Formal Verification and Analysis of 5G AKA Protocol Using Mixed Strand Space Model
Abstract
:1. Introduction
- We formally analyze the security of the latest version of the 5G AKA protocol in the mixed strand space model for mixed protocols [28] and give twenty-one attack scenarios of the 5G AKA protocol. Based on these attack scenarios, we find many new attacks of the 5G AKA protocol, including cross attacks for mixed cases.
- We propose the 5G-AKA’ protocol, and then formally analyze its security in the mixed strand space model for mixed protocols [28]. As a result, no attack scenario is obtained. By discussion and analysis, the 5G-AKA’ protocol can overcome these attacks of the 5G AKA protocol, thus it is secure.
- Based on comparative analysis, the 5G-AKA’ protocol is better than the 5G AKA protocol and the recently improved 5G AKA protocols in security, and is efficient and backward compatible.
2. Overview of the 5G AKA Protocol
- When the security anchor function (SEAF) initiates authentication with the user equipment (UE), the UE sends to the SEAF, where the UE includes mobile equipment (ME) and a universal subscriber identity module (USIM).
- Upon receiving , the SEAF sends and to the authentication server function (AUSF). denotes the serving network name (SNN) of the SN.
- If the SEAF is entitled to use , then the AUSF stores the receiving and sends and to the unified data management (UDM).
- The UDM invokes the subscriber identity de-concealing function (SIDF) whether is received. Then, the SIDF de-conceals to gain before the UDM can process the request. Based on , the UDM/ARPF (authentication credential repository and processing function) chooses the authentication method.
- When 5G AKA is selected, the UDM/ARPF generates , calculates and , and derives , and then creates a 5G home environment authentication vector from , , and . is an unpredictable challenge of the HN.
- The UDM sends the 5G home environment authentication vector to the AUSF together with . When an authentication and key management for applications (AKMA) subscription is used, the UDM also sends to the AUSF. denotes the AKMA indication and routing indicator.
- The AUSF stores the temporarily together with the received .
- The AUSF generates a 5G authentication vector from the 5G home environment authentication vector received from the UDM/ARPF by computing from , computing from , replacing with , and replacing with in the 5G home environment authentication vector.
- The ASUF creates a 5G serving environment authentication vector by removing from the 5G authentication vector, and then sends the 5G serving environment authentication vector (i.e., , and ) to the SEAF.
- The SEAF stores , and then sends , , and to the UE. is used by the UE and the access and mobility management function to identify the and the partial native security context that is created if the authentication is successful. denotes the anti-bidding down between architectures (ABBA) parameter.
- In the UE, the ME forwards and to the USIM. Upon receipt of and , the USIM first computes the anonymity key and retrieves the sequence number . Next, the USIM computes and compares this with which is included in . Then, the USIM verifies that the received is in the correct range. If is the same as and is in the correct range (i.e., , where denotes the highest sequence number the USIM has accepted), then the USIM computes a response , and , and then returns , and to the ME. The ME then computes , and .
- The UE sends to the SEAF.
- The SEAF computes and compares this with . If they coincide, then the SEAF considers the authentication as successful from the serving network’s point of view. If not, then the SEAF considers the authentication as unsuccessful.
- The SEAF sends the received to the AUSF.
- The AUSF compares the received with the stored . If and are equal, then the AUSF considers the authentication as successful from the home network point of view. Then, the AUSF informs the UDM about the authentication result.
- The AUSF indicates to the SEAF whether the authentication was successful or not from the home network point of view (i.e., ). If the authentication was successful, then the ASUF also sends and to the SEAF.
3. Formal Verification and Analysis of the 5G AKA Protocol
- The parties of the 5G AKA protocol shown in Figure 1 are simplified as the UE, the SN and the HN. The USIM and the ME are located in the UE, and the SEAF is located in the SN. The AUSF, the UDM, the ARPE and the SIDF are located in the HN.
- There is a session key between the SN and the HN, and it is secure.
- and do not affect the security of the 5G AKA protocol, so they are ignored here.
- : ;
- : ;
- : ;
- : ;
- : ;
- : ;
- : .
- : ;
- : ;
- : ;
- : ;
- : ;
- : .
- : ;
- : ;
- : ;
- : ;
- : ;
- : .
