A Survey Of Subscription Privacy On The 5G Radio Interface .

II. T ECHNICAL BACKGROUNDBefore we delve further into the subscription privacy aspectsof 5G, we outline the mobile telephony ecosystem and itspertinent security and privacy mechanismsA. System ArchitectureThe mobile telephony architecture consists of three maindomains; Home Network (HN), Serving Network (SN) andUser Equipment (UE) (see Figure 2). The subscribers carryUE, which typically refers to Mobile Equipment (ME) (thephone) containing a Universal Integrated Circuit Card (UICC)(the SIM card). The HN domain represents the networkfunctions that are conducted at a permanent location regardless of the location of the subscriber. The HN is where asubscription initially gets registered. It stores the subscribers’credentials and is responsible for management of subscriptioninformation. The SN domain is the part which provides thesubscribers access to the telephony network and its services.It represents the network functions that are local to the user’saccess point and thus their location changes when the usermoves. The SN is responsible for routing calls and transportof user data/information from source to destination. It hasthe ability to interact with the HN to cater for user-specificdata/services.Often UEs may have to operate in areas where their operators have no network coverage (i.e., base stations). In suchscenarios called roaming, other service providers, who have aroaming agreement with the subscriber’s operator, provide SNservices. Hence, in this paper, we treat SN as a semi-trustedentity to whom a subscriber’s long-term credentials can notbe exposed (barring a few exceptions). Note that according tothe 3GPP standard [3], HNs and SNs are further divided intological sub-entities. The security and privacy properties beingdiscussed in this paper do not require this level of granularity.It is within the UICC that the application Universal Subscriber Identity Module (USIM) runs. The USIM representsthe relationship between a subscriber and its issuing HN. During a subscription registration, the HN stores the subscriber’slong-term identifier, Mobile Station International SubscriberDirectory Number (MSISDN) (the telephone number) andother subscriber related data, including a 128-bit secret key Kand 48-bit monotonically increasing counters called SequenceNumbers (SQNs), within the USIM. These SQNs are utilizedfor the purpose of replay prevention. While an SQN shouldbe synchronized between the UE and HN, sometimes it maybecome out-of-sync due to the loss of messages on thewireless channel. We therefore use SQNU E and SQNHNto refer to the state of SQN in UE and HN respectively.These subscription parameters are also stored within the HN’sdatabase and form the basis of a security context between UEsand HNs and by extension (during roaming) between UEs andSNs. The SNs provision services to UEs after establishmentof a secure channel between them with help of the HNs.(a) When not roaming, both HN and SN belong to the same mobilenetwork operator.(b) When roaming, the SN and HN belong to distinct mobile networkoperators.Fig. 2: The mobile network architecture. The channel betweenUE and SN is initially unprotected while that between SN andHN is assumed to be protected.B. Identifier Types and TerminologiesIn mobile telephony systems, networks allocate to eachsubscriber a unique long-term identifier, known up to 4Gas the International Mobile Subscriber Identity (IMSI) andsince 5G as the Subscription Permanent Identifier (SUPI). ASUPI as defined in 3GPP TS 23.501 [9] is usually a stringof 15 decimal digits and acts as the long-term identifier ofan individual subscriber. The first three digits represent theMobile Country Code (MCC), while the next two or three formthe Mobile Network Code (MNC) that identifies the networkoperator. The length of the MNC field is a national affair.The remaining (nine or ten) digits are known as the MobileSubscriber Identification Number (MSIN) and represent theindividual user of that particular operator. Each decimal digitof the SUPI is represented in binary by using the TelephonyBinary Coded Decimal (TBCD) encoding [10].Authentication between a user and its service provider isbased on a shared symmetric key (details in Section II-E),thus can only take place after an initial user identification.However, if the IMSI/SUPI values are sent in plaintext over theradio link for this purpose then subscribers can be identified,located and tracked using these permanent identifiers. Toavoid this privacy breach, subscribers are assigned temporaryidentifiers called Globally Unique Temporary User EquipmentIdentity (GUTI) by the SNs. A GUTI uniquely and globallyidentifies a particular subscriber. These frequently-changingtemporary identifiers are then used for identification purposes

