# Secure D2D Communication for 5G IoT Network Based on Lightweight Cryptography
## 3 Secure D2D Communication  
### Proposed D2D System Model  
In this section, we propose a secure D2D communication mechanism for a 5G IoT network based on lightweight AEAD ciphers. The proposed secure D2D communication model is shown in Figure 1. Objects participating in D2D communication consist of 5G network components including user equipment (UE), general node-B (gNB), access and mobility management function (AMF)/security anchor function (SEAF) and user data management (UDM). UE is a device that is a mobile entity in a 5G network, and UE is an actual device that communicates with other devices directly in our system. gNB is a base station responsible for connecting UE to mobile networks. In our system, gNBs share their public key with other gNBs in advance and use their private key to generate D2D tokens (\(D2 DTK_{gNB_{g}}\)) via ECDSA. Moreover, AMF is responsible for the management of a mobile entity. SEAF is a middle entity of authentication between UE and a 5G network and is co-located with AMF. UDM stores information about mobile entities in a 5G network. A 5G network provides the authentication framework using 5G-AKA to verify the identity of the UE. 5G-AKA is used to authenticate the UE's validity before generating a D2D token for use in communication in the proposed secure D2D communication. It is corresponded to step 0 in the proposed D2D system, and this process is performed only once for each UE.  
After generating a D2D token, the D2D communication process has three steps similar to a typical D2D communication system: Device discovery, link setup and secure data transmission. However, in each process, there are features for security such as anonymity, authentication and confidentiality/integrity. We will discuss the details of these features in Section 3.2. The brief descriptions of each process are as follows:  
* Device discovery is a process that searches for nearby nodes. In this step, nodes in a network broadcast a request message to discover other nodes. If a node receives a request message, it sends a response message to another node. The broadcast or response message in this process includes each UE's encrypted identity SUCI and the issued D2D token.
* Link setup is a process for making a peer-to-peer connection between two nodes. During this process, each node sends a verification request to its base station, gNB, with the SUCI and D2D token of the target UE being received in the device discovery phase. After verification, ECDH is used to exchange secret keys for secure data transfer.
* Secure data transmission is a process where data is transmitted. The main feature of this step is that the data is encrypted using a lightweight AEAD cipher before transmission. In the encryption process, the sender node uses its D2D token identity and context sequence, thereby the confidentiality and integrity of the data are ensured. Moreover, authentication is processed in every transmission.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Ref.**} & \multicolumn{3}{c}{**Security Function**} & \multicolumn{3}{c}{**Considered D2D Step**} \\ \cline{2-7}  & **Conf. / Int.** & **Auth.** & **Anon.** & **D.D.** & **L.S.** & **D.T.** \\ \hline [PERSON] et al. [11] & ✓ & ✓ & & ✓ & ✓ & ✓ \\ \hline [PERSON] et al. [12] & ✓ & ✓ & & ✓ & ✓ & ✓ \\ \hline [PERSON] et al. [13] & ✓ & ✓ & & ✓ & ✓ & ✓ \\ \hline [PERSON] et al. [14] & ✓ & ✓ & & ✓ & ✓ & ✓ \\ \hline [PERSON] et al. [15] & ✓ & ✓ & ✓ & ✓ & ✓ & \\ \hline [PERSON] & & & ✓ & ✓ & ✓ & ✓ & \\ \(\text{[PERSON] et al. [16]}\) & ✓ & ✓ & ✓ & ✓ & ✓ & \\ \hline [PERSON] et al. [17] & ✓ & ✓ & ✓ & ✓ & ✓ & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Taxonomy of strategies of existing secure device-to-device (D2D) communication.