Runtime attestation protects apps in open radio networks
rApp/xApp Attestation: A New Security Use Case for O-RAN
Cryptography and SecurityNetworking and Internet Architecture
Summary
Open Radio Access Networks (O-RAN) allow different vendors to build parts of mobile networks, but this flexibility can cause security risks. The authors introduce a way to check if certain software components called rApps and xApps are running correctly and haven't been tampered with while in use. Instead of inventing new security tools, they show how existing verification methods can fit into the O-RAN setup. Their prototype runs quickly enough to not interfere with important network functions. They also discuss challenges like scaling the system and deciding what to do if tampering is detected.
What this means in practice
- •For mobile network operators: Use runtime attestation to verify that rApps and xApps in O-RAN environments remain secure and untampered during operation.
- •For telecom software developers: Integrate built-in attestation modules into the RIC platform to enable runtime integrity checks for O-RAN applications without disrupting time-sensitive tasks.
Authors
Hamed Alimohammadi, Burcu Şahin, Arda Akman, Chuan Heng Foh, Periklis Chatzimisios, Mohammad Shojafar
Abstract
The disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also expose the RAN Intelligent Controller (RIC) ecosystem to new runtime security risks. Existing O-RAN specifications define strong safeguards for onboarding, authentication, identity management, and secure communication; however, they do not provide a concrete mechanism for verifying whether deployed rApps and xApps remain in their intended, untampered state during operation. This paper introduces rApp/xApp attestation as a RIC-native O-RAN security use case for runtime integrity verification. Rather than proposing a new cryptographic protocol, the work defines how existing integrity verification techniques can be integrated into O-RAN through attestation modules, attestation agents, RIC application interfaces, and SMO-driven policy coordination. We map the use case to relevant O-RAN Alliance working groups, identify required standardization extensions, and demonstrate feasibility through a lightweight hash-based prototype implemented on the Near-RT RIC platform. Experimental results show attestation latencies below 40 ms across multiple cryptographic hash functions, indicating that runtime attestation can be performed without disrupting time-sensitive RIC operations when appropriately scheduled. Finally, we discuss remaining technical and standardization challenges, including trusted verification, known-good runtime states, scalability, mitigation policies, and future hybrid attestation mechanisms.