Pith. sign in

REVIEW 3 major objections 6 minor 92 references

Di5Guise: 5G Privacy with vSIM

T0 review · 3 major / 6 minor · reviewed 2026-07-12 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A virtualized SIM that can swap device identities on demand stops cellular operators from linking a user’s separate subscriber profiles into one pattern of life.

desk verdict Clean systems contribution that actually breaks the permanent EID binding with a working TEE prototype; the 49% number is a useful proxy result, not operator-grade proof. read the letter →

arxiv 2606.16943 v2 pith:OXZLLJOT submitted 2026-06-15 cs.CR cs.NI

Shirin Ebadi , Zach Moolman , Eric Keller , Tamara Lehman This is my paper
classification cs.CRcs.NI
keywords 5GprivacyvirtualizedSIMsubscriberunlinkabilitydeviceprofileprovisioningtrustedexecutionpattern-of-lifeanalysise
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Today’s eSIMs permanently bind every subscriber profile to a single fixed device profile (EID plus keys). An operator who sees that binding can still stitch together a complete picture of a person’s movements and online activity even when the user rotates numbers or encrypts traffic. Di5Guise replaces the fixed hardware SIM with vSIM, software that runs inside a trusted execution environment and can provision a fresh, unlinkable device profile for each subscriber identity. Trust is restored by remote attestation and group keys so the operator never learns which physical handset is requesting a new profile. On a working FPGA prototype that plugs into open-source 5G stacks, the same machine-learning correlator that re-identifies users at 93 percent accuracy with ordinary eSIMs falls to 49 percent—essentially random—once vSIM and traffic obfuscation are both used.

What carries the argument

vSIM: a TEE-resident software SIM that supports dynamic device-profile provisioning (new EID, certificate and secret key) while still presenting the exact same authentication interface the 5G network already expects.

What would settle it

Run the same SiamHAN re-identification task on a real multi-user 5G trace that contains genuine authentication exchanges, operator-visible EIDs, and ground-truth user labels; if accuracy with vSIM stays near the no-vSIM baseline, the claimed privacy gain does not hold.

Watch

Extended reading notes

Core claim

The permanent device profile that every eSIM carries is the root linking point that lets an operator-side adversary reassemble a user’s full pattern of life across multiple subscriber identities. By virtualizing the SIM and allowing each subscriber profile to be bound to a distinct, dynamically provisioned device profile, that structural one-to-many mapping is eliminated and cross-profile correlation collapses.

Load-bearing premise

That injecting synthetic EID labels into an existing TLS traffic dataset is a faithful stand-in for the linking power a real operator would lose once the permanent EID-to-subscriber map is removed.

Editorial extensions

If this is right

  • Operators can no longer cluster multiple prepaid or purpose-specific SIMs back to one handset simply by looking at the device identifier.
  • Existing subscriber-anonymity schemes become useful rather than futile, because the device-level binding that previously defeated them is gone.
  • A third-party or MVNO can provision device profiles without any change to the operator’s core network, enabling incremental deployment.
  • Daily authentication overhead stays under half a minute even with frequent profile switches, so the privacy gain does not require redesign of the radio stack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If co-location of rotated device profiles remains visible to the operator, careful cycling schedules and multi-device profile migration will still be needed to frustrate that residual signal.
  • The same TEE-backed dynamic identity pattern could be applied to other persistent hardware identifiers (IMEI, Wi-Fi MAC) that currently re-link anonymized sessions.
  • Once concurrent multi-profile authentication is added, a user could interleave packets across identities at fine grain, further eroding traffic-correlation attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. Di5Guise proposes vSIM, a TEE-hosted virtualized SIM that supports dynamic device-profile (EID, certificate, secret key) provisioning so each subscriber profile can be bound to a distinct, unlinkable device identity. The design addresses four trust challenges that arise when leaving a fixed secure element: key secrecy via TEE isolation and secure storage; initial trust via secure boot plus DAA-style group keys; runtime trust via remote attestation and a mutual-auth ECDH channel (Fig. 4); and backwards-compatible subscriber provisioning/authentication. A Rocket Chip/Keystone FPGA prototype is integrated with srsRAN/Open5GS and shown to complete 5G-AKA and carry traffic. Privacy is evaluated by injecting synthetic EIDs into SiamHAN on CSTNET TLS traffic, reporting re-identification accuracy falling from 93% (fixed EID) to 49% (per-profile EID + TLS obfuscation).

