Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Lightweight Security for Private Networks: Real-World Evaluation of WireGuard

Hubert Djuitcheu, Andrew Sergeev, Khurshid Alam, Danny Santhosh, Achim Autenrieth, Jochen Seitz

TL;DR

Industrial Open RAN expands the attack surface; IPsec secures UP traffic but adds complexity and overhead. The authors implement WireGuard for both end-to-end UP encryption and N2 mutual authentication in a real Terafactory Open RAN, and compare it with IPsec. Results show WireGuard delivers comparable throughput and CPU usage with lower latency overhead and much simpler configuration, making it a viable lightweight security layer. The work argues for considering WireGuard as a complement to IPsec to unify security across multiple interfaces in O-RAN deployments.

Abstract

This paper explores WireGuard as a lightweight alternative to IPsec for securing the user plane as well as the control plane in an industrial Open RAN deployment at the Adtran Terafactory in Meiningen. We focus on a realistic scenario where external vendors access their hardware in our 5G factory network, posing recurrent security risks from untrusted gNBs and intermediate network elements. Unlike prior studies limited to lab setups, we implement a complete proof-of-concept in a factory environment and compare WireGuard with IPsec under industrial traffic conditions. Our approach successfully protects user data (N3 interface) against untrusted gNBs and man-in-the-middle attacks while enabling control plane (N2 interface) authentication between the access and mobility management functions (AMF) and gNB. Performance measurements show that WireGuard adds minimal overhead in throughput, latency, and Central Processing Unit (CPU) usage, achieving performance comparable to IPsec. These findings demonstrate that WireGuard offers competitive performance with significantly reduced configuration complexity, making it a strong candidate for broader adoption in O-RAN, providing a unified, lightweight security layer across multiple interfaces and components.

Lightweight Security for Private Networks: Real-World Evaluation of WireGuard

TL;DR

Industrial Open RAN expands the attack surface; IPsec secures UP traffic but adds complexity and overhead. The authors implement WireGuard for both end-to-end UP encryption and N2 mutual authentication in a real Terafactory Open RAN, and compare it with IPsec. Results show WireGuard delivers comparable throughput and CPU usage with lower latency overhead and much simpler configuration, making it a viable lightweight security layer. The work argues for considering WireGuard as a complement to IPsec to unify security across multiple interfaces in O-RAN deployments.

Abstract

This paper explores WireGuard as a lightweight alternative to IPsec for securing the user plane as well as the control plane in an industrial Open RAN deployment at the Adtran Terafactory in Meiningen. We focus on a realistic scenario where external vendors access their hardware in our 5G factory network, posing recurrent security risks from untrusted gNBs and intermediate network elements. Unlike prior studies limited to lab setups, we implement a complete proof-of-concept in a factory environment and compare WireGuard with IPsec under industrial traffic conditions. Our approach successfully protects user data (N3 interface) against untrusted gNBs and man-in-the-middle attacks while enabling control plane (N2 interface) authentication between the access and mobility management functions (AMF) and gNB. Performance measurements show that WireGuard adds minimal overhead in throughput, latency, and Central Processing Unit (CPU) usage, achieving performance comparable to IPsec. These findings demonstrate that WireGuard offers competitive performance with significantly reduced configuration complexity, making it a strong candidate for broader adoption in O-RAN, providing a unified, lightweight security layer across multiple interfaces and components.

Paper Structure

This paper contains 31 sections, 6 figures.

Table of Contents

  1. Introduction
  2. Background and motivation
  3. Threat model and Security requirements
  4. Threat Model
  5. UP Traffic Exposure via Untrusted gNB
  6. External Access Exposure
  7. CP exploitation
  8. Inference of Internal Network Structure Through Remote-Access Abuse
  9. Security Requirements
  10. End-to-End UP Confidentiality
  11. UP Integrity
  12. Network isolation
  13. Mutual Authentication
  14. Low Security Overhead
  15. Proposed Lightweight Solution
  16. ...and 16 more sections

Figures (6)

  • Figure 1: O-RAN-based private network architecture
  • Figure 2: E2E UP Encryption on two distinct termination points: a) external server and b) UPF
  • Figure 3: WireGuard for gNB authentication
  • Figure 4: Security cost on latency and comparison with IPsec.
  • Figure 5: Security cost on throughput
  • ...and 1 more figures