With the continuous development of mobile communication technologies, Third Generation Partnership Project (3GPP) has proposed related standards with the fifth generation mobile communication technology (5G), which marks the official start of the evolution from the current Long Term Evolution (LTE) system to the next generation mobile communication system (5GS). This paper makes a large number of contributions to the security aspects of 3GPP 5G networks. Firstly, we present an overview of the network architecture and security functionality of the 3GPP 5G networks. Subsequently, we focus on the new features and techniques including the support of massive Internet of Things (IoT) devices, Device to Device (D2D) communication, Vehicle to Everything (V2X) communication, and network slice, which incur the huge challenges for the security aspects in 3GPP 5G networks. Finally, we discuss in detail the security features, security requirements or security vulnerabilities, existing security solutions and some open research issues about the new features and techniques in 3GPP 5G network.

With the digitalization of various industries, the combination of cloud computing and the Industrial Internet of Things (IIoT) has become an attractive data processing paradigm. However, cloud-assisted IIoT still has challenging issues including authenticity of data, untrustworthiness of third parties, and system robustness and efficiency. Recently Karati et al. [1] proposed a lightweight certificateless signature (CLS) scheme for cloud-assisted IIoT, that was claimed to address both authenticity of data and untrustworthiness of third parties. In this paper, we demonstrate that the CLS scheme fails to achieve the claimed security properties by presenting four types of signature forgery attacks. We also propose a robust certificateless signature (RCLS) scheme to address the aforementioned challenges. Our RCLS only needs public channels and is proven secure against both public key replacement attacks and malicious-but-passive third parties in the standard model. Performance evaluation indicates that RCLS outperforms other CLS schemes and is suitable for IIoT.

The emergence of Narrowband Internet of Things (NB-IoT) has brought hope for the popularization and application of mobile Internet standards. Nowadays, NB-IoT technology has been introduced into the 3GPP standards, where low-overhead, low-data-transmission IoT devices can securely access the fifth Generation (5G) core network through the 3GPP access network. However, according to the current 3GPP standard, these NB-IoT devices still employ the traditional authentication process of normal User Equipment (UE) to implement mutual authentication between NB-IoT devices and 5G core networks, which brings a lot of communication and storage overhead, and it will be more serious when lots of NB-IoT devices are activated simultaneously. In this paper, we propose a fast mutual authentication and data transfer scheme for massive NB-IoT devices,which integrates the access authentication and secure data transmission process and achieves the authentications and data transmissions of a group of NB-IoT devices at the same time. Our scheme can not only greatly simplify the authentication process and alleviate the load of the networks, but also ensure robust security protection including user anonymity and non-repudiation. The performance analysis results show that the proposed scheme can withstand a variety of security attacks with ideal efficiency.

The NarrowBand Internet of Things (NB-IoT) system has become an integral part of the future fifth generation (5G) network. Although the NB-IoT system has gradually been improved in the traditional LTE network currently, the NB-IoT system does not have an effective access authentication scheme in the future 5G network. According to the current 3GPP standard, NB-IoT devices still use the traditional access authentication method to perform mutual authentication with the network, which may bring a large amount of signaling and communication overhead. This problem will be magnified in a large-scale device environment in the future 5G network. In this paper, a quantum resistance access authentication and data distribution scheme is proposed for large-scale NB-IoT devices. The scheme can simultaneously implement access authentication and data transmission of a group of NB-IoT devices based on the lattice-based homomorphic encryption technology. Our scheme not only greatly reduce the network burden, but also achieve strong security including privacy protection and anti-quantum attacks. The performance analysis results show that our scheme has the ideal efficiency.

Ultra-dense Heterogeneous network (HetNet) technique can significantly improve wireless link quality, spectrum efficiency and system capacity, and satisfy different requirements for coverage in hotspots, which has been viewed as one of the key technologies in fifth Generation (5G) network. Due to the existence of many different types of base stations (BSs) and the complexity of the network topology in the 5G HetNets, there are a lot of new challenges in security and mobility management aspects for this multi-tier 5G architecture including insecure access points and potential frequent handovers among several different types of base stations. In this paper, we integrate user capability and Software Defined Network (SDN) technique, and propose a capability-based privacy protection handover authentication mechanism in SDN-based 5G HetNets. Our proposed scheme can achieve the mutual authentication and key agreement between User Equipments (UEs) and BSs in 5G HetNets at the same time largely reduce the authentication handover cost. We demonstrate that our proposed scheme indeed can provide robust security protection by employing several security analysis methods including the BAN logic and the formal verification tool Scyther. In addition, the performance evaluation results show that our scheme outperforms other existing schemes.

In cloud data sharing systems, Searchable Encryption (SE) schemes ensure data confidentiality with retrieving, but it faces several issues in practice. First, most of the previous Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) systems enable users to initiate search requests with a single keyword, which results in many inaccurate results to be returned, thereby wasting computing and bandwidth resources. Second, untrusted cloud servers may return a small portion of incomplete search results to compress communication overhead. Besides, most CP-ABKS schemes only support an unshared multi-owner setting, which incurs a large amount of computational and storage overhead. Furthermore, when the keyword space is a polynomial, most of the previous schemes suffer from offline keyword guessing attacks. To address these issues, we focus on a multi-keyword search scheme which supports the verification of search results without losing efficiency by combining Ciphertext Policy Attribute-Based Encryption (CP-ABE) technology under the shared multi-owner mechanism. We show the security of our scheme, which achieves selective security against offline keyword guessing attacks and guarantees the unforgeability of signatures. The comparison of experimental results illustrates that our scheme is effective and enjoys superior functionalities than the most relevant solutions.