Security and Isolation⚓︎

Mobile Asset traffic is contained, subscribers are authenticated with the configured algorithms and re-synchronized when needed, the 5G permanent identity is never sent in clear, the management path is outbound only, access to xControl follows the role model, changes are audited, and the core withstands a flood of unknown subscribers.

EXP-SEC-001 — UE-to-UE communication prevented⚓︎

Objective. The network blocks direct communication between two Mobile Assets served by the platform.

Preconditions

• Platform
  • An xCore is deployed and operational, and its Site shows as online in xControl.
  • The xCore is configured to prevent UE-to-UE communication (the default configuration).
  • The xCore has a System.
• Mobile Asset
  • Two Mobile Assets are provisioned on the System.
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
• Procedures executed first
  • EXP-SES-007 — Multiple UE attach

Procedure

Pass criteria

• No packet from one UE reaches the other in either direction.

Evidence collected: ICMP result from the UE.

EXP-SEC-002 — UE-to-platform communication prevented⚓︎

Objective. The network blocks communication from a UE to the software components of the Expeto Platform: the xCore's own addresses, its monitoring endpoints and the cluster's node addresses.

Preconditions

• Platform
  • An xCore is deployed and operational, and its Site shows as online in xControl.
  • The xCore is configured to prevent UE-to-UE communication (the default configuration).
  • The xCore has a System on which the UE is provisioned.
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
  • The node addresses of the cluster hosting the xCore (kubectl get nodes -o wide).
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Pass criteria

• No platform or node address answers the UE on any protocol tried.

Evidence collected: ICMP result from the UE.

EXP-SEC-003 — Authentication failure with wrong key material⚓︎

Objective. A SIM whose secret key does not match the key stored for its Mobile Asset fails authentication and obtains no service, and the failure is visible in xControl.

Preconditions

• Platform
  • The Site has a System with a System Profile and a Keyset.
• Mobile Asset
  • A Mobile Asset provisioned for the UE's IMSI with a deliberately wrong secret key (K) or operator key (OPc), state Active.
• Device
  • The UE is powered off or in airplane mode.
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.

Procedure

Expected signalling

Capture points: S1-MME / N2 (point 1), S6a / N8 (point 4).

Pass criteria

• No session is created and the UE obtains no service until the key material is corrected.
• The failed authentication is visible in xControl within 60 seconds.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log.
References: 3GPP TS 33.401 §6.1.1 (AKA procedure); 3GPP TS 24.301 §5.4.2.5 (Authentication not accepted by the network); 3GPP TS 33.501 §6.1.3 (Authentication procedures).

EXP-SEC-004 — Signalling security algorithms⚓︎

Objective. The network selects the configured ciphering and integrity algorithms for NAS and access stratum signalling, and every NAS message after the security mode procedure is integrity protected.

Preconditions

• Platform
  • You know the ciphering and integrity algorithms configured on the xCore (by default 128-EEA1 / 128-EIA1 for 4G and 128-NEA1 / 128-NIA1 for 5G).
• Tooling and access
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Pass criteria

• The selected algorithms equal the configured ones.
• Every NAS message after Security Mode Complete is integrity protected.

Evidence collected: 3GPP signalling capture (pcap).
References: 3GPP TS 33.401 §7.2.4 (NAS security mode command procedure); 3GPP TS 33.501 §6.7.2 (NAS security mode command procedure).

EXP-SEC-005 — Management path is outbound only and encrypted⚓︎

Objective. The connection between an xCore and xControl is initiated by the xCore, uses TLS at an accepted protocol version, and requires no inbound connection to the xCore from the management network.

Preconditions

• Tooling and access
  • A signalling capture on the xCore's egress (capture point 6).
  • A host on the management network (where xControl runs) with a port scanner.
• Procedures executed first
  • EXP-INS-002 — Management path and subscriber synchronization

Procedure

Pass criteria

• Every management connection is initiated by the xCore.
• TLS 1.2 or later is negotiated, with a cipher suite from the list in the platform's security documentation.
• Blocking inbound traffic to the xCore has no effect on management.

Evidence collected: 3GPP signalling capture (pcap); CLI output.

EXP-SEC-006 — Role-based access control in xControl⚓︎

Objective. Each xControl role can perform exactly the actions the permission model grants it, in the portal and through the API, and a Customer-scoped role sees only its own Customer's objects.

Preconditions

• Platform
  • Two Customers exist, each with at least one Mobile Asset.
• Tooling and access
  • Accounts with the ADMIN, CUSTOMER_ADMIN and READ_ONLY roles; the last two scoped to the first Customer.
  • An API token for each account.

