Professional Documents
Culture Documents
Information Technology Mobile Computing Module: GSM Security
Information Technology Mobile Computing Module: GSM Security
Information Technology Mobile Computing Module: GSM Security
Mobile Computing
Module: GSM Security
Introduction
The wireless-radio medium is open to all .Being a wireless network, GSM is also sensitive to
unauthorized use of resources. GSM offers precise security measures some of which maintains privacy
and confidentiality of users’ identity and data while others ensure that only registered users access the
network. This module provides detail discussion of GSM’s Security mechanisms and their
implementation. The topics covered in this module are:
Operator Side: From operator’s point of view it should be ensured that operators
· Maintaining privacy and anonymity of user which means that identification and location
of the subscriber should be concealed
· Confidentiality of communication over air should be maintained by providing proper
encryption methods
· There should be strong access control mechanisms for devices and SIM card
· Only authenticated users should be able to access the network
Rules of GSM Security
The Security features should adhere to the following rules:
· Access Control to SIM card: This is done by use of Personal Identification Number (PIN) to
get access to the SIM card
· Anonymity: Hiding the identity and location of user. This is done by using a TMSI number
Now we see how security measures described in above outlines are implemented by GSM network
Access control
SIM Subscriber identity module stores confidential information which can be personal as well as
network specific. It stores the following information:
Ki (128 bit) A3
Figure 1: A3 algorithm
Ki (128 bit) A8
KC (64 bit)
Figure 2: A8 algorithm
Both are one way functions which means output can be found if inputs are known but it is impossible to
find inputs if output is known. A3 and A8 use COMP128 which is a keyed hash function.Both are one
way functions which means output can be found if inputs are known but it is impossible to find inputs if
output is known. A3 and A8 use COMP128 which is a keyed hash function.It takes 128 bit key and 128
bit RAND number as input and produces 128 bit output. The first 32 bits of 128 bit form SRES i.e. Signed
response and next 54 bits forms the cipher key which is used for authentication and encryption.
The above mentioned steps are described in the activity diagram and block diagram shown in Fig. 4&5
Encryption
The data and signals are encrypted only between mobile station and base station.
Encrypted data
Figure 7: A5 algorithm
Summary
· GSM provides security to access control, user identification and data and signal via
different techniques documented in GSM specifications
· The security principles follow security by obscurity
· Access control is provided by protecting the SIM via PIN and PUK
· To address anonymity of subscriber, a temporary identifier TMSI is used for IMSI
· Authentication and Encryption is performed using challenge response technique
· A3,A5 and A8 algorithms are used along with symmetric key Kc