Pith. sign in

REVIEW 4 major objections 5 minor 69 references

Securing 5G Bootstrapping: A Two-Layer IBS Authentication Protocol

T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a two-layer identity-based signature, E2IBS, can authenticate 5G MIB/SIB1 broadcasts with 111 bytes of overhead and 15.45 µs verification, closing the fake-base-station gap that 5G specifications leave open.

desk verdict Real efficiency gains for 5G broadcast authentication, but the security proof has a gap around adversary-chosen commitments and the robust key generation isn't used in the instantiated protocol. read the letter →

arxiv 2502.04915 v1 pith:DI72BXG3 submitted 2025-02-07 cs.CR cs.NI

Yilu Dong (1) , Rouzbeh Behnia (2) , Attila A. Yavuz (2) , Syed Rafiul Hussain (1) ((1) The Pennsylvania State University , (2) University of South Florida) This is my paper · ORCID
classification cs.CRcs.NI
keywords 5Gsecurityfakebasestationattacksidentity-basedsignaturesbroadcastauthenticationcellularbootstrappinglawfulinterceptionrelayattackSIB1
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

5G leaves the messages a phone hears before it connects—the broadcast System Information blocks—unauthenticated, so a fake base station can lure devices and run denial-of-service, downgrade, or location-tracking attacks. The paper proposes E2IBS, a two-layer identity-based signature scheme, to let a phone verify the base station's identity and the MIB/SIB1 content before attaching. The load-bearing claim is that E2IBS does this cheaply: 111 bytes of communication overhead, 15.45 µs verification at the device, and signing fast enough for the 160 ms broadcast cycle, while remaining existentially unforgeable under chosen-message attacks assuming the elliptic-curve discrete-log problem is hard in the random-oracle model. If correct, this closes a long-standing gap without the certificate overhead that made earlier certificate-based fixes impractical, and it adds a fine-grained key-revocation path for lawful interception. The authors also report an end-to-end integration with an open-source 5G protocol stack, showing negligible impact on the base-station side.

What carries the argument

The central object is the key-additive identity-based signature assembled from a certificate-based construction with the same additive structure: the master public key is a set {Z_1,...,Z_t}; a hash H1(U, C_U) selects k indices; and the signer's secret key is x_U = Σ z_j + u, where u is derived from the identity. This additive form lets the scheme split key generation between the user and the PKG (user picks u1, PKG contributes z_U, final key x_U = u1 + z_U), which is the mechanism that avoids a single point of failure and enables short, sequence-numbered key lifetimes for lawful interception. Signature generation and verification follow the standard discrete-log signature form—s = r − h·x_U, with R' = sP + h(Σ Z[j] + C_U)—so the verifier's expensive operations reduce to point additions and two multiplications. The combinatorial condition C(t,k) ≥ 2^κ ties the parameter trade-off between key size and computation.

What would settle it

Measure the round-trip relay latency of a software-defined radio or low-latency relay that receives a signed SIB1 from a legitimate base station and retransmits it toward a UE; if the relay delay is routinely below the Δt used for that cell configuration, the UE will accept the relayed message and the scheme's authentication can be bypassed without breaking the signature.

Watch

Extended reading notes

Core claim

E2IBS is an identity-based signature whose secret key is the sum of k selected master-key components and a per-signer value, so verification needs only a hash, a few point additions, and two scalar multiplications instead of certificates or pairings. The core-PKG holds the master key; each base station gets an identity U_BS that embeds its cell ID and an expiry timestamp, plus a short-lived secret key. The base station signs the concatenated MIB and SIB1, and the phone checks the signature against the core-PKG public key already provisioned in its USIM, first rejecting any key whose timestamp has expired. The paper claims this scheme is EU-CMA secure under the ECDL assumption in the random-oracle model, that the split-key generation of Algorithm 2 prevents a compromised core-PKG from forging user keys, and that the resulting overhead (111 bytes, 21.48 µs end-to-end cryptographic delay on the test hardware) is the smallest among the compared certificate- and identity-based alternatives.

Load-bearing premise

The scheme's relay-attack defense assumes that an operator-configured time bound Δt = Δt_conf + Δt_sign is small enough to catch any adversarial retransmission of a signed SIB1; if a relay can resend the captured signed message within that window, the fake base station still passes authentication.

