Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks

Al Nahian Bin Emran; Arupjyoti Bhuyan; Duminda Wijesekera; Lisa Donnan; Rajendra Paudyal; Rajendra Upadhyay

REVIEW 3 major objections 5 minor 19 references

Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A pre-authentication layer can gate 5G registration on device identity and boot integrity without altering 3GPP NAS message structures.

desk verdict A real integration effort with a load-bearing security flaw: attestation evidence is not bound to the registration request, so the claimed SIM-transplant block can be bypassed with a two-radio relay. read the letter →

arxiv 2608.11293 v1 pith:ZU6WFFPK submitted 2026-08-11 cs.CR

Al Nahian Bin Emran , Rajendra Paudyal , Rajendra Upadhyay , Lisa Donnan , Arupjyoti Bhuyan , Duminda Wijesekera This is my paper · ORCID

classification cs.CR

keywords 5GstandalonesecuritydeviceauthenticationTPM2.0attestationbootintegritydualPKISIMtransplanttacticalnetworks5G-AKA

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The standard 5G authentication procedure verifies the subscriber credential on the USIM but not the physical device holding it or that device's boot state, a gap that matters when field equipment can be captured, modified, and returned to service. Battlefield 5G closes that gap with a pre-authentication layer that runs three checks before the saved registration request is processed: an outer X.509 device-certificate challenge at the base station, an independent inner certificate challenge at the access-management function, and a TPM 2.0 platform-configuration-register quote verified by an attestation proxy in the core. The paper shows these checks can be inserted into the existing registration path without changing any 3GPP NAS message structures, by holding the registration at the radio layer and then saving/replaying it at the core after the checks pass. On a software-defined radio testbed with a hardware TPM, the prototype blocked SIM-transplant, rogue-certificate, firmware-tamper, and replay attacks while adding 373.4 ms of average onboarding latency over a same-testbed baseline.

What carries the argument

The mechanism that carries the argument is a dual-root PKI wrapped around a suspension-and-resumption path in the protocol stack. Two independent certificate chains -- outer CA for the base station, inner CA for the access-management function -- ensure that possession of one enrolled device key does not unlock both admission gates. A base-station (gNB) RRC forwarding gate holds the NAS Registration Request at the radio layer until the outer certificate response verifies; an access-management function (AMF) save-and-replay mechanism buffers the raw NAS packet and event state, runs the inner certificate and TPM challenges, and re-injects the saved request into the normal mobility-management handler only after an attestation proxy confirms the quote. The TPM quote binds a fresh nonce to early boot measurements through the PCR chain $PCR_{t+1}=H(PCR_t \parallel m_t)$, so any firmware or bootloader change alters the quoted values. All three exchanges travel over existing RRC/NAS information-transfer paths using a compact custom binary wire protocol with magic byte 0xCA, which is what keeps the scheme compatible with standard 3GPP message structures.

What would settle it

Take an enrolled UE that holds valid outer and inner device certificates, modify its boot firmware so that PCRs 0-7 no longer match the stored baseline, and attempt onboarding; if the attestation proxy ever returns a trusted result and the UE completes registration with a PDU session, the boot-integrity claim is falsified. Repeating the same trial with unchanged firmware should reproduce the paper's reported pass/reject pattern.

Watch

Extended reading notes

Core claim

The paper's central claim is that a 5G Standalone network can demand device identity and boot integrity from the UE before standard registration is allowed to proceed, leaving 5G-AKA itself untouched. Battlefield 5G enforces this with two independent certificate hierarchies, one trusted only by the base station and one trusted only by the core's access-management function, so the same device credential cannot satisfy both checkpoints. After the outer X.509 challenge succeeds, the base station forwards the registration request to the core; the access-management function then pauses, runs the inner certificate exchange and a TPM attestation exchange against an enrolled baseline PCR 0-7 value, and only replays the saved registration request into normal 5G-AKA processing when an attestation proxy reports a trusted result. The prototype's measured outcome is that the four targeted attack classes are stopped and that onboarding latency rises from 1886 ms to 2260 ms on average, with the TPM quote round trip accounting for 235.7 ms of the 373.4 ms added delay while standard security-mode and PDU session procedures remain unchanged.

Load-bearing premise

The base station, the access-management function, and the attestation proxy are trusted components in this prototype; if an attacker compromises any one of them, the check that component performs can be skipped, and a compromised access-management function can admit a device with only a valid USIM by simply processing the registration request without running the inner certificate or TPM checks.

