The Service-Based Architecture (SBA) of the fifth generation (5G) of cellular networks introduced great advancements in flexibility, efficiency, and performance of modern networks, thanks to the distribution and softwarization of core network entities called Network Functions (NFs). Due to the distributed nature of 5G systems, these NFs are usually located in different sites to provide better Quality of Service (QoS) or specific services, which poses a great challenge regarding security. However, even though the 3GPP standard identifies security requirements by leveraging Transport Layer Security (TLS) authentication and OAuth2.0 authorization, current experimental and commercial deployments often disregard these aspects for the sake of simplicity and performance. In fact, even though data and communication protection is crucial, the implementation of security protocols and mechanisms complicates the deployments and may reduce the efficiency of 5G systems. This paper presents a novel solution that implements TLS for authentication and encryption leveraging entanglement-based Quantum Key Distribution (QKD), ensuring that all the communications between NFs in the 5G core network are secured by QKD keys, and are therefore quantum-safe. Additionally, this paper presents a QKD key repository using the Network Repository Function (NRF), which stores and relays TLS session keys to authenticated consumer NFs to access producer NFs in a fast but quantum-safe process. The solution was validated in a real hardware environment, and obtained results demonstrate that the proposed solution enhances the security of the SBA communications in an efficient way, reducing an 85% the service request time compared to the traditional TLS-based procedure, as well as 29.96% fewer bytes transmitted throughout the process.
The Service-Based Architecture (SBA) of the fifth generation (5G) of cellular networks introduced great advancements in flexibility, efficiency, and performance of modern networks, thanks to the distribution and softwarization of core network entities called Network Functions (NFs). Due to the distributed nature of 5G systems, these NFs are usually located in different sites to provide better Quality of Service (QoS) or specific services, which poses a great challenge regarding security. However, even though the 3GPP standard identifies security requirements by leveraging Transport Layer Security (TLS) authentication and OAuth2.0 authorization, current experimental and commercial deployments often disregard these aspects for the sake of simplicity and performance. In fact, even though data and communication protection is crucial, the implementation of security protocols and mechanisms complicates the deployments and may reduce the efficiency of 5G systems. This paper presents a novel solution that implements TLS for authentication and encryption leveraging entanglement-based Quantum Key Distribution (QKD), ensuring that all the communications between NFs in the 5G core network are secured by QKD keys, and are therefore quantum-safe. Additionally, this paper presents a QKD key repository using the Network Repository Function (NRF), which stores and relays TLS session keys to authenticated consumer NFs to access producer NFs in a fast but quantum-safe process. The solution was validated in a real hardware environment, and obtained results demonstrate that the proposed solution enhances the security of the SBA communications in an efficient way, reducing an 85% the service request time compared to the traditional TLS-based procedure, as well as 29.96% fewer bytes transmitted throughout the process.
The advent of quantum computing will pose great challenges to the current communication systems, requiring essential changes in the establishment of security associations in traditional architectures. In this context, the multi-technological and heterogeneous nature of 5G networks makes it a challenging scenario for the introduction of quantum communications. Specifically, 5G networks support the unification of non-3GPP access technologies (i.e. Wi-Fi), which are secured through the IPsec protocol suite and the Non-3GPP Interworking Function (N3IWF) entity. These mechanisms leverage traditional public key cryptography and Diffie-Hellman key exchange mechanisms, which should be updated to quantum-safe standards. Therefore, in this paper we present the design and development of a Quantum Key Distribution (QKD) based non-3GPP access mechanism for 5G networks, integrating QKD keys with IPsec tunnel establishment. Besides, we also demonstrate the feasibility of the system by experimental validation in a testbed with commercial QKD equipment and an open-source 5G core implementation. Results show that the time required to complete the authentication and IPsec security association establishment is 4.62% faster than traditional cryptography PSK-based systems and 5.17% faster than the certificate-based system, while ensuring Information-Theoretic Security (ITS) of the QKD systems.