3.1. Mixed Strand Space for the 5G AKA Protocol
3.2. The Initiator’s Guarantee of the 5G AKA Protocol
- (1)
- If is a server strand of Definition 1, then , , , , , , , , , , , , where , , and . By assumption (2), , so must originate on a responder strand , , , , , , , , , , , , where and is generated for . Since , must originate on a server strand . Since is uniquely originating in , , so . Hence, , , , , , , , , , , , .
- (2)
- If is a server strand of Definition 2, then , , , , , , , , , , where , and . By assumption (2), , so must originate on an initiator strand , , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . By assumption (1) and Definition 1, on . However, on according to Definition 2. Therefore, and cannot be in the same run of the protocol, so must exist in the past run of the protocol. However, it is impossible from to because increases. That is to say, it is impossible that exists in the past run of the protocol and exists in the current run of the protocol. Hence, is not a server strand of Definition 2.
- (3)
- If is a server strand of Definition 3, then , , , , , , , , , where and . Since is uniquely originating in , originates at , where . Let . Since , is non-empty. Hence, has at least one ≤-minimal element and the sign of is positive. does not lie on a penetrator strand but must lie on a regular strand instead (Lemma 5.4 in [29]). By inspection, precedes on the regular strand and , and the regular strand containing and is a responder strand . If is a responder strand of Definition 1, then , , , , , , , , , , , , where , and is generated for . If is a responder strand of Definition 2, then , , , , , , , , , . If is a responder strand of Definition 3, then , , , , , , , , . □
- (1)
- cannot find that and are replayed because does not contain the challenge of the UE (i.e., ), which is included in . That is to say, the replay attacks on the SN and the HN can be formed, resulting in the energy consumption ion of the SN and the HN.
- (2)
- successfully authenticates , but does not authenticate because does not contain , which makes that is included in , and , and the principal associated with the responder strand is . In [14], the authors also pointed out this security issue. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (3)
- Both and cannot be agreed with the UE because is included in them. That is to say, the key agreement fails, resulting in a new authentication and key agreement process.
- (4)
- (5)
- In Figure 3 and Figure 4, the penetrator replays an encrypted between the SN and the HN to make authentication failure. In Figure 5, the penetrator directly sends to the SN to make authentication failure. They are called MAC failure attacks. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (6)
- The server strand and the responder strand of Theorem 1 may exist in the past run of the protocol because they do not contain the challenge of the UE (i.e., ), which is included in . That is to say, on the UE may be a replayed message and is still in the correct range. As a result, the location privacy of the UE can be compromised by reidentifying . That is to say, the location privacy of the UE can be compromised.
- (1)
- If is a server strand of Definition 1, then , , , , , , , , , , , , where , , and . By assumption (2), . Since and , and , so . Hence, must originate on an initiator strand , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . By assumption (1) and Definition 2, on . However, on according to Definition 1. Therefore, and cannot be in the same run of the protocol, so must exist in the past run of the protocol. Because increases, it is possible from to . That is to say, it is possible that exists in the past run of the protocol and exists in the current run of the protocol. Hence, it is possible that is a server strand of Definition 1. By assumption (2), , so must originate on a responder strand , , , , , , , , , , , , where and is generated for . Since , must originate on a server strand . Since is uniquely originating in , , so . Hence, , , , , , , , , , , , . From the above, exists in the past run of the protocol and originates on , so must exist in past run of the protocol. From the above, originates on , so also must exist in the past run of the protocol.
- (2)
- If is a server strand of Definition 2, then , , , , , , , , , , where , and . By assumption (2), , so must originate on a responder strand , , , , , , , , , , where . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , , , , .
- (3)
- If is a server strand of Definition 3, then , , , , , , , , , where and . Since is uniquely originating in , originates at , where . Let . Since , is non-empty. Hence, has at least one ≤-minimal element and the sign of is positive. does not lie on a penetrator strand but must lie on a regular strand instead (Lemma 5.4 in [29]). By inspection, precedes on the regular strand and , and the regular strand containing and is a responder strand . If is a responder strand of Definition 1, then , , , , , , , , , , , , where , and is generated for . From the above, it is possible that is a responder strand of Definition 1 because it is possible from to , and both and must exist in the past run of the protocol. If is a responder strand of Definition 2, then , , , , , , , , , . If is a responder strand of Definition 3, then , , , , , , , , . □
- (1)
- cannot find that and are replayed because does not contain the challenge of the UE (i.e., ), which is included in . That is to say, the replay attacks on the SN and the HN can be formed, resulting in the energy consumption ion of the SN and the HN.
