# A Survey of Public Key Infrastructure-Based Security for Mobile Communication Systems
## 3 A Survey of the Literature
### Review of PKI-Based Security for 2G-GSM Systems  
Due to the low communication characteristics of the GSM cellular system, many researchers deployed lightweight cryptosystem algorithms in the field of GSM security, such as elliptic curve cryptosystem (ECC) and Ron Rivest-Adi Shamir-Leonard Adleman algorithm (RSA) algorithm, in order to provide secure authentication between a user and a server using a weak secret, and hence the encrypted key exchange (EKE) protocol is used. 2002 [PERSON] et al. [16] present a variant of RSA-EKE for mobile devices. In the protocol, the need for per session RSA key generation is cancelled, but an \"interactive step\" included against e-residue attacks brings additional computational costs on both the server and client sides. [PERSON] et al [17] follow to propose another influential work on strong user authentication with weak passwords. [PERSON] et al. 's contains a trusted third party which is continuously available online, as in Kerberos. Unlike EKE, there is no need to generate fresh public/private key pairs per session, but there is a need for the trusted server's public key to be known to all parties; in this protocol, by the help of the trusted server, the parties in the system authenticate each other. In order to bring some flexibility to GSM users, [PERSON] and [PERSON] [18] proposed an authentication protocol for GSM. In this protocol, without interacting with the operator of the service provider by using PINs and passwords, mobile users can redirect their calls, reach their accounts without their subscriber identity module (SIM) card, or easily disable their accounts. All the same, the scheme proposed is not secure since the users can access their accounts without the SIM card, and this mainly eliminates the dependency of the SIM card during authentication. [PERSON] et al. [19] followed and proposed a GSM authentication protocol using an ECC scheme. This scheme offers better security since it does not use A5/0, A5/1 and A5/2 algorithms, which have been already broken. In addition, this scheme provides mutual authentication, requires less storage, avoids replay attack, consumes smaller network bandwidth, and reduces the storage overhead and bandwidth consumption problem by delegating the key generation operation to the VLR, an advantage indeed. Nevertheless, this scheme provides a new session key for each and every new communication. VLR uses its initial identity for every new communication. The first Phase involves 4 message flows and the second phase involves 2 message flows. This aims to improve some drawbacks of the current GSM authentication protocol, including: not supporting bilateral authentication, huge bandwidth consumption between VLR and HLR, stored space overhead in VLR, and overloaded HLR with authentication of mobile stations. Figure 2: Taxonomy of the PKI-based security approaches in mobile communication systems. [PERSON] et al. [20] proposed an extension of the authentication protocol for GSM. In addition, security algorithms A3, A5 and A8 make this new protocol robust. Nevertheless, this scheme provides mutual authentication only for the first time, when the mobile station (MS) joins into the new VLR. Despite this, the scheme proposed a novel authentication protocol which not only clear the drawbacks of the previous works but also make the authentication more efficient. This scheme provide mutual authentication without changes in the basic system architecture, and it's employed that the same encryption algorithms and one-way hash functions used in the basic GSM authentication scheme (A3, A5 and A8). Building on that, each user has its own secret pre-shared key \(K_{0}\) which is stored in AuC/HLR in advance as well as in SIM/MS. However, in this protocol and for each new communication, VLR computes the certificate to prove its identity even though the MS has stayed in the same VLR.