{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T06:41:46Z","timestamp":1783492906567,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":50,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,10,25]],"date-time":"2021-10-25T00:00:00Z","timestamp":1635120000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1910150,CNS-2008026"],"award-info":[{"award-number":["CNS-1910150,CNS-2008026"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,10,25]]},"DOI":"10.1145\/3447993.3483255","type":"proceedings-article","created":{"date-parts":[[2021,10,26]],"date-time":"2021-10-26T09:00:31Z","timestamp":1635238831000},"page":"465-477","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":13,"title":["Data-plane signaling in cellular IoT"],"prefix":"10.1145","author":[{"given":"Zhaowei","family":"Tan","sequence":"first","affiliation":[{"name":"University of California"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Boyan","family":"Ding","sequence":"additional","affiliation":[{"name":"University of California"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jinghao","family":"Zhao","sequence":"additional","affiliation":[{"name":"University of California"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yunqi","family":"Guo","sequence":"additional","affiliation":[{"name":"University of California"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Songwu","family":"Lu","sequence":"additional","affiliation":[{"name":"University of California"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,10,25]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"3GPP. Proposed way forward on IMT-2020 submission Sep. 2017.  3GPP. Proposed way forward on IMT-2020 submission Sep. 2017."},{"key":"e_1_3_2_1_2_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2019","unstructured":"3GPP. TS36.213 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; Physical layer procedures, Sep. 2019 . 3GPP. TS36.213: Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer procedures, Sep. 2019."},{"key":"e_1_3_2_1_3_1","volume-title":"3GPP System Architecture Evolution (SAE)","year":"2020","unstructured":"3GPP. TS33.401 : 3GPP System Architecture Evolution (SAE) ; Security architecture, Jul. 2020 . 3GPP. TS33.401: 3GPP System Architecture Evolution (SAE); Security architecture, Jul. 2020."},{"key":"e_1_3_2_1_4_1","volume-title":"Dec.","year":"2020","unstructured":"3GPP. TS33.501 : Security architecture and procedures for 5G System , Dec. 2020 . 3GPP. TS33.501: Security architecture and procedures for 5G System, Dec. 2020."},{"key":"e_1_3_2_1_5_1","volume-title":"Dec.","year":"2020","unstructured":"3GPP. TS33.809 : Study on 5G security enhancements against False Base Stations (FBS) , Dec. 2020 . 3GPP. TS33.809: Study on 5G security enhancements against False Base Stations (FBS), Dec. 2020."},{"key":"e_1_3_2_1_6_1","volume-title":"Dec.","year":"2020","unstructured":"3GPP. TS33.853 : Key issues and potential solutions for integrity protection of the User Plane (UP) , Dec. 2020 . 3GPP. TS33.853: Key issues and potential solutions for integrity protection of the User Plane (UP), Dec. 2020."},{"key":"e_1_3_2_1_7_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2020","unstructured":"3GPP. TS36.211 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; Physical channels and modulation, Sep. 2020 . 3GPP. TS36.211: Evolved Universal Terrestrial Radio Access (E-UTRA); Physical channels and modulation, Sep. 2020."},{"key":"e_1_3_2_1_8_1","unstructured":"3GPP. TS33.401:3GPP System Architecture Evolution (SAE); Security architecture Sep. 2021.  3GPP. TS33.401:3GPP System Architecture Evolution (SAE); Security architecture Sep. 2021."