Securing xApps in Open RAN: A Hierarchical Approach to Authentication and Authorisation

The Open Radio Access Network (RAN) represents a significant advancement in the ongoing evolution of mobile networks, transitioning from proprietary physical hardware to virtualised network functions. Open RAN advocates for a disaggregated RAN utilising commercial off-the-shelf (COTS) hardware. The O-RAN Alliance is the preeminent organisation in the Open RAN initiative, guiding the industry towards a vendor-neutral radio access network characterised by open interfaces and protocols. The introduction of RAN Intelligent Controllers (RICs) and the ability to deploy third-party services on these RICs expedite the innovation within the RAN. The two RICs, non-real-time RIC and near-real-time RIC, enhance the operation of RAN by facilitating the deployment of third-party services, either as an rApp for non-real-time RIC or as an xApp for near-real-time RIC. However, this new disaggregated and open RAN expands the threat surface and introduces novel security and privacy challenges that were previously absent, and these issues remain unaddressed. The introduction of new stakeholders, such as third-party application providers and cloud service providers, into the RAN ecosystem presents potential vulnerabilities. This paper proposes a hierarchical management strategy to tackle security challenges in Open RAN, enabling authorisation, authentication, and monitoring for third-party applications. Experimental evaluations across multiple configurations demonstrate that the proposed framework is scalable and imposes minimal overhead, making it a practical solution for securing next-generation RAN deployments.