Researchers have demonstrated a 5G security prototype that verifies a device’s hardware and early boot state before allowing the standard mobile-network subscriber authentication process to begin.
The work addresses a gap in 5G Authentication and Key Agreement, or 5G-AKA. That protocol verifies the subscriber credential held on a USIM, but it does not prove that the SIM remains inside an approved physical device or that the device started with trusted firmware.
In military and other high-assurance networks, a valid SIM moved into unauthorized equipment could still pass subscriber authentication. The proposed architecture adds two certificate checks and a Trusted Platform Module attestation step before registration, binding network access to both the subscriber credential and a measured device state.
An outer X.509 certificate is checked at the 5G base station, while an inner certificate is validated deeper in the core network at the Access and Mobility Management Function. The Trusted Platform Module then supplies signed measurements from platform configuration registers covering early boot components.
The researchers built their testbed with srsRAN, Open5GS, a USRP B210 software-defined radio and a hardware Trusted Platform Module. Across six attack trials, the prototype blocked SIM transplant, rogue-certificate, firmware-tampering and replay scenarios under the threat assumptions used for the evaluation.
The added controls increased measured onboarding time from 1,886 milliseconds to 2,260 milliseconds, an overhead of about 373 milliseconds. Trusted Platform Module communication accounted for most of the delay, with an average round trip of 235.7 milliseconds, and the added signaling totaled 3,609 bytes.
The prototype measures platform configuration registers 0 through 7, which cover early boot rather than continuous runtime behavior. Its enrollment records are also kept in flat files for the test environment. Those design boundaries define the current experiment without changing the demonstrated pre-authentication sequence.
Hardware-rooted identity is also appearing in commercial authentication. IDEMIA and SLC Digital have proposed binding a verified identity to a SIM secure element, while Telin and IPification use network signals to verify a phone number, SIM and device without an SMS code.
The battlefield design places its additional checks before 5G-AKA rather than replacing the standards-based subscriber protocol. A device must therefore pass certificate validation and attest its measured boot state before the network proceeds with the familiar USIM challenge and key agreement.
The paper has been accepted for presentation at MILCOM 2026. Its test results provide a concrete implementation of device trust layered onto 5G subscriber identity, with measured costs for the extra cryptographic exchange.
Sources: arXiv
–
By Ji-seo Kim
