Adi Juliawan PawanaA. J. Pawana

Research

Six areas of active research.

My work spans formal verification of 3GPP protocols, detection of false base stations, and post-quantum cryptography, together with the 5G testbed that lets me measure each of them under load.

6 projects5 funded3 standards & service roles
01

False base station detection in beyond-5G networks

Problem

A false base station impersonates legitimate network infrastructure to intercept traffic or track subscribers. Detecting one is hard because genuine attack data is scarce, and the signals that distinguish an attacker from a congested cell are subtle.

Approach

Three complementary lines of work: synthesising realistic attack traffic with generative adversarial networks to solve the data scarcity problem, classifying it with a quanvolutional neural network that applies quantum circuits as feature extractors, and detecting multi-stage attacks from the handset side by reading NAS and RRC layer signalling rather than signal strength alone.

Outcome

A detection pipeline that trains on synthesised attack data and evaluates quantum-enhanced classification against classical baselines, plus a UE-side method that detects attacks which signal-strength heuristics miss. This is the core of my doctoral dissertation.

02

An end-to-end 5G testbed for security research

Problem

Evaluating new mobile network security mechanisms requires a network that can be modified end to end. Commercial equipment is closed, and the available open-source implementations each cover a single component, stop short of the interfaces most relevant to security research, and are not designed to interoperate across non-3GPP access, non-public networks, and the cryptography beneath them.

Approach

I extended four components and integrated them into a single system: the core network, the eBPF user plane, the RAN and UE simulator, and a non-3GPP UE. Each is a fork of an established open-source project carrying features its upstream does not implement, including eleven additional network functions in the core alone, Release 17 and 19 signalling, standalone non-public networks and inter-operator roaming across every access type, N2 and Xn handover in the radio access, and post-quantum key exchange throughout the authentication path.

Outcome

A testbed on which a formally verified protocol can be deployed, attacked, and measured under load. It runs on bare metal and on a k3s/arm64 cluster, and produced the published EAP-AKA' evaluation. Each component below is my own work on top of its upstream.

Testbed components

Core network

Extended 5G core

adijuliawan/open5gsprivateCextends Open5GS

  • Service-based interface layer regenerated against 3GPP Release 19 with openapi-generator, reproducible from a single script, and rebased onto Open5GS v2.8.0 with Rel-19 NGAP, NAS, and ASN.1
  • Eleven network functions the upstream core does not ship: N3IWF, TNGF, TWIF and W-AGF access gateways; NEF, CHF, NSSAAF, NSACF and NSWOF; and the Release 19 Ambient IoT pair, AIoTF and the Ambient IoT Data Management function of TS 29.369
  • Trusted non-3GPP access in two forms: TNGF carrying EAP-5G over RADIUS with NWt IPsec keyed by K_TIPSec, and TWIF running the NAS stack on behalf of N5CW Wi-Fi devices with no IPsec at all, keying the WLAN handshake through RADIUS MS-MPPE
  • Release 18 standalone non-public networks over both 3GPP and non-3GPP access, with network selection by NID, UE onboarding against local and remote provisioning servers, and Credentials Holder authentication reached over SEPP and N32
  • A pluggable EAP method framework covering EAP-AKA', EAP-5G, EAP-TLS and EAP-TTLS, with an experimental EAP-EDHOC method alongside them
  • Post-quantum crypto-agility for EAP-TLS through liboqs on OpenSSL 3.5, with selectable classical, hybrid and pure-PQC key exchange; PQC SUCI schemes, IKEv2, inter-NF SBI TLS and 256-bit NAS key hierarchies are staged on a research branch
  • Feature completions across the added functions: NEF traffic influence and QoS exposure under TS 29.522, access-aware converged charging including non-3GPP and SNPN, slice re-authentication and revocation under TS 33.501, PDU-session secondary authentication to an external DN-AAA, and a policy-driven uplink classifier for edge break-out
  • SEPP and N32 inter-PLMN roaming in both local break-out and home-routed modes
  • Per-NF container images and a Helm chart, validated on k3s/arm64 with indirect SBI through the SCP, 3GPP NF FQDNs, Multus interfaces for N2, N3 and Yw, and Prometheus metrics
  • Validated end to end on bare metal and on the k3s/arm64 SNPN testbed across all four access types and all four EAP methods

