See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/357124915

A Comprehensive Tutorial on How to Practically Build and Deploy 5G

Networks Using Open-Source Software and General-Purpose, Off-the-Shelf
Hardware

Article · December 2021

DOI: 10.46470/03d8ffbd.4ccb7950

CITATIONS READS

0 5,572

2 authors:

Sadiq Iqbal J. M. Hamamreh

Antalya Bilim University Antalya Bilim University
10 PUBLICATIONS 8 CITATIONS 92 PUBLICATIONS 1,198 CITATIONS

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Learn How to Build 4G/5G Networks From Scratch (End-to-End) View project

6G wireless networks View project

All content following this page was uploaded by J. M. Hamamreh on 19 December 2021.

The user has requested enhancement of the downloaded file.

Received November 1, 2021, accepted December 15, 2021, date of publication December 16, 2021
Digital Object Identifier 10.46470/03d8ffbd.4ccb7950

A Comprehensive Tutorial on How to

Practically Build and Deploy 5G
Networks Using Open-Source Software
and General-Purpose, Off-the-Shelf
Hardware
SADIQ IQBAL1 , JEHAD M. HAMAMREH2
1
WISLAB, Department of Electrical and Computer Engineering, Antalya Bilim University,Antalya, Turkey (e-mail: [email protected])
2
WISLAB, Department of Electrical and Electronics Engineering, Antalya Bilim University, Antalya, Turkey (e-mail: [email protected])
Corresponding author: S. Iqbal and J. M. Hamamreh (emails: [email protected], [email protected], Web:
https://wislab.researcherstore.com/solutions).
WISLAB (wislabi.com/solutions) offers solutions for building and deploying fully secure, cloud-based, and low-cost end-to-end 4G/5G
networks along with providing consultations on helping companies reduce their networks CAPEX/OPEX cost and determine which
solutions are best suited for their needs and use cases.

ABSTRACT 5G technology is the cornerstone for new services like eMBB, uRLLC, and mMTC, thus it
should be globally available and affordable to make these services a reality. Yet most vendors responsible
for the manufacturing of 5G hardware equipment and software still utilize and adopt the classical closed
radio access network (RAN) concept. Consequently, this forces mobile operators, who want to deploy such
equipment to build 5G cellular networks, to pay a hefty, unreasonable amount of money and still end up
in vendor lock-in, which limits them from making personal changes in the network architecture or using
different equipment and software from other vendors. This generally means that operators do not have
complete control over the network, which they have paid for. To tackle this challenge, a new concept
called Open RAN has recently emerged, which has attracted significant attention by industry leaders
due to its very exciting features like the ability to use open-source software, general-purpose hardware,
having the hardware separated from the software while maintaining full transparency, and interoperability.
Motivated by the many features and benefits enabled by Open RAN, there is a huge need for an educational
comprehensive step-by-step tutorial on how an individual or company can practically build and deploy
a 5G network using open-source software and commercial off-the-shelf, general-purpose hardware. In
this tutorial, we discuss almost everything related to the history and background of 5G companies and
manufacturers, legacy RAN solutions and equipment, different ways and approaches to build a 5G network
including RAN, CORE, and EDGE frameworks, open-source software, and generic hardware. After this,
we illustrate in detail the steps of how to build and set up a 5G network using srsRAN with LimeSDR, and
Raspberry Pi 4. In the end, we list the best possible PCs and software-defined radio (SDR) combinations
that can be extremely helpful in building 5G networks.

INDEX TERMS 4G, 5G, 6G, radio access networks, RANs, Closed RAN, Open RAN, universal software
radio peripheral, USRP, open-source software, software-defined radio, SDR, srsRAN, 5G Non stand alone.

I. INTRODUCTION tional Telecommunication Union (ITU) began researching

5G mobile communication technology to prepare for the
G is a revolutionary mobile communication technol-
5 ogy that has ushered in the 4th Industrial Revolution
with the potential to change the society and economy
expected data explosion after 2020 and to meet various
service requirements for future mobile communications [1].
After several years of research, three service scenarios of
of the future. From the beginning of 2010, the Interna-

VOLUME 2, 2021 1
 Building and Deploying Secure 5G Networks

5G are available: 1) eMBB (enhanced mobile broadband), 2013, Samsung had successfully developed the world’s
which provides data rates up to 20Gbps, much faster than first adaptive array transceiver technology operating in the
traditional mobile technologies; 2) uRLLC (ultra-reliable millimeter-wave Ka bands for cellular communications [3].
low latency communication), which aims to minimize the la- The new technology sits at the core of the 5G mobile com-
tency to 1ms or lower; and 3) mMTC (massive machine type munications system and provides data transmission several
communication), which supports up to 1 million connections hundred times faster than the current 4G networks. The
per 1 GHz [1]. The emergence of 5G created enhanced 5G- company achieved a lot in the next generation of technology
convergence services and integrated the existing industries and can now be considered one of the leaders in the 5G
more deeply with mobile telecommunication. Adopting 5G domain [3].
technology along with the ICT innovation services, such Huawei has been pouring money into research on 5G
as self-driving cars, smart factories, personal drones, and wireless networks and patenting key technologies. The
remote healthcare, are expected to experience tremendous company has hired many experts from abroad to decide
changes in service paradigms, leading to new markets [1]. the technical standards for the next-generation wireless
KISDI, Korea’s prestigious ICT state-run think tank, communication technology [3]. LG has also been one of the
predicts that the annual growth in major-related industries top 5G players in research activities, products, and patent
of 5G will be 43.3 percent and that 1,161 trillion win in analytics. In 2019, Bloomberg cited the 5G era as the era of
global markets in 26 years will be created. IHS Markit, a LG as the company managed to ship more than 100K 5G
global market research firm, estimates that 5G will account smartphones in the Korean market [3]. The Korean company
for 4.6 percent of the world’s total production in the future has been researching 5G for quite some time and built a
[1]. Previous generations of mobile networks 1G, 2G, 3G, reputation by getting published in many 5G related reports.
and 4G all led to 5G, which is offering to provide more LG has been one of the few companies, like Samsung and
connectivity than what is available right now [2]. Through Huawei, that does not just deploy 5G networks but also
a landmark 5G Economy study, it is found that 5G’s full build products that utilize the 5G network [3]. Ericsson
economic effect will likely be realized across the globe by on the other hand claims to be the only vendor currently
2035, supporting a wide range of industries and potentially working on all continents to make 5G a global standard for
enabling up to 13.1 trillion US dollars worth of goods and the next generation of wireless technology. Their 5G radio
services [2]. prototypes are the first products designed to enable operators
More importantly, 5G is designed to deliver peak data to conduct live field trials in their network which helps
rates up to 20 Gbps based on IMT-2020 requirements. operators to get a greater understanding of the potential
Qualcomm Technologies’ flagship 5G solution, the Qual- of 5G in their networks and environments [3]. Qualcomm,
comm Snapdragon X65 is designed to achieve up to 10 one of the leading 5G chip makers, is also leading in the
Gbps in downlink peak data rates. But 5G is about more overall 5G race. While other companies are talking about
than just how fast it is [2], where in addition to providing 5G, Qualcomm is building the technologies. Qualcomm also
higher peak data rates, 5G is designed to provide much disclosed their royalties’ price for every 5G phone that could
more network capacity by expanding into new spectrum be up to 16.25 US dollars, threefold than Ericsson’s price
bands, such as mmWave. 5G can also deliver much lower [3].
latency for a more immediate response and provide an Nokia has also joined the race of 5G as the company is
overall more uniform user experience so that the data rates developing, researching, and partnering with other entities to
stay consistently high even when users are moving around render 5G communication as fast as possible. The company
[2]. This clearly shows the importance of 5G due to the uses an 8000-hectare site to carry out 5G tests collaborating
significant change it will bring globally, which will lead us with Deutsche Telekom and Hamburg Port Authority for
to think about how we can utilize the available resources their project 5G MoNArch. The project’s goal is to gain
to build 5G base stations and networks in an efficient and knowledge and experience from 5G networks in the real-
affordable manner, which can make users happy with the world environment. Its industrial uses could be traffic light
service and its cost, whereas companies satisfied with the management, data processing from mobile sensors, and VR
revenue and return on investment (ROI). applications [3].
Having understood the importance of 5G and the value ZTE Corporation, regarded as one of the leaders in
it offers to the world, it is very crucial to know about the 4G LTE, also maintains its position in 5G research
the current big 5G companies, players, and what they and tests. Because of its performance and capabilities, the
are doing so that we can compare the limitations and 4G network was confronted by various bottlenecks on the
challenges these companies are currently facing with the Internet of things. At that time, ZTE was the first company
benefits and solutions we can get by building a 5G network. to propose its Pre5G concept and series solution [3]. NEC
The companies leading 5G research and development (RD) also rolled its sleeves for 5G and introduced a new business
are Samsung, Huawei, Nokia, LG, Ericsson, Qualcomm, concept, “5G. A Future Beyond Imagination” to make
ZTE, Orange, Verizon, ATT, NEC Corporation, and Cisco. drastic changes in the industry. According to SVP Toshim-
Samsung started researching 5G technology in 2011. In itsu Shimuzu, NEC plans to “collaboratively create new
2 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

RAN Evolution

Closed
RAN

Open
D-RAN C-RAN H-RAN F-RAN V-RAN
RAN

FIGURE 1. Evolution of RAN.

business models and services that connect information from billion devices in the next three years. From the previous
different industries and companies by utilizing advanced discussions, we can see the hype, attention, and importance
information and communications technologies (ICT) that of 5G. The World Economic Forum describes 5G as the
combine 5G with NEC’s proprietary AI, IoT, and other Fourth Industrial Revolution, so 5G will generate billions
digital technologies” [3]. of dollars through unrealized revenue streams.
The US telecom company Verizon deployed policies to All the telecom giants are motivated to get a hold of
render 5G for US consumers. Verizon positioned itself at the upcoming wave [3]. Recently, even Amazon one of
the forefront of 5G technology as they are building modern the big five companies in America, lauched AWS Private
infrastructure all over the country. According to them, the 5G service through its own Amazon Web Services (AWS)
world needs policies for 5G deployment which they are adopted cloud platform. AWS Private 5G is a managed
ready to provide [3]. Mobile network operator Orange is service that makes it easy to deploy, operate, and scale your
also participating in the build-out of a more connected own private cellular network, with all required hardware and
planet. The company is exploring different complementary software provided by AWS. Some use cases of AWS Private
areas such as improving mobile broadband up to 10 times 5G are running a smart manufacturing facility, enabling
faster than 4G, employing high-performance fixed Inter- business-critical applications such as augmented and virtual
net access to complete the fiber network where it’s not reality (AR/VR) applications for design engineering, image
available, and deploying new applications to support digital analysis during medical procedures, and autonomous guided
transformation across business sectors. Orange also claims vehicles at fulfillment centers and deliver reliable campus
that it will be a genuine multi-service network designed to connectivity [4].
adapt to a whole host of devices: smartphones mainly, but Now we move onto the actual question of why do we
also enhanced 360° content, augmented reality, connected need to build a 5G base station. Earlier, we mentioned,
objects, refrigerators, and driverless cars [3]. the companies, vendors, and operators, working on different
ATT is going to be the first company to provide 5G internal and external areas of the 5G network are building
services in the US. For achieving this feat, they deployed their own devices, architectures, and networks. The cost
5G connection in three cities: Waco TX, Kalamazoo MI, of these products is hundreds of thousands of dollars, for
and South Bend IN [3]. Cisco Systems launched 5G now example, China Mobile’s 2020 capital expenditure budget
portfolio in MWC 2018 to support 5G automation and was 179.8 billion yuan (about 25 billion US dollars). Of
infrastructure, which the company will support in three this sum, the 5G-related investment plan was about 100
primary ways: Services – enable 5G services so service billion yuan (about 14 billion US dollars). This means that
providers (SPs) can make more money; Infrastructure – on average, each 5G base station costs nearly 400,000 yuan
help build the 5G infrastructure, and Automation – Make (about 57,000 US dollars) [5].
a mass scale simpler to operate [3].The company knows From this example alone, we can see how much the ven-
the potential of 5G and plans to connect more than 30 dors and operators charge for their products. The products
VOLUME 2, 2021 3
 Building and Deploying Secure 5G Networks

