Presentation is loading. Please wait.

Presentation is loading. Please wait.

© 2003 Vodafone Group GSM and UMTS Security Peter Howard Vodafone Group R&D Royal Holloway, University of London, IC3 Network Security, 10 November 2003.

Similar presentations


Presentation on theme: "© 2003 Vodafone Group GSM and UMTS Security Peter Howard Vodafone Group R&D Royal Holloway, University of London, IC3 Network Security, 10 November 2003."— Presentation transcript:

1 © 2003 Vodafone Group GSM and UMTS Security Peter Howard Vodafone Group R&D Royal Holloway, University of London, IC3 Network Security, 10 November 2003

2 © 2003 Vodafone Group Contents l Introduction to mobile telecommunications l Second generation systems - GSM security l Third generation systems - UMTS security l Focus is on security features for network access

3 © 2003 Vodafone Group Introduction to Mobile Telecommunications l Cellular radio network architecture l Location management l Call establishment and handover

4 © 2003 Vodafone Group Cellular Radio Network Architecture l Radio base stations form a patchwork of radio cells over a given geographic coverage area l Radio base stations are connected to switching centres via fixed or microwave transmission links l Switching centres are connected to the public networks (fixed telephone network, other GSM networks, Internet, etc.) l Mobile terminals have a relationship with one home network but may be allowed to roam in other visited networks when outside the home network coverage area

5 © 2003 Vodafone Group Cellular Radio Network Architecture Home network Switching and routing Other Networks (GSM, fixed, Internet, etc.) Interconnect Radio base station Visited network Roaming

6 © 2003 Vodafone Group Location Management l The network must know a mobile’s location so that incoming calls can be routed to the correct destination l When a mobile is switched on, it registers its current location in a Home Location Register (HLR) operated by the mobile’s home operator l A mobile is always roaming, either in the home operator’s own network or in another network where a roaming agreement exists with the home operator l When a mobile registers in a network, information is retrieved from the HLR and stored in a Visitor Location Register (VLR) associated with the local switching centre

7 © 2003 Vodafone Group Location Management Home network Switching and routing Other Networks (GSM, fixed, Internet, etc.) Visited network HLR VLR Interconnect Roaming Radio base station

8 © 2003 Vodafone Group Call Establishment and Handover l For mobile originating (outgoing) calls, the mobile establishes a radio connection with a nearby base station which routes the call to a switching centre l For mobile terminated (incoming) calls, the network first tries to contact the mobile by paging it across its current location area, the mobile responds by initiating the establishment of a radio connection l If the mobile moves, the radio connection may be re-established with a different base station without any interruption to user communication – this is called handover

9 © 2003 Vodafone Group First Generation Mobile Phones l First generation analogue phones (1980 onwards) were horribly insecure l Cloning: your phone just announced its identity in clear over the radio link l easy for me to pick up your phone’s identity over the air l easy for me to reprogram my phone with your phone’s identity l then all my calls are charged to your bill l Eavesdropping l all you have to do is tune a radio receiver until you can hear someone talking

10 © 2003 Vodafone Group Second Generation Mobile Phones – The GSM Standard l Second generation mobile phones are characterised by the fact that data transmission over the radio link uses digital techniques l Development of the GSM (Global System for Mobile communications) standard began in 1982 as an initiative of the European Conference of Postal and Telecommunications Administrations (CEPT) l In 1989 GSM became a technical committee of the European Telecommunications Standards Institute (ETSI) l GSM is the most successful mobile phone standard l over 863 million customers l over 70% of the world market l over 197 countries source: GSM Association, May 2003

11 © 2003 Vodafone Group General Packet Radio Service (GPRS) l The original GSM system was based on circuit-switched transmission and switching l voice services over circuit-switched bearers l text messaging l circuit-switched data services l charges usually based on duration of connection l GPRS is the packet-switched extension to GSM l sometimes referred to as 2.5G l packet-switched data services l suited to bursty traffic l charges usually based on volume of data transmitted l Typical data services l browsing, messaging, download, corporate LAN access