over the wireless link before the establishment of a securechannel. The International Mobile Equipment Identity (IMEI),which uniquely identifies the ME, is a string of 15 digits.If the IMEI is sent in plaintext over the radio interfacethen it could compromise user privacy as it is also uniquelyidentifying from a subscription viewpoint. However, the 3GPPspecifications prohibit a UE from transmitting the IMEI untilafter establishment of a secure channel with the network [11].C. Security Assumptions1) Assumptions on Channels: According to 3GPP TS33.501 (sub-clause 5.9.3) [3], the channel between SN andHN should provide confidentiality, integrity, authentication andreplay prevention. The channel between UE and SN essentiallybeing a wireless one is subject to eavesdropping, interceptionand injection of messages by malicious third parties.2) Assumptions on Parties: The UE and its associated HNare fully trusted entities. The shared secret data being stored bythese two entities is assumed to be protected from third parties.Specifically, the UICC is considered to be a tamper-resistantsecurity module whose contents cannot be read by a maliciousentity. SNs are semi-trusted entities in the sense that duringthe secure channel establishment the long-term shared secretkey K and sequence numbers SQN should not be revealed tothem while the SUPI is provisioned to them. The provisioningof SUPI is essential for accurate billing purposes.3) Assumptions on Cryptographic Functions: All the cryptographic functions (detailed in Section II-E) are assumed toprovide both confidentiality and integrity protection to theirrespective inputs.D. Initialization of AuthenticationAs we will see in Section II-E, secure channel establishmentbetween subscribers and their service providers is conductedvia challenge-response protocols based upon the shared secretkey K. Thus, before such protocols can be executed it isimperative that the service provider correctly identifies thesubscriber with whom this channel needs to be established.3GPP TS 33.501 (sub-clause 6.1.2) [3] details the proceduresfor this subscription identification and selection of the subsequent authentication method (see Figure 3).The SN may initiate an authentication with the UE duringany procedure establishing a connection with the UE. The UEsends the SN either the 5G-GUTI in a registration requestmessage or the Subscription Concealed Identifier (SUCI) as aresponse to an identifier request message. The SUCI is a randomized public-key encryption of the SUPI (see Section IV-Afor details). In the case of a 5G-GUTI, the SN extracts thecorresponding SUPI from its database and forwards it alongwith its global identity Serving Network Name (SNname )to the HN in an authenticate request message. Otherwisethe SUCI is sent instead of the SUPI. Upon receipt of theauthenticate request message, the HN checks whether the SNis entitled to use the serving network name in the requestmessage by comparing the incoming serving network namewith the expected serving network name. The HN stores thereceived serving network name temporarily. If the SN is notauthorized to use the serving network name, the HN respondswith a serving network not authorized message. If the SUCIis received in an authenticate request message by HN, it deconceals the SUPI from it and chooses the authenticationmethod based upon its policy.E. The 5G-AKAThe security of communication between telephony subscribers and their service providers requires mutual authentication and key agreement. In 5G systems, these requirements arefulfilled by either EAP-AKA’ or 5G-AKA, both AuthenticatedKey Agreement (AKA) protocols. EAP-AKA’ and 5G-AKAare quite similar with identical message flows but with minordifferences in the way various keys get derived. We thereforeconsider only 5G-AKA in this paper. 