User plane

eBPF user plane

adijuliawan/eupfprivateGoextends eUPF

  • Ethernet PDU sessions implemented end to end: frame parsing separated from the IP path, packet filters that select a rule, traffic in both directions, MAC address reporting back to the SMF, buffering, and an uplink classifier over Ethernet
  • Usage Reporting Rules made functional rather than decorative: volume thresholds reported through Session Report Request, the time-based half honoured, forwarding stopped when quota is exhausted, the substitute FAR applied, and quota exemption and validity time both provisioned and advertised
  • Buffering Action Rules honoured instead of logged, holding downlink packets on BUFF and releasing them on FORW
  • SDF filters resolved bidirectionally by filter ID, ordered by precedence, several per UE, with a matching direction that had been inverted
  • IPv6 support across the datapath: GTP-U over an IPv6 transport with correct checksums, multi-homing branching points, IPv4v6 downlink matching, and End Markers on IPv6 tunnels
  • QER enforcement for every rule a PDR names rather than only the first, plus an MBR that wrapped above 4.29 Gbps and a floor that rejected low-rate streams
  • PFCP robustness: association re-establishment carrying its sessions, oversized messages that were silently discarded, a heartbeat response that could stall the receive loop, and malformed information elements that collapsed distinct faults into one error
  • Resource lifecycle fixes for URR slots, UE IP addresses and TEIDs leaked on teardown, and rule removal that could free another session's map slot
  • Conformance against TS 29.281 and TS 29.244, including a GTP-U echo interval that breached a normative requirement by default
  • eBPF corrections at the verifier boundary: map value padding a strict verifier rejects, and a third of the datapath stack budget held by an unreachable branch
  • Observability repairs, with datapath counters that never reached Prometheus and a scrape that republished every counter it had ever seen
  • arm64 as a first-class build target, with a Kubernetes deployment path

Radio access

RAN and UE simulator

adijuliawan/UERANSIMprivateC++extends UERANSIM

  • 5G roaming on the UE in both local break-out and home-routed modes
  • Standalone non-public network support across gNB and UE, with NR RRC ASN.1 raised to Release 17 so the NID is broadcast natively in SIB1 and carried into the serving network name
  • Network slice-specific authentication and authorization on the UE
  • N2 handover built out on both sides: HandoverRequired and HandoverCommand at the source, admission and acknowledgement at the target, rebind and HandoverNotify to complete it, and the failure and cancel paths
  • Xn handover between gNBs, including the inter-gNB transport and setup handshake, request and acknowledgement, Path Switch, and release
  • UE-side handover execution through RRCReconfiguration with ReconfigurationWithSync, hardened against stale HandoverCommands after a cancelled preparation and against self-handover
  • EAP-AKA' hardened for crypto soundness and RFC conformance across its base, forward-secrecy and post-quantum variants, with two decoder and encoder defects fixed and post-quantum KEM support added through liboqs
  • Per-flow QoS: TS 24.501 rule parsing, PDU session modification on both NAS and NGAP, an uplink flow classifier, and the QFI carried into the GTP-U header
  • T3396 back-off honoured, with local exponential back-off on PDU session reject and release
  • User-plane throughput work measured against a baseline harness: gNB fast paths, batched socket I/O, configurable TUN MTU and CPU affinity, each gated off by default, plus a fix for a remotely triggerable crash in the gNB