Significance. If the architecture and privacy claims hold, the paper fills a clear gap: prior operator-side defenses (PGPP, AAKA, ZipPhone, IMEI anonymization) leave the permanent EID binding intact, so cross-subscriber correlation remains possible. The systems contribution is substantial—an end-to-end TEE + secure-boot + group-key + provisioning stack that preserves 5G compatibility after a device profile is installed. Measured auth/provisioning latencies, resource CDFs, and packet traces give concrete engineering evidence. The work is therefore a meaningful step toward device–subscriber decoupling in 5G, provided the privacy evaluation is tightened to match the stated operator threat model.

major comments (3)
  1. Abstract and §6.2/Table 3/Fig. 6 present the headline result that Di5Guise drops SiamHAN re-identification from 93% to 49% (claimed random-guess level) with obfuscation. That number is obtained by synthetically attaching EID labels to the external CSTNET TLS dataset (outside-attacker traffic features), not from operator-side 5G authentication+traffic+EID traces. §6.2 itself states no such public trace exists and that a real operator already knows the EID deterministically. The experiment therefore measures only the marginal contribution of the one-to-many EID→IMSI map after other deterministic identifiers are removed. Under the threat model of §2.3 (honest-but-curious operator with full metadata, possibly multi-operator), residual signals—location co-occurrence of successive EIDs, billing/account linkage, radio fingerprints—remain available. The manuscript must either (i) evaluate or bou
  2. §7 acknowledges that an adversary who observes two device identifiers in the same location (or with traffic commonalities) can still correlate them, especially when ephemeral SUPIs are used. This residual risk is load-bearing for the central claim of “breaking correlation at its root,” yet it is left unquantified. Given that the privacy evaluation already assumes profile switches every 1–7 days, the paper should either add a simple co-location / multi-signal correlation experiment (even synthetic) or state explicit operational assumptions (switch cadence, geographic mixing, multi-profile concurrency) under which the residual attack is claimed to be ineffective.
  3. §6.3 reports 658 ms for challenge–response through the enclave versus ~7 ms for an emulated eSIM, and 1.68 s for a full profile switch (deregister + NAS re-init + re-auth). These costs are argued to be acceptable because authentication is infrequent (10–30/day) and switches occur every 1–7 days in the privacy eval. If residual location correlation forces more frequent rotation, the overhead becomes material. The paper should either (a) show that the 1–7 day cadence already frustrates the residual attacks of §7, or (b) quantify daily overhead under a more aggressive rotation schedule and discuss the multi-authenticated-profile future work more concretely as a necessary mitigation.
minor comments (6)
  1. Clarify what “random guessing” means for the 49% figure (Table 3). With 140 returning clients out of 600, multi-class assignment accuracy of ~23% would be uniform random; 49% is higher. State the exact decision task (pairwise same-user, top-1 among known users, etc.) so the claim is checkable.
  2. Without obfuscation, vSIM alone only reduces accuracy from ~93% to 75% (Fig. 6 / Table 3). The Abstract correctly says “when combined with obfuscation,” but the body should more prominently separate the contribution of device-profile rotation from that of TLS obfuscation.
  3. Figure 4 protocol: list the precise security properties (mutual auth, forward secrecy, attestation-based trust) and whether any formal or symbolic analysis was performed; currently they are asserted informally after the steps.
  4. §4.2.2 DAA/EPID revocation is sketched but not mapped to the mobile lifecycle (lost/stolen phone, group rekey). A short paragraph on how an operator would revoke a compromised platform private key without deanonymizing honest devices would strengthen the trust argument.
  5. Typographical / consistency: “Di5Guise” spacing and bolding vary; “eSIM secret key” vs “device profile” terminology should be fixed once in §2.1 and reused; arXiv id and venue year appear as placeholders in the header.
  6. Related work: SIMurai is correctly distinguished; a one-sentence comparison to commercial multi-IMSI / dual-SIM products and to eSIM multi-profile management (still single EID) would help non-specialist readers.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: privacy numbers are empirical outputs of an external ML model on synthetically labeled data, not algebraic restatements of fitted constants or self-defined quantities.

full rationale

The paper's central privacy claim (Abstract; §6.2, Table 3, Figure 6) is produced by taking the public CSTNET TLS dataset and SiamHAN model from an independent prior work, synthetically attaching fixed versus per-profile EID labels, and measuring re-identification accuracy. That measurement is an ordinary empirical evaluation; nothing in the architecture, the secure-channel protocol, the DAA group-key construction, or the FPGA/srsRAN prototype reduces by construction to the reported 93%→49% drop. Trust arguments rely on standard TEE, secure-boot, and remote-attestation machinery whose correctness is independent of the privacy numbers. The single self-citation (arXiv:2505.15827) is a prior version of the same idea and is not load-bearing for any uniqueness or derivation step. Residual-signal concerns about the evaluation proxy are validity issues, not circularity. The derivation chain is therefore self-contained against external benchmarks.

Assumptions & free parameters 2 free parameters · 5 assumptions · 2 invented entities

The systems result depends on standard TEE/secure-boot/DAA assumptions plus domain facts about 5G profile binding and operator vantage. The privacy percentage further depends on treating a TLS-correlation model with injected EIDs as a stand-in for operator linking after the structural EID map is broken. vSIM/Di5Guise are engineered constructs, not new physical entities; trust is postulated via existing crypto/hardware mechanisms rather than a new particle or force.

