C-RAN

All-in-one macro base station

In the 1G and 2G cellular networks, base stations had an all-in-one architecture. Analog, digital, and power functions were housed in a single cabinet as large as a refrigerator. Usually the base station cabinet was placed in a dedicated room along with all necessary supporting facilitates such as power, backup battery, air conditioning, environment surveillance, and backhaul transmission equipment. The RF signal is generated by the base station RF unit and propagates through pairs of RF cables up to the antennas on the top of a base station tower or other mounting points. This all-in-one architecture was mostly found in macro cell deployments.

Distributed base station

For 3G, a distributed base station architecture was introduced by Ericsson, Nokia, Huawei, and other leading telecom equipment vendors. In this architecture the radio function unit, also known as the remote radio head (RRH), is separated from the digital function unit, or baseband unit (BBU) by fiber. Digital baseband signals are carried over fiber, using the Open Base Station Architecture Initiative (OBSAI) or Common Public Radio Interface (CPRI) standard. The RRH can be installed on the top of tower close to the antenna, reducing the loss compared to the traditional base station where the RF signal has to travel through a long cable from the base station cabinet to the antenna at the top of the tower. The fiber link between RRH and BBU also allows more flexibility in network planning and deployment as they can be placed a few hundred meters or a few kilometers away. Most modern base stations now use this decoupled architecture.

C-RAN/Cloud-RAN

C-RAN may be viewed as an architectural evolution of the above distributed base station system. It takes advantage of many technological advances in wireless, optical and IT communications systems. For example, it uses the latest CPRI standard, low cost Coarse or Dense Wavelength Division Multiplexing (CWDM/ DWDM) technology, and mmWave to allow transmission of baseband signal over long distance thus achieving large scale centralised base station deployment. It applies recent Data Centre Network technology to allow a low cost, high reliability, low latency and high bandwidth interconnect network in the BBU pool. It utilizes open platforms and real-time virtualization technology rooted in cloud computing to achieve dynamic shared resource allocation and support multi-vendor, multi-technology environments.^[5]

All-in-one BTS

One major alternative solution that is addressing similar challenges of RAN, is the small size, all-in-one outdoor BTS. As a result of the achievements in the semiconductor industry, all the functionality of a BTS, including RF, baseband processing, MAC processing and package level processing, can now be implemented in a volume of <50 liters. This makes the system small and weatherproof, reduces the difficulty of BTS site choice and construction, eliminates the air conditioning requirement, and thus reduces operational costs.

However, because each BTS is still working on its own, it cannot readily make use of the collaboration algorithms to reduce the interference between neighboring BTSs. It is also relatively hard to upgrade or repair because the all-in-one BTS units are usually mounted near the antenna. More processing units in less-protected environments also implies a higher failure rate compared to C-RAN, which only has the RRU deployed outdoors.

The advantage of Cloud RAN lies in its ability to implement LTE-Advanced features such as Coordinated MultiPoint (CoMP) with very low latency between multiple radio heads. However, the economic benefit of improvements such as CoMP can be negated by the higher backhaul costs for some operators.

Small cell

The main competition between small cell and C-RAN occurs in two deployment scenarios: outdoor hotspot coverage and indoor coverage.

Global deployments

Several major operators have deployed or piloted C-RAN and O-RAN infrastructure:

• Rakuten Mobile (Japan) launched commercial 4G and 5G services based entirely on open RAN architecture using multiple radio vendors, becoming one of the first operators to do so at scale.^[14]
• Vodafone (UK) began deploying Open RAN technology across 2,500 sites in Southwest England and Wales, marking the first scaled O-RAN deployment in Europe.^[15]
• Reliance Jio (India) built its 5G network based on open RAN technology, while Airtel partnered with Mavenir for 5G Open RAN deployments initially across 2,300 sites, to be scaled to 10,000 sites.^[16]
• AT&T (United States) announced a large-scale Open RAN deal with Ericsson, Dell, Fujitsu, and Intel in late 2023 to modernise its network.^[17]
• China Mobile conducted pre-commercial O-RAN demonstrations in 2023, including mixed-vendor O-RAN integration with Lenovo and other partners.^[18]

Increased attack surface

By disaggregating the RAN into software-based components running on general-purpose servers, C-RAN and O-RAN inherit vulnerabilities common to cloud computing environments. The use of standard web protocols, APIs, and containerised network functions expands the potential attack surface. Containers used in the RAN shift security responsibilities toward virtual machines and cloud-native security mechanisms.^[19]

Multi-vendor risks

Multi-vendor interoperability, while a key goal of O-RAN, introduces risks from supply chain attacks and software vulnerabilities in third-party components. Each additional interface between vendors (such as the O1, E2, and A1 interfaces defined by the O-RAN Alliance) represents a potential point of exploitation if not properly secured.^[20]

Fronthaul security

The fronthaul link — the connection between the BBU pool (or DU) and Remote Radio Heads (RRHs/RUs) — relies heavily on fibre optic transport, typically using the CPRI or eCPRI standard. If this fronthaul link is physically or logically compromised, it can affect the integrity and confidentiality of radio signals. Regulatory bodies such as GSMA and 3GPP provide guidelines for securing 5G RAN deployments, including the fronthaul segment.^[21]

US Government assessment

The US National Telecommunications and Information Administration (NTIA) published a comprehensive Open RAN Security Report assessing threats in the O-RAN cloud (O-Cloud) layer, rating a significant portion of identified security threats as "High" severity. The report noted that while cloud computing risks are not entirely new to mobile network operators, moving essential RAN resources to cloud environments creates new management challenges.^[22]

Quad-backed Pacific deployment

In 2026, the Quad grouping (the United States, Australia, India, and Japan) announced support for the first commercial Open RAN deployment in the Pacific Islands region, building on an earlier US$20 million pilot project launched in 2023. The network was expected to become operational in early 2027.^[23]