{"id":"cf55e0f9-0c96-45d6-8db5-d2cdb2e2f480","arxiv_id":"2608.11293","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A dual-PKI and TPM attestation layer inserted before 5G-AKA onboarding verifies device identity and boot state, adding 373.4 ms overhead on a USRP testbed.","lead":"This paper builds a 5G registration-time checker that requires a device certificate at the base station, a separate certificate at the core, and a TPM boot-integrity quote before normal authentication proceeds. It shows the extra checks add about 373 milliseconds of delay on an open-source testbed while blocking several device-attack scenarios.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attestation evidence is not bound to the saved Registration Request, enabling a two-radio relay that defeats the claimed SIM-transplant block even under the paper's threat model.","rationale":"The reader identifies trusted gNB and AMF as the weakest assumption. That concern is real but partially mitigated by the layered checks: a compromised gNB alone does not bypass the inner CA and TPM gates at the AMF. The more direct, load-bearing issue is the absence of any cryptographic binding between the attested device and the registration attempt. Because all three checks sign only a fresh nonce, the evidence is portable across sessions and across registration requests. A relay attacker can use an enrolled UE as an oblivious signing oracle without violating the stated threat model, and the system will admit a stolen USIM on a rogue platform. This directly undercuts the paper's strongest claim of blocking SIM-transplant attacks. The fix is straightforward: include a hash of the saved Registration Request and a session or AMF identifier in the signed challenge data for all three checks. The verdict should remain conditional, but the condition must include this binding and a demonstration that the relay attack fails after the fix.","tokens_in":9253,"tokens_out":14543,"duration_ms":145603,"concrete_test":"Reproduce the described testbed with an enrolled UE additionally reachable through a second USRP running a fake gNB. Connect a rogue srsUE (valid USIM, no device certificates) to the real gNB and relay the real gNB/AMF/proxy challenge nonces to the enrolled UE over the fake-gNB link, returning the legitimate signed responses. If the rogue completes registration and establishes a PDU session, the SIM-transplant block claim is violated. Then modify the protocol so each challenge-response signs a hash of the saved Registration Request plus the AMF/session identifier, rerun the relay, and verify that admission is rejected.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim that the prototype blocks SIM-transplant and rogue-device registration assumes that the device answering the three challenges is the same device whose saved Registration Request is later replayed. Section IV.B states that certificate responses sign only a fresh 32-byte nonce, and the TPM quote binds only the proxy nonce; neither the outer, inner, nor TPM evidence includes a digest of the NAS Registration Request or a session/AMF identifier. Consequently, an adversary with a valid but stolen USIM can run two SDRs: one impersonates a gNB to an enrolled victim UE, and the other attaches to the real gNB as a rogue UE. The rogue relays each fresh challenge nonce from the real network to the victim, relays the signed certificate responses and TPM quote back, then lets its own saved Registration Request be replayed. The network sees valid signatures and a valid TPM quote over fresh nonces and proceeds to 5G-AKA, which the stolen USIM satisfies. None of the stated threat-model assumptions are violated: no TPM key is extracted, no CA signature is forged, and no PCR is made to match incorrectly. The design lacks channel binding between the attestation evidence and the registration attempt, so the four attack-blocking claims are not guaranteed by the described protocol.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes and implements Battlefield 5G, a pre-authentication framework for 5G Standalone networks that inserts an outer X.509 certificate check at the gNB, an independent inner X.509 certificate check at the AMF, and a TPM 2.0 PCR attestation verified by an attestation proxy before normal 5G-AKA registration proceeds. The implementation modifies srsRAN/srsUE and Open5GS, uses an RRC forwarding gate and an AMF-side save-and-replay mechanism to insert the checks without changing NAS message formats, and evaluates the prototype on a USRP B210 testbed. Across six trials the authors report a 373.4 ms increase in onboarding latency over a same-testbed baseline and claim that the prototype blocks SIM-transplant, rogue-certificate, firmware-tampering, and replay attacks.","tokens_in":9449,"tokens_out":4461,"duration_ms":76008,"significance":"If the claimed security properties held, the work would be a useful engineering