Possible Ways of Building 5G Network

Closed RAN Old Way New Way Open RAN

ERICSSON INC PARALLEL WIRELESS

NOKIA CORPORATION VIAVI
CISCO SYSTEMS INC MAVENIR
HUAWEI TECHNOLOGIES CO LTD RADISYS
INTEL CORPORATION FUJITSU
ZTE CORPORATION
Old KEYSIGHT
DALIWay
WIRELESS NEC
SAMSUNG ACCELLERAN
HITACHI DETECON
IBM CORPORATION ALTIOSTAR
LG MICROSYSTEMS
BAICELLS TECHNOLOGIES
5G AWS
Integrated Hardware
and Software
Separated

Off the Shelf Hardware Software(Cloud-Based)

FIGURE 2. Closed RAN vs. Open RAN with some examples on companies from each category (noting that the lists are not inclusive).

are not available in the local market and cannot work with Station (BS) connected to a Radio Frequency (RF) antenna
third-party hardware. Even the software is the proprietary at the top of the tower through heavy electrical cables.
product of these organizations. This indicates the limitations This architecture presented significant RF signal propaga-
enforced on local consumers from the tech giants. We tion loss in the electrical cable feed resulting in degraded
can ignore these limitations and build an end-to-end 5G signal transmission/reception power and quality. Therefore,
networks using open-source software and state-of-the-art telecommunication operators began to adopt a separated
off-the-shelf SDR-RF hardware along with generic compute BBU and RRH architecture based on D-RAN or just RAN
devices, which costs a fraction of the previously mentioned [6].
products.
What is a D-RAN? In a traditional D-RAN system, each
II. PREVIOUS RADIO ACCESS NETWORKS (RANS) AND BS is composed of two collocated components: (1) a digital
5G OPEN RAN unit (DU) or BBU, and (2) a radio unit (RU) or RRH. These
In this section, we will highlight the evolution of RANs from two components connect through a Common Public Radio
Distributed RANs (D-RANs) to Cloud RANs (C-RANs), Interface (CPRI). The BBU is the component responsible
Heterogeneous Cloud RANs (H-CRANs), Fog Computing for baseband processing that processes multiple calls and
RANs (F-RANs) and virtual RAN (V-RAN) as shown in forward’s traffic. The RRH is responsible for digital radio
Fig. 1, to know about the previous technologies so that we signal processing by transmitting, receiving, and converting
have the base knowledge about how networks work and signals. Each BS connects to the core network through
then we can focus on building a 5G network. Previous a backhaul [6]. C-RANs have emerged as a centralized
generations of cellular systems used to have a baseband solution, moving the BS functionalities to the cloud to
unit (BBU) and remote radio head (RRH) components optimize the resources and improve energy efficiency. What
physically integrated and located at the bottom of a Base is a C-RAN? The principle behind C-RAN architecture
4 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

SUPPORTED SOFTWAREs

USRP Hardware Driver (UHD) NI-USRP

Windows, GNU Radio, VHDL, Windows, LabVIEW 2018 LabVIEW FPGA

Linux, Mac OS C/C++, Verilog, NI Linux Real- and Newer
MATLAB RFNoC (Open-Source Time
Software/Simulink FPGA Framework)
Software,
Python, HDL Coder

FIGURE 3. Supported software generally used to build 5G Networks.

is to relocate some of the cellular network functions to A solution to address these factors is to implement the 5G
the cloud infrastructure. Network operators understand that network functions as software components [6].
the main cost of 5G is related to RAN and decided to What is a v-RAN? A virtual radio access network
invest in new types of open and low-cost architectures (vRAN) is a type of RAN with its networking functions
[6]. The traditional RANs have limitations, so to overcome separated from the hardware it runs on. The control and
them the RRH, and BBU functions decouple in C-RAN data planes of the vRAN are also separated as part of the
architectures where RRH is at the BS, the BBU in the virtualization. Network functions virtualization (NFV) is the
cloud infrastructure, and we have a front-haul in between practice of turning hardware-based functions into software.
RRH and BBU. The most intensive computational tasks get In an NFV architecture, the hardware is typically commer-
performed in BBUs allocated in the cloud. In a traditional cial off-the-shelf (COTS) standard hardware. A vRAN is
RAN architecture, the deployment and the commissioning more flexible because it also allows change without having
of a new BS are expensive and time-consuming. But in C- to replace hardware throughout the entire infrastructure and
RAN architecture, the infrastructure is easily deployed as all it needs is to update its software [8].
only an RRH is installed and an associated BBU service What is a Open RAN? It includes developing interop-
deployed in the cloud [6]. However, C-RANs experience erable open hardware, software, and interfaces for cellular
drawbacks such as primary user emulation attack, spectrum wireless networks that use white box servers and other
sensing data falsification, centralized signal processing in standard equipment, rather than the custom-made hardware
the cloud which can introduce the risk of higher latency, typically used in base stations [9]. Now we know about
and these issues can be solved by H-CRAN and F-RAN the use of conventional RAN and its types. Therefore, we
[6]. mention the companies that utilize these architectures, their
What is a H-RAN? H-CRAN is an architecture that takes limits, and the disadvantages. Then compare them with the
advantage of two approaches: C-RAN and Heterogeneous Open RAN. Afterward, we will discuss the usage of Open
Networks (HetNets). In H-CRAN architectures, RRHs as- RAN in building a 5G Network and BS.
sume the role of low power nodes (LPNs) by performing
simple functions (such as radiofrequency management and A. DIFFERENT RAN SOLUTIONS AND EQUIPMENT
simple symbol processing). The BBU is responsible for Many custom RAN solutions and equipment are available
coordination between high power nodes (HPNs) and RRHs from vendors such as ASOCS, Airspan, Altiostar, Casa
to mitigate inter-tier interference [6]. Systems, Ericsson, Intel, Nokia, Parallel Wireless, Radisys,
What is a F-RAN? The C-RAN and H-CRAN architec- and Samsung [11]. Out of these ASOCS focuses on vRAN
tures centralize their software process at the cloud resulting solutions, Airspan deals in OpenRANGE, RRUs, and DUs,
in a heavy load on the front-haul link. To mitigate this prob- Altiostar rolls out open virtualised RAN software solutions,
lem the F-RAN architecture based on the H-CRAN architec- Casa Systems manage Casa’s Axyom Software platform
ture is used [6]. F-RAN aims to minimize the disadvantages with 5G equipment, Ericsson’s RAN portfolio consists of
of C-RAN and H-CRAN. 5G networks need ultra-densified basebands, radio processors and a radio access processing
networks, device-centric architecture, specialized hardware, platform, Ericsson Radio System, Intel’s portfolio for wire-
need to coexist with legacy infrastructures, e.g., 2G, 3G, less 5G deployment solutions is centered around its Intel
and 4G, which increases management cost and complexity. FGPA suite, which consists of a wide variety of configurable
VOLUME 2, 2021 5
 Building and Deploying Secure 5G Networks

FIGURE 4. O-RAN Architecture [7].

embedded SRAM, high-speed transceivers, logic blocks and Nokia. All this could make for an extremely crowded 3.2
routing, Nokia’s AirScale Radio Access portfolio supports billion US dollar market [12].
all radio access technologies including both NSA and SA So far, we have discussed 5G, its importance, tech com-
5G networks, Nokia is also a contributor in ORAN alliance, panies that utilize Closed RAN, custom equipment, their
Parallel Wireless offer Open RAN solutions like end-to- limitations, challenges, costs, and why we need to build a
end virtualized network deployment services combined with 5G network. In the subsequent sections, we will mention the
software-defined hardware, Radisys is also a contributor possible ways of building a 5G network using Closed RAN
in Open RAN alliance because of sharing its Open 5G and Open RAN. Afterward, we will elaborate on different
Software seed code and Samsung is an active member of the approaches of how a 5G network can be built using Open
Open RAN community, participating in large-scale deploy- RAN and open-source software?
ment tests, conferences and most recently, commercializing
a new carrier-grade, fully-virtualized 5G RAN solution [11].
III. POSSIBLE WAYS OF BUILDING A 5G NETWORK
However, the companies that use closed or traditional Building a 5G network usually can be categorized into two
RAN will face challenges like declined sales, and equipment ways the classical old way and the new way, as shown
companies will also face challenges from new rivals that in Fig. 2. The old way utilizes Closed RAN, which has
support Open RAN. The orange tech company even said that coupled and integrated the hardware and software as a
any equipment it buys in Europe will have to be O-RAN- joint RAN solution, and the new way uses the Open RAN
compliant starting in 2025 [12]. Omdia, a telecommunica- concept, which has separated and disaggregated hardware
tion, media, and technology consultant, anticipates a 13% from software. One way of implementing Open RAN is
decline in 4G and 5G closed RAN products between 2020 through the disaggregation of software from hardware which
and 2024. Ericsson and Nokia both have joined the O-RAN allows RAN software to run on any common hardware
Alliance, a group developing specifications, and promised platform such as those based on Intel x86 and ARM
O-RAN products. Omdia expects Open RAN sales to soar architectures [15]. This disaggregation also applies to other
from 252 million US dollars last year to around 3.2 billion hardware components such as Field Programmable Gate
US dollars in 2024. European operators also want authorities Arrays (FPGAs) and Graphics Processing Units (GPUs),
to cultivate a local Open RAN supply chain, ensuring Asian which opens the abstraction layer. From Fig. 2, on the
and US vendors are not the only alternatives to Ericsson and left-hand side, we can see the vendors who use closed
6 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 5. SD-RAN Architecture [10].

FIGURE 6. NVIDIA Aerial Architecture [13].