free parameters (2)
  • profile_switch_interval_in_privacy_eval
    Privacy evaluation assumes subscriber/device profile changes on a 1–7 day cadence (§6.3); frequency is a modeling choice that bounds residual correlation and network auth load, not derived from first principles.
  • SiamHAN_EID_feature_injection
    How EIDs are encoded into the correlator and how many clients return (e.g., 140/600) shape the reported accuracies; these are experimental design choices on a proxy dataset, not measured from live operator logs.
assumptions (5)
  • domain assumption A TEE (Keystone-class) plus secure boot and secure storage prevents the rich OS and remote parties from extracting long-term SIM secrets once provisioned.
    Load-bearing for Challenge 1 and operator trust (§3–4.1); side channels are acknowledged in §7 but not shown negligible.
  • domain assumption DAA/group signatures let the operator verify ‘genuine Di5Guise hardware and software’ without learning a unique device key.
    Core of Challenge 2–3 and §4.2.2; anonymity of provisioning rests on this standard crypto assumption and correct issuer/revocation practice.
  • domain assumption After a device profile is provisioned, 5G AKA/subscriber provisioning and network auth need no core-network changes (backwards-compatible interface).
    Stated as Challenge 4 solution and validated only in the srsRAN/Open5GS lab stack (§4.3, §6.3), not on commercial SM-DP+.
  • domain assumption Honest-but-curious (or jurisdictionally compelled) operators have EID, subscriber, location, and traffic metadata, and prepaid identities without personal ID are available in the threat model’s regions.
    §2.3 threat model; without operator EID access the problem shrinks, and without anonymous prepaid the real-world identity link may remain.
  • ad hoc to paper CSTNET + SiamHAN with synthetic EIDs adequately isolates the contribution of one-to-many EID mapping to re-identification when other identifiers are defended.
    §6.2 methodology; authors note the ideal 5G dataset does not exist.
invented entities (2)
  • vSIM (virtualized SIM with dynamic device-profile provisioning) independent evidence
    purpose: Software SIM in a TEE that can provision and switch device profiles (EID, cert, secret) so each subscriber profile can be unbound from a permanent device identity.
    Central engineered artifact; independent evidence is the FPGA prototype and srsRAN integration, not an external physical discovery.
  • Di5Guise trust stack (group-key attestation + secure-channel provisioning protocol)
    purpose: Replace manufacturing-time unique SIM credentials with boot-time root of trust, remote attestation, and ECDH session setup so operators will issue device profiles to anonymous devices.
    Protocol in §4.2.2/Figure 4; security properties are argued, not formally verified or red-teamed at scale.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Di5Guise: 5G Privacy with vSIM." pith.science (2026). https://pith.science/paper/OXZLLJOT

@misc{pith2026260616943,
  author       = {Pith},
  title        = {Pith review of: Di5Guise: 5G Privacy with vSIM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OXZLLJOT}},
  note         = {Machine review of arXiv:2606.16943}
}
read the original abstract

SIM cards have been the key building block of user authenticationand security in cellular networks. While they are meant to serve as privacy protecting elements in cellular communications, they can be the root cause of privacy loss. Current eSIMs come with a fixed device profile--comprising a secret key, a certificate, and a unique eUICC identifier--that permanently binds every subscriber profile provisioned on the device to that device profile. This binding enables an attacker with the vantage point of a cellular operator to correlate subscriber identities back to a single device, piecing together a complete pattern of life--online activities, movement patterns, and real-world identity--even when users rotate subscriber identities or employ traffic obfuscation techniques. To mitigate this concern, we introduce Di5Guise, a privacy-enhancing architecture that breaks this correlation at its root by decoupling the device identity from the subscriber identity. Central to Di5Guise is vSIM, a virtualized SIM card that enables dynamic device profile provisioning, allowing each subscriber profile to be associated with a distinct, unlinkable device profile. Di5Guise establishes trust with the operator by ensuring that vSIM is running on secure hardware in a trustworthy state. We prototype Di5Guise on a Field Programmable Gate Array (FPGA) board and integrate it with srsRAN to demonstrate full compatibility with existing 5G infrastructure. Using a complex user correlation model, we show that Di5Guise reduces user re-identification accuracy from 93% to 49% when combined with obfuscation.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

92 extracted references · 2 linked inside Pith

  1. [1]

    https://docs.cloudlab.us/hardware.html

    Cloudlab hardware documentation. https://docs.cloudlab.us/hardware.html. Accessed: 2024-05-01

    2024

  2. [2]

    https://open5gs.org/

    Open5gs. https://open5gs.org/. Accessed: 2023-06-19

    2023

  3. [3]

    https://docs.srsran.com/projects/4g/en/n ext/app_notes/source/zeromq/source/

    srsRAN 4G with ZMQ Virtual Radios. https://docs.srsran.com/projects/4g/en/n ext/app_notes/source/zeromq/source/

  4. [4]

    https://docs.srsran.com/en/latest/

    srsran documentation. https://docs.srsran.com/en/latest/. Accessed: 2023-06-19

    2023

  5. [5]

    https://zeromq.org/

    Zeromq. https://zeromq.org/. Accessed: 2023-06-19

    2023

  6. [6]

    Technical report, 3rd Generation Partnership Project (3GPP), August 2020

    3GPP TS 33.501 version 16.3.0 Release 16. Technical report, 3rd Generation Partnership Project (3GPP), August 2020. Accessed: 2023-06-19

    2020

  7. [7]

    Technical Report 3GPP TS 31.102 version 18.4.0 Release 18, 3rd Generation Partnership Project (3GPP), 2023

