# A Blockchain-Assisted Security Protocol for Group Handover of MTC Devices in 5G Wireless Networks
## 5 The Proposed BSPGH
### System Initialization and Registration  
1. System initialization: Given security parameter \(1^{K}\), AMF selects a large prime number \(q\) and \(E\big{(}F_{q}\big{)}\) as the elliptic curve over a finite field \(F_{q}\). Let \(G\) be a cyclic additive group generated by generator \(P\) with order \(q\). \(H_{0}=Z_{q}\times\{0,1\}^{*}\to Z_{q}\), \(H_{1}:G\times\{0,1\}^{*}\to Z_{q}\), \(H_{2}:\{0,1\}^{*}\times G\times\{0,1\}^{*}\times G\times G\to Z_{q}\), \(H_{3}:\{0,1\}^{*}\times\{0,1\}^{*}\times\{0,1\}^{*}\times G\times Q\to Z_{q}\) and \(H_{4}:\{0,1\}^{*}\times\{0,1\}^{*}\times G\to Z_{q}\) are hash functions. AUSF chooses a random element \(\alpha\in Z_{q}\) and calculates the corresponding public key \(P_{pub}=\alpha\cdot P\). AMF chooses a random element \(\beta\in Z_{q}\) and calculates the corresponding public key \(T_{pub}=\beta\cdot P\). Finally, the AMF publishes the system parameter \(params=\left(P,q,G,P_{pub},T_{pub},H_{0},H_{1},H_{2},H_{3},H_{4}\right)\). 2. Initial registration: To protect identity privacy, each MTCD and gNB should first register with the AUSF to obtain their own pseudonyms. Below, we use the MTCD with the real identity \(ID_{\text{i}}\) as an example to explain the specific registration process, which is shown in Figure 2.  
\[Step\text{-}1:MTCD\to AMF:\{mpk_{i},\{ID_{i},mpk_{i}\}_{\delta}\}\] \begin{table}
\begin{tabular}{c c} \hline \hline
**Notation** & **Definition** \\ \hline \(TID\) & Temporary anonymous identity \\ \hline \(ID\) & Permanent identifier \\ \hline \(GID\) & Group key material \\ \hline \(MAC\) & Message authentication code \\ \hline \(H(msg)\) & Hash function \\ \hline \(TS\) & Timestamp \\ \hline \(K_{it}/K_{1t}\) & The session key of MTCD and gNB \\ \hline \(G\) & Cyclic additive group \\ \hline \(P/q\) & Generator of the group/prime order of group \\ \hline \(PK/SK\) & Public key/private key \\ \hline \(\{x\}_{k}\) & Encrypted \(x\) with key \(k\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Notations and definition of the proposed protocol. The MTCD generates a secret value and a corresponding partial public key. It randomly selects a random number \(msk_{i}\in Z_{q}\) as its secret value and calculates the partial public key \(mpk_{i}=msk_{i}\cdot P\). Then, it computes \(\delta=H_{0}\left(msk_{i}\cdot T_{pub}\right)\) as the symmetric encryption key and sends its identity \(ID_{i}\) in a message to AMF. \[Step\text{-}2:AMF\to AUSF/UDM:\{ID_{i},mpk_{i}\}\]  
AMF checks the identity of \(MTCD\) and forwards that identity and the public key to AUSF. The anonymous identity \(ID\) is generated by the AUSF, while the UDM stores the permanent identity \(ID\). \[Step\text{-}3:AUSF/UDM\to AMF:\{TID_{i}\}\]  
Upon receiving \(ID_{i}\), AUSF calculates the temporary anonymous identity \(TID=ID\oplus H_{1}(\alpha\cdot mpk_{i})\). AUSF then forwards \(TID_{i}\) to AMF. Simultaneously, AUSF also forwards the identity \(ID_{i}\) to UDM, which is responsible for storing \(ID_{i}\). \[Step\text{-}4:AMF\to MTCD:\{TID_{i},mpk_{i},psk_{i},R_{i}\}_{\delta}\]  
AMF generates the secret value and a corresponding partial public key for MTCD. It randomly selects a random number \(r_{i}\in Z_{q}\), calculates \(R_{i}=r_{i}\cdot P\), \(h_{i1}=H_{2}\left(TID_{i},mpk_{i},R_{i},T_{pub}\right)\), and \(psk_{i}=r_{i}+\beta\cdot h_{i1}\), then computes \(\delta=H_{0}(\beta\cdot mpk_{i})\). After forwarding the message to \(MTCD_{i}\), \(MTCD_{i}\) stores \(TID_{i}\), calculates \(h_{i1}\), and verifies that \(psk_{i}\cdot p=R_{i}+h_{i1}\cdot T_{pub}\). It then sets \(PK_{i}=\{mpk_{i},R_{i}\}\) and \(SK_{i}=\{msk_{i},psk_{i}\}\) as the public-private key pair. The AMF sends the public key to the gNB, and the gNB uploads the public key pair to the blockchain. Initial authentication: All MTCDs, the AUSF, and the UDM perform the initial authentication following the 5G-AKA scheme.