# A Composable Multifactor Identity Authentication and Authorization Scheme for 5G Services

Authors: Yurong Luo; Hui Li; Ruhui Ma; Zhenyang Guo
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The fifth-generation (5G) mobile communication technology has already deployed commercially and become a global research focus. The new features of 5G include unlimited information exchange, a large variety of connections with independent energy, and diversified high transmission rate services. Collective synergy of services is expected to change the way of life and future generations and introduce new converged services to the ICT industry. Different application services have to meet differentiated security demands. From the perspective of security, in order to support the multiservice of 5G services, it is necessary to consider the new security mechanism driven by the service. Based on 5G massive data stream, the 5G system can provide customized real-world services for potential users and reduce the user experience gap in different scenarios. However, 3GPP Extensible Authentication Protocol (EAP), which is the present entity authentication mechanism for the 5G service layer, is only an individual authentication architecture and unable to fulfill the flexible security objectives of differentiated services. In this paper, we present a new hierarchical identity management framework as well as an adaptable and composable three-factor authentication and session key agreement protocol for different applications in 5G multiservice systems. Finally, we propose an authorization process by combining with the proposed three-factor authentication mechanism and Service-Based Architecture (SBA) proposed by the 3GPP committee. The proposed mechanism can concurrently provide diverse identity authentication schemes corresponding to four different security levels by easily splitting or assembling three-factor authentication protocol blocks. The proposed scheme can be simultaneously applied to a variety of applications to improve the efficiency and quality of service and reduce the complexity of the whole 5G multiservice system, instead of designing or adopting several different authentication protocols. The performance evaluation results indicate that the proposed scheme can guarantee the multiple security of the system with ideal efficiency.


---

## Body

## 1. Introduction

At present, the global 5th generation mobile communication technology (5G) commercial development has begun to take shape and been recognized as main supporting technologies of mobile networks. It has become the focus of global mobile communication research and technology competition. Compared with the existing 4G network, 5G network aims to provide high quality and reliable services such as higher data rate, ultralower latency, massive connectivity, high energy efficiency, and accurate quality of experience (QoE) [1]. The 5G network can realize more kinds of dynamic customization and scalable network services by adopting software-defined network (SDN) and network function virtualization (NFV) technologies. Due to its powerful bandwidth and service capability, a significant number of new applications are introduced into the 5G network platform, such as augmented reality, multimedia video business, mobile industrial internet, autonomous driving, and mobile electronic health services.There are new security requirements and challenges in 5G, so it is not enough to provide the traditional security mechanism. 5G network will support massive smart devices and various forms of terminals; thus, 5G network is driven to introduce new identity management methods. The generation, distribution, and other lifecycle management of users’ identification involved in the identity management method will change [2].The growing demand for diversified applications has brought about widely different services, as well as security issues such as service authentication. Moreover, due to the openness of services, a variety of different mobile terminals need to be connected to the 5G network, which also raises corresponding security trust issues and attacks [3, 4]. In diverse application scenarios, different kinds of terminals have different security demands. For example, large-scale machine-type communication (MTC) devices need lightweight security mechanisms to adapt to low energy storage; meanwhile, high-speed mobile services need more efficient and secure authentication schemes, and video services need to meet the security requirements of low latency and high reliability. If the same security scheme is used for differentiated applications, it may seriously affect the user’s service experience. The 5G intelligent computing technology, which is user centric, reconfigures the appropriate security scheme after collecting user and scene data, so as to provide better services. It is significant to provide hierarchical security protection for different services in order to better provide security services for the vertical industry. In the traditional networks, multiservice system adopts different authentication schemes for different kinds of terminals, which increases the complexity of the system and reduces the quality of user experience. According to the current 3GPP standard [5], 5G employs Extensible Authentication Protocol (EAP) to realize the entity identity authentication for third-party services and applications, yet EAP is an identity authentication architecture that can merely adopt unitary authentication schemes such as symmetric key cryptography or digital certificate system alone. Diverse services and applications in EAP adopt a variety of independent authentication mechanisms, which cannot support differentiated and adventurous 5G services. Consequently, a flexible and secure composable authentication and service authorization framework is urgently needed to provide comprehensive and fine-grained entity trusted security support for the vertical industry in the 5G network.In this paper, we design a new flexible and composable multifactor authentication and session key agreement protocol under a diversified identity management architecture in 5G multiservice systems and finally give an authorization process based on the 5G unified authentication and service authorization framework. In our scheme, a new diversified identity, which includes the security levels of services and applications, is assigned by the 5G Network Repository Function (NRF) and deployed to 5G user equipment (UE) in the initial stages. Subsequently, the biometrics and password are employed in conjunction with the smart card to construct the multifactor service authentication and session key agreement protocol, which can be separated or combined according to 4 different security levels or requirements. Finally, the improved service authorization process based on the 5G service architecture is executed to provide required services for users. Without the separate implementation of different identity authentication protocols, this scheme can greatly improve the quality of service of users and reduce the complexity of the whole 5G multiservice system.The main contributions of the paper are threefold. (1) A hierarchical identification data structure for the 5G application layer is designed. (2) A composable and potent multifactor service authentication and session key agreement protocol is proposed, which provides 4 grades of security levels of authentication. Furthermore, the proposed protocol is not the simple combination of three authentication factors but flexibly integrates them to ensure the security and the feasibility of the 5G service system. (3) We give an authorization process based on the proposed authentication mechanism and SBA architecture. (4) The BAN logic and the formal verification tool, Scyther tool, have been employed to prove that the proposed scheme can achieve multiple security functions and resist attacks.Compared with the conference version [6], which barely proposed a conceptual classified mutual authentication scheme without high efficiency, formal security analysis, or detailed performance evaluation in the 5G multiservice system, we optimize the multifactor authentication scheme and provide key agreement and service authorization protocol in new design. Moreover, the formal analysis including BAN logic and CK model security analysis are employed to verify the scheme security. Then, we evaluate the computational cost, communication cost, and storage cost of our proposed scheme by comparing it with the typical EAP protocol based on the NIST standard and show the protocol performance under unknown attacks.The rest of the paper is organized as follows. In Section2, we investigate the related work. Section 3 introduces the biometric authentication fuzzy extractor function. Section 4 presents the security and network model. Section 5 details the processes of the proposed scheme. The security and performance analysis are revealed in Section 6 and Section 7, respectively. Finally, Section 8 summarizes the paper.


## 2. Related Work

The research works on the network entity authentication and process for services and applications in 4G/5G networks [7, 8] were very lacking. Shin and Kwon [9] proposed an anonymous three-factor authentication and access control scheme for real-time applications in WSNs. However, the scheme is liable to user collusion and desynchronization attacks. Ni et al. [8] designed a service-oriented anonymous authentication mechanism for enabling 5G IoT. In the scheme, an anonymous authenticated key agreement mechanism is proposed to ensure the secure connection and authentication for IoT devices and will not disclose user privacy. However, both of the schemes in [7, 8] employ the complex public key cryptosystem to design the related protocol and only achieve the single authentication method, which is not fit for 5G multiservice systems. Due to the introduction of the IoT service, users can also interactively control other devices in the 5G network, such as controlling the startup of the home appliance in the smart home scenario, so stricter authentication methods, such as biometric authentication, are required to ensure that the identity is true. Besides, there are a large number of authentication schemes based on the same authentication factors proposed in [10–14]. These schemes can achieve efficient and high-strength entity authentication, but cannot complete dynamic multifactor authentication which can adjust the security strength in the 5G multiservice network. Furthermore, some authentication mechanisms for the multiserver environment have been proposed in [15, 16]. Huang et al. [15] proposed a robust multifactor authentication protocol for fragile communications which can be separated to finish dynamical authentication. However, this scheme can only discuss two stand-alone schemes but cannot be composable or achieve the mutual authentication. Liao and Wang [16] proposed a dynamic ID-based remote user authentication scheme based on the smart card and password for the multiserver architecture. This scheme can achieve the mutual authentication and key agreement between the user and server by the use of hash function. However, Li et al. [17] pointed out that the scheme [16] is vulnerable to masquerade attacks.


## 3. Preliminary

Biometrics with certain probability distribution characteristics such as facial recognition are not completely random and limited. In order to protect the user’s biometric data and privacy, biometrics cannot be stored on the remote server and must be fuzzed. Fuzzy extractor can compact a pseudo-random eigenvalue string from a low-entropy string and is generally used to extract and recover secret features from biometrics. Based on the definition in [18], a fuzzy extractor can be described as a quintuple of ℳ,m,ℓ,t,ϵ including the following functions.


### 3.1. Metric Space

It is a setℳ with a distance function dis: ℳ×ℳ⟶ℝ+=0,∞. The function disω,ω′ is a measure of the difference between two variables, for example, Hamming distance.


### 3.2. Min Entropy

H∞A=−logmaxaPrA=a is the minimum-case entropy of a random variable A.


### 3.3. Statistic Distance

The statistical distance between two probability distributionsA and B is defined as SDA,B=1/2∑vPrA=v−PrB=v.


### 3.4. Fuzzy Extractor

A fuzzy extractor is represented as a quintuple ofℳ,m,ℓ,t,ε including a pair of procedures, “generate” (Gen) and “reproduce” (Rep).(1)
The probabilistic generation procedureGen:ℳ⟶R0,1ℓ×0,1∗ is(1)Genω=R,N.Any inputω∈ℳ is a low-entropy string. In the output pair, R is called as a characteristic string, and N is an auxiliary string. For any distribution W on ℳ of min-entropy m, the string R is nearly random even for those who observe N: if R,N←Genω; then, we have SD R,N,Uℓ,N≤ϵ, where Uℓ represents the uniform distribution on l−bit binary strings.(2)
The deterministic reproduction procedureRep:ℳ×0,1∗⟶D0,1ℓ is(2)Repω′,N=Rif disω,ω′≤t.For allω,ω′∈ℳ, if R,N←Genω and disω,ω′⩽t, the fuzzy extractor can recover the pseudo-random string R from P by computing Repω′,N.Thus, fuzzy extractors are capable of extracting pseudo-random stringR from a low-entropy string ω such as biometrics and then reproduce R from any string ω′ extremely similar to ω with the unclassified auxiliary string N.


## 3.1. Metric Space

It is a setℳ with a distance function dis: ℳ×ℳ⟶ℝ+=0,∞. The function disω,ω′ is a measure of the difference between two variables, for example, Hamming distance.


## 3.2. Min Entropy

H∞A=−logmaxaPrA=a is the minimum-case entropy of a random variable A.


## 3.3. Statistic Distance

The statistical distance between two probability distributionsA and B is defined as SDA,B=1/2∑vPrA=v−PrB=v.


## 3.4. Fuzzy Extractor

A fuzzy extractor is represented as a quintuple ofℳ,m,ℓ,t,ε including a pair of procedures, “generate” (Gen) and “reproduce” (Rep).(1)
The probabilistic generation procedureGen:ℳ⟶R0,1ℓ×0,1∗ is(1)Genω=R,N.Any inputω∈ℳ is a low-entropy string. In the output pair, R is called as a characteristic string, and N is an auxiliary string. For any distribution W on ℳ of min-entropy m, the string R is nearly random even for those who observe N: if R,N←Genω; then, we have SD R,N,Uℓ,N≤ϵ, where Uℓ represents the uniform distribution on l−bit binary strings.(2)
The deterministic reproduction procedureRep:ℳ×0,1∗⟶D0,1ℓ is(2)Repω′,N=Rif disω,ω′≤t.For allω,ω′∈ℳ, if R,N←Genω and disω,ω′⩽t, the fuzzy extractor can recover the pseudo-random string R from P by computing Repω′,N.Thus, fuzzy extractors are capable of extracting pseudo-random stringR from a low-entropy string ω such as biometrics and then reproduce R from any string ω′ extremely similar to ω with the unclassified auxiliary string N.


