6G networks, the architecture of telecommunications cores has shifted toward software-defined, virtualized, and cloud-native designs. Network slicing, multi-access edge computing (MEC), and disaggregated network functions have increased the complexity and attack surface of core networks. Traditional security models based on implicit trust and perimeter defense are no longer sufficient to protect such dynamic infrastructures. Zero Trust Architecture (ZTA) challenges the conventional notion of trust by enforcing continuous authentication, strict access controls, and context- aware security policies. While ZTA has seen successful deployment in enterprise IT networks, its application within the core of telecommunications systems is still in its early stages. This study addresses the gap by exploring: How ZTA principles can be adapted for telecom cores; The architectural modifications required for integration; 144 ACADEMIC RESEARCH IN MODERN SCIENCE International scientific-online conference The performance-security trade-offs of implementing Zero Trust in real- world telecom environments. 2.Methods Architectural Design We designed a modular Zero Trust framework integrated with a 5G core reference architecture based on 3GPP specifications. The following components were implemented: Policy Engine (PE): Handles dynamic decision-making for authentication and authorization using Open Policy Agent (OPA). Identity Provider (IdP): Manages cryptographic identities for network functions using SPIFFE/SPIRE. Policy Enforcement Points (PEPs): Deployed at ingress/egress of VNFs to enforce access policies. Micro-Segmentation: Service meshes (e.g., Istio) were used to logically segment workloads and isolate traffic flows. Testbed Setup A virtualized 5G core network was created using Kubernetes clusters. It included AMF, SMF, UPF, PCF, and NRF functions. Simulated UEs and gNBs generated traffic under normal and adversarial scenarios. Security policies were configured to: Authenticate every service-to-service communication. Continuously monitor traffic patterns. Block unauthorized access and lateral movement. Evaluation Metrics We assessed the Zero Trust deployment along two dimensions: Security Effectiveness: Measured by detection and prevention of simulated attack vectors (e.g., credential abuse, lateral movement, DDoS). Performance Metrics: Latency, jitter, and throughput were measured using iPerf and custom traffic generators. 3. 3.Results 3.1. Security Impact The ZTA framework successfully blocked 92% of lateral movement attempts in simulated attack scenarios. Unauthorized access to core network functions was denied by PEPs in real-time. Behavioral anomaly detection systems flagged and isolated suspicious traffic patterns within 2.5 seconds on average. Performance Evaluation 145 ACADEMIC RESEARCH IN MODERN SCIENCE International scientific-online conference Latency increased by an average of 3.6% due to real-time policy enforcement and mutual TLS handshakes. Throughput degradation was under 2% in most scenarios. Jitter remained within acceptable bounds for telecom- grade QoS. Resilience and Isolation In cases of compromised network functions, Zero Trust micro- segmentation ensured containment. Compromised VNFs were automatically disconnected from the control and user plane without affecting adjacent slices or services. 4.Discussion Implementing ZTA in telecom cores requires careful orchestration of identity, policy, and visibility layers. Our findings suggest that: Granular Trust Boundaries: Micro-segmentation must align with telecom service logic, especially in network slicing contexts. Policy Automation: Manual configuration is not scalable. Policy orchestration platforms integrated with NFV-MANO systems are essential. Legacy Systems: Interoperability with EPC (Evolved Packet Core) and hybrid environments is a significant challenge. Monitoring Overhead: Continuous verification requires extensive observability infrastruc