RAN architecture to build products that include hardware when compared with integrated platforms (Closed RAN),
and software from the same vendor. In other words, if an the vendors mentioned on the right-hand side of Fig. 2
operator uses vendor A for the radio, typically, it must support Open RAN.
use the baseband from vendor A as well. In addition, the
software that runs on the baseband hardware does not run IV. APPROACH TO BUILDING A 5G NETWORK USING
on another vendor’s hardware. This creates a vendor lock-in OPEN RAN HARDWARE AND OPEN-SOURCE
due to the proprietary vendor-specific product realization of SOFTWARE
the interface specification [15]. It is a serious issue faced From Fig. 3, we can see the supported software that can
by individuals who do not have the resources to buy these generally be used with the compatible hardware to build
products from the same vendor as they are costly. So, for a 5G network, such as the NI USRP LabVIEW and the
this reason along with the need to have flexibility in scaling USRP hardware driver (UHD). LabVIEW software adopted
VOLUME 2, 2021 7
 Building and Deploying Secure 5G Networks

FIGURE 7. 5G-EmPOWER Operating System [14].

FIGURE 8. FlexRAN Infrastructure [16].

by LabVIEW users with the NI-USRP LabVIEW driver is on-Chip (RFNoC), GNU Radio, HDL Coder, and Math-
a paid program [17]. In this way, users can buy LabVIEW Works MATLAB and Simulink software [17]. Now moving
software, the supported hardware to build a 5G network on to other open-source solutions and implementations for
which is costly at the same time. On the other hand, users the RAN, Core and Edge frameworks such as:
can build a 5G network, using USRP UHD open-source
software that is a product of Ettus Research published A. RAN FRAMEWORKS
by NI under open-source licenses [17]. The UHD driver 1) O-RAN
facilitates application development on USRP hardware in A key principle of the O-RAN architecture is to extend
C/C++, offers cross-platform support for industry develop- the SDN concept of decoupling the control plane (CP)
ment environments and frameworks, such as RF Network- from the user-plane (UP) into RAN while bringing in
embedded intelligence. The first benefit decoupling offers
8 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 9. Open-Air-Interface 5G Stack [18].

is to allow the UP to get more standardized since most of powered radio control, that has been envisioned by operators
the variability is in the CP. This allows easy-scaling and around the globe. The architecture is based on well-defined,
cost-effective solutions for the UP. RAN cloudification is standardized interfaces to enable an open, interoperable sup-
one of the fundamental tenets of the O-RAN architecture ply chain ecosystem in full support of and complementary
[7]. Operators are delivering NFVI/VIM requirements to to standards promoted by 3GPP and other industry standards
enhance virtualization platforms in support of various splits. organizations [7].
For example, high layer split between PDCP and RLC, low
layer split within PHY. The O-RAN reference architecture is 2) SD-RAN
built on a set of key interfaces between multiple decoupled SD-RAN is building open-source components for the mobile
RAN components. These include enhanced 3GPP interfaces RAN space, complementing O-RAN’s focus on architecture
(F1, W1, E1, X2, Xn) for true multi-vendor interoperability. and interfaces by building and trialing O-RAN compliant
To take full advantage of the economies of scale offered open-source components. SD-RAN is developing a near-
by an open computing platform approach, O-RAN Alliance real-time RIC (nRT-RIC) and a set of exemplar xApps for
reference designs will specify high performance, spectral, controlling the RAN. This RIC is cloud-native and builds
and energy-efficient white-box base station hardware. Ref- on several of ONF’s well-established platforms including the
erence platforms support a decoupled approach and offer ONOS SDN Controller. The architecture for the SD-RAN
detailed schematics for hardware and software architecture nRT-RIC will leverage the O-RAN architecture and vision
to enable both the BBU and RRU. Many components of [10]. As illustrated in Fig. 5, ONF has started to develop an
the O-RAN architecture will be delivered as open-source, Exemplar Platform consistent with the O-RAN architecture
through existing communities. These components include: using a specific set of implementation choices:
the RAN intelligent controller, protocol stack, PHY layer
1) The solution will include open-source implementa-
processing, and virtualization platform [7].
tions of O-DU, O-CU-UP, and OCU-CP.
The O-RAN reference architecture shown in Fig. 4, is 2) The solution will implement O-CU-UP using P4.
designed to enable next-generation RAN infrastructures. 3) The solution will include an open-source Near-Real-
Empowered by principles of intelligence and openness, Time RIC Controller implementation that is based on
the O-RAN architecture is the foundation for building the ONF’s ONOS.
virtualized RAN on open hardware, with embedded AI- 4) The solution will likely expand on the E2 interface to
VOLUME 2, 2021 9
 Building and Deploying Secure 5G Networks

FIGURE 10. Virtualized Open RAN Split 7.2 architecture [19].

FIGURE 11. COMAC Exemplar Platform [20].

allow for scheduler control and network slicing and 3) NVIDIA Aerial
contribute this expansion back to O-RAN for inclusion NVIDIA Aerial is an Application framework for building
in the specifications. high-performance, software-defined, cloud-native 5G appli-
5) The solution will be inter-operable with third-party cations to address increasing consumer demand. Optimize
Rus. your results with parallel processing on GPU for baseband
6) The solution will leverage COTS and white box P4- signals and data flow [13]. The NVIDIA Aerial SDK pack-
programmable switches. age as shown in Fig. 6, simplifies building programmable
7) The solution will use Aether5 as the Virtualization and scalable software-defined 5G RAN. The Aerial SDK
Layer, VIM, and Infrastructure Management Frame- supports:
work.
1) CUDA Baseband (cuBB): The NVIDIA cuBB SDK
10 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 12. Magma Architecture [21].

FIGURE 13. free5GC Architecture [22].

provides a GPU-accelerated 5G signal processing ease of deployment and management [13].

pipeline, including cuPHY for Layer 1 5G PHY. It
delivers unprecedented throughput and efficiency by 4) 5G-EmPOWER
keeping all physical layer processing within the high- 5G-EmPOWER is a Software-Defined Networking Platform
performance GPU memory [13]. for 5G Radio Access Networks. Its flexible architecture
2) CUDA Virtual Network Functions (cuVNF): The provides an open ecosystem where new 5G services can
NVIDIA cuVNF SDK provides optimized in- be tested in realistic conditions [14]. The 5G-EmPOWER
put/output and packet processing, exchanging pack- Operating System as shown in Fig. 7, consists of the
ets directly between GPU memory and GPUDirect- following components:
capable NVIDIA ConnectX-6 DX network interface
cards [13]. 1) Empower-core, the core library used to develop the
5G-EmPOWER controller.
The Aerial SDK works on COTS hardware and cloud- 2) Empower-runtime, the Python-based 5G-EmPOWER
native platforms such as NVIDIA EGX. It’s the single Controller. This allows network apps to control Wi-Fi
software programming model that goes from pico cells to APs and LTE eNBs using either a REST API or a
centralized RAN (CRAN) to distributed RAN (DRAN). It’s Python API.
Kubernetes based and provides container orchestration for 3) Empower-lvap-agent, the 5G-EmPOWER Wi-Fi
VOLUME 2, 2021 11
 Building and Deploying Secure 5G Networks

FIGURE 14. SD-Core Architecture [23].

agent. This agent allows controlling Wi-Fi access RAN runtime, one for each RAN module (e.g., one for
points using the empower-runtime. While in principle monolithic 4G eNB, or multiple for a disaggregated 4G and
it is possible to install this agent on any Linux 5G) [16]. The control and data plane separation as shown
box you will avoid a lot of pain if you use our in Fig. 8, are provided by the RAN runtime environment
OpenWRT branch which includes all the necessary which acts as an abstraction layer with the RAN module on
Kernel patches. one side and RTC and control apps on the other side. RAN
4) Empower-enb-agent, the 5G-EmPOWER LTE agent control applications can be developed both on the top of the
library. This agent allows controlling LTE eNBs using RAN runtime and RTC SDK allowing to monitor, control,
the empower-runtime. The agent can be integrated and coordinate the state of RAN infrastructure [16].
with any LTE stack however for the moment we 1) RAN Control Data Plane Separation: FlexRAN de-
officially support only srsLTE. couples the RAN control and data plane with several
5) Empower-vbs-emulator, a basic dummy eNB imple- benefits, including reducing the complexity of devel-
menting part of the 5G-EmPOWER southbound in- oping new control solutions; promoting openness and
terface and meant to help in the development of the innovation by allowing operators to open their RAN
controller when a real eNB is not available. service environment to authorized third parties to
6) srsLTE, a branch of srsLTE with the 5G-EmPOWER rapidly deploy innovative applications and services for
eNB agent. mobile subscribers, enterprises, and vertical segments
7) Empower-openwrt-packages, the ’empower-lvap- [16].
agent’ package for OpenWRT 19.07. 2) Centralized Real-time Control: FlexRAN consoli-
8) Empower-openwrt, a branch of OpenWRT 19.07 in- dates the control plane into a single logically cen-
cluding some Kernel patches necessary for the correct tralized controller, enabling easier coordination among
operation of the ’empower-lvap-agent’. base stations, effectively simplifying the development
9) Empower-config, the configuration files for the Wi-Fi of more sophisticated control applications [16].
WTPs. 3) Abstraction and Virtualized Control Functions:
10) Docker, some docker files of the main 5G-EmPOWER FlexRAN allows the flexible and programmable con-
components. trol of the underlying RAN infrastructure through
the introduction of RAN API and virtualized control
5) FlexRAN functions that have a modular structure and well-
The FlexRAN platform is made up of two main components: defined interfaces and are responsible for performing
the FlexRAN Service and Control Plane and FlexRAN the various control operations of the base station [16].
Application plane. The FlexRAN service and control plane 4) Control Delegation Policy Reconfiguration: The vir-
follows a hierarchical design and is composed of a Real-time tualized control functions of FlexRAN are exploited
Controller (RTC) that is connected to several underlying through a set of mechanisms designed to allow the
12 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 15. CORD Architecture [24].

FIGURE 16. LL-MEC Platform [25].

delegation of control functions, like schedulers and an RF board. The OAI gNB and the OAI UE com-
mobility managers, from the master controller to the municate as if there were an RF interface between
base stations at runtime and the reconfiguration of them, but without any real-time clock constraints. The
their behavior and parameters on the fly simply and I/Q samples can be transmitted over a radio channel
seamlessly [16]. simulator. The RF simulator also supports MIMO
[18].
6) Open-Air-Interface 5G Radio Access Network Project 2) L2-simulation framework: Using actual radios or even
RF simulators does not allow testing a large number of
The OAI 5G stack supports the following Non-Stand-Alone
UEs. Therefore, as shown in Fig. 9, the L2 simulator
(NSA) gNB, Stand-Alone (SA) gNB, and 5G NSA SA UE.
offers the possibility of connecting the OAI UE with
1) L1-simulation framework: The RF simulator replaces the OAI xNB (eNB in LTE and gNB in 5G) through
the radio board with software (TCP/IP) communi- the nFAPI interface defined by the Small Cells Forum
cation to make possible all functional tests without
VOLUME 2, 2021 13
 Building and Deploying Secure 5G Networks

FIGURE 17. LightEdge-MEC Platform [26].

