# ML-AKA: An Authentication Protocol for Non-Standalone 5G-Based C-IoT Networks
## 6 The Novel ML-AKA Protocol for the 5G-NSA Based C-IoT Network  
The following proposed protocol shows the challenge-response key agreement to provide authentic communication and security for the different UE/DE and core network devices present in the LTE-based C-IoT network. In the existing EPS-AKA algorithm, there are some potential vulnerabilities, i.e., DDoS attacks, identity catcher attacks, etc. In the ML-AKA protocol, we tackle these attacks by preserving key parameters like bandwidth and throughput. In the C-IoT network, three levels of authentication are required for secure communication from D2D or from the device to the core network. The different layers of communication are listed below:  
* _Personal Area Authentication (PAA):_ Authentication of the local devices for end-to-end secure communication establishment, dealing with local communication and personal devices, as shown in Figure 4.
* _Local Area Authentication (LAA):_ The link between the devices and eNodeB is secured by using LAA. This deals with the authentication and secure data transfer between end-to-end devices through an eNodeB, as shown in Figure 5.
* _Global Area Authentication (GAA):_ The communication between eNodeB and the core network, along with the local component, is secured by GAA. The GAA includes EPC security, physical channel security, etc., as shown in Figure 6.  
Figure 3: EPS-AKA protocol of the NSA-based C-IoT network. The above three layers required mutual authentication and a key agreement protocol for each DE/UE at its service layer. The end-to-end authentication of the proposed ML-AKA protocol is carried out in four different steps, as shown in Figure 7. The steps are listed below:  
Figure 4: A C-IoT communication framework in a personal area network. Figure 5: A C-IoT communication framework in a local area network. Figure 6: A C-IoT communication framework in global area network scenario. * _System model setup_: In the system model setup stage, different devices generate some common parameters and create key agreements for D2D communication. * _Roaming registration of devices_: See below for explanations of the roaming registration of devices, which will allow us to achieve authentic D2D communication. (1) Devices (\(D_{i}\) where i = 1,2) deal with the registration to the \(AP_{i}\) in order to acquire local area resources to take care of local area authentication (LAA). The device identities (\(DID_{1}\), \(DID_{2}\)) are used for device registration requests that devices send to their AP. (2) After the registration request from \(D_{i}\) to the \(AP_{i}\) has been accepted, the authentication request js sent to the eNodeB; each request has its own identity (\(APID_{i}\)) for verification purposes. (3) After accepting the \(APID_{i}\) authentication request by the eNodeB, the server checks the legitimacy of the access points through the \(APID_{i}\). If the authentication request is not pinged by the legitimate AP, eNodeB simply rejects the authentication request and halts the process. When the authentication request comes from the authorized devices (\(D_{i}\)) and access point (\(APID_{i}\)), the eNodeB generates authentication information that contains a roaming key \(Ni_{same}\). The roaming key is calculated with the use of a cryptographic derivative function (KDF). \[Ni_{same}=KDF(N_{i},APID_{i},rand_{i})\] (1) where \(N_{i}\) is the key shared in between device (\(D_{i}\)) and its nearest eNodeB with an \(rand_{i}\). (4) After obtaining the authentication information (\(Ni_{same}\)), the \(AP_{i}\) and \(D_{i}\) mutually authenticate each other. Along with the authentication and verifying the legitimacy, both the \(D_{i}\) and \(AP_{i}\) derive the D2D function key, which is \(Ni_{D2D}\) with the use of roaming key \(Ni_{same}\). \[Ni_{D2D}=KDF(Ni_{same},fun_{id},rand_{i})\] (2) where \(fun_{id}\) is the D2D function entity identity and \(rand_{i}\) represents random keys chosen by \(AP_{i}\) The D2D session key is generated by the D2D fun key \(Ni_{D2D}\).