Open Radio Access Networks (O-RAN) introduce flexibility and multi-vendor interoperability through open and standardized interfaces. The emergence of programmable RAN Intelligent Controllers (RICs), along with the ability to deploy third-party applications as xApps and rApps, further accelerates innovation. However, these advancements also expand the attack surface of 6G infrastructures and introduce significant new security challenges. As quantum computing threatens classical cryptography, O-RAN security must evolve toward quantum-resilient mechanisms. This article outlines a layered migration roadmap for integrating Post-Quantum Cryptography (PQC) and hybrid schemes into O-RAN’s identity, control, and runtime layers. Building on O-RAN Alliance Work Group 11 and GSMA post-quantum telco network task force guidelines, we estimate the relative cost and performance trade-offs of classical, hybrid, and PQC-only protections across key interfaces. The results show that hybrid integration provides near-term quantum resistance with moderate overhead, while full PQC deployment requires architectural adaptations. The proposed approach offers a standards-aligned path toward secure, interoperable, and energy-aware O-RAN evolution for 6G.
Open Radio Access Networks (O-RAN) introduce flexibility and multi-vendor interoperability through open and standardized interfaces. The emergence of programmable RAN Intelligent Controllers (RICs), along with the ability to deploy third-party applications as xApps and rApps, further accelerates innovation. However, these advancements also expand the attack surface of 6G infrastructures and introduce significant new security challenges. As quantum computing threatens classical cryptography, O-RAN security must evolve toward quantum-resilient mechanisms. This article outlines a layered migration roadmap for integrating Post-Quantum Cryptography (PQC) and hybrid schemes into O-RAN’s identity, control, and runtime layers. Building on O-RAN Alliance Work Group 11 and GSMA post-quantum telco network task force guidelines, we estimate the relative cost and performance trade-offs of classical, hybrid, and PQC-only protections across key interfaces. The results show that hybrid integration provides near-term quantum resistance with moderate overhead, while full PQC deployment requires architectural adaptations. The proposed approach offers a standards-aligned path toward secure, interoperable, and energy-aware O-RAN evolution for 6G.
Open Radio Access Networks (O-RAN) introduce unprecedented flexibility, interoperability, and intelligence into next-generation wireless systems, but their disaggregated and software-defined architecture also expands the attack surface and creates new security vulnerabilities. Conventional cryptographic mechanisms, while effective against classical threats, may become insufficient in the presence of quantum-enabled adversaries. This article presents a comprehensive perspective on quantum security for O-RAN, examining how quantum-resilient mechanisms can enhance confidentiality, authentication, and trust across the RAN ecosystem. It discusses post-quantum cryptography (PQC), quantum cryptography, quantum authentication, and quantum-enhanced threat detection within a zero-trust architecture based on continuous verification, least privilege, and micro-segmentation. Their integration with the Near-Real-Time (Near-RT) RAN Intelligent Controller, O-Cloud, and open interfaces is analyzed, together with practical deployment considerations, technology maturity, and adoption timelines. Finally, open research directions are outlined toward secure, resilient, and future-proof O-RAN architectures for 6G networks.
With its disaggregated and open interfaces, the Open Radio Access Network (O-RAN) architecture promises flexibility, innovation, and cost-effectiveness for future wireless networks. However, the increased reliance on software and open interfaces also introduces new security challenges. As the threat of quantum computing looms, the traditional cryptographic algorithms used in O-RAN will become vulnerable to potential attacks. This paper proposes the integration of Post-Quantum Cryptography (PQC) into O-RAN to enhance its security against post-quantum adversaries. We discuss the specific vulnerabilities of current O-RAN security mechanisms to quantum attacks and identify key areas where PQC can be applied, such as key exchange, authentication, and data protection. We present a framework for evaluating the suitability of different PQC algorithms for O-RAN and outline potential challenges and implementation considerations. By proactively integrating PQC into O-RAN, we aim to ensure the long-term security and resilience of this emerging network architecture in the era of quantum computing.