- (2)
- successfully authenticates , but does not authenticate because does not contain , which means that is included in , and , and the principal associated with the responder strand is . In [14], the authors also pointed out this security issue. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (3)
- In Figure 6, Figure 8, Figure 9 and Figure 10, there are interactions between different cases of the 5G AKA protocol, i.e., cross attacks. They are caused by the penetrators taking advantage of and . That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (4)
- In Figure 8 and Figure 9, the penetrator replays an encrypted between the SN and the HN to make authentication failure. In Figure 10, the penetrator directly sends to the SN to make authentication failure. They are called MAC failure attacks. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (5)
- The server strand and the responder strand of Theorem 2 in Figure 6 and Figure 8 only exist in the past run of the protocol according to Theorem 2, i.e., on the initiator strand of Theorem 2 in Figure 6 and Figure 8 is a replayed message and is not in the correct range. As a result, the location privacy of the UE can be compromised by identifying . Further, the server strand and the responder strand of Theorem 2 in Figure 7, Figure 9 and Figure 10 may exist in the past run of the protocol because they do not contain the challenge of the UE (i.e., ), which is included in . That is to say, on the UE in Figure 7, Figure 9 and Figure 10 can be a replayed message and is not in the correct range. As a result, the location privacy of the UE can be compromised by identifying . In [14,15,18,24], the authors also exploited this attack. That is to say, the location privacy of the UE can be compromised.
3.3. The Server’s Guarantee of the 5G AKA Protocol
- (1)
- cannot find that is replayed, which is not equal to and . This is because does not contain the challenge of the HN (i.e., ). That is to say, the replay attacks on the HN can be formed, resulting in the energy consumption ion of the HN.
- (2)
- and cannot be agreed with the HN because the HN does not send and together with , which makes that and can be a replayed key and a replayed SUPI, respectively. That is to say, the key agreement fails, resulting in a new authentication and key agreement process.
- (1)
- cannot find that is replayed, which is not equal to . This is because does not contain the challenge of the HN (i.e., ). That is to say, the replay attacks on the HN can be formed, resulting in the energy consumption ion of the HN.
- (2)
- The penetrator directly sends to the SN to make authentication failure. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (3)
- The responder strand of Theorem 6 may exist in the past run of the protocol because it does not contain the challenge of the HN, i.e., on the HN of Theorem 6 can be a replayed message, resulting in a replay attack. In the other words, the penetrator replays an encrypted between the SN and the HN to make an authentication failure. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
3.4. The Responder’s Guarantee of the 5G AKA Protocol
- (1)
- If is a server strand of Definition 1, then , , , , , , , , , , , , where , , , , and is generated for . By assumption (2), . Since and , and , so . Hence, must originate on an initiator strand , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , .
- (2)
- If is a server strand of Definition 2, then , , , , , , , , , , where , , , and . By Definition 1, . By assumption (2), . Since and , and , so . Hence, must originate on an initiator strand , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , . By assumption (2), , so must originate on an initiator strand , , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , , . By Definition 1, on . However, on according to Definition 2. Therefore, and cannot be in the same run of the protocol, so or must exist in the past run of the protocol. Since or exists in the past run of the protocol, must exist in the past run of the protocol. Because originates on , must exist in the past run of the protocol, so must exist in the current run of the protocol. However, it is impossible from to because increases. That is to say, it is impossible that exists in the past run of the protocol and exists in the current run of the protocol. Hence, is not a server strand of Definition 2.
- (3)
- If is a server strand of Definition 3, then , , , , , , , , , where , and . By Definition 1, . By assumption (2), . Since and , and , so . Hence, must originate on an initiator strand , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , . □
- (1)
- successfully authenticates , but does not authenticate . This is because cannot inspect , and , and is not sent with , which means that , and can be related to rather than . Accordingly, is included in and , and is related to . That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (2)
- In Figure 16, there are interactions between different cases of the 5G AKA protocol, i.e., cross attacks. They are caused by the penetrators taking advantage of . The penetrator replays an encrypted between the SN and the HN to make authentication failure, i.e., MAC failure attacks. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (3)
- The initiator strand and the server strand of Theorem 7 may exist in the past run of the protocol because they do not contain the challenge of the SN, i.e., the messages received by the SN can be replayed messages. As a result, the penetrator can impersonate the UE and the HN to complete the entire 5G AKA protocol with the SN, forming DoS attacks on the SN. This results in the energy consumption ion of the SN.
