 provided that enough capacity exists and that the radio product does not introduce too much processing delay as the latency budget is tight. Both of these pre- requisites are met with wireless media on the higher bands such as the E-band, and wireless may complement fiber at least in some of the cases, for example, for <6 GHz deployment, where the capacity requirement is not extremely high. 9 Transport 9.4.1.2 Security User signals on the low layer split point are cryptographically protected by the PDCP (Packet Data Convergence Protocol) layer between the UE and the gNB over the low layer fronthaul transport. Due to the PDCP protection, sensitive information is not easily available, even if the transport layer has no cryptographic protection. Legacy CPRI/OBSAI did not define further security services, and neither does the O-RAN specification demand this. High bit rates would also mandate high-performance cryptographic engines. The management plane to the RU needs cryptographic protection as it is otherwise lacking all protection. In the O-RAN standard, NetConf over SSH (Secure Shell) is included. 9.4.2 NG Interface The NG interface is defined for connectivity between the 5G RAN and the 5G Core net- work. NG2 is the control plane interface (NG-C, carrying NG-AP), and NG3 is the user plane interface (NG-U). In 5G RAN, the element is either the gNB-CU (cloud deploy- ment) or the classical gNB. The protocol stack on the user plane consists of GTP-U/UPD/IP (IPv6 or IPv4) and IPsec. The control plane stack relies on (DTLS)/SCTP/IP (IPv6 or IPv4) and IPsec. The protocol stack is included in Figure 5.3 of Chapter 5. 9.4.2.1 Connectivity Multiple NG2 and NG3 interfaces may exist in the same 5G RAN node. This allows resiliency to a failure in a single core network node (or site) and also load balancing of traffic in the core network nodes. Basically, any connectivity service that supports IP flows between the peer nodes is feasible. In Figure 9.9, classical gNBs use the first mile access service of a wireless link or fibe