WIXLIB

Based on and in compliance with the specifications, the O-RAN Software Community develops theopen-source software of the radio access network nodes (e.g., for the Near-Real-Time RAN intelligentcontroller, virtualization and cloud platforms,etc). The challenges of this approach are related to thedevelopment of highly performing software able to operate in real time environments and to thecollaborate with other open-source communities in order to leverage on existing solutions.Finally, to facilitate and stimulate the development of solutions according to the architecture andinterfaces defined in the technical groups, O-RAN Alliance has promoted the establishment oflaboratories for testing and integration called OTIC (Open Testing and Integration Center). OTIC labsprovide an open, collaborative and unbiased environment (i.e., independent from the O-RAN vendors)in order to pursue several objectives:----Support for the adoption of O-RAN specifications and the development of the O-RANecosystem through the organization of demos, laboratory or field trials and events such asworkshops.Organization of Plugfests, to host demonstrations of solutions and Proof of Concept based onO-RAN specifications.Testing and verification of the adherence of the implementations of RAN equipment to the ORAN specifications through conformity tests and interoperability tests based on the testspecifications developed in the technical groups. In this case, the goal is to issue certificatesand badges by the OTIC laboratory for solutions that meet the specifications based on the testsperformed.End-to-End setup functional and performance tests, according to the test specificationsdefined within the Testing and Integration Focus Group (TIFG).OTIC centers are also concerned about security aspects, in particular security featuresverification and functional and performance security tests of the RAN elements, with thestarting focus on End-to-End testing.Feedbacks to O-RAN Alliance based on test activities and experience, in order to support thedevelopment of technical specifications.As an open technical organization, O-RAN Alliance is the place where both incumbent as well asemerging industry players and academic institutions work together and contribute to open RANsolutions. All participants in fact can access and make technical contributions to any of the groupsthrough a consensus-driven process.O-RAN specifications have always been publicly accessible, as once approved by the O-RAN Board,they can be downloaded from the public website upon agreement to the O-RAN Alliance AdopterLicense. More recently, the Alliance updated its working procedures towards more transparencyto match that of long established standardization bodies. As an example, it was decided that thetechnical specifications be formally recognized by European Telecommunications Standards Institute(ETSI) through a procedure called PAS (Publicly Available Specification). The process is currentlyunderway, and the activity is expected to be taken over by the ETSI Technical Committee MSG (MobileStandards Group).To ensure compatibility and to avoid duplication of work, O-RAN’s technical work builds on existing3GPP specifications and standards. Specifically, one of the objectives of the Alliance is to design theunbundling of the radio access node with the addition of functional elements and related interfaces inaccordance and compliance to the 3GPP architecture.OPEN RAN SECURITY WHITE PAPER5

As shown in Figure 1, the O-RAN architecture extends the functional disaggregation of a 3GPP radiobase station (e.g. eNB for LTE or gNB for NR) by introducing three components plus a managementone:Figure 1 : O-RAN logical architecture[11] O-CU (O-RAN Central Unit) separated into O-CU-CP (Control Plane) and O-CU-UP (User Plane)as already foreseen in 3GPP: this is where the radio network intelligence is concentrated. It isa mini data center with high processing capacity, capable of managing multiple antennasdeployed within a radius of a few tens of Kms.O-DU (O-RAN Distributed Unit): it is where the transmission and reception operations aremanaged. Also, in this case, the node can be virtualized and hosted in a centralized data centerfor the management and coordination of multiple radio sites or reside directly near theantennas.O-RU (O-RAN Remote Unit): it is the node physically mounted together with the antenna andcan include the radio frequency and management components of the intelligent antennas.RIC (RAN Intelligent Controller), divided into Non-Real Time RIC and Near-Real Time RIC,exercises the management of radio resources and the control of the three components above(O-CU, O-DU and O-RU).Whilst solutions that implement disaggregated radio base stations already exist on the market, theywould be based on non-standard interfaces which force the operator to rely on a single supplier. Thenovelty introduced by the Alliance is the specification of new open interfaces between thedisaggregated components, together with the interoperability specifications that enable the operatorto purchase the different blocks from multiple suppliers.Another important objective is the separation, again through interoperable interfaces, between themanagement network and the equipment. In this way, the applications and management algorithmscome no longer as a “monolith” from a single supplier but can be developed by a third party or directlyby the operator.O-RAN Alliance technical specifications cover use cases, requirements and solutions for eachcomponent and interface depicted in Figure 1, therefore dealing with evolution of the architecture anddefinition of use cases, O-RAN Near-RT RIC, Non-RT RIC, Open Fronthaul Interfaces, Profiling of theOPEN RAN SECURITY WHITE PAPER6