    Universal mobile telecommunications system (umts); lte; 5g; characteristics of the universal subscriber identity module (usim) application. Technical Report 3GPP TS 31.102 version 18.4.0 Release 18, 3rd Generation Partnership Project (3GPP), 2023

    2023

  8. [8]

    5g; non-access-stratum (nas) protocol for 5g system (5gs); stage 3 (3gpp ts 24.501 version 16.5.1 release 16)

    3GPP. 5g; non-access-stratum (nas) protocol for 5g system (5gs); stage 3 (3gpp ts 24.501 version 16.5.1 release 16). Technical Report ETSI TS 124 501 V16.5.1, ETSI, 2020

    2020

Show all 92 references
  1. [9]

    Security analysis of the consumer remote sim provisioning protocol.ACM Trans

    Abu Shohel Ahmed, Aleksi Peltonen, Mohit Sethi, and Tuomas Aura. Security analysis of the consumer remote sim provisioning protocol.ACM Trans. Priv. Secur., 27(3), Aug. 2024

    2024

  2. [10]

    A survey of mobile vpn technologies.IEEE Communications Surveys and Tutorials, 18(2):1177–1196, 2016

    Abdullah Alshalan, Sandeep Pisharody, and Dijiang Huang. A survey of mobile vpn technologies.IEEE Communications Surveys and Tutorials, 18(2):1177–1196, 2016

    2016

  3. [11]

    Group-based attestation: Enhancing privacy and management in remote attestation

    Sami Alsouri, Özgür Dagdelen, and Stefan Katzenbeisser. Group-based attestation: Enhancing privacy and management in remote attestation. InTrust and Trust- worthy Computing: Third International Conference, TRUST 2010, Berlin, Germany, June 21-23, 2010. Proceedings 3, pages 63–...

    2010

  4. [12]

    Trustzone: Integrated hardware and software security.Information Quarterly, 3:18–24, 2004

    Tiago Alves. Trustzone: Integrated hardware and software security.Information Quarterly, 3:18–24, 2004

    2004

  5. [13]

    Intel software guard extensions (Intel SGX)

    Ittai Anati, Frank Mckeen, Shay Gueron, Huang Haitao, Simon Johnson, Rebekah Leslie-Hurd, Harish Patil, Carlos Rozas, and Hisham Shafi. Intel software guard extensions (Intel SGX). InTutorial at International Symposium on Computer Architecture (ISCA), 2015

    2015

  6. [14]

    Patterson, Brian Richards, Colin Schmidt, Stephen Twigg, Huy Vo, and Andrew Waterman

    Krste Asanović, Rimas Avizienis, Jonathan Bachrach, Scott Beamer, David Bian- colin, Christopher Celio, Henry Cook, Daniel Dabbelt, John Hauser, Adam Izraele- vitz, Sagar Karandikar, Ben Keller, Donggyu Kim, John Koenig, Yunsup Lee, Eric Love, Martin Maas, Albert Magyar, Howar...

    2016

  7. [15]

    Embedded sim task force requirements and use cases

    Gsm Association et al. Embedded sim task force requirements and use cases. Version, 1:1–38, 2011

    2011

  8. [16]

    Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities (CSWP 36C ipd)

    Michael Bartock, Jeffrey Cichonski, Murugiah Souppaya, Karen Scarfone, Parisa Grayeli, and Sanjeev Sharma. Reallocation of Temporary Identities: Applying 5G Cybersecurity and Privacy Capabilities (CSWP 36C ipd). Technical report, NIST, Nov. 2024

    2024

  9. [17]

    The battle for control over ukraine’s internet.Time, Oct, 2022

    Vera Bergengruen. The battle for control over ukraine’s internet.Time, Oct, 2022

    2022

  10. [18]

    An efficient reliable puf-based cryptographic key generator in 65nm cmos

    Mudit Bhargava and Ken Mai. An efficient reliable puf-based cryptographic key generator in 65nm cmos. InDesign, Automation & Test in Europe Conference & Exhibition (DATE), pages 1–6. IEEE, 2014. 13 Proceedings on Privacy Enhancing Technologies 2026(X) Shirin Ebadi, Zach Moolma...

    2014

  11. [19]

    Cryptographic accelerators for digital signature based on ed25519.IEEE Transac- tions on Very Large Scale Integration (VLSI) Systems, 29(7):1297–1305, 2021

    Mojtaba Bisheh-Niasar, Reza Azarderakhsh, and Mehran Mozaffari-Kermani. Cryptographic accelerators for digital signature based on ed25519.IEEE Transac- tions on Very Large Scale Integration (VLSI) Systems, 29(7):1297–1305, 2021

    2021

  12. [20]

    Understanding IMSI Privacy

    Ravishankar Borgaonkar and Swapnil Udar. Understanding IMSI Privacy. In BlackHat, 2014

    2014

  13. [21]

    Direct anonymous attestation

    Ernie Brickell, Jan Camenisch, and Liqun Chen. Direct anonymous attestation. InConference on Computer and Communications Security, CCS ’04, page 132–145, New York, NY, USA, 2004. Association for Computing Machinery

    2004

  14. [22]