## 4. System and Security Model

### 4.1. Network Model

5G network needs to establish different trust models according to the characteristics of different services and provide flexible management modes according to the demands of industry users. Operators already have relatively complete security capabilities, such as authentication, ID management, and key management. In order to reduce operating and maintenance costs, vertical industries can entrust service authentication to operators. Operators can perform network and service authentication in a unified manner to achieve direct network access to multiple services. The authentication capability of the operator not only greatly facilitates the user but also provides a vertical industry as a value-added service to help it rapidly deploy the service.Based on the principle of the service center, the 3GPP committee has designed a new 5G service secure architecture which describes the authentication and authorization of 5G services and applications: Service-Based Architecture (SBA) [19], as shown in Figure 1. There are 3 roles of the 5G SBA authentication and authorization framework including user equipment (UE), network repository function (NRF), and network function (NF) service producer. PLMN and gNB in Figure 1 are the public land mobile network and 5G base station, respectively.Figure 1
Network architecture.The NF service producers are various 5G vertical service providers. The entity user that owns a UE obtains NF service producers’ 5G services through NRF. Users can subscribe to a variety of services provided by service providers according to users’ needs. NRF is located in the 5G core network, which is responsible for the discovery and selection of network functions, and provides appropriate peer-to-peer services for UE. As a 5G service configuration management server, NRF is able to support the mutual authentication and service authorization between UEs and NF service producers. EAP [5] is the identity authentication architecture proposed by the 3GPP committee to realize the user application layer authentication, which is compatible with a series of authentication protocols such as EAP-AKA [20] and EAP-TLS [21] in diverse application scenarios.


### 4.2. Security Model

The authentication architecture of the proposed protocol includes 3 participants: the 5G entity userC, the 5G UE owned by a 5G entity C, and the service configuration management server NRF who supports authentication. In a basic CK-adversary model [22], the air interface channel between a UE and the NRF is public and unsecure, where a probabilistic polynomial-time (PPT) attacker A can monitor, tamper, and forge any wireless transmission of messages between 5G UEs and the NRF. Other than the basic adversary capabilities, A may collect the secret information stored in the UE’s memory and NRF’s database via explicit attacks. The security attacks are divided into three categories according to the type of information mastered by the adversary. We assume that the secure connection between the NRF and service producers has been established and is not within the scope of our scheme. The authentication framework and system secure model is as shown in Figure 2.Figure 2
Secure model.The design objective of this scheme is to achieve the composable and secure multifactor authentication for differentiated services and applications in the 5G network. The goal includes the following secure functions and capabilities:(i)
Multifactor authentication: to meet different security demands of various services, the mechanism should be able to easily combine multiple authentication factors to increase the security strength of the authentication protocol. Considering the convenience of 5G users, this scheme is mainly made up of password, smart card, and biometric authentication technology to accomplish multifactor authentication.(ii)
Composable authentication: considering the complexity of the system, the scheme should be an authentication protocol which can be divided into several blocks and flexibly combined to achieve different security strengths and goals. Without multiple authentication protocols, only a common authentication architecture does not affect the integrity of the protocol.(iii)
Efficient differentiated-service authentication: aimed at the differences in services over the 5G network, the proposed scheme can accommodate to multiservice authentication by splitting and assembling the authentication procedures. The flexible and composable authentication mechanism can largely improve the efficiency and quality of service. Aiming at the difference of applications in the 5G network, the scheme can adapt to multi-service authentication by separating and composing the authentication process. The flexible and fine-grained authentication mechanism could greatly increase the efficiency and quality of 5G service.(iv)
Session key agreement: to ensure the security of the subsequent communication process, the proposed scheme should negotiate a secret session key between the UE and the NRF to encrypt and protect the integrity of the communication information.(v)
Service authorization: after the successful authentication between the UE and NRF, users access resources and obtain services by means of legitimate NRF authorization. Depending on the authorized credential, the service providers deal with the service request and supply services to UE securely.(vi)
Withstanding existing protocol attacks: the proposed scheme should withstand the existing protocol attacks such as replay attack, MitM attack, and forgery attack.


## 4.1. Network Model

5G network needs to establish different trust models according to the characteristics of different services and provide flexible management modes according to the demands of industry users. Operators already have relatively complete security capabilities, such as authentication, ID management, and key management. In order to reduce operating and maintenance costs, vertical industries can entrust service authentication to operators. Operators can perform network and service authentication in a unified manner to achieve direct network access to multiple services. The authentication capability of the operator not only greatly facilitates the user but also provides a vertical industry as a value-added service to help it rapidly deploy the service.Based on the principle of the service center, the 3GPP committee has designed a new 5G service secure architecture which describes the authentication and authorization of 5G services and applications: Service-Based Architecture (SBA) [19], as shown in Figure 1. There are 3 roles of the 5G SBA authentication and authorization framework including user equipment (UE), network repository function (NRF), and network function (NF) service producer. PLMN and gNB in Figure 1 are the public land mobile network and 5G base station, respectively.Figure 1
Network architecture.The NF service producers are various 5G vertical service providers. The entity user that owns a UE obtains NF service producers’ 5G services through NRF. Users can subscribe to a variety of services provided by service providers according to users’ needs. NRF is located in the 5G core network, which is responsible for the discovery and selection of network functions, and provides appropriate peer-to-peer services for UE. As a 5G service configuration management server, NRF is able to support the mutual authentication and service authorization between UEs and NF service producers. EAP [5] is the identity authentication architecture proposed by the 3GPP committee to realize the user application layer authentication, which is compatible with a series of authentication protocols such as EAP-AKA [20] and EAP-TLS [21] in diverse application scenarios.


## 4.2. Security Model

The authentication architecture of the proposed protocol includes 3 participants: the 5G entity userC, the 5G UE owned by a 5G entity C, and the service configuration management server NRF who supports authentication. In a basic CK-adversary model [22], the air interface channel between a UE and the NRF is public and unsecure, where a probabilistic polynomial-time (PPT) attacker A can monitor, tamper, and forge any wireless transmission of messages between 5G UEs and the NRF. Other than the basic adversary capabilities, A may collect the secret information stored in the UE’s memory and NRF’s database via explicit attacks. The security attacks are divided into three categories according to the type of information mastered by the adversary. We assume that the secure connection between the NRF and service producers has been established and is not within the scope of our scheme. The authentication framework and system secure model is as shown in Figure 2.Figure 2
Secure model.The design objective of this scheme is to achieve the composable and secure multifactor authentication for differentiated services and applications in the 5G network. The goal includes the following secure functions and capabilities:(i)
Multifactor authentication: to meet different security demands of various services, the mechanism should be able to easily combine multiple authentication factors to increase the security strength of the authentication protocol. Considering the convenience of 5G users, this scheme is mainly made up of password, smart card, and biometric authentication technology to accomplish multifactor authentication.(ii)
Composable authentication: considering the complexity of the system, the scheme should be an authentication protocol which can be divided into several blocks and flexibly combined to achieve different security strengths and goals. Without multiple authentication protocols, only a common authentication architecture does not affect the integrity of the protocol.(iii)
Efficient differentiated-service authentication: aimed at the differences in services over the 5G network, the proposed scheme can accommodate to multiservice authentication by splitting and assembling the authentication procedures. The flexible and composable authentication mechanism can largely improve the efficiency and quality of service. Aiming at the difference of applications in the 5G network, the scheme can adapt to multi-service authentication by separating and composing the authentication process. The flexible and fine-grained authentication mechanism could greatly increase the efficiency and quality of 5G service.(iv)
Session key agreement: to ensure the security of the subsequent communication process, the proposed scheme should negotiate a secret session key between the UE and the NRF to encrypt and protect the integrity of the communication information.(v)
Service authorization: after the successful authentication between the UE and NRF, users access resources and obtain services by means of legitimate NRF authorization. Depending on the authorized credential, the service providers deal with the service request and supply services to UE securely.(vi)
Withstanding existing protocol attacks: the proposed scheme should withstand the existing protocol attacks such as replay attack, MitM attack, and forgery attack.


## 5. The Proposed Authentication Scheme

This section introduces a new 5G hierarchical identity management mechanism, a flexible and composable three-factor authentication and session key agreement protocol, and a service authorization scheme for differentiated services in the 5G application system.


### 5.1. Security Assumptions

Without loss of generality, the following security assumptions are proposed for the authentication model:(1)
In this scheme, some measures will be taken by the authentication serverNRF to prevent the dictionary attack and guessing the password of a valid user.(2)
When the 5G user uses a UE, all security-related operations are implemented in the trusted execution environment [23]. Thus, the communication between the smart card function calculation such as the fuzzy extractor is secure and cannot be monitored.(3)
In the registration phase, the UE can distinguish the right NRF, and the secret information is transmitted through a trusted channel.


### 5.2. 5G Diversified Identity Management Mechanism

In order to adapt to differentiated applications in the 5G network, a new 5G diversified identity management framework is proposed. As shown in Figure3, the 5G identity model includes three data blocks: physical identification, functional identification, and security level.(i)
Physical identification: the physical identification generated by the equipment manufacturer or operators satisfies the characteristic of global or network uniqueness. It represents the unique identification of a device, such as the UE’s international device identification (IMEI) or the user’s ID number.(ii)
Function identification: function identification is generated by telecom operators and application service providers, which points to specific services or applications that users can access. Since a device can have multiple different service resources, a physical ID can be related with several functional IDs. Function codes indicate the service authority of a user and can be changed and adjusted quickly and flexibly.(iii)
Security level: each function identification can be nominated with only one security level which shows the security requirements of functional services. According to the security requirements of service providers, we divide services or applications into four security levels:0,1,2,and3 followed by low to high, which will lead to single-factor, two-factor, and three-factor authentication protocol, respectively. Among them, 1 and 2 represent the same security strength because both of them can trigger two-factor authentication, but the authentication factors are different. For different security levels, the differentiated authentication subprotocol between UE and application server will be adopted. Ordinarily, browsing public web pages belongs to security level 0, while high-risk e-health services belong to security level 3. Service providers should demarcate security levels for services according to their defined security rules or authentication requirements.Figure 3
5G diversified identity model.


### 5.3. Flexible and Composable Three-Factor Authentication Mechanism for Different Applications

This section proposes an entity authentication mechanism in the 5G multiservice system. In this scheme, the service authentication protocol can be implemented in the form of a subprotocol according to several security levels. The proposed scheme consists of the following five phases: initialization, registration, authentication, session key agreement, and biometrics and password updating, which are described in detail as follows. The notations used in our proposed scheme are shown in Table1.Table 1
Notations.
NotationDescriptionPUB.KGenkPublic key generation algorithmPKNRF,SKNRFPublic-private key pair of the authentication serverNRFSKE.KGenkSymmetric key generation algorithmSKE.EncSKSymmetric encryption withSKSKE.DecSKSymmetric decryption withSKSignSKSign withSKHashCryptographic hash functionMACMessage authentication code functionIDCIdentification ofCPWPassword chosen byCBioBiometric dataSCSmart cardDBioBiometric dataDCPassword dataRNRandom numberTiCurrent timestampKsSession key ofNRF and CKijSession key betweeniandj


#### 5.3.1. Initialization

Based on a system security parameterk, the authentication server NRF generates a symmetric key for authentication and a public-private key pair for authorization. And the NRF generates an elliptic curve E shared between the NRF and the user C’s smart card SC for session key agreement.(1)
NRF implements public key generation algorithm PUB.KGenk to obtain a pair PKNRF,SKNRF(2)
NRF runs symmetric key generation algorithm SKE.KGenk to obtain SKC(3)
NRF calculates the base point P on the elliptic curve E, and n is the order of PThe parameterPKNRF,E,P is public, and the secret parameter SKNRFSKC is kept secret by the NRF.


#### 5.3.2. Registration

The registration process consists of the following steps:(1)
Biometrics registration:(i)
NRF generates IDC with the security level designed in Section 5.2 and notifies it to user C.(ii)
UserC collects the biometric data in his device UE, and a pair R,N is generated by C’s biometric template Bio. Algorithm Gen is defined as the fuzzy extractor generation as shown in Section 3. GenBio⟶R,N.(iii)
C extracts MAC key KB=HashR and sends KB,N to NRF.(iv)
After receivingKB,N, NRF chooses a random number RN1 and encrypts KB with SKC by using the symmetric key encryption algorithm SKE.Enc.DK=SKE.EncSKCIDCKBHashIDCKBRN1, where HashIDCKBRN1 is used for integrity detection. And DK¯=SKE.EncSKCKBRN1,IDC.(v)
NRF sets DBio=N,DK,Hash,Rep and DBio¯=N,DK¯,Hash,Rep, where Rep is the reproduction algorithm in the fuzzy extractor.(2)
Password registration:(i)
NRF chooses two new random numbers RN2andRN3 and calculates DE and D¯ as follows:(3)DE=HashIDCSKC⊕RN2⊕RN3,D¯=HashIDCSKC⊕RN3.(ii)
NRF sets DC=IDC,RN2,DE,D¯,Hash.(3)
Smart card registration:(i)
A smart card is sent to userC containing DC, DBio, elliptic curve E, and its base point P securely. Here, according to the 3GPP 5G standard [19], the smart card such as USIM has been deployed in a trust execution environment on each 5G device. Thus, the 5G device only requires to keep DC and DBio in secret in the smart card which are sent by NRF.(ii)
UserC encrypts DBio with KB and stores it in .(iii)
Upon receiving, userC inputs his random password PW. Then, the device generates a random number RN4 and computes D=D¯⊕HashPW⊕RN4 to replace the local old D¯.Finally, userC keeps and password securely. NRF also stores DBio¯,DC,E,P in its database and erases RN3 and DBio.


