Significant performance improvements in bandwidth and latency make 5G a suitable candidate for a wide range of applications, particularly those requiring real-time communication, such as Industrial Control Systems (ICS) and autonomous vehicles. However, today’s security, including modern cryptographic systems, is prone to different attacks caused by the high computational power of quantum computing, highlighting the need for integrating quantum-resistant security measures. To accommodate attacks targeted at 5G networks, there are efforts to move towards TLS-based security, which is the widely accepted standard across networks. However, integrating post-quantum algorithms must also be considered in such a transition. Thus, this paper is the first to perform the integration of Post-quantum TLS (PQ-TLS) protocols into 5G networks and offer a realistic performance evaluation. Our approach focuses on integrating PQ-TLS into the 5G control plane (CP) without requiring a major overhaul, thus ensuring communications’ interoperability even with legacy components of 5G, which may not support TLS. Specifically, we have updated the registration and authentication protocols for both core network functions and user equipment (UE) by implementing a TLS tunneling approach through virtualization. We then evaluate the performance and feasibility of PQ-TLS in enhancing the security of 5G communications on an actual testbed. Our results demonstrate that while PQ algorithms introduce some overhead, they remain viable for 5G applications, particularly for protocols that can run on the core network.
Significant performance improvements in bandwidth and latency make 5G a suitable candidate for a wide range of applications, particularly those requiring real-time communication, such as Industrial Control Systems (ICS) and autonomous vehicles. However, today’s security, including modern cryptographic systems, is prone to different attacks caused by the high computational power of quantum computing, highlighting the need for integrating quantum-resistant security measures. To accommodate attacks targeted at 5G networks, there are efforts to move towards TLS-based security, which is the widely accepted standard across networks. However, integrating post-quantum algorithms must also be considered in such a transition. Thus, this paper is the first to perform the integration of Post-quantum TLS (PQ-TLS) protocols into 5G networks and offer a realistic performance evaluation. Our approach focuses on integrating PQ-TLS into the 5G control plane (CP) without requiring a major overhaul, thus ensuring communications’ interoperability even with legacy components of 5G, which may not support TLS. Specifically, we have updated the registration and authentication protocols for both core network functions and user equipment (UE) by implementing a TLS tunneling approach through virtualization. We then evaluate the performance and feasibility of PQ-TLS in enhancing the security of 5G communications on an actual testbed. Our results demonstrate that while PQ algorithms introduce some overhead, they remain viable for 5G applications, particularly for protocols that can run on the core network.
The fifth generation of mobile networks (5G) is among the critical infrastructures whose security and privacy requirements are paramount. Compared to previous generations, 5G leverages a service-based architecture where many Network Functions (NF), i.e., the set of microservices on which is based the architecture, need secure communication means. NFs can communicate using HTTP2, and despite not being required by the standard, they can use Transport Layer Protocol (TLS) to ensure data integrity and authentication across the network. However, with the expected arrival of quantum computers in the near future, traditional cryptographic algorithms are under significant threat. With the recent run for post-quantum standardization, the NIST selected possible candidate algorithms. However, no study evaluates whether such algorithms would be applicable in the 5G core without significant performance degradation. In this paper, we perform the first assessment of the feasibility of using post-quantum secure Key Encapsulation Mechanism (KEM) for the 5G core network. To this aim, we implemented and compared the performances of five algorithms among those selected during the NIST standardization process. We adapted those algorithms to implement them in a standalone 5G core implemented via Open5GS, and tested their performance when performing user registration. Our results show that the KY-BER768 achieves comparable performance to TLS in terms of UE registration time and CPU utilization, thus being a candidate solution to improve the security posture of the 5G core.
The advent of quantum computing threatens the security of classical public-key cryptographic systems, prompting the transition to post-quantum cryptography (PQC). While PQC has been analyzed in theory, its performance in practical wireless communication environments remains underexplored. This paper presents a detailed implementation and performance evaluation of NIST-selected PQC algorithms in user equipment (UE) to UE communications over 5G networks. Using a full 5G emulation stack (Open5GS and UERANSIM) and PQC-enabled TLS 1.3 via BoringSSL and liboqs, we examine key encapsulation mechanisms and digital signature schemes across realistic network conditions. We evaluate performance based on handshake latency, CPU and memory usage, bandwidth, and retransmission rates, under varying cryptographic configurations and client loads. Our findings show that ML-KEM with ML-DSA offers the best efficiency for latency-sensitive applications, while SPHINCS+ and HQC combinations incur higher computational and transmission overheads, making them unsuitable for security-critical but time-sensitive 5G scenarios.
