Privacy-preserved mutually-trusted 5G communications in presence of pervasive attacks

Abstract

Ensuring secure fifth-generation (5G) cellular communications is crucial for protecting the privacy of Internet of Things (IoT) devices, especially wearables that can disclose sensitive information if the communication stream is compromised. Confidentiality must be maintained for personal health metrics, location data, and other private information transmitted over cellular networks. Users inherently trust cellular infrastructure protocols to deliver robust security. Therefore, the security provided by 5G networks is indispensable, as it mitigates cyber threats and ensures the integrity and confidentiality of data collected and transmitted by wearables and other IoT devices, thereby upholding user privacy in the increasingly connected IoT ecosystem. The 5G Authentication and Key Agreement (5G-AKA) protocol builds upon and enhances its fourth-generation (4G) predecessor to address and proactively mitigate inherited vulnerabilities. However, it still faces multiple vulnerabilities, primarily due to the lack of mutual authentication in the access and the unprotected signaling during the 5G-AKA procedure further increases exposure. This paper highlights vulnerabilities in the 5G-AKA protocol related to user privacy and data availability, particularly those emerging during bootstrapping and from unprotected messages within the AKA procedure. We propose security enhancements within the bootstrapping and 5G-AKA procedures to address the lack of authentication between the User Equipment (UE) and the Serving Network (SN) and to encapsulate unprotected messages within the 5G-AKA signaling. To demonstrate the effectiveness of our proposed security enhancements, we conduct both qualitative and formal security analyses. Furthermore, the proposed authentication algorithm is implemented as a part of a 5G-based communication simulation to investigate the increased computational and communication delays associated with the proposed security enhancements.