Network Security

Network zones are stacked with increasing proximity to the open internet or DMZ. Each zone is traversed by ingress and egress points through an application or server, with appropriate authentication and authorization for connecting system traffic.

Your network security must ensure adequate separation between internet-facing servers and back office systems. Malicious access to the control plane of network elements is highly damaging. For Diameter, the ports and gateways in this layer are often unauthenticated with the assumption that the network zone is fundamentally secure. 5G SBA provides improved authentication but remains an internal and highly protected network control plane. In Figure 1, Zone 5 is the most secure network zone.

In Figure 1, the Business API Gateway pods deployed in Zone 4 expose the Subscriber Management REST APIs on one virtual network interface, available to a web server in Zone 3, and authenticate the connecting server and requested URL. Only successfully authenticated requests are processed and dispatched using a separate virtual network interface to the MDC Gateway port on the MATRIXX Engine in Zone 5. A service mesh or Kubernetes policies can be used to achieve an equivalent solution within the Kubernetes overlay network.

You should separate each zone with a firewall. The firewall permits traffic between pre-determined interfaces only and determines if the packets are of the expected type. At a minimum, inter-zone traffic should be passed through a Packet Filter Firewall to inspect the origination and destination address and port, and to analyze the protocol against a defined authorized signature.

Figure 2 shows a MATRIXX deployment and network path between a self-care client and a MATRIXX Engine. This end-to-end path provides secure real-time subscriber query and self-care operations.