A Formally Verified Security Scheme for Inter-gNB-DU Handover in 5G Vehicle-to-Everything

Abstract

Cellular technology has evolved over the decades for mobile network operators to accommodate the ever-growing demands of services for connecting Vehicle-to-Everything (V2X). The 5G infrastructure facilitates V2X communications, where a small-cell base station operating at ultra-high radio frequency with limited coverage becomes pervasive. These small-cell base stations in 5G-V2X must be strategically deployed near the consumers to realize several use cases. More recently, the architectural split solutions in Next Generation Radio Access Network (NG-RAN) are introduced, in which the gNB is divided into the distributed unit (gNB-DU) and control unit (gNB-CU). This functional split intends to improve scalability, performance, and network orchestration optimization. In this case, frequent user equipment (UE) handover between gNB-DUs is inevitable. However, the current 5G standard did not consider securing the path between these two entities. Hence, the NG-RAN could likely experience various security threats if the current handover procedure standard is employed without changes. Consequently, this paper introduces potential threats like resource depletion at NG-RAN caused by the useless execution of resource-demanding procedures to complete the transfer of attachment of UE to target gNB-DU. Another is UE being denied from accessing services caused by unsuccessful uplink and downlink synchronization during random access procedure execution, requiring establishing security and mutual authentication between the entities. Motivated by this, we proposed a security protocol composed of two phases, namely initial and handover. While the former phase assists in mutual authentication and key agreement between UE and serving gNB-DU, the latter secures UE's mobility in inter-gNB-DU handover. This protocol aims to preserve the existing quality of service and support essential security requirements, including confidentiality, integrity, mutual authentication, secure key exchange, and perfect forward secrecy. The security requirements are formally verified using BAN logic and Scyther, and the proposed protocol demonstrated lower handover latency than EAP-AKA', AKA, EAP-TLS, and EAP-IKEv2.

Challenges and Opportunities in Mobile Network Security for Vertical Applications: A Survey

“…Some surveyed papers also propose applying formal methods to enhance trust (regarding security) in 5G networks (e.g., [210,[212][213][214][215]). In this case, one of the challenges is the appropriate choice of how to represent network components, specific components of application scenarios, potential attacks, and mitigation strategies.…”

A survey on the handover management in 5G-NR cellular networks: aspects, approaches and challenges

“…The first phase is responsible for mutual AKA between the UE and gNB-DU, and the second phase secures the link between the UE and gNB-DU. Both phases are achieved via a master key (MSK) and the other keys derived from MSK [69].…”

An Enhanced Group Key-Based Security Protocol to Protect 5G SON Against FBS

“…BAN logic's verification procedure consists of four steps: idealization (modeling the protocol using formal logic), assumption (setting initial realistic security assumptions), goals (defining the security objectives that the protocol is expected to meet), and derivation (deriving the security goals from the rules, assumptions, and intermediate results of the derivation). The BAN logic notations and rules can be found in [18] and [19]. The reader is also referred to Appendices B and C for the notations and rules, respectively.…”