contribution for tactical 5G: it addresses a real gap (5G-AKA authenticates the USIM rather than the physical device), uses a hardware TPM for boot attestation, and provides a same-testbed baseline with an overhead decomposition that is internally consistent (74.9 ms + 298.5 ms = 373.4 ms). The paper does not fit parameters or derive predictions from data; the overhead figures are direct measurements. However, the central security claims are not yet established. The protocol as described lacks binding between the attestation evidence and the specific registration attempt, which enables a concrete relay attack, and the attack validation in Section VI.B is only a summary table without experimental details. The engineering and measurement infrastructure appear sound, but the security contribution needs substantial rework.","major_comments":[{"comment":"The attestation evidence is not bound to the registration attempt. All three challenges contain only a fresh 32-byte nonce: the outer and inner certificate responses sign that nonce, and the TPM quote binds the proxy-provided nonce. Neither the certificate responses nor the TPM quote include a digest of the NAS Registration Request, an AMF-generated session identifier, or any other registration-specific value. Consequently, an adversary with a valid USIM and two software-defined radios can relay the real network's fresh challenges to an enrolled victim UE through a rogue gNB, relay the signed certificate responses and TPM quote back to the real network, and then let the adversary's own saved Registration Request be replayed. The verifiers see valid signatures over fresh nonces and 5G-AKA completes using the stolen USIM. This contradicts the claimed SIM-transplant and replay blocking in Section VII and Table III, and it is not excluded by the threat model in Section III, which explicitly allows SDR-based rogue platforms and over-the-air observation. The protocol needs channel binding, for example by including a digest of the NAS Registration Request or an AMF-generated session identifier in the signed nonce and in the TPM quote.","section":"Section IV.B, Table II"},{"comment":"The attack validation is presented only as a summary table. The paper does not describe how each of the four attacks was implemented or executed: how the SIM transplant was performed, what the rogue certificate was, which PCR was modified to simulate firmware tampering, or how a replay attempt was mounted. No logs, pass/fail counts, or observable outcomes are reported. Because the abstract and Section VII assert that the prototype 'blocks' all four attacks, this evidence is load-bearing and needs to be reported with enough detail for the reader to see that the attack scenarios actually exercised the intended adversarial capabilities.","section":"Section VI.B, Table III"},{"comment":"All latency claims rest on six trials with no reported standard deviation or per-trial data. Given the large observed ranges (outer CA 47.0–89.0 ms, TPM 219–258 ms, total 2228–2303 ms), the mean overhead value of 373.4 ms is not statistically characterized. The paper should report the number of trials per configuration, dispersion measures, and ideally the individual measurements or a statistical test, so that the central performance claim is supported.","section":"Section VI.C, Tables IV and V"}],"minor_comments":[{"comment":"The sentence 'Remote attestation has also been used in cloud and edge environments.' appears twice verbatim; remove the duplicate.","section":"Section II.C"},{"comment":"There are several typos and spacing errors: 'mission spporting', 'UA Vs', 'useP CR', and 'compares the PCR values compared to the enrollment baseline'. These should be corrected.","section":"Sections I, II.B, V"},{"comment":"The replay-attack row reports 'Fail if replayed' at every checkpoint, but this is a design assertion rather than an experimental result. It should be either labeled as a protocol-level expectation or accompanied by the same experimental detail as the other attack rows.","section":"Table III"},{"comment":"The paper should define exactly what 'onboarding latency' measures (e.g., time to Registration Accept, time to PDU session establishment) and clarify why the baseline total equals gNB RRC setup plus the standard 5G phases shown in Table IV.","section":"Section VI.A"},{"comment":"The enrollment process is only described in one sentence. The paper should explain how the known-good PCR baseline and the TPM Attestation Key identity are established and stored, since the security of the attestation gate depends on that process.","section":"Section IV.C"}],"recommendation":"major_revision","confidential_remarks":"The central security claim suffers from a concrete protocol-level gap: the absence of channel binding between the attestation evidence and the registration attempt enables a two-radio relay attack even under the paper's stated threat model. This is fixable in scope by re-designing the challenge messages to include a digest of the Registration Request or a session identifier and then re-evaluating. The attack-validation evidence in Table III is also too thin to support the 'blocks four attacks' claim. I recommend major revision rather than rejection because the engineering, latency measurement, and testbed work appear sound and the protocol fix is clear. The prior work by the same group (Ref. [16]) is appropriately cited."