Secure 5G Platform Engineering for a US Telecom Provider

Context

A telecoms start-up was building a production-grade 5G communications platform for a major US carrier, under intense time pressure and strict security requirements. The platform combined embedded Linux devices in the field, identity services, network connectivity, cloud infrastructure and software delivery.

Challenge

The security boundary didn’t stop at the cloud.

• Embedded devices were deployed into operational environments.
• There were multiple authentication and identity requirements.
• Infrastructure needed repeatable provisioning.
• Packaging, release and connectivity involved manual steps.

Security and automation had to work consistently across the whole stack, from the devices to the cloud.

Approach

One identity architecture. OpenAM became the central identity provider, with OAuth2 for applications and services and RADIUS for device and network access. The same model now reaches embedded devices, Linux systems, cloud workloads, operational users and platform services. There are fewer local credentials, controls are consistent, and access is auditable.

Security at the edge. We hardened embedded Linux authentication and PAM configuration, reduced privileged access exposure and rationalised access mechanisms, without breaking operations. For connected products, the endpoint is part of the platform.

Repeatable cloud infrastructure. We designed a Terraform architecture for GCP that codifies VMs, networking and supporting infrastructure. Provisioning became automated, version-controlled and reviewable instead of depending on individual knowledge.

Delivery automation. Package builds moved out of individual environments and into a controlled GitHub Actions pipeline producing consistent Debian packages. Pipeline definitions are version-controlled alongside the product.

Connecting distributed environments. Fortinet VPN provides encrypted connectivity between operational, remote and cloud environments, with dynamic BGP exchanging routes. The network absorbs topology changes instead of relying on hard-coded routes.

Machine identity and visibility. EJBCA issues and renews certificates for devices and services centrally. Platform observability means faster diagnosis, fewer blind spots and stronger recovery.

Results

• Hardened: embedded authentication and privileged access.
• Centralised: identity across device and cloud workloads.
• Trusted: certificate-based machine identity.
• Reduced: attack surface across field-deployed systems.
• Automated: Debian package builds and releases.
• Repeatable: Terraform-driven GCP provisioning, with infrastructure and pipeline configuration in code.
• Observable: secure hybrid networking and better platform visibility.

Security wasn’t treated as a separate project. It became part of how the platform is engineered, with hands-on implementation and architecture guidance alongside the client’s engineering teams.