#### 5.3.3. Authentication

Firstly, userC inserts the smart card and tries to request service. User C sends the service request message including the predefined identity IDC with the service security level. Upon the receipt of the message, the authentication server NRF verifies if the identity IDC is valid and checks the security level of IDC to ensure user’s access rights. Here, PW′ and Bio′ are represented as the collected password and biometrics during each authentication process, respectively. According to different security levels, different mutual authentication processes are executed in detail as shown in Algorithm 1.Algorithm 1: Composable three-factor authentication.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: authentication result: 0 for failure; 1 for success.(1)
: 5G userC sends a service request message including IDC and security level of the access service read from the smart card.(2)
:NRF checks the highest security level SR in the service request message. IfSR=0, thenOutput 1 andTerminate the authentication process.ElseifSR=1, then go to Step 3.ElseifSR=2, then go to Step 8.ElseifSR=3, then go to Step 3.NRF sends an attach response SR,Attach to notify C.(3)
5G userC chooses a new random number RN5 and sends IDC,T1,RN5 to NRF.(4)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T1 is invalid, Output 0. Else, go ahead.(ii)
SearchDK¯ by IDC in the database and decrypt DK¯ with SKC to obtain KB.(iii)
Generate a new random numberRN6 and compute DK=SKE.EncSKCIDCKBHashIDCKBRN1 and MK=HashHashDK⊕RN5T2.(iv)
SendT2RN6,MK to user C.(5)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T2 is invalid, Output 0. Else, go ahead.(ii)
ComputeR′=RepBio′,N and KB′=HashR′.(iii)
DecryptSKE.EncKBDBio with KB′ to obtain DK.(iv)
ComputeMK=?HashHashDK⊕RN5T2. If the equation is established, then go ahead. Else, Output 0.(v)
ComputeTag=MACKB′RN6⊕HashDKT3 and send Tag,T3 to NRF.(6)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T3 is invalid, Output 0. Else, go ahead.(ii)
VerifyTag=?MACKBRN6⊕HsahDKT3. If it is, then go ahead. Else, Output 0.(7)
IfSR=1, then output 1. Else, ifSR=3, go ahead.(8)
C computes M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T4 and sends IDC,RN2,DE,M1,T3 to NRF.(9)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T4 is invalid, Output 0. Else, go ahead.(ii)
ComputeRN3=DE⊕HashIDCSKC⊕RN2.(iii)
VerifyHashRN3⊕T4=?M1. If the equation is established, go ahead. Else, Output 0.(iv)
Generate new numbersRN2new,RN3new and calculate DEnew=HashIDCSKC⊕RN2new and D¯new=HashD¯⊕RN2new⊕HashIDCSKC⊕RN3new.(v)
CalculateM2=HashHashD¯⊕DEnew⊕T5 and M3=HashHashD¯⊕D¯new⊕T5.(vi)
SendRN2new,DEnew,D¯new,M2,M3,T5 to C.(10)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T5 is invalid, Output 0. Else, go ahead.(ii)
CalculateHashHashD⊕HashPW′⊕RN4⊕DEnew⊕T5=?M2 and(iii)
HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T5=?M3. If the two equations are established, then go ahead. Else, Output 0.GenerateRN4new and Dnew=HashD⊕HashPW′⊕RN4⊕RN2new⊕D¯new⊕HashPW′⊕RN4new.(iv)
ReplaceDE,D,RN2,RN4 with DEnew,Dnew,RN2new,RN4new. Output 1.According to the implementation method of the authentication protocol, the authentication protocol is able to divide into four protocol blocks: no authentication (attach request phase), biometrics and smart card-based authentication (biometrics authentication phase), password and smart card-based authentication (password authentication phase), and password and biometrics and smart card-based authentication which is the entire protocol as shown in Figure4. When the service security level SR=0, for example, the user wants to skim some public information without any privacy or sensitive data; he only needs to read his identity from the smart card and runs in two steps without any authentication. From a user experience perspective, the biometric authentication is more convenient than the password authentication for 5G users. Thus, the biometrics authentication phase and the password authentication phase are designed for the service security level SR=1 and SR=2, respectively. The user must implement all of the protocol blocks for the highest security level SR=3. The proposed authentication protocol can be adopted dynamically by composing some protocol blocks and steps to balance the efficiency and security.Figure 4
Authentication process.


#### 5.3.4. Session Key Agreement

In the subsequent authorization of NF service access processes, userC and NRF need to negotiate a session key to securely communicate with each other. The session key agreement process is executed after a successful authentication and based on the elliptic curve Diffie–Hellman (ECDH) protocol. The session key agreement is described in Algorithm 2.Algorithm 2: Session key agreement.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: agreement result: Ks.(1)
NRF executes the following commands.(i)
Check the highest security levelSR in the authentication process. IfSR=0, then Output 1, and Terminate the process. Else, go ahead.(ii)
Choose random numbera∈Zn∗.(iii)
Compute the secret auxiliary messageSMNRFIfSR=1, then setSMNRF=HashIDCKBRN6.IfSR=2, then setSMNRF=HashHashIDCSKC⊕RN3new.IfSR=3, then setSMNRF=HashIDCKBRN6⊕HashHashIDCSKC⊕RN3new.(iv)
CalculateKNRF=SMNRF⊕aP.(v)
SendKNRF to C.(2)
Upon the receipt of the message,C works as follows.(i)
Choose random numberb∈Zn∗.(ii)
Compute the secret auxiliary messageSMC.IfSR=1, then C setsSMC=HashIDCKBRN6.IfSR=2, then C setsSMC=HashDnew⊕HashPW⊕RN4new.IfSR=3, then C setsSMC=HashIDCKBRN6⊕HashDnew⊕HashPW⊕RN4new.(iii)
CalculateKC=SMC⊕bP.(iv)
CalculateKs=bKNRF⊕SMC.(v)
SendKC,SKE.EncKsaP to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
CalculateKs=aKC⊕SMNRF.(ii)
DecryptSKE.EncKsaP with Ks. And if the decryption is aP, NRF confirms success.(iii)
SendSKE.EncKsbP to C.(4)
C decrypts SKE.EncKsbP with Ks. And if the decryption is bP, C confirms success, and the process terminates.In this phase, whenSR=2or3, NRF and user C can derive bP and aP, respectively, since(4)Dnew⊕HashPW⊕RN4new=HashIDCSKC⊕RN3new.


#### 5.3.5. Biometrics and Password Updating

To avoid the attacker who obtains only one of the valid features (biometrics or password) distorting the information maliciously, we suppose that the biometrics and password update phase are implemented after the successful and complete authentication (SR=3). Users select the following phases to update the biometrics and password.(1) Biometrics Update Phase. The user who wants to update the biometrics needs to perform a complete authentication protocol and executes some steps similar to biometrics registration. The biometrics update phase is described in Algorithm 3.Algorithm 3: Biometrics update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If the authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Input new biometric data as same as those in the biometrics registration phase. The trusted device generates a new pairRnew,Nnew.(ii)
Calculate newKBnew=HashRnew.(iii)
SendSKE.EncKsKBnew,Nnew, biometrics update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
Choose a new numberRN1new and encrypt KBnew with SKC by using SKE.Enc.(ii)
CalculateDKnew=SKE.EncSKCIDCKBnewHashIDCKBnewRN1new and DK¯new=SKE.EncSKCKBnewRN1,IDC.(iii)
SetDBionew=Nnew,DKnew,Hash,Rep and DBio¯new=N,DK¯new,Hash,Rep(iv)
StoreDBio¯new in its database.(v)
SendSKE.EncKsDKnew to C.(4)
After receiving the message,C encrypts DBionew with KBnew and stores in the smart card. And Output 1.(2) Password Update Phase. To improve system security, the users are advised to change the password on a frequent basis. Likewise, the password updating phase begins with an authentication process but is slightly different from the password registration. The password update phase is described in Algorithm 4.Algorithm 4: Password update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Choose a new passwordPWnew, and the smart card generates new RN4new to compute MPU=HashD⊕HashPW⊕RN4⊕RN2⊕HashPWnew⊕RN4new.(ii)
SendSKE.EncKsMPU, password update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
DeriveHashPWnew⊕RN4new from MPU⊕HashHashIDCSKC⊕RN3⊕RN2.(ii)
ChooseRN2new as well as RN3new, and calculate D¯new=HashHashIDCSKC⊕RN3⊕RN2new⊕HashPWnew⊕RN4new⊕HashIDCSKC⊕RN3new.(iii)
CalculateDEnew=HashIDCSKC⊕RN2new⊕RN3new.(iv)
SendSKE.EncKsRN2new,DEnew,D¯new to C.(4)
Upon the receipt of the message,C computes Dnew=HashD⊕HashPW⊕RN4⊕RN2new⊕D¯new.(5)
C and NRF store Dnew, DEnew, and D¯new to replace the old information. And Output 1.


### 5.4. Authorization Scheme of NF Service Access

According to the 3GPP 5G service authentication and authorization architecture, Service-Based Architecture (SBA), we design a new authorization scheme for the 5G multiservice system, which is described in Algorithm5.Algorithm 5: Service authorization.
Require: the user identity IDC; the session key Ks; the smart card .Ensure: authorization result: 0 for failure; 1for success.(1)
If user C holds a valid token for his desirable service, then go to Step 5. Otherwise, go ahead.(2)
UserC and NRF execute the proposed authentication mechanism as mentioned above. If the authentication failed or key agreement failed, Output 0. Otherwise, go ahead.(3)
UserC sends the service authorization request MRS=IDC,Service Request.(4)
Upon the receipt of the message,NRF works as follows.(i)
ConfirmSR of the service authorization request is less than SR in the authentication process. IfSR of the service authorization request is bigger than SR in the authentication process, then go to Step 2. Else, go ahead.(ii)
GenerateTokenC=SignSKNRFIDC,NFh,KCh,SR,T5,lifetime.(iii)
SendSKE.EncKsTokenC,NFh,KCh to user C (the message is not encrypted when SR=0). Suppose that NRF has told NFh the session key KCh between NFh and C securely after the NF discovery process described in [24] is executed.(5)
UserC sends SKE.EncKChTokenC,IDC to the service producer NFh.(6)
NFh verifies TokenC through NRF. If the validation failed, Output 0. Otherwise, go ahead.(7)
NRF informs the verification result to the service producer NFh.(8)
NFh sends a service response to C and executes requested services if the token has been successfully verified. Output 1.The authorization process is shown in Figure5. The validity parameter lifetime in TokenC is associated with the service security level SR, which is set up by the service producer NFh in advance.Figure 5
Service authorization of 5G SBA.


## 5.1. Security Assumptions

Without loss of generality, the following security assumptions are proposed for the authentication model:(1)
In this scheme, some measures will be taken by the authentication serverNRF to prevent the dictionary attack and guessing the password of a valid user.(2)
When the 5G user uses a UE, all security-related operations are implemented in the trusted execution environment [23]. Thus, the communication between the smart card function calculation such as the fuzzy extractor is secure and cannot be monitored.(3)
In the registration phase, the UE can distinguish the right NRF, and the secret information is transmitted through a trusted channel.


