# Secure D2D Communication for 5G IoT Network Based on Lightweight Cryptography
## 3 Secure D2D Communication
### Details of Communication Mechanism  
This section deals with the detailed process for the proposed D2D communication system. As described in the system model, the proposed D2D communication system has four steps in total. These four steps may be classified into one pre-processing step performed before D2D communication and the remaining three steps in which actual D2D communication is performed. The pre-processing step is the D2D token generation step (corresponding to step 0), and the steps in which D2D communication is performed are device discovery, link setup and secure data transmission (corresponding to steps 1-3, respectively). First, in the D2D token generation step, each UE sends a request to the gNB to generate a D2D token for later use in D2D communication. The gNB that receives the D2D token generation request first verifies the identity of the UE that sent the request. At this time, the identity of the UE verifies the SUCI, which is an encrypted identity that emerges for user privacy in a 5G network. Unlike IMSI, the identity of the UE used in existing 4G networks, the SUCI can provide anonymity for the UE as a result of encrypting the IMSI using a public key (PUK). The verification for SUCI is performed using 5G-AKA, an authentication framework for performing primary authentication of UE registration in  
Figure 1: Secure D2D communication system model for a 5G Internet of Things (IoT) network. 5G networks. The subject that performs the actual verification is AMF/SEAF, and the verification is performed by comparing the credentials obtained by decrypting SUCI with the user credentials stored in the UDM. When the SUCI verification is completed, the result is transmitted to the gNB, and accordingly the gNB generates a D2D token and transmits it to the requesting UE. The generation of the D2D token uses the digital signature value calculated by the ECDSA of the UE's SUCI using the gNB's private key (PRK). The issued D2D token may also give anonymity to the UE with a value generated through a cryptographic algorithm by using the identity of the UE like SUCI. The issued D2D token can be verified if the SUCI of the UE and the public key of the gNB are known (note that each gNB shares the public key we mentioned in the previous section). The D2D token generation procedure is shown in Figure 2.  
From now on, actual D2D communication performing steps will be described. The whole process of proposed D2D communication is shown in Figure 3. Step 1 is device discovery, which is a process of searching for a nearby device with which to perform D2D communication. Here, each UE desiring D2D communication broadcasts a message requesting to perform D2D communication, and UEs in a state capable of D2D communication transmit a response message to the received D2D request message. Here, the broadcast message or response message includes the D2D token issued in step 0 and its SUCI. If a response message to the broadcasted request message is received, the process proceeds to the next step. The second stage of D2D communication is the link setup to establish a communication session. In this step, prior to establishing a communication session, verification is performed on the D2D token exchanged through device discovery. The verification of the D2D token performed here is similar to the UE identity verification performed in the D2D token generation, but the authentication is performed in the gNB without connecting to the core network. The D2D token can be verified using the public key and SUCI of each gNB, which authenticates that the D2D token has been issued from the gNB by request by a pre-authenticated UE. When the verification of the D2D token is completed, the secret key exchange used in the encryption process of the data transmission step is performed according to the result. The exchanged secret key is a secret key derived from the secret keys of both UEs using ECDH. Figure 2: D2D token generation procedure.