Evaluation of Intent Ambiguity Scenarios in O-RAN

Sammanfattning

Intent-Based Networking (IBN) is central to the shift toward high levels of automation in 5G and beyond, particularly within the Open RAN Service Management and Orchestration framework. Standardized under the 3rd Generation Partnership Project (3GPP) Technical Specification 28.312, IBN allows operators to define declarative outcomes rather than technical low-level configurations. However, this shift introduces vulnerabilities through intent ambiguity, a state of semantic underspecification where a single high-level intent can map to multiple technical actions. This thesis investigates how such ambiguities can be exploited via malicious intent injection attacks to achieve unauthorized network outcomes, focusing on two primary semantic gaps: the Intent Interpretation gap and the Utility-Expectation gap. The methodology utilizes a simulation-based approach involving the development of an intent extension for Network Simulator 3 and the ns3-oran module. This environment facilitates the execution of network scenarios across varying user densities, topologies, and mobility patterns in both urban and rural environments to provide a proof of concept for the security implications of declarative management. Evaluation of the Interpretation gap reveals that malicious context broadening is a universally successful vector for service degradation, resulting in a throughput collapse ranging from 72.6% to 83.9% relative to the baseline across all evaluated scenarios. Furthermore, exploits targeting the Utility-Expectation gap demonstrate the potential for stealthy persistence, where the 3GPP utility functions allow an attacker to decouple perceived satisfaction from physical reality. In representative scenarios, malicious parameter injection was found to mask up to 89.2% of the utility drop induced by a concurrent latency attack, though the effectiveness of this stealth was found to be highly dependent on scenario, network load, and topology. Finally, the study evaluates a provenance-based cryptographic detection system utilizing deterministic chains of hashed and signed tokens. The defense mechanism achieved 100% accuracy in identifying every attempt to exploit intent ambiguity by the adversary.