|
|
| Mobile & Cell Phone Information |
|
|
|
|
Security of GSM System
Introduction Every day millions of people use cellular phones over radio links. With the increasing features, the mobile phone is gradually becoming a handheld computer. In the early 1980's, when most of the mobile telephone system was analog, the inefficiency in managing the growing demands in a cost-effective manner led to the opening of the door for digital technology (Huynh & Nguyen, 2003). According to Margrave (n.d), "With the older analog-based cellular telephone systems such as the Advanced Mobile Phone System (AMPS) and the Total Access Communication System (TACS)", cellular fraud is extensive. It's very simple for a radio hobbyist to tune in and hear cellular telephone conversations since without encryption, the voice and user data of the subscriber is sent to the network (Peng, 2000). Margrave (n.d) states that apart from this, cellular fraud can be committed by using complex equipment to receive the Electronic Serial Number so as to clone another mobile phone and place calls with that. To counteract the aforementioned cellular fraud and to make mobile phone traffic secure to a certain extent, GSM (Global System for Mobile communication or Group Special Mobile) is one of the many solutions now out there. According to GSM-tutorials, formed in 1982, GSM is a worldwide accepted standard for digital cellular communication. GSM operates in the 900MHz, 1800MHz, or 1900Mhz frequency bands by "digitizing and compressing data and then sending it down a channel with two other streams of user data, each in its own time slot." GSM provides a secure and confidential method of communication. Security provided by GSM The limitation of security in cellular communication is a result of the fact that all cellular communication is sent over the air, which then gives rise to threats from eavesdroppers with suitable receivers. Keeping this in account, security controls were integrated into GSM to make the system as secure as public switched telephone networks. The security functions are: 1. Anonymity: It implies that it is not simple and easy to track the user of the system. According to Srinivas (2001), when a new GSM subscriber switches on his/her phone for the first time, its International Mobile Subscriber Identity (IMSI), i.e. real identity is used and a Temporary Mobile Subscriber Identity (TMSI) is issued to the subscriber, which from that time forward is always used. Use of this TMSI, prevents the recognition of a GSM user by the potential eavesdropper. 2. Authentication: It checks the identity of the holder of the smart card and then decides whether the mobile station is allowed on a particular network. The authentication by the network is done by a response and challenge method. A random 128-bit number (RAND) is generated by the network and sent to the mobile. The mobile uses this RAND as an input and through A3 algorithm using a secret key Ki (128 bits) assigned to that mobile, encrypts the RAND and sends the signed response (SRES-32 bits) back. Network performs the same SRES process and compares its value with the response it has received from the mobile so as to check whether the mobile really has the secret key (Margrave, n.d). Authentication becomes successful when the two values of SRES matches which enables the subscriber to join the network. Since every time a new random number is generated, eavesdroppers don't get any relevant information by listening to the channel. (Srinivas, 2001) 3. User Data and Signalling Protection: Srinivas (2001) states that to protect both user data and signalling, GSM uses a cipher key. After the authentication of the user, the A8 ciphering key generating algorithm (stored in the SIM card) is used. Taking the RAND and Ki as inputs, it results in the ciphering key Kc which is sent through. To encipher or decipher the data, this Kc (54 bits) is used with the A5 ciphering algorithm. This algorithm is contained within the hardware of the mobile phone so as to encrypt and decrypt the data while roaming. Algorithms used to make mobile traffic secure Authentication Algorithm A3: One way function, A3 is an operator-dependent stream cipher. To compute the output SRES by using A3 is easy but it is very difficult to discover the input (RAND and Ki) from the output. To cover the issue of international roaming, it was mandatory that each operator may choose to use A3 independently. The basis of GSM's security is to keep Ki secret (Srinivas, 2001) Ciphering Algorithm A5: In recent times, many series of A5 exists but the most common ones are A5/0(unencrypted), A5/1 and A5/2. Because of the export regulations of encryption technologies there is the existence of a series of A5 algorithms (Brookson, 1994). A8 (Ciphering Key Generating Algorithm): Like A3, it is also operator-dependent. Most providers combine A3 and A8 algorithms into a single hash function known as COMP128. The COMP128 creates KC and SRES, in a single instance (Huynh & Nguyen, 2003). GSM security flaws