## 5.2. 5G Diversified Identity Management Mechanism

In order to adapt to differentiated applications in the 5G network, a new 5G diversified identity management framework is proposed. As shown in Figure3, the 5G identity model includes three data blocks: physical identification, functional identification, and security level.(i)
Physical identification: the physical identification generated by the equipment manufacturer or operators satisfies the characteristic of global or network uniqueness. It represents the unique identification of a device, such as the UE’s international device identification (IMEI) or the user’s ID number.(ii)
Function identification: function identification is generated by telecom operators and application service providers, which points to specific services or applications that users can access. Since a device can have multiple different service resources, a physical ID can be related with several functional IDs. Function codes indicate the service authority of a user and can be changed and adjusted quickly and flexibly.(iii)
Security level: each function identification can be nominated with only one security level which shows the security requirements of functional services. According to the security requirements of service providers, we divide services or applications into four security levels:0,1,2,and3 followed by low to high, which will lead to single-factor, two-factor, and three-factor authentication protocol, respectively. Among them, 1 and 2 represent the same security strength because both of them can trigger two-factor authentication, but the authentication factors are different. For different security levels, the differentiated authentication subprotocol between UE and application server will be adopted. Ordinarily, browsing public web pages belongs to security level 0, while high-risk e-health services belong to security level 3. Service providers should demarcate security levels for services according to their defined security rules or authentication requirements.Figure 3
5G diversified identity model.


## 5.3. Flexible and Composable Three-Factor Authentication Mechanism for Different Applications

This section proposes an entity authentication mechanism in the 5G multiservice system. In this scheme, the service authentication protocol can be implemented in the form of a subprotocol according to several security levels. The proposed scheme consists of the following five phases: initialization, registration, authentication, session key agreement, and biometrics and password updating, which are described in detail as follows. The notations used in our proposed scheme are shown in Table1.Table 1
Notations.
NotationDescriptionPUB.KGenkPublic key generation algorithmPKNRF,SKNRFPublic-private key pair of the authentication serverNRFSKE.KGenkSymmetric key generation algorithmSKE.EncSKSymmetric encryption withSKSKE.DecSKSymmetric decryption withSKSignSKSign withSKHashCryptographic hash functionMACMessage authentication code functionIDCIdentification ofCPWPassword chosen byCBioBiometric dataSCSmart cardDBioBiometric dataDCPassword dataRNRandom numberTiCurrent timestampKsSession key ofNRF and CKijSession key betweeniandj


### 5.3.1. Initialization

Based on a system security parameterk, the authentication server NRF generates a symmetric key for authentication and a public-private key pair for authorization. And the NRF generates an elliptic curve E shared between the NRF and the user C’s smart card SC for session key agreement.(1)
NRF implements public key generation algorithm PUB.KGenk to obtain a pair PKNRF,SKNRF(2)
NRF runs symmetric key generation algorithm SKE.KGenk to obtain SKC(3)
NRF calculates the base point P on the elliptic curve E, and n is the order of PThe parameterPKNRF,E,P is public, and the secret parameter SKNRFSKC is kept secret by the NRF.


### 5.3.2. Registration

The registration process consists of the following steps:(1)
Biometrics registration:(i)
NRF generates IDC with the security level designed in Section 5.2 and notifies it to user C.(ii)
UserC collects the biometric data in his device UE, and a pair R,N is generated by C’s biometric template Bio. Algorithm Gen is defined as the fuzzy extractor generation as shown in Section 3. GenBio⟶R,N.(iii)
C extracts MAC key KB=HashR and sends KB,N to NRF.(iv)
After receivingKB,N, NRF chooses a random number RN1 and encrypts KB with SKC by using the symmetric key encryption algorithm SKE.Enc.DK=SKE.EncSKCIDCKBHashIDCKBRN1, where HashIDCKBRN1 is used for integrity detection. And DK¯=SKE.EncSKCKBRN1,IDC.(v)
NRF sets DBio=N,DK,Hash,Rep and DBio¯=N,DK¯,Hash,Rep, where Rep is the reproduction algorithm in the fuzzy extractor.(2)
Password registration:(i)
NRF chooses two new random numbers RN2andRN3 and calculates DE and D¯ as follows:(3)DE=HashIDCSKC⊕RN2⊕RN3,D¯=HashIDCSKC⊕RN3.(ii)
NRF sets DC=IDC,RN2,DE,D¯,Hash.(3)
Smart card registration:(i)
A smart card is sent to userC containing DC, DBio, elliptic curve E, and its base point P securely. Here, according to the 3GPP 5G standard [19], the smart card such as USIM has been deployed in a trust execution environment on each 5G device. Thus, the 5G device only requires to keep DC and DBio in secret in the smart card which are sent by NRF.(ii)
UserC encrypts DBio with KB and stores it in .(iii)
Upon receiving, userC inputs his random password PW. Then, the device generates a random number RN4 and computes D=D¯⊕HashPW⊕RN4 to replace the local old D¯.Finally, userC keeps and password securely. NRF also stores DBio¯,DC,E,P in its database and erases RN3 and DBio.


### 5.3.3. Authentication

Firstly, userC inserts the smart card and tries to request service. User C sends the service request message including the predefined identity IDC with the service security level. Upon the receipt of the message, the authentication server NRF verifies if the identity IDC is valid and checks the security level of IDC to ensure user’s access rights. Here, PW′ and Bio′ are represented as the collected password and biometrics during each authentication process, respectively. According to different security levels, different mutual authentication processes are executed in detail as shown in Algorithm 1.Algorithm 1: Composable three-factor authentication.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: authentication result: 0 for failure; 1 for success.(1)
: 5G userC sends a service request message including IDC and security level of the access service read from the smart card.(2)
:NRF checks the highest security level SR in the service request message. IfSR=0, thenOutput 1 andTerminate the authentication process.ElseifSR=1, then go to Step 3.ElseifSR=2, then go to Step 8.ElseifSR=3, then go to Step 3.NRF sends an attach response SR,Attach to notify C.(3)
5G userC chooses a new random number RN5 and sends IDC,T1,RN5 to NRF.(4)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T1 is invalid, Output 0. Else, go ahead.(ii)
SearchDK¯ by IDC in the database and decrypt DK¯ with SKC to obtain KB.(iii)
Generate a new random numberRN6 and compute DK=SKE.EncSKCIDCKBHashIDCKBRN1 and MK=HashHashDK⊕RN5T2.(iv)
SendT2RN6,MK to user C.(5)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T2 is invalid, Output 0. Else, go ahead.(ii)
ComputeR′=RepBio′,N and KB′=HashR′.(iii)
DecryptSKE.EncKBDBio with KB′ to obtain DK.(iv)
ComputeMK=?HashHashDK⊕RN5T2. If the equation is established, then go ahead. Else, Output 0.(v)
ComputeTag=MACKB′RN6⊕HashDKT3 and send Tag,T3 to NRF.(6)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T3 is invalid, Output 0. Else, go ahead.(ii)
VerifyTag=?MACKBRN6⊕HsahDKT3. If it is, then go ahead. Else, Output 0.(7)
IfSR=1, then output 1. Else, ifSR=3, go ahead.(8)
C computes M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T4 and sends IDC,RN2,DE,M1,T3 to NRF.(9)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T4 is invalid, Output 0. Else, go ahead.(ii)
ComputeRN3=DE⊕HashIDCSKC⊕RN2.(iii)
VerifyHashRN3⊕T4=?M1. If the equation is established, go ahead. Else, Output 0.(iv)
Generate new numbersRN2new,RN3new and calculate DEnew=HashIDCSKC⊕RN2new and D¯new=HashD¯⊕RN2new⊕HashIDCSKC⊕RN3new.(v)
CalculateM2=HashHashD¯⊕DEnew⊕T5 and M3=HashHashD¯⊕D¯new⊕T5.(vi)
SendRN2new,DEnew,D¯new,M2,M3,T5 to C.(10)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T5 is invalid, Output 0. Else, go ahead.(ii)
CalculateHashHashD⊕HashPW′⊕RN4⊕DEnew⊕T5=?M2 and(iii)
HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T5=?M3. If the two equations are established, then go ahead. Else, Output 0.GenerateRN4new and Dnew=HashD⊕HashPW′⊕RN4⊕RN2new⊕D¯new⊕HashPW′⊕RN4new.(iv)
ReplaceDE,D,RN2,RN4 with DEnew,Dnew,RN2new,RN4new. Output 1.According to the implementation method of the authentication protocol, the authentication protocol is able to divide into four protocol blocks: no authentication (attach request phase), biometrics and smart card-based authentication (biometrics authentication phase), password and smart card-based authentication (password authentication phase), and password and biometrics and smart card-based authentication which is the entire protocol as shown in Figure4. When the service security level SR=0, for example, the user wants to skim some public information without any privacy or sensitive data; he only needs to read his identity from the smart card and runs in two steps without any authentication. From a user experience perspective, the biometric authentication is more convenient than the password authentication for 5G users. Thus, the biometrics authentication phase and the password authentication phase are designed for the service security level SR=1 and SR=2, respectively. The user must implement all of the protocol blocks for the highest security level SR=3. The proposed authentication protocol can be adopted dynamically by composing some protocol blocks and steps to balance the efficiency and security.Figure 4
Authentication process.


### 5.3.4. Session Key Agreement

In the subsequent authorization of NF service access processes, userC and NRF need to negotiate a session key to securely communicate with each other. The session key agreement process is executed after a successful authentication and based on the elliptic curve Diffie–Hellman (ECDH) protocol. The session key agreement is described in Algorithm 2.Algorithm 2: Session key agreement.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: agreement result: Ks.(1)
NRF executes the following commands.(i)
Check the highest security levelSR in the authentication process. IfSR=0, then Output 1, and Terminate the process. Else, go ahead.(ii)
Choose random numbera∈Zn∗.(iii)
Compute the secret auxiliary messageSMNRFIfSR=1, then setSMNRF=HashIDCKBRN6.IfSR=2, then setSMNRF=HashHashIDCSKC⊕RN3new.IfSR=3, then setSMNRF=HashIDCKBRN6⊕HashHashIDCSKC⊕RN3new.(iv)
CalculateKNRF=SMNRF⊕aP.(v)
SendKNRF to C.(2)
Upon the receipt of the message,C works as follows.(i)
Choose random numberb∈Zn∗.(ii)
Compute the secret auxiliary messageSMC.IfSR=1, then C setsSMC=HashIDCKBRN6.IfSR=2, then C setsSMC=HashDnew⊕HashPW⊕RN4new.IfSR=3, then C setsSMC=HashIDCKBRN6⊕HashDnew⊕HashPW⊕RN4new.(iii)
CalculateKC=SMC⊕bP.(iv)
CalculateKs=bKNRF⊕SMC.(v)
SendKC,SKE.EncKsaP to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
CalculateKs=aKC⊕SMNRF.(ii)
DecryptSKE.EncKsaP with Ks. And if the decryption is aP, NRF confirms success.(iii)
SendSKE.EncKsbP to C.(4)
C decrypts SKE.EncKsbP with Ks. And if the decryption is bP, C confirms success, and the process terminates.In this phase, whenSR=2or3, NRF and user C can derive bP and aP, respectively, since(4)Dnew⊕HashPW⊕RN4new=HashIDCSKC⊕RN3new.


### 5.3.5. Biometrics and Password Updating

To avoid the attacker who obtains only one of the valid features (biometrics or password) distorting the information maliciously, we suppose that the biometrics and password update phase are implemented after the successful and complete authentication (SR=3). Users select the following phases to update the biometrics and password.(1) Biometrics Update Phase. The user who wants to update the biometrics needs to perform a complete authentication protocol and executes some steps similar to biometrics registration. The biometrics update phase is described in Algorithm 3.Algorithm 3: Biometrics update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If the authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Input new biometric data as same as those in the biometrics registration phase. The trusted device generates a new pairRnew,Nnew.(ii)
Calculate newKBnew=HashRnew.(iii)
SendSKE.EncKsKBnew,Nnew, biometrics update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
Choose a new numberRN1new and encrypt KBnew with SKC by using SKE.Enc.(ii)
CalculateDKnew=SKE.EncSKCIDCKBnewHashIDCKBnewRN1new and DK¯new=SKE.EncSKCKBnewRN1,IDC.(iii)
SetDBionew=Nnew,DKnew,Hash,Rep and DBio¯new=N,DK¯new,Hash,Rep(iv)
StoreDBio¯new in its database.(v)
SendSKE.EncKsDKnew to C.(4)
After receiving the message,C encrypts DBionew with KBnew and stores in the smart card. And Output 1.(2) Password Update Phase. To improve system security, the users are advised to change the password on a frequent basis. Likewise, the password updating phase begins with an authentication process but is slightly different from the password registration. The password update phase is described in Algorithm 4.Algorithm 4: Password update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Choose a new passwordPWnew, and the smart card generates new RN4new to compute MPU=HashD⊕HashPW⊕RN4⊕RN2⊕HashPWnew⊕RN4new.(ii)
SendSKE.EncKsMPU, password update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
DeriveHashPWnew⊕RN4new from MPU⊕HashHashIDCSKC⊕RN3⊕RN2.(ii)
ChooseRN2new as well as RN3new, and calculate D¯new=HashHashIDCSKC⊕RN3⊕RN2new⊕HashPWnew⊕RN4new⊕HashIDCSKC⊕RN3new.(iii)
CalculateDEnew=HashIDCSKC⊕RN2new⊕RN3new.(iv)
SendSKE.EncKsRN2new,DEnew,D¯new to C.(4)
Upon the receipt of the message,C computes Dnew=HashD⊕HashPW⊕RN4⊕RN2new⊕D¯new.(5)
C and NRF store Dnew, DEnew, and D¯new to replace the old information. And Output 1.


