# DOSS Protocol for Data Caching and Sharing Security in a 5G Network
## 7 Security Analysis
### Protocol Security Analysis
#### 7.1.2 The Analysis Based on Set 2  
* Mutual Entity Authentication: Since the \(UE\) already authenticated with \(SPAAA\) and uses SSO for further authorization, it uses the access token to acquire both cache/share tokens from \(SPAAA\), resulting in implicit authentication between \(SS\) and \(UE\). In addition, reverifies the access token, the \(SS\) verifies the \(ChT/ShT\) and in return, it agrees to UE caching/sharing request by sending Acknowledgements. The \(FID\) and \(Ack1/Ack2\) proved to hold, implying that this requirement is also enforced. * Mutual Key Authentication: This property is not required as the involved parties are in possession of session keys \(K_{UESA}\) and \(K_{UESS}\). * Mutual Key Confirmation: Despite that the keys are preshared, the requirement met by the successful run of the protocol between the \(UE\), \(SPAAA\), and \(UE\), \(SS\). * Key Freshness: Although there is no function in ProVerif to validate key freshness, the \(SPAAA\) verifies if the \(AcT\) expiry date and timestamp supplied in the message enforce the session's freshness. However, because the keys' secrecy has not been compromised, it is assumed that they are new. * Unknown-Key Share: ProVerif uses the reachability property to check aliveness in a protocol. This attack is prevented by the entities' IDs and key binding. This requirement is demonstrated by the inclusion of IDs (\(FID\), \(SPID\)), and access token \(AcT\) parameters; \(fid,ssid,label\) in the authorization process. * Key Compromise Impersonation Resilience: The \(UE\), \(SPAAA\) and \(SS\) are in possession of \(K_{UESA}\) and \(K_{UESS}\) when the protocol starts which are pre-shared keys in this protocol. Since the secrecy property of all data exchanged holds hence, they enforce this requirement. Further enforcement of this requirement is achieved when digital signatures are used in message exchange this protocol. The UE will be able to refresh the access token and request new tokens for other services as defined by the SP via access control claims and security parameters. The use of \(FID\) and security tokens enable the UE and SP to start new authentication and process that might require new parameters. With SSO the UE can access granted service and request other services which reduce exposure to adversaries. The protocol is proved to be secure after formally analysing it using ProVerif. With DCSS the UE will be able to request authorization from SP to cache the data as an option. This protocol provides authorization, implicit authentication to the UE and SP. The implementation of the DCSS protocol will enable the UE to cache the data and security tokens for further uses such as sharing with other UEs leveraging on SSO, which provides secure communication, improving user experience, and use of network resources. After the successful run of the protocol, the UE should achieve data cache and sharing authorization for the UE to cache and share the data accessed from SS. It will also achieve entity authentication and message authentication. This protocol is an optional protocol that might be used if the UE needs to cache or share data. It also depends on if data have caching abilities and if the UE has been given the ability to cache or share the data. In the case where neither ability of the subject or the object match then the caching/sharing authorization will be denied. This is achieved using labels and delegation of access permissions. The messages between entities are encrypted and signed by the sender in terms of the tokens they are signed by the \(SPAAA\)). With 5G enabling seamless access to edge services and promising to improve user experience, it is paramount to address the legacy mobile system's security issues. Hence, DCSS protocol will address security issues at the service level, for example when the UE is granted access to a service and permission to cache the data but not to share it. The UE will include its request if intends to cache and share the data.