Private cellular networks are becoming standard infrastructure in industrial settings. Manufacturers and utilities are deploying private LTE and 5G for reliable wireless coverage across factory floors and power grids. The problem is that cellular security was never designed with enterprise IT in mind. Network security teams think in IP addresses, MAC addresses, and device posture. A cellular core runs almost entirely on SIM cards because that is the way to identify subscribers. That mismatch turns a high-performance wireless network into a blind spot, and it’s not obvious until something goes wrong.
The core issue is that cellular protocols were built for carriers who care about billing subscribers, not verifying endpoints. Pull a SIM from an authorized security camera, drop it into a rogue laptop, and the cellular core authenticates it without complaint. IMEI works like a MAC address, which means an attacker can clone the identity of a smart meter or industrial sensor and slip past standard network locks. We recently had a chance to check out one exciting new solution to this problem during Mobility Field Day 14.
Building Bridges
OneLayer is trying to solve this problem by bringing mobile and IT together. OneLayer Bridge does this by sitting between the cellular core and existing enterprise security tools. It integrates with Nokia and Ericsson cores and converts raw signaling data into IT-readable context. Instead of trusting identity strings that can be faked, it looks at what a device’s hardware actually does when connecting.
When an endpoint attaches to the network, its modem sends control requests that expose its true hardware capabilities. Those profiles are hard coded into the physical chip. Spoofing software can’t touch them. OneLayer checks the attach request against a device database in real time. If a device claims via IMEI to be a low-bandwidth smart meter but its radio behavior looks like a laptop, that mismatch gets flagged immediately.
To keep rogue devices off production systems, new connections land in a staging APN first. This staging APN is a quarantine environment inside the cellular core, isolated from the rest of the network. OneLayer runs hardware fingerprinting there and checks device posture against management databases or MDM tools. Once the hardware profile matches the expected identity, the platform triggers a reattachment and moves the device into the correct production APN.
Gateway to Security
The platform also looks past the cellular modem. In industrial environments, one router typically serves as a gateway for PLCs, IP cameras, and tablets. These are devices the cellular core never sees. OneLayer queries the router during staging via SNMP, NetConf, and SSH, pulling MAC and IP addresses for downstream equipment to build out the full picture.
That data flows directly into tools security teams already use like Palo Alto firewalls and ServiceNow CMDBs. When a validated device joins the network, OneLayer updates Dynamic Address Groups in the firewall. Security teams write identity-based policies for individual cellular devices instead of managing broad, high-risk subnets. When something suspicious turns up, such as a SIM swap, or an unexpected hardware change, the platform updates firewall rules to quarantine the device automatically.
Bringing IT All Together
A valid SIM is not a trusted device. Treating it as one leaves critical infrastructure exposed to anyone willing to swap a chip when no one is looking. Checking hardware behavior that can’t be spoofed, and holding devices in isolation until they pass, is how private cellular networks stop being a security black box.
To learn more about OneLayer Bridge and how it can help secure your cellular and mobile assets, make sure to check out their website at https://onelayer.com. To see their entire presentation from Mobility Field Day, head over to the presentation appearance page here.