## 5.3.1. Initialization

Based on a system security parameterk, the authentication server NRF generates a symmetric key for authentication and a public-private key pair for authorization. And the NRF generates an elliptic curve E shared between the NRF and the user C’s smart card SC for session key agreement.(1)
NRF implements public key generation algorithm PUB.KGenk to obtain a pair PKNRF,SKNRF(2)
NRF runs symmetric key generation algorithm SKE.KGenk to obtain SKC(3)
NRF calculates the base point P on the elliptic curve E, and n is the order of PThe parameterPKNRF,E,P is public, and the secret parameter SKNRFSKC is kept secret by the NRF.


## 5.3.2. Registration

The registration process consists of the following steps:(1)
Biometrics registration:(i)
NRF generates IDC with the security level designed in Section 5.2 and notifies it to user C.(ii)
UserC collects the biometric data in his device UE, and a pair R,N is generated by C’s biometric template Bio. Algorithm Gen is defined as the fuzzy extractor generation as shown in Section 3. GenBio⟶R,N.(iii)
C extracts MAC key KB=HashR and sends KB,N to NRF.(iv)
After receivingKB,N, NRF chooses a random number RN1 and encrypts KB with SKC by using the symmetric key encryption algorithm SKE.Enc.DK=SKE.EncSKCIDCKBHashIDCKBRN1, where HashIDCKBRN1 is used for integrity detection. And DK¯=SKE.EncSKCKBRN1,IDC.(v)
NRF sets DBio=N,DK,Hash,Rep and DBio¯=N,DK¯,Hash,Rep, where Rep is the reproduction algorithm in the fuzzy extractor.(2)
Password registration:(i)
NRF chooses two new random numbers RN2andRN3 and calculates DE and D¯ as follows:(3)DE=HashIDCSKC⊕RN2⊕RN3,D¯=HashIDCSKC⊕RN3.(ii)
NRF sets DC=IDC,RN2,DE,D¯,Hash.(3)
Smart card registration:(i)
A smart card is sent to userC containing DC, DBio, elliptic curve E, and its base point P securely. Here, according to the 3GPP 5G standard [19], the smart card such as USIM has been deployed in a trust execution environment on each 5G device. Thus, the 5G device only requires to keep DC and DBio in secret in the smart card which are sent by NRF.(ii)
UserC encrypts DBio with KB and stores it in .(iii)
Upon receiving, userC inputs his random password PW. Then, the device generates a random number RN4 and computes D=D¯⊕HashPW⊕RN4 to replace the local old D¯.Finally, userC keeps and password securely. NRF also stores DBio¯,DC,E,P in its database and erases RN3 and DBio.


## 5.3.3. Authentication

Firstly, userC inserts the smart card and tries to request service. User C sends the service request message including the predefined identity IDC with the service security level. Upon the receipt of the message, the authentication server NRF verifies if the identity IDC is valid and checks the security level of IDC to ensure user’s access rights. Here, PW′ and Bio′ are represented as the collected password and biometrics during each authentication process, respectively. According to different security levels, different mutual authentication processes are executed in detail as shown in Algorithm 1.Algorithm 1: Composable three-factor authentication.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: authentication result: 0 for failure; 1 for success.(1)
: 5G userC sends a service request message including IDC and security level of the access service read from the smart card.(2)
:NRF checks the highest security level SR in the service request message. IfSR=0, thenOutput 1 andTerminate the authentication process.ElseifSR=1, then go to Step 3.ElseifSR=2, then go to Step 8.ElseifSR=3, then go to Step 3.NRF sends an attach response SR,Attach to notify C.(3)
5G userC chooses a new random number RN5 and sends IDC,T1,RN5 to NRF.(4)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T1 is invalid, Output 0. Else, go ahead.(ii)
SearchDK¯ by IDC in the database and decrypt DK¯ with SKC to obtain KB.(iii)
Generate a new random numberRN6 and compute DK=SKE.EncSKCIDCKBHashIDCKBRN1 and MK=HashHashDK⊕RN5T2.(iv)
SendT2RN6,MK to user C.(5)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T2 is invalid, Output 0. Else, go ahead.(ii)
ComputeR′=RepBio′,N and KB′=HashR′.(iii)
DecryptSKE.EncKBDBio with KB′ to obtain DK.(iv)
ComputeMK=?HashHashDK⊕RN5T2. If the equation is established, then go ahead. Else, Output 0.(v)
ComputeTag=MACKB′RN6⊕HashDKT3 and send Tag,T3 to NRF.(6)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T3 is invalid, Output 0. Else, go ahead.(ii)
VerifyTag=?MACKBRN6⊕HsahDKT3. If it is, then go ahead. Else, Output 0.(7)
IfSR=1, then output 1. Else, ifSR=3, go ahead.(8)
C computes M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T4 and sends IDC,RN2,DE,M1,T3 to NRF.(9)
Upon the receipt of the message,NRF works as follows.(i)
If the timestamp T4 is invalid, Output 0. Else, go ahead.(ii)
ComputeRN3=DE⊕HashIDCSKC⊕RN2.(iii)
VerifyHashRN3⊕T4=?M1. If the equation is established, go ahead. Else, Output 0.(iv)
Generate new numbersRN2new,RN3new and calculate DEnew=HashIDCSKC⊕RN2new and D¯new=HashD¯⊕RN2new⊕HashIDCSKC⊕RN3new.(v)
CalculateM2=HashHashD¯⊕DEnew⊕T5 and M3=HashHashD¯⊕D¯new⊕T5.(vi)
SendRN2new,DEnew,D¯new,M2,M3,T5 to C.(10)
Upon the receipt of the message,C works as follows.(i)
If the timestamp T5 is invalid, Output 0. Else, go ahead.(ii)
CalculateHashHashD⊕HashPW′⊕RN4⊕DEnew⊕T5=?M2 and(iii)
HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T5=?M3. If the two equations are established, then go ahead. Else, Output 0.GenerateRN4new and Dnew=HashD⊕HashPW′⊕RN4⊕RN2new⊕D¯new⊕HashPW′⊕RN4new.(iv)
ReplaceDE,D,RN2,RN4 with DEnew,Dnew,RN2new,RN4new. Output 1.According to the implementation method of the authentication protocol, the authentication protocol is able to divide into four protocol blocks: no authentication (attach request phase), biometrics and smart card-based authentication (biometrics authentication phase), password and smart card-based authentication (password authentication phase), and password and biometrics and smart card-based authentication which is the entire protocol as shown in Figure4. When the service security level SR=0, for example, the user wants to skim some public information without any privacy or sensitive data; he only needs to read his identity from the smart card and runs in two steps without any authentication. From a user experience perspective, the biometric authentication is more convenient than the password authentication for 5G users. Thus, the biometrics authentication phase and the password authentication phase are designed for the service security level SR=1 and SR=2, respectively. The user must implement all of the protocol blocks for the highest security level SR=3. The proposed authentication protocol can be adopted dynamically by composing some protocol blocks and steps to balance the efficiency and security.Figure 4
Authentication process.


## 5.3.4. Session Key Agreement

In the subsequent authorization of NF service access processes, userC and NRF need to negotiate a session key to securely communicate with each other. The session key agreement process is executed after a successful authentication and based on the elliptic curve Diffie–Hellman (ECDH) protocol. The session key agreement is described in Algorithm 2.Algorithm 2: Session key agreement.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: agreement result: Ks.(1)
NRF executes the following commands.(i)
Check the highest security levelSR in the authentication process. IfSR=0, then Output 1, and Terminate the process. Else, go ahead.(ii)
Choose random numbera∈Zn∗.(iii)
Compute the secret auxiliary messageSMNRFIfSR=1, then setSMNRF=HashIDCKBRN6.IfSR=2, then setSMNRF=HashHashIDCSKC⊕RN3new.IfSR=3, then setSMNRF=HashIDCKBRN6⊕HashHashIDCSKC⊕RN3new.(iv)
CalculateKNRF=SMNRF⊕aP.(v)
SendKNRF to C.(2)
Upon the receipt of the message,C works as follows.(i)
Choose random numberb∈Zn∗.(ii)
Compute the secret auxiliary messageSMC.IfSR=1, then C setsSMC=HashIDCKBRN6.IfSR=2, then C setsSMC=HashDnew⊕HashPW⊕RN4new.IfSR=3, then C setsSMC=HashIDCKBRN6⊕HashDnew⊕HashPW⊕RN4new.(iii)
CalculateKC=SMC⊕bP.(iv)
CalculateKs=bKNRF⊕SMC.(v)
SendKC,SKE.EncKsaP to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
CalculateKs=aKC⊕SMNRF.(ii)
DecryptSKE.EncKsaP with Ks. And if the decryption is aP, NRF confirms success.(iii)
SendSKE.EncKsbP to C.(4)
C decrypts SKE.EncKsbP with Ks. And if the decryption is bP, C confirms success, and the process terminates.In this phase, whenSR=2or3, NRF and user C can derive bP and aP, respectively, since(4)Dnew⊕HashPW⊕RN4new=HashIDCSKC⊕RN3new.


## 5.3.5. Biometrics and Password Updating

To avoid the attacker who obtains only one of the valid features (biometrics or password) distorting the information maliciously, we suppose that the biometrics and password update phase are implemented after the successful and complete authentication (SR=3). Users select the following phases to update the biometrics and password.(1) Biometrics Update Phase. The user who wants to update the biometrics needs to perform a complete authentication protocol and executes some steps similar to biometrics registration. The biometrics update phase is described in Algorithm 3.Algorithm 3: Biometrics update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If the authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Input new biometric data as same as those in the biometrics registration phase. The trusted device generates a new pairRnew,Nnew.(ii)
Calculate newKBnew=HashRnew.(iii)
SendSKE.EncKsKBnew,Nnew, biometrics update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
Choose a new numberRN1new and encrypt KBnew with SKC by using SKE.Enc.(ii)
CalculateDKnew=SKE.EncSKCIDCKBnewHashIDCKBnewRN1new and DK¯new=SKE.EncSKCKBnewRN1,IDC.(iii)
SetDBionew=Nnew,DKnew,Hash,Rep and DBio¯new=N,DK¯new,Hash,Rep(iv)
StoreDBio¯new in its database.(v)
SendSKE.EncKsDKnew to C.(4)
After receiving the message,C encrypts DBionew with KBnew and stores in the smart card. And Output 1.(2) Password Update Phase. To improve system security, the users are advised to change the password on a frequent basis. Likewise, the password updating phase begins with an authentication process but is slightly different from the password registration. The password update phase is described in Algorithm 4.Algorithm 4: Password update.
Require: the user identity IDC; the password PW′; the biometric data Bio′; the smart card.Ensure: update the result: 0 for failure; 1 for success.(1)
NRF and user C execute the mutual authentication process. The security level SR is set to 3. If authentication failed, Output 0. Otherwise, go ahead.(2)
UserC works as follows.(i)
Choose a new passwordPWnew, and the smart card generates new RN4new to compute MPU=HashD⊕HashPW⊕RN4⊕RN2⊕HashPWnew⊕RN4new.(ii)
SendSKE.EncKsMPU, password update request to NRF.(3)
Upon the receipt of the message,NRF works as follows.(i)
DeriveHashPWnew⊕RN4new from MPU⊕HashHashIDCSKC⊕RN3⊕RN2.(ii)
ChooseRN2new as well as RN3new, and calculate D¯new=HashHashIDCSKC⊕RN3⊕RN2new⊕HashPWnew⊕RN4new⊕HashIDCSKC⊕RN3new.(iii)
CalculateDEnew=HashIDCSKC⊕RN2new⊕RN3new.(iv)
SendSKE.EncKsRN2new,DEnew,D¯new to C.(4)
Upon the receipt of the message,C computes Dnew=HashD⊕HashPW⊕RN4⊕RN2new⊕D¯new.(5)
C and NRF store Dnew, DEnew, and D¯new to replace the old information. And Output 1.


