Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Assessing the Latency of Network Layer Security in 5G Networks

Sotiris Michaelides, Jonathan Mucke, Martin Henze

TL;DR

This study addresses the latency impact of network-layer security in 5G, particularly IPsec over the N3 interface for user data and over SBI for control data, and compares WireGuard as an alternative. It deploys an open, containerized testbed (Open5GS, UERANSIM, strongSwan, WireGuard) to measure latency across 12 IPsec configurations, TLS variants, and a WireGuard baseline, evaluating both UP and CP paths, as well as warm and cold conditions. The results show that properly configured IPsec, especially in start mode, incurs sub-millisecond overhead for latency-critical paths, with WireGuard offering lower resource usage but slightly higher latency in most cases; TLS performs competitively in some CP scenarios. These findings guide operators in selecting security configurations that balance robust protection with ultra-low latency requirements, and point to future work on optimization and post-quantum considerations for evolving 5G/6G architectures.

Abstract

In contrast to its predecessors, 5G supports a wide range of commercial, industrial, and critical infrastructure scenarios. One key feature of 5G, ultra-reliable low latency communication, is particularly appealing to such scenarios for its real-time capabilities. However, 5G's enhanced security, mostly realized through optional security controls, imposes additional overhead on the network performance, potentially hindering its real-time capabilities. To better assess this impact and guide operators in choosing between different options, we measure the latency overhead of IPsec when applied over the N3 and the service-based interfaces to protect user and control plane data, respectively. Furthermore, we evaluate whether WireGuard constitutes an alternative to reduce this overhead. Our findings show that IPsec, if configured correctly, has minimal latency impact and thus is a prime candidate to secure real-time critical scenarios.

Assessing the Latency of Network Layer Security in 5G Networks

TL;DR

This study addresses the latency impact of network-layer security in 5G, particularly IPsec over the N3 interface for user data and over SBI for control data, and compares WireGuard as an alternative. It deploys an open, containerized testbed (Open5GS, UERANSIM, strongSwan, WireGuard) to measure latency across 12 IPsec configurations, TLS variants, and a WireGuard baseline, evaluating both UP and CP paths, as well as warm and cold conditions. The results show that properly configured IPsec, especially in start mode, incurs sub-millisecond overhead for latency-critical paths, with WireGuard offering lower resource usage but slightly higher latency in most cases; TLS performs competitively in some CP scenarios. These findings guide operators in selecting security configurations that balance robust protection with ultra-low latency requirements, and point to future work on optimization and post-quantum considerations for evolving 5G/6G architectures.

Abstract

In contrast to its predecessors, 5G supports a wide range of commercial, industrial, and critical infrastructure scenarios. One key feature of 5G, ultra-reliable low latency communication, is particularly appealing to such scenarios for its real-time capabilities. However, 5G's enhanced security, mostly realized through optional security controls, imposes additional overhead on the network performance, potentially hindering its real-time capabilities. To better assess this impact and guide operators in choosing between different options, we measure the latency overhead of IPsec when applied over the N3 and the service-based interfaces to protect user and control plane data, respectively. Furthermore, we evaluate whether WireGuard constitutes an alternative to reduce this overhead. Our findings show that IPsec, if configured correctly, has minimal latency impact and thus is a prime candidate to secure real-time critical scenarios.
Paper Structure (17 sections, 4 figures, 1 table)

This paper contains 17 sections, 4 figures, 1 table.

Table of Contents

  1. Introduction
  2. Background on 5G Systems and Their Security
  3. Security Controls in 5G
  4. Security Protocols
  5. Related Work
  6. Methodology
  7. Selection of IPsec Configurations
  8. Experimental Setup
  9. Latency Overhead of Tunneling Protocols
  10. User Data Transmission over N3
  11. Control Communication within the 5GC
  12. Resource Consumption and Scalability
  13. Validation with Real UEs
  14. Operators' Perspective
  15. Discussion on Security and Latency
  16. ...and 2 more sections

Figures (4)

  • Figure 1: In a 5G network, separated into control and user plane, various security controls apply to different planes and interfaces: Control Plane Security, User Plane Security, IPsec, and TLS. In this work, we study the latency impact of IPsec and WireGuard to secure the up of 5G and the cp of the 5gc.
  • Figure 2: The average RTT for user data transmission on the N3 interface behaves similarly for different payload sizes, with IPsec performing comparable to the insecure baseline while WireGuard shows a slightly worse performance.
  • Figure 3: The average UE attachment time in warm scenarios is similar across configurations and protocols, except for WireGuard which is slightly slower. In cold scenarios, WireGuard and IPsec in start mode demonstrate their advantages.
  • Figure 4: The average CPU time for the successful registration of increasing UE numbers reveals scales linearly across security protocols, with a slight advantage for WireGuard.