 other RAN nodes, 5G or 4G. 9.4.3.2 Security The user plane is PDCP protected cryptographically (PDCP is carried over the GTP-U), while the control plane is unprotected (except for the RRC Radio Resource Control). IPsec (and DTLS) is needed to protect the control plane, and IPsec may provide addi- tional protection for the user plane. With IPsec protection using a central security gateway (SEG), the signal must visit the SEG, SO the SEG becomes the hub point. Alternatively, IPsec tunnels may be created directly between the 5G nodes (gNBs), and the tunnel then routed via the first common IP hub point. 9.4.3.3 Dual Connectivity The above applies as well for the dual connectivity case (LTE-5G, 5G-5G), with the differ- ence that there may be higher capacities involved, depending on the scheduler decisions. When LTE and 5G nodes share a site, the link is site internal. For dual connectivity, a flow control procedure is defined over the Xn/X2 interface, which limits the traffic flow if congestion occurs. 9.4.4 F1 Interface In the CU-DU split architecture, the F1 interface connects the gNB-DU to the gNB-CU. Since the latency-critical protocols terminate at the gNB-DU, the F1 interface is not as demanding as the low layer fronthaul interface in this respect. 9 Transport The protocol stack at the F1 interface is shown in Figure 5.12 of Chapter 5. The transport layers in the control plane are (DTLS)/SCTP/IP and in the user plane are GTP-U/UDP/IP, IP being either IPv6 or IPv4. IPsec is the protocol defined for cryptographic protection. With the gNB-CU, part of the computing functions of 5G radio are centralized, and as an example, implemented as VNFs (virtual network functions) in the cloud infrastruc- ture. Since the real-time critical functions are implemented in the gNB-DU, computing requirements on the cloud infrastructure are not as demanding as would be the case if the lower layers of the 5G radio protocols were also deployed in the cloud. As a possible further evolution, these real-time functions can also be moved to