iPhones running iOS 17 and above and private 5G networks

[herlesupreeth]

This is just an information post regarding testing private 5G SA with iPhones.

Here is the webpage outlining the requirements from Apple - https://support.apple.com/en-ie/guide/deployment/depac6747317/web

Following steps needs to be done to address requirement for iPhones to attach to private 5G SA:

1. SUPI concealment when exchanging over 5G network. In order to achieve that certain 5G files in SIM card needs to be programmed. A pysim script is provided at https://github.com/herlesupreeth/docker_open5gs/blob/master/sim/iphone-private-5g.script to program your Sysmocom SIM card with relevant files for the UDM configured in this repository (Dont forget to change the ADM key as per your SIM card in that script before executing). You have to execute as follows:

./pySim-shell.py -p 0 --script scripts/deactivate-5g.script
./pySim-shell.py -p 0 --script scripts/iphone-private-5g.script

2. Enable NAS encryption: This can be done with following changes in amf.yaml in amf folder of this repository

    security:
        integrity_order : [ NIA2, NIA1, NIA0 ]
        ciphering_order : [ NEA2, NEA1, NEA0 ]

3. Enable User plane encryption at gNB: This can be done by passing the following command line args to srsRAN_Project gNB:

cu_cp security --nea_pref_list=nea2,nea1,nea3,nea0

4. Also, you would have to use the PLMN 999 xx assigned for private 5G network

I have tested iPhone 13 Pro and verified the attach with the following commit srsran/srsRAN_Project@55c984b of srsRAN_Project gNB.

[herlesupreeth]

NOTE: The above requirement of NAS encryption and User plane encryption is not necessary when testing with 001 01 test PLMN. The only requirement is the availability of IMS and SUPI concealment. i.e. skip NAS encryption and User plane encryption mentioned above

iPhone blacklists SIM's ICCID from connecting to 5G SA if the PLMN is not one of the PLMN assigned for private mobile network

Luckily, the above blacklisting can be circumvented as follows:

1. First program the SIM with PLMN corresponding to a private mobile network PLMN e.g. 999 70
2. Start the 5GC with the SIM programmed PLMN
3. Start the gNB with the SIM programmed PLMN
4. Put the SIM in iPhone and attempt to attach to gNB. Wait for UE to attach to network
5. Then, bring down the network and put phone in airplane mode and pull out the SIM
6. Re-program the SIM to any desired PLMN e.g. 001 01
7. Now, iPhone allows attaching to 5G SA network with non-private mobile network PLMN

When testing with test PLNM (001 01), iPhone 13 pro was able to connect to default and ims APN and register with IMS successfully.

You would need to use the following deployment file https://github.com/herlesupreeth/docker_open5gs/blob/master/sa-vonr-deploy.yaml to have a successful connection

[platini2]

HI quick question, where do i derive the public key of SUCI in the simcard from my deployment?

[herlesupreeth]

If you are using this repo, then the key is already in this file https://github.com/herlesupreeth/docker_open5gs/blob/master/sim/iphone-private-5g.script

If not, then you need to replace the contents of "hnet_pubkey" with the public key you find at the location provided by the below configuration in udm.yaml

docker_open5gs/udm/udm.yaml

Line 15 in 9c034db

hnet:

In order to extract the public key you need to execute below command

openssl pkey -in curve25519-1.key -text

[platini2]

Thanks! i just found after i asked the question. there is a good guide from @s5uishida to generate them at
https://github.com/s5uishida/note_5g_suci_profile_ab

[lmesserStep]

Hey @herlesupreeth what is stopping me from using 3150-10 (Non-Public Network) on an iPhone 14? I am generating an eSIM for this.

I'm having trouble understanding why I would need IMS, Apple's official documentation seems to say a data-only network is fine.

[herlesupreeth]

@lmesserStep If you are using private network PLMN you dont need IMS.

[gabri94]

Hi All, we've been trying for a while to use these instructions to generate a sim card that can connect to our private 5G network on PLMN 99901, however our Iphone 14 pro is never able to detect the network.

We are able to detect and register the network (with PLMN 00101) if we use the following SIM card configurations:

• opencell sim card with 00101 (no supi/suci)
• sysmocom simcard with 00101 (no supi/suci)
• sysmocom simcard with 00101 (with supi/suci, configured as above)

We also tested using a Sierra 5G Modem and we are able to detect/register to our 99901 network using a simcard programmed for 99901 w/o suci.

Any idea?

[gabri94]

We were able to register our EU iPhone 14 pro (in the US) using n77 and n41.
With n78 and n48 we were able to detect the network, but iPhone was not registering

[platini2]

We were able to register our EU iPhone 14 pro (in the US) using n77 and n41.
With n78 and n48 we were able to detect the network, but iPhone was not registering

What gnb sw are you using? OAI or SRSRAN_5g?

[gabri94]

We tested both OAI+USRP and Nvidia ARC+Foxconn RU.

[platini2]

Thanks finally i was able to get the Iphone 14 Pro MAX in n78 SA with OAI+USRP running on a Raspberry PI 5 with 51PRBs

[shivakumardistproc]

I recently discovered that when operating using a private PLMN (e.g. 999 XX), Apple restricts attaching of iPhone to network operating only on NR bands which are allocated for private networks in respective countries. For example, if you are in USA you can use Band 41 when using private network PLMN.

1. Do Pixel phones have similar restrictions? Specifically:
   a. Do private PLMNs work only on NR bands allocated for private networks in their respective countries?
   b. More generally, does a Pixel phone restrict NR bands for a given PLMN?
2. Does anyone know how Pixel phones apply carrier configurations?

[gabri94]

Hi All, was anyone able to use Android phones with non-00101 PLMN?
We've been testing some Pixel phones, but they don't seem to have 5G SA enabled with 999-xx PLMNS

[platini2]

I have a Samsung Galaxy A15 5G registered in SA with PLMN 999-01, working even with and without SUPI concealment. Band 78.

[gabri94]

I confirm that on a Samsung S23 the phone can connect right away to 99901, however on both Pixel 8pro, Pixel 6 and Oneplus Nord the PLMN seems to be somehow locked on the modem.

[ffxxcad]

I have seen the same issue with Pixel 7a

[gabri94]

Same with Pixel 9 pro.