Network-based authentication is the ability to verify a user's mobile identity using the cryptographic credentials already stored inside their SIM card — without sending an OTP, without any user action, and without any information leaving the mobile operator's core network. Network-based authentication is made possible by the GSMA TS.43 EAP-AKA standard, which allows a mobile operator's Home Subscriber Server (HSS) to issue and verify a cryptographic challenge against the subscriber's USIM application in milliseconds. The result is silent, phishing-resistant identity verification that meets NIST AAL2 requirements — and it runs entirely on infrastructure operators have already built.

Definition — Network-Based Authentication: A method of verifying a user's identity by querying the mobile operator's network directly, using SIM card cryptographic credentials (EAP-AKA). No OTP is sent. No user action is required. The verification is invisible, instantaneous, and cryptographically bound to the physical SIM registered to that subscriber.

For operators, this matters in two ways. First, it is the replacement that regulated enterprise customers urgently need as SMS OTP is restricted or banned by regulators across the US, India, UAE, Singapore, and Malaysia. Second, it is a commercial API product — a per-verification revenue stream that exceeds A2P SMS termination rates, with near-zero marginal cost. The network-based authentication operator guide covers both dimensions in full. This blog explains the foundation: what network-based authentication is, how it works, who it is for, and why the timing is now.

‍

How Network-Based Authentication Works: The Five-Step Flow

The authentication event is built on the GSMA TS.43 EAP-AKA protocol — the same cryptographic handshake your network uses to authenticate devices at registration. Here is what happens when an enterprise application triggers a network-based authentication request:

‍

‍

The critical property of this flow is what does not happen: no message is sent to the user, no code is generated or transmitted, and no information traverses the SS7 signalling plane. The authentication is entirely contained within the operator's network and the device's SIM. For the complete technical walkthrough — including the RAND, AUTN, RES, XRES, CK, and IK parameters — see How Network-Based Authentication Works: EAP-AKA and TS.43 Explained for Operators.

For sessions where the device is on 2G or 3G and cannot complete the TS.43 EAP-AKA flow, U2opia's SilentAuth+ provides USSD fallback — routing the authentication over the GSM voice channel without any user interaction. This is the only commercial implementation that maintains network-based authentication coverage across 2G through 5G on the same API call.

Why the SIM Card Is the Authentication Factor

The SIM card — specifically the USIM application inside it — holds a secret key (Ki) that is shared only with the operator's Home Subscriber Server. This shared secret is the cryptographic foundation of GSM and LTE authentication. It has never been transmitted over the air and cannot be extracted from a correctly manufactured SIM without physically destroying it.

‍

When network-based authentication uses EAP-AKA, it is leveraging this same infrastructure — the Ki key, the HSS, and the RAND/AUTN challenge-response — to verify that the person requesting access is in possession of the physical SIM registered to that MSISDN. This is what makes network-based authentication phishing-resistant: there is no code for an attacker to intercept, replay, or social-engineer out of the user.

This also explains why the Entitlement Server sits at the centre of the architecture. The Entitlement Server is the network function that intermediates between the enterprise API call and the HSS — it issues the EAP-AKA challenge and validates the response. See What is an Entitlement Server & Why It Matters for Telecom Operators for the infrastructure primer, and From EAP-AKA to Access Token: How Device Authentication Works in a TS.43 for the full device-level token flow.

Network-Based Authentication vs Other Authentication Methods

To understand why network-based authentication is commanding enterprise procurement attention in 2026, it helps to compare it directly against the three methods it replaces: SMS OTP, IP-based authentication, and password-plus-TOTP. The comparison below uses the criteria that regulated enterprise buyers are applying to authentication procurement decisions following NIST SP 800-63B-4 (July 2025).

‍

‍

For a deeper analysis of the full operator-side comparison between network-based authentication and SMS OTP — including delivery failure rates, AIT fraud economics, and regulatory status across six markets — see Network-Based Authentication vs SMS OTP: The Full Operator Comparison.

The Three Network-Based Authentication Products Operators Can Deploy

Network-based authentication is not a single product — it is a family of APIs built on the same TS.43 EAP-AKA infrastructure. Operators can deploy one or all three, with each serving a distinct enterprise use case and commanding separate revenue. All three run on the same Diameter S6a / HSS integration.

‍

‍

All three products link back to the same operator infrastructure — and once Number Verification is live, adding Silent Authentication and SIM Swap Detection requires only API gateway configuration, not new network investment. The full product family is covered on the U2opia authentication overview.

