The Open Radio Access Network (O-RAN) offers flexibility and innovation but introduces unique security vulnerabilities, particularly from cryptographically relevant quantum computers. While Post-Quantum Cryptography (PQC) is the primary scalable defence, its computationally intensive handshakes create a significant bottleneck for the RAN control plane, posing sustainability challenges. This article proposes an energy-aware framework to solve this PQC bottleneck, ensuring quantum resilience without sacrificing operational energy efficiency. The system employs an O-RAN aligned split: a Crypto Policy rApp residing in the Non-Real- Time (Non-RT) RIC defines the strategic security envelope (including PQC suites), while a Security Operations Scheduling (SOS) xApp in the Near-RT RIC converts these into tactical timing and placement intents. Cryptographic enforcement remains at standards-compliant endpoints: the Open Fronthaul utilizes Media Access Control Security (MACsec) at the O-DU/O-RU, while the xhaul (midhaul and backhaul) utilizes IP Security (IPsec) at tunnel terminators. The SOS xApp reduces PQC overhead by batching non-urgent handshakes, prioritizing session resumption, and selecting parameters that meet slice SLAs while minimizing joules per secure connection. We evaluate the architecture via a Discrete-Event Simulation (DES) using 3GPP-aligned traffic profiles and verified hardware benchmarks from literature. Results show that intelligent scheduling can reduce per-handshake energy by approximately 60% without violating slice latency targets.
The Open Radio Access Network (O-RAN) offers flexibility and innovation but introduces unique security vulnerabilities, particularly from cryptographically relevant quantum computers. While Post-Quantum Cryptography (PQC) is the primary scalable defence, its computationally intensive handshakes create a significant bottleneck for the RAN control plane, posing sustainability challenges. This article proposes an energy-aware framework to solve this PQC bottleneck, ensuring quantum resilience without sacrificing operational energy efficiency. The system employs an O-RAN aligned split: a Crypto Policy rApp residing in the Non-Real- Time (Non-RT) RIC defines the strategic security envelope (including PQC suites), while a Security Operations Scheduling (SOS) xApp in the Near-RT RIC converts these into tactical timing and placement intents. Cryptographic enforcement remains at standards-compliant endpoints: the Open Fronthaul utilizes Media Access Control Security (MACsec) at the O-DU/O-RU, while the xhaul (midhaul and backhaul) utilizes IP Security (IPsec) at tunnel terminators. The SOS xApp reduces PQC overhead by batching non-urgent handshakes, prioritizing session resumption, and selecting parameters that meet slice SLAs while minimizing joules per secure connection. We evaluate the architecture via a Discrete-Event Simulation (DES) using 3GPP-aligned traffic profiles and verified hardware benchmarks from literature. Results show that intelligent scheduling can reduce per-handshake energy by approximately 60% without violating slice latency targets.
Open Radio Access Networks (O-RAN) introduce flexibility and multi-vendor interoperability through open and standardized interfaces. The emergence of programmable RAN Intelligent Controllers (RICs), along with the ability to deploy third-party applications as xApps and rApps, further accelerates innovation. However, these advancements also expand the attack surface of 6G infrastructures and introduce significant new security challenges. As quantum computing threatens classical cryptography, O-RAN security must evolve toward quantum-resilient mechanisms. This article outlines a layered migration roadmap for integrating Post-Quantum Cryptography (PQC) and hybrid schemes into O-RAN’s identity, control, and runtime layers. Building on O-RAN Alliance Work Group 11 and GSMA post-quantum telco network task force guidelines, we estimate the relative cost and performance trade-offs of classical, hybrid, and PQC-only protections across key interfaces. The results show that hybrid integration provides near-term quantum resistance with moderate overhead, while full PQC deployment requires architectural adaptations. The proposed approach offers a standards-aligned path toward secure, interoperable, and energy-aware O-RAN evolution for 6G.
