# A Secure Blockchain-Based Authentication and Key Agreement Scheme for 3 GPP 5G Networks
## 5 Security Evaluation
### Security Analysis  
We qualitatively justify that our 5 GSBA provides the following security features. **Mutual Authentication and Key Agreement:** By the 5 GSBA, UE uses a one-way hash secret \(Y\) stored in the USIM to prove that it is the legitimate party. A gNB verifies it by comparing it to the one-way hash value \(H(Y)\) stored in the private blockchain. Since  
Figure 4: Formal verification with Scyther. finding the original secret of a hash is a computationally infeasible problem, the UE can effectively prove to the gNB that its authentication request message is legitimate. Besides, the UE encrypts the one-way hash secret \(Y\) and a randomly generated HMAC key \(K_{hmac}\) using the public key \(PK_{core}\). Since only legitimate gNBs possessing the private key \(SK_{core}\) can read the one-way hash secret and the HMAC key, by issuing a correct HMAC code \(\sigma 2\), the gNB effectively prove to the UE that the authentication response is also legitimate. Thus, both gNB and UE can be mutually authenticated to derive a common key using ECDH parameters in the authentication messages. **Secure Data Transmission**: The 5 GSBA assumes that all subsequent user data will be encrypted with the session key generated in the authentication procedure. For the session key generation, a UE sends an ECDH public key \(a\cdot P\) to a gNB, and the gNB replies to another ECDH public key \(b\cdot P\) to the UE. Hence, the actual session key \(a\cdot b\cdot P\) is never transmitted anywhere. In fact, the ECDH relies on the Computational Diffie-Hellman (CDH) problem, which means it is difficult to find the \(a\) from \(a\cdot P\). Even if an adversary captures all the authentication messages, it is computationally infeasible for him to recover the session key by finding either \(a\) or \(b\) to calculate the \(a\cdot b\cdot P\). Consequently, the 5 GSBA can ensure only legitimate parties (i.e., UE and gNB) can read the user data. **Session Key Perfect Forward/Backward Secrecy:** The 5 GSBA uses the public key \(PK_{core}\) of the 5 GC, the randomly generated HMAC key \(K_{hmac}\), and the one-way hash secret \(Y\) for authentication purposes only. The session key generation relies on the randomly generated ECDH parameters. Hence, when the permanent keys are stolen in the future, attackers still could not derive the session key to recover the content of a specific session. Additionally, since the newly generated ECDH parameters for each session are irrelevant to the previous or future sessions, compromising the current session key will only affect the current session. The secrecy of the previous or future sessions will remain unaffected. **Device Anonymity:** Since the SUCI is mandatory by the 5 GSBA, the SUPIs of requesting UE devices are always concealed with ECIES. Hence, eavesdroppers cannot use authentication request messages to identify or trace any devices. **Protocol Attack Resistance:** The 5 GSBA outperforms most proposals, including the standardized 5G-AKA with the stronger resistibility to many attacks. For example, thanks to the aforementioned security properties, the 5 GSBA prevents common attacks such as eavesdropping, location tracking, and man-in-the-middle (MITM) attacks. Moreover, it is highlighted that some critical attacks can be prevented including DoS/DDoS attacks, linkability attacks, UE impersonation attacks, rogue base station attacks, and replay attacks:  
* **DoS Semantic Attack Prevention:** With the 5 GSBA, semantic attacks exploiting the weaknesses of the protocol are impracticable, because the authentication request contains a timestamp and a one-time hash secret Y. Specifically, when the gNB receives an authentication request, it first checks if the timestamp is fresh. Then, it decrypts the SUCI and compares the Y with the records stored in the private blockchain. If the calculated hash value does not match, it will reject the session immediately. In this way, adversaries cannot hoard multiple sessions in the gNB by replaying the same authentication messages (i.e., the original SUCI in 5G-AKA).