On De-synchronization of User Pseudonyms in Mobile Networks

Mohsin Khan; Kimmo Järvinen; Philip Ginzboorg; Valtteri Niemi

doi:10.1007/978-3-319-72598-7_22

On De-synchronization of User Pseudonyms in Mobile Networks

Mohsin Khan, Kimmo Järvinen, Philip Ginzboorg, Valtteri Niemi

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

3 Citations (Scopus)

Abstract

This paper is in the area of pseudonym-based enhancements of user identity privacy in mobile networks. Khan and Mitchell (2017) have found that in recently published pseudonym-based schemes an attacker can desynchronize the pseudonyms’ state in the user equipment and in its home network. In this paper, we first show that by exploiting this vulnerability a botnet of mobile devices can kick out of service a large portion of the users of a mobile network. We characterize this novel DDoS attack analytically and confirm our analysis using a simulation. Second, we explain how to modify the pseudonym-based schemes in order to mitigate the DDoS attack. The proposed solution is simpler than that in Khan and Mitchell (2017). We also discuss aspects of pseudonym usage in mobile network from charging and regulatory point of view.

Original language	English
Title of host publication	Information Systems Security. ICISS 2017
Subtitle of host publication	13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings
Editors	R. Shyamasundar, V. Singh, J. Vaidya
Publisher	Springer
Pages	347-366
ISBN (Electronic)	978-3-319-72598-7
ISBN (Print)	978-3-319-72597-0
DOIs	https://doi.org/10.1007/978-3-319-72598-7_22
Publication status	Published - 2017
MoE publication type	A4 Conference publication
Event	International Conference on Information Systems Security - Mumbai, India Duration: 16 Dec 2017 → 20 Dec 2017 Conference number: 13

Publication series

Name	Lecture Notes in Computer Science
Volume	10717

Conference

Conference	International Conference on Information Systems Security
Abbreviated title	ICISS
Country/Territory	India
City	Mumbai
Period	16/12/2017 → 20/12/2017

Keywords

3GPP
IMSI catchers
Pseudonym
Identity
Privacy

Access to Document

10.1007/978-3-319-72598-7_22

Cite this

Khan, M., Järvinen, K., Ginzboorg, P., & Niemi, V. (2017). On De-synchronization of User Pseudonyms in Mobile Networks. In R. Shyamasundar, V. Singh, & J. Vaidya (Eds.), Information Systems Security. ICISS 2017: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings (pp. 347-366). (Lecture Notes in Computer Science; Vol. 10717). Springer. https://doi.org/10.1007/978-3-319-72598-7_22

Khan, Mohsin ; Järvinen, Kimmo ; Ginzboorg, Philip et al. / On De-synchronization of User Pseudonyms in Mobile Networks. Information Systems Security. ICISS 2017: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings. editor / R. Shyamasundar ; V. Singh ; J. Vaidya. Springer, 2017. pp. 347-366 (Lecture Notes in Computer Science).

@inproceedings{8332a6caf5264dc7a828d1ebee9ad48e,

title = "On De-synchronization of User Pseudonyms in Mobile Networks",

abstract = "This paper is in the area of pseudonym-based enhancements of user identity privacy in mobile networks. Khan and Mitchell (2017) have found that in recently published pseudonym-based schemes an attacker can desynchronize the pseudonyms{\textquoteright} state in the user equipment and in its home network. In this paper, we first show that by exploiting this vulnerability a botnet of mobile devices can kick out of service a large portion of the users of a mobile network. We characterize this novel DDoS attack analytically and confirm our analysis using a simulation. Second, we explain how to modify the pseudonym-based schemes in order to mitigate the DDoS attack. The proposed solution is simpler than that in Khan and Mitchell (2017). We also discuss aspects of pseudonym usage in mobile network from charging and regulatory point of view.",

keywords = "3GPP , IMSI catchers, Pseudonym , Identity , Privacy ",

author = "Mohsin Khan and Kimmo J{\"a}rvinen and Philip Ginzboorg and Valtteri Niemi",

year = "2017",

doi = "10.1007/978-3-319-72598-7_22",

language = "English",

isbn = "978-3-319-72597-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "347--366",

editor = "R. Shyamasundar and V. Singh and J. Vaidya",

booktitle = "Information Systems Security. ICISS 2017",

address = "Germany",

note = "International Conference on Information Systems Security, ICISS ; Conference date: 16-12-2017 Through 20-12-2017",

