The advent of quantum computing will pose great challenges to the current communication systems, requiring essential changes in the establishment of security associations in traditional architectures. In this context, the multi-technological and heterogeneous nature of 5G networks makes it a challenging scenario for the introduction of quantum communications. Specifically, 5G networks support the unification of non-3GPP access technologies (i.e. Wi-Fi), which are secured through the IPsec protocol suite and the Non-3GPP Interworking Function (N3IWF) entity. These mechanisms leverage traditional public key cryptography and Diffie-Hellman key exchange mechanisms, which should be updated to quantum-safe standards. Therefore, in this paper we present the design and development of a Quantum Key Distribution (QKD) based non-3GPP access mechanism for 5G networks, integrating QKD keys with IPsec tunnel establishment. Besides, we also demonstrate the feasibility of the system by experimental validation in a testbed with commercial QKD equipment and an open-source 5G core implementation. Results show that the time required to complete the authentication and IPsec security association establishment is 4.62% faster than traditional cryptography PSK-based systems and 5.17% faster than the certificate-based system, while ensuring Information-Theoretic Security (ITS) of the QKD systems.
The advent of quantum computing will pose great challenges to the current communication systems, requiring essential changes in the establishment of security associations in traditional architectures. In this context, the multi-technological and heterogeneous nature of 5G networks makes it a challenging scenario for the introduction of quantum communications. Specifically, 5G networks support the unification of non-3GPP access technologies (i.e. Wi-Fi), which are secured through the IPsec protocol suite and the Non-3GPP Interworking Function (N3IWF) entity. These mechanisms leverage traditional public key cryptography and Diffie-Hellman key exchange mechanisms, which should be updated to quantum-safe standards. Therefore, in this paper we present the design and development of a Quantum Key Distribution (QKD) based non-3GPP access mechanism for 5G networks, integrating QKD keys with IPsec tunnel establishment. Besides, we also demonstrate the feasibility of the system by experimental validation in a testbed with commercial QKD equipment and an open-source 5G core implementation. Results show that the time required to complete the authentication and IPsec security association establishment is 4.62% faster than traditional cryptography PSK-based systems and 5.17% faster than the certificate-based system, while ensuring Information-Theoretic Security (ITS) of the QKD systems.
With the advent of quantum computing, the traditional security mechanisms employed in 5G communications might become vulnerable. Quantum Key Distribution (QKD) stands as a promising approach to secure communications and build 5G networks for ensuring long-term security and safeguarding against emerging quantum threats. In our previous work, a system to integrate QKD in multi-site 5G core networks to secure inter-Network Function (NF) communications was proposed and validated. This paper extends that approach by exploring additional segments of 5G networks prone to quantum vulnerabilities, particularly in the segment between the Radio Access Network (RAN) and the 5G core for both 3GPP and Non-3GPP access. This paper describes the proposed quantum-safe 5G network architecture and discusses the benefits and challenges of deploying QKD-enabled security in these segments.
The Service-Based Architecture (SBA) of the fifth generation (5G) of cellular networks introduced great advancements in flexibility, efficiency, and performance of modern networks, thanks to the distribution and softwarization of core network entities called Network Functions (NFs). Due to the distributed nature of 5G systems, these NFs are usually located in different sites to provide better Quality of Service (QoS) or specific services, which poses a great challenge regarding security. However, even though the 3GPP standard identifies security requirements by leveraging Transport Layer Security (TLS) authentication and OAuth2.0 authorization, current experimental and commercial deployments often disregard these aspects for the sake of simplicity and performance. In fact, even though data and communication protection is crucial, the implementation of security protocols and mechanisms complicates the deployments and may reduce the efficiency of 5G systems. This paper presents a novel solution that implements TLS for authentication and encryption leveraging entanglement-based Quantum Key Distribution (QKD), ensuring that all the communications between NFs in the 5G core network are secured by QKD keys, and are therefore quantum-safe. Additionally, this paper presents a QKD key repository using the Network Repository Function (NRF), which stores and relays TLS session keys to authenticated consumer NFs to access producer NFs in a fast but quantum-safe process. The solution was validated in a real hardware environment, and obtained results demonstrate that the proposed solution enhances the security of the SBA communications in an efficient way, reducing an 85% the service request time compared to the traditional TLS-based procedure, as well as 29.96% fewer bytes transmitted throughout the process.