Editorial extensions

If this is right

  • A UE can cryptographically authenticate the minimum System Information before deciding to attach, so a fake base station can no longer pass itself off as legitimate by broadcasting unauthenticated messages.
  • The 111-byte overhead fits inside the spare space of SIB1, so operators can deploy the scheme without reserving new radio resources or enlarging the broadcast.
  • At 15.45 µs per verification, the added energy cost on a phone is small, which matters as 5G shifts to smaller cells and more frequent handovers.
  • Lawful interception can be time- and location-bounded: sequence-numbered keys expire after 10 minutes by default, and a compromised core-PKG alone cannot mint valid user keys.
  • If the scheme were adopted in cellular standards, the root cause of fake-base-station attacks—unauthenticated bootstrapping—would be removed at the source rather than patched by detection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The relay-attack defense depends on a per-cell time bound Δt; I would want a measurement of adversarial relay latency on real radio hardware before trusting it, because a relay that forwards faster than Δt still passes authentication.
  • The split-key trick could be lifted out of 5G: any identity-based system that stores all user keys in one PKG could use the same user-chosen component to shrink the trusted-computing base.
  • The paper's phone-side cost was measured on a desktop-class machine with software radios; a benchmark on a production phone baseband would be the natural next check, since the 84% SIB1 processing increase might not hold on constrained hardware.
  • Roaming support requires the home operator to sign the roaming operator's public key and provision it over non-3GPP access networks; the paper leaves the secure transport of that provisioning step unspecified, which a deployment would need to fill in.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes E2IBS, a two-layer identity-based signature scheme intended to authenticate 5G MIB/SIB1 broadcast messages and mitigate fake base station attacks. The scheme replaces the hierarchical Schnorr-HIBS design with a core-PKG/base-station two-layer structure, and the authors claim EU-CMA security under the ECDL assumption in the random oracle model, resilience against PKG compromise, fine-grained lawful interception, and relay-attack protection. The paper reports an OpenAirInterface implementation with USRP radios and benchmarks showing 15.45 us verification and 111 bytes of over-the-air overhead, roughly 2x faster verification than the authors' earlier Schnorr-HIBS.

Significance. If the security and robustness claims were fully supported, E2IBS would be a meaningful step toward practical authentication of the 5G bootstrapping phase. The concrete contributions are real: the scheme is implemented on OpenAirInterface, the code is open-sourced, and the reported performance numbers appear reproducible and useful for protocol designers. The efficiency advantage over certificate-based alternatives is credible. However, the central security proof has gaps concerning adversary-chosen commitments, and the claimed PKG-compromise resilience and lawful-interception mechanism are not supported by the protocol as specified. These issues directly affect the load-bearing claims of the paper, so the result is not yet acceptable in its current form.

major comments (4)
  1. [Section V-B, Theorem 1] The proof does not handle adversary-chosen commitments C_U*. In the EU-CMA experiment of Definition 2, Verify takes C_U as an input, and in the Section VI-C protocol the value P_KBS, which plays the role of C_U, is transmitted alongside the signature. A forging adversary can therefore supply an arbitrary C_U* that was never generated by the simulator. After applying the forking lemma, the reduction would obtain the discrete logarithm of the combined value sum_i Z_{j_i} + C_U*, and if C_U* is adversary-chosen the reduction cannot isolate the ECDL target Z_{j*}. The proof needs either a game in which C_U is generated and registered by the challenger, or an explicit argument showing how the reduction succeeds for arbitrary C_U*.
  2. [Section V-B, Theorem 1 proof] The proof sketch is incomplete in several internal places. It refers to an H3-sim oracle that is never defined, while Algorithm 1 Verify uses H2; the OSign simulation for users whose H1 output contains j* is only described as 'works similarly to Schnorr Signature' without specifying the simulation; and the final forking-lemma step does not write out the two signature equations from which the ECDL solution is derived. These omissions leave the main security theorem unverified as written.
  3. [Section V-A and Corollary 1] Algorithm 2 does not achieve the claimed PKG-compromise resilience. Because the user supplies Q_U and the final commitment is C_U = Q_U + B_U, with no registration or other mechanism binding C_U to U, an adversary that has compromised the PKG can choose its own u_1', compute Q_U' = u_1'P, run Extract(msk, Q_U'), and obtain a valid signing key for the same identity U but with a different commitment C_U'. The verifier only checks the equation involving C_U' and H1(U, C_U'), so the impersonation succeeds. The 'binding property' asserted in the proof of Corollary 1 is therefore not present in the scheme as specified. In addition, Section VI-C instantiates the protocol with the Algorithm 1 Extract rather than Algorithm 2, so the claimed robust key generation and fine-grained lawful interception are not actually integrated into the protocol.
  4. [Section VI-E] The relay-attack defense relies on an unvalidated assumption that a configuration-specific time bound delta_t can separate legitimate transmissions from adversarial retransmissions. Any adversary that relays the signed SIB1 within delta_t, or uses hardware faster than the assumed delta_t_conf, passes the check; the paper provides no measurement or analysis bounding adversarial relay latency. The text itself acknowledges that a fixed bound is impractical for varying base station configurations. The claim of relay-attack resilience should be weakened, or the assumption should be formalized and validated experimentally.
minor comments (5)
  1. [Section II and Algorithm 1] H3 is used in Section VI-C step 4 and in the proof of Theorem 1 but is never defined, while Algorithm 1 Verify uses H2. Please unify the hash function notation throughout.
  2. [Section V-A, Algorithm 2] The prose states that a sequence number t is included in the H1 input during Extract, but the pseudocode calls H1(U, C_U) with no sequence number.
  3. [Section V-B, OCorrupt simulation] The line 'selects u, computes U <- uP mod q' appears to assign a point to the identity U; this should be C_U <- uP.
  4. [Section VII-B, Table II] The text states that 'both our scheme and Schnorr-HIBS are identity-based and pairing-based', but E2IBS as specified uses no pairings, and Table II's scheme type column does not classify it as pairing-based.
  5. [Section VII-C, Table III] The 84% increase in SIB1 processing time at the UE is described as 'negligible'; please quantify the user-perceived impact and justify this characterization in the context of the 160 ms SIB1 periodicity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: E2IBS explicitly adapts published ARIS/Tachyon constructions, and its claimed efficiency and security rest on measured benchmarks and an ECDL reduction rather than on its own outputs.

