1. Mobile Telephone System And GSM Security

2. The Mobile Telephone System First-Generation Mobile Phones First-Generation Mobile Phones Analog Voice Analog Voice Second-Generation Mobile Phones Second-Generation Mobile Phones Digital Voice Digital Voice Third-Generation Mobile Phones Third-Generation Mobile Phones Digital Voice and Data Digital Voice and Data

3. Advanced Mobile Phone System (a) Frequencies are not reused in adjacent cells. (b) To add more users, smaller cells can be used. (a)(b)

4. Channel Categories 832 channels in four categories: 832 channels in four categories: Control (base to mobile) to manage the system Control (base to mobile) to manage the system Paging (base to mobile) to alert users to calls for them Paging (base to mobile) to alert users to calls for them Access (bidirectional) for call setup and channel assignment Access (bidirectional) for call setup and channel assignment Data (bidirectional) for voice, fax, or data Data (bidirectional) for voice, fax, or data

5. D-AMPS Digital Advanced Mobile Phone System (a) A D-AMPS channel with three users. (b) A D-AMPS channel with six users.

6. GSM (1) GSM uses 124 frequency channels, each of which uses an eight-slot TDM system

7. GSM (2) A portion of the GSM framing structure.

8. GSM Security Principals

9. GSM System Architecture IMSI: International Mobile Subscriber Identity BTS: Base Transceiver Station BSC: Base Station Controller MSC: Mobile Switching Center HLR: Home Location Register VLR: Visitor Location Register AuC: Authentication Center PSTN VLR HLR AuC A3 A8 IMSI Ki A5 Mobile StationMobile Station SubsystemNetwork Subsystem MSC BSC BTS SIM Handset

10. AuC GSM Authentication Protocol XRES = A3(Ki, RAND) SRES = A3(Ki, RAND) A3 A8 IMSI Ki A5 SIM Handset HLR VLR 1- IMSI 4- RAND 5- SRES 2- IMSI 3- RAND, XRES Kc 6- Verify SRES 7- Encrypted Data MSC BSC BTS A5

11. GSM Encryption A5 Kc(64 bit), Frame Number(22 bit) 114 bit key stream FrameCipher text A5 Kc(64 bit), Frame Number(22 bit) 114 bit key stream Frame Kc = A8(Ki, RAND) Handset BTS

12. GSM Security Issues

13. Limited Encryption Scope Only the over-the-air traffic is encrypted Only the over-the-air traffic is encrypted Message on backbone are plain text Message on backbone are plain text PSTN Mobile StationMobile Station SubsystemNetwork Subsystem MSC BSC BTS SIM Handset VLR HLR AuC

14. Key Transmission IMSI, RAND, SRES are transmitted without encryption IMSI, RAND, SRES are transmitted without encryption SIM Handset IMSI RAND SRES BTS

15. Active Attacks (Impersonating) Unilateral Authentication Unilateral Authentication Only user authentication, No BTS authentication Only user authentication, No BTS authentication Potential for false base station attack Potential for false base station attack SIM Handset IMSI RAND SRES Fake BTS

16. Weak Encryption Algorithms Both A3 and A8 use COMP 128 which has been broken Both A3 and A8 use COMP 128 which has been broken With enough pair of (SRES, RAND) SIM can be cloned With enough pair of (SRES, RAND) SIM can be cloned A5/0 has no security at all A5/0 has no security at all A5/1 and A5/2 has been broken A5/1 and A5/2 has been broken

17. Channel Hijack Encryption is not used in some networks Encryption is not used in some networks Encryption algorithm is broken Encryption algorithm is broken Protection against radio channel hijack relies on encryption Protection against radio channel hijack relies on encryption Encrypted Message

18. Inflexibility Inadequate flexibility to upgrade and improve security functionality over time Inadequate flexibility to upgrade and improve security functionality over time

19. Questions? Mahdi Hasheminezhad Tarbiat Modares University Jan 2007