3GPP TS 33.501 (subclause 6.1.3.2) [3] defines the details of the 5G-AKA protocol.The security of 5G-AKA is based upon the shared symmetrickey K, while SQN provisions replay protection. To initiateauthentication, the UE sends the SN either the 5G-GUTI ina registration request message or the SUCI in response to anidentifier request message (as explained in Section II-D).TABLE I: Description of 5G-AKA parametersParameterRAKCKIKRESM ACCON CAU T NAU T SXRESHRES/HXRESKAU SFKSEAFContent/DescriptionRandom ChallengeAnonymity KeyConfidentiality KeyIntegrity KeyResponseMessage Authentication CodeConcealed Sequence NumberAuthentication TokenResynchronization TokenExpected ResponseHash of RES/XRESIntermediate KeyAnchor KeyFigure 4 shows the 5G-AKA and its associated failuremechanisms. Table I details the various acronyms used inFigure 4. In Figure 4, R is a uniformly chosen 128-bit randomnumber, functions f1 ,. . ., f5 , f1 and f5 are symmetric keyalgorithms. f1 , f2 and f1 act as message authenticationfunctions, and f3 , f4 , f5 and f5 are used as key derivationfunctions. Key derivation is performed using the Key Derivation Function (KDF) specified in 3GPP TS 33.220 [12]. Asuccessful 5G-AKA culminates in the derivation of the anchorkey KSEAF by both SN and UE, from which further keysfor subsequent communication are derived. The two cases ofauthentication failure for the 5G-AKA are as follows:1) MAC Failure: As the first step in authentication confirmation, the UE checks whether the received M ACvalue is correct or not. In case of a failure [Case (i) inFigure 4], the UE replies with a MAC Failure messageback to the SN.2) Sync Failure: After MAC verification, the UE checksthe freshness of the sequence number SQNU E received

UE(SU P I, K, SQNU E )HN(SU P I, K, SQNHN )SN(SNname )5G-GU T I(Registration Request message)(Identifier Request message)SU CI(Identifier Response message)SU CI or SU P I, SNname(Authenticate Request message)1. SU CI to SU P I de-concealment2. Authentication Method SelectionFig. 3: Initiation of Authentication Procedure.in the authentication challenge. In case of this failure [Case (i) and (ii) Figure 4], it responds witha Sync Failure message along with a re-sync tokenAU T S. Note that in Figure 4, the sequence number freshness check is denoted by XSQNHN SQNU E 4.What this actually means is that there is some “window”of size 4, within which sequence numbers smaller thanthe current sequence number of UE will be accepted giventhey previously had not been received by the UE. Thismechanism is there to handle out-of-order delivery ofchallenge messages from HN to UE.During the execution of 5G-AKA, it is crucial that SQNis protected from an eavesdropper during the exchange ofmessages between the UE and SN as its exposure may lead tothe compromise of the identity and location of a subscriber.We will see in Section V-B how SQN leakage can manifestinto privacy vulnerabilities.keeps on monitoring for the paging message at certain devicespecific time intervals. The device is able to preserve batterybecause, at other times, it switches off its receiver. The idleUE decodes these broadcast probes and if it detects its identityin these messages, it randomly acquires an available radiochannel and asks the concerned base station for “connectionsetup” for exchange of further signalling messages.III. T HE PAST - I NHERITED C HALLENGESThe first and foremost task for 5G Release 15 was to addressthe privacy vulnerabilities that existed in the previous generations. Hence, before we discuss the improvements offered byRelease 15, we take a look at the vulnerabilities that alreadyexisted in the early generations that affect subscription privacyon the radio channel. Table II provides a summary of theattacks on subscription privacy in earlier generations.A. IMSI-catchingF. Lawful InterceptionNote from Figure 4 that at the culmination of a successful5G-AKA, the HN provides the SUPI of the UE to the SN.This is required essentially for two main purposes; accuratebilling and Lawful Interception (LI) requirements. The lawenforcement agencies of almost all countries require that theirlocal service providers should have the capability to locateand track any particular mobile user once required by law.The SUPI is later also used as an input to the key derivationfunctions