full rationale

The paper transparently states that E2IBS is derived from the certificate-based ARIS scheme and that its parameter selection and security arguments are 'similar to' the authors' earlier Tachyon and ARIS work. This is a normal reliance on prior published constructions by overlapping authors, not a hidden reuse of the paper's own target result. The core verification equation is internally consistent: with skU = sum zji + u and s = r - h*skU, the verifier computes R' = sP + h(sum Zji + CU) = rP, so correctness is an algebraic identity inside the paper rather than an imported conclusion. The efficiency claims are supported by measured microbenchmark numbers (6.04 us signing, 15.45 us verification) and an OpenAirInterface prototype, and the communication overhead is a direct byte count, not a fitted value. The EU-CMA claim is presented as a reduction to ECDL using the external forking lemma; while the proof sketch is incomplete regarding adversary-chosen CU*, that is a soundness gap, not a circular step. No equation or performance result reduces to its own inputs by construction, and the self-citations to ARIS, Tachyon, and Schnorr-HIBS serve as prior work and baselines rather than as the sole justification of the central claim.

Assumptions & free parameters 5 free parameters · 6 assumptions · 1 invented entities

The scheme's correctness depends on ECDL and the random oracle model, plus the ARIS/Tachyon k-subset combinatorial assumption from the authors' prior work. Operational values (key validity periods, delta_t_conf) are hand-chosen and not empirically validated, and the core-PKG is an assumed trusted component.

free parameters (5)
  • t (number of mpk elements) = 1024 in evaluation
    Chosen by hand to make C(t,k) >= 2^128. Larger t increases mpk size and enables smaller k, trading key storage for verification speed.
  • k (subset size in signing key) = 18 in evaluation
    Chosen with t=1024 to reach 128-bit security for the k-combinatorial problem; directly controls signing and verification cost.
  • Core-PKG key validity period = 1 year (default)
    Operationally chosen; determines how often the operator must push a new root public key to USIMs.
  • Base station key validity period = 10 minutes (default)
    Operationally chosen; limits the window in which a compromised base station key can be used, but requires frequent key extraction.
  • delta_t_conf (relay time bound) = not specified, operator-configured
    Used in Section VI-E to bound relay attacks; no concrete value or validation is provided, so the relay defense rests on this unmeasured quantity.
assumptions (6)
  • standard math The Elliptic Curve Discrete Logarithm problem is hard.
    Theorem 1 reduces EU-CMA security of E2IBS to ECDL, a standard cryptographic assumption.
  • domain assumption Hash functions H1 and H2 (and H3 in the proof) behave as random oracles.
    Section V, Notations and Theorem 1 proof. The security reduction is in the random oracle model, not the standard model.
  • domain assumption The adversary cannot guess the k-subset selected by H1 among C(t,k) possibilities.
    Section V Setup. Security depends on the t-choose-k subset selection used in ARIS/Tachyon [25,34].
  • domain assumption The adversary cannot physically tamper with UEs, base stations, core network components, or extract keys from a USIM.
    Section IV adversary model explicitly excludes physical tampering with legitimate components.
  • domain assumption A confidentiality and integrity-protected channel exists to update the core-PKG public key stored in the USIM.
    Section VI-C initialization phase relies on the post-authentication AMF-UE protected channel for root key replacement.
  • ad hoc to paper The time bound delta_t can separate legitimate base station transmissions from adversarial relays.
    Section VI-E relay defense: delta_t = delta_t_conf + delta_t_sign is operator-configured and not empirically validated.
invented entities (1)
  • core-PKG co-located with AUSF
    purpose: Root key generator that issues base station signing keys from NRCell_ID and expiry timestamp; replaces hierarchical AMF-level PKGs.
    A protocol architecture choice, not a separately verified device; its security is assumed rather than demonstrated, and no falsifiable external handle is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Securing 5G Bootstrapping: A Two-Layer IBS Authentication Protocol." pith.science (2026). https://pith.science/paper/DI72BXG3