## 5.4. Authorization Scheme of NF Service Access

According to the 3GPP 5G service authentication and authorization architecture, Service-Based Architecture (SBA), we design a new authorization scheme for the 5G multiservice system, which is described in Algorithm5.Algorithm 5: Service authorization.
Require: the user identity IDC; the session key Ks; the smart card .Ensure: authorization result: 0 for failure; 1for success.(1)
If user C holds a valid token for his desirable service, then go to Step 5. Otherwise, go ahead.(2)
UserC and NRF execute the proposed authentication mechanism as mentioned above. If the authentication failed or key agreement failed, Output 0. Otherwise, go ahead.(3)
UserC sends the service authorization request MRS=IDC,Service Request.(4)
Upon the receipt of the message,NRF works as follows.(i)
ConfirmSR of the service authorization request is less than SR in the authentication process. IfSR of the service authorization request is bigger than SR in the authentication process, then go to Step 2. Else, go ahead.(ii)
GenerateTokenC=SignSKNRFIDC,NFh,KCh,SR,T5,lifetime.(iii)
SendSKE.EncKsTokenC,NFh,KCh to user C (the message is not encrypted when SR=0). Suppose that NRF has told NFh the session key KCh between NFh and C securely after the NF discovery process described in [24] is executed.(5)
UserC sends SKE.EncKChTokenC,IDC to the service producer NFh.(6)
NFh verifies TokenC through NRF. If the validation failed, Output 0. Otherwise, go ahead.(7)
NRF informs the verification result to the service producer NFh.(8)
NFh sends a service response to C and executes requested services if the token has been successfully verified. Output 1.The authorization process is shown in Figure5. The validity parameter lifetime in TokenC is associated with the service security level SR, which is set up by the service producer NFh in advance.Figure 5
Service authorization of 5G SBA.


## 6. Security Analysis

Our proposed scheme can provide the following security objectives.


### 6.1. Protocol Verification

#### 6.1.1. Authentication ofC to NRF

When serviceSR=1, NRF verified the legal user C by computing if the challenge response result Tag is MACKBRN6⊕HsahDKT3. The attacker cannot extract correct KB and decrypt SKE.EncKBDBio in the smart card SC. Therefore, the attacker is not able to derive the correct Tag without KB or DK. When the security level is 2, NRF verifies if HashRN3⊕T3=?M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T3. As a result of PW′=PW,M1=HashHashD⊕HashPW⊕RN4⊕DE⊕T3=HashHashD¯⊕DE⊕T3=HashRN3⊕T3Due to the collision resistance of hash function, an adversary cannot derive correctM1 without the user random password. When the security level is 3, the complete authentication process is executed between C and NRF.


#### 6.1.2. Authentication ofNRF to C

When the security level is 1,C verifies NRF by checking MK=?HashHashDK⊕RN5T2. The attacker cannot extract DK from smart card or NRF’s database without KB or SKC. When the security level is 2, C checks if HashHashD⊕HashPW′⊕RN4⊕DEnew⊕T4=M2 and HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T4=M3. Here, M3 and M2 are calculated with the server’s secret parameters SKC,RN3. Attackers cannot disguise legitimate NRF to cheat C without the secret parameters. Similarly, C runs the above two subprotocols of authentication when SR is 3.


#### 6.1.3. Session Key Agreement

In the session key agreement phase,KC sent to NRF and KNRF sent to C are composed of the hashed authentication secret information and string generated by using the ECDH algorithm. Firstly, without biometrics Bio, password PW, or NRF’s secret information RN3, an adversary is unable to deduce aP or bP from KNRF and KC. Secondly, even if an adversary obtained the part of the user and NRF’s data accidentally and calculated the correct aP and bP, he is unfeasible to compute the session key Ks=abP since our proposed scheme is based on the elliptic curve Diffie–Hellman problem (ECDHP) and elliptic curve discrete logarithm problem (ECDLP).


### 6.2. Attack Analysis

The proposed scheme can resist several protocol attacks as follows.


#### 6.2.1. Replay Attack

The attacker can disguise the previously transmitted message as a legitimate user and send it to the disguised user. By using the timestamp and the new nonce, our proposed scheme can resist replay attacks. Based on the timestamps and fresh nonces, the proposed scheme can defend against the replay attack. In Steps 1 to 6,C and NRF check the validity of the timestamp from the other side, and the attacker cannot forge the Tag or MK without KB and the private key SKC. In addition, the random numbers RN6 and Tag calculated with RN6 are updated in each session. In Steps 8 to 10, the random numbers RN2, RN3, and RN4 are used for authentication, which are updated at the end of each authentication protocol.


#### 6.2.2. Forgery Attack

In our scheme, it is impossible for any attacker to forge the legalMK=HashHashDK⊕RN5T2 without the secret key SKC. Moreover, the calculation results of M2andM3 need to use secret parameters SKC and RN3 kept secretly by NRF. According to the irreversibility of one-way hash function, it is too hard for any attacker to recover one of SKC and RN3 from the public parameters. The attacker has ID′ which is not IDC and hopes to deduce the authentication information from M1, for instance, the password of C in another. The attacker has to find an integer i′ in which i≠i′ satisfying that(5)HashID′⊕PW⊕i′=HashIDC⊕PW⊕i,which is impossible due to the collision resistance of hash function. In the biometric authentication, an adversary cannot obtain the correct biometric data to generate KB and achieve the response challenge.


#### 6.2.3. Man-in-the-Middle Attack

In the session key agreement phase, if the attacker hijacks and forges the agreement message between the NRF and user after the authentication phase, the attacker may make man-in-the-middle attack. In the proposed scheme,aP is hidden by the use of HashIDCKBRN6 or HashHashIDCSKC⊕RN3new, and bP is also hidden by the use of HashIDCKBRN6 or HashDnew⊕HashPW⊕RN4new. The attacker cannot drive the middle key taP and tbP from the transmitted messages KC and KNRF over the public channel without possessing the secret KB, password, and RN3.In addition, there are some other attacks aimed at password/smart card authentication protocol. We proved the proposed scheme can resist the following attacks.


#### 6.2.4. Stolen Smart Card Attack

When the smart card of a valid user is hijacked by an attacker, first case, even if an attacker obtains a smart card, he cannot guess the password fromD=D¯⊕HashPW⊕RN4 in DC owing to using one-way hash function. In addition, the biometric information is not stored in the smart card in the plaintext but protected and encrypted with KB. To gain the biometric information, the attacker requires to record the biometric information immediately to finish the authentication. To sum up, it is unable for any attacker to complete the authentication when the security level is greater than 0.We summed up the proposed scheme and other related schemes for the protocol security properties. Table2 shows several important security properties of our scheme, scheme in [10], and the standard mechanism proposed by the 3GPP committee including EAP-AKA (marked as AKA) and EAP-TLS (marked as TLS).Table 2
Comparison of security properties.
Yu et al. [10]AKATLSOursMutual authenticationYYYYMultifactor authenticationYNNYKey agreementNYYYAuthorizationNNNYComposability resistingYNNYProtocol attack resistingYNNYDictionary attack resistingN——YStolen smart card attackYNNY


### 6.3. Scyther Simulation

The formal verification tool Scyther [25] is employed to verify security simulation analysis of our proposed scheme. Scyther is a tool which can be used to find problems that arise from the way the protocols are constructed and support multiprotocol parallel analysis. Scyther tool has a clear description of the state set trajectory. Based on the model improvement algorithm, Scyther is conveniently used to protocol attack search, role execution, and security proof. Scyther uses a set of claims to represent many security goals such as secrecy and several authentications including aliveness, weak agreement, agreement, and synchronization. Secret claim is used to mean confidentiality and expresses that certain information is not revealed to an adversary, even though these data are communicated over an untrusted network. In order to provide different degrees of authentication strength, several forms of authentication claims including Alive, Weakagree, Niagree (noninjective agree), and Nisynch (noninjective synchronization) are employed to detect potential protocol attacks such as replay, reflection, and man-in-the-middle attacks. For a detailed description of the formal definition of all Scyther claims, please see [26].In our proposed scheme, there are two main roles: UE and NRF; they represent the userC’s equipment and network repository function NRF, respectively. Since the register of our proposed protocol is supposed to be secure, we only consider the three-factor authentication and session key agreement phase. We structure the proposed scheme in the Security Protocol Description Language (SPDL) to describe and analyze protocols and specify the security properties of our proposed scheme by a series of claims of Scyther as shown in Figure 6. Here, the Dolev–Yao intruder model is employed in which the attacker can completely control the network and conduct a series of attacks to be the implementation scenario of the proposed scheme. According to Figure 6, our scheme successfully makes certain all Scyther secrecy and authentication claims; moreover, there are no attacks found under the verification of the Scyther tool.Figure 6
Formal verification results under the test of the Scyther tool.


### 6.4. Authentication Proof Using BAN Logic

We use the BAN logic [27] to prove the security of our proposed protocol. By our proposed scheme, the authentication and session key process when SR=3 is composed of the biometrics and smart card authentication (SR=1) and password and smart card authentication process (SR=2) as shown in Section 4. Therefore, if both the biometrics authentication and password authentication process are demonstrated to achieve security goals, the complete authentication process (SR=3) can also be proven to achieve security goals obviously. Consequently, we mainly demonstrate the security of the biometrics and smart card authentication process and password and smart card authentication process, respectively.


#### 6.4.1. Biometrics and Smart Card Authentication

According to the analytic procedures of the BAN logic, the biometrics and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCFirstly, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPKBRN6(ii)
Msg 2.C⟶NRF:bPKBRN6,aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsSecondly, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KBC(vi)
A6.C|≡NRF↔KBCBased on the assumptions and the rules of the BAN logic, the proofs are presented as follows.According to Msg 1, we have(6)C⊲aPKBRN6.Before the key agreement process, userC has verified the NRF’s signature by using the public key of NRF. With the successful confirmation, A6, and the message-meaning rule, we can derive(7)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(8)C|≡♯aP.Based on the nonce verification rule, we can derive(9)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(10)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(11)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2. From Msg 3, we have(12)C⊲bPKs.According to Goal 1 we have proved and the message-meaning rule, we can derive(13)C|≡NRF|∼bP.Based on A2, the random number and freshness rule, and the nonce verification rule, we can derive(14)C|≡NRF|≡bP.According toC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(15)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


#### 6.4.2. Password and Smart Card Authentication

According to the analytic procedures of the BAN logic, the password and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCAgain, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPhhIDCSKC⊕RN3new(ii)
Msg 2.C⟶NRF:bPhDnew⊕hPW⊕RN4new, aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsIn the same way, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KPC(vi)
A6.C|≡NRF↔KPCSpecifically,KP is defined by the use of the sharing secret between NRF and C, KP=hDnew⊕hPW⊕RN4new=hhIDCSKC⊕RN3new.According to Msg 1, we have(16)C⊲aPhhIDCSKC⊕RN3new.This is the equivalent as follows:(17)C⊲aPKP.Before the key agreement process, userC has verified the NRF by using the secret information RN3. With the successful confirmation, A6, and the message-meaning rule, we can derive(18)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(19)C|≡♯aP.Based on the nonce verification rule, we can derive(20)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(21)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(22)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2.From Msg 3, we have(23)C⊲bPKs.Based on Goal 1 we have proved and the message-meaning rule, we can derive(24)C|≡NRF|∼bP.According to A2, the random number and freshness rule, and the nonce verification rule, we can derive(25)C|≡NRF|≡bP.FromC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(26)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


## 6.1. Protocol Verification

### 6.1.1. Authentication ofC to NRF

When serviceSR=1, NRF verified the legal user C by computing if the challenge response result Tag is MACKBRN6⊕HsahDKT3. The attacker cannot extract correct KB and decrypt SKE.EncKBDBio in the smart card SC. Therefore, the attacker is not able to derive the correct Tag without KB or DK. When the security level is 2, NRF verifies if HashRN3⊕T3=?M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T3. As a result of PW′=PW,M1=HashHashD⊕HashPW⊕RN4⊕DE⊕T3=HashHashD¯⊕DE⊕T3=HashRN3⊕T3Due to the collision resistance of hash function, an adversary cannot derive correctM1 without the user random password. When the security level is 3, the complete authentication process is executed between C and NRF.