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, this is a genuine engineering effort: the authors put dual-PKI device certs and a hardware TPM quote into the 5G registration path on an srsRAN/Open5GS testbed and measured a 373 ms overhead. That part is credible and useful. Second, the central security claim—that the system blocks SIM-transplant and rogue-device registration—is not actually established. The stress-test note is right: the attestation evidence signs only fresh nonces, not the saved Registration Request or a session/AMF identifier. An attacker with a valid USIM can run two SDRs, relay fresh challenges to an enrolled victim UE, and use the victim's valid certificate responses and TPM quote to pass all three checks on its own registration. This violates none of the paper's stated threat-model assumptions: no TPM key is extracted, no CA signature is forged, no PCR is made to match incorrectly. Nonce freshness only stops pure replay of captured evidence; it does not stop a real-time relay.\n\nWhat is genuinely new: the combination of independent outer/inner CA checkpoints with a gNB-side RRC forwarding gate and AMF-side save-and-replay is an original integration. I know of no prior work that inserts TPM attestation into the UE admission path this way, especially without changing 3GPP NAS message structures. The implementation details are concrete—wire protocol message types, PCR 0–7, proxy verification. The latency breakdown is clear and internally consistent; TPM quote generation dominates at 235.7 ms, and certificate verification being ~1 ms locally is plausible.\n\nSoft spots beyond the relay: the attack validation in Table III is a summary, not an experiment. There are no traces, no adversary scripts, no variance, and no released code or raw data. The gNB/AMF/proxy trust assumption is stated, but the relay attack does not need a compromised infrastructure node, so it is a fair attack under the paper's own model. Minor: the prose has typos and some duplicated sentences.\n\nThis paper is for people building tactical 5G admission controls; it gives them a measured integration pattern and a clear latency budget. But as a security paper, the headline claim needs fixing: bind the challenge responses to a digest of the Registration Request and a session/AMF identifier, or explicitly scope the claims to exclude an in-path relay. With that fix the contribution becomes meaningful; without it, the claimed protections are not guaranteed.\n\nI would send it to peer review—the engineering is real and the problem is important—but I would flag the relay issue as the primary revision. It is not a desk reject; it is a revise-and-resubmit that changes the title claim.","headline":"A real integration effort with a load-bearing security flaw: attestation evidence is not bound to the registration request, so the claimed SIM-transplant block can be bypassed with a two-radio relay.","tokens_in":10062,"tokens_out":3932,"would_cite":false,"duration_ms":47002,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A pre-authentication layer can gate 5G registration on device identity and boot integrity without altering 3GPP NAS message structures.","keywords":["5G standalone security","device authentication","TPM 2.0 attestation","boot integrity","dual PKI","SIM transplant","tactical networks","5G-AKA"],"falsifier":"Take an enrolled UE that holds valid outer and inner device certificates, modify its boot firmware so that PCRs 0-7 no longer match the stored baseline, and attempt onboarding; if the attestation proxy ever returns a trusted result and the UE completes registration with a PDU session, the boot-integrity claim is falsified. Repeating the same trial with unchanged firmware should reproduce the paper's reported pass/reject pattern.","tokens_in":9042,"feed_emoji":"📡","tokens_out":14188,"duration_ms":111932,"temperature":0.7,"pith_summary":"The standard 5G authentication procedure verifies the subscriber credential on the USIM but not the physical device holding it or that device's boot state, a gap that matters when field equipment can be captured, modified, and returned to service. Battlefield 5G closes that gap with a pre-authentication layer that runs three checks before the saved registration request is processed: an outer X.509 device-certificate challenge at the base station, an independent inner certificate challenge at the access-management function, and a