    Harvard University Press, 2020

    Ben Buchanan.The hacker and the state: Cyber attacks and the new normal of geopolitics. Harvard University Press, 2020

    2020

  15. [23]

    Group signatures

    David Chaum and Eugène Van Heyst. Group signatures. InAnnual Interna- tional Conference on Theory and Application of Cryptographic Techniques, EURO- CRYPT’91, page 257–265, Berlin, Heidelberg, 1991. Springer-Verlag

    1991

  16. [24]

    {MAGE}: Mutual attestation for a group of enclaves without trusted third parties

    Guoxing Chen and Yinqian Zhang. {MAGE}: Mutual attestation for a group of enclaves without trusted third parties. In31st USENIX Security Symposium (USENIX Security 22), pages 4095–4110, 2022

    2022

  17. [25]

    I gave a bounty hunter $300

    Joseph Cox. I gave a bounty hunter $300. then he located our phone. https: //www.vice.com/en/article/i-gave-a-bounty-hunter-300-dollars-located- phone-microbilt-zumigo-tmobile/, January 2019

    2019

  18. [26]

    SiamHAN: IPv6 address correlation attacks on TLS encrypted traffic via siamese heterogeneous graph attention network

    Tianyu Cui, Gaopeng Gou, Gang Xiong, Zhen Li, Mingxin Cui, and Chang Liu. SiamHAN: IPv6 address correlation attacks on TLS encrypted traffic via siamese heterogeneous graph attention network. In30th USENIX Security Symposium (USENIX Security 21), pages 4329–4346. USENIX Associ...

    2021

  19. [27]

    Equal access & interconnection

    Suzanne Debaille, Joel Repiquet, Mark Cartwright, and Simon Dunkley. Equal access & interconnection. study on the issues related to fair and equal access and the provision of harmonised offerings for interconnection to public telecommu- nications networks and services in the c...

    1997

  20. [28]

    libsodium

    Frank Denis. libsodium

  21. [29]

    Tor: The second- generation onion router

    Roger Dingledine, Nick Mathewson, Paul F Syverson, et al. Tor: The second- generation onion router. InUSENIX security symposium, volume 4, pages 303–320, 2004

    2004

  22. [30]

    Thomas Hou

    Changlai Du, Hexuan Yu, Yang Xiao, Wenjing Lou, Chonggang Wang, Robert Gazda, and Y. Thomas Hou. Mobile tracking in 5g and beyond networks: Problems, challenges, and new directions.2022 IEEE 19th International Conference on Mobile Ad Hoc and Smart Systems (MASS), pages 426–434, 2022

    2022

  23. [31]

    Decoupling the device and identity in cellular networks with vsim.arXiv preprint arXiv:2505.15827, 2025

    Shirin Ebadi, Zach Moolman, Eric Keller, and Tamara Lehman. Decoupling the device and identity in cellular networks with vsim.arXiv preprint arXiv:2505.15827, 2025

    2025 arXiv

  24. [32]

    Chinese hackers are deep inside america’s telecoms networks

    The Economist. Chinese hackers are deep inside america’s telecoms networks. The Economist, 2024

    2024

  25. [33]

    Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones.ACM Transactions on Computer Systems (TOCS), 32(2):1–29, 2014

    William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N Sheth. Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones.ACM Transactions on Computer Systems (T...

    2014

  26. [34]

    TR 102 216 - Technical Report: Smart Cards; Vocabulary for Smart Card Platform Specifications

    ETSI. TR 102 216 - Technical Report: Smart Cards; Vocabulary for Smart Card Platform Specifications. Technical Report TR 102 216 V5.0.0, European Telecom- munications Standards Institute, November 2019. Version 5.0.0

    2019

  27. [35]

    Embedded subscriber identity module esim

    Torsten J Gerpott and Sebastian May. Embedded subscriber identity module esim. Business & Information Systems Engineering, 59:293–296, 2017

    2017

  28. [36]

    https://www.glocalme.com /product/simbox/

    GlocalMe: SIMBOX – Multiple SIM Card Caller Set. https://www.glocalme.com /product/simbox/

  29. [37]

    Gräfenstein, Stefan Köpsell, and Maryam Zarezadeh

    Marcel D.S.K. Gräfenstein, Stefan Köpsell, and Maryam Zarezadeh. Privacy- preserving identifier checking in 5G. Cryptology ePrint Archive, Paper 2025/2200, 2025

    2025

  30. [38]

    The elliptic curve diffie-hellman (ecdh)

    Rakel Haakegaard and Joanna Lang. The elliptic curve diffie-hellman (ecdh). Online at https://koclab. cs. ucsb. edu/teaching/ecc/project/2015Projects/Haakegaard+ Lang. pdf, 2015

    2015

  31. [39]

    Expressive privacy control with pseudonyms

    Seungyeop Han, Vincent Liu, Qifan Pu, Simon Peter, Thomas Anderson, Arvind Krishnamurthy, and David Wetherall. Expressive privacy control with pseudonyms. InProceedings of the ACM SIGCOMM 2013 Conference on SIG- COMM, SIGCOMM ’13, page 291–302, New York, NY, USA, 2013. Associa...

