Formal verification of secondary authentication protocol for 5G secondary authentication

Abstract

The fifth-generation mobile network (5G) will enable interconnectivity between the home network (HN) and data network (DN) whereby mobile users with their user equipment (UE) will be able to access services provided by external service providers (SP) seamlessly. The mobile user and SP will rely on security assurances provided by authentication protocols used. For 5G, primary authentication between the UE and the HN has been defined and specified by the Third Generation Partnership Project (3GPP) while the secondary authentication has also been defined but not specified. 3GPP recommends the extensible authentication protocol (EAP) framework for secondary authentication between the UE and the SP. However, the secondary authentication methods have not been formally verified, so this paper proposes a secondary authentication protocol (SAP) for service authentication and provides a comprehensive formal analysis using ProVerif a security protocol verifier. Finally, it conducts a security analysis on the protocol's security properties.

An Introduction of a Modular Framework for Securing 5G Networks and Beyond

“…In another applicable scenario, the HN might provide infrastructure services via network slices to other MNOs or SPs, even though they are in the same network domain; however, the service and security provision are handled by another party, therefore secondary authentication could be applied to internal DN [9]. The primary and secondary authentications are discussed in detail in [10][11][12][13], respectively.…”

“…The 5G-AKA or EAP-AKA' methods are mandatory for the 5G primary authentication procedure and the only authentication methods supported by UE and SN, for private networks' EAP framework, should be used as specified in [6] and as shown in Figure 1. The 5G-AKA and EAP-AKA' are discussed in [6,10,11,14,15].…”

“…After establishing connectivity to the network, the UE must be authenticated and authorised to use the services, which is addressed by SLS [12]. SLS also requires mutual authentication between the UE and the SP to establish a secure communication channel, with a focus on zero trust [11].…”

“…• Secondary Authentication Protocol (SAP)-AKA Protocol: enables the UE and the SP to establish mutual authentication and anchor keys [11]. • Network Service-Federated Identity (NS-FId) Protocol: enables the UE and the SP to achieve mutual federated authentication and authorisation [12].…”

“…These protocols are formally verified for security guarantees that align with the security requirements of the unified modular architecture in Figure 2, as demonstrated in [10][11][12][13]26].…”