A Case for Enabling Delegation of 5G Core Decisions to the RAN

TL;DR

The paper addresses backhaul reliability challenges in 5G during disasters and austere operations and argues for delegating core decisions to the RAN via ORAN xApps. It presents three concrete designs—Collocated 5GC deployment, Decision Caching, and Decision Logic Replication—and analyzes their performance and security implications, beginning with a 5G-AKA key-management perspective over the hierarchical keys $K$, $K_{AUSF}$, $K_{SEAF}$, $K_{AMF}$, $K_{NAS}$, $K_{UP}$, and $K_{RRC}$. The analysis highlights trade-offs between latency, availability, and edge security, and discusses use cases for Industrial IoT and Non-Terrestrial Networks along with extensions like Probationary Authentication, DoS mitigation, and Zero Trust, all of which motivate prototype development. The work aims to enable resilient edge operation by enabling RAN-centric control paths while outlining practical security considerations and deployment challenges, with future prototypes to quantify feasibility in realistic settings.

Abstract

Under conventional 5G system design, the authentication and continuous monitoring of user equipment (UE) demands a reliable backhaul connection between the radio access network (RAN) and the core network functions (AMF, AUSF, UDM, etc.). This is not a given, especially in disaster response and military operations. We propose that, in these scenarios, decisions made by core functions can be effectively delegated to the RAN by leveraging the RAN's computing resources and the micro-service programmability of the O-RAN system architecture. This paper presents several concrete designs of core-RAN decision delegation, including caching of core decisions and replicating some of the core decision logic. Each design has revealed interesting performance and security trade-offs that warrant further investigation.

Figures (3)

• Figure 2: Illustration of the four main steps that a UE must go through involving 5GC network control functions (NFs) before the UE is able to send and receive data over a 5G network. NF selections are made from a set of NF instances based on UE subscription and service requirements, performance consideration, and other policy.
• Figure 3: A visualization of the 5G-AKA key derivation hierarchy. The UE's USIM and its home network's 5GC UDR both possess shared secret $K$. The 5GC NF and UE are able to use $K$ to generate subsequent keys.
• Figure 4: Illustration of decision logic replication. Custom xApps act as a proxy for the core NF when required. The major steps are the same as in Figure \ref{['fig:process']}. However, at step 1, this design (i) supports the "express mode" for selected UEs with cached decisions, and (ii) is able to take over authentication and session establishment for other eligible UEs with cached core state when the backhaul is congested or unavailable.