Telecom operators across the globe are warming up to the idea of building networks based on open radio access network (RAN) technology. These networks are programmable, agile and flexible in facilitating innovative use cases. By enabling automated and accelerated provisioning of network capacity and services, greater control over the development of enhanced network services, and reduced network equipment and operating expenses, they offer telcos greater flexibility. Further, the technology is cost-efficient, as it reduces operators’ reliance on exclusive vendors and decreases the expenditure incurred on infrastructure.
However, alongside these advantages, there are certain risks associated with the deployment of open RAN that need to be ironed out. Further, the interoperability of open RAN technology makes testing of such networks difficult. In this scenario, it is essential to adopt a risk-based approach along with efficient testing strategies to adequately address the security concerns surrounding this new technology.
A look at the security and testing challenges associated with open RAN…
As more vendors become involved in the open RAN ecosystem, the threat surface area increases, especially through their interfaces. While the use of virtualisation and cloud platforms helps in better utilising hardware resources between different applications, it can also introduce security risks. In fact, recently discovered vulnerabilities such as Meltdown and Spectre reveal that there could be increased security risks when sharing hardware resources.
According to industry experts, since open RAN can be implemented as a multivendor network, each application can come from a different vendor. Sourcing applications from multiple places in this way gives rise to a situation wherein each application exposes an application programming interface (API) to the services it provides, thereby opening up avenues for potential security risks.
Moreover, since open RAN deployment would be heterogeneous, some apps would reside on cell sites in an operator’s private cloud, while some would be outside of it. However, this deployment strategy breaks the prevailing security model, in which the operator RAN is secured via a security perimeter. Such a strategy assumes a zero-trust network.
According to Ericsson, in case of virtualisation and cloud environments, many layers need to be considered to ensure that the trust chain is maintained between applications and the underlying hardware. The authentication process is the base for establishing a secure communication channel, but it must trust the layers underneath to attest that the node, layer or data set has not been compromised. Further, as there are different layers between the hardware and its security functions and the application, one needs standardised interfaces and APIs to use the hardware security functions and allow them to attest to and validate the layers above.
Mitigating security risks
In order to tide through the security challenges posed by open RAN, it is imperative to adopt industry best practices. As per industry reports, operators should adopt an end-to-end strategy to address API security, including the authentication of APIs and segregation of duties, the use of hardware-secured asset tags, and other methodologies. Further, data protection should be enabled in real-time using modern vulnerability assessment and threat management technologies, such as advanced infrastructure security protection and threat analysis. Network participants need protocols for proper authentication and authorisation, including user identity verification for roaming and cloud services, security identification for themselves, and identification of network usage behaviour and mobility patterns via machine learning technology. Moreover, security policies and procedures should be standardised at the global level.
Participants also need standardised polices for data storage, management, and fraud detection and response. Another important concern is ensuring the safety of the physical supply chain, which can be accomplished by holding vendors responsible for the security of the products and services delivered. Essentially, communication service providers and other key participants need shared playbooks outlining categories of risks, mitigation actions and teams responsible for carrying out remediation. Time is a critical factor in responding to attacks, and such a playbook reduces uncertainty and response time.
Testing and integration issues
The creation of seamless and flexible interoperability in a multivendor, open ecosystem also introduces new testing, management and integration challenges that require diligence and cooperation. The key challenges that operators need to address when considering open RAN are interoperability, ownership accountability, troubleshooting and isolation of problems, and management and orchestration of all multivendor virtual network functions and physical network functions on a common cloud infrastructure, which may also be multivendor.
Further, the number of test cases that operators and network equipment manufacturers need to undertake and the amount of testing required are much greater with open RAN compared to traditional RAN. This is because of the larger combination of vendors under the open RAN ecosystem, which dramatically increases the cycle time for testing every software release and every regression, as well as the time needed for implementing testing automation.
Addressing testing issues
To address these challenges, an open test and integration centre (OTIC) has been established in Berlin, Germany, as a collaborative hub for commercial O-RAN development and interoperability testing. The operator-led OTIC initiative has a shared commitment to the verification, integration, testing and validation of disaggregated RAN components.
The OTIC lab provides a structured environment with common test platforms and practices that enable software developers, equipment manufacturers and system integrators to verify functional compliance with O-RAN Alliance specifications. The lab enables the interoperability of disaggregated 5G access infrastructure elements to be fully validated prior to network deployment. However, operators must take responsibility for multivendor, disaggregated elements and make sure they undertake collaborative efforts to maintain quality of experience standards for open RAN. Further, telcos need to integrate robust multivendor testing processes from the lab to the field and beyond, to fully realise and reap open network architecture benefits.
Other risk mitigation strategies
The rapid shift towards open RAN deployments represents a paradigm shift for mobile network operators, who now need to put various network elements together. In this regard, ensuring that components sourced from different vendors work together seamlessly has become a top priority for operators.
To this end, access to the latest testing tools and resources throughout the life cycle of an open RAN can help operators ensure that network performance issues are identified and resolved quickly enough to meet their key performance indicator goals. These include tests for functionality, performance, reliability and resilience; subsystem wraparound tests; system-level tests; protocol compliance for open interfaces and protocols; and performance monitoring of open interfaces and protocols to ensure optimum operation.
However, interoperability testing can be challenging, especially for distributed units, due to the high flexibility in protocol implementations and the need for tight synchronisation with radio units. Moreover, there is a possibility of encountering incompatible configurations among multiple possible combinations of software and hardware. In this scenario, the industry requires the development of cutting-edge solutions that allow the testing and validation of interoperability in a controlled and managed environment.