A Formal Analysis of 5G Authentication (1806.10360v4)

Abstract: Mobile communication networks connect much of the world's population. The security of users' calls, SMSs, and mobile data depends on the guarantees provided by the Authenticated Key Exchange protocols used. For the next-generation network (5G), the 3GPP group has standardized the 5G AKA protocol for this purpose. We provide the first comprehensive formal model of a protocol from the AKA family: 5G AKA. We also extract precise requirements from the 3GPP standards defining 5G and we identify missing security goals. Using the security protocol verification tool Tamarin, we conduct a full, systematic, security evaluation of the model with respect to the 5G security goals. Our automated analysis identifies the minimal security assumptions required for each security goal and we find that some critical security goals are not met, except under additional assumptions missing from the standard. Finally, we make explicit recommendations with provably secure fixes for the attacks and weaknesses we found.

• The paper demonstrates that key authentication goals in the 5G AKA protocol fail without extra, non-standardized assumptions.
• It reveals implicit authentication weaknesses, where the protocol relies on subsequent procedures that may not fully secure communication.
• The formal model exposes privacy risks like subscriber traceability, urging explicit protocol enhancements in 5G standards.

A Formal Analysis of 5G Authentication

The paper "A Formal Analysis of 5G Authentication" presents a rigorous examination of the 5G AKA protocol, a crucial component of mobile telecommunication security. The authors focus on the protocol's ability to provide mutual authentication between subscribers and the network, thus securing user data, calls, and SMS communications. Their analysis identifies both strengths and deficiencies in the current 5G AKA protocol, emphasizing the theoretical assumptions and security goals stipulated by the 3rd Generation Partnership Project (3GPP) standards.

Methodology and Results

The researchers embarked on constructing the first comprehensive formal model of 5G AKA using Tamarin, a security protocol verification tool. This model accurately reflects the protocol's complexity, including its statefulness, use of sequence numbers (SQNs), and cryptographic functions. Through systematic analysis, they identify the minimal security assumptions necessary for each security goal. Crucially, some of these goals are unmet without additional, non-standardized assumptions.

Key Findings:

• Critical Security Goal Violations: The authors reveal that critical authentication properties are not satisfied unless additional assumptions are made, which the 5G standard does not explicitly require. Notably, agreement properties on session keys are lacking, posing potential security risks.
• Implicit Authentication Flaws: The 5G AKA protocol relies on implicit authentication, assuming subsequent procedures will confirm security. This design choice may be problematic if future procedures fail to enforce these confirmations.
• Privacy Concerns: They highlight a privacy attack enabling traceability of subscribers by active attackers, indicating a need for improved protections against such threats.

Implications

The findings have practical implications for the deployment and improvement of 5G networks. The identification of security gaps and underspecified standards should prompt changes in the 5G protocol specifications to ensure stronger security guarantees. Furthermore, the emphasis on privacy protection highlights the necessity for ongoing advancements in securing user identity and location data against both passive and active threats.

Recommendations

To address the identified issues, the paper suggests several recommendations:

• Explicit Security Assumptions: The standards should clearly specify required security assumptions, such as binding communications between serving and home networks.
• Protocol Modifications: Consider alterations to the protocol to embed explicit confirmation mechanisms that do not rely on future key confirmation phases.
• Privacy Enhancements: Move towards designing authentication protocols that protect privacy against active attackers as well, by possibly employing more resilient cryptographic techniques.

Future Developments

With the evolving nature of 5G standards, this analysis serves as a foundational step towards enhancing protocol security. Future work could include the examination of other AKA protocol variants from previous network generations (3G, 4G) to assess progression or regression in security guarantees. The presented formal model can also facilitate rapid evaluation of new proposals or modifications within the standards, thus streamlining the transition to more secure telecommunications frameworks.

In summary, this paper provides a critical and detailed examination of the 5G AKA protocol's security posture, offering essential insights for its refinement and future-proofing in the wake of increasing security demands.