3GPP-based interfaces, O-RAN Cloud and Orchestration, White-box Hardware and Open Source SW,transport network, management network, test and integration, and security aspects.The most updated versions of the specifications can be found in [12].Within the Alliance, the SFG (Security Focus Group) is responsible for defining the requirements andspecifying the architectures and protocols for security and privacy in O-RAN systems. SFG specifiessecurity requirements, architectures and frameworks in support of the open interfaces defined byother O-RAN WGs. This includes security guidelines that span across the entire O-RAN architecture.3. Security in Open RANOpen interfaces between individual network functions with available specifications unlock traditionalclosed world of telecommunications to vendors from IT. Security of RAN, even though it has its ownspecifics, shares many risks with IT infrastructure. Thanks to its openness and transparency, O-RAN canbenefit from existing as well as future security solutions initially developed for IT.Openness also brings more competition to telecommunication industry because implementation ofsecurity solution will not be bound to products of just one vendor but will be usable with equipmentfrom any O-RAN compliant vendor. This inherited interoperability also opens doors for specializedvendors, who provide best of breed security solutions, but do not provide entire RAN stack. Mobilenetwork operators (MNOs) will be free to select products that best suits their needs and will avoid arisk of vendor lock in. Transparency builds ground for better monitoring and gives better visibility intothe network, which leads to more effective security operations. Disaggregation also enables MNOs toreplace smaller parts of RAN equipment from one vendor in case it does not meet their requirementsanymore.Security Focus Group (SFG) has adopted principles of zero trust architecture (ZTA) as defined in NISTSpecial Publication 800-207 [2] which is based on zero trust security model. Zero trust security modelsassume that an attacker can be present in internal as well as external environment and that anoperator-owned environment is no different and no more trustworthy than any other environment.Its principle: “never trust, always verify”. Due to this approach, no implicit trust between O-RANcomponents and any other parts of the infrastructure is assumed.Security in Open RAN is built on thorough risk analysis from which explicit requirements are created.In March 2022, O-RAN Alliance released its first version of Security Test Specifications [6]. Target ofthis document is to develop the security test cases, which verifies the development andimplementation of the security requirements or emulates the attacks and validates mitigationmethods align with the threats and recommended security controls identified in O-RAN threatmodelling and remediation analysis.Open as well as proprietary RAN implementations must face the same technological challenges. Dueto its open nature, all Open RAN specifications come under close scrutiny. They have to addresssecurity challenges and by consensus propose the best secure solution possible. This ensures that realsecurity is achieved instead of security through obscurity.MoU representatives in the O-RAN Alliance support development of open RAN specifications thatenable compliance with security and data privacy requirements in the EU to allow MNOs to buildsolutions that meet security and legislative requirements.OPEN RAN SECURITY WHITE PAPER7

