Operator side 5g profiles show privacy risks and anonymisation effects
Quantifying the Privacy Posture of Operator-Side 5G/O-RAN Profiles
Cryptography and SecurityNetworking and Internet Architecture
Summary
Mobile network data can reveal personal information even after usual anonymisation methods. The authors studied how different techniques reduce the chance that someone’s data can be traced back to them. They found that just changing subscriber identifiers is not enough, but generalising or suppressing some data helps improve privacy. However, heavily removing data can also reduce how well the remaining data works for certain analyses. The authors created a way to measure privacy risks and share these results through a dashboard for regulators or operators.
What this means in practice
- •For mobile network operators: Assess privacy risks of releasing 5G network profiles by measuring anonymity levels and data transformations through an integrated dashboard.
- •For telecom regulator teams: Use a composite privacy index to evaluate operator data privacy posture for compliance and risk assessment purposes.
Authors
Nikolaos Kekatos, Apostolos Valiakos, Alexios Lekidis, Elpiniki Papageorgiou
Abstract
Operator-side network profiles derived from 5G/ORAN traffic carry personal data such as ephemeral subscriber identifiers, slice-level KPIs, and control-plane signalling, and must be anonymised before release to a federated-learning aggregator, threat-intelligence exchange, or ML training pipeline. We study how much re-identification risk remains after standard operator-side anonymisation. We quantify privacy posture with k-anonymity, l-diversity and t-closeness, aggregate them into a composite Privacy-Posture Index (PPI), and measure residual re-identification across eight transformation configurations on internal PCAP captures and the public Idaho Labs 5GAD corpus, under a full-QI syntactic bound and two simulated adversaries. The evaluation is modest in scale, and we read its trends as indicative rather than definitive. Three findings emerge. Pseudonymisation alone leaves re-identification unchanged; material privacy gains arise when quasi-identifiers are coarsened through generalisation, optionally combined with suppression. A downstream classification task then shows that suppression-heavy releases retain majority-class utility but sacrifice much of their minority-class recall, a cost the aggregate metrics hide. Finally, the standard kmin-based PPI correlates only modestly with the disclosure bound and not at all with the partial-knowledge attack, whereas a mean-class-size variant PPI correlates strongly with all three disclosure/attack measures; we therefore read PPI as a regulator-facing summary, not a security bound. The profiles are produced by passive operator-side monitoring with rule-based DPI; our contribution is the privacy-quantification layer that computes these metrics, applies the transformation policy, and exposes both through an inspectable dashboard.