    2013

  32. [40]

    Anony- mous device authorization for cellular networks

    Abida Haque, Varun Madathil, Bradley Reaves, and Alessandra Scafuro. Anony- mous device authorization for cellular networks. InProceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks, WiSec ’21, page 25–36, New York, NY, USA, 2021. Associ...

    2021

  33. [41]

    GUTI Reallocation Demysti- fied: Cellular Location Tracking with Changing Temporary Identifier

    Byeongdo Hong, Sangwook Bae, and Yongdae Kim. GUTI Reallocation Demysti- fied: Cellular Location Tracking with Changing Temporary Identifier. InNetwork and Distributed System Security Symposium (NDSS), Feb. 2018

    2018

  34. [42]

    the war phone

    Roman Horbyk. “the war phone”: mobile communication on the frontline in eastern ukraine.Digital War, 3(1):9–24, 2022

    2022

  35. [43]

    Identifying population movements with non-negative matrix factorization from wi-fi user counts in smart and connected cities.arXiv preprint arXiv:2111.10459, 2021

    Michael Huffman, Armen Davis, Joshua Park, and James Curry. Identifying population movements with non-negative matrix factorization from wi-fi user counts in smart and connected cities.arXiv preprint arXiv:2111.10459, 2021

    2021 arXiv

  36. [44]

    Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information

    Syed Rafiul Hussain, Mitziu Echeverria†, Omar Chowdhury†, Ninghui Li, and Elisa Bertino. Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information. InNetwork and Distributed System Security (NDSS), Feb. 2019

    2019

  37. [45]

    https://en.wikipedia.org/wiki/IMSI-catcher

    IMSI-catcher. https://en.wikipedia.org/wiki/IMSI-catcher

  38. [46]

    Intel®trust domain extension (intel®tdx).Intel, 2023

    Intel. Intel®trust domain extension (intel®tdx).Intel, 2023

    2023

  39. [47]

    A cost-effective foundation for end-to-end IoT security: Intel® enhanced privacy ID (Intel® EPID)

    Intel Corporation. A cost-effective foundation for end-to-end IoT security: Intel® enhanced privacy ID (Intel® EPID). White paper, Intel Corporation, 2015

    2015

  40. [48]

    Intel software guard extensions: Epid provisioning and attestation services

    Simon Johnson, Vinnie Scarlata, Carlos Rozas, Ernie Brickell, Frank Mckeen, et al. Intel software guard extensions: Epid provisioning and attestation services. White Paper, 1(1-10):119, 2016

    2016

  41. [49]

    tiny-aes-c: Small portable aes128/192/256 in c

    kokke. tiny-aes-c: Small portable aes128/192/256 in c

  42. [50]

    Deepu George Koshy and Sethuraman N. Rao. Evolution of sim cards – what’s next? In2018 International Conference on Advances in Computing, Communications and Informatics (ICACCI), pages 1963–1967, 2018

    1963

  43. [51]

    FCC fines major U.S

    Brian Krebs. FCC fines major U.S. wireless carriers for selling customer location data. Krebs on Security, April 2024. Accessed: 2026-02-19

    2024

  44. [52]

    Keystone: An open framework for architecting trusted execution environments

    Dayeol Lee, David Kohlbrenner, Shweta Shinde, Krste Asanovic, and Dawn Song. Keystone: An open framework for architecting trusted execution environments. InProceedings of the Fifteenth European Conference on Computer Systems, EuroSys ’20, 2020

    2020

  45. [53]

    RAND Corporation, 2023

    Mary Lee, James Dimarogonas, Bryce Downing, Edward Geist, Shane Manuel, and Ryan A Schwankhart.Opportunities and Risks of 5G Military Use in Europe. RAND Corporation, 2023

    2023

  46. [54]

    Platypus: Software-based power side-channel attacks on x86

    Moritz Lipp, Andreas Kogler, David Oswald, Michael Schwarz, Catherine Easdon, Claudio Canella, and Daniel Gruss. Platypus: Software-based power side-channel attacks on x86. In2021 IEEE Symposium on Security and Privacy (SP), pages 355–371, 2021

    2021

  47. [55]

    SIMurai: Slicing through the complexity of SIM card security research

    Tomasz Piotr Lisowski, Merlin Chlosta, Jinjin Wang, and Marius Muench. SIMurai: Slicing through the complexity of SIM card security research. In33rd USENIX Security Symposium (USENIX Security 24), pages 4481–4498, Philadelphia, PA, August 2024. USENIX Association

    2024

  48. [56]

    Pufky: A fully functional puf-based cryptographic key generator

    Roel Maes, Anthony Van Herrewege, and Ingrid Verbauwhede. Pufky: A fully functional puf-based cryptographic key generator. InCryptographic Hardware and Embedded Systems (CHES), pages 302–319. Springer, 2012

    2012

  49. [57]

    Privacy issues in location-aware mobile devices

    Robert P Minch. Privacy issues in location-aware mobile devices. InAnnual Hawaii International Conference on System Sciences, pages 10–pp. IEEE, 2004

    2004

  50. [58]

    Com- bining communication patterns & traffic patterns to enhance mobile traffic iden- tification performance.Journal of Information Processing, 24(2):247–254, 2016

