Demo: Strict Architectural Separation Between Operators in Shared RANs

RAN sharing allows multiple operators to efficiently share parts of a 5G radio network. However, it also poses a risk to security, as some shared components have the ability to eavesdrop and modify the communication of all connected devices, regardless of the operator they are connected to. This demo paper introduces a method to architecturally improve tenant separation in 5G/6G networks utilizing RAN sharing. We introduce an F1AP proxy, which allows each operator to control their own Central Unit (CU), requiring only the Distributed Units (DU) and proxies to be shared. Since the keys needed to decrypt or modify user plane and control plane traffic are only stored and processed at the CU, our approach enables a strict cryptographic separation while not requiring changes to existing NG-RAN implementations. We demonstrate the feasibility of the approach with a prototypical implementation of the proxy in an otherwise unmodified OpenAirInterface setup.