Defeating the downgrade attack on identity privacy in 5G

Mohsin Khan; Philip Ginzboorg; Kimmo Järvinen; Valtteri Niemi

doi:10.1007/978-3-030-04762-7_6

Defeating the downgrade attack on identity privacy in 5G

Mohsin Khan^*, Philip Ginzboorg, Kimmo Järvinen, Valtteri Niemi

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

19 Citations (Scopus)

291 Downloads (Pure)

Abstract

3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.

Original language	English
Title of host publication	Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings
Editors	Cas Cremers, Anja Lehmann
Publisher	Springer
Pages	95-119
Number of pages	25
ISBN (Print)	9783030047610
DOIs	https://doi.org/10.1007/978-3-030-04762-7_6
Publication status	Published - 1 Jan 2018
MoE publication type	A4 Conference publication
Event	Conference on Security Standards Research - Darmstadt, Germany Duration: 26 Nov 2018 → 27 Nov 2018 Conference number: 4

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11322 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Conference on Security Standards Research
Abbreviated title	SSR
Country/Territory	Germany
City	Darmstadt
Period	26/11/2018 → 27/11/2018

Keywords

3GPP
5G
Identity privacy
IMSI catchers
Pseudonym

Access to Document

10.1007/978-3-030-04762-7_6

Defeating the downgrade attack on identity privacy in 5G_SSR_2018Accepted author manuscript, 546 KB

Cite this

Khan, M., Ginzboorg, P., Järvinen, K., & Niemi, V. (2018). Defeating the downgrade attack on identity privacy in 5G. In C. Cremers, & A. Lehmann (Eds.), Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings (pp. 95-119). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11322 LNCS). Springer. https://doi.org/10.1007/978-3-030-04762-7_6

Khan, Mohsin ; Ginzboorg, Philip ; Järvinen, Kimmo et al. / Defeating the downgrade attack on identity privacy in 5G. Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings. editor / Cas Cremers ; Anja Lehmann. Springer, 2018. pp. 95-119 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{d4ba02ed2bf14f948f0f4d4150d4df61,

title = "Defeating the downgrade attack on identity privacy in 5G",

abstract = "3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.",

keywords = "3GPP, 5G, Identity privacy, IMSI catchers, Pseudonym",

author = "Mohsin Khan and Philip Ginzboorg and Kimmo J{\"a}rvinen and Valtteri Niemi",

year = "2018",

month = jan,

day = "1",

doi = "10.1007/978-3-030-04762-7_6",

language = "English",

isbn = "9783030047610",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "95--119",

editor = "Cas Cremers and Anja Lehmann",

booktitle = "Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings",

address = "Germany",

note = "Conference on Security Standards Research, SSR ; Conference date: 26-11-2018 Through 27-11-2018",

}

Khan, M, Ginzboorg, P , Järvinen, K & Niemi, V 2018, Defeating the downgrade attack on identity privacy in 5G. in C Cremers & A Lehmann (eds), Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11322 LNCS, Springer, pp. 95-119, Conference on Security Standards Research, Darmstadt, Germany, 26/11/2018. https://doi.org/10.1007/978-3-030-04762-7_6

Defeating the downgrade attack on identity privacy in 5G. / Khan, Mohsin; Ginzboorg, Philip ; Järvinen, Kimmo et al.
Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings. ed. / Cas Cremers; Anja Lehmann. Springer, 2018. p. 95-119 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11322 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - Defeating the downgrade attack on identity privacy in 5G

AU - Khan, Mohsin

AU - Ginzboorg, Philip

AU - Järvinen, Kimmo

AU - Niemi, Valtteri

N1 - Conference code: 4

PY - 2018/1/1

Y1 - 2018/1/1

N2 - 3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.

AB - 3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.

KW - 3GPP

KW - 5G

KW - Identity privacy

KW - IMSI catchers

KW - Pseudonym

UR - http://www.scopus.com/inward/record.url?scp=85057777554&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-04762-7_6

DO - 10.1007/978-3-030-04762-7_6

M3 - Conference article in proceedings

AN - SCOPUS:85057777554

SN - 9783030047610

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 95

EP - 119

BT - Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings

A2 - Cremers, Cas

A2 - Lehmann, Anja

PB - Springer

T2 - Conference on Security Standards Research

Y2 - 26 November 2018 through 27 November 2018

ER -

Khan M, Ginzboorg P , Järvinen K, Niemi V. Defeating the downgrade attack on identity privacy in 5G. In Cremers C, Lehmann A, editors, Security Standardisation Research - 4th International Conference, SSR 2018, Proceedings. Springer. 2018. p. 95-119. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-04762-7_6

Defeating the downgrade attack on identity privacy in 5G

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this