    Sophon Mongkolluksamee, Vasaka Visoottiviseth, and Kensuke Fukuda. Com- bining communication patterns & traffic patterns to enhance mobile traffic iden- tification performance.Journal of Information Processing, 24(2):247–254, 2016

    2016

  51. [59]

    esimplicity or esimplification? privacy and security risks in the esim ecosystem

    Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas, and Aanjhan Ran- ganathan. esimplicity or esimplification? privacy and security risks in the esim ecosystem. InProceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA, 2025. USENIX Association

    2025

  52. [60]

    RFC 3041: Privacy Extensions for Stateless Address Autoconfiguration in IPv6, 2001

    Thomas Narten and Richard Draves. RFC 3041: Privacy Extensions for Stateless Address Autoconfiguration in IPv6, 2001

    2001

  53. [61]

    Preventing SIM Box Fraud Using Device Model Finger- printing

    BeomSeok Oh, Junho Ahn, Sangwook Bae, Mincheol Son, Yonghwa Lee, Min Suk Kang, and Yongdae Kim. Preventing SIM Box Fraud Using Device Model Finger- printing. InNetwork and Distributed System Security (NDSS), Feb. 2023

    2023

  54. [62]

    Nested enclave: Supporting fine-grained hierarchical isolation with sgx

    Joongun Park, Naegyeong Kang, Taehoon Kim, Youngjin Kwon, and Jaehyuk Huh. Nested enclave: Supporting fine-grained hierarchical isolation with sgx. In International Symposium on Computer Architecture (ISCA), pages 776–789, 2020

    2020

  55. [63]

    Lightweight identity-based re-authentication for supporting post-quantum security in 5g

    Manish Paudel, Maryna Veksler, and Kemal Akkaya. Lightweight identity-based re-authentication for supporting post-quantum security in 5g. InWorkshop on Security and Privacy of Next-Generation Networks (FutureG 2026), San Diego, CA, USA, February 2026

    2026

  56. [64]

    Privacy in (mobile) telecommunications services.Ethics and Information Technology, 6:247–260, 2004

    Jacques Penders. Privacy in (mobile) telecommunications services.Ethics and Information Technology, 6:247–260, 2004

    2004

  57. [65]

    SafeBricks: Shielding network functions in the cloud

    Rishabh Poddar, Chang Lan, Raluca Ada Popa, and Sylvia Ratnasamy. SafeBricks: Shielding network functions in the cloud. In15th USENIX Symposium on Net- worked Systems Design and Implementation (NSDI 18), pages 201–216, Renton, WA, Apr. 2018. USENIX Association

    2018

  58. [66]

    Advanced encryption standard (aes)(fips-197)

    AES Primitives. Advanced encryption standard (aes)(fips-197). 2003

    2003

  59. [67]

    Snoeren, and David Wetherall

    Barath Raghavan, Tadayoshi Kohno, Alex C. Snoeren, and David Wetherall. En- listing isps to improve online privacy: Ip address mixing by default. InProceedings of the 9th International Symposium on Privacy Enhancing Technologies, 2009

    2009

  60. [68]

    Detecting and De- fending Against Third-Party Tracking on the Web

    Franziska Roesner, Tadayoshi Kohno, and David Wetherall. Detecting and De- fending Against Third-Party Tracking on the Web. InUSENIX Symposium on Networked Systems Design and Implementation (NSDI), 2012

    2012

  61. [69]

    PhD thesis, Khalifa University of Science, 2018

    Khalifa Abdulla Ali Saad.Security risks to military operations posed by online fitness tracking devices. PhD thesis, Khalifa University of Science, 2018

    2018

  62. [70]

    Supporting third party attestation for intel sgx with intel data center attestation primitives

    Vinnie Scarlata, Simon Johnson, James Beaney, and Piotr Zmijewski. Supporting third party attestation for intel sgx with intel data center attestation primitives. White paper, 12, 2018

    2018

  63. [71]

    Pretty Good Phone Privacy

    Paul Schmitt and Barath Raghavan. Pretty Good Phone Privacy. In30th USENIX Security Symposium (USENIX Security), Aug. 2021

    2021

  64. [72]

    Asokan, Valtteri Niemi, and Jean-Pierre Seifert

    Altaf Shaik, Ravishankar Borgaonkar†, N. Asokan, Valtteri Niemi, and Jean-Pierre Seifert. Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems. InNetwork and Distributed System Security Symposium 14 Di5Guise: 5G Privacy with vSIMProceedings...