Procedure

Pass criteria

• Every action tried matches the permission model for the role, in the portal and through the API.
• A Customer-scoped role never sees another Customer's objects.

Postconditions

• Revert the status change made as CUSTOMER_ADMIN.

Evidence collected: xControl screenshot.

EXP-SEC-007 — Audit trail of provisioning and access⚓︎

Objective. Provisioning changes and portal logins are recorded with the account, the time and, for logins, the origin address, so that an administrator can reconstruct who changed what.

Preconditions

• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • A superuser account, for the revision history.
• Procedures executed first
  • EXP-PRV-001 — Provision a Mobile Asset

Procedure

Pass criteria

• Every login attempt and every provisioning change tried is recorded with account and time.

Evidence collected: xControl screenshot.

EXP-SEC-008 — Unknown-subscriber signalling storm⚓︎

Objective. A sustained flood of attach attempts from subscribers the platform does not know is rejected in full, without a restart of any network function, without unbounded memory growth, and without degrading service for known subscribers.

Preconditions

• Platform
  • The 3GPP peer simulator is connected to the xCore as a radio and configured with 250 IMSIs that are not provisioned (for example on an unserved PLMN).
  • Container CPU and memory of the MME or AMF and the subscriber database can be read (kubectl top pod, or the container metrics in xView).
• Mobile Asset
  • One Mobile Asset is connected and passing data (execute the UE-initiated attach procedure first if it is not).
• Tooling and access
  • Access to the CLI.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Pass criteria

• Zero unknown subscribers accepted; no network function restarted.
• The known UE keeps service and re-attaches during the flood.
• MME or AMF memory is back at its pre-flood baseline within five minutes of the flood ending, and no context remains for any unknown IMSI.

Evidence collected: Kubernetes pod and node status; CLI output; UE connectivity check.

EXP-SEC-009 — Subscriber identity concealment (SUCI)⚓︎

Objective. A 5G UE never sends its permanent identity in clear. The Registration Request and every identity response carry a SUCI protected with the home network's public key, the UDM de-conceals it with the private key provisioned on the Site, and registration fails when that key is absent.

Preconditions

• Platform
  • The home network private key for the Site's PLMN is provisioned on the Site's subscriber database (cd /nr, then add suci pkId=<key id> plmn=<mccmnc>, entering the private key when prompted) and read suci lists it.
• Mobile Asset
  • The UE's Mobile Asset is provisioned in xControl on the System under test, with state Active and status Provisioned or Disconnected.
  • The SIM has SUCI concealment enabled with protection scheme Profile A or Profile B, the same key identifier, and the matching home network public key.
• Device
  • The UE is powered off or in airplane mode.
• Tooling and access
  • Log in to xControl with an account that can view the Mobile Asset under test.
  • A signalling capture on N2 (capture point 1).
  • Access to the CLI.

Procedure

Expected signalling

Capture points: N2 (point 1).

Pass criteria

• Every identity the UE sends on N2 is a SUCI with a non-null protection scheme and the provisioned key identifier; the IMSI never appears in clear.
• Registration succeeds with the private key present and fails without it.

Postconditions

• Confirm with read suci that the key is present again.

Evidence collected: 3GPP signalling capture (pcap); CLI output.
References: 3GPP TS 33.501 §6.12 (Subscription identifier privacy); 3GPP TS 24.501 §9.11.3.4 (5GS mobile identity (SUCI)); 3GPP TS 24.501 §5.4.3 (Identification procedure); 3GPP TS 23.003 §2.2B (Subscription Concealed Identifier (SUCI)).

EXP-SEC-010 — Authentication re-synchronisation⚓︎

Objective. A SIM that has been authenticated by one subscriber database (for example the private Site's) and then attaches through another (the xRouter's, or a second private Site's) reports a sequence-number mismatch. The network re-synchronises with the SIM and completes the authentication without any action on the device.

Preconditions

• Platform
  • Two Sites of the same Customer with independent subscriber databases that both hold the Mobile Asset, A and B (a private Site and the xRouter, or two private Sites with a Shared System), each with a capture point on its S1-MME / N2 and S6a / N8 interfaces.
• Mobile Asset
  • The Mobile Asset is provisioned on a System available at both Sites.
• Tooling and access
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
  • Log in to xControl with an account that can view the Mobile Asset under test.
• Procedures executed first
  • EXP-SES-001 — UE-initiated attach

Procedure

Expected signalling

Capture points: S1-MME / N2 at Site B (point 1), S6a / N8 at Site B (point 4).