With its disaggregated and open interfaces, the Open Radio Access Network (O-RAN) architecture promises flexibility, innovation, and cost-effectiveness for future wireless networks. However, the increased reliance on software and open interfaces also introduces new security challenges. As the threat of quantum computing looms, the traditional cryptographic algorithms used in O-RAN will become vulnerable to potential attacks. This paper proposes the integration of Post-Quantum Cryptography (PQC) into O-RAN to enhance its security against post-quantum adversaries. We discuss the specific vulnerabilities of current O-RAN security mechanisms to quantum attacks and identify key areas where PQC can be applied, such as key exchange, authentication, and data protection. We present a framework for evaluating the suitability of different PQC algorithms for O-RAN and outline potential challenges and implementation considerations. By proactively integrating PQC into O-RAN, we aim to ensure the long-term security and resilience of this emerging network architecture in the era of quantum computing.
Open Radio Access Networks (O-RAN) introduce unprecedented flexibility, interoperability, and intelligence into next-generation wireless systems, but their disaggregated and software-defined architecture also expands the attack surface and creates new security vulnerabilities. Conventional cryptographic mechanisms, while effective against classical threats, may become insufficient in the presence of quantum-enabled adversaries. This article presents a comprehensive perspective on quantum security for O-RAN, examining how quantum-resilient mechanisms can enhance confidentiality, authentication, and trust across the RAN ecosystem. It discusses post-quantum cryptography (PQC), quantum cryptography, quantum authentication, and quantum-enhanced threat detection within a zero-trust architecture based on continuous verification, least privilege, and micro-segmentation. Their integration with the Near-Real-Time (Near-RT) RAN Intelligent Controller, O-Cloud, and open interfaces is analyzed, together with practical deployment considerations, technology maturity, and adoption timelines. Finally, open research directions are outlined toward secure, resilient, and future-proof O-RAN architectures for 6G networks.
As Open Radio Access Network (O-RAN) deployments expand and adversaries adopt “store-now, decrypt-later” strategies, operators need empirical data on the cost of migrating critical control interfaces to post-quantum cryptography (PQC). This paper experimentally evaluates the impact of integrating a NIST-aligned Module-Lattice Key-Encapsulation Mechanism (ML-KEM) into IKEv2/IPsec, protecting the E2 interface between the 5G Node B (gNB) and the Near-Real-Time RAN Intelligent Controller (Near-RT RIC). Using an open-source testbed built from srsRAN, Open5GS, FlexRIC and strongSwan (with liboqs), we compare three configurations: no IPsec, classical Elliptic Curve Diffie–Hellman (ECDH)-based IPsec, and ML-KEM-based IPsec. This study focuses on IPsec tunnel-setup latency and the runtime behaviour of Near-RT RIC xApps under realistic signalling workloads. Results from repeated, automated runs show that ML-KEM integration adds a small overhead to tunnel establishment, which is approximately 2.7~4.7 ms in comparison to classical IPsec, while xApp operation and RIC control loops remain stable in our experiments. These findings, produced from an open, reproducible testbed, indicate that ML-KEM-based IPsec on the E2 interface is practically feasible and inform quantum-safe migration strategies for O-RAN deployments.
As Open Radio Access Network (O-RAN) deployments expand and adversaries adopt 'store-now, decrypt-later' strategies, operators need empirical data on the cost of migrating critical control interfaces to post-quantum cryptography (PQC). This paper experimentally evaluates the impact of integrating a NIST-aligned module-lattice KEM (ML-KEM, CRYSTALS-Kyber) into IKEv2/IPsec protecting the E2 interface between the 5G Node B (gNB) and the Near-Real-Time RAN Intelligent Controller (Near-RT RIC). Using an open-source testbed built from srsRAN, Open5GS, FlexRIC and strongSwan (with liboqs), we compare three configurations: no IPsec, classical ECDH-based IPsec, and ML-KEM-based IPsec. The study focuses on IPsec tunnel-setup latency and the runtime behaviour of Near-RT RIC xApps under realistic signalling workloads. Results from repeated, automated runs show that ML-KEM integration adds a small overhead to tunnel establishment, which is approximately 3~5 ms in comparison to classical IPsec, while xApp operation and RIC control loops remain stable in our experiments. These findings indicate that ML-KEM based IPsec on the E2 interface is practically feasible and inform quantum-safe migration strategies for O-RAN deployments.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.