between UE and SN. This ensures that the SUPIvalue provisioned by the HN is the one claimed by the UE,otherwise the communication breaks down.G. Paging MessagesWhen a UE does not have any ongoing data transmissions, itenters an idle state in order to preserve energy. If delivery of anetwork service like a call or SMS needs to be delivered to theUE, the network probes the idle UE by sending a “paging”message and the UE responds correspondingly. The pagingprocedure works because even when in the idle state, the UEAs mentioned in Section II-B, for obvious privacy reasons, GUTI is utilized for subscription identification purposesover the wireless interface before the establishment of asecure channel. However, there are certain situations whereauthentication through the use of these temporary identifiersis not possible. For example, when a user registers with anetwork for the first time and is not yet assigned a temporaryidentifier. Another case is when the network is unable toresolve the IMSI from the presented GUTI. An active man-inthe-middle adversary can intentionally simulate this scenarioto force an unsuspecting user to reveal its long-term identity.These attacks are known as “IMSI-catching” attacks [18] andpersist in mobile networks, including LTE [14], [11]. IMSIcatching attacks have threatened all generations of mobiletelephony for decades [19]. In IMSI-catching, through theuse of identifier request messages (Section II-D) the attackerobtains the identities of everybody around in an attack area.The attacker needs no previous assumption of who might bethere, and needs no previous information about the victim. It isthus a powerful attack, which breaches the subscription privacy

UE(SU P I, K, SQNU E )HN(SU P I, K, SQNHN )SN(SNname ) R {0, 1}128AK f5 (K, R)M AC f1 (K, SQNHN kR)CON C SQNHN AKAU T N CON CkM ACCK, IK f3 (K, R), f4 (K, R)XRES f2 (K, R)XRES KDF (CKkIK, SNname kRkXRES)HXRES SHA256(RkXRES )KAU SF KDF (CKkIK, SNname kCON C)KSEAF KDF (KAU SF , SNname )SQNHN SQNHN 1R, AU T N, HXRES R, AU T NXCON CkXM AC AU T NAK f5 (K, R)XSQNHN XCON C AKM AC f1 (K, XSQNHN kR)?Check (i) XM AC M AC(ii) XSQNHN SQNU E 4If (i) and (ii) then:SQNU E XSQNHNRES f2 (K, R).KSEAF KDF (KAU SF , SNname )RES KDF (CKkIK, SNname kRkRES)RES HRES SHA256(RkRES )?Check HRES HXRES RES ?Success, KSEAF , [SU P I]If (i) then:Check RES XRES MAC FailureIf (i) and (ii) then:M AC f1 (K, SQNU E kR)AK f5 (K, R)CON C SQNU E AK AU T S CON C kM AC Sync Failure, AU T SFig. 4: The 5G-AKA protocol and its associated failure mechanisms.completely. IMSI-catching is well documented as a Key Issue(Appendix A) in 3GPP TR 33.899 (sub-clause 5.7.3.2) [6].B. (Raw) IMSI-probingIn its discussions, 3GPP distinguishes between “IMSIcatching” and “IMSI-probing”. IMSI-probing is where anattacker already knows the subscription identity, e.g., an IMSIor an MSISDN plus some associated information, and wants tofind out whether the subscriber with this identity is present ina given area. This is a far less powerful attack than IMSIcatching. There are many possible ways to carry out suchan attack, e.g., send a bunch of (if possible silent [20])SMSs or other “activity triggers” to that MSISDN and seewhether there is a corresponding flurry of signalling in the cellyou are testing. Preventing all sorts of IMSI-probing attackswould be difficult and would involve a lot of overhead, e.g.,dummy signalling to conceal when the real signalling happens.Consequently, it was not thought worthwhile to address thisattack by 3GPP.C. Unauthenticated IMEI RequestIn GSM and UMTS systems, it was possible for an attackerto request the subscriber for its IMEI via an unauthenticatedidentity request message [13], [15], [17]. However, from LTEonwards, such provisions were removed and now the networkcan only request the user for its IMEI after establishment of

