# 5G-Compliant Authentication Protocol for RFID
## 2 Security Architecture and Procedures for 5G and Threat Model
### The 5G Authentication and Key Agreement Protocol, 5G-AKA
The \(SUCI\) is, as explained, the encryption of the \(SUPI\) with the public key of HN using a random number \(ne:SUCI=\{SUPI\}^{ne}_{pk}\). The \(SUCI\) is used to identify the UE, while the \(SUPI\) is never sent clearly. This prevents a security flaw in 4G that allows an attacker to get the permanent identifier of an UE (\(IMSI\)) by impersonating a serving network (\(IMSI\) catcher attack [9]). After a successful execution of 5G-AKA, the SN can issue a pseudonym called \(GUTI\) (globally unique temporary UE identity) that the UE can be used to identify itself for a certain period of time [10]. This avoids computing the \(SUCI\) that requires generating a random number \(ne\) and computing an assymmetric encryption. The \(GUTI\) is updated by AMF upon receiving a registration request message from a UE of type \"initial registration\", \"mobility registration update\", \"periodic registration update\" or in response to a paging message, but it is left to the operator to re-assign it more frequently. * Assumptions on Channels. The channel between UE and SN, on the radio physical layer, is subject to attacks by passive and active adversaries (Section 2.3). By contrast, the channel between the SN and HN is supposed to be secure (Clause 5.9.3 [2]). Figure 2 describes the flows of the 5G-AKA protocol, where \(\oplus\) and \(||\) stand for xor and concatenation, respectively. For simplicity, we just identify three parties: UE, SN and HN, integrating the different sub-entities (SEAF, AUSF, UDM...), as we do not require this level of granularity. Nevertheless, within UE,  
we distinguish between computations in the USIM and in the ME, since this is relevant for the new proposal described in the next section. The protocol consists of three phases:  
* The first phase is the initiation of the authentication procedure and the selection of the authentication method. The SEAF of SN may initiate an authentication with the UE during any procedure establishing a signalling connection with the UE. If UE does not have a valid \(GUTI\), then it computes and sends the \(SUCI\) to SN, who relays it to HN. Otherwise, UE sends the \(GUTI\) to SN. If the SN (AMF) is able to obtain the corresponding \(SUPI\), by looking it up in its database, then SN forwards it to HN. If not, it requests (\"Identifier Request Message\") the \(SUCI\) to UE and relays it to HN. SN includes its identifier (\(SN_{name}\)) in the message to HN. The HN (AUSF) then checks whether the SN is authorized and if so, obtains the \(SUPI\): directly if it was sent or, otherwise, deconcealing it from the \(SUCI\) (at SIDF). Based on \(SUPI\), the HN (UDM/ARPF) shall choose the authentication method. * The second phase is the actual authentication procedure, which is based on a typical challenge-response mechanism. Thus, upon receiving a request for authentication, HN generates a random number \(R\), which is used as a challenge, and an authentication value \(AUTN\), which consists of a message authentication code \(MAC\) (using \(f1\)) and a value, \(CONC\) (using \(f5\)), which masks the sequence number \(SQ_{HN}\), required to compute the \(MAC\) and included to prevent replay attacks. It additionally computes the response to this challenge (\(XRES\)) and sends its hashed value (\(HXRES\)) to SN, so that this can detect incorrect responses, even when it is not able to compute the correct ones. The use of \(HXRES\) reduces the vulnerability to denial of service (DoS) attacks, since junk messages can be detected earlier. The response involves the long-term key \(K\), the challenge \(R\) and the identifier of SN, to guarantee that both parties are communicating with the same SN. UE receives the challenge and the authentication value: \(R\), \(AUTN\). Then, USIM retrieves \(SQ_{HN}\), computes the \(MAC\) and makes a twofold check: (i.) that the \(MAC\) is correct and therefore the authenticity of the message, and (ii.)