FIGURE 18. Aether Architecture [27].

(SCF). nFAPI splits the xNB into a MAC entity and a able for the test and simulation of downlink transmit and
PHY entity. In OAI, the xNB MAC connects through receive functionality. In addition, GNU Radio applications
the nFAPI interface to a channel proxy that simulates are available for downlink to transmit and receive to and
the channel and allows the connection of many UEs from a file. The current focus is on extending the capabilities
to the MAC stub. Each UE is the simulated OAI UE of the GNU Radio applications [28].
that connects to the proxy [18].
8) Open vRAN
7) openLTE Mavenir Open vRAN solution brings increased business
OpenLTE is an open-source implementation of the 3GPP agility with network elasticity and flexibility in radio access
LTE specifications. The focus is on the transmission and networks with the world’s first fully containerized, virtu-
reception of the downlink. Currently, octave code is avail- alized Open RAN Split 7.2 architecture [19]. This allows
14 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

the Mavenir customers to break free of vendor lock-in with 3) Federation Gateway: The Federation Gateway in-
the evolved Open RAN architecture, designed with cloud- tegrates the MNO core network with Magma by
native virtualization techniques, which enables RAN to flex using standard 3GPP interfaces to existing MNO
and adapt based on usage and coverage. Mavenir’s Open components. It acts as a proxy between the Magma
vRAN O-RAN compliant, fully containerized true Open AGW and the operator’s network and facilitates core
RAN solution works on open interfaces supporting O-RAN functions, such as authentication, data plans, policy
Split 7.2x and Split 2 as shown in Fig. 10,. It further enforcement, and charging to stay uniform between
disaggregates into Distributed unit (DU) and centralized an existing MNO network and the expanded network
unit (CU). These entities work as a containerized network with Magma [21].
function (vDU, vCU CNF) running on Commercial Off
the Shelf (COTS) hardware. Designed to support multiple 3) free5GC
Fronthaul splits simultaneously [19]. The free5GC is an open-source project for 5th generation
(5G) mobile core networks. The goal of this project is to
B. CORE FRAMEWORKS implement the 5G core network (5GC) defined in 3GPP
1) COMAC Release 15 (R15) and beyond. The implementation is based
The Converged Multi-Access and Core (COMAC) open- on nextEPC, implementation of 4G EPC R13. That is, the
source project, paired with the COMAC RD, has been MME, SGW, and PGW are migrated into 5GC. Because
launched to bring convergence to Operators’ mobile and commercial 5G User Equipment (UE) and base station
broadband access and core networks. It will build upon a (gNB) are not on the market yet, the free5GC uses 4G
suite of ONF projects that are part of the CORD project protocols to communicate with 4G UE and 4G base station
umbrella. By leveraging and unifying both access and (eNB) as shown in Fig. 13. Thus, the authentication protocol
core projects, COMAC will enable greater infrastructure is still based on 4G [22].
efficiencies, as well as common subscriber authentication
and service delivery capabilities [20]. 4) SD-Core
Optimized for 5G deployments, the COMAC Exemplar The SD-Core project is a 4G/5G disaggregated mobile core
Platform as shown in Fig. 11, will leverage SDN and cloud optimized for public cloud deployment in concert with
principles to disaggregate elements and will be built on distributed edge clouds and is ideally suited for carrier and
a microservice architecture, so operators can dynamically private enterprise 5G networks. It exposes standard 3GPP
place elements where they best serve their needs. Access, interfaces enabling the use of SD-Core as a conventional
edge, core, or public clouds work together in a centralized mobile core [23]. SD-Core is a flexible, agile, scalable, and
and coordinated way to deliver exceptional user experience configurable dual-mode 4G/5G core network platform that
while leveraging common infrastructure and public cloud builds upon and enhances ONF’s OMEC and free 5GC core
economics [20]. network platforms to support LTE, 5G NSA and 5G SA
services as shown in Fig. 14. The SD-Core control plane
2) Magma provides the flexibility of simultaneous supports for 5G
Magma is an open-source software platform that gives standalone, 5G non-standalone, and 4G/LTE deployments.
network operators an open, flexible, and extendable mobile SD-Core provides a rich set of APIs to Runtime Operation
core network solution. The high-level Magma architecture Control (ROC). Operators can use these APIs to provision
Ais shown in Fig. 12. Magma is designed to be 3GPP the subscribers in the mobile core; control runtime config-
generation and access network (cellular or WiFi) agnostic. uration of network functions, and provide telemetry data to
It can flexibly support a radio access network with minimal third party applications [23].
development and deployment effort [21]. Magma has three
major components: C. EDGE FRAMEWORKS
1) Access Gateway: The Access Gateway (AGW) pro- 1) CORD
vides network services and policy enforcement. In an The edge of the operator network (such as the central
LTE network, the AGW implements an evolved packet office for telcos and the head-end for cable operators) is
core (EPC), and a combination of an AAA and a where operators connect to their customers. CORD is a
PGW. It works with existing, unmodified commercial project intent on transforming this edge into an agile service
radio hardware [21]. delivery platform enabling the operator to deliver the best
2) Orchestrator: Orchestrator is a cloud service that pro- end-user experience along with innovative next-generation
vides a simple and consistent way to configure and services [24]. The CORD (Central Office Re-architected as
monitor the wireless network securely. The Orches- a Datacenter) platform as shown in Fig. 15, leverages SDN,
trator can be hosted on a public/private cloud. The NFV, and Cloud technologies to build agile datacenters for
metrics acquired through the platform allow you to the network edge. Integrating multiple open-source projects,
see the analytics and traffic flows of the wireless users CORD delivers a cloud-native, open, programmable, agile
through the Magma web UI [21]. platform for network operators to create innovative services
VOLUME 2, 2021 15
 Building and Deploying Secure 5G Networks

FIGURE 19. Akraino Architecture [29].

FIGURE 20. srsRAN Architecture [30].

[24]. Commodity servers interconnected by a fabric of nication between the LL-MEC and underlying RAN and
White-box Switches, switching fabric in a Spine-Leaf topol- CN. With LL-MEC, coordinated RAN and CN network
ogy for optimized East-to-West traffic and specialized access applications can be developed by leveraging both LL-MEC
hardware for connecting subscribers (residential, mobile, and FlexRAN SDKs allowing to monitor and control not
and/or enterprise). only the traffic but also the state of network infrastructure
[25].
2) LL-MEC
The LL-MEC platform is made up of two main components: 3) LIGHTeDGe
the LL-MEC platform and data-control APIs as shown in Lightedge is a lightweight, ETSI-compliant MEC solution
Fig. 16. The LL-MEC provides two main services: native for 4G and 5G networks. Lightedge can provide Mobile
IP-service endpoint and real-time radio network information Network Operators (MNOs) with a MEC platform that can
to MEC applications on per user and service basis and can immediately bring the advantages of edge computing to
be connected to several underlying RANs and CN gateways. current 4G users as shown in Fig. 17 while enabling a seam-
The data plane APIs acts as an abstraction layer between less transition from the 4G towards a full 5G architecture
RAN and CN data plane and the LL-MEC platform. The [26]. Lightedge follows the bump in the wiring architecture
OpenFlow and FlexRAN protocols facilitate the commu- proposed by ETSI, thereby placing the MEC host between
16 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 21. srsEPC Architecture [31].

FIGURE 22. srsENB Architecture [31].

the RAN and the EPC of the 4G system to enable the been tested by the community and are ready for adoption
interception of UE requests. as-is or used as a starting point for customizing a new edge
blueprint [29].
4) Aether Akraino follows a holistic design focused on availability,
Aether is the first open-source 5G Connected Edge platform capacity, security, and continuity such as:
for enabling enterprise digital transformation. It provides
1) Finite set of configurations – To reduce complexity,
mobile connectivity and edge cloud services for distributed
the design will follow a finite set of configurations.
enterprise networks as a cloud-managed offering as shown
2) May support Multiple workloads types such as VMs,
in Fig. 18. Aether is an open-source platform optimized
Containers, microservices, etc.
for multi-cloud deployments, and simultaneous support for
3) Security – The design needs to validate the security
wireless connectivity over licensed, unlicensed, and lightly
of the blueprint.
licensed (CBRS) spectrum [27]. The Aether network is op-
4) Autonomous, turn-key solution for service enable-
erational and connects Aether Edges at project collaborator
ment.
locations around the world. The network is used for Aether
5) Platform, VNF, and application assessment and gating
and Pronto development.
– assess whether the application is fit to run at the edge
5) Akraino (e.g., latency sensitiveness, code quality).
Akraino is a set of open infrastructures and application These above-mentioned open-source software are non-
blueprints for the Edge, spanning a broad variety of use conventional 5G software suites that can be used to build
cases, including 5G, AI, Edge IaaS/PaaS, IoT, for both a 5G mobile networks. It depends on the user’s choice,
provider and enterprise edge domains. These Blueprints the resources available, and software platforms. In our use
have been created by the Akraino community and focus case study, we will focus on srsRAN as the open-source
exclusively on the edge in all its different forms as shown software [30] and possible software-defined radio (SDR)
in Fig. 19. What unites all these blueprints is that they have devices that can be deployed with srsRAN such as Lime
VOLUME 2, 2021 17
 Building and Deploying Secure 5G Networks

FIGURE 23. srsUE Architecture [31].

FIGURE 24. Basic 5G Network.

SDR mini, BladeRF micro 2.0 xA4, and Ettus x310 that TABLE 2.

are listed in Tables 1,2, and 3 respectively [32]. Tables 1,2,

BladeRF micro 2.0 xA4 Description
and 3 give the description of each mentioned SDR, their 1 Price: 500 US Dollars
advantages and limitations. It is up to the reader’s choice 2 Driver: SoapySDR
which SDR to use. 3 Frequency Range: 47 Mhz – 6 Ghz
4 RF Bandwidth: 56 Mhz
TABLE 1. 5 Clock: 38.4 MHz onboard VCTCXO
6 Channels: 2x2
Lime SDR mini Description
1 Price: 200 US Dollars TABLE 3.
2 Driver: SoapySDR
3 Frequency Range: 10 Mhz – 3.5 GHz
Ettus x310 Description
4 RF Bandwidth: 30.72 Mhz
5 Clock: 30.72 MHz onboard VCTCXO 1 Price: 7050 US Dollars
6 Channels: 1x1 2 Driver: UHD
3 Frequency Range: DC - 6GHz (w/ Daughter Cards)
4 RF Bandwidth: 160 MHz (w/ Daughter Cards)
A brief description of what is srsRAN, use case scenarios 5 Clock: Configurable
of how to set up a 5G network using the Zero MQ with 6 Channels: 2x2
virtual radios, srsRAN on Raspberry Pi 4, and 5G Non-
Standalone Access (NSA) end to end system respectively
will be given in the subsequent section. After this, we V. WHAT IS SRSRAN AND ITS FEATURES
will mention the best possible SDR and PC hardware srsRAN is an open-source 4G and 5G software radio suite
combinations that can be used with the srsRAN software as shown in Fig. 20. that provides UE and RAN solutions
suite in the following subsequent sections. [30], [33]. It runs on off-the-shelf computer, RF hardware,
18 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

has a channel simulator for EPA, EVA, and ETU

3GPP channels, a ZeroMQ-based fake RF driver for
I/Q over IPC/network, mobility support for Intra-
ENB, and Inter-ENB (S1) and proportional-fair and
round-robin MAC scheduler with FAPI-like C++ API
[31].
3) srsENB also provides SR, periodic, aperiodic CQI
feedback support, and standard S1AP and GTP-U
interfaces to the core network as shown in Fig. 22.
It can reach up to 150 Mbps during DL in 20
MHz MIMO TM3/TM4 with commercial UEs (195
Mbps with QAM256), 75 Mbps during DL in SISO
configuration with commercial UEs, 50 Mbps during
UL in 20 MHz with commercial UEs, and user-plane
encryption [31].