Security breaches Time to time, people have tried to decode GSM algorithms. For instance, according to Issac press release (1998) in April 1998, the SDA (Smartcard Developer Association) along with two U.C Berkeley researchers alleged that they have cracked the COMP128 algorithm, which is stored on the SIM. They claimed that within several hours they were able to deduce the Ki by sending immense numbers of challenges to the authorization module. They also said that out of 64 bits, Kc uses only 54 bits with zeros padding out the other 10, which makes the cipher key purposefully weaker. They felt government interference might be the reason behind this, as this would allow them to monitor conversations. However, they were unable to confirm their assertion since it is illegal to use equipment to carry out such an attack in the US. In reply to this assertion, the GSM alliance stated that since the GSM network allows only one call from any phone number at any one time it is of no relevant use even if a SIM could be cloned. GSM has the ability to detect and shut down duplicate SIM codes found on multiple phones (Business press release, 1998). According to Srinivas (2001), one of the other claims was made by the ISAAC security research group. They asserted that a fake base station could be built for around $10,000, which would allow a "man-in-the-middle" attack. As a result of this, the real base station can get deluged which would compel a mobile station to connect to the fake station. Consequently, the base station could eavesdrop on the conversation by informing the phone to use A5/0, which is without encryption. One of the other possible scenarios is of insider attack. In the GSM system, communication is encrypted only between the Mobile station and the Base Transceiver station but within the provider's network, all signals are transmitted in plain text, which could give a chance for a hacker to step inside (Li, Chen & Ma). Measures taken to tackle these flaws According to Quirke (2004), since the emergence of these, attacks, GSM have been revising its standard to add newer technologies to patch up the possible security holes, e.g. GSM1800, HSCSD, GPRS and EDGE. In the last year, two significant patches have been implemented. Firstly, patches for COMP 128-2 and COMP128-3 hash function have been developed to address the security hole with COMP 128 function. COMP128-3 fixes the issue where the remaining 10 bits of the Session Key (Kc) were replaced by zeroes. Secondly, it has been decided that a new A5/3 algorithm, which is created as part of the 3rd Generation Partnership Project (3GPP) will replace the old and weak A5/2. But this replacement would result in releasing new versions of the software and hardware in order to implement this new algorithm and it requires the co-operation of the hardware and software manufacturers. GSM is coming out of their "security by obscurity" ideology, which is actually a flaw by making their 3GPP algorithms available to security researchers and scientists (Srinivas, 2001). Conclusion To provide security for mobile phone traffic is one the goals described in GSM 02.09 specification, GSM has failed in achieving it in past (Quirke, 2004). Until a certain point GSM did provide strong subscriber authentication and over-the-air transmission encryption but different parts of an operator's network became vulnerable to attacks (Li, Chen, Ma). The reason behind this was the secrecy of designing algorithms and use of weakened algorithms like A5/2 and COMP 128. One of other vulnerability is that of inside attack. In order to achieve its stated goals, GSM is revising its standards and it is bringing in new technologies so as to counteract these security holes. While no human-made technology is perfect, GSM is the most secure, globally accepted, wireless, public standard to date and it can be made more secure by taking appropriate security measures in certain areas. Bibliography Business Wire Press release (1998). GSM Alliance Clarifies False & Misleading Reports of Digital Phone Cloning. Retrieved October 26th, 2004 Web site: http://jya.com/gsm042098.txt Brookson (1994). Gsmdoc Retrieved October 24th, 2004 from gsm Web site: http://www.brookson.com/gsm/gsmdoc.pdf Chengyuan Peng (2000). GSM and GPRS security. Retrieved October 24th, 2004 from Telecommunications Software and Multimedia Laboratory Helsinki University of Technology Web site: http://www.tml.hut.fi/Opinnot/Tik-110.501/2000/papers/peng.pdf Epoker Retrieved October 27th, 2004 from Department of Mathematics Boise State University, Mathematics 124,Fall 2004 Web site:http://math.boisestate.edu/~marion/teaching/m124f04/epoker.htm