TPM 2.0 platform-configuration-register quote verified by an attestation proxy in the core. The paper shows these checks can be inserted into the existing registration path without changing any 3GPP NAS message structures, by holding the registration at the radio layer and then saving/replaying it at the core after the checks pass. On a software-defined radio testbed with a hardware TPM, the prototype blocked SIM-transplant, rogue-certificate, firmware-tamper, and replay attacks while adding 373.4 ms of average onboarding latency over a same-testbed baseline.","feed_headline":"Dual certificates and TPM checks gate 5G access with 373 ms overhead","feed_subtitle":"Three pre-registration checks block SIM transplant, firmware tampering, and replay in a live 5G standalone testbed.","key_machinery":"The mechanism that carries the argument is a dual-root PKI wrapped around a suspension-and-resumption path in the protocol stack. Two independent certificate chains -- outer CA for the base station, inner CA for the access-management function -- ensure that possession of one enrolled device key does not unlock both admission gates. A base-station (gNB) RRC forwarding gate holds the NAS Registration Request at the radio layer until the outer certificate response verifies; an access-management function (AMF) save-and-replay mechanism buffers the raw NAS packet and event state, runs the inner certificate and TPM challenges, and re-injects the saved request into the normal mobility-management handler only after an attestation proxy confirms the quote. The TPM quote binds a fresh nonce to early boot measurements through the PCR chain $PCR_{t+1}=H(PCR_t \\parallel m_t)$, so any firmware or bootloader change alters the quoted values. All three exchanges travel over existing RRC/NAS information-transfer paths using a compact custom binary wire protocol with magic byte 0xCA, which is what keeps the scheme compatible with standard 3GPP message structures.","core_discovery":"The paper's central claim is that a 5G Standalone network can demand device identity and boot integrity from the UE before standard registration is allowed to proceed, leaving 5G-AKA itself untouched. Battlefield 5G enforces this with two independent certificate hierarchies, one trusted only by the base station and one trusted only by the core's access-management function, so the same device credential cannot satisfy both checkpoints. After the outer X.509 challenge succeeds, the base station forwards the registration request to the core; the access-management function then pauses, runs the inner certificate exchange and a TPM attestation exchange against an enrolled baseline PCR 0-7 value, and only replays the saved registration request into normal 5G-AKA processing when an attestation proxy reports a trusted result. The prototype's measured outcome is that the four targeted attack classes are stopped and that onboarding latency rises from 1886 ms to 2260 ms on average, with the TPM quote round trip accounting for 235.7 ms of the 373.4 ms added delay while standard security-mode and PDU session procedures remain unchanged.","pith_inferences":["Most of the added latency comes from the 235.7 ms TPM quote round trip, so replacing command-line TPM tools with direct library calls or caching attestation results for a short window could cut the overhead substantially; neither approach is measured in the paper.","The same dual-CA admission pattern could apply to other trust boundaries in 5G, such as network-slice onboarding or edge-host admission, where one device credential should not simultaneously unlock two independent decisions.","The framework assumes the enrolled baseline PCR values stay current; if a legitimate device's firmware or OS is updated without re-enrollment, the attestation proxy would reject a healthy device, making a re-enrollment policy a practical prerequisite for field use."],"forward_implications":["A UE with a valid USIM but no enrolled device certificate is stopped at the gNB, before any registration request reaches the 5G core.","A UE with valid certificates but tampered boot state is stopped at the attestation proxy, where the TPM quote over PCRs 0-7 is compared with the enrolled baseline.","Captured certificate responses and TPM quotes cannot be reused in later sessions because every challenge binds the response to a fresh 32-byte nonce.","Compromise of the outer checkpoint alone does not admit a device, since the AMF still requires the independent inner certificate and the TPM attestation result.","Onboarding latency rises by 373.4 ms on average, dominated by the TPM quote round trip (235.7 ms), while standard 5G-AKA and PDU session procedures remain unchanged."],"supporting_citations":[{"why":"It defines 3GPP 5G-AKA and the security architecture, establishing that the standard authenticates the subscriber credential rather than the device.","marker":"[1]"},{"why":"It supplies