- (1)
- If is a server strand of Definition 1, then , , , , , , , , , , , , where , , , , and is generated for . By assumption (2), . Since and , and , so . Hence, must originate on an initiator strand , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , .
- (2)
- If is a server strand of Definition 2, then , , , , , , , , , , where , , , and . By assumption (2), , so must originate on an initiator strand , , , , , , , , where and . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , , .
- (3)
- If is a server strand of Definition 3, then , , , , , , , , , where , and . □
- (1)
- successfully authenticates , but does not authenticate . This is because cannot inspect , and , which means that , and can be related to rather than . Accordingly, is included in and , and is related to . That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (2)
- (3)
- In Figure 19, the penetrator replays an encrypted between the SN and the HN to make authentication failure, i.e., MAC failure attacks. That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (4)
- The initiator strand and the server strand of Theorem 8 may exist in the past run of the protocol, i.e., the messages received by the SN can be replayed messages. As a result, the penetrator can impersonate the UE and the HN to complete the entire 5G AKA protocol with the SN, forming DoS attacks on the SN. This results in the energy consumption ion of the SN.
- (1)
- successfully authenticates , but does not authenticate . This is because cannot inspect , and , which makes that , and can be related to rather than . Accordingly, is included in and , and is related to . That is to say, the authentication fails, resulting in a new authentication and key agreement process.
- (2)
- (3)
- (4)
- The initiator strand and the server strand of Theorem 9 may exist in the past run of the protocol, i.e., the messages received by the SN can be replayed messages. As a result, the penetrator can impersonate the UE and the HN to complete the entire 5G AKA protocol with the SN, thus forming DoS attacks on the SN. This results in the energy consumption ion of the SN.
4. Our Proposed 5G-AKA’ Protocol and Its Security Analysis
4.1. The 5G-AKA’ Protocol
- To cryptographically bind and to , and protect , we replace with on the UE and the HN.
- To prevent DoS attacks on the SN, we add the challenge–response mechanism between the SN and the HN. In detail, we add to the first three messages between the SEAF (located in the SN) and the AUSF (located in the HN) and add to the fourth message between the SEAF and the AUSF, where is an unpredictable challenge of the SEAF;
- Add to the second message between the SEAF and the AUSF, matching with in the first message between them;
- In the latest version of the 5G AKA protocol, is used to initiate a new authentication procedure for the UE. However, it causes a large number of attacks according to the above security analysis. Hence, we use a timeout mechanism on the HN instead of to initiate a new authentication procedure towards the UE. That is to say, if and are different, then the UE directly discards the receives , and the HN will initiate a new authentication procedure towards the UE when the HN does not receive an authentication response message or a synchronization failure message within a certain period of time.
- : ;
- : ;
- : ;
- : ;
- : ;
- : ;
- : .
- : ;
- : ;
- : ;
- : ;
- : ;
- : .
4.2. Mixed Strand Space for the 5G-AKA’ Protocol
4.3. The Initiator’s Guarantee of the 5G-AKA’ Protocol
- (1)
- If is a server strand of Definition 5, then , , , , , , , , , , , , . By assumptions (2) and (3), and are uniquely originating in , so must originate on a unique responder strand , , , , , , , , , , , , , where . Since , must originate on a server strand . Since is uniquely originating in , , so , and . Since , must originate on a server strand . Since is uniquely originating in , , so . Since , must originate on a responder strand . Since is uniquely originating in , , so . Hence, , , , , , , , , , , , , .
- (2)
- If is a server strand of Definition 6, then , , , , , , , , , , , , where . Since , must originate on an initiator strand , , , , , , , , , so originates on . By assumptions (1) and (2), originates on . Since is uniquely originating in , . However, and , . Hence, is not a server strand of Definition 6. □
- (1)
- If is a server strand of Definition 5, then , , , , , , , , , , , , . Since , and , so . Hence, must originate on an initiator strand , , , , , , , so originates on . By assumptions (1) and (2), originates on . Since is uniquely originating in , . However, and , . Hence, is not a server strand of Definition 5.
