## 4 The Proposed 3-Tier AKA Mutual Authentication and Key Agreement (AKA) Protocol
### Authentication and Key Agreement Phase (Edge Device and Fog Node Authentication Protocol)  
In this phase, if a registered edge device \(\delta_{d}\) is going to join the network, the Authentication and Key Agreement process between edge device \(\delta_{d}\), fog node \(\zeta_{z}\), and 5G service provider \(u_{v}\) is performed. Figures 5 and 6 show the steps of the Authentication and Key Agreement protocol to accomplish mutual authentication between fog nodes and edge devices and generate a common session key for future security services. Figure 4: 3-Tier AKA: Entity registration protocol. Figure 3: UML activity diagram for 3-Tier AKA: Entity initialization protocol. Figure 5: UML activity diagram for 3-Tier AKA: Mutual authentication protocol. Figure 6: 3-Tier AKA: Authentication and Key Agreement protocol for edge device and fog node. **Step 1:**: The edge device \(\delta_{d}\) computes a self-authentication message \(proof\,Me\), which is the encryption of the current timestamp \(T\) along with a string literal \"\(\delta_{d}to\zeta_{z}\)\" using the edge secret key \(K_{\delta_{d}}\), \(proof\,Me=E(T\parallel``\delta_{d}to\zeta_{z}\)\", \(K_{\delta_{d}})\). The timestamp ensures the refresh of the message and prevents the replay attacks, whereas the string literal requests from the 5G service provider that the edge device \(\delta_{d}\) would like to communicate with the fog node \(\zeta_{z}\). Then, \(\delta_{d}\) transmits \(proof\,Me\) and the security token \(O_{\delta_{d}}\) to 5G service provider \(u_{v}\). See lines 1 and 2 in Figure 6.
**Step 2:**: The 5G service provider \(u_{v}\) receives the self-authentication message \(proof\,Me\) and the token \(O_{\delta_{d}}\) from edge device \(\delta_{d}\). Then, \(u_{v}\) decrypts the received token to recognize the identity of the edge device, i.e., the \(\delta_{d}ID\), and to retrieve the secret key of \(\delta_{d}\), i.e., \(K_{\delta_{d}}\). \(u_{v}\) decrypts the received \(proof\,Me\) using \(K_{\delta_{d}}\), and verifies that \(T\) is within the current time skew. If the timestamp is verified, then \(\delta_{d}\) is authenticated to \(u_{v}\) and generates a session key \(SK_{\delta_{d}\zeta_{z}}\) to be used between edge device \(\delta_{d}\) and fog node \(\zeta_{z}\). However, if the timestamp verification fails, \(u_{v}\) closes the session as presented in lines 2 and 3 in Figure 6. In lines 4 and 5, from Figure 6, \(u_{v}\) encrypts the string \"\(\delta_{d}to\zeta_{z}\)\" along with the generated session key using their master secret key \(MS_{u_{v}}\), which is called \(proof_{\delta_{d}}\). Note that \(proof_{\delta_{d}}\) is a sealed value of the generated session key \(MS_{\delta_{d}\zeta_{z}}\) that is not saved in the 5G service provider to make it a stateless entity. As shown in line 5 in Figure 6, the retrieved timestamp, the string \"\(\delta_{d}to\zeta_{z}\)\", the session key \(SK_{\delta_{d}\zeta_{z}}\), and the \(proof_{\delta_{d}}\) are encrypted by the secret key \(K_{\delta_{d}}\) to form the message response \(R_{\delta_{d}}\), i.e., \(K_{\delta_{d}}=E(T\parallel``\delta_{d}to\zeta_{z}\)\" \(\parallel SK_{\delta_{d}\zeta_{z}}\parallel\)\(proof_{\delta_{d}},K_{\delta_{d}})\). Then, \(u_{v}\) sends \(R_{\delta_{d}}\) to the edge device \(\delta_{d}\). **Step 3:**: Once edge device \(\delta_{d}\) receives the response message \(R_{\delta_{d}}\), as shown in line 5 from Figure 6, it decrypts \(R_{\delta_{d}}\), and first, verifies the value of the timestamp to authenticate the 5G service provider \(u_{v}\) that verified device \(\delta_{d}\) and created a secret session key to be used between \(\delta_{d}\) and the fog node \(\zeta_{z}\). Note that the value \(proof_{\delta_{d}}\) is sent to the edge device, not to the fog node, to avoid involving the fog node in the protocol until the edge device decides to. Now, the edge device decrypts \(R_{\delta_{d}}\) to retrieve the session key \(SK_{\delta_{d}\zeta_{z}}\) and \(proof_{\delta_{d}}\).