Kata and arm, a secure alternative in the 5 g space
- 1. 1 Β© 2021 Arm Limited Kata and Arm A secure alternative in the 5G space Kiel Friedt Principal Solutions Engineer, Arm September 2021
- 2. 2 Β© 2021 Arm Limited Agenda β’5G Technology and Initiatives β 5G Acronyms, O-RAN β Arm in 5G β RICs and performance requirements β Addressing security concerns β’Experience Using Cloud Native Technology β Deploying RICs with Kata containers β Orchestration and lifecycle β’Conclusion and Remarks β’Q&A Kiel Friedt Principal Solutions Engineer, Arm Focused on 5G and Networking using Arm technology
- 3. 3 Β© 2021 Arm Limited 5G Technology and Initiatives
- 4. 4 Β© 2021 Arm Limited Acronyms β’ RAN: Radio Access Network β’ RIC: RAN Intelligent Controller β’ Near RT (RealTime) RIC: a logical function that enables near-real-time control and optimization of O-RAN elements and resources via fine-grained data collection and actions over E2 interface. β’ non-RT RIC: a logical function that enables non-real-time control and optimization of RAN elements and resources, AI/ML workflow including model training and updates, and policy-based guidance of applications/features in near-RT RIC. β’ O-CU: O-RAN Central Unit: a logical node hosting RRC, SDAP and PDCP protocols β’ O-DU: O-RAN Distributed Unit: a logical node hosting RLC/MAC/High-PHY layers based on a lower layer functional split. β’ O-RU: O-RAN Radio Unit: a logical node hosting Low-PHY layer and RF processing based on a lower layer functional split. This is similar to 3GPPβs βTRPβ or βRRHβ but more specific in including the Low-PHY layer (FFT/iFFT, PRACH extraction). β’ O-CU-CP: O-RAN Central Unit β Control Plane: a logical node hosting the RRC and the control plane part of the PDCP protocol β’ O-CU-UP: O-RAN Central Unit β User Plane: a logical node hosting the user plane part of the PDCP protocol and the SDAP protocol β’ multi-RAT: Device that connects to multiple cell networks ie. 4G & 5G β’ O1: Interface between management entities in Service Management and Orchestration Framework and O-RAN managed elements, for operation and management, by which FCAPS management, Software management, File management shall be achieved. β’ O1*: Interface between Service Management and Orchestration Framework and Infrastructure Management Framework supporting O-RAN virtual network functions. β’ xAPP: Independent software plug-in to the Near-RT RIC platform to provide functional extensibility to the RAN by third parties. β’ gNB: the logical 5G radio node, βgβ stands for next generation βNBβfor NodeB β’ eNB/ng-eNB : the logical 4G radio node connected to a 5G network β’ A1: Interface is to enable Non-RT RIC function to provide policy-based guidance, AI/ML model management, and enrichment information to the near-RT RIC for RAN optimization. β’ E1: Interface facilitates the inter-connection of a gNB-CU-CP and a gNB-CU-UP supplied by different manufacturers β’ E2: interface is to allow the RIC to communicate with a RAN to provide guidance, optimization and value added services. β’ X2: interface supports the exchange of signalling information between two eNBs β’ NMS: A Network Management System β’ MNO: Mobile network operators
- 5. 5 Β© 2021 Arm Limited A little history β’ In 2G and 3G, the mobile architectures used a controller that was responsible for RAN orchestration and management. β’ 4G, the X2 interface caused vendor lock-in as every RAN vendor had either own version of X2. β’ Mobile network operators now focused on one RAN vendor instead of deploying many different vendors in one location. β’ The O-RAN Alliance saw this and went back to the controller concept to enable Open RAN. (https://www.o-ran.org/membership) Operator Members
- 6. 6 Β© 2021 Arm Limited Arm in 5G
- 7. 7 Β© 2021 Arm Limited Where does arm fit into 5G? https://gsacom.com/paper/lte-to-5g-june-2021-global-update Launched 5G networks Deployed 5G networks Investment in 5G Soft-launched 5G β’ Core Network β’ 5G core β’ LTE core β’ RAN β’ DU β’ CU 22,000 5G cell sites from over 160 operators worldwide 1+ billion active 5G smartphone customers by 2022 β’ RIC β’ High L1 β’ Small Cell β’ L1/2/3
