# 5G-AKA-FS: A 5G Authentication and Key Agreement Protocol for Forward Secrecy
## 1 Introduction  
Since the first deployment of the fifth generation (5G) mobile networks in 2019, 5G has rapidly become a mainstream mobile network worldwide. According to the Global System for Mobile Communications Association (GSMA), the 5G adoption rate reached 43.1% in the United States in Q4 2022 [1]. 5G mobile networks and telecommunication standards have been developed to meet the various demands of modern telecommunication. In particular, it is designed to support enhanced features such as Enhanced Mobile BroadBand (EMBB),Massive Machine-Type Communications (MMTC), and Ultra-Reliable and Low-Latency Communications (URLLC) [2]. In order to ensure the seamless delivery of high-quality services to users through these three features, 5G demands heightened security compared to its predecessors in mobile networks. Therefore, the 3 rd Generation Partnership Project (3 GPP) consortium, which is in charge of the standardization of 5G mobile networks, has standardized an essential 5G security architecture and procedures as well as several security features [3,4]. Figure 1 depicts the 3 GPP 5G security architecture. Notably, in 5G, primary authentication emerges as a cornerstone, representing the initial security checkpoint for accessing 5G network environments. For the 5G primary authentication, two protocols have been adopted as standards: 5G Authentication and Key Agreement (5G-AKA) and Improved Extensible Authentication Protocol Method for 3 rd Generation Authentication and Key Agreement (EAP-AKA\({}^{\prime}\)) [3,5]. The former caters to 3 GPP devices, while the latter is tailored for non-3 GPP devices. The 5G primary authentication protocols, i.e., 5G-AKA and EAP-AKA\({}^{\prime}\), allow a user equipment (UE) (e.g., a mobile phone) and a home network (HN) (e.g., the network of a service provider) to authenticate each other and exchange key materials (e.g., anchor keys) to protect entire subsequent 5G communications. Note that they have been enhanced and markedly differentiated from their previous version (i.e., Evolved Packet System Authentication and Key Agreement (EPS-AKA) [4] and Extensible Authentication Protocol Method for 3 rd Generation Authentication and Key Agreement (EAP-AKA) [6]). The most distinctive feature of those security protocols in the 5G network is using a Subscriber Concealed Identifier (SUCI) that can be explained as a Subscriber Permanent Identifier (SUPI) in the encrypted format. In the previous generation, authentication was performed by transmitting the user identification information, International Mobile Subscriber Identity (IMSI), without encryption. On the other hand, in 5G, SUPI, which is a UE's identifier, is encrypted into SUCI using a key derived through the Elliptic Curve Integrated Encryption Scheme (ECIES) before transmission to address identifier exposure [7, 8, 9, 10]. Despite these efforts, 5G-AKA still remains vulnerable to various types of attacks [7, 9, 10, 11, 12, 13, 14]. Ref. [15] described vulnerabilities for 5G-AKA through formal verification and analysis. The authors  
Figure 1: 3 GPP 5G security architecture. showed that there still exist attack scenarios against 5G-AKA. In addition, refs. [10; 16] pointed out that privacy problems of users may occur since 5G-AKA is susceptible to linkability attacks. Furthermore, ref. [17] presented shortcomings of 5G-AKA, including the lack of support for forward secrecy, also known as perfect forward secrecy. Meanwhile, the 5G network environments face the following new challenges:  
* As the advancement of 5G technology and the proliferation of 5G network applications continue at a rapid pace, the emergence of new security threats and attacks becomes more pronounced, thereby necessitating the establishment of elevated security prerequisites.