Pass criteria

• The attach at the second Site completes without any action on the device.
• Exactly one re-synchronisation round is needed on arrival, none on the following attach at the same Site.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log.
References: 3GPP TS 33.102 §6.3.5 (Re-synchronisation procedure); 3GPP TS 24.301 §5.4.2.7 (Abnormal cases in the UE (synch failure)); 3GPP TS 29.272 §5.2.3.1 (Authentication Information Retrieval (Re-Synchronization-Info)); 3GPP TS 33.501 §6.1.3.3 (Synchronisation failure or MAC failure); 3GPP TS 24.501 §5.4.1.3.7 (Abnormal cases in the UE (5G AKA synch failure)).

EXP-SEC-011 — Illegal UE reject (cause #3) after a failed authentication⚓︎

Objective. A UE the network cannot authenticate is refused with cause 3, Illegal UE: the network abandons the attach or registration with that cause, releases the radio connection and keeps no context, and the UE treats its SIM as invalid for the network until it is power-cycled instead of retrying. EXP-SEC-003 covers the failure itself and its visibility; this test covers the exact cause and what follows it.

Preconditions

• Platform
  • The Site has a System with a System Profile and a Keyset.
• Mobile Asset
  • A Mobile Asset provisioned for the UE's IMSI with a deliberately wrong secret key (K), state Active, as in EXP-SEC-003.
• Device
  • The UE is powered off or in airplane mode.
• Tooling and access
  • Log in to xControl with an account that holds the ADMIN role.
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
• Procedures executed first
  • EXP-SEC-003 — Authentication failure with wrong key material

Procedure

Expected signalling

Capture points: S1-MME / N2 (point 1), S6a / N8 (point 4).

Pass criteria

• The reject carries cause #3, Illegal UE (EMM on 4G, 5GMM on 5G), the radio connection is released, and no MME or AMF context remains.
• The UE makes no further attach or registration attempt on the network for five minutes after the reject.
• The failed authentication is visible in the xControl Event Log within 60 seconds, and service returns once the key is corrected and the UE power-cycled.

Postconditions

• Restore the correct key material on the Mobile Asset.

Deployment notes

• Simulator: With the 3GPP peer simulator, send an Authentication Response with a wrong RES instead of using a mis-keyed SIM: the network rejects the response and the same cause follows.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log; CLI output.
References: 3GPP TS 24.301 §5.4.2.7 (Authentication procedure, abnormal cases on the network side); 3GPP TS 24.301 §5.5.1.2.5 (Attach not accepted by the network); 3GPP TS 24.501 §5.4.1.3.5 (Authentication not accepted by the network); 3GPP TS 24.501 §5.5.1.2.5 (Initial registration not accepted by the network); 3GPP TS 33.401 §6.1.1 (AKA procedure).

EXP-SEC-012 — PLMN not allowed (cause #11) for a UE of a PLMN the Site does not serve⚓︎

Objective. A UE whose IMSI belongs to a PLMN the Site does not serve selects the private network and is refused with cause 11, PLMN not allowed, before any authentication: the UE places the private PLMN on its forbidden list and returns to its own network instead of retrying, and the private core spends no subscriber-database exchange on it. This is the behaviour a private radio owes the mobile operator's other subscribers and any third-party device in its coverage.

Preconditions

• Platform
  • The private radio broadcasts a PLMN of its own, different from the home PLMN of the UE under test.
  • The Site's served PLMN list holds only the PLMNs of the Mobile Assets it hosts; the UE's home PLMN is not among them.
• Mobile Asset
  • A UE with a SIM of another network (a consumer SIM of the mobile operator, or a third party's) that is not provisioned in xControl.
• Device
  • The UE is powered off or in airplane mode.
• Tooling and access
  • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.

Procedure

Expected signalling

Capture points: S1-MME / N2 (point 1), S6a / N8 (point 4).

Pass criteria

• The reject carries cause #11, PLMN not allowed, and is sent without an authentication attempt; no request for the UE's identity reaches the subscriber database.
• The UE makes no further attempt on the private PLMN in automatic selection for five minutes and returns to its home network where it has coverage.
• No MME or AMF context remains for the IMSI.

Postconditions

• Power-cycle the UE to clear the private PLMN from its forbidden list before using it in other tests.

Deployment notes

• MNO PLMN broadcast: Where the private radio broadcasts the mobile operator's own PLMN, cause #11 would forbid the UE's home network; such a deployment refuses unserved subscribers through the subscriber database instead (EXP-PRV-005) and this test does not apply.

Evidence collected: 3GPP signalling capture (pcap); CLI output.
References: 3GPP TS 24.301 §5.5.1.2.5 (Attach not accepted by the network); 3GPP TS 24.501 §5.5.1.2.5 (Initial registration not accepted by the network); 3GPP TS 23.122 §3.1 (Forbidden PLMN list (definition)).