Every attempt to access to the Internet through a Web browser, email sent, VPN connection, VoIP call, instant message or other use of telecommunications systems involves cryptographic techniques. The most commonly applied technique is asymmetric cryptography, which is generally executed in the background without the user even being aware. It establishes a cryptographic code based on the computational complexity of mathematical problems. However, this type of cryptography, which is widely used in today’s telecommunications systems, is under threat as electronics and computing rapidly develop. The development of fifth-generation cellular networks (5G) is gaining momentum, and given its wide field of application, security requires special attention. This is especially true faced with the development of quantum computers. One solution to this security challenge is to use more advanced techniques to establish cryptographic keys that are not susceptible to attack. An essential part of quantum cryptography, Quantum Key Distribution (QKD) uses the principles of quantum physics to establish and distribute symmetric cryptographic keys between two geographically distant users. QKD establishes information-theoretically secure cryptographic keys that are resistant to eavesdropping when they are created. In this paper, we survey the security challenges and approaches in 5G networks concerning network protocols, interfaces and management organizations. We begin by examining the fundamentals of QKD and discuss the creation of QKD networks and their applications. We then outline QKD network architecture and its components and standards, following with a summary of QKD and post-quantum key distribution techniques and approaches for its integration into existing security frameworks such as VPNs (IPsec and MACsec). We also discuss the requirements, architecture and methods for implementing the FPGA-based encryptors needed to execute cryptographic algorithms with security keys. We discuss the performance and technologies of post-quantum cryptography, and finally, examine reported 5G demonstrations which have used quantum technologies, highlighting future research directions.
IPSec is a widely used network security protocol that plays a crucial role in providing secure transmission channels in the current Internet. However, the advent of quantum computing poses unprecedented challenges to the security of traditional cryptographic methods, including those used in IPSec. Fortunately, quantum key distribution (QKD) offers a theoretically unbreakable method for exchanging keys between two communicating parties. To address the security threats posed by quantum computing, we propose IPSeQ, a security-enhanced IPSec protocol that integrates QKD into its design. Specifically, IPSeQ leverages quantum keys to strengthen key negotiation, authentication, and data encryption processes. To achieve rapid key updates while ensuring transmission efficiency and key synchronization, IPSeQ introduces a sliding window-based dynamic key updating mechanism. Experiments conducted with real QKD devices demonstrate that our proposed mechanism can improve throughput by more than 50 percent compared to traditional schemes, particularly at higher quantum key generation rates. Additionally, IPSeQ effectively maintains robust data transmission in scenarios where quantum keys are scarce (e.g., when the key generation rate is less than 10 kb/s).
With the rapid advancement of quantum computing, existing cryptographic schemes in 4G LTE and 5G networks confront serious security threats. Traditional reliance on protocols like IPsec and Transport Layer Security leaves infrastructure vulnerable to future quantum attacks, particularly “Harvest Now, Decrypt Later” attacks, where adversaries store current encrypted traffic for future decryption. To counter these threats, Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD) have become potential solutions. As future 6G networks aim to realize ultra-reliable and ubiquitous secure connectivity, it is essential to incorporate both PQC and QKD solutions to ensure long-term robustness. Therefore, the synergy of these security solutions and 5G draws the attention of researchers and practitioners worldwide. This study systematically reviews the literature in this specific field. We analyzed evidence from reviewed literature to address three research questions, resulting in a novel taxonomy to categorize publications in this area and a vision for a quantum-safe 6G network. Moreover, we discussed several open challenges in 5G, PQC, and QKD, along with future work.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.