- (2)
- If is a server strand of Definition 6, then , , , , , , , , , , , , where . Since , must originate on an initiator strand . Since is uniquely originating in , , so and . Hence, , , , , , , , , , , , . By assumptions (2) and (3), and are uniquely originating in , so must originate on a unique responder strand , , , , , , , , , , , , where . Since , must originate on a server strand . Since is uniquely originating in , , so , , and . Since , must originate on a responder strand . Since is uniquely originating in , , so . Hence, , , , , , , , , , , , . □
- (1)
- Since is used to calculate , the challenge of the UE (i.e., ), the pre-shared key between the UE and the HN (i.e., ) and are included in . As a result, can find whether is replayed, successfully authenticates and , and on the UE cannot be replayed, making that the location privacy of the UE cannot be compromised.
- (2)
- Since is replaced with a timeout mechanism on the HN, MAC failure attacks are prevented. Further, on the UE cannot be replayed maliciously to generate . As a result, the penetrator cannot take advantage of and to performed cross attacks.
4.4. The Server’s Guarantee of the 5G-AKA’ Protocol
- (1)
- Although cannot find that is replayed because does not contain the challenge of the HN (i.e., ), can find whether is replayed because is used to calculate . Hence, this does not affect the security of the 5G-AKA’ protocol.
- (2)
- Since is replaced with a timeout mechanism on the HN, MAC failure attacks are prevented.
- (3)
- Since the HN sends and together with , they can be agreed with the HN.
4.5. The Responder’s Guarantee of the 5G-AKA’ Protocol
- (1)
- If is a server strand of Definition 5, then , , , , , , , , , , , , , where , , , , and is generated for . Since , must originate on a server strand . Since is uniquely originating in , , so . Since , must originate on a responder strand . Since is uniquely originating in , , so and according to assumption (1). As a result, , and . Hence, , , , , , , , , , , , , . Since , according to assumption (2). Because and , and , so . By assumption (3), is uniquely originating in , so must originate on a unique initiator strand , , , , , , , where . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , .
- (2)
- If is a server strand of Definition 6, then , , , , , , , , , , , , where , , and . Since , must originate on a responder strand , , , , , , , , , , , , so originates on . By assumptions (1) and (2), originates on . Since is uniquely originating in , . However, and , . Hence, is not a server strand of Definition 6. □
- (1)
- If is a server strand of Definition 5, then , , , , , , , , , , , , , where , , , , and is generated for . Since , must originate on a unique responder strand , , , , , , , , , , , , , so originates on . By assumptions (1) and (2), originates on . Since is uniquely originating in , . However, and , . Hence, is not a server strand of Definition 5.
- (2)
- If is a server strand of Definition 6, then , , , , , , , , , , , , where , , and . Since , must originate on a responder strand . Since is uniquely originating in , , so and according to assumption (1). As a result, , and . Hence, , , , , , , , , , , , . Since , according to assumption (2). By assumption (3), is uniquely originating in , so must originate on a unique initiator strand , , , , , , , , where . Since , must originate on a server strand . Since is uniquely originating in , , so and . Hence, , , , , , , , . □
- (1)
- Since is added to the second message between the SN and the HN, and is added to the fourth message between the SN and the HN, both and on the HN can be agreed with the SN, which means that successfully authenticates and obtains the corresponding .
- (2)
- Since is replaced with a timeout mechanism on the HN, MAC failure attacks are prevented. Further, on the UE cannot be replayed maliciously to generate because . As a result, the penetrator cannot take advantage of and to performed cross attacks.
- (3)
- Since the challenge–response mechanism between the SN and the HN is added, the messages received by the SN cannot be replayed, preventing Dos attacks on the SN.