@misc{pith2026250204915,
  author       = {Pith},
  title        = {Pith review of: Securing 5G Bootstrapping: A Two-Layer IBS Authentication Protocol},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DI72BXG3}},
  note         = {Machine review of arXiv:2502.04915}
}
read the original abstract

The lack of authentication during the initial bootstrapping phase between cellular devices and base stations allows attackers to deploy fake base stations and send malicious messages to the devices. These attacks have been a long-existing problem in cellular networks, enabling adversaries to launch denial-of-service (DoS), information leakage, and location-tracking attacks. While some defense mechanisms are introduced in 5G, (e.g., encrypting user identifiers to mitigate IMSI catchers), the initial communication between devices and base stations remains unauthenticated, leaving a critical security gap. To address this, we propose E2IBS, a novel and efficient two-layer identity-based signature scheme designed for seamless integration with existing cellular protocols. We implement E2IBS on an open-source 5G stack and conduct a comprehensive performance evaluation against alternative solutions. Compared to the state-of-the-art Schnorr-HIBS, E2IBS reduces attack surfaces, enables fine-grained lawful interception, and achieves 2x speed in verification, making it a practical solution for securing 5G base station authentication.

Figures

Figures reproduced from arXiv: 2502.04915 by the authors.

Figure 1
Figure 1. Cellular Network Architecture. UE and the base stations. The UE listens for SI messages and connects to the base station with the highest signal strength. 5GC is the brain of the 5G cellular network and houses several components to provide services to the UEs. An important component is the Access and Mobility Management Function (AMF). supports UE authentication, mobility management, and paging, handles the NAS laye… view at source ↗
Figure 3
Figure 3. Instantiation of Schnorr-HIBS. For UBS we use a concatenation of NRCell_ID [37] and an expiry timestamp. NRCell_ID is a string of size 36 bits and uniquely identifies a base station for a particular mobile network operator. Each expiry timestamp is 32 bits long. Therefore, UBS can be a maximum of 9 bytes. Validity period of the keys. Instead of using complex key revocation techniques, we assign different validity pe… view at source ↗
Figure 4
Figure 4. Our protocol for authenticating 5G cellular base stations. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 67 canonical work pages

  1. [1]

    Imsi- catch me if you can: Imsi-catcher-catchers,

    A. Dabrowski, N. Pianta, T. Klepp, M. Mulazzani, and E. Weippl, “Imsi- catch me if you can: Imsi-catcher-catchers,” in Proceedings of the 30th annual computer security applications Conference , 2014, pp. 246–255

    work page 2014

  2. [2]

    Insecure connection bootstrapping in cellular networks: the root of all evil,

    S. R. Hussain, M. Echeverria, A. Singla, O. Chowdhury, and E. Bertino, “Insecure connection bootstrapping in cellular networks: the root of all evil,” in Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks , 2019, pp. 1–11

    work page 2019

  3. [3]

    Hiding in plain signal: Physical signal overshadowing attack on {LTE},

    H. Yang, S. Bae, M. Son, H. Kim, S. M. Kim, and Y . Kim, “Hiding in plain signal: Physical signal overshadowing attack on {LTE},” in 28th USENIX Security Symposium (USENIX Security 19) , 2019, pp. 55–72

    work page 2019

  4. [4]

    Breaking lte on layer two,

    D. Rupprecht, K. Kohls, T. Holz, and C. P ¨opper, “Breaking lte on layer two,” in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 1121–1136

    work page 2019

  5. [5]

    Practical attacks against privacy and availability in 4g/lte mobile communication systems,

