Ctrlk
GXC Main Website
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Onyx Security Specification

GXC's Onyx solution is a fully integrated, cloud-orchestrated platform for deploying and managing secure, private 4G and 5G cellular networks. Designed for enterprise and industrial environments, Onyx delivers robust, multi-layered security across the radio, edge, core, and management planes, ensuring data sovereignty and enterprise control.

Security Architecture

Cellular networks operate across three distinct planes that separate functions for optimal performance, scalability, and security:

  • End-to-end encryption and segmentation across all network layers

  • Zero trust enforcement with least-privilege access control

  • Full enterprise control over user, control, and management plane data

  • Secure device onboarding and identity protection with SIM-based and cryptographic mechanisms

  • Scalable orchestration and monitoring through the centralized Onyx Portal

Data Flow and Security

Cellular networks operate across three distinct planes that separate functions for optimal performance, scalability, and security:

  • User Plane (Data Plane) – Transports all application-level traffic between user devices and enterprise application services or external destinations, including the actual data payloads.

  • Control Plane – Manages signaling between user devices and the network to establish, manage, and secure sessions, authenticate devices, and enforce mobility and QoS policies.

  • Management Plane – Handles configuration, monitoring, orchestration, authentication records, and logs. It supports administrative control and operational visibility across the network.

The Onyx platform implements layered security across all three planes, ensuring enterprise data sovereignty and compliance while maintaining seamless usability and scale.

(4G & 5G) On-Premises Deployments

In on-premises deployments, user and control plane traffic terminate locally, ensuring full enterprise data ownership. Only minimal operational metadata is sent to the cloud-based Orchestrator, preserving data sovereignty by keeping sensitive application and session data within enterprise boundaries.

Data Flow & Security in 4G & 5G On-Premises Deployments

4G On-Premises Sequence Diagram

5G On-Premises Sequence Diagram

(4G) Cloud Deployments

In cloud deployments, all traffic is securely routed to a cloud-hosted Onyx Edge, enabling centralized orchestration without on-premises infrastructure. All communications are encrypted in transit, providing rapid scalability and simplified deployment while maintaining robust security controls.

Data Flow & Security in 4G Cloud Deployments

4G Cloud Sequence Diagram

User Plane

User Plane in On-Premises Deployments

User Plane in Cloud Deployments

Protection in Transit

  • (4G) OTA ciphering protects communication between UE and Onyx RAN using up to 128-EEA2 for encryption and 128-EIA2 for integrity protection

  • (5G, On-Premises) OTA ciphering protects communication between UE and Onyx Edge using up to 128-NEA3 for encryption and 128-NIA3 for integrity protection

  • (4G, Cloud) IPSec tunnels secure traffic between Onyx APs and the Onyx Edge using AES_CBC-128 encryption cipher with HMAC-SHA2-256-128 integrity protection

  • (On-Premises) APN-mapped VLANs isolate traffic by device group, enabling bridge networking mode, and limiting device exposure across VLAN segments. This supports enforcement of enterprise-managed segmentation and access policies at device group level. VLAN IP domain segregation, combined with DHCP-based IP assignment, enables precise IP tracking and policy-driven access control. Enterprises can assign devices to specific subnets, monitor usage, and enforce local security controls across the enterprise LAN.

  • (Cloud) Enterprise-managed firewall enforces traffic filtering and restricts malicious activity

  • Enterprises can enforce end-to-end security protocols such as TLS or VPN between UE and enterprise application services to protect user traffic

  • (On-Premises) Data is processed locally and handed over to the enterprise network, maintaining full enterprise control

  • (Cloud) Data is securely routed to the Onyx Edge

Protection at Rest

  • Data remains in volatile memory and is never stored persistently

Control Plane

Control Plane in On-Premises Deployments

Control Plane in Cloud Deployments

Protection in Transit

  • (4G, Cloud) IPSec tunnels secure traffic between Onyx APs and the Onyx Edge using AES_CBC-128 encryption cipher with HMAC-SHA2-256-128 integrity protection

  • Encrypted NAS signaling protects communication between UE and Onyx Edge using SNOW-3G and AES-CTR encryption across 4G (128-EEA1/EEA2) and 5G (128-NEA1/NEA2) networks

  • 4G/5G AKA authenticates devices and establishes shared encryption keys

  • Milenage performs SIM-based challenge-response authentication and key derivation

  • (5G, On-Premises) SUCI encryption shields subscriber identifiers using AES-128 in CTR mode with HMAC-SHA-256 integrity protection (3GPP Profile A)

  • IMSI Lock with IMEI binding restricts SIM/eSIM usage to authorized devices to prevent unauthorized SIM transfers, SIM swap attacks, and device impersonation

  • (On-Premises) All signaling transactions terminate at the Onyx Edge

  • (Cloud) Signaling is securely routed to the Onyx Edge

  • (Cloud) Enterprise-managed firewall enforces traffic filtering and restricts malicious activity

  • Enterprise network remains oblivious to control plane operations

Protection at Rest

  • Minimal control plane data required for Orchestrator operations is encrypted in transit and securely stored on the Orchestrator using encryption at rest

Management Plane

Management Plane in On-Premises Deployments

Management Plane in Cloud Deployments

Protection in Transit

  • TLS encryption (TLS 1.2/1.3) secures management traffic across all components using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_AES_256_GCM_SHA384, and TLS_AES_128_GCM_SHA256 cipher suites

  • (5G) Secure NETCONF interface enables authenticated, automated RAN setup and configuration

  • Cryptographically signed OTA equipment software updates are securely delivered and verified to ensure integrity and authenticity

  • SIM/eSIM credentials and authentication tokens are transmitted from the Orchestrator to the Onyx Edge over encrypted channels

