Defeating the Downgrade Attack on Identity Privacy in 5G

Abstract

3GPP Release 15, the first 5G standard, includes protection of user identity privacy against IMSI catchers. These protection mechanisms are based on public key encryption. Despite this protection, IMSI catching is still possible in LTE networks which opens the possibility of a downgrade attack on user identity privacy, where a fake LTE base station obtains the identity of a 5G user equipment. We propose (i) to use an existing pseudonym-based solution to protect user identity privacy of 5G user equipment against IMSI catchers in LTE and (ii) to include a mechanism for updating LTE pseudonyms in the public key encryption based 5G identity privacy procedure. The latter helps to recover from a loss of synchronization of LTE pseudonyms. Using this mechanism, pseudonyms in the user equipment and home network are automatically synchronized when the user equipment connects to 5G. Our mechanisms utilize existing LTE and 3GPP Release 15 messages and require modifications only in the user equipment and home network in order to provide identity privacy. Additionally, lawful interception requires minor patching in the serving network.

Quantum Key Distribution for 5G Networks: A Review, State of Art and Future Directions

“…The algorithm is used to offer better security device distribution, isolation, and improved traffic flow. In [34], the authors update LTE pseudonyms by utilizing the current pseudonym-based solutions to prevent International Mobile Subscriber Identity (IMSI) downgrade attacks using fake base stations. Various access control solutions have been proposed based on authentication, encryption, authorization, and secret sharing.…”

Overview of 5G & Beyond Security

“…Special instances, like private networks, optionally require authentication based on EAP. Because it is separate from the Radio Access (RA) scheme, in non-3GPP technologies, primary authentication will also work [80]. When the data network authentication is done outside the authority of a telecom provider is secondary authentication.…”

“…To prevent downgrade attacks with a fake LTE BS from IMSI (International Mobile Subscriber Identity), advocated using an existing approach based on pseudonyms and a method to change LTE pseudonyms. An attack called RPEDO is addressed to find security problems with the paging protocol [80].…”

Is 5G Handover Secure and Private? A Survey

“…Recently, Khan et al [25] proposed a downgrade attack against 5G ME, which can catch ME's International Mobile Subscriber Identity (IMSI) which is a global identity of ME. Hussain et al [26] came up with an attack named ToRPEDO that can enable an adversary to verify a victim's coarse-grained location information, inject fabricated paging messages, and initiate DoS attacks.…”