5. Discussion
5.1. Security of the 5G-AKA’ Protocol
5.2. Performance of the 5G-AKA’ Protocol
6. Conclusions
Author Contributions
Funding
Institutional Review Board Statement
Informed Consent Statement
Data Availability Statement
Conflicts of Interest
Abbreviations
3GPP | 3rd generation partnership project |
4G | 4th generation mobile communication technology |
5G | 5th generation mobile communication technology |
ABBA | anti-bidding down between architectures |
AKA | authentication and key agreement |
AKMA | authentication and key management for applications |
AMF | authentication management field |
ARPF | authentication credential repository and processing function |
AUSF | authentication server function |
DoS | denial of service |
EAP-AKA’ | improved extensible authentication protocol method for 3rd generation authentication and key agreement |
EAP-TLS | extensible authentication protocol method for transport layer security |
ECDH | elliptic curve Diffie–Hellman |
EPS | evolution packet system |
HN | home network |
ICB | initial counter block |
LTE | long-term evolution |
MAC | message authentication code |
ME | mobile equipment |
MitM | man-in-the-middle attacks |
PKI | public key infrastructure |
SEAF | security anchor function |
SIDF | subscriber identity de-concealing function |
SN | serving network |
SNN | serving network name |
SQN | sequence number |
SUCI | subscription concealed identifier |
SUPI | subscription permanent identifier |
TS | technical specification |
UDM | unified data management |
UE | user equipment |
USIM | universal subscriber identity module |
XOR | exclusive-or |
Notations
the ABBA parameter | |
, | two anonymity keys |
the AKMA indication and routing indicator | |
the authentication management field | |
a dummy value of all zeros | |
an authentication token of the HN | |
a resynchronization parameter | |
a base key derived from | |
CA | the amount of calculation of the 5G AKA protocol |
a cipher key | |
ECDH | the generation and verification of an ECDH exchange |
an encryption key | |
, , | three message authentication functions |
, , , | four key generating functions |
F | the generation and verification of a key function or a key derivation function or a MAC function or a hash function |
FN | the number of fields (among the UE, the SN and the HN) of the 5G AKA protocol |
a hash function for computing MAC | |
, , , | four messages that are not inspected by the SN |
the HN | |
a hashing response from | |
a hashing expected response from | |
an initial counter block | |
an integrity key | |
a long-term key between the UE and the HN | |
a key between the UE and the access and mobility management function | |
a key derived from and | |
the key set of the penetrator | |
a key derived from | |
the session key between the SN and the HN | |
a key derivation function | |
a MAC of the HN | |
the “MAC failure” indication | |
a MAC of the UE | |
a MAC key | |
MN | the number of messages (among the UE, the SN and the HN) of the 5G AKA protocol |
identifying the and the partial native security context | |
PED | the encryption and decryption based on a public and private key pair |
an unpredictable challenge of the HN | |
, | two unpredictable challenges of the SEAF |
a response | |
a response from | |
the authentication result | |
an unpredictable challenge of the UE | |
a hash function | |
the SN | |
the serving network name of the SN | |
a fresh sequence number generated by the HN | |
the highest sequence number the USIM has accepted | |
a SUCI of the UE | |
a SUPI of the UE | |
the “Synchronization failure” indication | |
the UE | |
an ephemeral private key of the UE for Diffie-Hellman exchange | |
an ephemeral public key of the UE for Diffie-Hellman exchange | |
a MAC locally computed by the UE | |
an expected response | |
an expected response from | |
an ephemeral private key of the HN for Diffie-Hellman exchange | |
an ephemeral public key of the HN for Diffie-Hellman exchange |
References
- Xu, S.; Gan, Z. Review and trends of 5G security technology. Radio Commun. Technol. 2020, 46, 133–138. [Google Scholar]
- 3GPP TS 33.102: 3G Security; Security Architecture. Available online: https://www.3gpp.org/DynaReport/33102.htm (accessed on 26 January 2022).
- 3GPP TS 33.401: 3GPP System Architecture Evolution (SAE); Security Architecture. Available online: https://www.3gpp.org/DynaReport/33401.htm (accessed on 26 January 2022).
- 3GPP TS 33.501: 3GPP System Architecture Evolution (SAE); Security Architecture. Available online: https://www.3gpp.org/DynaReport/33501.htm (accessed on 26 January 2022).
