As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.
As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.
Significant performance improvements in bandwidth and latency make 5G a suitable candidate for a wide range of applications, particularly those requiring real-time communication, such as Industrial Control Systems (ICS) and autonomous vehicles. However, today’s security, including modern cryptographic systems, is prone to different attacks caused by the high computational power of quantum computing, highlighting the need for integrating quantum-resistant security measures. To accommodate attacks targeted at 5G networks, there are efforts to move towards TLS-based security, which is the widely accepted standard across networks. However, integrating post-quantum algorithms must also be considered in such a transition. Thus, this paper is the first to perform the integration of Post-quantum TLS (PQ-TLS) protocols into 5G networks and offer a realistic performance evaluation. Our approach focuses on integrating PQ-TLS into the 5G control plane (CP) without requiring a major overhaul, thus ensuring communications’ interoperability even with legacy components of 5G, which may not support TLS. Specifically, we have updated the registration and authentication protocols for both core network functions and user equipment (UE) by implementing a TLS tunneling approach through virtualization. We then evaluate the performance and feasibility of PQ-TLS in enhancing the security of 5G communications on an actual testbed. Our results demonstrate that while PQ algorithms introduce some overhead, they remain viable for 5G applications, particularly for protocols that can run on the core network.
The open fronthaul interface is a standard protocol for a link between the radio units and the distributed unit in RAN, enabling different vendors interoperable. We study the security requirements of the open fronthaul interface for 5G networks. The O-RAN management plane (M-plane) mandates an end-to-end security using SSHv2, whereas the O-RAN control and user plane (CU-plane) do not support any security measure yet. We investigate MACsec for the CU-plane security, which is recommended as one of security options in the eCPRI specification. Furthermore, we implemented quantum-safe crypto solutions using a hybrid mode key exchange and signature schemes, which can be applied for the post-quantum SSH and MACsec protocols.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.
The fifth generation of mobile networks (5G) is among the critical infrastructures whose security and privacy requirements are paramount. Compared to previous generations, 5G leverages a service-based architecture where many Network Functions (NF), i.e., the set of microservices on which is based the architecture, need secure communication means. NFs can communicate using HTTP2, and despite not being required by the standard, they can use Transport Layer Protocol (TLS) to ensure data integrity and authentication across the network. However, with the expected arrival of quantum computers in the near future, traditional cryptographic algorithms are under significant threat. With the recent run for post-quantum standardization, the NIST selected possible candidate algorithms. However, no study evaluates whether such algorithms would be applicable in the 5G core without significant performance degradation. In this paper, we perform the first assessment of the feasibility of using post-quantum secure Key Encapsulation Mechanism (KEM) for the 5G core network. To this aim, we implemented and compared the performances of five algorithms among those selected during the NIST standardization process. We adapted those algorithms to implement them in a standalone 5G core implemented via Open5GS, and tested their performance when performing user registration. Our results show that the KY-BER768 achieves comparable performance to TLS in terms of UE registration time and CPU utilization, thus being a candidate solution to improve the security posture of the 5G core.
We have successfully demonstrated the first 5G open radio access network (O-RAN)-enabled and quantum-secured optical network solution and tested its performance in a 5G fronthaul use case. Our proposed solution is unique in a way that it combines a quantum key distribution (QKD)-compatible on-demand programmable 100 Gbps Ethernet encryptor with multi-tenant network operation while satisfying the stringent timing requirements of the 5G O-RAN with ultra-low pipeline latency. Moreover, our encryption cores provide the fastest reconfiguration speeds with the highest transmission capacity. By using dynamic reconfiguration technology, encryption schemes can be switched between Advanced Encryption Standard (AES) variations AES-256, AES-192, and AES-128 and Camellia-256, XOR, or no-encryption configurations in 16.7 ms for encryption and 24.1 ms for decryption. Furthermore, the key slicing functionality was introduced to our system, allowing users to have their separate key storages within the field programmable gate array and different key exchange schemes or refresh rates per client, where a secret key rate of 1.6 keys/s per client for less than 10 Gb of encrypted data could be provided. With encryption, the lowest system latency of 817.6 ns was achieved. Without encryption, the system latency could be as low as 667.2 ns. When our proposed system was tested in 5G fronthaul where our design was placed between a 5G radio unit and a 5G distributed unit/central unit, and the traffic between the 5G customer premises equipment and 5G core user plane function was transported and encrypted by our system over 100 Gbps, no significant impact on network latency on the millisecond scale was observed. Our system’s 10 Gbps fronthaul interface was stressed with a large Ethernet frame (1500B) at a rate of ≈9.8Gbps with 300,000 Internet Control Message Protocol pings, and less than 1% data loss was observed.
With the emergence of smart devices and the Internet of Things (IoT), 5G has been developed to meet the growing demand for transmission speeds and bandwidth. 5G overcomes the limitations of previous generations of technology, offering significant improvements in speed, latency, and stability. However, with the advancement of computational capabilities and the advent of quantum computers, security issues have become a pressing concern. Current technologies in 5G fronthaul rely on intrinsic security technologies, which are difficult to defend against quantum computer-based attacks. Consequently, this paper proposes a future mobile fronthaul architecture, such as 6G, which builds upon the 5G fronthaul network architecture while introducing quantum communication based on the BB84 protocol. This architecture enhances privacy protection and improves resistance to eavesdropping while maintaining the original performance. Additionally, the paper models the architecture to explore its noise resistance, using forward and backward spontaneous Raman scattering power as indicators, and demonstrates the system's feasibility under the influence of high-power 6G signals. The potential applications of this architecture are also examined. The results indicate that the quantum-secure 6G fronthaul network represents a significant breakthrough. It not only meets the stringent security requirements of modern communication but also enables a wide range of applications, paving the way for a safer and more interconnected digital future.