5G network slicing: logical networks on shared infrastructure
In short: Network slicing lets an operator run several logical networks on the same 5G infrastructure, each tuned for different needs such as broadband, low latency or huge numbers of devices. Slices are identified by an S-NSSAI and selected by the core. Isolation between slices is a key security and reliability concern.
What a slice is
A network slice is an end-to-end logical network with its own characteristics, built on shared physical infrastructure. Think of VLANs or VRFs on a campus network, but extended across radio, transport and core, and tied to service guarantees. One slice might favour high throughput for video, another low latency and reliability for machine control, another efficient handling of many low-power sensors.
Identifying and selecting slices
Each slice is identified by an S-NSSAI (Single Network Slice Selection Assistance Information). It has two parts:
- SST (Slice/Service Type): the expected behaviour. Standard values include 1 for eMBB, 2 for URLLC and 3 for massive IoT, and operators can define their own.
- SD (Slice Differentiator): optional, to tell apart several slices of the same type, for example one URLLC slice per enterprise customer.
When a device registers, it can request slices. The AMF, helped by the Network Slice Selection Function (NSSF), decides which slices the device is allowed, based on its subscription. Data sessions are then set up in a chosen slice, using SMFs and UPFs serving that slice.
| Slice type | Priority | Example customer |
|---|---|---|
| eMBB | High throughput | Live video broadcast from a stadium |
| URLLC | Low latency, high reliability | Remote control of machinery on a site |
| Massive IoT | Many devices, low power, small data | Utility meter reading |
| Custom | Isolation and policy | Emergency services or a private enterprise slice |
Building and running slices
Slicing depends on automation. Operators describe slices as templates, then management systems deploy and configure the needed functions and transport paths. Resources can be dedicated (for example a UPF only for one slice) or shared. More dedication means better isolation and predictability but higher cost. Assurance tools monitor each slice against its service level agreement (SLA).
Slicing is only possible on standalone 5G, and commercial offers vary a lot between operators and countries. Treat marketing claims carefully and ask exactly which parts are dedicated.
Security and isolation
- Isolation: a problem in one slice, such as a traffic flood from compromised IoT devices, should not degrade another. Check how RAN, transport and core resources are separated.
- Access control: only authorised devices should join a slice. 3GPP defines optional slice-specific authentication, so an enterprise can add its own check on top of the operator's.
- Shared functions: functions common to many slices, such as the AMF, are high-value targets.
- Management plane: orchestration systems that create slices must be strongly protected, because they can change every slice.
- End-to-end encryption: a slice is not a VPN. Protect sensitive application traffic with TLS or IPsec as well.
Tip: in exams, a common mistake is to describe a slice as just a QoS class. A slice is a complete logical network; QoS flows run inside it.
Practice
What two parts make up an S-NSSAI?
Which core function helps the AMF choose which slices a device may use?
Does placing traffic in a private slice remove the need for encryption?
Key takeaways
- A slice is an end-to-end logical network on shared 5G infrastructure.
- Slices are identified by an S-NSSAI made of SST and optional SD.
- The AMF and NSSF decide which slices a device may use.
- Dedicated resources improve isolation but cost more.
- Protect the orchestration layer and still encrypt sensitive traffic.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.