    A. Shaik, J. Seifert, R. Borgaonkar, N. Asokan, and V . Niemi, “Practical attacks against privacy and availability in 4g/lte mobile communication systems,” in 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21-24,

    work page 2016

  6. [6]

    Lteinspector: A systematic approach for adversarial testing of 4g lte,

    S. Hussain, O. Chowdhury, S. Mehnaz, and E. Bertino, “Lteinspector: A systematic approach for adversarial testing of 4g lte,” in Network and Distributed Systems Security (NDSS) Symposium 2018 , 2018

    work page 2018

  7. [7]

    5greasoner: A property-directed security and privacy analysis frame- work for 5g cellular network protocol,

    S. R. Hussain, M. Echeverria, I. Karim, O. Chowdhury, and E. Bertino, “5greasoner: A property-directed security and privacy analysis frame- work for 5g cellular network protocol,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , 2019, pp. 669–684

    work page 2019

  8. [8]

    3GPP, Specification number TR 33.809 version 0.8.0, Study on 5G security enhancements against false base stations,

    “3GPP, Specification number TR 33.809 version 0.8.0, Study on 5G security enhancements against false base stations,” 2020

    work page 2020

Show all 69 references
  1. [9]

    On the impact of rogue base stations in 4g/lte self organizing networks,

    A. Shaik, R. Borgaonkar, S. Park, and J.-P. Seifert, “On the impact of rogue base stations in 4g/lte self organizing networks,” in Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks, 2018, pp. 75–86

    2018

  2. [10]

    State machine mutation-based testing framework for wireless communication protocols,

    S. M. M. Rashid, T. Wu, K. Tu, A. A. Ishtiaq, R. H. Tanvir, Y . Dong, O. Chowdhury, and S. R. Hussain, “State machine mutation-based testing framework for wireless communication protocols,” in Proceed- ings of the 2024 on ACM SIGSAC Conference on Computer and Communications Se...

    2024

  3. [11]

    New vulnerabilities in 4g and 5g cellular access network protocols: exposing device capa- bilities,

    A. Shaik, R. Borgaonkar, S. Park, and J.-P. Seifert, “New vulnerabilities in 4g and 5g cellular access network protocols: exposing device capa- bilities,” in Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks , 2019, pp. 221–231

    2019

  4. [12]

    Logic gone astray: A security analysis framework for the control plane protocols of 5g basebands,

    K. Tu, A. A. Ishtiaq, S. M. M. Rashid, Y . Dong, W. Wang, T. Wu, and S. R. Hussain, “Logic gone astray: A security analysis framework for the control plane protocols of 5g basebands,” in 33rd USENIX Security Symposium (USENIX Security 24) . Philadelphia, PA: USENIX Association...

    2024

  5. [13]

    5g suci-catchers: Still catching them all?

    M. Chlosta, D. Rupprecht, C. P ¨opper, and T. Holz, “5g suci-catchers: Still catching them all?” in Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks , 2021, pp. 359–364

    2021

  6. [14]

    {DoLTEst}: In-depth downlink negative testing framework for {LTE} devices,

    C. Park, S. Bae, B. Oh, J. Lee, E. Lee, I. Yun, and Y . Kim, “ {DoLTEst}: In-depth downlink negative testing framework for {LTE} devices,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 1325–1342

    2022

  7. [15]

    Touching the untouchables: Dynamic security analysis of the lte control plane,

    H. Kim, J. Lee, E. Lee, and Y . Kim, “Touching the untouchables: Dynamic security analysis of the lte control plane,” in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 1153–1168

    2019

  8. [16]

    3GPP, Specification number TR 21.915 version 15.0.0, Release De- scription; Release 15,

    “3GPP, Specification number TR 21.915 version 15.0.0, Release De- scription; Release 15,” 2019

    2019

  9. [17]

    An extended certificate-based authentication and security protocol for mobile networks,

    C.-C. Lee, I.-E. Liao, and M.-S. Hwang, “An extended certificate-based authentication and security protocol for mobile networks,” Information Technology and Control, vol. 38, no. 1, 2009

    2009

  10. [18]

    An optimized protocol for mobile network authentication and security,

    X. Yi, E. Okamoto, and K. Y . Lam, “An optimized protocol for mobile network authentication and security,” ACM SIGMOBILE Mobile Computing and Communications Review, vol. 2, no. 3, pp. 37–39, 1998

    1998

  11. [19]

    An authentication and security protocol for mobile comput- ing,

    Y . Zheng, “An authentication and security protocol for mobile comput- ing,” in Mobile Communications. Springer, 1996, pp. 249–257

