Towards a Multi-Layer Defence Framework for Securing Near-Real-Time Operations in Open RAN

2025-12-01

AI Summary

To address security threats—including message tampering, telemetry poisoning, and malicious xApp hijacking—against the Open RAN near-real-time (near-RT) control loop at runtime, this paper proposes the first three-layer runtime threat model targeting E2 interface control flows: message layer, data layer, and control logic layer. We design a lightweight, multi-layered defense framework comprising: (i) E2-semantics-aware message signing and verification; (ii) LSTM-based modeling of telemetry time-series features for poisoning attack detection; and (iii) execution-state hash challenge-response for remote, runtime xApp authentication. Evaluated on a real-world O-RAN testbed, our solution incurs an average latency of <80 ms under 500 UE load, achieves high detection accuracy, imposes low system overhead, and supports policy-driven deployment and scalable integration—demonstrating strong practical deployability.

Technology Category

• Planning, Routing, and Scheduling: Plan Execution and Monitoring
• Application Domains: Mobility, Driving & Flight
• Machine Learning: Learning on the Edge & Model Compression

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments
• Security and Privacy: Authentication, authorization, and access control
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Securing the near-real-time (near-RT) control operations in Open Radio Access Networks (Open RAN) is increasingly critical, yet remains insufficiently addressed, as new runtime threats target the control loop while the system is operational. In this paper, we propose a multi-layer defence framework designed to enhance the security of near-RT RAN Intelligent Controller (RIC) operations. We classify operational-time threats into three categories, message-level, data-level, and control logic-level, and design and implement a dedicated detection and mitigation component for each: a signature-based E2 message inspection module performing structural and semantic validation of signalling exchanges, a telemetry poisoning detector based on temporal anomaly scoring using an LSTM network, and a runtime xApp attestation mechanism based on execution-time hash challenge-response. The framework is evaluated on an O-RAN testbed comprising FlexRIC and a commercial RAN emulator, demonstrating effective detection rates, low latency overheads, and practical integration feasibility. Results indicate that the proposed safeguards can operate within near-RT time constraints while significantly improving protection against runtime attacks, introducing less than 80 ms overhead for a network with 500 User Equipment (UEs). Overall, this work lays the foundation for deployable, layered, and policy-driven runtime security architectures for the near-RT RIC control loop in Open RAN, and provides an extensible framework into which future mitigation policies and threat-specific modules can be integrated.

Problem

• Securing near-real-time control operations in Open RAN against runtime threats
• Detecting and mitigating message-level, data-level, and control logic-level attacks
• Providing a layered defense framework with low latency for operational feasibility

Innovation

• Multi-layer defence framework for Open RAN near-RT security
• Signature-based message inspection and LSTM anomaly detection
• Runtime xApp attestation with hash challenge-response mechanism