5. In a mobile roaming system, there are three entities: a mobile user U, its home server H, and a foreign server V. The mobile user U, who is subscribed to the home server H, is currently in a foreign network administered by the foreign server V. There is a direct link between U and V, and another direct link between V and H. However, there is no direct link between U and H. In order to obtain the services provided by V, U must be authenticated by V (with the help from H).

Suppose that the mobile user U shares a symmetric key KUH with its home server H. The home server H and the foreign server V also have public keys PKH and PKV that are certified by a trusted CA (H and V both have certificates). You task is to design a secure authentication and key establishment protocol which can satisfy the following security requirements.

a. User authentication: the foreign server must be sure that U is a legitimate
subscriber of H.

b. Server authentication: the user must be sure that V is indeed the real foreign server. (In the view of the user, the foreign server is V)

c. Secure key agreement: U and V will establish a fresh session key at the end of the protocol. The session key can only be known by U and V (i.e., H cannot know the session key).

d. Anonymity & unlinkability: Besides the user and the home server, no one
including the foreign server can tell the real identity of the user (i.e., the foreign server V only knows that U is a valid user of H, but does not know U’s real identity) or link two sessions belonging to the same user.

You can assume that all the entities (H, V, and U) can perform public key operations. However, only H and V have certified public keys.

Describe each step of your protocol clearly and then provide justifications for each of the security requirements given above.

---