ANONYCALL: Enabling Native Private Calling in Mobile Networks

ANONYCALL: Enabling Native Private Calling in Mobile Networks

Speakers: Hexuan Yu

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=64226aysJak

Overview

Hexuan Yu, a PhD candidate from Virginia Tech, presents ANONYCALL, a system that enables truly private phone calls within existing 5G cellular infrastructure without requiring modifications to the IMS signaling process, RAN components, or core network logic. The system solves two critical problems that prevent anonymous cellular access from being practical: how to make an anonymous user reachable by phone (when the operator does not know who they are) and how to bill an anonymous user for usage without breaking their privacy. ANONYCALL introduces temporary short-lived CP-URIs that decouple identity from reachability, combined with a novel privacy-preserving charging credential using Pedersen commitments and adaptable signatures. The complete system adds less than 200 milliseconds of overhead to a standard 5G call setup, making it imperceptible to users. The work is motivated by the privacy needs of military personnel, government employees, and other sensitive persons whose location can be persistently tracked through cellular network metadata.

Background

▶ Watch: Problem: persistent cellular identifiers create digital trails (0:30)

Mobile networks rely on persistent identifiers -- phone numbers, SUPI (Subscription Permanent Identifier), and IMEI -- to provide essential services including calling, billing, and location services. This creates a persistent digital trail for every user, a problem severe enough that the FCC has fined major US carriers for privacy violations. For sensitive persons such as military personnel and government employees, persistent location tracking through cellular metadata creates critical safety risks.

Recent academic progress has introduced anonymous authentication schemes for cellular networks using complex cryptographic techniques that provide perfect anonymity and unlinkability. However, these schemes create two new practical problems. First, the reachability paradox: if the operator does not know who you are, how can someone call you using your phone number? In the Tor network, services do not need to charge users or make them reachable, but cellular networks require both. Second, the billing paradox: cellular networks use usage-based billing, but anonymous access prevents the operator from tracking sessions to compute charges.

The IMS (IP Multimedia Subsystem) is the real-time IP-based communication system built within the cellular infrastructure. Each user has a CP-URI (Contact Permanent URI) that maps to their permanent identity and a dynamic IP address. Calls are established via SIP signaling using this CP-URI to locate the callee's current IP address.

Key Findings

▶ Watch: Temporary CP-URIs decouple identity from call routing (4:00)

Temporary CP-URIs decouple identity from reachability: ANONYCALL replaces the permanent CP-URI (which normally maps to a phone number) with a temporary format based on the user's dynamically assigned IP address. This IP address already exists in the standard IMS process and is refreshed every 10-60 minutes depending on operator configuration. The operator can still resolve the CP-URI to the current IP address for call routing but cannot determine who the user is.

Authorized caller discovery preserves privacy: Anonymous users create a pre-recorded message directing authorized callers to an authentication agent. Callers authenticate themselves using existing trust infrastructure (Telecom PKI, which is already mandatory in the US for combating robocalls, or W3C DID Verifiable Credentials). Once authenticated, the callee releases their temporary CP-URI to the caller.

Privacy-preserving charging with hidden balance: The novel credential uses Pedersen commitments to hide the user's balance, SPS-EQ (Structure-Preserving Signatures on Equivalence Classes) for adaptable signatures that the user can rerandomize independently, and range proofs to prove sufficient balance without revealing the actual amount. After each call, the operator homomorphically updates the hidden balance.

Conditional unlinkability prevents abuse: Honest users enjoy full unlinkability between sessions (credentials appear fresh and random each time). However, if a dishonest user attempts to reuse the same credential with the same balance more than once, a mathematical backdoor enables de-anonymization, providing accountability without sacrificing honest-user privacy.

Sub-200ms overhead: The total additional latency (CP-URI retrieval plus charging verification) is below 200 milliseconds, imperceptible during a normal phone call.

Technical Deep Dive

▶ Watch: Authorized caller authentication via Telecom PKI or DID credentials (8:00)

The reachability module works within the 5G home-routed architecture, meaning all CP-URI resolution and charging logic stays within the user's home network. This is critical because even when a user is roaming on a foreign network, the foreign network does not need to know the CP-URI resolution logic, minimizing inter-operator protocol modifications.

The authentication agent handles first-time caller authorization, but the overhead is amortized across subsequent calls. Once a caller is authorized and added to the callee's contact list, they receive the latest CP-URI automatically. The effective per-call latency is dominated by CP-URI retrieval time, not the full authentication process.

The charging credential is constructed as follows: the hidden balance is committed using Pedersen commitment; tracing parameters for accountability are embedded; the entire structure is signed with an SPS-EQ scheme. Before each call, the user proves (via zero-knowledge range proof) that their balance exceeds a predefined threshold. After the call, the operator homomorphically adds (postpaid) or subtracts (prepaid) from the hidden balance and issues a new signature. The user rerandomizes the updated credential independently for the next session.

For lawful interception, ANONYCALL is compatible with the cryptographic backdoors already present in the underlying anonymous authentication schemes. Law enforcement can recover real user identity through these mechanisms when legally authorized, maintaining compliance with existing lawful intercept requirements.

Demo / Proof of Concept

▶ Watch: Privacy-preserving charging: Pedersen commitments and range proofs (10:00)

The researchers implemented ANONYCALL with a commercial smartphone using a SIP dialer app, a 5G-standards-compliant IMS core, and the authentication agent on AWS. Call traces captured via Wireshark confirmed that the operator could not see permanent user identities -- only temporary CP-URIs and dynamic IP addresses. Performance evaluation covered different authentication methods (Telecom PKI, DID Verifiable Credentials) and network conditions, demonstrating sub-200ms total overhead across configurations.

Defensive Implications

▶ Watch: US Naval Research Lab interest and deployment via privacy MVNO (16:30)

ANONYCALL addresses a genuine operational security need for military personnel, government employees, journalists, and other high-risk individuals whose cellular metadata creates safety risks. The system is envisioned as a service offered by a dedicated MVNO (Mobile Virtual Network Operator) specializing in privacy-enhanced communications. This deployment model avoids requiring changes to major carrier infrastructure while providing strong anonymity guarantees.

For defenders, the system balances three competing requirements: user privacy (anonymous access and unlinkable sessions), operator needs (usage-based billing and call routing), and government requirements (lawful interception). The conditional unlinkability design ensures that the system cannot be abused for criminal purposes without detection.

Key Takeaways

• ANONYCALL enables truly private phone calls within 5G infrastructure without modifying IMS signaling, RAN, or core network logic
• Temporary CP-URIs refresh every 10-60 minutes, decoupling user identity from call reachability
• Privacy-preserving charging uses Pedersen commitments and adaptable signatures to enable usage-based billing without revealing user identity or session linkability
• Total overhead is under 200 milliseconds per call -- imperceptible to users
• Compatible with lawful interception requirements through existing cryptographic accountability mechanisms
• The system could be deployed by a dedicated privacy-focused MVNO without requiring major carrier cooperation

About the Speaker(s)

Hexuan Yu is a PhD candidate at Virginia Tech working on privacy-enhancing technologies for cellular networks. His research focuses on making anonymous cellular access practical by solving the reachability and billing challenges that prevent current anonymous authentication schemes from being deployable. The US Naval Research Lab expressed strong interest in the work during Q&A.