- 8. 8 Β© 2021 Arm Limited Arm: Enabling More Open 5G Platforms Deployable Technology Innovations Enabling Software Accelerator Abstraction L1 Kernels Cloud Native RU DU CU REC RIC EPC Software Libraries ISV Stacks on Arm Neoverse Platform & Silicon Partner Innovation ML TRS MEC ASIC AI/ML CPU system L2/ L3+ L1 FPGA ASSP Diversity of choice by enabling a rich ecosystem of hardware and software vendors Platform Diversity & Choice
- 9. 9 Β© 2021 Arm Limited 5G O-RAN Partner PoC Solutions 5G Core CU RAN Intelligence Controller near-RT DU RU RIC 5G Core CU Distributed Unit L2 High-L1 RU High-L1 5G Core Centralized Unit Distributed Unit RU RAN on Neoverse L2 High-L1 5G Core Smallcell L2/3 Smallcell L1 Small-cell RFE CU DU RU Core Network 5G Core LTE Core
- 10. 10 Β© 2021 Arm Limited 5G Solutions and Ecosystem Compute/MEC EPC, RIC CU/DU uCPE Small-cell Use-cases, PoCs Partner HW Partner Stacks Community SW AWS Graviton2, Outpost Hawkeye, Accton T&W (NXP+QC) CIG, Arcadyan (NXP) MRVL Octeon 10 Telco Sys ENEA Fortinet, Clavister RadiSys Altran Arraycomm Astri Accelleran Phluido Magma OAI Comm Agility Radisys Ampere Altra Video ML inference Web, Data Platform Standards Middleware, Libraries System-Ready ORAN-TIP Accel-API DPDK, ODP, VPP, OpenSSL ARM-RAL Cloud-native: Kubernetes, KVM, Docker, Rancher PARSEC Video, ML, Data libraries Cassini
- 11. 11 Β© 2021 Arm Limited Four components of the RIC architecture β’ Four functional software elements: β’ Orchestration/NMS layer with Non-Real Time RIC β’ Near-real time RIC itself β’ multi-RAT CU protocol stack β’ DU software function They all are deployed as VNFs or containers to distribute capacity across multiple network elements with security isolation and scalable resource allocation. Interactions with RU hardware is done to increase efficiency and to be optimized in real-time. Thus, providing better network experiences to the end user.
- 12. 12 Β© 2021 Arm Limited RICs and Performance Requirements
- 13. 13 Β© 2021 Arm Limited O-RAN architecture Non Real-Time RIC >=1 Sec Functionality includes configuration management, device management, fault management, performance management, and lifecycle management for all network elements in the network. Source: O-RAN ALLIANCE Logical Architecture Near Real-Time RIC >10 ms < 1second A near-real-time, micro-service-based software platform for hosting applications called xApps. These run on the near-RT RIC platform. The near-RT RIC software platform provides xApps with data, which is then used to optimize run behavior. Control of RAN infrastructure (eNB, gNB, CU, DU) is done through the E2 protocol.
- 14. 14 Β© 2021 Arm Limited Performance needs β’ Looking at the latency numbers in the figure, the Near Real-time RIC acts within 10 to 1000 milliseconds to make decisions based on metrics from RAN nodes. β’ These decisions are driven by sophisticated algorithms built in to the βxApps.β But, why is there the need for these algorithms or XApps? Source: O-RAN ALLIANCE
- 15. 15 Β© 2021 Arm Limited What can the near real-time RIC do for you! β’ Near real-time RIC leverages embedded intelligence and is responsible for: β’ per-UE controlled load-balancing β’ RB management β’ Interference detection and mitigation β’ Provides QoS management, connectivity management and seamless handover control. β’ xApps β’ Admission Control β Executing logic to determine if a dual connection should be accepted or rejected (4G &5G) β’ Measurement Campaign: β The metrics are reported periodically as VES events and include metrics such as number of dual connected UEs, duration of dual connections, and signal strength metrics. β’ ML Based: β Support ML models in non-real time and near-real time RIC use cases. β’ Traffic steering β Control which cell a UE should use based on performance. Capabilities options for an xApp
- 16. 16 Β© 2021 Arm Limited Security Concerns
- 17. 17 Β© 2021 Arm Limited Security concerns β’ xApps have the ability to control RAN infrastructure (eNB, gNB, CU, DU) β’ 3rd party xApps are not vetted or may contains exploits or be exploitable. β’ 3rd party xApps not compatible with others when ran along side each other. β’ Multiple RT RICs having similar/same xApps. β’ Process starvation due to resource allocation. β’ Only Security is policy based currently Kata is a natural fit when securing the RIC.
