TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA

• URL: http://arxiv.org/abs/2606.26528v1
• Date: Thu, 25 Jun 2026 02:07:02 GMT
• Title: TESLA-for-5G: Broadcast Authentication for 5G Networks Using TESLA
• Abstract summary: 5G base stations broadcast unauthenticated system information (SI) that every user equipment (UE) reads during cell selection.<n>Prior approaches require UEs to authenticate System Information Block 1 (SIB1) using digital signatures.<n>We propose TESLA-for-5G (TF5), a broadcast authentication protocol for 5G SIB1 that combines TESLA with GG09 Schnorr-like identity-based signatures (IBS)
• Score: 13.531588596047229
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: 5G base stations broadcast unauthenticated system information (SI) that every user equipment (UE) reads during cell selection. This enables attackers to broadcast forged SI from a fake base station (FBS), deceiving UEs into camping on it. Prior approaches require UEs to authenticate System Information Block 1 (SIB1) using digital signatures. This necessitates computation-heavy verification for every SIB1 reception, imposing a significant burden on resource-constrained UEs. We propose TESLA-for-5G (TF5), a broadcast authentication protocol for 5G SIB1 that combines TESLA with GG09 Schnorr-like identity-based signatures (IBS). In the steady state, TF5 enables UEs to authenticate each SIB1 message using a symmetric MAC and delayed key disclosure, eliminating the need for per-message digital signatures. Initial trust is bootstrapped during cell entry using a lightweight GG09 IBS over the TESLA parameters, avoiding certificate distribution overhead. We formally verify TF5 in Tamarin under a Dolev-Yao adversary and demonstrate its favorable computation, communication, and storage costs through both an implementation on the OpenAirInterface 5G stack and trace-driven analysis.

Related papers

• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM [0.0]
  We propose a confidential interbank settlement protocol for permissioned-compatible networks.<n>In this model, the initiating institution remains publicly identifiable on-chain for accountability and compliance.<n>The protocol supports shield, confidential transfer, and unshield state transitions.
  arXiv  Detail & Related papers  (2026-08-28T17:08:02Z)
• Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks [2.0344286047762363]
  5G-AKA authenticates a subscriber credential stored on a USIM but does not authenticate the physical device that holds that credential or verify its boot state.<n>We present Battlefield 5G, a pre-authentication framework for 5G standalone networks.<n>We implement these capabilities by extending the Radio Access Network of the Software Radio System.
  arXiv  Detail & Related papers  (2026-08-11T17:22:47Z)
• A Lightweight Post-Quantum Authentication Framework for 5G Base Station Bootstrapping [10.889502556532639]
  EMULSION is a symmetric chained publicly verifiable authentication framework for 5G broadcast authentication.<n>It achieves 33x lower end-to-end delay and 31x less communication overhead than ML-DSA, and 12x lower delay and 5.4x less overhead than FN-DSA.<n>We formally prove the security of EMULSION and open-source its implementation for public testing and adaptation.
  arXiv  Detail & Related papers  (2026-06-29T16:42:16Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• Semantics Over Syntax: Uncovering Pre-Authentication 5G Baseband Vulnerabilities [18.510444087809315]
  We present Constraint-Guided Semantic Testing (ConSeT), a framework that generates semantic violations for testing 5G UEs.<n>ConSeT decodes RRC messages into structured fields, derives schema-based rules, infers cross-field dependencies, and produces syntactically valid test cases that intentionally violate semantic constraints.<n>We evaluate ConSeT on both commercial and open-source 5G UEs.
  arXiv  Detail & Related papers  (2026-04-05T21:48:11Z)
• Privacy-Preserving Identifier Checking in 5G [0.1310865248866973]
  Device identifiers like the International Mobile Equipment Identity (IMEI) are crucial for ensuring device integrity and meeting regulations in 4G and 5G networks.<n>Sharing these identifiers with Mobile Network Operators (MNOs) brings significant privacy risks.<n>We propose a privacy-preserving identifier checking method in 5G.
  arXiv  Detail & Related papers  (2025-12-09T07:17:39Z)
• SALT-V: Lightweight Authentication for 5G V2X Broadcasting [4.791189058605987]
  Vehicle-to-Everything (V2X) communication faces a critical authentication dilemma.<n>Neither meets 5G New Radio (NR)-V2X's stringent requirements for both immediate authentication and computational efficiency.<n>This paper presents SALT-V, a novel hybrid authentication framework.
  arXiv  Detail & Related papers  (2025-11-14T07:32:21Z)
• Authentication Against Insecure Bootstrapping for 5G Networks: Feasibility, Resiliency, and Transitional Solutions in Post-Quantum Era [10.889502556532639]
  5G protocol lacks robust base station authentication mechanism during initial bootstrapping phase.<n>Conventional solutions, including digital signatures based on Public Key Infrastructures (PKIs) and identity-based signatures, are inadequate against quantum-capable adversaries.<n>We propose BORG, a transitional authentication solution based on a Hierarchical Identity-Based Threshold Signature scheme with a Fail-Stop property.
  arXiv  Detail & Related papers  (2025-10-27T15:56:59Z)
• Cross-Service Token: Finding Attacks in 5G Core Networks [58.86003502940164]
  We present FivGeeFuzz, a grammar-based fuzzing framework designed to uncover security flaws in 5G core SBIs.<n>Using FivGeeFuzz, we discovered 8 previously unknown vulnerabilities in free5GC, leading to runtime crashes, improper error handling, and unauthorized access to resources.
  arXiv  Detail & Related papers  (2025-09-10T20:40:33Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Securing 5G Bootstrapping: A Two-Layer IBS Authentication Protocol [4.087348638056961]
  Lack of authentication during the initial bootstrapping phase between cellular devices and base stations allows attackers to send malicious messages to the devices.<n>We propose E2IBS, a novel and efficient two-layer identity-based signature scheme for seamless integration with existing cellular protocols.<n>Compared to the state-of-the-art Schnorr-HIBS, E2IBS reduces attack surfaces, enables fine-grained lawful interception, and achieves 2x speed in verification.
  arXiv  Detail & Related papers  (2025-02-07T13:32:48Z)
• Towards Credential-based Device Registration in DApps for DePINs with ZKPs [46.08150780379237]
  We propose a credential-based device registration (CDR) mechanism that verifies device credentials on the blockchain. We present a general system model, and technically evaluate CDR using zkSNARKs with Groth16 and Marlin.
  arXiv  Detail & Related papers  (2024-06-27T09:50:10Z)
• Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signature [39.973130114073605]
  We introduce a bi-level signature scheme, Bileve, which embeds fine-grained signature bits for integrity checks. Bileve can differentiate 5 scenarios during detection, reliably tracing text and regulating LLMs.
  arXiv  Detail & Related papers  (2024-06-04T03:58:14Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.