# 5G-IPAKA: An Improved Primary Authentication and Key Agreement Protocol for 5G Networks
## 1 Introduction  
With the continuous popularization of 5G communication technology, in the near future, the 5G network, as an important communication infrastructure, will penetrate into diverse vertical fields, such as in transportation, medical treatment, and industry, and will also support various information interactions between people, people and things, and things and things [1]. In the 5G network, three different primary authentication and key agreement protocols are defined in the related 3 rd generation partnership project (_3 GPP_) specifications [2; 3; 4], including the 5G AKA (authentication and key agreement) protocol, the EAP-AKA' protocol, and the 5G EAP-TLS protocol. The first two protocols are based on the shared key cryptography, while the last one is based on the public key cryptography. These protocols all aim to provide mutual authentication of subscribers and networks. Currently, they are in the process of standardization. The 5G AKA protocol [2; 3; 4] was developed directly from the evolution packet system (_EPS_)-AKA protocol of the long-term evolution (_LTE_)/4G network [3], so it inherited certain security vulnerabilities from the EPS-AKA protocol, such as impersonation attacks, man-in-the-middle attacks (_MitM_), and denial of service (_DoS_) attacks [5; 6; 7; 8; 9; 10; 11]. In [12], the authors analyzed the 5G AKA protocol of TS 33.501 v0.7.0. They discovered a protocol vulnerability that would enable an attacker to impersonate another user in a serving network (_SN_). Basedon the Tamarin model checker [13], [PERSON] et al. [14] investigated the security properties of the 5G AKA protocol of TS 33.501 v15.1.0, and several major issues were revealed, which were related to user localization, the leakage of activity, the impact of active attackers, and the presence of malicious \(SN\) while roaming. In [15], the authors pointed out that the 5G AKA protocol suffers from link ability attacks, and proposed a new authentication scheme by making use of the Diffie-Hellman key exchange algorithm to generate the session key. This scheme was successful in preventing link ability attacks along with an MitM attack. For the more recently 5G AKA protocol, the authors in [16] found a new attack type. They claimed that the protection mechanism of the sequence number (\(SQN\)) can be defeated under specific replay attacks due to its use of exclusive-OR (\(XOR\)) and a lack of randomness. In [17], the authors modeled all key components of the 5G AKA protocol (i.e., the user equipment, the serving network, and the home network) according to the definition in the 3 GPP specification document. They discovered an attack that exploits a potential race condition and additionally showed that solving the race condition for the honest case does not necessarily prevent the attack. In [18], the authors investigated the privacy properties of the 5G AKA protocol using the Bana-Comon logic [19; 20]. They discovered a novel de-synchronization attack and proved that their proposed protocol guarantees the privacy properties. In [21], the authors proposed a novel version of the 5G AKA protocol to prevent active attacks and gain resistance against malignant serving networks. Unfortunately, there is a possibility of an \(SN\) impersonation, so this scheme does not eliminate the vulnerability towards the MitM attack. Further, [PERSON] et al. in [22] also attempted to launch a revised version of the 5G AKA protocol. However, their proposed protocol suffers from privacy preservation, as the device identities are clearly transmitted in the air, which leads to numerous security attacks. As time goes on, more attacks on the 5G AKA protocol were found due to the insecure channel between different network domains in the legacy mobile network. In [23], the authors discovered an attack exploiting subscription concealed identifier (\(SUCI\)) to track a subscriber in the 5G network, which is directly caused by the insecure air channel.