The transition to a cloud-native 5G Service-Based Architecture (SBA) improves scalability but exposes control-plane signaling to emerging quantum threats, including Harvest-Now, Decrypt-Later (HNDL) attacks. While NIST has standardized post-quantum cryptography (PQC), practical, deployable integration in operational 5G cores remains underexplored. This work experimentally integrates NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves unmodified network functions (NFs). Implemented on free5GC, we compare three deployments: (i) native HTTPS/TLS, (ii) TLS sidecar, and (iii) PQC-enabled sidecar. Measurements at the HTTP/2 request-response boundary over repeated independent runs show that PQC increases end-to-end Service-Based Interface (SBI) latency to approximately 54 ms, adding a deterministic 48-49 ms overhead relative to the classical baseline, while maintaining tightly bounded variance (IQR <= 0.2 ms, CV < 0.4%). We also quantify the impact of Certification Authority (CA) security levels, identifying certificate validation as a tunable contributor to overall delay. Overall, the results demonstrate that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.

翻译：向云原生5G服务化架构（SBA）的转型虽提升了可扩展性，却使控制面信令面临新兴量子威胁，包括"先捕获，后解密"（HNDL）攻击。尽管美国国家标准与技术研究院（NIST）已标准化后量子密码（PQC），但如何在运营级5G核心网中实现切实可部署的集成仍待深入探究。本工作采用边车代理模式，在保持网络功能（NF）不变的前提下，将NIST标准化的ML-KEM-768与ML-DSA算法集成至开源5G核心网free5GC。基于free5GC实现后，我们比较了三种部署方案：（i）原生HTTPS/TLS，（ii）TLS边车，及（iii）启用PQC的边车。在HTTP/2请求-响应边界通过重复独立运行测量的结果表明：PQC将端到端服务化接口（SBI）延迟增加至约54毫秒，相比经典基线引入48-49毫秒的确定性开销，同时保持高度紧凑的方差（四分位距≤0.2毫秒，变异系数<0.4%）。我们还量化了证书颁发机构（CA）安全等级的影响，将证书验证识别为总时延中的一个可调贡献因素。总体而言，实验结果证明基于边车的PQC插入能够为量子韧性5G信令提供一种无中断且运行可预测的迁移路径。