4. The O-RAN risk-based approach to cybersecurityO-RAN architecture adds beyond the 5G 3GPP specifications new open interfaces and functions toenable secure supplier diversity. Security concerns are similar to those of 5G networks e.g. the cloud,virtualization, containerization, edge computing, network slicing and AI/ML. Since the O-RANarchitecture is built based on 3GPP specifications, it emerges and benefits from the 3GPP’s securityfeatures.Innovation and supplier diversity in an open ecosystem will bring forward additional diverse securitysolutions to address potential threats and mitigate risk because of the ability to monitor, detect,prevent and respond more quickly.O-RAN Alliance recognizes cybersecurity as an essential topic on its agenda and is earnestly searchingfor the optimal means to improve cyber resilience of the O-RAN system.MoU operators who will deploy and manage O-RAN infrastructure are committed to handlecybersecurity seriously with constant attention. They want to know how well cyber risks facing O-RANare being managed in their organizations, processes, and services. They need to have a thoroughunderstanding of cyber risks in open and interoperable networks like O-RAN systems and have to knowhow to leverage from security measures and mitigation techniques specified within O-RANspecifications and have to identify hardening measures for operational environments so to cope withcyber risks and regulations.A risk-based threat modeling and remediation analysis has been conducted within the O-RAN Alliancein line with ISO 27005 [1] for building an effective security O-RAN architecture, as well as managingand continuously decreasing risks of the overall O-RAN system. The proposed risk assessment processhas three parts: risk identification, risk analysis and risk evaluation. This means that one has first toidentify valuable assets, then consider the threats that could compromise those assets and finallyperform a risk assessment in order to estimate the actual damage generated by the realization of anythreat to these assets.The risk-based threat modeling and remediation analysis is focusing on the critical O-RAN componentsand interfaces to identify the true risks to the O-RAN’s most valuable assets, prioritize actions tomitigate those risks to acceptable levels and deliver compliance to the national authority proceduresand overall regulation framework (EU 5G toolbox, ). The concept of “zero trust” [2] networking isapplied on the risk assessment meaning that anything that connects to a O-RAN network shouldinherently not be trusted unless it can be verified.Following the ISO 27005 methodology [1], the O-RAN risk-based threat modeling and remediationanalysis assesses and aligns security with the goals that the O-RAN Alliance has identified the followingitems:-Item 1: The main stakeholders contributing to the security of O-RAN networksItem 2: The main assets, their degree of sensitivity and security propertiesItem 3: The main threats actors, threats and vulnerabilities posed to O-RAN networksItem 4: The main security principles to enforce the security of the O-RAN systemItem 5: The main risks in terms of impact and likelihood based on risk criteriaItem 6: Prioritization which risks need to be addressed, and in which orderItem 7: Risk monitoring and reviewOPEN RAN SECURITY WHITE PAPER8

MoU operators are aware that the identified risks are not static and can change abruptly. Therefore,risks will be continuously monitored, where the characteristics of each threat (e.g., likelihood, impact,vulnerabilities, and assets) will be reassessed over time to keep an up‐to‐date risk picture for O-RAN.MoU operators will also keep a close eye on:-Any new assets included within the risk management scopeAsset values that require modification in response to changing O-RAN requirementsNew threats, whether external or internal, that have yet to be assessedSecurity incidents.This risk-based approach enables O-RAN members to focus their efforts on the risks that are the mostsignificant to their operations.5. O-RAN Security Focus Group activitiesThe SFG work is captured in four security specifications that are the pillars of the O-RAN securityarchitecture that cover threat modeling, security requirements, protocols and tests. Latest approvedSFG specifications are accessible on the O-RAN ALLIANCE web site [12].5.1. O-RAN Security Threat Modeling and Remediation Analysis 2.1 [3]This document is a risk-based threat modeling and remediation analysis used for managing risksand for building an effective O-RAN security architecture. The risk assessment methodology basedon ISO 27.005 standard described in previous section has been used within the “O-RAN SecurityThreat Modeling and Remediation Analysis” document. The version 2.1 contains description ofItem 1 to 5 addressed in section 4 above:---Main stakeholders managing, operating, and maintaining O-RAN systems with their associatedresponsibilities are identified. Among them, three stakeholders are of particular relevance tothe cybersecurity of O-RAN networks: on one hand, mobile network operators have a central,decision-making role, giving them leverage on the overall secure operation of their networks,and on the other hand, telecom equipment suppliers and cloud providers, who are responsiblefor the provision of software and hardware required to operate O-RAN networks.O-RAN's key assets to be protected are determined together with their location in component.42 assets are identified with their protection level in terms of Confidentiality, Integrity,Availability (CIA), Replay and Authenticity when at rest and in transit.Based on the critical assets coming from the previous item, their vulnerabilities, potentialthreats and threat agents have been characterized.The assessed threats are consolidated from various sources, including O-RAN specifications,main 5G standardization documents and telecommunication best practices (e.g. 3GPP, ITU,ETSI, ENISA, ISO, NIST and GSMA).Threat IDUnique identification per Threat (e.g. T-XX-01)Threat titleTitle of the threatThreat descriptionDescription of the ThreatThreat agentAn individual or group that can manifest a threatOPEN RAN SECURITY WHITE PAPER9

