CHAPTER 10 · MODULE M10 · NARRATED VIDEO + CAPSTONE
Defend it.
Then build it all.
Everything we opened, we also exposed. This finale defends it: the WG11 threat model per interface and the mandated controls (802.1X + MACsec on fronthaul, TLS + NACM on O1/M-plane, IPsec on E2/D2), then the O-Cloud and O2 (IMS vs DMS), network slicing across O1/A1/E2, the open-source stack, and your capstone — a 20-site greenfield design. From O-RAN WG11 STS/SecProt/SRCS, WG6 O2, and the slicing arch.
per-ifthreatsWG11 STS
802.1X·MACsecfronthaul
TLS·IPsecO1 · E2
O2IMS/DMSO-Cloud
20-sitecapstonedesign task
ENkaraoke subs
▶ VIDEO · CHAPTER 10 · NARRATED
Security, the O-Cloud, slicing — and your capstone
The player screen is a live animation stage — threats fan out of each interface and controls snap on, O2 splits into IMS and DMS, a slice threads O1/A1/E2, and the capstone design task assembles, exactly as the narration reaches each idea. Karaoke subtitles EN + Persian, fullscreen.
◈
LAB · INTERFACE → THREAT → CONTROL MAPPER
Secure every seam →
Click an interface; its threats fan out and the mandated O-RAN control snaps on, with the spec clause.
LAB · INTERFACE → THREAT → CONTROL · WG11
Secure every seam
Click an interface to see its threat surface and the O-RAN-mandated control. Openness only stays safe when every seam is protected.
Open Fronthaul
threat surface
🛡 mandated control
spec clause—
REFERENCE · CONTROLS PER INTERFACE · WG11 SecProtSpec
Every seam, its mandated control
O-RAN does not hope for security — it specifies it, interface by interface.
| Interface | Threats | Mandated control |
|---|---|---|
| Open Fronthaul | tapping, rogue O-RU, timing attack | 802.1X (access) + MACsec (encrypt/auth); MACsec bypass for timing |
| O1 / M-plane | config tampering, unauthorized access | NETCONF over TLS 1.2/1.3 (mutual) + NACM authorization |
| E2 | injection, eavesdropping | IPsec tunnel (Near-RT RIC ↔ E2 nodes) |
| D2 | inter-O-DU tampering | IPsec |
| O2 | infrastructure compromise | TLS + authentication (IMS/DMS) |
THE PATTERN · SRCS
The controls follow one pattern everywhere: authenticate the endpoints, encrypt the traffic, authorize the actions. The threats live in the WG11 STS threat model; the protocols in SecProtSpec (TLS profiles per 3GPP TS 33.210; DTLS 1.0 forbidden); the requirements in SRCS. Get it right and Open RAN is as safe as any RAN.
The controls follow one pattern everywhere: authenticate the endpoints, encrypt the traffic, authorize the actions. The threats live in the WG11 STS threat model; the protocols in SecProtSpec (TLS profiles per 3GPP TS 33.210; DTLS 1.0 forbidden); the requirements in SRCS. Get it right and Open RAN is as safe as any RAN.
REFERENCE · O-CLOUD / O2 & SLICING · WG6 + WG1
Where it runs, and how it slices
| Thing | What it manages | Example |
|---|---|---|
| O2-IMS | the infrastructure itself | servers, OS, platform health |
| O2-DMS | the workloads on top | deploy / scale O-DU, RICs |
| Slice intent | starts at the SMO slice mgmt fn | URLLC vs mMTC on one hardware |
| Slice touchpoints | O1 (config), A1 (policy), E2 (enforce) | a thread, not one interface |
IMS vs DMS · THE INTERVIEW QUESTION
O2-IMS runs the cloud (is the infrastructure healthy?); O2-DMS runs the applications on the cloud (deploy and scale the NFs). A network slice is not one interface — it is an intent from the SMO that flows down through O1 to configure, is shaped by A1 policies, and is enforced per-slice on E2. It sits last because it only makes sense once you know every interface it touches.
O2-IMS runs the cloud (is the infrastructure healthy?); O2-DMS runs the applications on the cloud (deploy and scale the NFs). A network slice is not one interface — it is an intent from the SMO that flows down through O1 to configure, is shaped by A1 policies, and is enforced per-slice on E2. It sits last because it only makes sense once you know every interface it touches.
CAPSTONE · THE DESIGN TASK · ≥ 70% TO CERTIFY
Design a 20-site greenfield Open RAN
| Decision | Justify against | Chapter |
|---|---|---|
| Functional split | bandwidth & latency budget | M2 |
| O-RU category (A / B) | antenna configuration (mMIMO?) | M2 |
| Sync topology (LLS-C1→C4) | the transport you are given | M5 |
| M-plane model | hierarchical vs hybrid | M6 |
| Test campaign | the right cases for your pairing | M9 |
| Two RIC use cases | traced through their interfaces | M8 |
IT IS A DESIGN TASK, NOT A MEMORY TEST
Every decision above is a chapter of this course applied to one real network. Justify each choice in a single line; the open-source path (O-RAN SC RICs + OAI/srsRAN + your O-RU) is fair game for the build. Pass at ≥ 70% and you have earned the O-RAN Advance Course masterclass.
Every decision above is a chapter of this course applied to one real network. Justify each choice in a single line; the open-source path (O-RAN SC RICs + OAI/srsRAN + your O-RU) is fair game for the build. Pass at ≥ 70% and you have earned the O-RAN Advance Course masterclass.
🛠 Engineer detail block — the 5 security questions an RFP will ask
- Fronthaul: 802.1X + MACsec, and what is your MACsec bypass? Timing (PTP) often cannot tolerate MACsec latency — the bypass policy per VLAN is where real deployments live, and where mistakes leak plaintext.
- O1/M-plane: mutual TLS + NACM, with which account groups? "TLS is on" is not an answer; NACM authorization (who may edit what) is the control that actually contains a compromised session.
- E2/D2: IPsec — negotiated how, re-keyed how often? An IPsec tunnel that never re-keys is a finding. SecProt requires regular SA re-establishment.
- O-Cloud: is it IMS or DMS you mean? Conflating infrastructure management (IMS) with deployment management (DMS) is the fastest way to fail an O-Cloud design review.
- Slicing: which interfaces enforce isolation? A slice that is only configured on O1 but not enforced on E2 is a slice on paper. Name the O1/A1/E2 touchpoints explicitly.
✓ QUIZ · 8 QUESTIONS · SHUFFLED EVERY LOAD