Encrypting IMSI to improve privacy in 5G Networks

Sammanfattning: Nowadays, the long-term identifier of a user in a mobile network, namely International Mobile Subscriber Identity or IMSI, is transmitted in clear text over the radiointerface. Given that this interface is used as a shared medium, anyone with a radio transceiver and processing software can thus read such identifier. This fact constitutes a threat to user privacy, considering that the user is traceable by following the presence of the identifier in the network. Moreover, the menace has been known in the literature for the last 25 years, but no countermeasures have been deployed because the severity was judged not to be sufficiently high. However, the current situation is different. One the one hand, the user is made more vulnerable: the needed equipment for catching IMSIs over the radio interface is becoming cheaper, while user-related connected devices are arising in the form of Internet of Things. On the other hand, mobile devices are now computationally more powerful, and the upcoming standardization of 5G represents an opportunity to address such issues. This dissertation presents a proposal to encrypt the IMSI based on Elliptic Curve Integrated Encryption Scheme, a public-key approach in which the long-term subscription identifier is concealed over the radio interface. By doing so, the IMSI is never publicly disclosed, and thus privacy is enhanced. Besides, research was conducted to show the technical feasibility of the proposal. First, the impact of the encrypted identifier on the network was studied. Secondly,the execution time needed for Android devices to perform encryption operations was measured. In both cases, the results were favorable, drawing the conclusion that there are no impediments to the adoption of the presented solution. The Thesis was developed in cooperation with Ericsson AB, Security Research.