Editorial extensions

If this is right

A UE with a valid USIM but no enrolled device certificate is stopped at the gNB, before any registration request reaches the 5G core.
A UE with valid certificates but tampered boot state is stopped at the attestation proxy, where the TPM quote over PCRs 0-7 is compared with the enrolled baseline.
Captured certificate responses and TPM quotes cannot be reused in later sessions because every challenge binds the response to a fresh 32-byte nonce.
Compromise of the outer checkpoint alone does not admit a device, since the AMF still requires the independent inner certificate and the TPM attestation result.
Onboarding latency rises by 373.4 ms on average, dominated by the TPM quote round trip (235.7 ms), while standard 5G-AKA and PDU session procedures remain unchanged.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Most of the added latency comes from the 235.7 ms TPM quote round trip, so replacing command-line TPM tools with direct library calls or caching attestation results for a short window could cut the overhead substantially; neither approach is measured in the paper.
The same dual-CA admission pattern could apply to other trust boundaries in 5G, such as network-slice onboarding or edge-host admission, where one device credential should not simultaneously unlock two independent decisions.
The framework assumes the enrolled baseline PCR values stay current; if a legitimate device's firmware or OS is updated without re-enrollment, the attestation proxy would reject a healthy device, making a re-enrollment policy a practical prerequisite for field use.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. First, this is a genuine engineering effort: the authors put dual-PKI device certs and a hardware TPM quote into the 5G registration path on an srsRAN/Open5GS testbed and measured a 373 ms overhead. That part is credible and useful. Second, the central security claim—that the system blocks SIM-transplant and rogue-device registration—is not actually established. The stress-test note is right: the attestation evidence signs only fresh nonces, not the saved Registration Request or a session/AMF identifier. An attacker with a valid USIM can run two SDRs, relay fresh challenges to an enrolled victim UE, and use the victim's valid certificate responses and TPM quote to pass all three checks on its own registration. This violates none of the paper's stated threat-model assumptions: no TPM key is extracted, no CA signature is forged, no PCR is made to match incorrectly. Nonce freshness only stops pure replay of captured evidence; it does not stop a real-time relay.

What is genuinely new: the combination of independent outer/inner CA checkpoints with a gNB-side RRC forwarding gate and AMF-side save-and-replay is an original integration. I know of no prior work that inserts TPM attestation into the UE admission path this way, especially without changing 3GPP NAS message structures. The implementation details are concrete—wire protocol message types, PCR 0–7, proxy verification. The latency breakdown is clear and internally consistent; TPM quote generation dominates at 235.7 ms, and certificate verification being ~1 ms locally is plausible.

Soft spots beyond the relay: the attack validation in Table III is a summary, not an experiment. There are no traces, no adversary scripts, no variance, and no released code or raw data. The gNB/AMF/proxy trust assumption is stated, but the relay attack does not need a compromised infrastructure node, so it is a fair attack under the paper's own model. Minor: the prose has typos and some duplicated sentences.

This paper is for people building tactical 5G admission controls; it gives them a measured integration pattern and a clear latency budget. But as a security paper, the headline claim needs fixing: bind the challenge responses to a digest of the Registration Request and a session/AMF identifier, or explicitly scope the claims to exclude an in-path relay. With that fix the contribution becomes meaningful; without it, the claimed protections are not guaranteed.

I would send it to peer review—the engineering is real and the problem is important—but I would flag the relay issue as the primary revision. It is not a desk reject; it is a revise-and-resubmit that changes the title claim.

Referee Report

3 major / 5 minor

Summary. The paper proposes and implements Battlefield 5G, a pre-authentication framework for 5G Standalone networks that inserts an outer X.509 certificate check at the gNB, an independent inner X.509 certificate check at the AMF, and a TPM 2.0 PCR attestation verified by an attestation proxy before normal 5G-AKA registration proceeds. The implementation modifies srsRAN/srsUE and Open5GS, uses an RRC forwarding gate and an AMF-side save-and-replay mechanism to insert the checks without changing NAS message formats, and evaluates the prototype on a USRP B210 testbed. Across six trials the authors report a 373.4 ms increase in onboarding latency over a same-testbed baseline and claim that the prototype blocks SIM-transplant, rogue-certificate, firmware-tampering, and replay attacks.

