Gsm Security

GSM Network Architecture  Which related to the security system Network and Switching Subsystem Permanen IMSI

HLR

BTS LAI

Ki

MSISDN

A5

Temporer MSRN SRES IMSI

AUC

VLR

ME

Mobile Station

SRES

IMSI

MSRN

TMSI

MSISDN

Kc RAND Ki

Kc

A3

RAND

A8

LAI

SIM

IMSI

Ki

A3

A8

A5

• • • • • • • • •

IMSI TMSI MSRN MSISDN LAI Ki Kc SRES RAND

: International Mobile Subscriber Identity : Temporary Mobile Subscriber Identity : Mobile Station Roaming Number : Mobile Station ISDN : Local Area Identity : authentication key : ciphering key : Signed Response : random number

GSM Security Algorithms Ki 128 bit

RAND 128 bit

• A3 : Subscriber authentication algorithm • A8 : Cipher key generation algorithm • A5 : Ciphering/deciphering algorithm

A3

SRES

A8

Kc

32 bit

TDMA frame number

64 bit

A5 S2

S1 downlink

Plain text 114 bit

Cipher text 114 bit uplink

GSM Security System Basic Services •

TMSI assignment

•

Authentication

•

Signaling and voice data confidentiality

•

SIM and ME identification

TMSI Assignment

IMSI

E(TMSI) A5

IMSI BTS

VLR TMSI

•

Objective : to protect the IMSI.

•

5 digit TMSI replace at each location update procedure.

•

TMSI sent encrypted by A5 algorithm from BTS to MS. Weaknesses:  No protection for IMSI which transmitted between MS and fixed network.  TMSI only encrypted between BTS and MS.

Authentication challenge RAND

RAND

Ki

SRESnetwork

A3

SRESMS MS

SRESMS

SRESMS = SRESnetwork ?

No Deny access

response Access granted

Yes Fixed network

• •

Objective : to know subscriber identity fidelity. Known as Challenge-Response method. Weaknesses:  No protection for RAND and SRESMS which transmitted.

Ciphering - Deciphering Kc

Nomor Frame

Kc

Nomor Frame

64 bit

22 bit

64 bit

22 bit

Codeword downlink 114 bit

Algoritma A5

Algoritma A5 S1

Plaintext 114 bit

Ciphertext

S2

Plaintext 114 bit

S2

114 bit BTS

• •

S1

Codeword uplink 114 bit

MS

Ciphering process are held on BTS and MS, using A5 algorithm. Symmetry cryptography.