3) srsUE
It is an application running on a Linux-based operating
system, the excellent advantage of srsUE is that it is
implemented entirely in software as a 4G LTE and 5G NR
FIGURE 25. 5G NSA Network. NSA UE modem [31]. It can connect to an LTE network
to provide a standard network interface and includes the
featuring both the UE and eNodeB/gNodeB applications following features:
[34]. 1) srsUE is LTE release 10 aligned with features up to
release 15, is configured for TDD and FDD opera-
A. SRSRAN FEATURES tions. It is tested with bandwidths like 1.4, 3, 5, 10,
The srsRAN includes features like srsEPC, srsENB and 15, and 20 MHz and includes transmission modes 1
srsUE which are discussed below: (single antenna), 2 (transmit diversity), 3 (CCD), and
4 (closed-loop spatial multiplexing). It can manually
1) srsEPC configure DL/UL carrier frequencies and simulate
srsRAN uses srsEPC as a lightweight implementation of a 3GPP channels such as EPA, EVA, and ETU [31].
complete LTE core network (EPC) as shown in Fig. 21. 2) It offers TUN virtual network kernel interface integra-
However, srsEPC runs as a single binary but still provides tion for Linux OS, a detailed log system with per-layer
the key EPC components such as Home Subscriber Service log levels and hex dumps. It comes with MAC and
(HSS), Mobility Management Entity (MME), Service Gate- NAS layer Wireshark packet captures, command-line
way (S-GW), and Packet Data Network Gateway (P-GW) trace metrics, and detailed input configuration files as
[31]. shown in Fig. 23. srsUE also provides services like
evolved multimedia broadcast and multicast service
2) srsENB (eMBMS), frequency-based ZF and MMSE equaliz-
srsRAN uses srsENB in conjunction with srsEPC to im- ers, and highly optimized Turbo Decoder for Intel
plement functionalities of a complete 4G/5G BS [31] and SSE4.1/AVX2 (with +150 Mbps) [31].
includes the following features: 3) For support purposes, srsUE includes 5G NSA sup-
1) srsENB is aligned with LTE Release 10. It supports port, soft USIM supporting XOR/Milenage authenti-
FDD configuration, has been tested with bandwidths cation, hard USIM support via PC/SC, snow3G and
1.4, 3, 5, 10, 15, and 20 MHz and it also includes AES integrity/ciphering support, QoS support, 150
transmission modes such as 1 (single antenna), 2 Mbps during DL in 20 MHz MIMO TM3/TM4 or
(transmit diversity), 3 (CCD), and 4 (closed-loop spa- 2xCA configuration (195 Mbps with QAM256), 75
tial multiplexing) [31]. srsENB also offers command- Mbps during DL in 20 MHz SISO configuration (98
line trace metrics, detailed input configuration files, Mbps with QAM256), 36 Mbps during DL in 10
and supports 5G NSA [31]. MHz SISO configuration and supports Ettus USRP
2) Frequency-based ZF and MMSE equalizers and highly B2x0/X3x0 families, BladeRF, LimeSDR [31].
optimized Turbo Decoder are also included in the In the above paragraphs, we briefly discussed what is
srsENB. Detailed log system can be obtained with srsRAN and its features, now in the subsequent sections,
per-layer log levels and hex dumps and MAC layer we will talk about how to implement srsRAN with ZMQ
Wireshark packet capture is also possible [31]. It also application to simulate a virtual 5G Network, an end-to-end
VOLUME 2, 2021 19
 Building and Deploying Secure 5G Networks

5G NSA Network and after that, we will also list the steps 4) cd build
of how practically implement srsRAN with an ultra-low-cost 5) cmake ../
SDR device like limeSDR and low power Raspberry Pi 4 6) make
so that the users can practically build extremely low budget After this, the cmake console output should read the
5G Networks. following lines:
1) FINDING ZEROMQ.
VI. SIMULATING AND SETTING UP A 5G NETWORK
2) Checking for module ’ZeroMQ’
The main goal of this setup is to help the readers learn how
3) No package ’ZeroMQ’ found
to build and deploy 4G/5G base stations. From Fig. 24,
4) Found libZEROMQ: /usr/local/include,
we can see a 5G network consisting of a 5G base station
5) /usr/local/lib/libzmq.so
(which utilizes commonly available hardware and open-
source software) and a user equipment (UE) device. As it The ZMQ application has been installed.
depends on the reader’s choice about what type of hardware Now, to start the LTE network on a single PC, we need to
device one can use, on the other hand, we illustrate the steps make sure that UE and EPC both are in different namespaces
of how one can virtually simulate and practically build a because they will share the same network configuration, UE
4G/5G Network using srsRAN with ZMQ and srsRAN with receives the IP address from the EPC subnet and the Linux
LimeSDR and Raspberry Pi 4. will bypass the TUN interfaces when routing traffic between
both ends. To communicate over the TCP/IP stack, we
1) Virtually building a full end-to-end LTE network on a require TUN interfaces for the UE and EPC. Each srsRAN
single computer by using ZMQ Virtual Radios application will be launched in a separate terminal as well
In this particular approach, we can use virtual radios with a as ping and iperf [35].
ZMQ networking library to transfer radio samples between Basically, there are six steps in order to launch the
applications and build an end-to-end network [35]. Why this network and at the end terminate it, following the step 1,
approach is useful because we do not need to have any creating network namespace ue1 for UE as:
physical radios for performing development, testing, CI/CD, 1) sudo ip netns add ue1
teaching, and demonstration. Before this, the user needs to In step 2, running the EPC, will create a TUN device
make sure that they have installed ubuntu on their PC [36], in the default network namespace so it will need root
on the virtual box which is a free and open-source hosted permissions as:
hypervisor for x86 virtualization [37]. After this, the user 1) sudo ./srsepc/src/srsepc
needs to install ZMQ and build srsRAN and for installing In step 3, running the eNodeB, with the default configura-
ZMQ development libraries on ubuntu the user can use: tions and pass all the parameters needed to be tweaked for
1) sudo apt-get install libzmq3-dev ZMQ as command line programs:
Then, the user must install two important library files such 1) ./srsenb/src/srsenb - -rf.device_name=zmq
as libzmq and czmq [35]. - -rf.device_args="fail_on_disconnect=true,
For libzmq: tx_port=tcp://*:2000,rx_port=tcp://localhost:2001,
1) git clone https://github.com/zeromq/libzmq.git id=enb,base_srate=23.04e6"
2) cd libzmq In step 4, running the UE with root permission to create
3) ./autogen.sh the TUN device as:
4) ./configure
1) sudo ./srsue/src/srsue - -rf.device_name=zmq
5) make
- -rf.device_args="tx_port=tcp://*:2001,
6) sudo make install
rx_port=tcp://localhost:2000,id=ue,
7) sudo ldconfig
base_srate=23.04e6" - -gw.netns=ue1
For czmq:
This command will run the UE and attach it to the core
1) git clone https://github.com/zeromq/czmq.git
network, then the UE will be assigned a new IP address
2) cd czmq
172.16.0.2.
3) ./autogen.sh
In step 5, generating traffic in the downlink direction from
4) ./configure
EPC to UE, by just entering ping in command line as:
5) make
6) sudo make install 1) ping 172.16.0.2
7) sudo ldconfig and in order to generate traffic in the uplink direction from
Now, to build and compile srsRAN so that it recognizes UE to EPC, running the ping command in the UE network
the addition of ZMQ: name space as:
1) git clone https://github.com/srsRAN/srsRAN.git 1) sudo ip netns exec ue1 ping 172.16.0.1
2) cd srsRAN After step 5 and finishing the setup, the user also needs to
3) mkdir build delete the netns as: s
20 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 26. Overview of NSA Network Architecture.

1) sudo ip netns delete ue1 rx_port1=tcp://localhost:2100,id=ue,

base_srate=23.04e6
By following the above directions and the five steps, the
users can run an end-to-end LTE network [35] which can In the above command, two TX and two RX channels
be highly desirable for an individual with a single PC. To are added to support the primary and secondary carrier as
end the simulation, first, the UE needs to be terminated then shown in Fig. 26. So, to complete the ZMQ setup, the user
the eNB, they can only run one time, to run them again the needs to set the network namespace netns under the [gw]
UE needs to detach and after that, the eNB can be restarted. settings as:
For now, only one eNB and UE are supported [35]. 1) [gw]
2) netns = ue1
2) Virtually building a 5G NSA End-to-End Network using Now to setup the NR RAT, which provides the 5G NR
ZMQ capabilities of UE, this has to enabled in the config under
The 21.10 release of srsRAN brings 5G NSA features to [rat.nr] as:
srsENB and can be enabled via the srsENB configuration 1) [rat.nr]
files. Therefore, by using the ZMQ virtual radios in place of 2) bands = 3, 78
actual RF hardware we can create a 5G network as shown 3) nof_carriers = 1
in the following steps: In the above command, the enable bands are 3 and
From Fig. 27. we can see the 5G Non-Standalone mode, 78 which reflect the FDD and TDD respectively, and the
which uses the pre-existing 4G infrastructure to build upon, user can test each duplex mode simply by configuring the
two carriers are sent to UE, the primary carrier being the 4G network. The number of carriers must be set to 1, if not then
and the secondary carrier being the 5G, the UE first connects the UE will not be able to connect to gNB and will only
with the 4G carrier and then with the 5G carrier. The 4G have an LTE connection [39]. The NSA mode is a part of
carrier anchor is used for control plane signaling while the 3GPP release 15, so it must be included in the config entry
5G carrier is used for high-speed data plane traffic [39]. under the [rrc] field, by default the release included is 8.
To run this setup, we need three things, srsUE must run in 1) [rrc]
a separate network namespace, srsENB should be configured 2) release = 15
so that both the LTE eNB, and the NSA gNB cells are Until now we have only configured UE, now moving on
created at run time and srsEPC should include UE in the the srsENB, to enable 5G NSA, the user needs to make
list of subscribers [39]. To enable ZMQ and 5G NSA carrier changes in both enb.conf and rr.conf as shown below:
changes must be made in the configuration files of srsUE For configuring the eNB, the user needs to make the
and srsENB, no changes are made in the srsEPC and also required changes to enable ZMQ in the [rf] section as:
the modified config files can be downloaded from here [39]. 1) device_name = zmq
For srsUE, changes must be made in ue.conf file to enable 2) device_args = fail_on_disconnect=true,
ZMQ and 5G NR features. To enable ZMQ, we need to tx_port0=tcp://*:2000,rx_port0=tcp://localhost:2001,
change the device names in [rf] section of UE as: tx_port1=tcp://*:2100,rx_port1=tcp://localhost:2101,
1) device_name = zmq id=enb,base_srate=23.04e6
2) device_args = tx_port0=tcp://*:2001, Just like UE, here we have two TX and two RX channels
rx_port0=tcp://localhost:2000,tx_port1=tcp://*:2101, that are mapped to the relevant ports configured on the UE
VOLUME 2, 2021 21
 Building and Deploying Secure 5G Networks

FIGURE 27. Y Cable [38].

