 the cloud, which then changes the F1 interface to the low layer fronthaul interface. The gNB-DUs only interface the gNB-CU, with one gNB-CU serving, for example, hundred gNB-DUs, depending on the implementation. The data center interfaces the transport network via a data center edge switch/router. With the CU-DU higher layer split architecture, it is often assumed that the central- ized unit relies on cloud computing on a data center; however, this is an implementation topic from the 3GPP standards viewpoint. 9.4.4.1 Security on F1 The F1 interface consists of the user plane and control plane (F1 AP, Application Pro- tocol). On the user plane, since PDCP terminates at the gNB-CU, end user IP flow is cryptographically protected by PDCP over the F1, between the UE and the gNB-CU. On the control plane, NAS signaling as well as RRC signaling are as cryptographically well protected over the F1. Otherwise, the F1 control plane messaging is clear text, which is why cryptographic protection with IPsec in the network domain is required. On the user plane, the end user IP flow is cryptographically protected even if the trans- port IP layer is not. In addition, IPsec may be used to protect the F1 user plane. 9.5 Specific Topics 9.5.1 Network Slicing in Transport Following the principle that different slices (and the customers there) are tenants on the shared 5G network infrastructure, logical separation of the tenants calls for a network slice to be attached to a specific transport service (a transport slice) in the otherwise common transport network. The approach depends on the use case and needs, as in some cases it is sufficient to support the network slice on the core network and the air interface only and share the same transport service for all of the slices, meaning that the transport layer is agnostic to slices. Other cases require a dedicated transport service for the slice, with logical separation and possibly in some way slice specific transport service. The example network diagram in Figure 9.9 for the NG inter