Search

Open Radio Access Networks (Open RANs) enable flexible cellular network deployments by adopting open-source software and white-box hardware to build reference architectures customizable to innovative target use cases. The Open Radio Access Network (O-RAN) Alliance defines specifications introducing new Radio Access Network (RAN) Intelligent Controller (RIC) functions that leverage open interfaces between disaggregated RAN elements to provide precise RAN control and monitoring capabilities using applications called xApps and rApps. Multiple xApps targeting novel use cases have been developed by the O-RAN Software Community (OSC) and incubated on the Near-Real-Time RIC (Near-RT RIC) platform. However, the Near-RT RIC has, so far, been demonstrated to support only a single xApp capable of controlling the RAN elements. This work studies the scalability of the OSC Near-RT RIC to support simultaneous control signaling by multiple xApps targeting the RAN element. We particularly analyze its internal message routing mechanism and experimentally expose the design limitations of the OSC Near-RT RIC in supporting simultaneous xApp control. To this end, we extend an existing open-source RAN slicing xApp and prototype a slice-aware User Equipment (UE) admission control xApp implementing the RAN Control E2 Service Model (E2SM) to demonstrate a multi-xApp control signaling use case and assess the control routing capability of the Near-RT RIC through an end-to-end O-RAN experiment using the OSC Near-RT RIC platform and an open-source Software Defined Radio (SDR) stack. We also propose and implement a tag-based message routing strategy for disambiguating multiple xApps to enable simultaneous xApp control. Our experimental results prove that our routing strategy ensures 100% delivery of control messages between multiple xApps and E2 Nodes while guaranteeing control scalability and xApp non-repudiation. Using the improved Near-RT RIC platform, we assess the security posture and resiliency of the OSC Near-RT RIC in the event of volumetric application layer Denial of Service (DoS) attacks exploiting the E2 interface and the E2 Application Protocol (E2AP). We design a DoS attack agent capable of orchestrating a signaling storm attack and a high-intensity resource exhaustion DoS attack on the Near-RT RIC platform components. Additionally, we develop a latency monitoring xApp solution to detect application layer signaling storm attacks. The experimental results indicate that signaling storm attacks targeting the E2 Terminator on the Near-RT RIC cause control loop violations over the E2 interface affecting service delivery and optimization for benign E2 Nodes. We also observe that a high-intensity E2 Setup DoS attack results in unbridled memory resource consumption leading to service interruption and application crash. Our results also show that the E2 interface at the Near-RT RIC is vulnerable to volumetric application layer DoS attacks, and robust monitoring, load-balancing, and DoS mitigation strategies must be incorporated to guarantee resiliency and high reliability of the Near-RT RIC. Master of Science Telecommunication networks need sophisticated controllers to support novel use cases and applications. Cellular base stations can be managed and optimized for better user experience through an intelligent radio controller called the Near-Real-Time Radio Access Network (RAN) Intelligent Controller (RIC) (Near-RT RIC), defined by the Open Radio Access Network (O-RAN) Alliance. This controller supports simultaneous connections to multiple base stations through the E2 interface and allows simple radio applications called xApps to control the behavior of those base stations. In this research work, we study the performance and behavior of the Near-RT RIC when a malicious or compromised base station tries to overwhelm the controller through a Denial of Service (DoS) attack. We develop a solution to determine the application layer communication delay between the controller and the base station to detect potential attacks trying to compromise the functionality and availability of the controller. To implement this solution, we also upgrade the controller to support multiple radio applications to interact and control one or more base stations simultaneously. Through the developed solution, we prove that the O-RAN Software Community (OSC) Near-RT RIC is highly vulnerable to DoS attacks from malicious base stations targeting the controller over the E2 interface.

RESUMEN: El desarrollo de las tecnologías 5G y 6G viene acompañado de cambios importantes en las redes de acceso, como consecuencia de la capacidad de virtualizar y ejecutar, sobre equipos de propósito general, las funcionalidades de las estaciones base que antes se debían realizar en equipos dedicados, complejos y de altas capacidades. Gracias a esta transformación surge el concepto de functional split. Esta virtualización, basada en Software Defined Network/Network Function Virtualization (SDN/NFV), ha permitido junto con el de Cloud/Centralizad Radio Access Network (C-RAN) una mayor cooperación de los elementos de la red, lográndose una mayor adaptación ante la aparición de nuevos servicios, con requisitos heterogéneos, y una mayor demanda. Por otro lado, se han desarrollado soluciones Software Defined Radio (SDR) que permiten desplegar estaciones bases de diferentes generaciones celulares en equipos de bajas prestaciones, facilitando el proceso de desarrollo de soluciones y su posterior validación por personal investigador y académico, ajeno a las operadoras. En este trabajo, se ha utilizado la solución SDR srsRAN (antes denominada srsLTE), adaptando su implementación para lograr la separación y aislamiento de diversas funcionalidades de red. De este modo, se consigue centralizar parte de su operación, que se ejecuta de forma virtualizada, en el propio equipo u otro. Además, se ha realizado un estudio del consumo computacional de la implementación realizada en diferentes equipos y la validación de las diferentes divisiones funcionales, llamadas splits, desarrolladas. ABSTRACT: The development of 5G and 6G technologies comes together with major changes in the access network architecture, due to the ability to virtualise and execute, in general purpose equipment, base station functionalities that previously were only deployed in specific purpose devices. This evolution gave rise to the concept of “functional split”. This virtualisation capability, leveraging Software Defined Network/Network Function Virtualisation (SDN/NFV), together with the Cloud/Centralised Radio Access Network (C-RAN), has enabled a greater cooperation between network elements, easing the adaptation of new emerging services, with heterogeneous requirements, and the greater capacity demand. On the other hand, Software Defined Radio (SDR) solutions have been developed, and they allow the deployment of base stations (belonging to different cellular technologies) in low-capability equipment. In turn, it has simplified the process of developing solutions and their subsequent validation by the research and scientific communities, outside operators. In this work, we have modified the implementation of the SDR solution srsRAN (previously named srsLTE) to achieve the separation and isolation of different network functionalities. In this way, it is possible to centralise part of its operation, which is executed in virtualised resources, at the same or another equipment. In addition, we have also studied the computational consumption of the implemented solution in different devices, and we have assessed the feasibility of various functional divisions, called “splits”. Máster en Ingeniería de Telecomunicación