Significance. If the claimed security properties held, the work would be a useful engineering contribution for tactical 5G: it addresses a real gap (5G-AKA authenticates the USIM rather than the physical device), uses a hardware TPM for boot attestation, and provides a same-testbed baseline with an overhead decomposition that is internally consistent (74.9 ms + 298.5 ms = 373.4 ms). The paper does not fit parameters or derive predictions from data; the overhead figures are direct measurements. However, the central security claims are not yet established. The protocol as described lacks binding between the attestation evidence and the specific registration attempt, which enables a concrete relay attack, and the attack validation in Section VI.B is only a summary table without experimental details. The engineering and measurement infrastructure appear sound, but the security contribution needs substantial rework.

major comments (3)

[Section IV.B, Table II] The attestation evidence is not bound to the registration attempt. All three challenges contain only a fresh 32-byte nonce: the outer and inner certificate responses sign that nonce, and the TPM quote binds the proxy-provided nonce. Neither the certificate responses nor the TPM quote include a digest of the NAS Registration Request, an AMF-generated session identifier, or any other registration-specific value. Consequently, an adversary with a valid USIM and two software-defined radios can relay the real network's fresh challenges to an enrolled victim UE through a rogue gNB, relay the signed certificate responses and TPM quote back to the real network, and then let the adversary's own saved Registration Request be replayed. The verifiers see valid signatures over fresh nonces and 5G-AKA completes using the stolen USIM. This contradicts the claimed SIM-transplant and replay blocking in Section VII and Table III, and it is not excluded by the threat model in Section III, which explicitly allows SDR-based rogue platforms and over-the-air observation. The protocol needs channel binding, for example by including a digest of the NAS Registration Request or an AMF-generated session identifier in the signed nonce and in the TPM quote.
[Section VI.B, Table III] The attack validation is presented only as a summary table. The paper does not describe how each of the four attacks was implemented or executed: how the SIM transplant was performed, what the rogue certificate was, which PCR was modified to simulate firmware tampering, or how a replay attempt was mounted. No logs, pass/fail counts, or observable outcomes are reported. Because the abstract and Section VII assert that the prototype 'blocks' all four attacks, this evidence is load-bearing and needs to be reported with enough detail for the reader to see that the attack scenarios actually exercised the intended adversarial capabilities.
[Section VI.C, Tables IV and V] All latency claims rest on six trials with no reported standard deviation or per-trial data. Given the large observed ranges (outer CA 47.0–89.0 ms, TPM 219–258 ms, total 2228–2303 ms), the mean overhead value of 373.4 ms is not statistically characterized. The paper should report the number of trials per configuration, dispersion measures, and ideally the individual measurements or a statistical test, so that the central performance claim is supported.

minor comments (5)

[Section II.C] The sentence 'Remote attestation has also been used in cloud and edge environments.' appears twice verbatim; remove the duplicate.
[Sections I, II.B, V] There are several typos and spacing errors: 'mission spporting', 'UA Vs', 'useP CR', and 'compares the PCR values compared to the enrollment baseline'. These should be corrected.
[Table III] The replay-attack row reports 'Fail if replayed' at every checkpoint, but this is a design assertion rather than an experimental result. It should be either labeled as a protocol-level expectation or accompanied by the same experimental detail as the other attack rows.
[Section VI.A] The paper should define exactly what 'onboarding latency' measures (e.g., time to Registration Accept, time to PDU session establishment) and clarify why the baseline total equals gNB RRC setup plus the standard 5G phases shown in Table IV.
[Section IV.C] The enrollment process is only described in one sentence. The paper should explain how the known-good PCR baseline and the TPM Attestation Key identity are established and stored, since the security of the attestation gate depends on that process.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the latency figures are direct measurements and the security claims are asserted protocol properties, with no fitted parameter renamed as a prediction and no load-bearing self-citation.