### 6.1.2. Authentication ofNRF to C

When the security level is 1,C verifies NRF by checking MK=?HashHashDK⊕RN5T2. The attacker cannot extract DK from smart card or NRF’s database without KB or SKC. When the security level is 2, C checks if HashHashD⊕HashPW′⊕RN4⊕DEnew⊕T4=M2 and HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T4=M3. Here, M3 and M2 are calculated with the server’s secret parameters SKC,RN3. Attackers cannot disguise legitimate NRF to cheat C without the secret parameters. Similarly, C runs the above two subprotocols of authentication when SR is 3.


### 6.1.3. Session Key Agreement

In the session key agreement phase,KC sent to NRF and KNRF sent to C are composed of the hashed authentication secret information and string generated by using the ECDH algorithm. Firstly, without biometrics Bio, password PW, or NRF’s secret information RN3, an adversary is unable to deduce aP or bP from KNRF and KC. Secondly, even if an adversary obtained the part of the user and NRF’s data accidentally and calculated the correct aP and bP, he is unfeasible to compute the session key Ks=abP since our proposed scheme is based on the elliptic curve Diffie–Hellman problem (ECDHP) and elliptic curve discrete logarithm problem (ECDLP).


## 6.1.1. Authentication ofC to NRF

When serviceSR=1, NRF verified the legal user C by computing if the challenge response result Tag is MACKBRN6⊕HsahDKT3. The attacker cannot extract correct KB and decrypt SKE.EncKBDBio in the smart card SC. Therefore, the attacker is not able to derive the correct Tag without KB or DK. When the security level is 2, NRF verifies if HashRN3⊕T3=?M1=HashHashD⊕HashPW′⊕RN4⊕DE⊕T3. As a result of PW′=PW,M1=HashHashD⊕HashPW⊕RN4⊕DE⊕T3=HashHashD¯⊕DE⊕T3=HashRN3⊕T3Due to the collision resistance of hash function, an adversary cannot derive correctM1 without the user random password. When the security level is 3, the complete authentication process is executed between C and NRF.


## 6.1.2. Authentication ofNRF to C

When the security level is 1,C verifies NRF by checking MK=?HashHashDK⊕RN5T2. The attacker cannot extract DK from smart card or NRF’s database without KB or SKC. When the security level is 2, C checks if HashHashD⊕HashPW′⊕RN4⊕DEnew⊕T4=M2 and HashHashD⊕HashPW′⊕RN4⊕D¯new⊕T4=M3. Here, M3 and M2 are calculated with the server’s secret parameters SKC,RN3. Attackers cannot disguise legitimate NRF to cheat C without the secret parameters. Similarly, C runs the above two subprotocols of authentication when SR is 3.


## 6.1.3. Session Key Agreement

In the session key agreement phase,KC sent to NRF and KNRF sent to C are composed of the hashed authentication secret information and string generated by using the ECDH algorithm. Firstly, without biometrics Bio, password PW, or NRF’s secret information RN3, an adversary is unable to deduce aP or bP from KNRF and KC. Secondly, even if an adversary obtained the part of the user and NRF’s data accidentally and calculated the correct aP and bP, he is unfeasible to compute the session key Ks=abP since our proposed scheme is based on the elliptic curve Diffie–Hellman problem (ECDHP) and elliptic curve discrete logarithm problem (ECDLP).


## 6.2. Attack Analysis

The proposed scheme can resist several protocol attacks as follows.


### 6.2.1. Replay Attack

The attacker can disguise the previously transmitted message as a legitimate user and send it to the disguised user. By using the timestamp and the new nonce, our proposed scheme can resist replay attacks. Based on the timestamps and fresh nonces, the proposed scheme can defend against the replay attack. In Steps 1 to 6,C and NRF check the validity of the timestamp from the other side, and the attacker cannot forge the Tag or MK without KB and the private key SKC. In addition, the random numbers RN6 and Tag calculated with RN6 are updated in each session. In Steps 8 to 10, the random numbers RN2, RN3, and RN4 are used for authentication, which are updated at the end of each authentication protocol.


### 6.2.2. Forgery Attack

In our scheme, it is impossible for any attacker to forge the legalMK=HashHashDK⊕RN5T2 without the secret key SKC. Moreover, the calculation results of M2andM3 need to use secret parameters SKC and RN3 kept secretly by NRF. According to the irreversibility of one-way hash function, it is too hard for any attacker to recover one of SKC and RN3 from the public parameters. The attacker has ID′ which is not IDC and hopes to deduce the authentication information from M1, for instance, the password of C in another. The attacker has to find an integer i′ in which i≠i′ satisfying that(5)HashID′⊕PW⊕i′=HashIDC⊕PW⊕i,which is impossible due to the collision resistance of hash function. In the biometric authentication, an adversary cannot obtain the correct biometric data to generate KB and achieve the response challenge.


### 6.2.3. Man-in-the-Middle Attack

In the session key agreement phase, if the attacker hijacks and forges the agreement message between the NRF and user after the authentication phase, the attacker may make man-in-the-middle attack. In the proposed scheme,aP is hidden by the use of HashIDCKBRN6 or HashHashIDCSKC⊕RN3new, and bP is also hidden by the use of HashIDCKBRN6 or HashDnew⊕HashPW⊕RN4new. The attacker cannot drive the middle key taP and tbP from the transmitted messages KC and KNRF over the public channel without possessing the secret KB, password, and RN3.In addition, there are some other attacks aimed at password/smart card authentication protocol. We proved the proposed scheme can resist the following attacks.


### 6.2.4. Stolen Smart Card Attack

When the smart card of a valid user is hijacked by an attacker, first case, even if an attacker obtains a smart card, he cannot guess the password fromD=D¯⊕HashPW⊕RN4 in DC owing to using one-way hash function. In addition, the biometric information is not stored in the smart card in the plaintext but protected and encrypted with KB. To gain the biometric information, the attacker requires to record the biometric information immediately to finish the authentication. To sum up, it is unable for any attacker to complete the authentication when the security level is greater than 0.We summed up the proposed scheme and other related schemes for the protocol security properties. Table2 shows several important security properties of our scheme, scheme in [10], and the standard mechanism proposed by the 3GPP committee including EAP-AKA (marked as AKA) and EAP-TLS (marked as TLS).Table 2
Comparison of security properties.
Yu et al. [10]AKATLSOursMutual authenticationYYYYMultifactor authenticationYNNYKey agreementNYYYAuthorizationNNNYComposability resistingYNNYProtocol attack resistingYNNYDictionary attack resistingN——YStolen smart card attackYNNY


## 6.2.1. Replay Attack

The attacker can disguise the previously transmitted message as a legitimate user and send it to the disguised user. By using the timestamp and the new nonce, our proposed scheme can resist replay attacks. Based on the timestamps and fresh nonces, the proposed scheme can defend against the replay attack. In Steps 1 to 6,C and NRF check the validity of the timestamp from the other side, and the attacker cannot forge the Tag or MK without KB and the private key SKC. In addition, the random numbers RN6 and Tag calculated with RN6 are updated in each session. In Steps 8 to 10, the random numbers RN2, RN3, and RN4 are used for authentication, which are updated at the end of each authentication protocol.


## 6.2.2. Forgery Attack

In our scheme, it is impossible for any attacker to forge the legalMK=HashHashDK⊕RN5T2 without the secret key SKC. Moreover, the calculation results of M2andM3 need to use secret parameters SKC and RN3 kept secretly by NRF. According to the irreversibility of one-way hash function, it is too hard for any attacker to recover one of SKC and RN3 from the public parameters. The attacker has ID′ which is not IDC and hopes to deduce the authentication information from M1, for instance, the password of C in another. The attacker has to find an integer i′ in which i≠i′ satisfying that(5)HashID′⊕PW⊕i′=HashIDC⊕PW⊕i,which is impossible due to the collision resistance of hash function. In the biometric authentication, an adversary cannot obtain the correct biometric data to generate KB and achieve the response challenge.


## 6.2.3. Man-in-the-Middle Attack

In the session key agreement phase, if the attacker hijacks and forges the agreement message between the NRF and user after the authentication phase, the attacker may make man-in-the-middle attack. In the proposed scheme,aP is hidden by the use of HashIDCKBRN6 or HashHashIDCSKC⊕RN3new, and bP is also hidden by the use of HashIDCKBRN6 or HashDnew⊕HashPW⊕RN4new. The attacker cannot drive the middle key taP and tbP from the transmitted messages KC and KNRF over the public channel without possessing the secret KB, password, and RN3.In addition, there are some other attacks aimed at password/smart card authentication protocol. We proved the proposed scheme can resist the following attacks.


## 6.2.4. Stolen Smart Card Attack

When the smart card of a valid user is hijacked by an attacker, first case, even if an attacker obtains a smart card, he cannot guess the password fromD=D¯⊕HashPW⊕RN4 in DC owing to using one-way hash function. In addition, the biometric information is not stored in the smart card in the plaintext but protected and encrypted with KB. To gain the biometric information, the attacker requires to record the biometric information immediately to finish the authentication. To sum up, it is unable for any attacker to complete the authentication when the security level is greater than 0.We summed up the proposed scheme and other related schemes for the protocol security properties. Table2 shows several important security properties of our scheme, scheme in [10], and the standard mechanism proposed by the 3GPP committee including EAP-AKA (marked as AKA) and EAP-TLS (marked as TLS).Table 2
Comparison of security properties.
Yu et al. [10]AKATLSOursMutual authenticationYYYYMultifactor authenticationYNNYKey agreementNYYYAuthorizationNNNYComposability resistingYNNYProtocol attack resistingYNNYDictionary attack resistingN——YStolen smart card attackYNNY


## 6.3. Scyther Simulation

The formal verification tool Scyther [25] is employed to verify security simulation analysis of our proposed scheme. Scyther is a tool which can be used to find problems that arise from the way the protocols are constructed and support multiprotocol parallel analysis. Scyther tool has a clear description of the state set trajectory. Based on the model improvement algorithm, Scyther is conveniently used to protocol attack search, role execution, and security proof. Scyther uses a set of claims to represent many security goals such as secrecy and several authentications including aliveness, weak agreement, agreement, and synchronization. Secret claim is used to mean confidentiality and expresses that certain information is not revealed to an adversary, even though these data are communicated over an untrusted network. In order to provide different degrees of authentication strength, several forms of authentication claims including Alive, Weakagree, Niagree (noninjective agree), and Nisynch (noninjective synchronization) are employed to detect potential protocol attacks such as replay, reflection, and man-in-the-middle attacks. For a detailed description of the formal definition of all Scyther claims, please see [26].In our proposed scheme, there are two main roles: UE and NRF; they represent the userC’s equipment and network repository function NRF, respectively. Since the register of our proposed protocol is supposed to be secure, we only consider the three-factor authentication and session key agreement phase. We structure the proposed scheme in the Security Protocol Description Language (SPDL) to describe and analyze protocols and specify the security properties of our proposed scheme by a series of claims of Scyther as shown in Figure 6. Here, the Dolev–Yao intruder model is employed in which the attacker can completely control the network and conduct a series of attacks to be the implementation scenario of the proposed scheme. According to Figure 6, our scheme successfully makes certain all Scyther secrecy and authentication claims; moreover, there are no attacks found under the verification of the Scyther tool.Figure 6
Formal verification results under the test of the Scyther tool.


## 6.4. Authentication Proof Using BAN Logic

We use the BAN logic [27] to prove the security of our proposed protocol. By our proposed scheme, the authentication and session key process when SR=3 is composed of the biometrics and smart card authentication (SR=1) and password and smart card authentication process (SR=2) as shown in Section 4. Therefore, if both the biometrics authentication and password authentication process are demonstrated to achieve security goals, the complete authentication process (SR=3) can also be proven to achieve security goals obviously. Consequently, we mainly demonstrate the security of the biometrics and smart card authentication process and password and smart card authentication process, respectively.