[39]. For RRC config, the main change is to add the NR Step 2, run the eNB/ gNB,
cell to the cell list in the rr.conf file to the end of the file 1) sudo srsenb
as: The output obtained will look like this:
1) nr_cell_list = 1) Opening 2 channels in RF
( device=zmq with args=fail_on_disconnect=true,
{ tx_port0=tcp://*:2000,rx_port0=tcp://localhost:2001,
rf_port = 1; tx_port1=tcp://*:2100, rx_port1=tcp://
cell_id = 0x02; localhost:2101,id=enb,base_srate=23.04e6
tac = 0x0007; 2) CHx base_srate=23.04e6
pci = 500; 3) CHx id=enb
root_seq_idx = 204; 4) Current sample rate is 1.92 MHz with a
base rate of 23.04 MHz (x12 decimation)
// TDD: 5) CH0 rx_port=tcp://localhost:2001
//dl_arfcn = 634240; 6) CH0 tx_port=tcp://*:2000
//band = 78; 7) CH0 fail_on_disconnect=true
8) CH1 rx_port=tcp://localhost:2101
// FDD: 9) CH1 tx_port=tcp://*:2100
dl_arfcn = 368500;
band = 3;
} 10) ==== eNodeB started ===
); 11) Type <t> to view trace
As shown in the above command, the user can see the 12) Current sample rate is 11.52 MHz with a
FDD and TDD configs, however, for the RRC config, only base rate of 23.04 MHz (x2 decimation)
the FDD is used as shown above. For utilizing TDD, the user 13) Current sample rate is 11.52 MHz with a
needs to the opposite change and restart the srsENB [39]. base rate of 23.04 MHz (x2 decimation)
Till now, the necessary changes have been made to operate 14) Setting frequency: DL=2680.0 Mhz,
the 5G NSA mode. Now the user can start the network as UL=2560.0 MHz for cc_idx=0 nof_prb=50
shown below in three steps: 15) Setting frequency: DL=1842.5 Mhz,
Step 1, run the EPC, UL=1747.5 MHz for cc_idx=1 nof_prb=52
1) sudo srsepc From the output, the IDs can be seen as 0 and 1, where
This command will give the output as: 0 represents LTE cell and 1 represents NR Cell [39]. Next
1) HSS Initialized. step is to run the UE as:
2) MME S11 Initialized. 1) sudo srsue
3) MME GTP-C Initialized. When the UE runs successfully then attaches with the
4) MME Initialized. MCC: 0xf001, MNC: 0xff01 eNB/gNB, the user will see the following output:
5) SPGW GTP-U Initialized. 1) Opening 2 channels in RF device=zmq with
6) SPGW S11 Initialized. args=tx_port0=tcp://*:2001,
7) SP-GW Initialized. rx_port0=tcp://localhost:2000,
22 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

tx_port1=tcp://*:2101,rx_port1=tcp:// Traffic will now be sent from UE to eNB, it will be shown

localhost:2100,id=ue,base_srate=23.04e6 in both server and iperf consoles.
2) CHx base_srate=23.04e6 For client iPerf output:
3) CHx id=ue
1) Connecting to host 172.16.0.1, port 5201
4) Current sample rate is 1.92 MHz with a
2) [ 5] local 172.16.0.2 port 52484 connected to
base rate of 23.04 MHz (x12 decimation)
172.16.0.1 port 5201
5) CH0 rx_port=tcp://localhost:2000
3) [ ID] Interval Transfer Bitrate Retr Cwnd
6) CH0 tx_port=tcp://*:2001
4) [ 5] 0.00-1.00 sec 954 KBytes 7.81 Mbits/sec 0 79.2
7) CH1 rx_port=tcp://localhost:2100
KBytes
8) CH1 tx_port=tcp://*:2101
5) [ 5] 1.00-2.00 sec 1.12 MBytes 9.44 Mbits/sec 0 126
9) Waiting PHY to initialize ... done!
KBytes
6) [ 5] 2.00-3.00 sec 1.00 MBytes 8.39 Mbits/sec 12
49.5 KBytes
10) Attaching UE...
7) [ 5] 3.00-4.00 sec 640 KBytes 5.24 Mbits/sec 2 42.4
11) Current sample rate is 1.92 MHz with a
KBytes
base rate of 23.04 MHz (x12 decimation)
8) [ 5] 4.00-5.00 sec 512 KBytes 4.19 Mbits/sec 2 39.6
12) Current sample rate is 1.92 MHz with a
KBytes
base rate of 23.04 MHz (x12 decimation)
9) [ 5] 5.00-6.00 sec 512 KBytes 4.19 Mbits/sec 2 33.9
KBytes
13) Found Cell: Mode=FDD, PCI=1, PRB=50, For server iPerf output:
Ports=1, CP=Normal, CFO=-0.2 KHz 1) --------------------------------
14) Current sample rate is 11.52 MHz with a 2) Server listening on 5201
base rate of 23.04 MHz (x2 decimation) 3) --------------------------------
15) Current sample rate is 11.52 MHz with a 4) Accepted connection from 172.16.0.2, port 52482
base rate of 23.04 MHz (x2 decimation) 5) [ 5] local 172.16.0.1 port 5201 connected
16) Found PLMN: Id=00101, TAC=7 to 172.16.0.2 port 52484
17) Random Access Transmission: seq=33, tti=981, ra- 6) [ ID] Interval Transfer Bitrate
rnti=0x2 7) [ 5] 0.00-1.00 sec 634 KBytes 5.19 Mbits/sec
18) RRC Connected 8) [ 5] 1.00-2.00 sec 950 KBytes 7.78 Mbits/sec
19) Random Access Complete. c-rnti=0x46, ta=0 9) [ 5] 2.00-3.00 sec 977 KBytes 8.00 Mbits/sec
20) Network attach successful. IP: 172.16.0.3 10) [ 5] 3.00-4.00 sec 533 KBytes 4.36 Mbits/sec
21) Software Radio Systems RAN (srsRAN) 13/10/2021 11) [ 5] 4.00-5.00 sec 553 KBytes 4.53 Mbits/sec
15:29:9 TZ:0 12) [ 5] 5.00-6.00 sec 537 KBytes 4.40 Mbits/sec
22) RRC NR reconfiguration successful.
23) Random Access Transmission: prach_occasion=0, Traffic can be traced from UE and eNB/gNB consoles by
preamble_index=0, ra-rnti=0xf, tti=1611 typing t in each console and the result obtained will be as
24) Random Access Complete. c-rnti=0x4601, ta=0 shown below: For UE console,
1) - - - - - -Signal- - - - - - - - - -|
In the output, RRC NR reconfiguration successful
- - - - - - -DL- - - - - - - - - - - -|
points out the successful connection of UE with the NR cell,
- - - - - - -UL- - - - - - - - - - - -
this will be used for data link while the LTE cell will be used
2) rat pci rsrp pl cfo |
for control messaging [39]. From here, we move towards the
mcs snr iter brate bler ta_us |
testing of the NSA connection, to generate traffic from UE
mcs buff brate bler
to gNB, iperf3 client will be used on the UE side, UDP
3) lte 1 -11 11 -1.4u |
traffic will be generated at 10 Mbps and 60 seconds [39],
0 142 0.0 0.0 0% 0.0 |
here it is important to note to start the server first and then
0 0.0 0.0 0%
the client.
4) nr 500 1 0 23u |
To listen to traffic coming from UE, the user must start 27 70 1.0 8.5M 0% 0.0 |
the iPerf server on network side: 28 36k 8.3M 0%
1) iperf3 -s -i 1 5) lte 1 -11 11 -1.4u |
0 142 0.0 0.0 0% 0.0 |
With the network and iPerf up and running, it’s time to
0 0.0 0.0 0%
run the client on UE side from the command:
6) nr 500 1 0 23u |
1) sudo ip netns exec ue1 iperf3 27 70 1.0 9.2M 0% 0.0 |
-c 172.16.0.1 -b 10M -i 1 -t 60 28 24k 8.1M 0%
VOLUME 2, 2021 23
 Building and Deploying Secure 5G Networks