- Ferrag, M.A.; Maglaras, L.; Argyriou, A.; Kosmano, D.; Janicke, H. Security for 4G and 5G cellular networks: A survey of existing authentication and privacy-preserving schemes. J. Netw. Comput. Appl. 2018, 101, 55–82. [Google Scholar] [CrossRef] [Green Version]
- Jover, R.P.; Marojevic, V. Security and protocol exploit analysis of the 5G specifications. IEEE Access 2019, 7, 24956–24963. [Google Scholar] [CrossRef]
- Ahmad, I.; Shahabuddin, S.; Kumar, T.; Okwuibe, J.; Ylianttila, M. Security for 5G and beyond. IEEE Commun. Surv. Tutor. 2019, 21, 3682–3722. [Google Scholar] [CrossRef]
- Khan, R.; Kumar, P.; Jayakody, D.N.K.; Liyanage, M. A survey on security and privacy of 5G technologies: Potential solutions, recent advancements, and future directions. IEEE Commun. Surv. Tutor. 2019, 22, 196–248. [Google Scholar] [CrossRef] [Green Version]
- Hussain, S.R.; Echeverria, M.; Karim, I.; Chowdhury, O.; Berino, E. 5GReasoner: A property-directed security and privacy analysis framework for 5G cellular network protocol. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, London, UK, 11–15 November 2019; pp. 669–684. [Google Scholar]
- Hussain, S.R.; Echeverria, M.; Chowdhury, O.; Li, N.; Bertino, E. Privacy attacks to the 4G and 5G cellular paging protocols using side channel information. In Proceedings of the 26th Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, 24–27 February 2019; pp. 1–15. [Google Scholar]
- Khan, H.; Martin, K.M. A survey of subscription privacy on the 5G radio interface-the past, present and future. J. Informat. Secur. Appl. 2020, 53, 102537. [Google Scholar] [CrossRef]
- Security Vulnerability in 5G-AKA Draft. Available online: https://www.cs.ox.ac.uk/5G-analysis/5G-AKA-draft-vulnerability.pdf (accessed on 23 February 2022).
- Meier, S.; Schmidt, B.; Cremers, C.; Basin, D. The Tamarin prover for the symbolic analysis of security protocols. In Proceedings of the 25th International Conference on Computer Aided Verification, Saint Petersburg, Russia, 13–19 July 2013; pp. 696–701. [Google Scholar]
- Basin, D.; Dreier, J.; Hirschi, L.; Radomirovic, S.; Sasse, R.; Stettler, V. A formal analysis of 5G authentication. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, Canada, 15–19 October 2018; pp. 1383–1396. [Google Scholar]
- Liu, F.; Peng, J.; Zuo, M. Toward a secure access to 5G network. In Proceedings of the 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), New York, NY, USA, 1–3 August 2018; pp. 1121–1128. [Google Scholar]
- Borgaonkar, R.; Hirschi, L.; Park, S.; Shaik, A. New privacy threat on 3G, 4G, and upcoming 5G AKA Protocols. Proc. Priv. Enhancing Technol. 2019, 3, 108–127. [Google Scholar] [CrossRef] [Green Version]
- Cremers, C.; Dehnel-Wild, M. Component-based formal analysis of 5G-AKA: Channel assumptions and session confusion. In Proceedings of the 26th Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, 24–27 February 2019; pp. 1–15. [Google Scholar]
- Koutsos, A. The 5G-AKA authentication protocol privacy. In Proceedings of the 2019 IEEE European Symposium on Security and Privacy (EuroS & P), Stockholm, Sweden, 17–19 June 2019; pp. 464–479. [Google Scholar]
- Bana, G.; Comon-Lundh, H. Towards unconditional soundness: Computationally complete symbolic attacker. In Proceedings of the First International Conference on Principles of Security and Trust (ETAPS), Tallinn, Estonia, 24 March–1 April 2012; pp. 189–208. [Google Scholar]
- Bana, G.; Comon-Lundh, H. A computationally complete symbolic attacker for equivalence properties. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, Scottsdale, AZ, USA, 3–7 November 2014; pp. 609–620. [Google Scholar]
- Braeken, A.; Liyanage, M.; Kumar, P.; Murphy, J. Novel 5G authentication protocol to improve the resistance against active attacks and malicious serving networks. IEEE Access 2019, 7, 64040–64052. [Google Scholar] [CrossRef]
- Gharsallah, I.; Smaoui, S.; Zarai, F. A secure efficient and lightweight authentication protocol for 5G cellular networks: SEL-AKA. In Proceedings of the 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), Tangier, Morocco, 24–28 June 2019; pp. 1311–1316. [Google Scholar]