VulnerabilityWhat vulnerabilities can the threat exploits?Threatened AssetsImpacted Asset(s)AffectedComponentsThe list of Components impacted by that ThreatFigure 2: Threat template used in O-RAN Threat Model and Remediation AnalysisThe threat modelling and remediation analysis identified specific O-RAN vulnerabilities. Amongthem, there are the unauthorized access to O-DU, O-CU-CP, O-CU-UP and RU to degrade RANperformance or execute broader network attack, the unprotected synchronization and controlplane traffic on Open Fronthaul Interface, the Near-RT RIC conflicts with O-gNB, the x/rAppsconflicts and the x/rApps access to network and subscriber data.The identified threats are grouped in seven categories to cover the overall O-RAN architecture.Among of themoooooooCommon threats related to the insecure design, misconfiguration, weakauthentication, and lack of access control.Threats against the Fronthaul interface and M-S-C-U Planes including the MiTMattacks, unauthorized access to the FH interface, spoofing of M-S-C-U Planes messagesand DoS attacks against a Master clock.Threats against Near RT-RIC xApps, Non-RT RIC and rApps.Threats against SMO such DoS attacks and improper/missing authorization weaknesson SMO functionsThreats against O-Cloud including the compromise of VNF/CNF images and embeddedsecrets, the weak orchestrator configurations, access controls and isolation, themisuse of a VM/Container to attack other VM/Container, hypervisor/containerengine, other hosts (memory, network, storage), etc., the spoofing and eavesdroppingon network traffic to access all O-RAN network data processed in the workload andthe compromise auxiliary/supporting network services.Threats to open source including the use of SW components with knownvulnerabilities and untrusted libraries that can be exploited by an attacker through abackdoor attack.Threats against ML including data poisoning attacks, altering a machine learning modeland transfer learning attack.The rationale between the 49 identified threats and the vulnerabilities within the O-RAN’sassets are provided.As already anticipated above, it is worth highlighting that O-RAN expanded attack surface isbounded by explicit security requirements in a Zero Trust environment. A zero-trustarchitecture means even in a closed proprietary implementation, interfaces between internalproprietary software modules shouldn’t be trusted. Many of today’s security threats comefrom faults in one module opening access to compromise of other critical modules. From thisstandpoint, even closed proprietary implementations should examine their own internalproprietary threat surfaces. Closed proprietary RAN implementations by a single vendor hassimilar attack surface within their own internal components, and because the implementationis proprietary there is no way to demonstrate whether they are taking a zero-trust approachto their internal interfaces because it is hidden without clear stated requirements to be testedagainst.OPEN RAN SECURITY WHITE PAPER 10

---Security principles based on the zero-trust approach are defined to adequately address theidentified threats in the previous step. 16 Security Principles are identified among them,authentication and access control mechanisms, trusted communication, secure cryptographicoperations, secure storage, secure boot, trusted and secure update, secure management ofopen-source components, robust isolation, continuous security development, testing, logging,monitoring and vulnerability handling, and security assurance. The security principles rationaleis provided to trace all security principles back to threats and demonstrate that the definedsecurity principles contribute to counter those threats. These principles are intended to drivespecifications of normative security requirements (see “O-RAN Security RequirementsSpecifications” [4] in section 5.2 below) and provide security principles which vendors andoperators should address when building a secure end-to-end O-RAN system.The process of risk assessment evaluates the risk for each asset-threat-vulnerabilitycombination and then assigns it a ris

stakeholders on 5G security initiatives, and socializing MoU parties' views on Open RAN security. 2. Open RAN / O-RAN ALLIANCE O-RAN Alliance was founded in February 2018 by five operators (AT&T, China Mobile, Deutsche Telekom, NTT DOCOMO and Orange; with TIM S.P.A joining before the end of 2018) with the aim of