Huynh & Nguyen (2003). Overview of GSM and GSM security. Retrieved October 25th, 2004 from Oregon State university, project Web site: http://islab.oregonstate.edu/koc/ece478/project/2003RP/huynh_nguyen_gsm.doc Li, Chen & Ma (n.d). Security in gsm. Retrieved October 24th, 2004 from gsm-security Web site: http://www.gsm-security.net/papers/securityingsm.pdf Quirke (2004). Security in the GSM system. Retrieved October 25th, 2004 from Security Website:http://www.ausmobile.com/downloads/technical/Security in the GSM system 01052004.pdf Margrave (n.d). GSM system and Encryption. Retrieved October 25th, 2004 from gsm-secur Web site: http://www.hackcanada.com/blackcrawl/cell/gsm/gsm-secur/gsm-secur.html Press release (1998). Smartcard Developer Association Clones Digital GSM 1998). Retrieved October 26th, 2004 from is sac Web site: http://www.isaac.cs.berkeley.edu/isaac/gsm.html Srinivas (2001). The GSM Standard (An overview of its security) Retrieved October 25th, 2004 from papers Web site:http://www.sans.org/rr/papers/index.php?id=317 Stallings (2003). Cryptography and Network Security: Principles and practices. USA: Prentice Hall. By Priyanka Agarwal http://M6.net The author is a novice who is trying to create her niche on network of networks.
|
|
|
|
RELATED ARTICLES
Telephone Tips, Techniques and Etiquette Whether using the telephone for business or personal use, using this communication tool effectively means being timely, communicating clearly and having the other person's interest in mind. Lets Talk In the eyes of a teenage girl cellular phones are the best invention since boys. My daughter has had a cell phone for awhile now but it wasy a prepaid one. That was getting too costly considering she ran through minutes at an astounding rate. The day she received her unlimited flip phone she was estatic. I don't think she would have been any happier if she had been presented with a brand new car. PDA Cell Phones - the New Generation of Wireless Phones It's time you know what the latest technological gadget is. In fact, this new toy is buzzing everywhere nowadays. PDA cell phones are popping up more and more in the market place. Young or old, maybe you should be asking yourself whether this new cellular phone is something you should consider owning? Well, if you're unsure about whether a PDA cell phone is the right piece of hardware for you, don't be. Read on and find out everything you need to know about these great cell phones! The Pros and Cons of Camera Cell Phones All the major phone manufacturers are cashing in on the ever increasing market in camera phones. Companies such as Nokia, Siemens, Motorola and many more have seen their profits sore since the introduction of the camera cell phone. Many of the cell phone carriers are offering a free camera phone for new customers to their networks. Finding Long Distance When a person moves, they need to hook up utilities. Often it can be difficult to know what you need to do and who to call. One such utility that needs to be taken care of is long distance. You probably feel overwhelmed because of the many promotions featuring long distance service. There are many kinds to choose from and many companies to look at. So, where do you begin? How do you find the best options? What SMS Users Are Telling Telcos The recent rollout of 3G-ready mobile devices has caused a lot of excitement in the Telco industry, especially in the Asia-Pacific region. This article will highlight the message that current customers are sending through their SMS messaging habits. Many consumers have been used to sending SMS for at least 2 years. Even with its humble typing of tiny keypads and source of simple news channel, SMS is a global phenomenon. Telcos must take time to study what their customers are saying. Why Your Business Should Consider SMS As an organisation, the use of SMS might seem too innovative or unprofessional. Calling Cards and Prepaid Phone Cards To Help You Save Money You can now save quite a bit of money on your long distance calling simply by using prepaid phone cards. It wasn't too many years ago that making a call overseas or even to an old friend in a neighboring state would be very expensive and even prohibitive. Making Sense of Cellular Phone Minutes Cellular phones are different from your land-line home phone in that you'll need to determine in advance how many minutes you'll use in any given month. Deciding how many minutes you'll need and making sure you don't go over your allotted minutes is one of the trickiest parts of using a cellular phone. The Importance Of Cell Phones In Modern Society Cell phones have become a necessity for many people throughout the world. The ability to keep in touch with family, business associates, and access to email are only a few of the reasons for the increasing