Who Is Deploying Network-Based Authentication? The Market Picture in 2026

The commercial deployment of network-based authentication at scale began in July 2026 when the three major US carriers launched commercial Number Verification APIs covering more than 300 million mobile connections. This followed the GSMA Open Gateway initiative reaching 86 operator groups — representing 80% of global mobile connections — who have committed to CAMARA-standardised API exposure.

The US launch was the highest-profile deployment, but network-based authentication had been live at production scale in emerging markets — Africa, South Asia, Southeast Asia, MENA — for several years prior, running on U2opia's SilentAuth+ platform across 104+ operator networks. What the US carrier launch established was enterprise procurement precedent at developed-market scale: large regulated enterprises now have a commercially available, AAL2-compliant authentication alternative with no hardware token and no app requirement.

For the full context of the US carrier launch — including what it means for operators globally and how the commercial model works — see AT&T, T-Mobile & Verizon Launch Network-Based Authentication: What Operators Need to Know.

What Is Driving Enterprise Demand: The Regulatory Mandates

Enterprise adoption of network-based authentication is not purely voluntary — it is being driven by regulatory mandates that have collectively made SMS OTP non-compliant for high-value authentication across every major regulated market:

‍

‍

The combined effect is that any enterprise operating in two or more of these markets — which includes every global bank, every multinational fintech, and most large technology companies — is under simultaneous compliance pressure from multiple regulators, all pointing to the same technical conclusion. For the full NIST AAL2 technical mapping, see NIST 800-63B-4 & Carrier APIs: The US Operator's Authentication Mandate Playbook. For the operator-side cost of staying on SMS OTP, see The True Cost of SMS OTP: What Operators Are Losing Globally.

Silent Authentication: Network-Based Authentication Without Any User Step

The most commercially advanced form of network-based authentication is silent authentication — where the EAP-AKA verification happens entirely in the background without the user ever seeing an authentication screen. SilentAuth+ is U2opia's implementation of this pattern, built on GSMA TS.43 Release 11.

Definition — Silent Authentication: A form of network-based authentication where SIM-based identity verification happens in the background without the user's awareness. The device's SIM card responds to the EAP-AKA challenge automatically. No OTP, no notification, no user step. Completion time: under 300ms in most network conditions.

Silent authentication is deployed across banking (pre-authorising high-value transactions), e-commerce (removing the OTP step at checkout — the highest drop-off point in mobile purchase flows), gaming (frictionless onboarding without a registration screen), and enterprise applications (step-up verification before revealing sensitive data).

‍

The key technical differentiator of SilentAuth+ versus other silent authentication implementations is the USSD fallback for 2G and 3G devices. Most TS.43 implementations fail silently when the device is not on LTE — excluding a significant share of the addressable base in emerging markets and producing an auth failure that the enterprise cannot diagnose. SilentAuth+ detects the device's network capability and routes 2G/3G sessions through the USSD channel, returning the same verified result to the enterprise API regardless of which authentication path was used.

For why other implementations fail in production and what the USSD fallback solves, see Why Silent Authentication Fails in TS.43 Production Networks. For the comparison between Silent Authentication in TS.43 and alternative approaches, including IP-based and OTP-based methods, see those deep-dives from the published blog library.

How Network-Based Authentication Is Different from IP-Based and OAuth Methods

A common point of confusion for enterprise architects is how network-based authentication relates to IP-based number verification and OAuth/IAM frameworks. The differences are fundamental, not cosmetic.

IP-based number verification attempts to infer a user's phone number from the device's IP address — comparing the IP seen by the application server against a range known to belong to a specific operator and subscriber. This works when the device is on a cellular data connection with a stable carrier IP, but fails immediately on Wi-Fi (where the IP is the router's address, not the carrier's), on VPNs, and on networks with shared or dynamic IP allocation. It also provides no cryptographic proof — IP address can be spoofed — and does not satisfy NIST AAL2 phishing-resistance requirements.

OAuth and IAM frameworks operate at the application authentication layer — above the network. They manage tokens, sessions, and access control, but they do not provide a mechanism for verifying physical possession of a mobile device at the SIM level. TS.43 operates below OAuth: it verifies the device's physical identity at the network layer, and the resulting verification token can then be consumed by the enterprise's OAuth or IAM system as a trusted signal. For the precise technical boundaries, see Why TS.43 Authentication Is Different from OAuth, IAM, and Zero Trust and TS.43 Authentication Trust Model: Who Trusts Whom in Entitlement Servers.