- 18. 18 Β© 2021 Arm Limited Experience Using Cloud Native Technology
- 19. 19 Β© 2021 Arm Limited Deploying RICs with Kata containers
- 20. 20 Β© 2021 Arm Limited kata-containers Multi Hypervisor QEMU, Cloud Hypervisor, Firecracker Works seamlessly with Kubernetes and Docker and is a drop in replacement for runc Open Source Open governance project under the Open Infrastructure Foundation umbrella Multi Architecture x86, ARM, IBM Power, IBM s/390x OCI-compatible runtime that enhances the security of container workloads in a lightweight virtual machines. https://kata-containers.io
- 21. 21 Β© 2021 Arm Limited Katas Growing Community https://kata-containers.io
- 22. 22 Β© 2021 Arm Limited Docker containers Traditional containers use Linux control groups (cgroups), for managing and allocating resources and namespaces to provide container isolation. Further security isolation is provided by dropping Linux capabilities, using read-only mount points, mandatory access controls (MAC) security measures like those in SELinux or dropping syscalls using SECCOMP, etc. It is difficult, if not impossible, to effectively apply these security policies to complex applications. To mitigate this, operators started nesting containers in VMs. Doing so reduced performance and the agile aspect of a container.
- 23. 23 Β© 2021 Arm Limited Kata containers β’ Kata Containers provides container isolation by using hardware virtualization. β’ In the case of Kubernetes, VM isolation is provided at the pod level. β’ For Kata Containers, each pod is booted as a lightweight VM with its own unique kernel instance. β’ Since each pod is now running with its own VM, they no longer gain access to the host kernel and get the full security benefits of a VM.
- 24. 24 Β© 2021 Arm Limited Orchestration and Lifecycle
- 25. 25 Β© 2021 Arm Limited Deployment currently Source: kata-containers.io β’ Currently the near RT RIC is deployed with Helm and Kubernetes β’ E2 manager: controls E2 connection establishment and provides REST APIs to manage these connections. β’ Routing Manager: a basic RIC platform service, responsible for generating and distributing routing policies to xApps. β’ Subscription Manager: Near-realtime RIC Platform Subscription Manager β’ A1 Mediator: Terminating the northbound A1 interface. It is translating information received over A1 it into conrete actions that xApps must take to adpat their behavior accordingly and it sends back feedback on the implementation status of such actions. β’ App manager: provides a flexible and secure way for deploying and managing various RIC xApp applications in a Kubernetes environment. β’ RMR: RIC message routing - A library originally based on NNG (nano-messaging nxt generation) for low latency message routing.
- 26. 26 Β© 2021 Arm Limited Multi-tenant Kubernetes example KERNEL CONTAINER POD CONTAINER CONTAINER CONTAINER KERNEL CONTAINER CONTAINER CONTAINER KERNEL CONTAINER CONTAINER CONTAINER CONTAINER KERNEL KUBERNETES NODE 1 NODE 2 NODE 3 NODE 4 KATA VM NODE 2 KATA VM KATA VM KATA VM CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER CONTAINER POD POD POD POD POD POD POD POD POD Standard Containers Kata Containers Isolate sensitive workloads by node KERNEL KUBERNETES NODE 1 Isolate sensitive workloads within a node Source: kata-containers.io
- 27. 27 Β© 2021 Arm Limited Deployment with kata example
- 28. 28 Β© 2021 Arm Limited Kata orchestration and lifecycle β’ The process to use kata is easy β’ Install or compile version 2 of kata β’ Configure containerd β’ Modify the runtimeclass to kata β’ Modify the plugins.cri.containerd.runtime.kata-runti me β’ Kata-agent is a process running in the guest as a supervisor for managing containers and processes running within those containers. β’ The kata-agent makes use of libcontainer to manage the lifecycle of the container. This way the kata-agent reuses most of the code used by runc. β’ The Kubelet is responsible for managing the lifecycle of pods within the node/s
- 29. 29 Β© 2021 Arm Limited Conclusion and Q&A
- 30. 30 Β© 2021 Arm Limited Conclusion β’ 5G is quickly taking hold and arm is going to be part of it. β’ Security concerns seen are easily remedied using Kata β’ Complexity can easily be solved with a combination of tools readily available and supported on arm.
- 31. 31 Β© 2021 Arm Limited See you at KubeCon and Arm DevSummit 2021! devsummit.arm.com events.linuxfoundation.org/kubecon- cloudnativecon-north-america/
- 32. 32 Β© 2021 Arm Limited Blogs Write in your subtitle here β’ The open, interoperable path to 5G deployment β’ Enabling the dynamic 5G infrastructure with Arm-based solutions β’ Project Cassini - Ensuring a cloud native experience across a secure Arm-based edge ecosystem
- 33. The Cloud to Edge Infrastructure Foundation for a World of 1T Intelligent Devices Thank You!
- 34. Β© 2021 Arm Limited The Arm trademarks featured in this presentation are registered trademarks or trademarks of Arm Limited (or its subsidiaries) in the US and/or elsewhere. All rights reserved. All other marks featured may be trademarks of their respective owners. www.arm.com/company/policies/trademarks