Securing Ethernet-based Optical Fronthaul for 5G Network

Abstract

In 5G networks, an optical fronthaul transports massive user data from remote radio heads (RRH) to the core network (CO) with high throughput and low latency. eCPRI is a new standard interface for the Ethernet-based optical fronthaul network to enhance the efficiency and performance. If fronthaul networks are deployed in an unsafe domain, an end-to-end security system should be implemented over the data flow, which usually requires additional overhead and processing time. This redundancy may cause unexpected latency and performance degradation in the data transport for 5G networks. According to the specification of eCPRI, vendors may optionally implement either IPsec or MACsec to ensure the security of transmission. In this paper, we investigate security solutions suitable for the Ethernet-based optical fronthaul network. We analyze the standard security protocols such as IPsec and MACsec for the security of the high speed link. We propose WireGuard as an alternative security solution which may replace IPsec. According to our analysis, the extended overhead for security protocols has negligible impact on the latency. However, eCPRI processing time can be prolonged, which may cause additional latency and eventually affect the maximum transmission distance of fronthaul networks. As an example, we performed a simulation of eCPRI traffic and measured the latency of WireGuard. We also point out that a re-key interval should be carefully chosen not to compromise the security of the high capacity link such as 5G fronthaul networks. Our analysis is further extended to a long-term security solution which is resistant to quantum attacks.