- Hu, X.; Liu, C.; Liu, S.; Cheng, X. A security enhanced 5G authentication scheme for insecure channel. IEICE Trans. Inf. Syst. 2020, 103, 711–713. [Google Scholar] [CrossRef] [Green Version]
- Hu, X.; Liu, C.; Liu, S.; Li, J.; Cheng, X. A vulnerability in 5G authentication protocols and its Countermeasure. IEICE Trans. Inf. Syst. 2020, 103, 1806–1809. [Google Scholar] [CrossRef]
- Edris, E.K.K.; Aiash, M.; Loo, J.K. Formal verification and analysis of primary authentication based on 5G-AKA protocol. In Proceedings of the 2020 7th International Conference on Software Defined Systems (SDS), Paris, France, 20–23 April 2020; pp. 256–261. [Google Scholar]
- Ouaissa, M.; Ouaissa, M. An improved privacy authentication protocol for 5G mobile networks. In Proceedings of the 2020 International Conference on Advances in Computing, Communication & Materials (ICACCM), Dehradun, India, 21–22 August 2020; pp. 136–143. [Google Scholar]
- Parne, B.L.; Gupta, S.; Gandhi, K.; Meena, S. PPSE: Privacy preservation and security efficient AKA protocol for 5G communication networks. In Proceedings of the 2020 IEEE International Conference on Advanced Networks and Telecommunications Systems (ANTS), New Delhi, India, 14–17 December 2020; pp. 1–6. [Google Scholar]
- Fábrega, F.J.T.; Herzog, J.C.; Guttman, J.D. Mixed strand spaces. In Proceedings of the 12th IEEE Computer Security Foundations Workshop, Mordano, Italy, 30–30 June 1999; pp. 72–82. [Google Scholar]
- Fábrega, F.J.T.; Herzog, J.C.; Guttman, J.D. Strand space: Proving security protocols correct. J. Comput. Secur. 1999, 7, 191–230. [Google Scholar] [CrossRef]
- Herzog, J.C. The Diffie-Hellman key-agreement scheme in the strand-space model. In Proceedings of the 16th IEEE Computer Security Foundation Workshop, Pacific Grove, CA, USA, 30 June–2 July 2003; pp. 234–247. [Google Scholar]
Protocols | Authentication Properties | UE to SN | UE to HN | SN to UE | SN to HN | HN to UE | HN to SN |
---|---|---|---|---|---|---|---|
5G AKA | Injection agreement | No | No | No | No | No | No |
Non-injection agreement | No | No | No | No | No | No | |
Weaker agreement | No | Yes | No | Yes | Yes | Yes | |
5G-AKA’ | Injection agreement | Yes | Yes | Yes | Yes | Yes | Yes |
Non-injection agreement | No | No | No | No | No | No | |
Weaker agreement | No | No | No | No | No | No |
Security Properties | 5G AKA | [22] | [23] | [24] | 5G-AKA’ |
---|---|---|---|---|---|
Implement mutual authentication | No | No | No | No | Yes |
Prevent MitM attacks | No | No | No | No | Yes |
Resistance against cross attacks | No | No | No | Yes | Yes |
Compromise the location privacy of the UE | No | Yes | Yes | Yes | Yes |
Prevent masquerading attacks | No | No | No | No | Yes |
Resistance against replay attacks | No | No | No | No | Yes |
Defend against DoS attacks on the SN | No | No | No | No | Yes |
Prevent MAC failure attacks | No | No | No | Yes | Yes |
Provide key secrecy | Yes | Yes | Yes | Yes | Yes |
Provide perfect forward secrecy | No | No | No | No | Yes |
Comparative Items | 5G AKA | [22] | [23] | [24] | 5G-AKA’ |
---|---|---|---|---|---|
The number of messages | MN | MN | MN | MN | MN-2 |
The number of fields | FN | FN + 9 | FN-1 | FN + 2 | FN + 4 |
The amount of calculation | CA | CA + 2F | CA + 4PED-1ECDH-2F | CA + 2PED + 1F | CA + 1F |
Backward compatibility | -- | Yes | No | No | Yes |
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |
© 2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Xiao, Y.; Gao, S. Formal Verification and Analysis of 5G AKA Protocol Using Mixed Strand Space Model. Electronics 2022, 11, 1333. https://doi.org/10.3390/electronics11091333
Xiao Y, Gao S. Formal Verification and Analysis of 5G AKA Protocol Using Mixed Strand Space Model. Electronics. 2022; 11(9):1333. https://doi.org/10.3390/electronics11091333
Chicago/Turabian StyleXiao, Yuelei, and Shan Gao. 2022. "Formal Verification and Analysis of 5G AKA Protocol Using Mixed Strand Space Model" Electronics 11, no. 9: 1333. https://doi.org/10.3390/electronics11091333