    1996

  12. [20]

    On evaluating delegated digital signing of broadcasting messages in 5g,

    H. Gao, Y . Zhang, T. Wan, J. Zhang, and H. Duan, “On evaluating delegated digital signing of broadcasting messages in 5g,” in 2021 IEEE global communications conference (GLOBECOM). IEEE, 2021, pp. 1– 7

    2021

  13. [21]

    Short signatures from the weil pairing,

    D. Boneh, B. Lynn, and H. Shacham, “Short signatures from the weil pairing,” in International Conference on the Theory and Application of Cryptology and Information Security . Springer, 2001, pp. 514–532

    2001

  14. [22]

    The sm9 cryptographic schemes,

    Z. Cheng, “The sm9 cryptographic schemes,” Cryptology ePrint Archive, 2017

    2017

  15. [23]

    Ieee approved draft standard for identity-based cryptographic tech- niques using pairings,

    “Ieee approved draft standard for identity-based cryptographic tech- niques using pairings,” IEEE P1363.3/D8, April 2013 , pp. 1–136, 2013

    2013

  16. [24]

    Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,

    A. Singla, R. Behnia, S. R. Hussain, A. Yavuz, and E. Bertino, “Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security , 2021, pp. 501–515

    2021

  17. [25]

    ARIS: Authentication for real-time IoT systems,

    R. Behnia, M. O. Ozmen, and A. A. Yavuz, “ARIS: Authentication for real-time IoT systems,” in IEEE International Conference on Commu- nications (ICC) , ser. ICC. New York, NY , USA: ACM, 2019, pp. 1855–1867

    2019

  18. [26]

    E2IBS-5G-Authentication, https://github.com/SyNSec-den/ E2IBS-5G-Authentication

  19. [27]

    Random oracles are practical: A paradigm for designing efficient protocols,

    M. Bellare and P. Rogaway, “Random oracles are practical: A paradigm for designing efficient protocols,” in Proceedings of the 1st ACM conference on Computer and Communications Security (CCS ’93) . NY , USA: ACM, 1993, pp. 62–73

    1993

  20. [28]

    Imsi catcher,

    D. Strobel, “Imsi catcher,” Chair for Communication Security, Ruhr- Universit¨at Bochum, vol. 14, 2007

    2007

  21. [29]

    Practical cellphone spying,

    C. Paget, “Practical cellphone spying,” Def Con, vol. 18, 2010

    2010

  22. [30]

    Location leaks on the gsm air interface,

    D. F. Kune, J. Koelndorfer, N. Hopper, and Y . Kim, “Location leaks on the gsm air interface,” ISOC NDSS (Feb 2012) , 2012

    2012

  23. [31]

    Measuring the deployment of 5g security enhancement,

    S. Nie, Y . Zhang, T. Wan, H. Duan, and S. Li, “Measuring the deployment of 5g security enhancement,” in Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2022, pp. 169–174

    2022

  24. [32]

    On the security of public key protocols,

    D. Dolev and A. Yao, “On the security of public key protocols,” IEEE Transactions on information theory , vol. 29, no. 2, pp. 198–208, 1983

    1983

  25. [33]

    Efficient signature generation by smart cards,

    C. Schnorr, “Efficient signature generation by smart cards,” Journal of Cryptology, vol. 4, no. 3, pp. 161–174, 1991

    1991

  26. [34]

    Tachyon: Fast signatures from compact knapsack,

    R. Behnia, M. O. Ozmen, A. A. Yavuz, and M. Rosulek, “Tachyon: Fast signatures from compact knapsack,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’18. New York, NY , USA: ACM, 2018, pp. 1855–1867

    2018

  27. [35]

    Multi-signatures in the plain public-key model and a general forking lemma,

    M. Bellare and G. Neven, “Multi-signatures in the plain public-key model and a general forking lemma,” in Proceedings of the 13th ACM Conference on Computer and Communications Security , ser. CCS ’06. New York, NY , USA: ACM, 2006, pp. 390–399

    2006

  28. [36]

    3GPP, Specification number TS 38.331 version 15.9.0, Radio Resource Control (RRC); Protocol specification,

    “3GPP, Specification number TS 38.331 version 15.9.0, Radio Resource Control (RRC); Protocol specification,” 2020

    2020

  29. [37]

    3GPP, Specification number TS 29.571 version 15.6.0, Common Data Types for Service Based Interfaces,

    “3GPP, Specification number TS 29.571 version 15.6.0, Common Data Types for Service Based Interfaces,” 2020

