As the industry evolves towards RAN virtualization, with virtual RAN or Open RAN (O-RAN), it is important that a risk-based approach is taken to adequately address security.Virtualization throughout the network and a service-based architecture means that security needs to be handled in a new way.

5G will accelerate innovation and provide transformative use cases across multiple global sectors. However, it will also bring new security challenges for the mobile ecosystem, with broader attack surfaces, more devices and increased traffic loads. We must have networks that are trustworthy, resilient, and secure at every phase of the system lifecycle.  These new security challenges are addressed by 3GPP’s SA3 security work group.

Expanded threat surface

The introduction of new and additional touch points in O-RAN architecture, along with the decoupling of hardware and software, has the potential to expand the threat and attack surface of the network in numerous ways, including:

• New interfaces increase threat surface – for example, open fronthaul, A1, E2, etc.
• Near-Real-Time (RT) RIC and 3PP xApps introduces new threats that could be exploited
• Decoupling of hardware increases threat to Trust Chain
• Management interfaces may not be secured to industry best practices
• (not exclusive to O-RAN):  adherence to Open Source best practices

These and other areas are explored in greater depth in Ericsson’s report, Security considerations of Open RAN.  Many of these items are being studied in several O-RAN Alliance working groups, including the Security Task Group, a consensus-based standards group that will ensure that O-RAN implementations meet the levels of security expected by the industry.

Ericsson is committed to providing leadership and guidance in the O-RAN Alliance on these emerging areas of study.  In the meantime, let’s take an in-depth look at just one of these new areas of risk:

Weakened Links in the Trust Chain 

Virtualization and the use of cloud platforms give the possibility to utilize hardware resources better between different applications, but it will also introduce security risks as isolation between applications are only “logical” in software without physical isolation across hardware resources. Recently discovered vulnerabilities like Meltdown and Spectre reveal that there can be increased security risks when sharing hardware resources.

To establish a secure and trusted communication channel between two endpoints, one needs first to authenticate each side before a secure (confidentiality and integrity-protected) channel can be established. To authenticate each endpoint, a unique identifier and one or more credentials that shall be kept secret are needed. To protect the credentials in a computer environment, hardware security functionality such as Trusted Platform Module (TPM), Hardware Security Module (HSM), and secure enclaves, are used to establish a hardware root of trust.

In the case of virtualization and cloud environments, there are many layers that need to be considered to ensure the trust chain is maintained between applications and the underlying hardware. The authentication process is the base for establishing a secure communication channel, but it must trust the layers underneath to attest that the node, layer or data set has not been compromised. For example, a node could request a valid service, authenticate correctly to the system and be authorized to use that service yet still represent a malicious threat if it is running on compromised firmware.

As there are different layers between the hardware and its security functions and the application, one needs standardized interfaces and APIs to use the hardware security functions and allow those to attest to and validate the layers above. Together with standardized and interoperable APIs, there must also be a transparency to how the different layers use and provide the security functions in the chain, especially as different hardware vendors may have different security functions, capabilities or implementation variances.

Ericsson will continue its leadership role within the O-RAN Alliance and its Security Task Group to incorporate security best practices, ensuring that new deployments are ready to meet the level of security, resilience and performance expected by service providers and their customers.