User plane security in split RAN architectures

A network node of a radio access network (RAN) of a wireless communication network, the network node comprising:

• processing circuitry and a memory, the memory containing instructions executable by the processing circuitry, whereby the network node is configured to establish a secure tunnel between first and second tunnel endpoints that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) that is dedicated to user plane traffic and has yet to be established;
• wherein to establish the secure tunnel, the network node is configured to exchange an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints between the endpoints.

A non-transitory computer readable medium storing a computer program product for controlling a programmable network node, the computer program product comprising software instructions that, when run on the programmable network node, cause the programmable network node to:

• establish a secure tunnel between first and second tunnel endpoints that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) that is dedicated to user plane traffic and has yet to be established;
• wherein to establish the secure tunnel, the network node is configured to exchange an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints between the endpoints.