![](bg8.png)
• After receiving the Handover Command message
from Source gNB during the Handover Execu-
tion stage, UE will initially derive the session
key K
gNB*
, and then derive the unique session
key (K
gNB**
) using the key material (˜Akey) and
K
gNB*
.
• If the authentication is successful, then the UE
will send the RRC Reconfiguration Completion
message to the Target gNB.
In the final stage, Handover Completion stage, we
follow the original Xn handover procedure.
7 CONCLUSIONS AND FUTURE
WORK
Forward security plays a vital role in 5G Xn han-
dovers. It guarantees security for future handovers.
The failure of the proof of forward security during 5G
Xn handovers reveals the strong attack surface that
allows intercepting communications while remaining
invisible or unnoticed. Our study shows that the se-
crecy of future handovers strongly depends on the
choice of the session key generation, i.e., hkd, or vkd,
during handovers.
We also present a possible solution to mitigate this
kind of attack to enhance secrecy. While our model
of an untrusted base station is a simplified binary one,
and this classification may, in reality, be more com-
plex policy-based decisions or signaling-based detec-
tion of rogue base stations.
We would like to recall and emphasize that 5G
standards do mandate some security requirements but
also leave some options to operators to promote flex-
ibility. The operators implementing 3GPP standards
that are aware of this security problem may have al-
ready implemented a mitigation of these effects as
part of optional features of their systems. Any such
solution could also be formalized and proved correct
in a similar manner to what we did here. Therefore,
future works may include the assessment of various
other approaches for hardening the security of han-
dover protocols using formal modelling and verifica-
tion.
ACKNOWLEDGEMENTS
This work was funded by ELLIIT, Excellence Center
at Link
¨
oping-Lund on Information Technology.
REFERENCES
3GPP TS 33.501, V17.7.0 (2022). 5G; Security architecture
and procedures for 5G System. 3GPP TS 33.501.
3GPP TS 38.423, V17.1.0 (2022). 5G; NG-RAN; Xn Ap-
plication protocol (XnAP). 3GPP TS38.423.
Basin, D., Cremers, C., Dreier, J., Meier, S., Sasse, R., and
Schmidt, B. Tamarin-prover Manual Security Proto-
col Analysis in the Symbolic Model, 2019.
Bitsikas, E. and P
¨
opper, C. (2021). Don’t hand it over:
Vulnerabilities in the Handover Procedure of Cellular
Telecommunications. In Annual Computer Security
Applications Conference, pages 900–915.
Blanchet, B. (2012). Security protocol verification: Sym-
bolic and Computational models. In International
Conference on Principles of Security and Trust, pages
3–29. Springer.
Dolev, D. and Yao, A. (1983). On the security of public key
protocols. IEEE Transactions on information theory,
29(2):198–208.
Gupta, S., Parne, B. L., Chaudhari, N. S., and Saxena, S.
(2022). SEAI: Secrecy and Efficiency Aware Inter-
gNB Handover Authentication and Key Agreement
Protocol in 5G Communication Network. Wireless
Personal Communications, 122(4):2925–2962.
Huang, J. and Qian, Y. (2020). A secure and efficient
handover authentication and key management proto-
col for 5G networks. Journal of Communications and
Information Networks, 5(1):40–49.
Hussain, S. R., Echeverria, M., Karim, I., Chowdhury, O.,
and Bertino, E. (2019). 5GReasoner: A property-
directed security and privacy analysis framework for
5G cellular network protocol. In Proceedings of the
2019 ACM SIGSAC Conference on Computer and
Communications Security, pages 669–684.
Lowe, G. (1997). A hierarchy of authentication specifica-
tions. In Proceedings 10th computer security founda-
tions workshop, pages 31–43. IEEE.
Meier, S., Schmidt, B., Cremers, C., and Basin, D. (2013).
The TAMARIN prover for the symbolic analysis of
security protocols. In International conference on
computer aided verification, pages 696–701. Springer.
Miller, R., Boureanu, I., Wesemeyer, S., and Newton, C. J.
(2022). The 5G Key-Establishment Stack: In-Depth
Formal Verification and Experimentation. In Proceed-
ings of the 2022 ACM on Asia Conference on Com-
puter and Communications Security, pages 237–251.
Nyangaresi, V. O. and Rodrigues, A. J. (2022). Efficient
handover protocol for 5G and beyond networks. Com-
puters & Security, 113:102546.
Peltonen, A., Sasse, R., and Basin, D. (2021). A compre-
hensive formal analysis of 5G handover. In Proceed-
ings of the 14th ACM Conference on Security and Pri-
vacy in Wireless and Mobile Networks, pages 1–12.
Yan, X. and Ma, M. (2021). NSEHA: a neighbor-based se-
cure and efficient handover authentication mechanism
for 5G networks. In 2021 9th International Confer-
ence on Communications and Broadband Networking,
pages 209–216.
SECRYPT 2023 - 20th International Conference on Security and Cryptography
510