7) lte 1 -11 11 -1.4u | Pi 4, since srsRAN consists of a core network and an eNB,
0 142 0.0 0.0 0% 0.0 | the eNB can be run on the hardware device such as the
0 0.0 0.0 0% Raspberry Pi 4B /4GB rev 1.2 running with Ubuntu Server
8) nr 500 2 0 23u | 20.04 LTS aarch64 image [38]. The Pi4 hardware revision
27 69 1.0 4.6M 0% 0.0 | can be checked from [40]. The whole LTE setup can be run
28 19k 4.2M 0% with a USRP B210, a LimeSDR-USB, and a LimeSDR-
9) lte 1 -11 11 -1.3u | Mini, but keeping in mind that when using USRP B210 the
0 142 0.0 0.0 0% 0.0 | user can create a 2x2 MIMO cell with srsenb and run the
0 0.0 0.0 0% srsepc core network on the Pi too, however, when using
10) nr 500 2 0 23u | either of the LimeSDRs, the user can only create a 1x1
27 69 1.0 5.0M 0% 0.0 | SISO cell with srsenb and the core network must be run on
28 26k 4.8M 0% a separate device [38]. It should be noted that when using
11) lte 1 -11 11 -1.4u | the SDRs due to their power requirements the user must use
0 142 0.0 0.0 0% 0.0 | an external power source this can be achieved through the
0 0.0 0.0 0% Y cable as shown in Fig. 27. The LTE setup consists of two
12) nr 500 2 0 23u | steps, the first is a software set up and the second step is the
| 27 69 1.0 4.7M 0% 0.0 | hardware setup. In the first step, the user needs to set up the
28 28k 4.7M 0% required software as shown below and then proceed towards
For eNB/ gNB console, setting up the hardware and running the LTE network.
Step 1: Configuring the software
1) - - - - - - - - - - - - - -DL- - - - - - - - - - - - - -|
The user needs to install the SDR drivers and build
- - - - - - - - - - - - - -UL- - - - - - - - - - - - - -
srsRAN. For USRP the UHD drivers and for LimeSDRs
2) rat rnti cqi ri mcs brate ok nok (%) |
the SoapySDR/LimeSuite drivers can be installed as shown
pusch pucch phr mcs brate ok nok (%) bsr
below:
3) lte 46 15 0 0 0 0 0 0% |
For USRP:
n/a n/a 0 0 0 0 0 0% 0.0
4) nr 4601 n/a 0 27 6.9M 124 0 0% | 1) sudo apt update
n/a n/a 0 0 6.1M 95 0 0% 0.0 2) sudo apt upgrade
5) lte 46 15 0 0 0 0 0 0% | 3) sudo apt install cmake
n/a n/a 0 0 0 0 0 0% 0.0
6) nr 4601 n/a 0 27 4.4M 92 0 0% | and followed by:
n/a n/a 0 0 4.2M 76 0 0% 0.0 1) sudo apt install libuhd-dev libuhd3.15.0 uhd-host
7) lte 46 15 0 0 0 0 0 0% | 2) sudo /usr/lib/uhd/utils/uhd_images_downloader.py
n/a n/a 0 0 0 0 0 0% 0.0
8) nr 4601 n/a 0 27 5.2M 113 0 0% | 3) ## Then test the connection by typing:
n/a n/a 0 0 5.0M 94 0 0% 0.0 4) sudo uhd_usrp_probe
9) lte 46 15 0 0 0 0 0 0% |
n/a n/a 0 0 0 0 0 0% 0.0 For SoapySDR:
10) nr 4601 n/a 0 27 5.4M 118 0 0% | 1) git clone https://github.com/pothosware/SoapySDR.git
n/a n/a 0 0 5.3M 99 0 0% 0.0 2) cd SoapySDR
11) lte 46 15 0 0 0 0 0 0% | 3) git checkout tags/soapy-sdr-0.7.2
n/a n/a 0 0 0 0 0 0% 0.0 4) mkdir build cd build
12) nr 4601 n/a 0 27 7.6M 156 0 0% | 5) cmake ..
n/a n/a 0 0 7.2M 129 0 0% 0.0 6) make -j4
In both outputs obtained from UE and eNB/gNB, the rat 7) sudo make install
column represents the metrics associated with the NSA 5G 8) sudo ldconfig
link (nr), or with the LTE link (lte). In the above section
(ii), we talked about the steps related to simulating 5G NSA For LimeSuite:
network using srsRAN with ZMQ application. In the (iii) 1) sudo apt install libusb-1.0-0-dev
section, we will enumerate the steps the user can take to 2) git clone https://github.com/myriadrf/LimeSuite.git
build a practical 4G LTE network. 3) cd LimeSuite
4) git checkout tags/v20.01.0
3) Building a 4G LTE Network using srsRAN on Raspberry 5) mkdir builddir cd builddir
Pi 4 as a PC and limeSDR USRP 6) cmake ../
A user can easily build a 4G LTE network by using ultra- 7) make -j4
low-cost computing hardware like the low power Raspberry 8) sudo make install
24 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

FIGURE 28. htop (LTE connection) [38].

9) sudo ldconfig 7) sudo cpupower frequency-info

10) cd .. 8) * should show that the CPU is running in
11) cd udev-rules performance mode, at maximum clock speed
12) sudo ./install.sh Step 2: Configuring the hardware
To start the Pi eNB, some configurations must be made
13) ## Then test the connection by typing: regarding the USRP B210 and LimeSDRs and the choice
14) LimeUtil –find is up to the user, which hardware to use the USRP or the
15) LimeUtil –update SDR. For this LTE setup, the Pi4 eNodeB was tested with a
16) SoapySDRUtil –find 3MHz wide cell in LTE B3 (1800MHz band), DL=1878.40
UL=1783.40 [38].
Now to compile the srsRAN as, For USRP B210 changes to be made in default enb.conf
1) sudo apt install libfftw3-dev libmbedtls-dev file:
libboost-program-options-dev libconfig++-dev libsctp- 1) sudo nano /root/.config/srsran/enb.conf
dev 2) [enb]
2) git clone https://github.com/srsRAN/srsRAN.git
3) cd srsran 3) mcc = <yourMCC>
4) git checkout tags/release_19_12 4) mnc = <yourMNC>
5) mkdir build cd build 5) mme_addr = 127.0.1.100 ## or
6) cmake ../ IP for external MME, eg. 192.168.1.10
7) make -j4 6) gtp_bind_addr = 127.0.1.1 ## or local interface
8) sudo make install IP for external S1-U, eg. 192.168.1.3
9) sudo ldconfig 7) s1c_bind_addr = 127.0.1.1 or local interface
IP for external S1-MME, eg. 192.168.1.3
10) ## copy configs to /root 8) n_prb = 15
11) sudo ./srsran_install_configs.sh user 9) tm = 2
10) nof_ports = 2
Until this step, the drivers have been installed and now the
user must modify the Pi CPU scaling_governor to ensure 11) [rf]
it is running in performance mode as: 12) dl_earfcn = 1934
1) sudo systemctl disable ondemand 13) tx_gain = 80 ## this power seems to work best
2) sudo apt install linux-tools-raspi 14) rx_gain = 40
15) device_name = UHD
3) sudo nano /etc/default/cpufrequtils 16) device_args = auto
4) * insert: ## does not work with anything other than ’auto’
5) * GOVERNOR="performance" For LimeSDR-USB or LimeSDR-Mini changes to be
made in default enb.conf file:
6) ## reboot 1) sudo nano /root/.config/srsran/enb.conf

VOLUME 2, 2021 25
 Building and Deploying Secure 5G Networks

2) [enb] 1) sudo srsepc /root/.config/srsran/epc.conf

3) mcc = <yourMCC> 2) sudo /usr/local/bin/srsepc_if_masq.sh eth0
4) mnc = <yourMNC> From, Fig. 28, we can see the resource utilization when
5) mme_addr = <ipaddr> running the software on the Pi 4B /4GB RAM with x2 UEs
## IP for external MME, eg. 192.168.1.10 attached to the USRP B210 cell. It is important to note
6) gtp_bind_addr = <ipaddr> local interface here that Fig. 28 shows the results of the srsRAN software
IP for external S1-U, eg. 192.168.1.3 running for more than 18 hours without any problems, only
7) s1c_bind_addr = <ipaddr> local interface half of the RAM is used, and the CPU cores are sitting at
IP for external S1-MME, eg. 192.168.1.3 around 25% [38].
8) n_prb = 15 In these three ways, the users can build and run inex-
9) tm = 1 pensive 4G/5G networks virtually and practically through
10) nof_ports = 1 using srsRAN and the required hardware. There are many
PC and SDR combinations possible to be able to run the
11) [rf] srsRAN, but for those users, who want to best explore the
12) dl_earfcn = 1934 functionalities of srsRAN, we list three hardware packages
13) tx_gain = 60 ## this power seems to work best that can help build the required setup to run srsRAN and
14) rx_gain = 40 provide information to the users of what they can buy. These
15) device_name = soapy setups are grouped according to price ranging from 400$ to
16) device_args = auto 16000$ [32].
## does not work with anything other than ’auto’ When choosing for the computing hardware, the users can
And the changes to be made in the default configs of consider the following criteria given in Table 4:
srsRAN core network:
1) sudo nano /root/.config/srsran/epc.conf TABLE 4.

S. No. Compute Criteria

2) [[mme]] 1 Overall cost of the machine.
3) mcc = <yourMCC> 2 Number of cores effect the overall performance.
4) mnc = <yourMNC> 3
CPUs running at lower frequencies may struggle under heavy
computational load.
5) mme_bind_addr = 127.0.1.100 ## or local interface
Greater cache memory size greater the speed of certain
IP for external S1-MME, eg. 192.168.1.10 4
computations.
1) sudo nano /root/.config/srsran/user_db.csv 5 Number of threads increase the processor’s execution speed.

2) * add details of your SIM cards This criterion doesn’t include all the features, because
To keep in mind, when running the srsRAN core network depending upon the use-case, the choice of features may
(srsepc) on an external device like another Pi, the user must vary and include features like processor cinebench score,
open incoming firewall ports to allow the S1-MME and S1- cooling ability, and portability. For SDR criteria, just the
U connections from srsenb. like commute criteria, there are many features to look for
S1-MME = sctp, port 36412 || S1-U = udp, port 2152 but depending upon the use-case, the features may vary. In
If using iptables, Table 5, the SDR criteria is given:
1) sudo iptables -A INPUT -p sctp -m sctp - -dport TABLE 5.
36412 -j ACCEPT
S. No. SDR Criteria
2) sudo iptables -A INPUT -p udp -m udp - -dport 2152 1 Cost per unit of the SDR.
-j ACCEPT 2 The drivers used by SDR (Soapy, UHD, etc).
3 The frequency range(s) the SDR operates in.
Finally, when running the Pi4 eNodeB, the user must 4 Maximum possible bandwidth available.
launch the software in separate ssh windows or using a 5 Clock rate of the SDR.
screen and for SDR an external power source must be used. How many channels the SDR support (SISO, MIMO,
6
etc).
When running the srsenb for the first time the user has to 6 The specifications of the onboard FPGA.
wait a few minutes for it to finish [38].
Now, Launch Pi4 eNodeB as: Based on the Tables 4 and 5, the users can decide
1) sudo srsenb /root/.config/srsran/enb.conf on the compute and SDR criteria then compare which
For LimeSDRs, between runs when using the LimeSDR- hardware options are more favorable to them. By following
USB, the user sometimes needs to physically unplug and the hardware combinations given below they can directly
reconnect the SDR to power cycle it. Now, the user can use them with srsRAN to build a 4G/5G network, again it
launch the core network (on a separate device, or the Pi4 depends upon the use case and the resources available to
eNodeB when using USRP B210) as: the user. Each combination contains an SDR and computer
26 VOLUME 2, 2021
Building and Deploying Secure 5G Networks

hardware section, to run a full end-to-end system at least TABLE 8. Combination 3