12 © 2003 Vodafone Group GSM Security — The Goals l GSM was intended to be no more vulnerable to cloning or eavesdropping than a fixed phone l it’s a phone not a “secure communications device”! l GSM uses integrated cryptographic mechanisms to achieve these goals l just about the first mass market equipment to do this l previously cryptography had been the domain of the military, security agencies, and businesses worried about industrial espionage, and then banks (but not in mass market equipment)

13 © 2003 Vodafone Group GSM Security Features l Authentication l network operator can verify the identity of the subscriber making it infeasible to clone someone else’s mobile phone l Confidentiality l protects voice, data and sensitive signalling information (e.g. dialled digits) against eavesdropping on the radio path l Anonymity l protects against someone tracking the location of the user or identifying calls made to or from the user by eavesdropping on the radio path

14 © 2003 Vodafone Group GSM Security Mechanisms l Authentication l challenge-response authentication protocol l encryption of the radio channel l Confidentiality l encryption of the radio channel l Anonymity l use of temporary identities

15 © 2003 Vodafone Group GSM Security Architecture l Each mobile subscriber is issued with a unique 128-bit secret key (Ki) l This is stored on a Subscriber Identity Module (SIM) which must be inserted into the mobile phone l Each subscriber’s Ki is also stored in an Authentication Centre (AuC) associated with the HLR in the home network l The SIM is a tamper resistant smart card designed to make it infeasible to extract the customer’s Ki l GSM security relies on the secrecy of Ki l if the Ki could be extracted then the subscription could be cloned and the subscriber’s calls could be eavesdropped l even the customer should not be able to obtain Ki

16 © 2003 Vodafone Group GSM Security Architecture Home network Switching and routing Other Networks (GSM, fixed, Internet, etc.) Visited network HLR/AuC VLR SIM

17 © 2003 Vodafone Group GSM Authentication Principles l Network authenticates the SIM to protect against cloning l Challenge-response protocol l SIM demonstrates knowledge of Ki l infeasible for an intruder to obtain information about Ki which could be used to clone the SIM l Encryption key agreement l a key (Kc) for radio interface encryption is derived as part of the protocol l Authentication can be performed at call establishment allowing a new Kc to be used for each call

18 © 2003 Vodafone Group HLR AuC Visited Access NetworkVisited Core Network Mobile Station (MS) BSC BTS SIM ME SGSN MSC Home Network (2) Authentication (1) Distribution of authentication data GSM Authentication MSC – circuit switched services SGSN – packet switched services (GPRS)

19 © 2003 Vodafone Group GSM Authentication: Prerequisites l Authentication centre in home network (AuC) and security module (SIM) inserted into mobile phone share l subscriber specific secret key, Ki l authentication algorithm consisting of l authentication function, A3 l key generating function, A8 l AuC has a random number generator

20 © 2003 Vodafone Group Entities Involved in GSM Authentication SIMSubscriber Identity Module MSCMobile Switching Centre SGSNServing GPRS Support Node HLR/AuCHome Location Register / Authentication Centre

21 © 2003 Vodafone Group GSM Authentication Protocol MSC SGSN HLR/AuCSIM RAND RES {RAND, XRES, Kc} Authentication Data Request A3A8 Ki RAND Kc RES A3A8 Ki RAND XRES RES = XRES?

