The rapid advancement of quantum computing presents an urgent threat to 5G networks, particularly across sensitive roaming boundaries. While existing quantum-safe solutions typically require intrusive modifications to core network functions, this paper introduces a highly crypto-agile, non-intrusive proxy architecture to secure the N32 control-plane and N9 user-plane roaming interfaces. By deliberately isolating cryptographic operations within local, containerized proxies, our design avoids complex dependency upgrades on the running 5G core. To maximize practical deployability, we developed proof-of-concept prototypes based on OpenSSL 3.5.4 offering two distinct, highly configurable variants. The first enables immediate, software-only integration utilizing Post-Quantum Cryptography (PQC) suites (ML-KEM/ML-DSA, BIKE/Falcon). The second deploys autonomous agents in a custom Pre-Shared Key (PSK) configuration fed by out-of-band Quantum Key Distribution (QKD), enabling dynamically enforced cryptoperiods and seamless Public Key Infrastructure (PKI) fallback mechanism based on real-time key availability. We evaluate this architecture using a comprehensive open-source testbed combining Open5GS and QKDNetSim. To assess practical deployability, we measured control-plane registration times, cryptographic data volume, user-plane delay, and QKD key consumption against legacy HTTP(S) baselines. Experimental results demonstrate that these quantum-safe architectures perform comparably to, or better than, legacy security. The PQC proxies maintained competitive cold-start registration times (261–285 ms), successfully balancing computational and bandwidth trade-offs. Notably, the QKD-assisted PSK configuration achieved the highest efficiency, reducing median registration time to 258.2 ms (a 4.5% improvement over legacy HTTPS) and restricting handshake data volume to 12.3 kB by bypassing heavy asymmetric certificate authentication. Furthermore, all prototypes successfully secured the traditionally unencrypted GPRS Tunnelling Protocol user plane (GTP-U) traffic traversing the N9 interface with a practically negligible delay increase ( $\sim 300~\mu $ s). Finally, the study highlights critical transport-layer constraints, such as TCP-in-TCP congestion interference, underscoring the necessity of DTLS 1.3 to optimize practical, quantum-resilient telecommunications infrastructure.
The rapid advancement of quantum computing presents an urgent threat to 5G networks, particularly across sensitive roaming boundaries. While existing quantum-safe solutions typically require intrusive modifications to core network functions, this paper introduces a highly crypto-agile, non-intrusive proxy architecture to secure the N32 control-plane and N9 user-plane roaming interfaces. By deliberately isolating cryptographic operations within local, containerized proxies, our design avoids complex dependency upgrades on the running 5G core. To maximize practical deployability, we developed proof-of-concept prototypes based on OpenSSL 3.5.4 offering two distinct, highly configurable variants. The first enables immediate, software-only integration utilizing Post-Quantum Cryptography (PQC) suites (ML-KEM/ML-DSA, BIKE/Falcon). The second deploys autonomous agents in a custom Pre-Shared Key (PSK) configuration fed by out-of-band Quantum Key Distribution (QKD), enabling dynamically enforced cryptoperiods and seamless Public Key Infrastructure (PKI) fallback mechanism based on real-time key availability. We evaluate this architecture using a comprehensive open-source testbed combining Open5GS and QKDNetSim. To assess practical deployability, we measured control-plane registration times, cryptographic data volume, user-plane delay, and QKD key consumption against legacy HTTP(S) baselines. Experimental results demonstrate that these quantum-safe architectures perform comparably to, or better than, legacy security. The PQC proxies maintained competitive cold-start registration times (261–285 ms), successfully balancing computational and bandwidth trade-offs. Notably, the QKD-assisted PSK configuration achieved the highest efficiency, reducing median registration time to 258.2 ms (a 4.5% improvement over legacy HTTPS) and restricting handshake data volume to 12.3 kB by bypassing heavy asymmetric certificate authentication. Furthermore, all prototypes successfully secured the traditionally unencrypted GPRS Tunnelling Protocol user plane (GTP-U) traffic traversing the N9 interface with a practically negligible delay increase ( ∼300μ s). Finally, the study highlights critical transport-layer constraints, such as TCP-in-TCP congestion interference, underscoring the necessity of DTLS 1.3 to optimize practical, quantum-resilient telecommunications infrastructure.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The evolving 5G architecture, moving from proprietary monolithic hardware towards the disaggregated and modular Open Radio Access Network (Open RAN), introduces new, critical interfaces requiring robust security. While IPSec is a prevalent solution for securing IP communications, the advent of quantum computing threatens its traditional cryptographic underpinnings; it may be deprecated in the near future. To address this, we propose a quantum-safe Open RAN framework for securing fronthaul (i.e., Radio Unit-Distributed Unit) and backhaul (i.e., Centralized Unit-5G core) interfaces. Our framework employs a hybrid key exchange scheme, combining post-quantum cryptography (PQC) with quantum keys as cryptographic material, designed for seamless integration with TLS, IKEv2/IPSec, and MACSec standards, and compatible with ETSI QKD 004 and 014 APIs. Furthermore, we present a novel key distribution protocol for Quantum Key Distribution Networks (QKDN). This protocol incorporates encapsulation techniques inspired by onion routing, combined with PQC, to ensure confidentiality, integrity, authenticity, and anonymity. It also leverages post-quantum public key encryption to protect shared secrets from intermediate nodes within the QKDN, mitigating intermediary attacks. We have deployed a proof-of-concept of our proposal, experimentally validating both air-based and fiber-based QKD, primarily using ML-KEM and ML-DSA standards for PQC algorithms.