full rationale

The paper contains no derivation chain in which an output is equivalent to its input by construction. The central quantitative claim, 373.4 ms of added pre-authentication overhead, is the difference of two directly measured onboarding latencies on the same testbed (1886 ms baseline versus 2260 ms Battlefield 5G), reported in Tables IV and V with a per-checkpoint breakdown; there is no fitted parameter that is then relabeled as a prediction. The four attack-blocking claims (SIM transplant, rogue certificate, firmware tampering, replay) are asserted properties of the three-check pipeline described in Section IV and validated in Section VI.B by Table III showing where each attack is stopped; they are not derived from a fitted model or from a self-citation. The citations to the authors' prior work, such as [16] on TPM-based attestation for 5G VNFs and [3] on gNB local breakout, are contextual and do not carry the paper's central load-bearing premise; the dual-CA design is instead attributed to external NSA CSfC guidance. The skeptical observation that the attestation evidence is not bound to the saved Registration Request identifies a potential security limitation of the protocol, not a circular step, because no protocol input is defined in terms of the asserted security outcome. Accordingly, the honest finding is no significant circularity, score 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper's claims rest on four categories of assumptions: trust in the network-side components (gNB, AMF, proxy), standard TPM/PKI security properties, non-spoofable PCRs, and fresh nonces. The network trust assumption is the most structurally fragile: if the gNB or AMF is compromised, the dual-certificate gates can be bypassed. No free parameters are fitted; the latency figures are direct measurements.

assumptions (4)

domain assumption gNB, AMF, and attestation proxy are trusted and uncompromised
Declared in Section III and relied on throughout; if false, both certificate gates can be bypassed.
domain assumption Adversary cannot extract TPM-resident private keys or forge CA signatures
Standard TPM and PKI assumptions, stated in Section III; if false, the TPM quote and certificate chains do not prove device identity.
domain assumption PCR values reflect the measured boot state and cannot be spoofed without booting expected software
Stated in Section III; this is the foundation of the boot-integrity claim.
domain assumption Challenge nonces are fresh for each session
Used in the replay-resistance argument; if nonces repeat, captured responses could be replayed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks." pith.science (2026). https://pith.science/paper/ZU6WFFPK

@misc{pith2026260811293,
  author       = {Pith},
  title        = {Pith review of: Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZU6WFFPK}},
  note         = {Machine review of arXiv:2608.11293}
}

read the original abstract

The standardized 5G Authentication and Key Agreement (5G-AKA) authenticates a subscriber credential stored on a Universal Subscriber Identity Model (USIM) but does not authenticate the physical device that holds that credential or verify its boot state. This gap is significant in tactical 5G deployments, where user equipment may be captured, modified, returned to service, or used with transplanted subscriber credentials. We present Battlefield 5G, a pre-authentication framework for 5G Standalone networks that combines dual X.509 device-certificate checks with Trusted Platform Module (TPM) -based boot attestation before standard registration is accepted. The design places an outer certificate challenge on the 5G base-station called gNB, an independent inner certificate challenge on the Access and Mobility Management Function (AMF) in the 5G core network, and a TPM PCR (Platform Configuration Register) quote verified by an attestation proxy on the 5G core network side. A gNodeB (gNB) side Radio Resource Control (RRC) forwarding gate and an AMF-side save-and-replay mechanism enable multi-round certificate and attestation challenge-response exchanges to be inserted into the registration path without modifying any 3GPP Non-Access Stratum (NAS) message structures or adding new NAS message types. We implement these capabilities by extending the Radio Access Network of the Software Radio System (srsRAN), gNB, User Equipment of the Software Radio System (srsUE) and Open5GS in a B210-based Universal Radio Peripheral (USRP) testbed with a hardware TPM 2.0 in the UE. The prototype blocks SIM-transplant, rogue-certificate, firmware-tampering, and replay attacks. Across six trials, Battlefield 5G increases average onboarding latency from 1886 ms to 2260 ms, adding 373.4 ms of pre-authentication overhead while preserving standard 5G-AKA, security mode, and packet data unit (PDU) session procedures.

Figures

Figures reproduced from arXiv: 2608.11293 by the authors.

**Figure 2.** Triple-check pre-authentication flow across the UE, gNB, and core [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

19 extracted references · 16 canonical work pages

[1]

ETSI TS 133 501 V18.6.0 (2024-07): 5G; Security architecture and procedures for 5G System (3GPP TS 33.501 version 18.6.0 Release 18),

“ETSI TS 133 501 V18.6.0 (2024-07): 5G; Security architecture and procedures for 5G System (3GPP TS 33.501 version 18.6.0 Release 18),” ETSI, Sophia Antipolis, France, Tech. Rep. RTS/TSGS- 0333501v1860, Jul. 2024, version 18.6.0, Release 18. [Online]. Available: https://www.etsi.org/deliver/etsi ts/133500 133599/133501/ 18.06.00 60/ts 133501v180600p.pdf

work page 2024
[2]