Untrusted access UE

Non-3GPP UE

adijuliawan/n3iwueprivateGoextends free5GC n3iwue

  • Complete primary authentication coverage on the UE side: 5G-AKA, EAP-AKA' under TS 33.501 and RFC 5448, EAP-TLS 1.3, and EAP-TTLS with MS-CHAPv2 under TS 33.501 Annex U
  • An experimental EAP-EDHOC method built to RFC 9528 and tracked from draft-09 to draft-ietf-emu-eap-edhoc-12, with a full method and cipher-suite matrix and an interop record against the corresponding AUSF
  • Network slice-specific authentication and authorization, with the post-authentication key and IKE acknowledgement paths corrected
  • EAP-TLS secondary authentication for PDU sessions under TS 33.501
  • A crypto-agility layer on the EAP-TLS 1.3 peer for post-quantum research, with an algorithm-agnostic PKI script on OpenSSL 3.5 and a matrix sweep harness
  • UE-side standalone non-public networks: onboarding registration, remote provisioning and re-registration, subscription-based access, Credentials Holder authentication via external AAA, and anonymous SUCI with NSI-based SUPI
  • IPsec child-SA rekey migration under TS 24.502
  • Security context persisted across daemon restarts with per-transition state saves and GUTI capture, and clean deregistration on shutdown
  • Production packaging for an arm64 single-board target, including a kernel-state safety net for crashed runs and port forwarding that survives raw ESP across subnets
03

Quantum-resilient authentication for 5G and 6G

Problem

The authentication protocols securing mobile networks today rest on cryptography that a sufficiently large quantum computer would break. Replacing them is constrained by backward compatibility and by the strict latency budgets of mobile handover.

Approach

Designed a hybrid post-quantum variant of 5G-AKA that adds forward secrecy while remaining deployable alongside existing infrastructure, surveyed the EAP-AKA' protocol family with formal analysis and empirical measurement, and measured the cost of EAP-AKA' on a real Open5GS testbed for industrial non-public networks.

Outcome

5G-AKA-HPQC, published in IEEE Internet of Things Journal, alongside a systematic assessment of where the EAP-AKA' family stands against quantum adversaries and what its integration actually costs in deployment.

04

Formal verification of mobile authentication protocols

Problem

Security proofs for mobile network protocols are frequently published with methodological gaps, and a flawed proof is more consequential than no proof, because it discourages further scrutiny.

Approach

Modelled 3GPP protocols in ProVerif and SVO logic, re-examined published verification results, and corrected the methodology where the original analysis did not hold.

Outcome

A corrected reassessment of 5G-AKA-FS, verification of AKMA under the TLS 1.3 PSK option, and a vulnerability analysis of the DMRN handover protocol for 6G.

05

Intrusion detection for the cloud-native 5G core

Problem

Moving the 5G core onto cloud-native infrastructure widens the attack surface considerably, and roaming interfaces, where traffic crosses between operators that only partially trust each other, are among the most exposed.

Approach

Built a deep learning intrusion detection system targeting roaming traffic in a cloud-native core, benchmarked detection architectures for real-time use under Kubernetes orchestration, and contributed to a Zero Trust reference architecture for regulated financial environments.

Outcome

A roaming-focused IDS evaluated against cloud-native 5G core traffic, a benchmark of which architectures hold up under real-time constraints, and a Zero Trust DevSecOps model published for the financial sector.

06

Language models for anomaly and threat detection

Problem

Medical IoT devices such as insulin delivery controllers cannot run heavyweight security monitoring, yet a compromised controller poses a direct physical risk to the patient. Separately, the development of defensive models across security is limited by the scarcity of labelled attack data.

Approach

Built a lightweight LLM-based anomaly detection framework sized for constrained medical devices, and used LLM-driven augmentation to expand attack datasets for web API threat detection.

Outcome

An anomaly detection framework for IoTMD-enabled diabetes management systems, a generative augmentation method that improves web API attack detection, and a design review of specification-based misbehaviour detection.

Funded projects

5 total

Standards & service

Presentations

Conference presentations tied to first-author papers. Invited talks and seminars are listed separately once confirmed.