The open fronthaul interface is a standard protocol for a link between the radio units and the distributed unit in RAN, enabling different vendors interoperable. We study the security requirements of the open fronthaul interface for 5G networks. The O-RAN management plane (M-plane) mandates an end-to-end security using SSHv2, whereas the O-RAN control and user plane (CU-plane) do not support any security measure yet. We investigate MACsec for the CU-plane security, which is recommended as one of security options in the eCPRI specification. Furthermore, we implemented quantum-safe crypto solutions using a hybrid mode key exchange and signature schemes, which can be applied for the post-quantum SSH and MACsec protocols.
The open fronthaul interface is a standard protocol for a link between the radio units and the distributed unit in RAN, enabling different vendors interoperable. We study the security requirements of the open fronthaul interface for 5G networks. The O-RAN management plane (M-plane) mandates an end-to-end security using SSHv2, whereas the O-RAN control and user plane (CU-plane) do not support any security measure yet. We investigate MACsec for the CU-plane security, which is recommended as one of security options in the eCPRI specification. Furthermore, we implemented quantum-safe crypto solutions using a hybrid mode key exchange and signature schemes, which can be applied for the post-quantum SSH and MACsec protocols.
As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.
We have successfully demonstrated the first 5G open radio access network (O-RAN)-enabled and quantum-secured optical network solution and tested its performance in a 5G fronthaul use case. Our proposed solution is unique in a way that it combines a quantum key distribution (QKD)-compatible on-demand programmable 100 Gbps Ethernet encryptor with multi-tenant network operation while satisfying the stringent timing requirements of the 5G O-RAN with ultra-low pipeline latency. Moreover, our encryption cores provide the fastest reconfiguration speeds with the highest transmission capacity. By using dynamic reconfiguration technology, encryption schemes can be switched between Advanced Encryption Standard (AES) variations AES-256, AES-192, and AES-128 and Camellia-256, XOR, or no-encryption configurations in 16.7 ms for encryption and 24.1 ms for decryption. Furthermore, the key slicing functionality was introduced to our system, allowing users to have their separate key storages within the field programmable gate array and different key exchange schemes or refresh rates per client, where a secret key rate of 1.6 keys/s per client for less than 10 Gb of encrypted data could be provided. With encryption, the lowest system latency of 817.6 ns was achieved. Without encryption, the system latency could be as low as 667.2 ns. When our proposed system was tested in 5G fronthaul where our design was placed between a 5G radio unit and a 5G distributed unit/central unit, and the traffic between the 5G customer premises equipment and 5G core user plane function was transported and encrypted by our system over 100 Gbps, no significant impact on network latency on the millisecond scale was observed. Our system’s 10 Gbps fronthaul interface was stressed with a large Ethernet frame (1500B) at a rate of ≈9.8Gbps with 300,000 Internet Control Message Protocol pings, and less than 1% data loss was observed.
Nowadays, 5G architecture is characterized by the use of monolithic hardware, where the configuration of its elements is completely proprietary for each manufacturer. In recent years, as an alternative to this centralized architecture, a new model has emerged: the Open Radio Access Network (Open RAN). One of its main features has been the split of the Base Band Unit (BBU) into new simpler hardware with more specific functions approaching to a more modular model. As a consequence of this split, new interfaces appeared to connect these components that need to be protected. With the developments in the field of quantum computing, traditional protection mechanisms for this kind of interfaces may be deprecated in the near future. This security issue motivates this paper, which aims to study how to integrate post-quantum cryptography (PQC) mechanisms to current security standards, such as IPsec and MACsec. In addition, the proposal is also put into practice to compare the performance of traditional mechanisms with PQC implementations. This research shows that the new implementation does not reduce the performance of the aforementioned standards, while the security is reinforced against quantum attacks.
The rise of quantum computing poses a major threat to traditional ciphers, specifically making the Radio Access Network (RAN) vulnerable to future quantum-based attacks. To address this challenge, this paper proposes quantum-inspired RAN (Q-RAN), a next-generation framework designed to future-proof telecom networks against quantum threats. As a foundation, to evaluate, we integrate quantum network simulators with the Open-Source OpenAirInterface (OAI) stack to deploy a 5G standalone network capable of supporting quantum operations. We analyzed these, and the best fit is taken for quantum proofing. This paper considered four different quantum simulators — QuNetSim, SimQN, SeQuence, and NetSquid — for integrating with the 5G Open source stack. The framework generated by these simulators is called Quantum Gateways (namely Qtunnels) enables seamless message exchange between quantum and classical RAN components. This integrated architecture showcases how quantum simulators can be harmonized on existing 5G infrastructure, establishing a resilient and adaptable telco ecosystem catered to the quantum era or post-quantum era. In addition, this paper quantifies the Qtunnel impact — F1 Interface — between the Central Unit (CU) and Distribution Unit (DU) of RAN. The results show that the Post Quantum Cryptography (PQC)-enabled F1 interfaces provide a two-fold overhead delay when compared to the benchmark delay, however, the PQC-enabled RAN interfaces are resistant to quantum threats.