What Operators Need to Deploy Network-Based Authentication

For operators evaluating whether their network is ready to deploy network-based authentication as a commercial API, the infrastructure requirements are straightforward — most operators with a 4G/5G core already have everything they need.

1. Diameter S6a connectivity from your authentication gateway to the HSS/HLR — this is standard on any LTE-compliant core network.

2. USIM applet compatibility across your SIM estate — all SIMs manufactured since 2012 support the USIM application required for EAP-AKA. Legacy SIM inventory may need an audit.

3. A TS.43-compliant Entitlement Server — this is the network function that intermediates between the CAMARA API call and the HSS EAP-AKA challenge. Operators can build this in-house or deploy U2opia's hosted Entitlement Server via SilentAuth+.

4. A CAMARA-compliant API gateway — the enterprise-facing interface that receives Number Verification or Silent Authentication requests and routes them to the Entitlement Server.

5. USSD gateway readiness for fallback — operators serving markets with significant 2G/3G subscriber populations need USSD fallback configured to avoid silent auth failures on legacy devices.

‍

For operators who have not yet deployed a TS.43 Entitlement Server, U2opia's SilentAuth+ provides a hosted implementation with USSD fallback, eliminating the need to build and operate the gateway infrastructure from scratch. The TS.43 Entitlement Server Deployment Guide covers the carrier-side deployment checklist. For implementation specifics, see How to Implement an Entitlement Server and Architecting a Scalable Entitlement System: GSMA TS.43 Best Practices.

Typical deployment timeline from infrastructure audit to production API — for operators with existing 4G/5G core and GSMA Open Gateway alignment — is 8–16 weeks. For a scoped assessment of your network's readiness, contact the U2opia operator team.

The Revenue Model: How Operators Monetise Network-Based Authentication

Network-based authentication is not just a compliance product — it is a revenue product. Operators deploying network-based authentication APIs charge enterprise customers on a per-verification basis, with typical direct licensing rates of $0.006–$0.010 per authentication event. This compares favourably to A2P SMS OTP termination rates of $0.003–$0.05, with near-zero marginal cost after infrastructure is live and zero AIT fraud exposure.

The three-product architecture — Silent Authentication, Number Verification, and SIM Swap Detection — allows operators to build a multi-product enterprise identity platform from a single network integration. Each product addresses a distinct enterprise budget line: authentication, compliance verification, and fraud prevention. Contract stickiness is high: an enterprise that integrates its authentication stack with the carrier API does not switch mid-year.

For the full commercial model — including ARPU uplift modelling, revenue comparison against A2P SMS, enterprise targeting strategy, and the four operator monetisation frameworks — see How Operators Monetize Authentication APIs: The Global MNO Revenue Playbook. For the infrastructure business case that sits beneath the API revenue model, see Business Benefits of TS.43 Entitlement Servers for Telecom Operators.

‍

Network-Based Authentication Use Cases by Enterprise Vertical

Enterprise adoption of network-based authentication is highest in verticals where regulatory pressure and authentication fraud exposure are both acute:

• Financial services — Banks and fintech platforms use Number Verification and Silent Authentication to replace SMS OTP for transaction verification, step-up authentication before large transfers, and mobile banking login. Regulatory mandates in the US, India, UAE, Singapore, and Malaysia make this the highest-urgency vertical in 2026.

• Healthcare — Patient portals and health information exchanges running SMS OTP for login are under HIPAA technical safeguard guidance converging on NIST AAL2. Silent authentication removes the OTP friction that drives patient abandonment in telehealth onboarding flows.

• E-commerce and super apps — Removing the OTP step at checkout reduces abandonment at the highest drop-off point in the mobile purchase funnel. Gaming and streaming platforms use silent authentication at onboarding — a 15–25% improvement in registration completion is typical when the OTP screen is eliminated.

• Government and public sector — Federal contractors and citizen-facing digital services under NIST SP 800-63B-4 cannot use SMS OTP for AAL2 workloads. Network-based authentication is the only non-hardware-token solution that satisfies AAL2 without requiring device distribution.

• Enterprise SaaS and identity platforms — Identity providers and enterprise SSO platforms are embedding network-based authentication as a step-up factor for sensitive operations — administrator access, data export, account recovery — where phishing resistance is required but hardware token distribution is operationally impractical.

For use cases specific to the Entitlement Server product family — including wearables, eSIM, VoWiFi, and IoT — see Use Cases of Entitlement Servers: Wearables, eSIM, VoWiFi, and Silent Authentication.