},{"key":"e_1_3_2_1_9_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2021","unstructured":"3GPP. TS36.201 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; LTE physical layer; General de scription, Jan. 2021 . 3GPP. TS36.201: Evolved Universal Terrestrial Radio Access (E-UTRA); LTE physical layer; General description, Jan. 2021."},{"key":"e_1_3_2_1_10_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2021","unstructured":"3GPP. TS36.212 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; Multiplexing and channel coding, Jan. 2021 . 3GPP. TS36.212: Evolved Universal Terrestrial Radio Access (E-UTRA); Multiplexing and channel coding, Jan. 2021."},{"key":"e_1_3_2_1_11_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2021","unstructured":"3GPP. TS36.321 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; Medium Access Control (MAC) protocol specification, Jan. 2021 . 3GPP. TS36.321: Evolved Universal Terrestrial Radio Access (E-UTRA); Medium Access Control (MAC) protocol specification, Jan. 2021."},{"key":"e_1_3_2_1_12_1","volume-title":"Evolved Universal Terrestrial Radio Access (E-UTRA)","year":"2021","unstructured":"3GPP. TS36.322 : Evolved Universal Terrestrial Radio Access (E-UTRA) ; Radio Link Control (RLC) protocol specification, Jan. 2021 . 3GPP. TS36.322: Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Link Control (RLC) protocol specification, Jan. 2021."},{"key":"e_1_3_2_1_13_1","volume-title":"NR","year":"2021","unstructured":"3GPP. TS38.211 : NR ; Physical channels and modulation, Jan. 2021 . 3GPP. TS38.211: NR; Physical channels and modulation, Jan. 2021."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3300061.3300140"},{"key":"e_1_3_2_1_15_1","volume-title":"J. A 2019 surge, a 2020 wobble, a 2025 boom - nb-iot and lte-m on track, says ericsson. https:\/\/enterpriseiotinsights.com\/20200616\/channels\/news\/nb-iot-and-lte-m-on-track-says-ericsson","author":"Blackman","year":"2020","unstructured":"Blackman , J. A 2019 surge, a 2020 wobble, a 2025 boom - nb-iot and lte-m on track, says ericsson. https:\/\/enterpriseiotinsights.com\/20200616\/channels\/news\/nb-iot-and-lte-m-on-track-says-ericsson , Jun 2020 . Blackman, J. A 2019 surge, a 2020 wobble, a 2025 boom - nb-iot and lte-m on track, says ericsson. https:\/\/enterpriseiotinsights.com\/20200616\/channels\/news\/nb-iot-and-lte-m-on-track-says-ericsson, Jun 2020."},{"key":"e_1_3_2_1_16_1","volume-title":"Jun","author":"Bressner T. A. H.","year":"2015","unstructured":"Bressner , T. A. H. Development and Evaluation of UTDoA as a Positioning Method in LTE. https:\/\/www.diva-portal.org\/smash\/get\/diva2:867797\/FULLTEXT01.pdf , Jun 2015 . Bressner, T. A. H. Development and Evaluation of UTDoA as a Positioning Method in LTE. https:\/\/www.diva-portal.org\/smash\/get\/diva2:867797\/FULLTEXT01.pdf, Jun 2015."},{"key":"e_1_3_2_1_17_1","first-page":"2","article-title":"Fast authentication and data transfer scheme for massive nb-iot devices in 3gpp 5g network","volume":"6","author":"Cao J.","year":"2018","unstructured":"Cao , J. , Yu , P. , Ma , M. , and Gao , W . Fast authentication and data transfer scheme for massive nb-iot devices in 3gpp 5g network . IEEE Internet of Things Journal 6 , 2 ( 2018 ), 1561--1575. Cao, J., Yu, P., Ma, M., and Gao, W. Fast authentication and data transfer scheme for massive nb-iot devices in 3gpp 5g network. IEEE Internet of Things Journal 6, 2 (2018), 1561--1575.","journal-title":"IEEE Internet of Things Journal"},{"key":"e_1_3_2_1_18_1","first-page":"6","article-title":"Anti-quantum fast authentication and data transmission scheme for massive devices in 5g nb-iot system","volume":"6","author":"Cao J.","year":"2019","unstructured":"Cao , J. , Yu , P. , Xiang , X. , Ma , M. , and Li , H . Anti-quantum fast authentication and data transmission scheme for massive devices in 5g nb-iot system . IEEE Internet of Things Journal 6 , 6 ( 2019 ), 9794--9805. Cao, J., Yu, P., Xiang, X., Ma, M., and Li, H. Anti-quantum fast authentication and data transmission scheme for massive devices in 5g nb-iot system. IEEE Internet of Things Journal 6, 6 (2019), 9794--9805.","journal-title":"IEEE Internet of Things Journal"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.micpro.2019.102899"},{"key":"e_1_3_2_1_20_1","volume-title":"Mar","author":"CellMapper","year":"2021","unstructured":"CellMapper . CellMapper. cellmapper.net , Mar 2021 . CellMapper. CellMapper. cellmapper.net, Mar 2021."},{"key":"e_1_3_2_1_21_1","first-page":"3","article-title":"Nb-iot uplink receiver design and performance study","volume":"7","author":"Chakrapani A","year":"2019","unstructured":"Chakrapani , A . Nb-iot uplink receiver design and performance study . IEEE Internet of Things Journal 7 , 3 ( 2019 ), 2469--2482. Chakrapani, A. Nb-iot uplink receiver design and performance study. IEEE Internet of Things Journal 7, 3 (2019), 2469--2482.","journal-title":"IEEE Internet of Things Journal"},{"key":"e_1_3_2_1_22_1","first-page":"1","volume-title":"Security issues in internet of things: Vulnerability analysis of lorawan, sigfox and nb-iot. In 2019 Global IoT Summit (GIoTS)","author":"Coman F. L.","year":"2019","unstructured":"Coman , F. L. , Malarski , K. M. , Petersen , M. N. , and Ruepp , S . Security issues in internet of things: Vulnerability analysis of lorawan, sigfox and nb-iot. In 2019 Global IoT Summit (GIoTS) ( 2019 ), IEEE , pp. 1 -- 6 . Coman, F. L., Malarski, K. M., Petersen, M. N., and Ruepp, S. Security issues in internet of things: Vulnerability analysis of lorawan, sigfox and nb-iot. In 2019 Global IoT Summit (GIoTS) (2019), IEEE, pp. 1--6."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_13"},{"key":"e_1_3_2_1_24_1","volume-title":"Jun","author":"Fischer S.","year":"2014","unstructured":"Fischer , S. Observed Time Difference Of Arrival (OTDOA) Positioning in 3GPP LTE. https:\/\/www.qualcomm.com\/media\/documents\/files\/otdoa-positioning-in-3gpp-lte.pdf , Jun 2014 . Fischer, S. Observed Time Difference Of Arrival (OTDOA) Positioning in 3GPP LTE. https:\/\/www.qualcomm.com\/media\/documents\/files\/otdoa-positioning-in-3gpp-lte.pdf, Jun 2014."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2980159.2980163"},{"key":"e_1_3_2_1_26_1","volume-title":"Mar","author":"Mobile","year":"2021","unstructured":"GSMA. Mobile iot lpwa - lte-m & nb-iot commercial launches: Gsma . https:\/\/www.gsma.com\/iot\/mobile-iot-commercial-launches , Mar 2021 . GSMA. Mobile iot lpwa - lte-m & nb-iot commercial launches: Gsma. https:\/\/www.gsma.com\/iot\/mobile-iot-commercial-launches, Mar 2021."},{"key":"e_1_3_2_1_27_1","first-page":"1","article-title":"Optimization of random access channel in nb-iot","volume":"5","author":"Harwahyu R.","year":"2017","unstructured":"Harwahyu , R. , Cheng , R.-G. , Wei , C.-H. , and Sari , R. F . Optimization of random access channel in nb-iot . IEEE Internet of Things Journal 5 , 1 ( 2017 ), 391--402. Harwahyu, R., Cheng, R.-G., Wei, C.