# Privacy-Aware Access Protocols for MEC Applications in 5G +
## 4 Results and Discussion
### Solution
#### 4.1.3 Access to APPIFY in MEC  
[PERSON] can access APPIFY in MEC after completing the registration. If there are no accessible MEC hosts around [PERSON], she then falls back to receive the services from the main server of APPIFY. In that case, [PERSON] would not be able to experience the benefits of the MEC host. In what follows, we assume that a suitable MEC host is deployed near the user for simplicity. Similar to the legacy systems, the 5G system includes a secure connection between UE and MNO. In addition to this, we also assume secure channels between MNO and MEC and between MEC and APPIFY, as mentioned earlier in Section 3.1. Schematic illustration of our solution idea is presented in Figure 3. The solution idea includes two other secure channels and the three channels mentioned earlier. These new channels are authenticated, confidential, and integrity protected. The two secure channels could be called an outer channel, between UE and MEC, and an inner channel, between UE and APPIFY. A part of the inner channel, between UE and MEC, runs inside the outer channel. Several different protocols can be chosen for the outer and inner channels for realizing our solution. Next, we describe a solution variant which uses datagram transport layer security (DTLS) [52] over user datagram protocol (UDP) for the outer channel and transport layer security (TLS) 1.3 [53] over the transmission control protocol (TCP) for the inner channel. The DTLS handshake includes server authentication based on the certificate of the server, where the MEC host is the server for the outer channel. The TLS handshake also includes server authentication based on the server certificate, where APPIFY is the server in the case of the inner channel. APPIFY authenticates the client, [PERSON], after the TLS handshake is completed by using the post-handshake client authentication extension of TLS 1.3 [53]. Therefore, while only [PERSON] authenticates the MEC host in the DTLS connection, in the TLS connection, Alice and APPIFY have mutual authentication. Figure 3: Solution idea for accessing APPIFY in MEC. The solution for accessing APPIFY in MEC is explained step by step and is summarized in Figure 4.  
1. UE of Alice and MNO run the 5G authentication and key agreement (AKA) procedure. As the result of this procedure, a secure connection is established between the UE of Alice and MNO. During the AKA procedure, IMSI is used as an identifier of [PERSON], and in the end, a temporary identifier TMSI is shared. After this step, the UE of Alice uses TMSI for further identification to MNO. 2. [PERSON] sends a request to MNO for establishing DTLS over UDP connection toward MEC. 3. If there is no deployed MEC in the network of MNO, then MNO replies to [PERSON] with an error message. In this case, [PERSON] connects to the main server of APPIFY. Otherwise, MNO sends the IP address of MEC to [PERSON]. 4. Alice and MEC complete the DTLS handshake. MEC sends \(cert(MEC)\) to [PERSON] during the handshake, and [PERSON] verifies this certificate by using the verification key of MNO, \(VK_{MNO}\). 5. [PERSON] sends a request for communication with APPIFY to MEC through the DTLS channel. 6. If there is no APPIFY in MEC, then MEC replies to [PERSON] with an error message. In this case, [PERSON] connects to the main server of APPIFY, similarly as in Step 3. Otherwise, MEC assigns a session number \(N\) to the DTLS connection and links it with APPIFY. 7. MEC confirms to the UE that APPIFY is hosted in MEC. Figure 4: Communication flow of the MEC access. [PERSON] sends a request for TLS over the TCP connection with APPIFY through MEC. When MEC receives the request, it inserts the session number \(N\) to the message and forwards it to APPIFY. The APPIFY also includes \(N\) in the messages directed to [PERSON] in further messages. This way, MEC will deliver the messages to the correct DTLS channels (without the session number). We do not go further into the communication details inside the MEC host.