Frequently Asked Questions: Network-Based Authentication

‍

What is the difference between network-based authentication and two-factor authentication?

Two-factor authentication (2FA) is an authentication design pattern — requiring two factors from different categories. Network-based authentication is a specific technology for one of those factors: the possession factor, verified through the physical SIM card. Network-based authentication is a form of 2FA when combined with a password or biometric at the relying party. The key distinction is that traditional 2FA usually delivers the second factor via SMS OTP — which is phishable and restricted under NIST SP 800-63B-4. Network-based authentication provides the second factor cryptographically, without transmitting any code.

‍

Does network-based authentication work when the user is on Wi-Fi?

Yes — with the right implementation. First-generation operator implementations required the device to be on a cellular data session at the moment of authentication, which excluded Wi-Fi sessions. U2opia's NumberVerify2 uses a CIBA + TS.43 temporary token architecture that resolves this: the initial EAP-AKA challenge is issued over the cellular channel, and the resulting token is used to complete verification on the Wi-Fi session. SilentAuth+ also supports Wi-Fi via TS.43 EAP-AKA when the operator's Entitlement Server is configured for it.

‍

Is network-based authentication the same as silent authentication?

Silent authentication is one implementation of network-based authentication — specifically, the pattern where the EAP-AKA verification happens in the background without the user taking any action. Number Verification is also network-based authentication, but it requires the enterprise to explicitly call the verification API (the user may not be present). SIM Swap Detection is a network query, not an authentication event per se — it checks whether a SIM transfer has occurred recently. All three are built on the same network authentication infrastructure.

‍

What does network-based authentication mean for operators who only run 2G or 3G networks?

The TS.43 EAP-AKA standard requires LTE (4G) or 5G connectivity for the primary authentication flow. For operators with significant 2G or 3G subscriber populations — common across Africa, South Asia, and Southeast Asia — USSD fallback provides coverage continuity. SilentAuth+ is the only production implementation that handles both paths transparently: TS.43 EAP-AKA for 4G/5G sessions and USSD for 2G/3G sessions, returning a consistent verification result to the enterprise API regardless of which path was used. See Why Silent Authentication Fails in TS.43 Production Networks for what happens when USSD fallback is absent.

‍

How long does a network-based authentication event take?

A standard EAP-AKA authentication event — from API call to verified result — completes in under 300 milliseconds in typical network conditions on a 4G connection. The USSD fallback path adds latency of 1–3 seconds depending on USSD routing and network load. Both are significantly faster than the average SMS OTP flow, which requires the user to receive a message (0.5–30+ seconds depending on network load and delivery chain) and then read and enter a 6-digit code. For network-based authentication in a mobile app context, the authentication event is imperceptible to the user.

‍

How do operators expose network-based authentication as a commercial API?

Operators expose network-based authentication through the GSMA CAMARA Number Verification API — a standardised interface that enterprise identity platforms can integrate against. The CAMARA API abstracts the EAP-AKA handshake into a single API call with a simple boolean response, reducing enterprise integration time to days rather than weeks. Operators can either build the API gateway infrastructure in-house (see the TS.43 Entitlement Server Deployment Guide and Architecting a Scalable Entitlement System) or deploy U2opia's SilentAuth+ as a hosted gateway with Entitlement Server, USSD fallback, and enterprise billing already integrated.

The Network You Have Built Is the Authentication Asset You Need

Network-based authentication is not a new technology being added to the operator's stack. It is an existing capability — the same SIM cryptography, the same HSS, the same Diameter interfaces that authenticate every device on your network — being exposed as a commercial API to enterprise customers who need it urgently and are prepared to pay for it at rates above your current A2P SMS revenue.

The regulatory landscape has set a compliance deadline. NIST SP 800-63B-4, the RBI mandate, the CBUAE notice, and the MAS and BNM frameworks have collectively told your enterprise customers that SMS OTP is no longer acceptable for regulated workloads. Your network-based authentication infrastructure is the certified replacement — the only one that satisfies AAL2 phishing-resistance requirements without hardware tokens or app distribution complexity.

The question is not whether your enterprise customers will migrate. They will. The question is whether they migrate to your network-based authentication API or to an OTT identity provider who has already built the integration layer on top of your infrastructure. Operators who move first — deploying SilentAuth+ and Number Verification now — capture both the A2P SMS migration revenue and the long-term enterprise identity relationship.

Start with the full network-based authentication operator guide to see the complete architecture, the commercial model, and the deployment path. Then contact the U2opia operator team to scope your network's readiness in a single session.