-H., and Sari, R. F. Optimization of random access channel in nb-iot. IEEE Internet of Things Journal 5, 1 (2017), 391--402.","journal-title":"IEEE Internet of Things Journal"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23313"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23442"},{"key":"e_1_3_2_1_30_1","first-page":"465","volume-title":"Burglars' iot paradise: Understanding and mitigating security risks of general messaging protocols on iot clouds","author":"Jia Y.","year":"2020","unstructured":"Jia , Y. , Xing , L. , Mao , Y. , Zhao , D. , Wang , X. , Zhao , S. , and Zhang , Y . Burglars' iot paradise: Understanding and mitigating security risks of general messaging protocols on iot clouds . In IEEE S&P ( 2020 ), IEEE , pp. 465 -- 481 . Jia, Y., Xing, L., Mao, Y., Zhao, D., Wang, X., Zhao, S., and Zhang, Y. Burglars' iot paradise: Understanding and mitigating security risks of general messaging protocols on iot clouds. In IEEE S&P (2020), IEEE, pp. 465--481."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3323416"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2973750.2973751"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2016.7452266"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-65127-9_19"},{"key":"e_1_3_2_1_35_1","volume-title":"April","author":"OpenAirInterface","year":"2018","unstructured":"OpenAirInterface . OpenAirInterface Official Website , April 2018 . http:\/\/www.openairinterface.org. OpenAirInterface. OpenAirInterface Official Website, April 2018. http:\/\/www.openairinterface.org."},{"key":"e_1_3_2_1_36_1","volume-title":"Diameter Vulnerabilities Exposure Report","author":"Positive Technologies","year":"2018","unstructured":"Positive Technologies . Diameter Vulnerabilities Exposure Report , 2018 . Positive Technologies. Diameter Vulnerabilities Exposure Report, 2018."},{"key":"e_1_3_2_1_37_1","volume-title":"10th USENIX Workshop on Offensive Technologies (WOOT 16)","author":"Rupprecht D.","year":"2016","unstructured":"Rupprecht , D. , Jansen , K. , and P\u00f6pper , C . Putting LTE security functions to the test: A framework to evaluate implementation correctness . In 10th USENIX Workshop on Offensive Technologies (WOOT 16) ( 2016 ). Rupprecht, D., Jansen, K., and P\u00f6pper, C. Putting LTE security functions to the test: A framework to evaluate implementation correctness. In 10th USENIX Workshop on Offensive Technologies (WOOT 16) (2016)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00006"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24283"},{"key":"e_1_3_2_1_40_1","volume-title":"Apr","author":"Schwarz R.","year":"2013","unstructured":"Schwarz , R. LTE: System Specifications and Their Impact on RF & Base Band Circuits. https:\/\/cdn.rohde-schwarz.com\/pws\/dl_downloads\/dl_application\/application_notes\/1ma221\/1MA221_0e.pdf , Apr 2013 . Schwarz, R. LTE: System Specifications and Their Impact on RF & Base Band Circuits. https:\/\/cdn.rohde-schwarz.com\/pws\/dl_downloads\/dl_application\/application_notes\/1ma221\/1MA221_0e.pdf, Apr 2013."},{"key":"e_1_3_2_1_41_1","volume-title":"-P. Practical attacks against privacy and availability in 4G\/LTE mobile communication systems. NDSS","author":"Shaik A.","year":"2015","unstructured":"Shaik , A. , Borgaonkar , R. , Asokan , N. , Niemi , V. , and Seifert , J . -P. Practical attacks against privacy and availability in 4G\/LTE mobile communication systems. NDSS ( 2015 ). Shaik, A., Borgaonkar, R., Asokan, N., Niemi, V., and Seifert, J.-P. Practical attacks against privacy and availability in 4G\/LTE mobile communication systems. NDSS (2015)."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3212480.3212497"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3317549.3319728"},{"key":"e_1_3_2_1_44_1","volume-title":"Jan","author":"Microelectronics","year":"2021","unstructured":"ST Microelectronics . LTE Cellular to Cloud Pack with STM32L496AG MCU. https:\/\/www.st.com\/en\/evaluation-tools\/p-l496g-cell02.html , Jan 2021 . STMicroelectronics. LTE Cellular to Cloud Pack with STM32L496AG MCU. https:\/\/www.st.com\/en\/evaluation-tools\/p-l496g-cell02.html, Jan 2021."