We demonstrate an FPGA-based architecture integrating QKD with MACsec Key Agreement protocol to quantum-secure the Open-RAN Fronthaul. This includes a protocol for key synchronization in the MACsec control plane. A key rate of 1 key/sec was achieved providing high reliability for critical applications.
The open fronthaul interface is a standard protocol for a link between the radio units and the distributed unit in RAN, enabling different vendors interoperable. We study the security requirements of the open fronthaul interface for 5G networks. The O-RAN management plane (M-plane) mandates an end-to-end security using SSHv2, whereas the O-RAN control and user plane (CU-plane) do not support any security measure yet. We investigate MACsec for the CU-plane security, which is recommended as one of security options in the eCPRI specification. Furthermore, we implemented quantum-safe crypto solutions using a hybrid mode key exchange and signature schemes, which can be applied for the post-quantum SSH and MACsec protocols.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.
Abstract Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre‐shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.
As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.
We have successfully demonstrated the first 5G open radio access network (O-RAN)-enabled and quantum-secured optical network solution and tested its performance in a 5G fronthaul use case. Our proposed solution is unique in a way that it combines a quantum key distribution (QKD)-compatible on-demand programmable 100 Gbps Ethernet encryptor with multi-tenant network operation while satisfying the stringent timing requirements of the 5G O-RAN with ultra-low pipeline latency. Moreover, our encryption cores provide the fastest reconfiguration speeds with the highest transmission capacity. By using dynamic reconfiguration technology, encryption schemes can be switched between Advanced Encryption Standard (AES) variations AES-256, AES-192, and AES-128 and Camellia-256, XOR, or no-encryption configurations in 16.7 ms for encryption and 24.1 ms for decryption. Furthermore, the key slicing functionality was introduced to our system, allowing users to have their separate key storages within the field programmable gate array and different key exchange schemes or refresh rates per client, where a secret key rate of 1.6 keys/s per client for less than 10 Gb of encrypted data could be provided. With encryption, the lowest system latency of 817.6 ns was achieved. Without encryption, the system latency could be as low as 667.2 ns. When our proposed system was tested in 5G fronthaul where our design was placed between a 5G radio unit and a 5G distributed unit/central unit, and the traffic between the 5G customer premises equipment and 5G core user plane function was transported and encrypted by our system over 100 Gbps, no significant impact on network latency on the millisecond scale was observed. Our system’s 10 Gbps fronthaul interface was stressed with a large Ethernet frame (1500B) at a rate of ≈9.8Gbps with 300,000 Internet Control Message Protocol pings, and less than 1% data loss was observed.