### 6.4.1. Biometrics and Smart Card Authentication

According to the analytic procedures of the BAN logic, the biometrics and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCFirstly, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPKBRN6(ii)
Msg 2.C⟶NRF:bPKBRN6,aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsSecondly, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KBC(vi)
A6.C|≡NRF↔KBCBased on the assumptions and the rules of the BAN logic, the proofs are presented as follows.According to Msg 1, we have(6)C⊲aPKBRN6.Before the key agreement process, userC has verified the NRF’s signature by using the public key of NRF. With the successful confirmation, A6, and the message-meaning rule, we can derive(7)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(8)C|≡♯aP.Based on the nonce verification rule, we can derive(9)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(10)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(11)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2. From Msg 3, we have(12)C⊲bPKs.According to Goal 1 we have proved and the message-meaning rule, we can derive(13)C|≡NRF|∼bP.Based on A2, the random number and freshness rule, and the nonce verification rule, we can derive(14)C|≡NRF|≡bP.According toC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(15)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


### 6.4.2. Password and Smart Card Authentication

According to the analytic procedures of the BAN logic, the password and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCAgain, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPhhIDCSKC⊕RN3new(ii)
Msg 2.C⟶NRF:bPhDnew⊕hPW⊕RN4new, aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsIn the same way, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KPC(vi)
A6.C|≡NRF↔KPCSpecifically,KP is defined by the use of the sharing secret between NRF and C, KP=hDnew⊕hPW⊕RN4new=hhIDCSKC⊕RN3new.According to Msg 1, we have(16)C⊲aPhhIDCSKC⊕RN3new.This is the equivalent as follows:(17)C⊲aPKP.Before the key agreement process, userC has verified the NRF by using the secret information RN3. With the successful confirmation, A6, and the message-meaning rule, we can derive(18)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(19)C|≡♯aP.Based on the nonce verification rule, we can derive(20)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(21)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(22)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2.From Msg 3, we have(23)C⊲bPKs.Based on Goal 1 we have proved and the message-meaning rule, we can derive(24)C|≡NRF|∼bP.According to A2, the random number and freshness rule, and the nonce verification rule, we can derive(25)C|≡NRF|≡bP.FromC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(26)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


## 6.4.1. Biometrics and Smart Card Authentication

According to the analytic procedures of the BAN logic, the biometrics and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCFirstly, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPKBRN6(ii)
Msg 2.C⟶NRF:bPKBRN6,aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsSecondly, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KBC(vi)
A6.C|≡NRF↔KBCBased on the assumptions and the rules of the BAN logic, the proofs are presented as follows.According to Msg 1, we have(6)C⊲aPKBRN6.Before the key agreement process, userC has verified the NRF’s signature by using the public key of NRF. With the successful confirmation, A6, and the message-meaning rule, we can derive(7)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(8)C|≡♯aP.Based on the nonce verification rule, we can derive(9)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(10)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(11)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2. From Msg 3, we have(12)C⊲bPKs.According to Goal 1 we have proved and the message-meaning rule, we can derive(13)C|≡NRF|∼bP.Based on A2, the random number and freshness rule, and the nonce verification rule, we can derive(14)C|≡NRF|≡bP.According toC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(15)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


## 6.4.2. Password and Smart Card Authentication

According to the analytic procedures of the BAN logic, the password and smart card authentication protocol must satisfy the following goals:(i)
Goal 1.C|≡NRF↔KsC(ii)
Goal 2.NRF|≡NRF↔KsC(iii)
Goal 3.C|≡NRF|≡NRF↔KsC(iv)
Goal 4.NRF|≡C|≡NRF↔KsCAgain, the protocol is described in the following idealized form:(i)
Msg 1.NRF⟶C:aPhhIDCSKC⊕RN3new(ii)
Msg 2.C⟶NRF:bPhDnew⊕hPW⊕RN4new, aPKs, where Ks=abP(iii)
Msg 3.NRF⟶C:bPKsIn the same way, we make the following initial status and hypotheses:(i)
A1.NRF|≡♯a(ii)
A2.C|≡♯b(iii)
A3.NRF|≡C|⇒b(iv)
A4.C|≡NRF|⇒a(v)
A5.NRF|≡NRF↔KPC(vi)
A6.C|≡NRF↔KPCSpecifically,KP is defined by the use of the sharing secret between NRF and C, KP=hDnew⊕hPW⊕RN4new=hhIDCSKC⊕RN3new.According to Msg 1, we have(16)C⊲aPhhIDCSKC⊕RN3new.This is the equivalent as follows:(17)C⊲aPKP.Before the key agreement process, userC has verified the NRF by using the secret information RN3. With the successful confirmation, A6, and the message-meaning rule, we can derive(18)C|≡NRF|∼aP.Based on the random number and freshness rule, A1, and A4, we can derive(19)C|≡♯aP.Based on the nonce verification rule, we can derive(20)C|≡NRF|≡aP.According to A4 and the jurisdiction rule, we can derive(21)C|≡aP.C can compute Ks=b∗aP, and according to the belief rule, we can derive Goal 1:(22)C|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 2.From Msg 3, we have(23)C⊲bPKs.Based on Goal 1 we have proved and the message-meaning rule, we can derive(24)C|≡NRF|∼bP.According to A2, the random number and freshness rule, and the nonce verification rule, we can derive(25)C|≡NRF|≡bP.FromC|≡NRF|≡aP and the belief rule, we can derive Goal 3:(26)C|≡NRF|≡NRF↔KsC.Equally, according to Msg 2 and the same deductions, we can derive Goal 4.


## 7. Performance Analysis

This section evaluates the performance of our proposed scheme including the efficiency parameters’ computational cost, storage cost, and communication cost by comparing our proposed scheme with the effective three-factor authentication scheme in [10] and the current 3GPP standard [5]. Since the 3GPP committee employs the Extensible Authentication Protocol (EAP) as the identity authentication architecture to achieve the user authentication for services and applications, we mainly compare our proposed scheme with the typical EAP including EAP-AKA and EAP-TLS to evaluate the performance.Without loss of generality, we set that the system adopts AES as the symmetric encryption algorithm and elliptic curve digital signature (ECDSA) as the digital signature algorithm. Meanwhile, bothID and PW are 128 bits in length. We assume the request and response information is 16 bits (2 bytes). To achieve the same security level with AES 128 bits, we assume that the key size for algorithms based on ECC is 256 bits [28]. Moreover, the output of the hash function is 128 bits, the length of the random number is 128 bits, and the size of the timestamp is 32 bits [29].On the computational cost, we mainly refer to the time consumed by each cryptographic algorithm or operation including the hash operationNh, symmetric encryption (or decryption) operation SKE, digital signing operation Sign, and verification operation SigVer, respectively. We test the above operations or algorithms on a laptop PC with Intel (R) Core i5-4210U 1.70 GHz CPU as a server and Huawei Mate 40 device with Kirin 9000 5G SOC 3.13GHZ processor as a client by using the Eclipse Java IDE. The testing results are shown in Table 3. Table 4 shows the comparison of the computational cost of related schemes. According to Table 4, our scheme outperforms the scheme in [10] and EAP-TLS. When SR=3, the computational cost of our scheme is little larger than that in EAP-AKA for flexibility and security.Table 3
Computational cost of the cryptography operations (μs).
OperationSymbolClientServerHashNh21.90.429Symmetric encryptionSKE36.70.713Digital signingSign7755.6102Signing verificationSigVer11919.1173.4Table 4
Computational cost (μs).
ClientServerOurs:SR=000Ours:SR=15Nh+1SKE=146.25Nh+2SKE=3.571Ours:SR=212Nh=262.89Nh=3.861Ours:SR=317Nh+1SKE=40914Nh+2SKE=7.432Yu et al. [10]3Nh+1SigVer+1SKE+2Sign=27532.74Nh+2SigVer+1SKE+1Sign=451.2EAP-AKA5SKE=183.55SKE=3.565EAP-TLS4Nh+1SignVer+2SKE=12080.14Nh+1SignVer+2SKE=176.542On the storage cost, the client has to preserveDBio,DC stored in the smart card. The total storage overheads of related schemes are shown in Table 5. From Table 5, the overall storage overhead of our proposed scheme is lower than that of EAP-TLS, which is little larger than that of EAP-AKA and the scheme in [10]. Some additional overheads are involved because of the multifactor authentication and protocol flexibility.Table 5
Storage cost (bytes).
ClientServerMemory contentsDBio,DCDBio¯,DCStorage space in ours134134Storage space in [10]8096Storage space in EAP-AKA3232Storage space in EAP-TLS480480On the communication overhead, our complete authentication protocol runs 4 message exchanges. According to the size of all of interaction messages, we compared the communication overhead in each security level of the proposed scheme with the scheme in [10], EAP-AKA, and EAP-TLS as shown in Table 6. From Table 6, the communication cost of our scheme is major observable better than that of the scheme in [10] and EAP-TLS, which is little larger than that of the EAP-AKA.Table 6
Communication overhead (bytes).
TaskRoundsOverheadOurs:SR=0218+2=20Ours:SR=1520+36+36+20=112Ours:SR=2420+68+84=172Ours:SR=3720+92+152=264Yu et al. [10]5558EAP-AKA576EAP-TLS10986Performance with attacks: we analyze the performance of our proposed protocols when there are unknown attacks or uncertain attacks. We do not know when the unknown/uncertain attacks occur either. To be precise, we assume that the probability of unknown attacks occurred in thei step is 1/nmsg, where nmsg is the number of signal messages in one execution of protocols. Considering the consistency, we elaborately evaluate the authentication computational cost of our scheme when the attacks occur, and other performance evaluations with attacks are the same as that of the computational cost. We define an instability index ISI to evaluate the influence of performance with attacks for one success execution of the protocol, which is described as follows, where Ci represents the total computational cost before the attack occurs in the i step and Cscs shows the total computational cost for one success execution of the protocol with no attack.(27)ISI=p×∑i=1nmsg1/nmsgCi+1−p×Cscs1−p×Cscs.For our proposed protocol whenSR is 0, 1, 2, and 3, respectively, ISIs are shown as follows:(28)ISISR0=1,ISISR1=221726p12853551−p+1,ISISR2=227061p18010441−p+1,ISISR3=889481p49513241−p+1.For the scheme in [10],(29)ISIYu=97468738p1991610001−p+1.For the scheme in EAP-AKA,(30)ISIAKA=685695p85266251−p+1.For the scheme in EAP-TLS,(31)ISITLS=4533024p91517711−p+1.Figure7 shows the result of instability index ISI of different security-level authentication process and other related schemes. According to Figure 7, no matter what SR is, our scheme outperforms the scheme in [10] and EAP-TLS even if there are some unknown attacks occurred. However, the instability index of our scheme is little higher than that of EAP-AKA due to the introduction of the multiple authentication factors of the proposed scheme. ISI of different security levels in our scheme is close to each other, and it is a good sign that the computation overheads of the three authentication phases are evenly distributed. Therefore, our scheme has better performance under the unknown attacks.Figure 7
Comparison of the ISI of the authentication protocols.Based on the above results of comparison and analysis, our scheme outperforms the scheme in [10] and EAP-TLS in terms of computation cost, communication overhead, and stability under unknown attacks without the loss of flexibility and security. Our proposed scheme requires more storage than EAP-AKA and the scheme in [10] because of the composability of the authentication process. The overall performance of our scheme is worse than the EAP-AKA’s; however, the proposed scheme can achieve more types of security properties, such as multifactor authentication, protocol composability, and resisting protocol attacks.


## 8. Conclusions

This paper presents an efficient and dynamically composable service authentication and authorization mechanism in 5G multiservice systems. By integrating and utilizing three authentication factors subtly, our proposed scheme is able to achieve four security intensities for different 5G application scenarios as well as session key agreement independently, and that greatly reduces system complexity. Based on the 3GPP SBA and our proposed protocol, we design an authorization process to implement service access control. We have corroborated that the proposed mechanism can achieve the ideal efficiency, meanwhile, realize the mutual authentication and service authorization, and resist the password guessing attack, stolen smart card attack, and existing protocol attacks.



---

*Source: 6697155-2021-04-19.xml*