Defeating IMSI Catchers

Abstract

IMSI catching is a problem on all generations of mobile telecommunication networks, i.e., 2G (GSM, GPRS), 3G (HDSPA, EDGE, UMTS) and 4G (LTE, LTE+). Currently, the SIM card of a mobile phone has to reveal its identity over an insecure plaintext transmission, before encryption is enabled. This identifier (the IMSI) can be intercepted by adversaries that mount a passive or active attack. Such identity exposure attacks are commonly referred to as 'IMSI catching'. Since the IMSI is uniquely identifying, unauthorized exposure can lead to various location privacy attacks. We propose a solution, which essentially replaces the IMSIs with changing pseudonyms that are only identifiable by the home network of the SIM's own network provider. Consequently, these pseudonyms are unlinkable by intermediate network providers and malicious adversaries, and therefore mitigate both passive and active attacks, which we also formally verified using ProVerif. Our solution is compatible with the current specifications of the mobile standards and therefore requires no change in the infrastructure or any of the already massively deployed network equipment. The proposed method only requires limited changes to the SIM and the authentication server, both of which are under control of the user's network provider. Therefore, any individual (virtual) provider that distributes SIM cards and controls its own authentication server can deploy a more privacy friendly mobile network that is resilient against IMSI catching attacks.

Analysis of User Identity Privacy in LTE and Proposed Solution

“…The IMSI can be intercepted by adversaries. Such attacks are commonly referred to as "IMSI catching" [13]. To protect the user identity privacy, the LTE allocates various different temporary identities such as GUTI, M-TMSI, and C-RNTI to a single UE within LTE network architecture for different networking services.…”

“…The authors in [13] propose a solution where the IMSI is replaced with a changing pseudonym that only the home network can link to the user's identity. This hiding of the IMSI is done without changing any of the system messages.…”

“…Our solution requires the HSS to store only two additional values for each UE: C and CNEW and the UE to store only one additional value: CMSI. As the solution in [13] requires storing more additional values at the HSS and the UE, it is obvious that the memory cost in [13] is higher. (b) The solution in [13] requires that HSS and each UE must have an additional shared secret key κ to encrypt PMSI.…”

“…As the solution in [13] requires storing more additional values at the HSS and the UE, it is obvious that the memory cost in [13] is higher. (b) The solution in [13] requires that HSS and each UE must have an additional shared secret key κ to encrypt PMSI. The compromising of the key κ will lead to compromising the entire method.…”

“…Using SQN as a key has an advantages: (1) no additional key is required to conceal the key; (2) as SQN is changing key, the threats of breaching the privacy by knowing SQN value is minimized. (c) Another difference with [13] lies in the sequence number management. Their approach always increases the sequence number at HSS, which would enable an adversary to mount denial of service attack DoS against the HSS.…”