The transition to a cloud-native 5G Service-Based Architecture (SBA) improves scalability but exposes control-plane signaling to emerging quantum threats, including Harvest-Now, Decrypt-Later (HNDL) attacks. While NIST has standardized post-quantum cryptography (PQC), practical, deployable integration in operational 5G cores remains underexplored. This work experimentally integrates NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves unmodified network functions (NFs). Implemented on free5GC, we compare three deployments: (i) native HTTPS/TLS, (ii) TLS sidecar, and (iii) PQC-enabled sidecar. Measurements at the HTTP/2 request-response boundary over repeated independent runs show that PQC increases end-to-end Service-Based Interface (SBI) latency to approximately 54 ms, adding a deterministic 48-49 ms overhead relative to the classical baseline, while maintaining tightly bounded variance (IQR <= 0.2 ms, CV < 0.4%). We also quantify the impact of Certification Authority (CA) security levels, identifying certificate validation as a tunable contributor to overall delay. Overall, the results demonstrate that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.
6G networks will require quantum-secure cryptography deployed across core infrastructure, edge nodes, resource-constrained IoT devices. Although post-quantum cryptographic (PQC) algorithms have been standardized by NIST, their practical deployability in bandwidth and latency limited wireless systems remains unclear. This paper presents a practical evaluation of NIST selected PQC schemes, including ML-KEM (Kyber), ML-DSA (Dilithium), and Falcon. Benchmarks conducted with OpenSSL and the OQS provider on heterogeneous platforms show that while computational performance is acceptable, ciphertext and signature size expansion significantly impact handshake reliability and bandwidth efficiency, particularly at the network edge. The results highlight key system-level trade-offs and motivate the need for PQC optimization and deployment-aware design for future quantum-secure 6G networks.
Advances in quantum computing pose a significant threat to the widely used Public Key Infrastructure (PKI). The two leading technologies to address this challenge are Post-Quantum Cryptography and Quantum Key Distribution. A promising approach is the hybridization of these technologies - combining their respective strengths while mitigating their limitations - and integrating them with the cryptographic mechanisms used today to enhance crypto-agility and facilitate transitioning to a quantum-safe infrastructure. However, changing current network protocols to quantum-safe alternatives is not just a matter of security: their efficiency and scalability must also be demonstrated within real-world telecommunications infrastructures to ensure their practical adoption. In this work, we present the first long-running test with detailed measurements of a suite of hybrid quantum-safe protocols that integrate classical cryptography, PQC, and QKD within a production environment (MadQCI). Using standardized protocols and interfaces and employing Transport Layer Security (TLS) as the base protocol for real-world comparison, this study demonstrates the efficiency and scalability of the proposed solution in deployed heterogeneous networks. These results mark a significant step towards the widespread adoption of quantum-safe hybrid protocols and contribute to clarifying the path toward their future standardization in next-generation telecommunications networks.
The fifth generation of mobile networks (5G) is among the critical infrastructures whose security and privacy requirements are paramount. Compared to previous generations, 5G leverages a service-based architecture where many Network Functions (NF), i.e., the set of microservices on which is based the architecture, need secure communication means. NFs can communicate using HTTP2, and despite not being required by the standard, they can use Transport Layer Protocol (TLS) to ensure data integrity and authentication across the network. However, with the expected arrival of quantum computers in the near future, traditional cryptographic algorithms are under significant threat. With the recent run for post-quantum standardization, the NIST selected possible candidate algorithms. However, no study evaluates whether such algorithms would be applicable in the 5G core without significant performance degradation. In this paper, we perform the first assessment of the feasibility of using post-quantum secure Key Encapsulation Mechanism (KEM) for the 5G core network. To this aim, we implemented and compared the performances of five algorithms among those selected during the NIST standardization process. We adapted those algorithms to implement them in a standalone 5G core implemented via Open5GS, and tested their performance when performing user registration. Our results show that the KY-BER768 achieves comparable performance to TLS in terms of UE registration time and CPU utilization, thus being a candidate solution to improve the security posture of the 5G core.