The Open Radio Access Network (O-RAN) offers flexibility and innovation but introduces unique security vulnerabilities, particularly from cryptographically relevant quantum computers. While Post-Quantum Cryptography (PQC) is the primary scalable defence, its computationally intensive handshakes create a significant bottleneck for the RAN control plane, posing sustainability challenges. This article proposes an energy-aware framework to solve this PQC bottleneck, ensuring quantum resilience without sacrificing operational energy efficiency. The system employs an O-RAN aligned split: a Crypto Policy rApp residing in the Non-Real- Time (Non-RT) RIC defines the strategic security envelope (including PQC suites), while a Security Operations Scheduling (SOS) xApp in the Near-RT RIC converts these into tactical timing and placement intents. Cryptographic enforcement remains at standards-compliant endpoints: the Open Fronthaul utilizes Media Access Control Security (MACsec) at the O-DU/O-RU, while the xhaul (midhaul and backhaul) utilizes IP Security (IPsec) at tunnel terminators. The SOS xApp reduces PQC overhead by batching non-urgent handshakes, prioritizing session resumption, and selecting parameters that meet slice SLAs while minimizing joules per secure connection. We evaluate the architecture via a Discrete-Event Simulation (DES) using 3GPP-aligned traffic profiles and verified hardware benchmarks from literature. Results show that intelligent scheduling can reduce per-handshake energy by approximately 60% without violating slice latency targets.
As Open Radio Access Network (O-RAN) deployments expand and adversaries adopt “store-now, decrypt-later” strategies, operators need empirical data on the cost of migrating critical control interfaces to post-quantum cryptography (PQC). This paper experimentally evaluates the impact of integrating a NIST-aligned Module-Lattice Key-Encapsulation Mechanism (ML-KEM) into IKEv2/IPsec, protecting the E2 interface between the 5G Node B (gNB) and the Near-Real-Time RAN Intelligent Controller (Near-RT RIC). Using an open-source testbed built from srsRAN, Open5GS, FlexRIC and strongSwan (with liboqs), we compare three configurations: no IPsec, classical Elliptic Curve Diffie–Hellman (ECDH)-based IPsec, and ML-KEM-based IPsec. This study focuses on IPsec tunnel-setup latency and the runtime behaviour of Near-RT RIC xApps under realistic signalling workloads. Results from repeated, automated runs show that ML-KEM integration adds a small overhead to tunnel establishment, which is approximately 2.7~4.7 ms in comparison to classical IPsec, while xApp operation and RIC control loops remain stable in our experiments. These findings, produced from an open, reproducible testbed, indicate that ML-KEM-based IPsec on the E2 interface is practically feasible and inform quantum-safe migration strategies for O-RAN deployments.
The telecommunications industry faces a dual transformation: the architectural shift toward Open Radio Access Networks (O-RAN) and the emerging threat from quantum computing. O-RAN disaggregated, multi-vendor architecture creates a larger attack surface vulnerable to crypt-analytically relevant quantum computers(CRQCs) that will break current public key cryptography. The Harvest Now, Decrypt Later (HNDL) attack strategy makes this threat immediate, as adversaries can intercept encrypted data today for future decryption. This paper presents Q-RAN, a comprehensive quantum-resistant security framework for O-RAN networks using NIST-standardized Post-Quantum Cryptography (PQC). We detail the implementation of ML-KEM (FIPS 203) and ML-DSA (FIPS 204), integrated with Quantum Random Number Generators (QRNG) for cryptographic entropy. The solution deploys PQ-IPsec, PQ-DTLS, and PQ-mTLS protocols across all O-RAN interfaces, anchored by a centralized Post-Quantum Certificate Authority (PQ-CA) within the SMO framework. This work provides a complete roadmap for securing disaggregated O-RAN ecosystems against quantum adversaries.
As Open Radio Access Network (O-RAN) deployments expand and adversaries adopt 'store-now, decrypt-later' strategies, operators need empirical data on the cost of migrating critical control interfaces to post-quantum cryptography (PQC). This paper experimentally evaluates the impact of integrating a NIST-aligned module-lattice KEM (ML-KEM, CRYSTALS-Kyber) into IKEv2/IPsec protecting the E2 interface between the 5G Node B (gNB) and the Near-Real-Time RAN Intelligent Controller (Near-RT RIC). Using an open-source testbed built from srsRAN, Open5GS, FlexRIC and strongSwan (with liboqs), we compare three configurations: no IPsec, classical ECDH-based IPsec, and ML-KEM-based IPsec. The study focuses on IPsec tunnel-setup latency and the runtime behaviour of Near-RT RIC xApps under realistic signalling workloads. Results from repeated, automated runs show that ML-KEM integration adds a small overhead to tunnel establishment, which is approximately 3~5 ms in comparison to classical IPsec, while xApp operation and RIC control loops remain stable in our experiments. These findings indicate that ML-KEM based IPsec on the E2 interface is practically feasible and inform quantum-safe migration strategies for O-RAN deployments.