importance of cell phones. Today's technically advanced cell phones are capable of not only receiving and placing phone calls, but storing data, taking pictures, and can even be used as walkie talkies, to name just a few of the available options. The Benefits of Digital Analogue is the process of taking an audio or video signal and then turning it into electronic pulses. Digital is the process of turning the signal into a binary format, represented by a string of 1's and 0's. Analogue technology has been around for a long time now. It really isn't that complicated and is fairly inexpensive. The problem with analogue signals lies in their size limitations regarding the amount of data they can carry. Prepaid Cell Phones ? Are They Right For You In today's world of communication technology, there's a lot out there to consider before investing in a cell phone plan. With a multitude of carriers offering scores of options, it isn't always easy to isolate the one package out of the many that would best suit your needs. Sometimes, the mainstream choices aren't available to folks who are inhibited by particular circumstances, such as poor credit or other types of financial constraints. In cases such as those, prepaid cell phones can be the proverbial lifesaver. You don't have to be financially restricted to consider a prepaid wireless plan, however. Many people choose to purchase this type of service in order to avoid contracts which would lock them into services for a designated amount of time and money. Cellular Phone Plan Choosing a cellular phone plan for all your needs. Small Business Phone Systems ? A Brief Explanation How a business presents itself to its customers has to be the single most important factor in its potential success. In days gone by usually your first contact with new customers would have been through your storefront or through word of mouth, passed on by other satisfied customers. In today's modern world, telecommunication plays an ever increasing role in reaching potential new customers. Prepaid Cellular Phone Reasons why someone would purchase a prepaid cellular phone. Hurricane Katrina Aftermath; Time to Launch Balloon Cell Towers One of the most critical infrastructures for restoring order to a catastrophic disaster is that of communication. Communication is necessary for those in need to call in their needs and to alert authorities of growing problems. In the aftermath of Hurricane Katrina there is no cell phone use and those who have cell phones cannot use them because the towers are down, the power to the towers are down and by now anyone with a cell phone has dead batteries with no way to recharge them. Most cars are submerged and/or were submerged and you cannot start them or use the batteries to charge thru the cigarette lighter adapters. Choosing The Right Phone and Voice Mail System Phone and voice mail systems can be pretty costly, even for companies with a low number phones. Before investing in any type of phone system or voice mail system, you need to estimate how much your company is likely to expand over the next few years and if possible how many phones you may require. Failure to do this could cost you or your company a lot of money in upgrade and restructuring costs further down the road. It is better and cheaper to plan and allow for expansion at an early stage, than wait until it is too late. Review of Bluetooth Wireless Headsets Bluetooth headsets make up one of the fastest wireless markets here in the US and around the world. Headsets with Bluetooth wireless technology are capable of working with a variety of other Bluetooth enabled devices such as cell phones, PDAs, and digital music devices (like the iPod). Unlike conventional headsets, Bluetooth headsets do not require wires of any sort, but rather receive information from your portable device through 2.4GHz radio waves. The range of communication for most headsets is somewhere around 10 feet, which is usually plenty long. Selecting a Cell Phone More Than Just a Phone SMS 101 - Short Message Service Explained Short Message Service (SMS) is a quick and simple way to communicate short messages via mobile phones, handheld devices, and increasingly even landline telephones. Commonly known as text messages, SMSes, or even texts the practice has spread rapidly throughout the world, evident by the fact that 500 billion such messages were sent in the last year alone. The practice has its popularity due in great part to its convenience and cost effectiveness. For example, a typical text message placed in the US at USD 0.05 per message is priced at just 10 to 20% that of a voice call. Such savings have made it the most popular form of communication in many countries, and the practice is quickly gaining in popularity in the United States as well.
|
| home | site map |
| © 2005 |