  • Integrated CBRS Domain Proxy enables compliant, interference-free shared spectrum operations through encrypted communication with the SAS

  • Enterprise-managed firewall enforces traffic filtering and restricts malicious activity

  • Minimal management metadata is securely sent to the Orchestrator

  • Enterprise network remains oblivious to management operations

Protection at Rest

  • Data is encrypted to ensure confidentiality and prevent unauthorized access

  • AWS key management services and credential safeguards protect stored credentials and sensitive assets

  • Backups of configuration and operational data are encrypted and stored with geographical redundancy

  • AWS IMDSv2 strengthens instance-level metadata protection, securing credentials and sensitive metadata in cloud instances

  • Cryptographically signed OTA update packages are verified before installation to ensure software integrity

Device Access

Device access in the Onyx platform is secured through layered controls within the enterprise network. The Onyx Portal / Orchestrator securely manage SIM provisioning, access policies, and configuration, providing control and end-to-end visibility across the network.

Device Access in On-Premises Deployments

Device Access in Cloud Deployments

  • (4G) OTA ciphering protects communication between UE and Onyx RAN using up to 128-EEA2 for encryption and 128-EIA2 for integrity protection

  • (5G, On-Premises) OTA ciphering protects communication between UE and Onyx Edge using up to 128-NEA3 for encryption and 128-NIA3 for integrity protection

  • (4G, Cloud) IPSec tunnels secure traffic between Onyx APs and the Onyx Edge using AES_CBC-128 encryption cipher with HMAC-SHA2-256-128 integrity protection

  • Encrypted NAS signaling protects communication between UE and Onyx Edge using SNOW-3G and AES-CTR encryption across 4G (128-EEA1/EEA2) and 5G (128-NEA1/NEA2) networks

  • 4G/5G AKA authenticates devices and establishes shared encryption keys

  • Milenage performs SIM-based challenge-response authentication and key derivation

  • (5G, On-Premises) SUCI encryption shields subscriber identifiers using AES-128 in CTR mode with HMAC-SHA-256 integrity protection (3GPP Profile A)

  • IMSI Lock with IMEI binding restricts SIM/eSIM usage to authorized devices to prevent unauthorized SIM transfers, SIM swap attacks, and device impersonation

  • (On-Premises) APN-mapped VLANs isolate traffic by device group, enabling bridge networking mode, and limiting device exposure across VLAN segments. This supports enforcement of enterprise-managed segmentation and access policies at device group level. VLAN IP domain segregation, combined with DHCP-based IP assignment, enables precise IP tracking and policy-driven access control. Enterprises can assign devices to specific subnets, monitor usage, and enforce local security controls across the enterprise LAN.

  • (Cloud) Enterprise-managed firewall enforces traffic filtering and restricts malicious activity

  • Enterprises can enforce end-to-end security protocols such as TLS or VPN between UE and enterprise application services to protect user traffic

GXC Equipment Access

Onyx Edge

  • Supports key-based SSH and local console access for the “agw_user” account, enabling customers to log on to collect basic debug information, restart services, reboot the system, etc.

  • Onyx Portal users have RBAC-restricted access to a limited set of diagnostic commands and troubleshooting features; all operations are audit logged

  • GXC Engineering has direct login and key-based SSH access for troubleshooting operations

  • Network port exposure is limited by design to minimize the attack surface

  • All user operations and administrative actions are audit logged

Onyx AP

  • GXC Engineering has secure, authenticated access for troubleshooting operations

  • Configuration and updates are delivered via the Onyx Edge; all changes are audit logged

  • Onyx APs are generally isolated from the enterprise network, preventing direct network access

Mesh Node

  • Managed via the Onyx Edge with no direct network access

  • Configuration and updates are delivered via the Onyx Edge; all changes are audit logged

(5G) FHM

  • Managed via the Onyx Edge with no direct network access

  • Configuration and updates are delivered via the Onyx Edge; all changes are audit logged

Onyx Portal User Access & Third-Party Integrations

Onyx Portal User Access

  • Logically isolated environments for each GXC partner and customer tenant enforce administrative separation and secure access boundaries, preventing cross-tenant data exposure

  • SSO with MFA strengthens user authentication for Onyx Portal access

  • CAPTCHA mechanisms, including reCAPTCHA, prevent automated credential abuse by bots

  • Bcrypt-hashed user credentials mitigate brute-force and rainbow table attacks

  • RBAC enforces least-privilege access for all Onyx Portal functions

  • Flexible integration with enterprise IdPs enables seamless alignment with existing authentication frameworks and security policies

  • Comprehensive audit logging tracks all access, configuration, and authentication events, with 60 days log retention

  • AWS WAF protects Onyx Portal web interface against common attack vectors

  • AWS GuardDuty continuously detects infrastructure threats and anomalies

Third-Party API Integrations

  • API integrations allowing enterprises to export telemetry and logs to third-party applications are entirely optional and controlled by enterprise policy

  • All API integrations use tokenized, tightly scoped connections with short-lived tokens

  • Continuous validation and strict token-scoped permissions ensure secure access

  • Comprehensive audit logging tracks all third-party API access and activities with 60 days log retention

Compliance & Certifications

  • FCC-certified for Part 96 compliance, supporting shared CBRS spectrum use in the United States

  • SOC 2 Type I certification affirms GXC's internal controls to safeguard customer data

* Specifications are subject to change without prior notice.

* For definitions of acronyms and abbreviations used in this spec sheet, refer to the GXC Glossary.

Contact GXC

To get in touch with GXC, please visit https://gxc.io/contact-us/.

PreviousOnyx RAN Specification
Next5G Onyx Architecture Solution Brief

Last updated

Was this helpful?