As 5G is offering new services that include improved security for its core functions, there is an effort to secure all domains in 5G, including control, data, and synchronization. This has turned the attention to 5G fronthaul communication security, which has not been considered crucial for past generations of cellular technologies. With overall information security efforts increasing preparation for the deployment of post-quantum cryptographic algorithms, there is also a need to assess the feasibility and overhead when such algorithms are considered for 5G Open Fronthaul communications between the radio heads in base stations and distributed units within the network. This is crucial for protocols such as eCPRI which has certain real-time requirements to meet. To this end, this paper first proposes an integrated security solution that combines IEEE 802.11AE (MACsec) along with a post-quantum-based EAP-TLS authentication within a typical ethernet-based fronthaul topology. We then implement a proof of concept to integrate all these components in a virtualized setting for the first time and evaluate the associated transmission delay with the eCPRI messages under various settings. The results demonstrate that MACsec can be a viable option that can satisfy the real-time requirements when used with post-quantum-based EAP-TLS1.3 that offers perfect forward secrecy.
5th Generation (5G) cellular networks have been adopted around the world since the rollout began around 2019. It brought with it many innovations and new services, such as Enhanced Mobile Broadband (eMBB), Ultra Reliable and Low Latency Communications (URLLC), and Massive Internet of Things (mIoT). 5G also introduced a more scalable approach to network operations using fully software-based Virtualized Network Functions (VNF) in Core Networks (CN) rather than the prior hardware-based approach. However, while this shift towards a fully software-based system design provides numerous significant benefits, such as increased interoperability, scalability, and cost-effectiveness, it also brought with it an increased cybersecurity risk. Security is crucial to maintaining trust between vendors, operators, and consumers. Cyberattacks are rapidly increasing in number and sophistication, and we are seeing a shift towards zero-trust approaches. This means that even communications between VNFs inside a 5G core have to be scrutinized and hardened against attacks, especially with the advent of quantum computers. The National Institute of Standards and Technology (NIST), over the past 10 years, has led efforts to standardize Post Quantum Cryptography (PQC) to protect against quantum attacks. This paper covers a custom implementation of the open-source free5GC CN, to expand its HTTPS capabilities for VNFs by introducing PQC Key Encapsulation Methods (KEM) for TLS v1.3. This paper provides the details of this integration with a focus on the latency of different PQC KEMs in initial handshakes between VNFs, on packet size, and the implications on a 5G environment. This work also conducts a security comparison between the PQC-equipped free5GC and other open-source 5G CNs. The presented results indicate a negligible increase in UE connection setup duration and a small increase in connection setup data requirements, strongly indicating that PQC KEM’s benefits far outweigh any downsides when integrated into 5G and 6G core services.
The rapid growth of 5G wireless technology has transformed connectivity, offering exceptional bandwidth, ultralow latency, and massive IoT device connectivity.However, as quantum computers are progressing, resistance against attacks from such computers becomes a mandatory requirement for all critical infrastructure, necessitating efficient post-quantum cryptography (PQC) implementations for 5G-based IoT devices with limited resources.For instance, User Equipment (UE) reauthentication due to frequent handovers and mobility events is a daily operation that already comes with some overhead, which is not attractive to be used for IoT UE devices.Incorporating heavier PQ solutions into these re-authentications will lead to even more additional communication and computation overhead that may hinder PQ deployment in next generation networks.As such, this paper introduces a novel, lightweight approach for integrating PQC in 5G IoT authentication by proposing a custom identity-based session resumption mechanism without compromising interoperability with existing protocols.This approach prevents replay attacks and ensures perfect forward secrecy (PFS) by utilizing customized identities that are dynamically generated based on device-specific parameters, combined with intelligent server-side caching of quantum-resistant cryptographic materials that eliminate the need for full PQC computations during subsequent re-authentications.We demonstrate through realistic 5G experimentation that the proposed solution significantly lowers authentication overhead while providing quantumresistant security.
The rapid development of quantum computing poses a significant threat to the security of current cryptographic systems, including those used in User Equipment (UE) for mobile communications. Conventional cryptographic algorithms such as Rivest–Shamir–Adleman (RSA) and Elliptic curve cryptography (ECC) are vulnerable to quantum computing attacks, which could jeopardize the confidentiality, integrity, and availability of sensitive data transmitted by UEs. This demo paper proposes the integration of Post-Quantum Cryptography (PQC) in TLS for UE Communication to mitigate the risks of quantum attacks. We present our setup and explain each of the components used. We also provide the entire workflow of the demo for other researchers to replicate the same setup. By addressing the implementation of PQC within a 5G network to secure UE-to-UE communication, this research aims to pave the way for developing quantum-resistant mobile devices and securing the future of wireless communications.