Although the security properties of 3G and 4G mobile networks have significantly improved by comparison with 2G (GSM), significant shortcomings remain with respect to user privacy. A number of possible modifications to 2G, 3G and 4G protocols have been proposed designed to provide greater user privacy; however, they all require significant modifications to existing deployed infrastructures, which are almost certainly impractical to achieve in practice. In this article we propose an approach which does not require any changes to the existing deployed network infrastructures or mobile devices, but offers improved user identity protection over the air interface. The proposed scheme makes use of multiple IMSIs for an individual USIM to offer a degree of pseudonymity for a user. The only changes required are to the operation of the authentication centre in the home network and to the USIM, and the scheme could be deployed immediately since it is completely transparent to the existing mobile telephony infrastructure. We present two different approaches to the use and management of multiple IMSIs.
In this paper we propose a way to enhance the identity privacy in LTE LTE-Advanced systems. This is achieved while minimizing the impact on the existing E-UTRAN system. This is important since proposals to modify a widely deployed infrastructure must be cost effective, both in terms of design changes and in terms of deployment cost. In our proposal, the user equipment (UE) identifies itself with a dummy identity, consisting only of the mobile nation code and the mobile network code. We use the existing signalling mechanisms in a novel way to request a special encrypted identity information element. This element is protected using identity-based encryption (IBE), with the home network (HPLMN) as the private key generator (PKG) and the visited network (VPLMN) and the private key owner. This allows the UE to protect the identity (IMSI) from external parties. To avoid tracking the “encrypted IMSI” also include a random element. We use this as an opportunity to let the UE include as subscriber-side random challenge to the network. The challenge will be bounded to the EPS authentication vector (EPS AV) and will allow use to construct an online 3-way security context. To complete our proposal we also strengthen the requirements on the use of the temporary identifier (M-TMSI). Identity privacy is a security issue that is crucial for the users of a cellular network. Knowledge of the permanent identity of a user may allow an adversary to track and amass comprehensive profiles about individuals. Such profiling may expose an individual to various kind of unanticipated risks, and above all may deprive an individual of his right to privacy. With the introduction of sensitive services like online banking, shopping, etc. through cellular phones, identity privacy has now become a bigger security issue. In GSM and UMTS, the problem of user identity privacy vulnerability is proven to exist. In both these systems, there are situations where the permanent identity of a subscriber may get compromised. Long Term Evolution (LTE), which evolved from GSM and UMTS, is proposed by 3GPP for inclusion into the fourth generation of cellular networks. Although security of LTE has evolved from the security of GSM and UMTS, due to different architectural and business requirements of fourth generation systems, LTE security is substantially different and improved compared to its predecessors. However, the issue of identity privacy vulnerability continue to exist in LTE. In this paper, we discuss how the security architecture of LTE deals with identity privacy. We also discuss a possible solution that may be utilised to overcome the problem of user identity privacy in LTE.