Mobile and Expeditionary C3N Operations Powered by 5G,

JMA Wireless, “Mobile and Expeditionary C3N Operations Powered by 5G,” JMA Wireless, Case Study, 2025, online. [Online]. Available: https://info.jmawireless.com/hubfs/J4666 JMA Mobile and Expeditionary C3N operations case study AH v9.pdf

work page 2025
[3]

gnb- based local breakout for urllc in industrial 5g,

R. Paudyal, R. Upadhyay, A. N. B. Emran, and D. Wijesekera, “gnb- based local breakout for urllc in industrial 5g,” in2025 IEEE 30th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 2025, pp. 1–6

work page 2025
[4]

Commercial Solutions for Classified (CSfC) Key Management Requirements Annex,

National Security Agency, “Commercial Solutions for Classified (CSfC) Key Management Requirements Annex,” National Security Agency, Requirements Annex, Jan. 2021, online. [Online]. Available: https://www.nsa.gov/Portals/75/documents/resources/everyone/csfc/ capability-packages/(U)%20Key%20Management%20Requirements% 20Annex%20v2.0.pdf

work page 2021
[5]

A formal analysis of 5g authentication,

D. Basin, J. Dreier, L. Hirschi, S. Radomirovic, R. Sasse, and V . Stettler, “A formal analysis of 5g authentication,” inProceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 1383–1396

2018
[6]

Trusted Platform Module 2.0 Library Part 1: Architecture,

Trusted Computing Group, “Trusted Platform Module 2.0 Library Part 1: Architecture,” Trusted Computing Group, TCG Published Specification. [Online]. Available: https://trustedcomputinggroup.org/wp-content/ uploads/Trusted-Platform-Module-2.0-Library-Part-1-Architecture Version-185 pub.pdf

work page
[7]

Remote attestation procedures (rats) architecture,

H. Birkholz, D. Thaler, M. Richardson, N. Smith, and W. Pan, “Remote attestation procedures (rats) architecture,”(No Title), 2023

work page 2023
[8]

Insecure connection bootstrapping in cellular networks: the root of all evil,

S. R. Hussain, M. Echeverria, A. Singla, O. Chowdhury, and E. Bertino, “Insecure connection bootstrapping in cellular networks: the root of all evil,” inProceedings of the 12th conference on security and privacy in wireless and mobile networks, 2019, pp. 1–11

work page 2019

Show all 19 references

[9]

Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,

A. Singla, R. Behnia, S. R. Hussain, A. Yavuz, and E. Bertino, “Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations,” inProceedings of the 2021 ACM Asia Conference on Computer and Communications Security, 2021, pp. 501–515

2021
[10]

Fixing insecure cellular system information broadcasts for good,

A. J. Ross, B. Reaves, Y . Nasser, G. Cukierman, and R. P. Jover, “Fixing insecure cellular system information broadcasts for good,” inProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses, 2024, pp. 693–708

2024
[11]

Base sta- tion certificate and multi-factor authentication for cellular radio control communication security,

S. Purification, S. Wuthier, J. Kim, I. Kim, and S.-Y . Chang, “Base sta- tion certificate and multi-factor authentication for cellular radio control communication security,”arXiv preprint arXiv:2504.02133, 2025

2025 arXiv
[12]

Securing 5g bootstrapping: A two-layer ibs authentication protocol,

Y . Dong, R. Behnia, A. A. Yavuz, and S. R. Hussain, “Securing 5g bootstrapping: A two-layer ibs authentication protocol,”arXiv preprint arXiv:2502.04915, 2025

2025 arXiv
[13]

Baron: Base-station authentication through core network for mobility management in 5g networks,

A. Lotto, V . Singh, B. Ramasubramanian, A. Brighente, M. Conti, and R. Poovendran, “Baron: Base-station authentication through core network for mobility management in 5g networks,” inProceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Network...

2023
[14]

Real-world demonstration of secure 5g roaming for military communications,

A. Bhuyan and M. Gheorghevici, “Real-world demonstration of secure 5g roaming for military communications,” inMILCOM 2024-2024 IEEE Military Communications Conference (MILCOM). IEEE, 2024, pp. 639–640

2024
[15]

Bootstrapping and maintaining trust in the cloud,

N. Schear, P. T. Cable, T. M. Moyer, B. Richard, and R. Rudd, “Bootstrapping and maintaining trust in the cloud,” inProceedings of the 32nd Annual Conference on Computer Security Applications, 2016, pp. 65–77

2016
[16]

Tpm-based continuous remote attestation and integrity verification for 5g vnfs on kubernetes,

A. N. B. Emran, R. Upadhyay, R. Paudyal, L. Donnan, and D. Wijesek- era, “Tpm-based continuous remote attestation and integrity verification for 5g vnfs on kubernetes,” in2025 IEEE 7th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applicat...

