NSF Convergence Accelerator Track: G: The Security-Enhanced Radio Access Network (SE-RAN)

SRI国际公司、俄亥俄州立大学（OSU）和AccuKnox公司将为下一代开放无线接入网（O-RAN）兼容的5G+移动架构开发创新的边缘到核心安全服务。这个名为安全增强型无线接入网络（SE-RAN）的合作项目将加强5G移动基础设施，抵御针对5G网络、协议及其控制层服务中的漏洞的各种攻击。该项目的核心是变革性网络管理服务，为5G运营商在整个5G网络基础设施中提供前所未有的威胁识别、政策执行和合规性监控。SE-RAN项目特别侧重于保护关键任务5G网络，提供针对复杂移动网络对手的全面保护架构。SE-RAN项目将提供符合O-RAN标准的5G原生应用保护平台（5GNAPP），用于跨移动设备、基站、RAN操作和5G控制平面的监控和内线策略实施。它将大大提高5G网络的可信度，包括在移动设备隐私方面的安全性、5G通信的保密性和完整性、对攻击的抵抗力，包括对控制平面渗透的企图，以及对移动基础设施及其用户的攻击的实时检测。该项目涉及与主要开源利益相关者合作，将安全规范和模块与顶级5G开源O-RAN项目集成在一起。该项目还将与整个政府的5G集成商合作，过渡模块化安全服务，以解决各种关键任务用例。最后，该项目将通过与积极参与新型和颠覆性5G安全和隐私技术开发的初创企业、行业领导者和投资者建立战略关系，通过过渡SE-RAN技术，促进对美国信息技术产业的可持续影响。SE-RAN项目将培育一个社区，创建模块化的o - ran兼容安全组件，以增强移动网络基础设施的部署和运行时管理。这些解决方案将扩展现有的O-RAN联盟的开放软件架构，以解决至少两个基本问题。第一个问题是由于移动网络控制平面迁移到基于云的操作环境而产生的广泛的攻击面。虽然将RAN智能控制器（RIC）集成到Kubernetes框架中大大提高了控制逻辑的可扩展性和可扩展性，但它也将控制平面暴露在对抗策略的广度和开源供应链漏洞之下，这些漏洞困扰着现有的云生态系统。第二个问题是目前对5G核心网络运营缺乏可视性：如果不能以足够的粒度观察移动网络的运营，就无法确保移动网络的安全。SE-RAN项目代表了第一个以安全为重点的基站内部遥测流，它将促进O-RAN兼容5G开源软件（OSS）生态系统中的运行时安全监控。SE-RAN基于四项突破性创新。首先，SE-RAN将提供模块化基站扩展（即O-RAN服务模型），提供先进的5G协议第三层安全审计，旨在改变5G运营商跟踪网络中每个用户设备（UE）设备和基站的安全相关状态的能力。其次，SE-RAN将提供首个运行时5G-IDS（入侵检测系统）控制平面应用，用于基于恶意射频（RF）的攻击和异常检测。第三，SE-RAN将推出5G- kubearmor，这是第一个近实时RAN智能控制器（nRT-RIC）安全策略生成和执行引擎，使5G管理员能够使用应用层最不允许的安全策略来保护5G控制平面。最后，在统一的安全事件和事件管理（SIEM）系统下，将推出首个集成所有三种技术的5GNAPP管理服务。该项目的总体效益将是一个变革性的安全框架，为5G运营商提供前所未有的威胁识别、政策执行和合规监控，覆盖整个5G网络基础设施。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

SRI International, Ohio State University (OSU), and AccuKnox Inc. will develop innovative edge-to-core security services for the next generation of the Open Radio Access Network (O-RAN) compliant 5G+ mobile architecture. This collaborative project, named Security-Enhanced Radio Access Network (SE-RAN), will fortify 5G mobile infrastructures against a wide range of attacks that target vulnerabilities within 5G networks, protocols, and their control-layer services. The project's centerpiece is a transformative network management service, offering 5G operators an unprecedented level of threat identification, policy enforcement, and compliance monitoring throughout their entire 5G network infrastructures. Project SE-RAN specifically focuses on safeguarding mission-critical 5G networks, providing a comprehensive protection architecture against sophisticated mobile-network adversaries.Project SE-RAN will deliver an O-RAN compliant 5G-Native Application Protection Platform (5GNAPP) for monitoring and inline policy enforcement across mobile devices, base stations, RAN operations, and the 5G control plane. It will substantially enhance the trustworthiness of 5G networks, including security with respect to mobile device privacy, 5G communications confidentiality and integrity, resistance to attacks, including attempts at control-plane infiltration, and live detection of attacks against the mobile infrastructure and its users. The project involves collaboration with key open-source stakeholders to integrate security specifications and modules with top-tier 5G open-source O-RAN projects. The project will also work with 5G integrators throughout the government to transition modular security services to address various mission-critical use cases. Finally, the project will foster sustainable impacts on the U.S. information technology industries by transitioning SE-RAN technologies through strategic relationships with startups, industry leaders, and investors actively involved in the development of novel and disruptive 5G security and privacy technologies.Project SE-RAN will foster a community that creates modular O-RAN-compliant security components to enhance the deployment and runtime management of mobile network infrastructures. These solutions will extend the existing O-RAN consortium’s open software architecture to tackle at least two fundamental problems. The first problem is the extensive attack surface that arises from the migration of the mobile network control plane into a cloud-based operating environment. While the integration of the RAN Intelligent Controller (RIC) into a Kubernetes framework dramatically increases the scalability and extensibility of control logic, it also exposes the control plane to the breadth of adversarial tactics and open-source supply chain vulnerabilities that plague existing cloud ecosystems. The second problem is the existing lack of visibility into core 5G network operations: one cannot secure the mobile network if one cannot observe its operations with sufficient granularity. Project SE-RAN represents the first security-focused, base-station-internal telemetry stream that will facilitate runtime security monitoring within the O-RAN compliant 5G Open-Source Software (OSS) ecosystem.SE-RAN is based on four groundbreaking innovations. First, SE-RAN will deliver a modular base station extension (i.e., an O-RAN service model) that delivers advanced 5G-protocol layer-3 security auditing designed to transform the ability of 5G operators to track the security-relevant state of every user equipment (UE) device and base station in the network. Second, SE-RAN will deliver the first runtime 5G-IDS (intrusion detection system) control plane application for malicious radio frequency (RF)-based exploit and anomaly detection. Third, SE-RAN will introduce 5G-KubeArmor, the first near real-time RAN Intelligent Controller (nRT-RIC) security policy generation and enforcement engine, enabling 5G administrators to secure the 5G control plane using application-layer least-permissive security policies. Finally, it will introduce the first 5GNAPP management service that integrates all three technologies under a unified security incident and event management (SIEM) system. The overall benefit of this project will be a transformative security framework that provides 5G operators with unprecedented threat identification, policy enforcement, and compliance monitoring that spans the entire 5G network infrastructure.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.