## 2 Overviews of Both the 5G AKA Protocol and the 5G-IPAKA Protocol
### The 5G-IPAKA Protocol  
In order to overcome the above shortcomings of the latest version of the 5G AKA protocol, we proposed the 5G-IPAKA protocol in [28], which is illustrated in Figure 2.  
In Figure 2, the detail steps of the 5G-IPAKA protocol are as follows:  
1. When the SEAF initiates an authentication with the UE, the UE sends \(SUCI\) to the SEAF. 2. Upon receiving \(SUCI\), the SEAF generates \(RAND_{SN}\) and then sends \(RAND_{SN}\), \(SUCI\), and \(SNN\) to the AUSF, where \(RAND_{SN}\) is an unpredictable challenge of the SEAF. 3. If the SEAF is entitled to use \(SNN\), then the AUSF stores the received \(SNN\) and sends \(SUCI\) and \(SNN\) to the UD. Figure 2: The 5G-IPAKA protocol. The UDM invokes the SIDF when \(SUCI\) is received. Then, the SIDF de-conceals \(SUCI\) to gain \(SUPI\) before the UDM can process the request. Based on \(SUPI\), the UDM/ARPF chooses one authentication method. 5. When 5G-IPAKA is selected, the UDM/ARPF generates \(RAND\), calculates \(AUTN\) and \(XRES^{*}\), and derives \(K_{AUSF}\), and then creates a 5G HE AV from \(RAND\), \(AUTN\), \(XRES^{*}\), and \(K_{AUSF}\), where \(AUTN=SQN\oplus AK||AMF||MAC\), \(AK=f_{5}(BK,RAND)\), \(MAC=f_{1}(BK,SQN||RAND||AMF)\), \(CK=f_{3}(BK,RAND)\), \(IK=f_{4}(BK,RAND)\), \(XRES=f_{2}(BK,RAND)\), \(XRES^{*}=KDF(CK||IK,SNN||RAND||XRES)\), \(K_{AUSF}=KDF(CK||IK,SNN||SQN\oplus AK)\), and \(BK=KDF(K,x\cdot y\cdot G||SNN)\). 6. The UDM sends the 5G HE AV to the AUSF together with \(SUPI\). When an AKMA subscription is used, the UDM also sends \(AKMA\) to the AUSF. 7. The AUSF stores the \(XRES^{*}\) temporarily together with the received \(SUPI\). 8. The AUSF generates a 5G AV from the 5G HE AV received from the UDM/ARPF by computing \(HXRES^{*}\) from \(XRES^{*}\), computing \(K_{SEAF}\) from \(K_{AUSF}\), replacing \(XRES^{*}\) with \(HXRES^{*}\), and replacing \(K_{AUSF}\) with \(K_{SEAF}\) in the 5G HE AV. 9. The ASUF creates a 5G SE AV by adding \(SUPI\) to the 5G AV, then sends the 5G SE AV (i.e., \(RAND\), \(AUTN\), \(HXRES^{*}\), \(K_{SEAF}\), and \(SUPI\)) together with \(RAND_{SN}\) to the SEAF. 10. The SEAF stores \(HXRES^{*}\), computes \(MAC_{SN}\), and then sends \(RAND_{SN}\), \(RAND\), \(AUTN\), \(ngKSI\), \(ABBA\), and \(MAC_{SN}\) to the UE, where \(MAC_{SN}\) is a MAC of the SEAF and \(MAC_{SN}=HMAC(K_{SEAF},RAND_{SN}||RAND||AUTN||ngKSI||ABBA)\). 11. In the UE, the ME forwards \(RAND\) and \(AUTN\) to the USM. Upon receipt of \(RAND\) and \(AUTN\), the USM first computes \(BK=KDF(K,x\cdot y\cdot G||SNN)\) and the anonymous key \(AK=f_{5}(BK,RAND)\) and retrieves the sequence number \(SQN=(SQN\oplus AK)\oplus AK\). Next, the USM computes \(XMAC=f_{1}(BK,SQN||RAND||AMF)\) and compares this with \(MAC\) that is included in \(AUTN\). Then, the USM verifies that the received \(SQN\) is in the correct range. If \(XMAC\) is the same as \(MAC\) and \(SQN\) is in the correct range, then the USIM computes a response \(RES=f_{2}(BK,RAND)\), \(CK=f_{3}(BK,RAND)\), and \(IK=f_{4}(BK,RAND)\), and then returns \(RES\), \(CK\), and \(IK\) to the ME. The ME then computes \(RES^{*}=KDF(CK||IK,SNN||RAND||RES)\), \(K_{AUSF}\), and \(K_{SEAF}\). Finally, the ME verifies \(MAC_{SN}\) using \(K_{SEAF}\). If the verification fails, then the ME aborts. 12. The UE computes \(MAC_{UE,2}\), and then sends \(RES^{*}\) and \(MAC_{UE,2}\) to the SEAF, where \(MAC_{UE,2}=HMAC(K_{SEAF},RAND_{SN}||RES^{*})\) is another MAC of the UE. 13. The SEAF verifies \(MAC_{UE,2}\). If the verification fails, then the SEAF aborts. Otherwise, the SEAF computes \(HRES^{*}=SHA256(RAND||RES^{*})\) and compares this with \(HXRES^{*}\). If they coincide, then the SEAF considers that the authentication is successful from the serving network point of view. If not, then the SEAF considers that the authentication is unsuccessful. 14. The SEAF sends the received \(RES^{*}\) to the AUSF. 15. The AUSF compares the received \(RES^{*}\) with the stored \(XRES^{*}\).