NSF VINES · Track 1

A Systematic Security Foundation for Next-Generation Cellular Networks

Collaborative research between Virginia Tech and UCLA to replace fragmented 5G/6G security mappings with secured named data, local policy enforcement, and verifiable audit trails.

Explore the project Meet the team

Project introduction

From disjoint identifiers to one coordinated trust fabric

Today’s cloud-native 5G Service-Based Architecture secures each Network Function with separate transport certificates, OAuth2 service identities, and cloud workload IDs. Those layers were developed independently—and keeping them synchronized under dynamic scaling creates security gaps and operational complexity.

The challenge

As mobile cores move from dedicated appliances to distributed cloud deployments, perimeter protection is no longer enough. Mutual TLS, OAuth2 tokens issued by the NRF, and cloud auditing systems each name the same logical Network Function differently. Dynamic NF changes—scaling, relocation, failover—can desynchronize these mappings and weaken authorization guarantees.

Our approach

NSF VINES establishes a unified semantic naming scheme and carries cryptographically secured named data objects. Authentication and authorization are evaluated locally through named certificates and trust schemas, reducing runtime dependence on centralized token services while producing tamper-evident audit records.

Collaborative Research · NSF Awards 2548992 / 2548993 · Virginia Tech & UCLA

Proof of concept

TrustNG system design

Our early prototype replaces repeated mTLS/OAuth2 coordination with secured named data objects, hierarchical naming, and an NDN sidecar that evaluates authenticity and authorization at the edge of each Network Function.

Architectural comparison between conventional 5G SBA security mappings and the TrustNG secured named-data approach — Architectural comparison: cross-layer identifier mappings versus a coordinated semantic namespace.

TrustNG system design showing trust controller, named certificates, and local policy evaluation — TrustNG system design with trust controller bootstrapping and local evaluation.

Hierarchical naming scheme for Network Functions and secured data objects — Hierarchical naming binds service identity, credentials, logs, and produced data under one namespace.

NDN sidecar design integrated with 5G Network Functions — NDN sidecar design for integrating secured named data with 5G NFs.

Preliminary results

Early performance signals

Initial measurements examine request latency and resource consumption for the proof-of-concept path. These results are preliminary and will expand as the system matures.

Latency results figure 1 — Latency measurements (set 1).

Latency results figure 2 — Latency measurements (set 2).

Resource consumption results figure 3 — Resource consumption (set 3).

Resource consumption results figure 4 — Resource consumption (set 4).

Team

People behind NSF VINES

A collaborative team spanning Virginia Tech and UCLA, bringing together expertise in mobile network security, Internet architecture, and Named Data Networking.

Angelos Stavrou

PI · Virginia Tech

Dr. Angelos Stavrou is a professor in the Bradley Department of Electrical & Computer Engineering at Virginia Tech and the founder of Quokka Inc. and A2 Labs. Dr. Stavrou is a serial entrepreneur and the founder of Quokka, A2 Labs, Aether Argus, WayWave, Impedyme, and Weavian Inc. Quokka is a VC-backed mobile security company with a valuation of more than $100 M. Dr. Stavrou has also served as a principal investigator on research awards from NSF, DARPA, IARPA, DHS, AFOSR, ARO, ARL, and ONR. He has written more than 160 peer-reviewed conference and journal articles. Stavrou received his M.Sc. in Electrical Engineering, M.Phil., and Ph.D. (with distinction) in Computer Science, all from Columbia University. Stavrou is an Associate Editor of IEEE Transactions on Computers, IEEE Security & Privacy, and IEEE Internet Computing magazine, and part of the governing board of the IEEE Blockchain initiative. He is a senior member of the ACM, USENIX, and IEEE. In 2013, he received the IEEE Reliability Society Engineer of the Year award. His team was awarded the DHS Cyber Security Division’s "Significant Government Impact Award" in 2017 and the “Bang for the Buck Award” in 2019. He received the IEEE Reliability Society Lifetime Award in 2024.

Lixia Zhang

Co-PI · UCLA

Dr. Lixia Zhang is a Distinguished Professor in UCLA’s Computer Science Department and holds the Jonathan B. Postel Chair. She received her Ph.D. in Computer Science from MIT and worked at Xerox Palo Alto Research Center before joining UCLA in 1995. Her research spans Internet architecture, network security, and resilient routing, and she has led NSF- and DARPA-supported research in areas including web caching, Internet distance mapping, and sensor networking. Since 2010, she has led the NSF-funded Named Data Networking (NDN) project, developing a new Internet architecture that secures data directly by design. She is a Fellow of both ACM and IEEE, a recipient of the IEEE Internet Award and the ACM SIGCOMM Lifetime Achievement Award, an inductee of the Internet Hall of Fame, and a member of the National Academy of Engineering.

Amirreza Ghafoori

Ph.D. Student · Virginia Tech

Amirreza is a Ph.D. student in Computer Engineering at Virginia Tech, within the Bradley Department of Electrical and Computer Engineering, advised by Prof. Angelos Stavrou. His research focuses on secure system design for next-generation mobile networks (5G/6G) using Named Data Networking (NDN), particularly developing secure and resilient network architectures based on Zero Trust principles. His work also includes network measurement and performance analysis in high-mobility environments, such as 5G and satellite networks. He earned his B.Sc. in Computer Engineering from Amirkabir University of Technology (Tehran Polytechnic) and defended his M.S. in Computer Engineering at Virginia Tech in 2024 as part of his direct-Ph.D. program.

Tianyuan Yu

Postdoctoral Associate · UCLA

Dr. Tianyuan Yu is a postdoctoral researcher at UCLA where he also earned his PhD under Professor Lixia Zhang. His research spans Internet architectures, network security, and decentralized applications.

Adam Thieme

Ph.D. Student · UCLA

Adam Thieme is a PhD student in the Internet Research Laboratory at UCLA, advised by Lixia Zhang. His work on NDN systems includes a distributed replication design for NDN Data Repositories, identifying the roadblocks that keep applications from decentralizing (ACM/IRTF ANRW 2025), and attribute-based access control for secure mHealth data sharing (ACM ICN 2022 and IEEE/ACM CHASE 2026). He is also a co-author of From SRM to NDN (ACM SIGCOMM CCR 2026), which traces three decades of data-centric networking and its influence on NDN.