With the advent of quantum computing, the traditional security mechanisms employed in 5G communications might become vulnerable. Quantum Key Distribution (QKD) stands as a promising approach to secure communications and build 5G networks for ensuring long-term security and safeguarding against emerging quantum threats. In our previous work, a system to integrate QKD in multi-site 5G core networks to secure inter-Network Function (NF) communications was proposed and validated. This paper extends that approach by exploring additional segments of 5G networks prone to quantum vulnerabilities, particularly in the segment between the Radio Access Network (RAN) and the 5G core for both 3GPP and Non-3GPP access. This paper describes the proposed quantum-safe 5G network architecture and discusses the benefits and challenges of deploying QKD-enabled security in these segments.
The fifth generation of mobile networks (5G) is among the critical infrastructures whose security and privacy requirements are paramount. Compared to previous generations, 5G leverages a service-based architecture where many Network Functions (NF), i.e., the set of microservices on which is based the architecture, need secure communication means. NFs can communicate using HTTP2, and despite not being required by the standard, they can use Transport Layer Protocol (TLS) to ensure data integrity and authentication across the network. However, with the expected arrival of quantum computers in the near future, traditional cryptographic algorithms are under significant threat. With the recent run for post-quantum standardization, the NIST selected possible candidate algorithms. However, no study evaluates whether such algorithms would be applicable in the 5G core without significant performance degradation. In this paper, we perform the first assessment of the feasibility of using post-quantum secure Key Encapsulation Mechanism (KEM) for the 5G core network. To this aim, we implemented and compared the performances of five algorithms among those selected during the NIST standardization process. We adapted those algorithms to implement them in a standalone 5G core implemented via Open5GS, and tested their performance when performing user registration. Our results show that the KY-BER768 achieves comparable performance to TLS in terms of UE registration time and CPU utilization, thus being a candidate solution to improve the security posture of the 5G core.
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.
Breakthroughs in the field of quantum computing are forcing society to adapt the systems it employs to future threats. Telecommunications networks are no exception, and technologies such as Quantum Key Distribution (QKD) have been developed to establish secure and confidential mechanisms for quantum-safe key distribution. However, the lack of flexibility and scalability of this technology hinders its implementation in 5G/6G networks. In this context, this paper presents the design and development of a QKD classical channel authentication system based on Post-Quantum Cryptography (PQC) algorithms for securing multi-site 5G/6G networks. It also presents the deployment in an experimental infrastructure with a 5G core securization use case, and a comprehensive validation and performance evaluation, measuring key parameters such as protocol timing, error rate, and keyrate. Results show that the PQC authentication offers a similar performance compared to the inflexible, vendor-specific authentication mechanism, obtaining Quantum Bit Error Rate (QBER) measurements ranging from 2.5% to 3.5% in both cases, while only reducing the keyrate 4.53% (from 525.27 bps to 501.44 bps).
Abstract Fifth-generation (5G) network technology is not just an improved extension of the fourth generation; it possesses several key properties, including high capacity, network slicing, low latency, high throughput, and network virtualisation.5G aims to provide a better-quality network. Users can access a variety of web services from any location at any time, thanks to the rapid advancements in wireless communication technologies and the increasing popularity of mobile devices. To provide secure communication, numerous schemes have been developed using the elliptic curve and problems based on the hardness of integer factorisation. However, these problems can be solved by quantum computers in polynomial time. Hence, these protocols are no longer safe on quantum computers. This article proposes a quantum-safe and efficient 5G cross-network slice authentication scheme to counter quantum adversaries. We have utilised the CSIDH-based key exchange protocol to enhance its security against quantum attacks. This scheme is based on the mathematical hard problem of computing the action of an ideal over an elliptic curve that is a commutative isogeny Diffie-Hellman problem (CSIDH). The security of the protocol is proved on the BPR model. Additionally, a comparison of all possible post-quantum 5G solutions using key exchange protocols such as Kyber, Classic McEliece, and SPHINCS+5G has been made.