TABLE II: Summary of privacy attacks in the previous generationsIMSI-catching[11], [13], [14], [15], [16], [17], [18],(Raw) IMSI-probingUnauthenticated IMEI Request[13], [15],GUTI Persistence[21],GUTI-MSISDN Mapping[22], [23], [24],C-RNTI based TrackingGUTI Reallocation Replay Attack[21],Localization through Measurement Reports[22],IMSI-paging Attack[29], [22], [21],ToRPEDO AttackAKA Protocol Linkability Attack (LFM)[21], [29],Legend: yes, [32] partially/limited/optionala secure channel between them [33]. However, under certainspecial circumstance, e.g., when the UE has no IMSI or novalid GUTI during emergency attach, the IMEI is sent beforea security context is activated. This is to restrain the misuseof ME for placing invalid emergency calls [34].D. GUTI PersistenceTemporary subscriber identifiers like GUTI are used as aprivacy measure to mitigate subscription identification andtracking by eavesdroppers on the radio link, making it harderto track the location or activity of a particular subscriber. Inan LTE system, the updating of GUTI is recommended on thefollowing occasions: When the SN gets changed or during a new Attachprocedure; During a Tracking Area (TA) update; When the SN issues “GUTI reallocation command”.The major problem with the mechanism of GUTI allocationin the current LTE system is that it is up to the SN policyconfiguration when (if at all) to reallocate the GUTI. It is alsopossible for the SN to keep (re)allocating the same old GUTIto the UE. The UE neither takes part in the generation of theGUTI nor verifies the freshness of the newly allocated GUTI.This opens up possibilities for either poor implementations orpoor configuration that keeps the GUTI unchanged for a longtime. The evidence of these poor practices has been found inreal mobile network operators [22], [21] where the operatorstend not to frequently update the GUTI on these occasions.The reason ascribed to such practices is to avoid the signallingstorms [35] within the networks. In LTE networks, acquiringor tracking the temporary subscription identifiers has beenone of the most important attack strategies in compromisingsubscription privacy [22]. GUTI persistence has been identifiedas a Key Issue in 3GPP TR 33.899 (sub-clause 5.7.3.1) [6].TMSI / GUTIMSISDNIMSIRadio ActiveRadio PassiveAttacker CapabilitiesUser TraceabilityLocation LeakTypeIdentity DisclosureAttackGeneration2G? no, not FIII-GIII-HIII-IIII-JIII-K? property unknownE. Mapping between GUTI and MSISDNThese attacks are somewhat related to the IMSI-probingones but are more fine-grained. In these attacks, the attackerstarts with similar assumptions about knowing one of thesubscription long-term identities and the aim is to locate andthen further trace that subscriber. The attack uses the usualtechniques of either initiating phone calls [23] or sendingsilent SMSs [24] to the target MSISDN. This results intriggering of their paging procedures, which ultimately lead toa mapping between the known identity (usually MSISDN) andthe GUTI [25]. This enables an attacker to track a particularsubscriber for a long duration due to infrequent updation ofGUTI in LTE (details in Section III-D). Note that in theseattacks paging messages are sought by the attackers insteadof looking out for a generic signalling flurry.F. C-RNTI based TrackingThe Cell Random Network Temporary Identifier (C-RNTI)is a physical layer 16-bit identifier unique within a given celland is assigned to each device during the “Random AccessProcedure” (see Section III-I for details). Passive analysis ofreal LTE traffic has revealed that the C-RNTI is included inthe header (in unencrypted form) of every single packet [26].This leads to linking of the radio traffic (both user and controlplane) by a passive adversary. Further mapping to a user’sGUTI or MSISDN is trivial and can be undertaken via theuse of silent text messages. Through tracking of the C-RNTIvalue, an attacker can easily determine how long a given userstays at a given location.Further analysis of captured LTE traffic has revealed thatduring mobility handover events these physical layer identifierscan be linked together. This leads to traceability of users whenthey move from cell to cell. This was because the capturedhandover triggering messages were sent in the clear. According

to the response of the standardization bodies, these messagesare not suppose to be in the clear.G. GUTI Reallocation Replay AttackAs explained in Section II-B, subscribers communicate withthe networks us

In this paper, we provide an overview of the state of subscription privacy on the 5G radio interface. Keeping the aforementioned privacy objectives in mind, this paper eval-uates, systematizes, and contextualizes the requisite aspects of 5G subscription privacy in three chronological categories; past, prese