}

Khan, M, Järvinen, K, Ginzboorg, P & Niemi, V 2017, On De-synchronization of User Pseudonyms in Mobile Networks. in R Shyamasundar, V Singh & J Vaidya (eds), Information Systems Security. ICISS 2017: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings. Lecture Notes in Computer Science, vol. 10717, Springer, pp. 347-366, International Conference on Information Systems Security, Mumbai, India, 16/12/2017. https://doi.org/10.1007/978-3-319-72598-7_22

On De-synchronization of User Pseudonyms in Mobile Networks. / Khan, Mohsin; Järvinen, Kimmo; Ginzboorg, Philip et al.
Information Systems Security. ICISS 2017: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings. ed. / R. Shyamasundar; V. Singh; J. Vaidya. Springer, 2017. p. 347-366 (Lecture Notes in Computer Science; Vol. 10717).

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - On De-synchronization of User Pseudonyms in Mobile Networks

AU - Khan, Mohsin

AU - Järvinen, Kimmo

AU - Ginzboorg, Philip

AU - Niemi, Valtteri

N1 - Conference code: 13

PY - 2017

Y1 - 2017

N2 - This paper is in the area of pseudonym-based enhancements of user identity privacy in mobile networks. Khan and Mitchell (2017) have found that in recently published pseudonym-based schemes an attacker can desynchronize the pseudonyms’ state in the user equipment and in its home network. In this paper, we first show that by exploiting this vulnerability a botnet of mobile devices can kick out of service a large portion of the users of a mobile network. We characterize this novel DDoS attack analytically and confirm our analysis using a simulation. Second, we explain how to modify the pseudonym-based schemes in order to mitigate the DDoS attack. The proposed solution is simpler than that in Khan and Mitchell (2017). We also discuss aspects of pseudonym usage in mobile network from charging and regulatory point of view.

AB - This paper is in the area of pseudonym-based enhancements of user identity privacy in mobile networks. Khan and Mitchell (2017) have found that in recently published pseudonym-based schemes an attacker can desynchronize the pseudonyms’ state in the user equipment and in its home network. In this paper, we first show that by exploiting this vulnerability a botnet of mobile devices can kick out of service a large portion of the users of a mobile network. We characterize this novel DDoS attack analytically and confirm our analysis using a simulation. Second, we explain how to modify the pseudonym-based schemes in order to mitigate the DDoS attack. The proposed solution is simpler than that in Khan and Mitchell (2017). We also discuss aspects of pseudonym usage in mobile network from charging and regulatory point of view.

KW - 3GPP

KW - IMSI catchers

KW - Pseudonym

KW - Identity

KW - Privacy

U2 - 10.1007/978-3-319-72598-7_22

DO - 10.1007/978-3-319-72598-7_22

M3 - Conference article in proceedings

SN - 978-3-319-72597-0

T3 - Lecture Notes in Computer Science

SP - 347

EP - 366

BT - Information Systems Security. ICISS 2017

A2 - Shyamasundar, R.

A2 - Singh, V.

A2 - Vaidya, J.

PB - Springer

T2 - International Conference on Information Systems Security

Y2 - 16 December 2017 through 20 December 2017

ER -

Khan M, Järvinen K, Ginzboorg P, Niemi V. On De-synchronization of User Pseudonyms in Mobile Networks. In Shyamasundar R, Singh V, Vaidya J, editors, Information Systems Security. ICISS 2017: 13th International Conference, ICISS 2017, Mumbai, India, December 16-20, 2017, Proceedings. Springer. 2017. p. 347-366. (Lecture Notes in Computer Science). doi: 10.1007/978-3-319-72598-7_22

On De-synchronization of User Pseudonyms in Mobile Networks

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this