Layered RAN Security Middleware for Stateless Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and scope of Radio Access Networks (RANs) have introduced new security challenges, including vulnerabilities from open RAN architectures, compromised code execution, and resource exhaustion attacks.
Innovation Solution
A layered security approach using Domain Specific Language (DSL) to manage secure and optimized RAN code production, combined with automation to guarantee security and resilience in telecommunication systems. This involves separating data movement and formatting operations from compute operations, with each layer implementing formal checking procedures to identify and eradicate potential attack surfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If RAN complexity increases to support advanced 5G features, then network capability and functionality improve, but security vulnerability and attack surface increase
Solution Approach 1:
The patent segments the RAN security architecture into multiple independent layers: a security layer that validates data packets against constraints, a stateless function execution layer that processes validated data, and a configuration management layer. This segmentation isolates security functions from network processing functions, allowing the network to handle complex 5G features while maintaining security through layered validation and constraint checking at each segment.
Solution Approach 2:
The patent introduces a security layer as an intermediary between data packet reception and stateless function execution. This intermediary layer validates incoming data packets against predefined constraints before allowing them to reach the execution layer, effectively mediating between the need for advanced network capabilities and the requirement for security validation.
2Adaptability or versatility
If open RAN architecture is adopted to enable vendor diversity and innovation, then system versatility improves, but security risk from compromised code execution increases
Solution Approach 1:
The patent implements preliminary action by validating data packets against security constraints before they are executed by stateless functions. The security layer performs constraint validation in advance, ensuring that only authorized and safe data packets proceed to the execution layer, thereby preventing compromised code execution while maintaining open RAN vendor diversity.
Solution Approach 2:
The patent employs stateless functions that are executed once and then discarded, eliminating persistent state that could be exploited for code compromise. Each function operates independently without maintaining state between executions, making the system more resilient to compromised code while preserving the flexibility of open RAN architecture.
3Productivity
If stateful processing is used to maintain network state, then functional capability improves, but attack surface for state space manipulation increases
Solution Approach 1:
The patent extracts state management functionality from the network processing path by implementing stateless functions that operate on validated data packets without maintaining persistent state. The security layer handles state-related validation separately, allowing the main processing path to be stateless and thus immune to state space manipulation attacks while preserving network processing capability.
Solution Approach 2:
The patent segments the processing architecture into a security layer that handles state validation and constraint checking, and a stateless function execution layer that processes data without maintaining state. This segmentation separates state management from data processing, eliminating the attack surface for state space manipulation while maintaining full network processing capability.
4Reliability
If security validation is performed on all data packets, then security resilience improves, but processing time and latency increase
Solution Approach 1:
The patent performs security validation in advance through the security layer that checks data packets against constraints before they reach the execution layer. By performing this validation preliminarily and efficiently, the system ensures security resilience while minimizing the time added to the processing pipeline, as the validation is done in a dedicated layer rather than during execution.
Data Source
AI summary
A method for enforcing security of radio access networks (RANs) is provided. The method includes running code in a secured middleware that can manipulate unit functions that process data. The method includes receiving data flows from one or more devices associated with the RAN, wherein the data flows are maintained in a first data space. The method includes validating the data flows based on security constraints. The method further includes executing stateless functions according to a configuration file of the middleware, wherein the configuration file is maintained independently from other data stored by the middleware. The method further includes updating a state of the RAN based on analysis results of the data validation and execution of the stateless functions.