    2020

  30. [38]

    Realization of rf distance bounding

    K. B. Rasmussen and S. Capkun, “Realization of rf distance bounding.” in USENIX Security Symposium , 2010, pp. 389–402

    2010

  31. [39]

    Uwb rapid-bit-exchange system for distance bounding,

    N. O. Tippenhauer, H. Luecken, M. Kuhn, and S. Capkun, “Uwb rapid-bit-exchange system for distance bounding,” in Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks, 2015, pp. 1–12

    2015

  32. [40]

    A formal approach to distance-bounding rfid protocols,

    U. D ¨urholz, M. Fischlin, M. Kasper, and C. Onete, “A formal approach to distance-bounding rfid protocols,” in International Conference on Information Security. Springer, 2011, pp. 47–62

    2011

  33. [41]

    3GPP, Specification number TS 38.104 version 15.9.0, Base Station (BS) radio transmission and reception,

    “3GPP, Specification number TS 38.104 version 15.9.0, Base Station (BS) radio transmission and reception,” 2020

    2020

  34. [42]

    PBC: Pairing-Based Cryptography Library,

    “PBC: Pairing-Based Cryptography Library,” https://crypto.stanford.edu/ pbc/, 2020

    2020

  35. [43]

    FourQlib,

    “FourQlib,” https://www.microsoft.com/en-us/research/project/fourqlib/, 2020

    2020

  36. [44]

    OpenAirInterface,

    “OpenAirInterface,” https://www.openairinterface.org/, 2020. 13

    2020

  37. [45]

    USRP B210,

    “USRP B210,” https://www.ettus.com/all-products/UB210-KIT/, 2020

    2020

  38. [46]

    Identity-based signatures,

    E. Kiltz and G. Neven, “Identity-based signatures,” in Identity-Based Cryptography, 2009, pp. 31–44

    2009

  39. [47]

    Elliptic curve-based certificateless signatures for identity- based encryption (eccsi),

    M. Groves, “Elliptic curve-based certificateless signatures for identity- based encryption (eccsi),” Internet Engineering Task Force (IETF), RFC 6507, 2012

    2012

  40. [48]

    Self-certified public key generation on the intel mote 2 sensor network platform,

    O. Arazi, I. Elhanany, D. Rose, H. Qi, and B. Arazi, “Self-certified public key generation on the intel mote 2 sensor network platform,” in 2006 2nd IEEE Workshop on Wireless Mesh Networks , 2006, pp. 118–120

    2006

  41. [49]

    Load-balanced key establishment methodologies in wireless sensor networks,

    O. Araz and H. Qi, “Load-balanced key establishment methodologies in wireless sensor networks,” International Journal of Security and Networks, vol. 1, no. 3-4, pp. 158–166, 2006

    2006

  42. [50]

    Short paper: A new identity-based dh key-agreement protocol for wireless sensor networks based on the arazi-qi scheme,

    I. Hang, M. Ullmann, and C. Wieschebrink, “Short paper: A new identity-based dh key-agreement protocol for wireless sensor networks based on the arazi-qi scheme,” in Proceedings of the Fourth ACM Conference on Wireless Network Security , ser. WiSec ’11. New York, NY , USA: Ass...

    2011

  43. [51]

    The elliptic curve digital sig- nature algorithm (ecdsa),

    D. Johnson, A. Menezes, and S. Vanstone, “The elliptic curve digital sig- nature algorithm (ecdsa),” International journal of information security , vol. 1, no. 1, pp. 36–63, 2001

    2001

  44. [52]

    Real-time digital signatures for time-critical networks,

    A. A. Yavuz, A. Mudgerikar, A. Singla, I. Papapanagiotou, and E. Bertino, “Real-time digital signatures for time-critical networks,” IEEE Transactions on Information Forensics and Security , vol. 12, no. 11, pp. 2627–2639, 2017

    2017

  45. [53]

    Schnorrq: Schnorr signatures on fourq,

    C. Costello and P. Longa, “Schnorrq: Schnorr signatures on fourq,” MSR Tech Report, 2016. Available at: https://www. microsoft. com/en-us/research/wp-content/uploads/2016/07/SchnorrQ. pdf, Tech. Rep., 2016

    2016

  46. [54]

    BlueKrypt: Cryptographic Key Recommendation,

    “BlueKrypt: Cryptographic Key Recommendation,” https: //www.keylength.com/en/4/, 2020

    2020

  47. [55]

    3GPP, Specification number TS 33.501 version 15.8.0, Security archi- tecture and procedures for 5G System,