2025
[17]

Department of Defense Zero Trust Reference Architecture,

U.S. Department of Defense, “Department of Defense Zero Trust Reference Architecture,” Defense Information Systems Agency (DISA) and National Security Agency (NSA) Zero Trust Engineering Team, Reference Architecture, Jul. 2022, online. [Online]. Available: https://dodcio.defen...

2022
[18]

srsRAN Project: Open-source O-RAN 5G CU/DU solution,

Software Radio Systems, “srsRAN Project: Open-source O-RAN 5G CU/DU solution,” https://github.com/srsran/srsRAN Project, online; ac- cessed May 19, 2026

2026
[19]

Open5GS: Open source implementation of 5GC and EPC,

Open5GS, “Open5GS: Open source implementation of 5GC and EPC,” https://open5gs.org, online; accessed May 19, 2026

2026

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

ETSI TS 133 501 V18.6.0 (2024-07): 5G; Security architecture and procedures for 5G System (3GPP TS 33.501 version 18.6.0 Release 18),

“ETSI TS 133 501 V18.6.0 (2024-07): 5G; Security architecture and procedures for 5G System (3GPP TS 33.501 version 18.6.0 Release 18),” ETSI, Sophia Antipolis, France, Tech. Rep. RTS/TSGS- 0333501v1860, Jul. 2024, version 18.6.0, Release 18. [Online]. Available: https://www.etsi.org/deliver/etsi ts/133500 133599/133501/ 18.06.00 60/ts 133501v180600p.pdf

work page 2024

[2] [2]

Mobile and Expeditionary C3N Operations Powered by 5G,

JMA Wireless, “Mobile and Expeditionary C3N Operations Powered by 5G,” JMA Wireless, Case Study, 2025, online. [Online]. Available: https://info.jmawireless.com/hubfs/J4666 JMA Mobile and Expeditionary C3N operations case study AH v9.pdf

work page 2025

[3] [3]

gnb- based local breakout for urllc in industrial 5g,

R. Paudyal, R. Upadhyay, A. N. B. Emran, and D. Wijesekera, “gnb- based local breakout for urllc in industrial 5g,” in2025 IEEE 30th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 2025, pp. 1–6

work page 2025

[4] [4]

Commercial Solutions for Classified (CSfC) Key Management Requirements Annex,

National Security Agency, “Commercial Solutions for Classified (CSfC) Key Management Requirements Annex,” National Security Agency, Requirements Annex, Jan. 2021, online. [Online]. Available: https://www.nsa.gov/Portals/75/documents/resources/everyone/csfc/ capability-packages/(U)%20Key%20Management%20Requirements% 20Annex%20v2.0.pdf

work page 2021

[5] [5]

A formal analysis of 5g authentication,

D. Basin, J. Dreier, L. Hirschi, S. Radomirovic, R. Sasse, and V . Stettler, “A formal analysis of 5g authentication,” inProceedings of the 2018 ACM SIGSAC conference on computer and communications security, 2018, pp. 1383–1396

2018

[6] [6]

Trusted Platform Module 2.0 Library Part 1: Architecture,

Trusted Computing Group, “Trusted Platform Module 2.0 Library Part 1: Architecture,” Trusted Computing Group, TCG Published Specification. [Online]. Available: https://trustedcomputinggroup.org/wp-content/ uploads/Trusted-Platform-Module-2.0-Library-Part-1-Architecture Version-185 pub.pdf

work page

[7] [7]

Remote attestation procedures (rats) architecture,

H. Birkholz, D. Thaler, M. Richardson, N. Smith, and W. Pan, “Remote attestation procedures (rats) architecture,”(No Title), 2023

work page 2023

[8] [8]

Insecure connection bootstrapping in cellular networks: the root of all evil,

S. R. Hussain, M. Echeverria, A. Singla, O. Chowdhury, and E. Bertino, “Insecure connection bootstrapping in cellular networks: the root of all evil,” inProceedings of the 12th conference on security and privacy in wireless and mobile networks, 2019, pp. 1–11

work page 2019