In a blog, Jason S Boswell, Head of Security, Network Product Solutions at Ericsson outlines his concerns about security.
He notes steps taken by 3GPP’s SA3 Security Group on 5G: this article outlines How 5G is both more and less secure than other networks.
However, his contention is that the introduction of new and additional touch points in O-RAN architecture, along with the decoupling of hardware and software, could introduce more weaknesses, from a security point of view.
They include
• New interfaces increase threat surface – for example, open fronthaul, A1 (see table below), E2, etc.
• Near-real-rime RAN intelligent controller (RIC) and 3PP xApps introduces new threats that could be exploited
• Decoupling of hardware increases threat to trust chain
• Management interfaces may not be secured to industry the standard of industry best practices
• Open Source best practices are potentially dangerous, which is not exclusive to Open RAN.
Ericsson says it is “committed to providing leadership and guidance in the O-RAN Alliance on these emerging areas of study” and explores these areas in greater detail in its report, Security considerations of Open RAN.
Interestingly, Caroline Gabriel, Director of Research at Rethink Research, suggests major vendors might contribute to O-RAN’s problems.
They would say that, wouldn’t they?
We need to bear in mind that Ericsson is one of the world’s three biggest vendors whose model for as long as anyone can remember regarding the RAN is selling big, tightly integrated systems – what the OpenRAN movement, including the O-RAN Alliance, is designed to escape from.
The plan is to get prices down by enabling more competition and greater flexibility in the products while we’re at it.
But it’s not surprising that the blog picks what Boswell calls the Trust Chain (which you can’t help but feel takes a passing slap at Huawei) to elaborate on.
For example, he points out that virtualisation could well enable operators to make better use of hardware, but there are implicit dangers in applications only being separated logically, rather than physical isolation. Then there are all those layers of software, too.
It doesn’t mean they’re wrong
It’s an interesting read, if probably not a revelation to anyone involved in these issues, but certainly Open RAN and O-RAN still have a long way to go before their superior model is proved conclusively, despite the support and intention to deploy of many operators.
They include Deutsche Telekom, Orange Telefonica and Vodafone in Europe and their opcos beyond, Rakuten Mobile in Japan (although it has global ambitions), DISH in the US, and Turkcell.