},{"key":"e_1_3_2_1_45_1","unstructured":"sysmocom. sysmoUSIM-SJS1 SIM + USIM Card (10-pack). http:\/\/shop.sysmocom.de\/products\/sysmousim-sjs1 2016.  sysmocom. sysmoUSIM-SJS1 SIM + USIM Card (10-pack). http:\/\/shop.sysmocom.de\/products\/sysmousim-sjs1 2016."},{"key":"e_1_3_2_1_46_1","volume-title":"USENIX Symposium on Networked Systems Design and Implementation (NSDI)","author":"Tan Z.","year":"2021","unstructured":"Tan , Z. , Zhao , J. , Li , Y. , Xu , Y. , and Lu , S . Device-Based LTE Latency Reduction at the Application Layer . In USENIX Symposium on Networked Systems Design and Implementation (NSDI) ( 2021 ). Tan, Z., Zhao, J., Li, Y., Xu, Y., and Lu, S. Device-Based LTE Latency Reduction at the Application Layer. In USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2021)."},{"key":"e_1_3_2_1_47_1","volume-title":"Apr","year":"2020","unstructured":"ublox. Even with 5G on the horizon, 4G LTE-M and NB-IoT devices show no signs of going obsolete. https:\/\/www.u-blox.com\/en\/blogs\/insights\/even-5g-horizon-4g-lte-m-and-nb-iot-devices-show-no-signs-going-obsolete , Apr 2020 . ublox. Even with 5G on the horizon, 4G LTE-M and NB-IoT devices show no signs of going obsolete. https:\/\/www.u-blox.com\/en\/blogs\/insights\/even-5g-horizon-4g-lte-m-and-nb-iot-devices-show-no-signs-going-obsolete, Apr 2020."},{"key":"e_1_3_2_1_48_1","article-title":"How can iot services pose new security threats in operational cellular networks?","author":"Xie T.","year":"2020","unstructured":"Xie , T. , Tu , G.-H. , Li , C.-Y. , and Peng , C . How can iot services pose new security threats in operational cellular networks? IEEE Transactions on Mobile Computing ( 2020 ). Xie, T., Tu, G.-H., Li, C.-Y., and Peng, C. How can iot services pose new security threats in operational cellular networks? IEEE Transactions on Mobile Computing (2020).","journal-title":"IEEE Transactions on Mobile Computing ("},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372224.3419212"},{"key":"e_1_3_2_1_50_1","first-page":"55","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Yang H.","year":"2019","unstructured":"Yang , H. , Bae , S. , Son , M. , Kim , H. , Kim , S. M. , and Kim , Y . Hiding in plain signal: Physical signal overshadowing attack on LTE . In 28th USENIX Security Symposium (USENIX Security 19) ( 2019 ), pp. 55 -- 72 . Yang, H., Bae, S., Son, M., Kim, H., Kim, S. M., and Kim, Y. Hiding in plain signal: Physical signal overshadowing attack on LTE. In 28th USENIX Security Symposium (USENIX Security 19) (2019), pp. 55--72."}],"event":{"name":"ACM MobiCom '21: The 27th Annual International Conference on Mobile Computing and Networking","location":"New Orleans Louisiana","acronym":"ACM MobiCom '21","sponsor":["SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing"]},"container-title":["Proceedings of the 27th Annual International Conference on Mobile Computing and Networking"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3447993.3483255","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3447993.3483255","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3447993.3483255","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:49:11Z","timestamp":1750193351000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3447993.3483255"}},"subtitle":["attacks and defense"],"short-title":[],"issued":{"date-parts":[[2021,10,25]]},"references-count":50,"alternative-id":["10.1145\/3447993.3483255","10.1145\/3447993"],"URL":"https:\/\/doi.org\/10.1145\/3447993.3483255","relation":{},"subject":[],"published":{"date-parts":[[2021,10,25]]},"assertion":[{"value":"2021-10-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}