two SDRs and two compute platforms are required [32].
SDR Computer Hardware
Dell Precision 3340 Workstation
TABLE 6. Combination 1 Ettus x310
Intel i7-10700
Price: $7,013.00 Price: $1349.00
SDR Computer Hardware Driver: UHD # Cores: 8
Lime SDR mini Raspberry Pi 4 Frequency
Price: $200 Price: $72 Range: DC
Frequency: 2.9 - 4.8 GHz
Driver: - 6GHz (w/
# Cores: 4
SoapySDR Daughter Cards)
Frequency RF Bandwidth:
Range: 10 Mhz Frequency: 1.5 Ghz 160 MHz (w/ Cache Size: 16 MiB
– 3.5 GHz Daughter Cards)
RF Bandwidth: Clock:
Cache Size: 1 MiB # Threads: 16
30.72 Mhz Configurable
Clock: 30.72 # Channels: 2x2 .
MHz onboard # Threads: 4 FPGA:
VCTCXO KINTEX7-410T
# Channels: 1x1 .
FPGA: Intel Al-
tera MAX 10
from DC to 6 GHz with the use of the appropriate daughter
Combination 1 shown in Table 6, will enable users to cards, a potential bandwidth of 160 MHz (requires the
set up a cheap end-to-end wireless network and just under correct daughter cards), a multi-cell configuration, and a
650$. To run the full end-to-end system, the user will need powerful Kintex7 FPGA. The 3340 workstation offers an
two LimeSDR minis and three Raspberry Pi4 units, each RF intel i7-10700 which is capable of high-intensity compu-
frontend for eNB and UE and a Pi4 for EPC, eNB, and UE. tations without a significant drop-off in performance over
This combination is highly ideal for demos and testing of sustained periods [32]. The workstation offers 10 Gbps
networks and applications due to small size and portability ethernet connection, which allows users full utilization of
[32]. Moving to the second combination shown in Table 7: the 10 Gbps connection available on the x310. The full end-
to-end system would cost around $16724.
TABLE 7. Combination 2
VII. CONCLUSION AND FUTURE WORKS
SDR Computer Hardware In this manuscript, we presented a comprehensive tutorial on
BladeRF micro how to build a 5G network using open source software and
HP Omen 15 Intel i5-10300H
2.0 xA4
Price: $550 Price: $1,049.99 off-the-shelf hardware. The main purpose of this paper is to
Driver: inform and guide individuals on how to build a 5G network,
# Cores: 4
SoapySDR in a very simple, easy, and straightforward way. We have
Frequency
Range: 47 Mhz Frequency: 2.4 – 4.5 Ghz
compiled this tutorial in such a way, that it clearly explains
– 6 GHz the evolution of the wireless systems from closed RAN to
RF Bandwidth: open RAN and why the closed RAN approach is unfruitful.
Cache Size: 8 MiB
56 Mhz
We further discussed the legacy RANs and the companies
Clock: 38.4
MHz onboard # Threads: 8 related to them. Then we described in detail the numerous
VCTCXO approaches available to build a 5G network due to the
# Channels: 2x2 . open RAN concept that includes RAN, CORE, and EDGE
FPGA: Altera
Cyclone V (49 frameworks. These frameworks also highlight the main ideas
kLE) and technologies implemented in 5G networks. Then we
demonstrated each technology, software, and application
The BladeRF micro 2.0 xA4 offers users a 2X2 MIMO used in building and simulating the 5G network. There
configuration, higher bandwidth, a larger frequency range, are three procedures that we illustrated in the paper, that
and a larger FPGA. On the other hand, HP Omen 15 is includes virtually building an end-to-end LTE network on a
a gaming notebook, built for high performance and high single computer by using ZMQ Virtual Radios, a 5G NSA
CPU load for a certain time length. The intel i5 10300H is End-to-End Network using ZMQ, and a 4G LTE Network
the main focus here, having scored highly in the cinebench using srsRAN on RaspberryPi 4 as a PC and limeSDR
r20 benchmarking test, therefore this combination is an USRP. We have clearly explained these three methods in
upgrade over the previous combination 1 in terms of price the paper with the required assumptions. In the end, we
and performance [32]. concluded the paper with recommendations of appropriate
The combination shown in Table 8 by far offers the most hardware and SDR combinations that will result in the
potential in terms of RF frontends and PC performance. best experience when building a 5G network according to
The Ettus x310 offers users the largest frequency range, relevant usage and resources.
VOLUME 2, 2021 27
 Building and Deploying Secure 5G Networks

REFERENCES [35] “srsRAN with ZMQ Virtual Radios,” Software Radio Systems,
[1] A. G. Zaballos, E. I. Rodriguez, K. W. Kim, and S. Park, “5G, the driver 2019, https://docs.srsran.com/en/latest/app_notes/source/zeromq/source/
for the next-generation digital society in latin america and the caribbean.” index.html.
IDB, Mar 2020. [36] Almon, “Welcome to the ubuntu community installation guide,” Ubuntu,
[2] Qualcomm, “Everything you need to know about 5G.” Qualcomm, https: 2018, https://help.ubuntu.com/community/Installation.
//www.qualcomm.com/5g/what-is-5g. [37] “VirtualBox,” https://www.virtualbox.org/.
[3] V. Singh, Sr. Research Analyst Market Research and N. Tanwer, Research [38] “srsRAN on Raspberry Pi 4,” srsRAN, 2021, https://docs.srsran.com/en/
Analyst Market Research, “5G companies: Which players are leading the latest/app_notes/source/pi4/source/index.html.
market?” greyb, 2020, https://www.greyb.com/5g-companies/. [39] “5G NSA End-to-End,” https://docs.srsran.com/en/latest/app_notes/
source/5g_nsa_zmq/source/index.html#g-nsa-overview.
[4] “AWS Private 5G, easily deploy, manage, and scale a private cellular net-
[40] “How to Check if Your Raspberry Pi 4 Model B is
work,” Amazon Web Services, 2021, https://aws.amazon.com/private5g/.
Rev1.2?” Cytron, 2020, https://tutorial.cytron.io/2020/02/22/
[5] E. Udin, “A 5G base station is quite expensive, why destroy
how-to-check-if-your-raspberry-pi-4-model-b-is-rev1-2/.
it?” Gizchina Media, 2020, https://www.gizchina.com/2020/04/05/
a-5g-base-station-is-quite-expensive-why-destroy-it/.
[6] G. E. Gonçalves, “Flying to the clouds: The evolution of the 5G radio
access networks,” Palgrave Studies in Digital Business Enabling Tech-
nologies. Palgrave Macmillan, Cham, 2020. SADIQ IQBAL received the B.E. Degree in
[7] “O-RAN,” O-RAN Alliance, 2019, https://www.o-ran.org/. Electrical Engineering from QUEST University
[8] “What Is vRAN (Virtual Radio Access Network)?” SDxCentral, 2018, Nawabshah, Pakistan in 2016. He is presently
https://www.sdxcentral.com/5g/ran/definitions/vran/. pursuing the Master (M.Sc.) degree in Electrical
[9] D. Jones and C. Bernstein, “Radio access network (RAN),” TechTarget, and Computer Engineering from Antalya Bilim
2021, https://www.techtarget.com/searchnetworking/definition/ University, Antalya, Turkey.
radio-access-network-RAN. His research interests include physical layer
[10] ONF, “SD RAN,” ONF Mobile Projects, https://opennetworking.org/ technology, 5G communication networks, Artifi-
sd-ran/. cial Intelligence, Deep Learning, and IoT and its
[11] S. Partners, “10 RAN vendors: challengers, newcomers and heavy- applications.
weights,” STL Advisory Limited, 2017, https://stlpartners.com/telco_
cloud/10-ran-vendors/.
[12] M. Lore, “Open or closed, RAN vendors face a 2020s squeeze,”
Light Reading, 2021, https://www.lightreading.com/open-ran/ JEHAD M. HAMAMREH is the Founder and
open-or-closed-ran-vendors-face-2020s-squeeze/a/d-id/766804. Director of WISLAB, and A. Professor with the
[13] “NVIDIA aerial,” NVIDIA Corporation, https://developer.nvidia.com/ Electrical and Electronics Engineering Depart-
aerial-sdk. ment, Antalya Bilim University. He received his
[14] “An O-RAN compliant near-RT RAN intelligent controller for het RANs,” Ph.D. degree in telecommunication engineering
5G-EmPOWER, http://5g-empower.io/. and cyber systems from Istanbul Medipol Univer-
[15] “A 5G americas white paper, transition toward open interop-
sity, Turkey, in 2018. Previously, he worked as a
erable networks,” 5G Americas, 2020, https://www.5gamericas.org/
Researcher at the Department of Electrical and
transition-toward-open-interoperable-networks/.
[16] “FLEXRAN,” mosaic5g, https://mosaic5g.io/flexran/.
Computer Engineering at Texas AM University.
[17] NI, “What is the difference between NI and ettus research USRP de- He is the inventor of more than 20+ Patents and
vices?”,” NI, 2021, https://www.ni.com/en-tr/innovations/white-papers/ an author of more than 75+ peer-reviewed scientific papers along with
19/what-is-the-difference-between-ni-and-ettus-usrps.html. several book chapters. His innovative patented works won the gold, silver,
[18] “OpenAirInterface 5G Radio Access Network Project,” OpenAirInterface, and bronze medals by numerous international invention contests and fairs.
2021, https://openairinterface.org/oai-5g-ran-project/. His current research interests include wireless physical and MAC layers
[19] “Open Virtualized RAN (Open vRAN), Mavenir Open vRAN Brings security, orthogonal frequency-division multiplexing and multiple-input
Network Elasticity, Flexibility, and Best in Class Automation,” Mavenir, multiple-output systems, advanced waveforms design, multidimensional
2021, https://www.mavenir.com/portfolio/mavair/radio-access/vran/. modulation techniques, and orthogonal/non-orthogonal multiple access
[20] “Converged multi-access and core COMAC,” Open Networking Founda- schemes for future wireless systems. He is a serial referee for various scien-
tion, 2021, https://opennetworking.org/comac/. tific journals as well as a TPC member for several international conferences.
[21] M. Core, “An open-source platform for building carrier-grade networks,” He is an Editor at Researcherstore, RS-OJICT journal, and Frontiers in
Magma Core, 2021, https://www.magmacore.org/. Communications and Networks. Email: [email protected] OR
[22] free5GC, “What is free5GC?” Communication Service/Software Labora- [email protected].
tory (CS Lab), 2019, https://www.free5gc.org/.
[23] C. Cascone, “SD-Core,” Open Networking Foundation, 2021, https://
opennetworking.org/sd-core/.
[24] L. Peterson, “Central office re-architected as a datacenter (CORD),” Open
Networking Foundation, 2021, https://opennetworking.org/cord/.
[25] “LL-MEC,” mosaic5g, https://mosaic5g.io/ll-mec/.
[26] “LIGHTeDGe,” https://lightedge.io/.
[27] O. Sunay, “Aether Architecture,” ONF, https://opennetworking.org/
aether/.
[28] bwojtowi, “openLTE,” Slashdot Media, 2021, https://sourceforge.net/
projects/openlte/.
[29] “Akraino,” lfedge, 2020, https://www.lfedge.org/projects/akraino/.
[30] srsRAN, “Your own mobile network,” srsRAN, 2019, https://www.srslte.
com/.
[31] “srsRAN Features,” Software Radio Systems, 2019, https://docs.srsran.
com/en/latest/feature_list.html.
[32] “Hardware Options,” srsRAN, 2021, https://docs.srsran.com/en/latest/
app_notes/source/hw_packs/source/index.html.
[33] “SRS,” Software Radio Systems, 2012, https://www.srs.io/.
[34] “srsRAN Application Notes,” Software Radio Systems, 2019, https://docs.
srsran.com/en/latest/app_notes/source/index.html.

28 VOLUME 2, 2021

View publication stats