the dual-CA separation principle the two independent certificate hierarchies adapt for separate checkpoints.","marker":"[4]"},{"why":"It formally analyzes 5G authentication and shows the protocol's focus on subscriber credentials rather than physical device integrity.","marker":"[5]"},{"why":"It defines TPM 2.0 PCRs, measured boot, quote signing, and attestation keys, the basis for the boot-integrity check.","marker":"[6]"},{"why":"It specifies the attester-verifier-reference-value pattern the TPM quote verification follows.","marker":"[7]"},{"why":"It is prior work by the same authors on TPM-based continuous attestation for 5G network functions, extended here to the UE admission path.","marker":"[16]"},{"why":"It provides the software-defined radio stack for the base station and UE that the prototype modifies to add the outer challenge and forwarding gate.","marker":"[18]"},{"why":"It provides the open-source 5G core whose access-management function is modified for the save-and-replay mechanism.","marker":"[19]"}],"fun_headline_variants":["TPM boot checks and dual certs add 373 ms, block SIM theft","Battlefield 5G stops rogue UEs with TPM attestation in 373 ms","Dual certs + TPM quotes: 373 ms to secure 5G standalone","Pre-registration gate: TPM and dual PKI thwart 4 attack types","5G standalone: 373 ms overhead for hardware-trusted access"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The base station, the access-management function, and the attestation proxy are trusted components in this prototype; if an attacker compromises any one of them, the check that component performs can be skipped, and a compromised access-management function can admit a device with only a valid USIM by simply processing the registration request without running the inner certificate or TPM checks.","fun_headline_variants_meta":{"raw":{"variants":["TPM boot checks and dual certs add 373 ms, block SIM theft","Battlefield 5G stops rogue UEs with TPM attestation in 373 ms","Dual certs + TPM quotes: 373 ms to secure 5G standalone","Pre-registration gate: TPM and dual PKI thwart 4 attack types","5G standalone: 373 ms overhead for hardware-trusted access"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000781,"raw_usage":{"total_tokens":3564,"prompt_tokens":1173,"completion_tokens":2391,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":789,"completion_tokens_details":{"reasoning_tokens":2284}},"tokens_in":789,"tokens_out":2391,"duration_ms":14289,"temperature":1.0,"reasoning_tokens":2284,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:12:06.364508+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take an enrolled UE that holds valid outer and inner device certificates, modify its boot firmware so that PCRs 0-7 no longer match the stored baseline, and attempt onboarding; if the attestation proxy ever returns a trusted result and the UE completes registration with a PDU session, the boot-integrity claim is falsified. Repeating the same trial with unchanged firmware should reproduce the paper's reported pass/reject pattern.","supporting_citations":[{"cited_title":"ETSI TS 133 501 V18.6.0 (2024-07): 5G; Security architecture and procedures for 5G System (3GPP TS 33.501 version 18.6.0 Release 18),","cited_arxiv_id":null,"evidence_quote":"It defines 3GPP 5G-AKA and the security architecture, establishing that the standard authenticates the subscriber credential rather than the device."},{"cited_title":"Commercial Solutions for Classified (CSfC) Key Management Requirements Annex,","cited_arxiv_id":null,"evidence_quote":"It supplies the dual-CA separation principle the two independent certificate hierarchies adapt for separate checkpoints."},{"cited_title":"Trusted Platform Module 2.0 Library Part 1: Architecture,","cited_arxiv_id":null,"evidence_quote":"It defines TPM 2.0 PCRs, measured boot, quote signing, and attestation keys, the basis for the boot-integrity check."},{"cited_title":"Remote attestation procedures (rats) architecture,","cited_arxiv_id":null,"evidence_quote":"It specifies the attester-verifier-reference-value pattern the TPM quote verification follows."},{"cited_title":"Tpm-based continuous remote attestation and integrity verification for 5g vnfs on kubernetes,","cited_arxiv_id":null,"evidence_quote":"It is prior work by the same authors on TPM-based continuous attestation for 5G network functions, extended here to the UE admission path."},{"cited_title":"srsRAN Project: Open-source O-RAN 5G CU/DU solution,","cited_arxiv_id":null,"evidence_quote":"It provides the software-defined radio stack for the base station and UE that the prototype modifies to add the outer challenge and forwarding gate."},{"cited_title":"Open5GS: Open source implementation of 5GC and EPC,","cited_arxiv_id":null,"evidence_quote":"It provides the open-source 5G core whose access-management function is modified for the save-and-replay mechanism."}],"review_version":1}