Active Attack Resilience in 5G: A New Take on Authentication and Key Agreement

2025-07-23

AI Summary

5G-AKA, the current 5G authentication cornerstone, suffers from three critical weaknesses: vulnerability to active attacks, reliance on sequence numbers—inducing substantial state-synchronization overhead and susceptibility to desynchronization—and absence of perfect forward secrecy (PFS), rendering past session keys compromisable upon long-term key exposure. This paper proposes a novel, infrastructure-compatible, stateless authentication and key agreement protocol. It eliminates sequence numbers to achieve lightweight PFS. Built upon the 5G-AKA framework, the protocol is formally verified using ProVerif to satisfy both 3GPP and academic security requirements against passive and active adversaries. Prototype evaluation demonstrates that the protocol significantly enhances resilience against active attacks and provides strong PFS, while maintaining bounded computational and communication overhead and improving system scalability.

Technology Category

• Multiagent Systems: Agreement, Argumentation & Negotiation
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Philosophy and Ethics of AI: Privacy & Security

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments

Abstract

As 5G networks expand into critical infrastructure, secure and efficient user authentication is more important than ever. The 5G-AKA protocol, standardized by 3GPP in TS 33.501, is central to authentication in current 5G deployments. It provides mutual authentication, user privacy, and key secrecy. However, despite its adoption, 5G-AKA has known limitations in both security and performance. While it focuses on protecting privacy against passive attackers, recent studies show its vulnerabilities to active attacks. It also relies on a sequence number mechanism to prevent replay attacks, requiring perfect synchronization between the device and the core network. This stateful design adds complexity, causes desynchronization, and incurs extra communication overhead. More critically, 5G-AKA lacks Perfect Forward Secrecy (PFS), exposing past communications if long-term keys are compromised-an increasing concern amid sophisticated threats. This paper proposes an enhanced authentication protocol that builds on 5G-AKA's design while addressing its shortcomings. First, we introduce a stateless version that removes sequence number reliance, reducing complexity while staying compatible with existing SIM cards and infrastructure. We then extend this design to add PFS with minimal cryptographic overhead. Both protocols are rigorously analyzed using ProVerif, confirming their compliance with all major security requirements, including resistance to passive and active attacks, as well as those defined by 3GPP and academic studies. We also prototype both protocols and evaluate their performance against 5G-AKA and 5G-AKA' (USENIX'21). Our results show the proposed protocols offer stronger security with only minor computational overhead, making them practical, future-ready solutions for 5G and beyond.

Problem

• Enhancing 5G-AKA security against active attacks
• Eliminating sequence number reliance to reduce complexity
• Adding Perfect Forward Secrecy with minimal overhead

Innovation

• Stateless design eliminates sequence number reliance
• Adds Perfect Forward Secrecy with minimal overhead
• ProVerif-verified security against active/passive attacks