    2026

  65. [73]

    The use of private mobile phones at war: Ac- counts from the donbas conflict

    Irina Shklovski and Volker Wulf. The use of private mobile phones at war: Ac- counts from the donbas conflict. InCHI conference on human factors in computing systems, pages 1–13, 2018

    2018

  66. [74]

    https://github.com/CuiTianyu961030/SiamHAN

    SiamHAN. https://github.com/CuiTianyu961030/SiamHAN

  67. [75]

    https://signal.org/

    Signal messanger. https://signal.org/

  68. [76]

    Zipphone: Protecting user location privacy from cellular service providers, 2020

    Keen Sung, Brian Levine, and Mariya Zheleva. Zipphone: Protecting user location privacy from cellular service providers, 2020

    2020

  69. [77]

    A survey of encryption algo- rithms in iot.17th SC@ RUG 2019-2020, page 9, 2020

    Kaavyaa Stalin Thara and Pranav Gupta Vallala. A survey of encryption algo- rithms in iot.17th SC@ RUG 2019-2020, page 9, 2020

    2019

  70. [78]

    https://www.walmart.com/c/kp/prepaid-sim-cards

    Walmart - pre-paid sim cards. https://www.walmart.com/c/kp/prepaid-sim-cards

  71. [79]

    Court upholds $92M T-Mobile fine for selling customer data

    TROYPOINT. Court upholds $92M T-Mobile fine for selling customer data. TROYPOINT, 2025. Accessed: 2026-02-19

    2025

  72. [80]

    Military decoys for the digital age

    Stefan Tschimben, Isabella Bates, Rucha Khairnar, Joanna Crosby, James H Curry, and Keith D Gremban. Military decoys for the digital age. InMILCOM 2024-2024 IEEE Military Communications Conference (MILCOM), pages 981–986. IEEE, 2024

    2024

  73. [81]

    Compact and flexible fpga implementa- tion of ed25519 and x25519.ACM Transactions on Embedded Computing Systems (TECS), 18(3):1–21, 2019

    Furkan Turan and Ingrid Verbauwhede. Compact and flexible fpga implementa- tion of ed25519 and x25519.ACM Transactions on Embedded Computing Systems (TECS), 18(3):1–21, 2019

    2019

  74. [82]

    The subscriber identity module: Past, present and future.GSM and UMTS: The Creation of Global Mobile Communication, pages 341–369, 2001

    Klaus Vedder. The subscriber identity module: Past, present and future.GSM and UMTS: The Creation of Global Mobile Communication, pages 341–369, 2001

    2001

  75. [83]

    Should you get a burner phone for your next international trip? what you need to know

    Palash Volvoikar. Should you get a burner phone for your next international trip? what you need to know. https://www.cnet.com/tech/mobile/why-international- travelers-should-consider-a-burner-phone-going-into-the-us/, April 2025

    2025

  76. [84]

    Walls, Shane S

    Robert J. Walls, Shane S. Clark, and Brian Neil Levine. Functional privacy or why cookies are better with milk. InUSENIX Workshop on Hot Topics in Security (HotSec), 2012

    2012

  77. [85]

    The risc-v instruction set manual volume ii: Privileged architecture

    Krste Asanović Andrew Waterman. The risc-v instruction set manual volume ii: Privileged architecture. Technical report, 2017

    2017

  78. [86]

    Us cell carriers are selling access to your real-time phone location data

    Zack Whittaker. Us cell carriers are selling access to your real-time phone location data. https://www.zdnet.com/article/us-cell-carriers-selling-access-to- real-time-location-data/, May 2018

    2018

  79. [87]

    The department of defense’s digital logistics are under attack

    Jason Wolff. The department of defense’s digital logistics are under attack. 2023

    2023

  80. [88]

    How the great firewall of china detects and blocks fully encrypted traffic

    Mingshi Wu, Jackson Sippe, Danesh Sivakumar, Jack Burg, Peter Anderson, Xiaokang Wang, Kevin Bock, Amir Houmansadr, Dave Levin, and Eric Wustrow. How the great firewall of china detects and blocks fully encrypted traffic. In32nd USENIX Security Symposium (USENIX Security 23), ...

    2023

  81. [89]

    Tuba Yavuz, Farhaan Fowze, Grant Hernandez, Ken Yihang Bai, Kevin R. B. Butler, and Dave Jing Tian. Encider: Detecting timing and cache side channels in sgx enclaves and cryptographic apis.IEEE Transactions on Dependable and Secure Computing, 20(2):1577–1595, 2023

    2023

  82. [90]

    A design of milenage algorithm-based mutual authentication protocol for the protection of initial identifier in lte.Journal of Venture Innovation, 2(1):13–21, 2019

    Jae-hoe Yoo, Hyung-uk Kim, and Yong-hoon Jung. A design of milenage algorithm-based mutual authentication protocol for the protection of initial identifier in lte.Journal of Venture Innovation, 2(1):13–21, 2019

    2019

  83. [91]

    Thomas Hou, and Wenjing Lou

    Hexuan Yu, Changlai Du, Yang Xiao, Angelos Keromytis, Chonggang Wang, Robert Gazda, Y. Thomas Hou, and Wenjing Lou. AAKA: An Anti-Tracking Cellular Authentication Scheme Leveraging Anonymous Credentials. InNetwork and Distributed System Security Symposium (NDSS), Feb. 2024

    2024

  84. [92]

    Securesim: rethinking authentication and access control for sim/esim

    Jinghao Zhao, Boyan Ding, Yunqi Guo, Zhaowei Tan, and Songwu Lu. Securesim: rethinking authentication and access control for sim/esim. InProceedings of the 27th Annual International Conference on Mobile Computing and Networking, Mo- biCom ’21, page 451–464, New York, NY, USA, ...

    2021

Pith tools

Reviewed July 12, 2026 · model on record in the stance chip above.