    “3GPP, Specification number TS 33.501 version 15.8.0, Security archi- tecture and procedures for 5G System,” 2020

    2020

  48. [56]

    Rogue base station detection using a machine learning approach,

    J. Jin, C. Lian, and M. Xu, “Rogue base station detection using a machine learning approach,” in 2019 28th Wireless and Optical Communications Conference (WOCC) . IEEE, 2019, pp. 1–5

    2019

  49. [57]

    Detecting imsi-catcher using soft computing,

    T. Van Do, H. T. Nguyen, N. Momchil et al. , “Detecting imsi-catcher using soft computing,” in International Conference on Soft Computing in Data Science . Springer, 2015, pp. 129–140

    2015

  50. [58]

    Strengthening mobile network security using machine learning,

    P. Engelstad, B. Feng, T. van Do et al., “Strengthening mobile network security using machine learning,” in International Conference on Mobile Web and Information Systems . Springer, 2016, pp. 173–183

    2016

  51. [59]

    A network based imsi catcher detection,

    S. Steig, A. Aarnes, T. Van Do, and H. T. Nguyen, “A network based imsi catcher detection,” in 2016 6th International Conference on IT Convergence and Security (ICITCS) . IEEE, 2016, pp. 1–6

    2016

  52. [60]

    Imsi catcher detection method for cellular networks,

    H. Alrashede and R. A. Shaikh, “Imsi catcher detection method for cellular networks,” in 2019 2nd International Conference on Computer Applications & Information Security (ICCAIS) . IEEE, 2019, pp. 1–6

    2019

  53. [61]

    The messenger shoots back: Network operator based imsi catcher detection,

    A. Dabrowski, G. Petzl, and E. R. Weippl, “The messenger shoots back: Network operator based imsi catcher detection,” in International Symposium on Research in Attacks, Intrusions, and Defenses . Springer, 2016, pp. 279–302

    2016

  54. [62]

    Fbs-radar: Uncovering fake base stations at scale in the wild

    Z. Li, W. Wang, C. Wilson, J. Chen, C. Qian, T. Jung, L. Zhang, K. Liu, X. Li, and Y . Liu, “Fbs-radar: Uncovering fake base stations at scale in the wild.” in NDSS, 2017

    2017

  55. [63]

    Rehand: Secure region-based fast handover with user anonymity for small cell networks in mobile communications,

    C.-I. Fan, J.-J. Huang, M.-Z. Zhong, R.-H. Hsu, W.-T. Chen, and J. Lee, “Rehand: Secure region-based fast handover with user anonymity for small cell networks in mobile communications,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 927–942, 2019

    2019

  56. [64]

    Privacy-aware secure region- based handover for small cell networks in 5g-enabled mobile commu- nication,

    R. Alnashwan, P. Gope, and B. Dowling, “Privacy-aware secure region- based handover for small cell networks in 5g-enabled mobile commu- nication,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 1898–1913, 2023

    1913

  57. [65]

    Strong privacy-preserving universally composable aka protocol with seamless handover support for mobile virtual network operator,

    R. Alnashwan, Y . Yang, Y . Dong, P. Gope, B. Abdolmaleki, and S. R. Hussain, “Strong privacy-preserving universally composable aka protocol with seamless handover support for mobile virtual network operator,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and...

    2024

  58. [66]

    Iboost: a lightweight provably secure identity-based online/offline signature technique based on fcm for massive devices in 5g wireless sensor networks,

    C. Meshram, A. L. Imoize, A. Elhassouny, A. Aljaedi, A. R. Alharbi, and S. S. Jamal, “Iboost: a lightweight provably secure identity-based online/offline signature technique based on fcm for massive devices in 5g wireless sensor networks,” IEEE Access, vol. 9, pp. 131 336–131 ...

    2021

  59. [67]

    Identity-based key management scheme for secure discussion group establishment in dosns,

    L. Zhang, W. Han, R. Zhang, L. Wang, and X. Meng, “Identity-based key management scheme for secure discussion group establishment in dosns,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 3706–3719, 2023

    2023

  60. [68]

    Realizing fully secure unrestricted id-based ring signature in the standard model based on hibe,

    M. H. Au, J. K. Liu, W. Susilo, and J. Zhou, “Realizing fully secure unrestricted id-based ring signature in the standard model based on hibe,” IEEE Transactions on Information Forensics and Security, vol. 8, no. 12, pp. 1909–1922, 2013. Yilu Dong is a Ph.D. student at Penn St...

    2011

  61. [2016]

    The Internet Society, 2016

    2016

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.