## 6 Discussion  
### Security of the 5 GAKA-LCCO Protocol  
\(SUCI=x\cdot G||\{SUPI\}_{EK}||MAC_{UE}\), \(MAC_{UE}=HMAC(MK,\{SUPI\}_{EK})\) and \(EK||ICB||MK||K_{AUSF}=KDF(K,x\cdot y\cdot G||RAND_{SN}||T_{SN}||SNN)\), so both \(RAND_{SN}\) and \(T_{SN}\) are included in \(SUCI\), meaning that both the SN and the HN can find whether \(SUCI\) is replayed. \(AUTN=AMF||MAC\), \(MAC=f_{1}(MK,RAND||AMF)\) and \(EK||ICB||MK||K_{AUSF}=KDF(K,x\cdot y\cdot G||RAND_{SN}||T_{SN}||SNN)\), so \(AUTN\) contains the challenge of the UE (i.e., \(x\)). Hence, the second received message of the UE cannot be a replayed message, preventing the location privacy of the UE from being compromised. Since the received messages of the SN contain the challenge of the SN (i.e., \(RAND_{SN}\)), these messages cannot be some replayed messages, preventing DoS attacks against the SN. In addition, \(T_{SN}\) is included in \(\{RAND_{SN}||T_{SN}||SUCI||SNN\}_{K_{SN,HN}}\) and verified by the HN based on maintaining the time synchronization between the SN and HN, so the first received message of the HN cannot be replayed, preventing DoS attacks against the HN. The 5 GAKA-LCCO protocol does not contain the above \"MAC failure\" indication, so it can defend against those attacks based on MAC failure. In addition, \(EK||ICB||MK\)\(||K_{AUSF}=KDF(K,x\cdot y\cdot G||RAND_{SN}||T_{SN}||SNN)\) and \(K_{SEAF}=KDF(K_{AUSF},SNN)\), providing perfect forward secrecy (PFS) based on the Diffie-Hellman exchange. Depending on the above formal verification and security analysis of the 5 GAKA-LCCO protocol, our proposed 5 GAKA-LCCO protocol can completely overcome the above shortcomings in the latest version of the 5G AKA protocol. Figure 6: Security simulation results of the 5 GAKA-LCCO protocol in the Scyther tool. A comparative analysis between the 5 GAKA-LCCO protocol and the recently improved 5G AKA protocols [23; 24; 26; 28] regarding the shortcomings of the latest version of the 5G AKA protocol is given in Table 1.  
From Table 1, the recently improved 5G AKA protocols still have some of the shortcomings of the latest version of the 5G AKA protocol, but our proposed 5 GAKA-LCCO protocol completely overcomes all the shortcomings of the latest version of the 5G AKA protocol. In [23], the ephemeral public-private key pair of the UE (i.e., \(x\) and \(x\cdot G\)), the PKI public-private key pair of the SN, and the PKI public-private key pair of the HN are used to ensure the security of the channel between the UE and the SN, the security of channel between the UE and the HN, and the security of the channel between the SN and the HN. The first received message of the UE is encrypted by using the ephemeral public key of the UE, which means that the message can only be decrypted by using the ephemeral private key of the UE, so it cannot be a replayed message, preventing the location privacy of the UE being compromised. In addition, the UE can find whether \(SUCI\) is replayed. However, the other parts fully inherit the 5G AKA protocol, so the other shortcomings of the 5G AKA protocol still exist in the protocol of [23]. In [24], both the synchronization failure and the MAC failure are constructed as the format of \(RES^{*}\), making it impossible to distinguish them, which can prevent the location privacy of the UE being compromised and prevent those attacks based on MAC failure. However, the other parts fully inherit the 5G AKA protocol, so the other shortcomings of the 5G AKA protocol still exist in the protocol of [24]. In [26], \(SUCI\) is included in \(AUTH_{SEAF}\) of the second received message of the UE, so the UE can find whether \(SUCI\) is replayed, where \(AUTH_{SEAF}\) is an authentication token of the SEAF. However, both the SN and the HN cannot find whether \(SUCI\) is replayed, resulting in DoS attacks against both the SN and HN.