The current way of protecting privacy does not provide any protection against an active attacker on the air-interface, claiming to be a legitimate network that has lost the temporary identity. Moreover, there is also no protection against passive eavesdroppers who are present when requests for International Mobile Subscriber Identity (IMSI) are made. This paper presents a new method for protecting the IMSI by means of establishing a pseudonym between the user equipment and the home network. The pseudonym is derived locally at the user equipment and the home network without affecting existing Universal Subscriber Identity Modules (USIMs). We analyse the solution from a technical perspective, as well as from a regulatory and operational perspective. The presented method protects the IMSI from passive and active IMSI-catchers as well as honest but curious serving networks. Moreover, it can recover from lock-out situations where one party has lost the pseudonym.
Authors
Karl Norrman, Mats Näslund, Elena Dubrova
Presented at the 2nd IEEE International Workshop on 5G Security in connection to Mobimedia, Xian, China June 18-19, 2016 © 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.