Free and Open Source Software

Description

Free and Open Source Software (FOSS) within the 3GPP context is not a specific protocol or network element, but a category of software whose licensing and distribution model is addressed from a security and management perspective. The 3GPP specifications, particularly in the 33-series (Security), provide guidelines and requirements for the use of FOSS in network functions and products. This involves establishing security assurance processes to manage the risks associated with incorporating externally developed, openly available code into critical telecommunications systems.

The architectural consideration for FOSS is integrated into the broader Security Assurance Specification (SCAS) framework. When a network function vendor incorporates FOSS components, they must subject the entire product, including those components, to security evaluation. The open nature of the source code means potential vulnerabilities are publicly discoverable, which necessitates robust vulnerability management and patch processes. The network operator or vendor is responsible for maintaining a Software Bill of Materials (SBOM) to track all FOSS dependencies.

Its role in the network is foundational yet indirect, as FOSS components can be part of virtually any network software, from core network functions like the AMF or SMF to management and orchestration (MANO) platforms and even radio access network software. The 3GPP security specifications mandate that the use of FOSS does not compromise the overall security objectives of confidentiality, integrity, and availability. This requires careful integration, continuous monitoring of security advisories for the used FOSS libraries, and the ability to deploy updates or mitigations promptly to address newly discovered flaws.

Purpose & Motivation

The formal treatment of FOSS in 3GPP specifications was motivated by its widespread and increasing adoption in the telecommunications industry. Using FOSS can accelerate development, reduce costs, and foster innovation by leveraging community-driven projects. However, this introduced new security challenges for network operators and regulators accustomed to proprietary, vendor-controlled software stacks where the entire codebase was subject to confidential security evaluations.

Previous approaches often lacked formal policies for open-source software, potentially leading to unmanaged security risks, license compliance issues, and unpredictable support lifecycles. The purpose of defining FOSS guidelines in 3GPP was to create a standardized security framework that allows the industry to benefit from open-source innovation while ensuring it meets the high assurance and reliability requirements of carrier-grade networks. It addresses the problem of how to maintain security accountability in a supply chain that incorporates software components with diverse authorship and transparency.