# A Survey of Public Key Infrastructure-Based Security for Mobile Communication Systems
## 3 A Survey of the Literature
### Review of PKI-Based Security for 3 GPP Systems
[40] proposed a scheme called EPS mutual authentication and Crypt-analyzing (SPAKA), which is a self-certified based protocol, and it solves the positive capturing of the IMSI during user identification and key agreement protocols. The authors use the PKI to encrypt the transmitted AKA messages, and hence it offers a high security level, even though the fake MME is still a problem. [PERSON] et al. [41] proposed a new scheme for group based communication authentication called a Secure and Efficient group Authentication and key Agreement protocol for LTE networks (SE-AKA) using the ECDH to accomplish the key forward/backward secrecy and also adapt an asymmetric cryptosystem to keep user privacy. For group authentication, SE-AKA uses a group temporary key (GTK), which employs a well-known keys generation algorithm called Diffie-Hellman, and also provides a strong security level when subscribers need to meet the limitations of the authenticated group before network authentication. However, the problem of this scheme is the consumption of the MME when the ECDH consumes time to generate and exchange the public keys between group members. Meanwhile, the main role of the MME is to work as an access between the HSS and the UEs. In addition, the proposed group is considered as an uncontrolled area in the network and is used to break the security of the network since the authentication approvals are invoked to the group authority instead of the HSS. In addition, the users in group-based communication face new challenges in authentication when they move such as long delay and high computational overhead may take place during handover process. [PERSON] et al. [42] proposed a privacy preserving handover authentication scheme for EAP based on wireless networks. The authors used the proxy signature scheme to achieve authentication between the MN and the access point (AP) without including the third party. The full security analysis shows that the proposed scheme can accomplish privacy preserving and forward/backward security. The proposed approach is claimed to be more efficient in terms of computation and communication overheads. This work consists of two phases: delegation initialization phase and handover authentication phase. Meanwhile, the proposed scheme can only be deployed in the mobile user side with 2.128 ms, hence has relatively low computational cost compared with the works of [PERSON] et al. [43] and [PERSON] et al. [44]. [PERSON] et al. [43] proposed a handover authentication scheme which uses the ID-based encryption technology to protect the communications in the handover authentication process. However, firstly it needs the private key generator (PKG) to issue the private keys of MNs and APs, which results in the key escrow problem. Secondly, although the PKG updates private keys for MNs and APs every hour, it is possible for adversaries to compromise a private key before the expiration time. As a result, the scheme fails to provide the perfect forward/backward security. Meanwhile, the update of private key every hour cannot perfectly solve the illegal usage of the private key which is revoked before the expiration time. In addition, since it takes two bilinear pairing operations at least on the resource-constrained MNs, this scheme is not efficient in the handover process, as it requires a high computational cost. [PERSON] et al. [44] proposed a handover scheme using credentials based on chameleon hashing. Actually, the MN and the target AP can achieve mutual authentication and generate the pairwise transient key (PTK) via exchanging their short-term credentials issued by the AAA server. This scheme can achieve the robust key exchange and efficiency in terms of latency performance. Nevertheless, if adversaries compromise the unbroken short-term credentials at any time before expiration, they can calculate the PTKs at any time. Thus, it fails to achieve the perfect forward/backward security. Meanwhile, it does not consider the revocation of short-term credentials.