Securing elastic radio access networks

为了满足对5G网络中的连接性的激增的需求，移动的网络运营商（MNO）发现难以抵消传统无线电接入网络（RAN）的CAPEX/OPEX。云RAN（C-RAN）是一种可行的替代方案，提供看似无限的资源，基带单元（BBU）的集中式操作以及轻量级远程无线电头端（RRH）的可扩展部署。Elastic RAN（E-RAN）是爱立信对C-RAN的实现，提供基带网络，以实现虚拟BBU和虚拟RRH之间的灵活协调，这些虚拟BBU和RRH通过软件定义网络（SDN）和网络功能虚拟化（NFV）进行管理。 E-RAN专注于灵活的5G网络切片，以满足终端用户对不同级别QoS的需求。此外，E-RAN中的虚拟化和弹性资源分配促进了E-RAN内的附加服务（诸如内容分发网络（CDN）服务）的按需托管。然而，由于E-RAN由大量充当关键连接点的资源组成，因此安全漏洞（例如DDoS攻击）可能会危及系统和数据的完整性，并中断服务并降低合法最终用户的QoS/QoE。因此，必须保护E-RAN及其服务，以确保高水平的鲁棒性和可靠性。 我们的目标包括：（i）自动保护E-RAN免受DDoS攻击，以及（ii）在网络边缘高效且自动地部署对策。我们将利用机器学习（ML）来开发基于异常的入侵检测的新技术。对于响应和缓解，我们将利用ML和SDN/NFV的灵活性，在多租户E-RAN基础设施上进行高效的网络切片重新配置。拟议的研究将扩大入侵检测和缓解的范围，包括对E-RAN中零日威胁的保护。与行业合作伙伴爱立信加拿大合作取得的进展将对加拿大移动网络运营商的C-RAN安全产生影响。

To meet the surge in demand for connectivity in 5G networks, mobile network operators (MNOs) are finding it difficult to offset the CAPEX/OPEX of traditional Radio Access Networks (RANs). Cloud RANs (C-RANs) are a feasible alternative, offering seemingly infinite resources, centralized operation of baseband units (BBUs), and scalable deployment of lightweight remote radio heads (RRHs). Elastic RAN (E-RAN), Ericsson's implementation of C-RAN, provides baseband networking to enable flexible coordination between virtual BBUs and virtual RRHs that are managed via software-defined networking (SDN) and network functions virtualization (NFV). E-RAN focuses on the flexible 5G network slicing to meet end-user demands for different levels of QoS. Furthermore, virtualization and elastic resource allocation in E-RAN facilitate on-demand hosting of additional services such as Content Distribution Network (CDN) services within the E-RAN. However, as E-RANs consist of a large number of resources that act as pivotal connecting points, a security breach, such as a DDoS attack, could compromise the integrity of system and data, and disrupt services and degrade QoS/QoE for legitimate end-users. Hence, it is imperative to secure E-RANs and their services, to ensure high levels of robustness and dependability. Our objectives include: (i) automatically protect E-RANs against DDoS attacks, and (ii) efficiently and automatically deploy countermeasures at the network edge. We will leverage machine learning (ML) to develop novel techniques for anomaly-based intrusion detection. For response and mitigation, we will leverage ML and the flexibility of SDN/NFV for efficient network slice reconfiguration across a multi-tenant E-RAN infrastructure. The proposed research will broaden the scope of intrusion detection and mitigation, including protection against zero-day threats in E-RANs. Advances made in collaboration with the industry partner, Ericsson Canada, will have an impact on securing C-RANs for Canadian MNOs.