## 4 Secure 5G Network Architecture for Mutual Authentication
ADMF can only be located on nodes where network providers, such as carriers, can trust, so they are installed and operated on the base stations. \begin{table}
\begin{tabular}{c c} \hline \hline
**Abbreviation** & **Explanation** \\ \hline UE & User Equipment \\ AMF & Access and mobility Management Function \\ SMF & Session Management Function \\ SAF & Secondary Authentication Function \\ ADMF & Authentication Data Management Function \\ UPF & User Plane Function \\ AUSF & Authentication Server Function \\ DN-AAA & Data Network Authentication, Authorization and Accounting \\ N4 & interface or bridge between control gland and user plane \\ SUPI & Subscription Permanent Identifier \\ NAI & Network Access Identifier \\ PDU & Protocol Data Unit \\ UDM & Unified Data Management \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Entities of Secondary Authentication in 5G’s Security Architecture. Figure 1: The proposed network architecture. Mutual authentication in 5G is divided into initial and re-authentication processes to avoid duplicate authentication processes. Initial authentication is the process by which a user first authenticates to a data network and is initiated by the user equipment. The re-authentication process is used to validate the connection and maintain and renew the authentication status for networks and users that have been secondary authenticated. The re-authentication process can occur either by the user or by DN-AAA. The procedure of the initial authentication and re-authentication process of the mutual authentication framework proposed in this study is illustrated in the following Figures 2 and 3. The following describes the procedures of the initial authentication process described in Figure 2.  
1. Base stations located in the Serving network area operate SAF and ADMF in the form of sliced network functions. Base stations that previously gained trust from service providers can operate SAF and ADMF internally, and ADMF runs on devices in the fog layer. Also, SAF can be operated in equipment such as servers, routers, and switches that exist at the edge layer and can  
Figure 2: The initial secondary authentication with Secondary Authentication Function (SAF) and Authentication Data Management Function (ADMF). simultaneously perform authentication from a service provider. They relay mutual authentication of adjacent peripheral IoT devices. SAFs and ADMFs generate a public key pair using the node's resources, which are used to obtain the authentication authority of the DN-AAA server. 2. ADMF establishes an N4 session with the UPF to communicate with the DN-AAA server. 3. ADMF requests authorization from the DN-AAA server via the N4 interface. At this time, ADMF encrypts its ID information signed with the private key of the base station and transmits it with the public key of the DN-AAA server. 4. The DN-AAA server decrypts the input ADMF request packet with its private key. The DN-AAA server verifies the signature of the decrypted data using the public key of a base station. In the case of a trusted base station, its ID value and authentication authority information to be used for secondary authentication are encrypted using the base station's public key and transmitted to ADMF. 5. Authorized by the DN-AAA server, ADMF informs the SAFs of the other nodes that are connected to it about its data network. 6. The UE sends a registration request to the AMF for primary authentication. 7. AMF performs a primary authentication between the network provider and the UE using a predefined protocol. 8. The UE establishes a NAS security context with the AMF. 9. The UE sends a NAS message, including the PDU Session Establishment Request message, to the AMF to perform mutual authentication with the DN-AAA server. 10. The AMF delivers the message of the received UE to the SMF via the N1 SM container. At this time, SUPI information of the UE is delivered together. 11. The SMF checks the subscription information of the UE from the UDM using the received SUPI.