arXiv subjects

Lisa Donnan

Publications and source records attributed to Lisa Donnan.

4 recordsLinked to original sources

arXiv2026

Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks

The standardized 5G Authentication and Key Agreement (5G-AKA) authenticates a subscriber credential stored on a Universal Subscriber Identity Model (USIM) but does not authenticate the physical device that holds that credential or verify its boot state. This gap is significant in tactical 5G deployments, where user equipment may be captured, modified, returned to service, or used with transplanted subscriber credentials. We present Battlefield 5G, a pre-authentication framework for 5G Standalone networks that combines dual X.509 device-certificate checks with Trusted Platform Module (TPM) -based boot attestation before standard registration is accepted. The design places an outer certificate challenge on the 5G base-station called gNB, an independent inner certificate challenge on the Access and Mobility Management Function (AMF) in the 5G core network, and a TPM PCR (Platform Configuration Register) quote verified by an attestation proxy on the 5G core network side. A gNodeB (gNB) side Radio Resource Control (RRC) forwarding gate and an AMF-side save-and-replay mechanism enable multi-round certificate and attestation challenge-response exchanges to be inserted into the registration path without modifying any 3GPP Non-Access Stratum (NAS) message structures or adding new NAS message types. We implement these capabilities by extending the Radio Access Network of the Software Radio System (srsRAN), gNB, User Equipment of the Software Radio System (srsUE) and Open5GS in a B210-based Universal Radio Peripheral (USRP) testbed with a hardware TPM 2.0 in the UE. The prototype blocks SIM-transplant, rogue-certificate, firmware-tampering, and replay attacks. Across six trials, Battlefield 5G increases average onboarding latency from 1886 ms to 2260 ms, adding 373.4 ms of pre-authentication overhead while preserving standard 5G-AKA, security mode, and packet data unit (PDU) session procedures.

cs.CR↗

arXiv2026

Availability Attacks Without an Adversary: Evidence from Enterprise LANs

Denial-of-Service (DoS) conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking and undocking of user endpoints repeatedly trigger rapid recalculations of the control plane of the Rapid Spanning Tree Protocol (RSTP) [1]. Although protocol-compliant and nonmalicious, these events introduce transient forwarding disruptions of approximately 2-4 seconds duration that degrade realtime streaming (voice and video) services while remaining largely undetected by conventional security monitoring. We map this phenomenon to the NIST and MITRE insider threat frameworks, characterizing it as an unintentional insider-driven availability breach, and demonstrate that explicit edge-port configuration effectively mitigates the condition without compromising loop prevention

cs.CR↗

arXiv2025

Quantitative Analysis of UAV Intrusion Mitigation for Border Security in 5G with LEO Backhaul Impairments

Uncooperative unmanned aerial vehicles (UAVs) pose emerging threats to critical infrastructure and border protection by operating as rogue user equipment (UE) within cellular networks, consuming resources, creating interference, and potentially violating restricted airspaces. This paper presents minimal features of the operating space, yet an end-to-end simulation framework to analyze detect-to-mitigate latency of such intrusions in a hybrid terrestrial-non-terrestrial (LEO satellite) 5G system. The system model includes terrestrial gNBs, satellite backhaul (with stochastic outages), and a detection logic (triggered by handover instability and signal quality variance). A lockdown mechanism is invoked upon detection, with optional local fallback to cap mitigation delays. Monte Carlo sweeps across UAV altitudes, speeds, and satellite outage rates yield several insights. First, satellite backhaul outages can cause arbitrarily long mitigation delays, yet, to meet fallback deadlines, they need to be effectively bounded. Second, while handover instability was hypothesized, our results show that extra handovers have a negligible effect within the range of parameters we considered. The main benefit of resilience from fallback comes from the delay in limiting mitigation. Third, patrol UEs experience negligible collateral impact, with handover rates close to terrestrial baselines. Stress scenarios further highlight that fallback is indispensable in preventing extreme control-plane and physical security vulnerabilities: Without fallback, prolonged outages in the satellite backhaul delay lockdown commands, allowing rogue UAVs to linger inside restricted corridors for several seconds longer. These results underscore the importance of complementing non-terrestrial links with local control to ensure robust and timely response against uncooperative UAV intrusions.

cs.CR↗

arXiv2025

TPM-Based Continuous Remote Attestation and Integrity Verification for 5G VNFs on Kubernetes

In the rapidly evolving landscape of 5G technology, the adoption of cloud-based infrastructure for the deployment of 5G services has become increasingly common. Using a service-based architecture, critical 5G components, such as the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF), now run as containerized pods on Kubernetes clusters. Although this approach improves scalability, flexibility, and resilience, it also introduces new security challenges, particularly to ensure the integrity and trustworthiness of these components. Current 5G security specifications (for example, 3GPP TS 33.501) focus on communication security and assume that network functions remain trustworthy after authentication, consequently lacking mechanisms to continuously validate the integrity of NVFs at runtime. To close this gap, and to align with Zero Trust principles of 'never trust, always verify', we present a TPM 2.0-based continuous remote attestation solution for core 5G components deployed on Kubernetes. Our approach uses the Linux Integrity Measurement Architecture (IMA) and a Trusted Platform Module (TPM) to provide hardware-based runtime validation. We integrate the open-source Keylime framework with a custom IMA template that isolates pod-level measurements, allowing per-pod integrity verification. A prototype on a k3s cluster (consisting of 1 master, 2 worker nodes) was implemented to attest to core functions, including AMF, SMF and UPF. The experimental results show that the system detects unauthorized modifications in real time, labels each pod's trust state, and generates detailed audit logs. This work provides hardware-based continuous attestation for cloud native and edge deployments, strengthening the resilience of 5G as critical infrastructure in multi-vendor and mission-critical scenarios of 5G.

cs.CR↗