22 © 2003 Vodafone Group GSM Authentication Parameters Ki = Subscriber authentication key (128 bit) RAND = Authentication challenge (128 bit) (X)RES = A3 Ki (RAND) = (Expected) authentication response (32 bit) Kc = A8 Ki (RAND) = Cipher key (64 bit) Authentication triplet= {RAND, XRES, Kc} (224 bit)

23 © 2003 Vodafone Group GSM Authentication Algorithm l Composed of two algorithms which are often combined l A3 for user authentication l A8 for encryption key (Kc) generation l Located in the customer’s SIM and in the home network’s AuC l Standardisation of A3/A8 not required and each operator can choose their own

24 © 2003 Vodafone Group GSM Encryption l Different mechanisms for GSM (circuit-switched services) and GPRS (packet-switched services)

25 © 2003 Vodafone Group GSM Encryption Principles (circuit-switched services) l Data on the radio path is encrypted between the Mobile Equipment (ME) and the Base Transceiver Station (BTS) l protects user traffic and sensitive signalling data against eavesdropping l extends the influence of authentication to the entire duration of the call l Uses the encryption key (Kc) derived during authentication

26 © 2003 Vodafone Group Encryption Mechanism l Encryption is performed by applying a stream cipher called A5 to the GSM TDMA frames, the choice being influenced by l speech coder l error propagation l delay l handover

27 © 2003 Vodafone Group Time Division Multiple Access (TDMA) User 1 User 2 FramesN-1Frame NFrame N+1 Time Slots 4 1 23 412341 User 2User 1

28 © 2003 Vodafone Group Encryption Function l For each TDMA frame, A5 generates consecutive sequences of 114 bits for encrypting/decrypting in the transmit/receive time slots l encryption and decryption is performed by applying the 114 bit keystream sequences to the contents of each frame using a bitwise XOR operation l A5 generates the keystream as a function of the cipher key and the ‘frame number’ - so the cipher is re-synchronised to every frame l The TDMA frame number repeats after about 3.5 hours, hence the keystream starts to repeat after 3.5 hours l new cipher keys can be established to avoid keystream repeat

29 © 2003 Vodafone Group Managing the Encryption l BTS instructs ME to start ciphering using the cipher command l At same time BTS starts decrypting l ME starts encrypting and decrypting when it receives the cipher command l BTS starts encrypting when cipher command is acknowledged

30 © 2003 Vodafone Group Strength of the Encryption l Cipher key ( Kc ) 64 bits long but 10 bits are typically forced to zero in SIM and AuC l 54 bits effective key length l Full length 64 bit key now possible l The strength also depends on which A5 algorithm is used

31 © 2003 Vodafone Group GSM Encryption Algorithms l Currently defined algorithms are: A5/1, A5/2 and A5/3 l The A5 algorithms are standardised so that mobiles and networks can interoperate globally l All GSM phones currently support A5/1 and A5/2 l Most networks use A5/1, some use A5/2 l A5/1 and A5/2 specifications have restricted distribution but the details of the algorithms have been discovered and some cryptanalysis has been published l A5/3 is new - expect it to be phased in over the next few years

32 © 2003 Vodafone Group GPRS Encryption l Differences compared with GSM circuit-switched l Encryption terminated further back in network at SGSN l Encryption applied at higher layer in protocol stack l Logical Link Layer (LLC) l New stream cipher with different input/output parameters l GPRS Encryption Algorithm (GEA) l GEA generates the keystream as a function of the cipher key and the ‘LLC frame number’ - so the cipher is re-synchronised to every LLC frame l LLC frame number is very large so keystream repeat is not an issue

33 © 2003 Vodafone Group GPRS Encryption Algorithms l Currently defined algorithms are: GEA1, GEA2 and GEA3 l The GEA algorithms are standardised so that mobiles and networks can interoperate globally l GEA1 and GEA2 specifications have restricted distribution l GEA3 is new - expect it to be phased in over the next few years

34 © 2003 Vodafone Group GSM User Identity Confidentiality (1) l User identity confidentiality on the radio access link l temporary identities (TMSIs) are allocated and used instead of permanent identities (IMSIs) l Helps protect against: l tracking a user’s location l obtaining information about a user’s calling pattern

35 © 2003 Vodafone Group GSM User Identity Confidentiality (2) l When a user first arrives on a network he uses his IMSI to identify himself l When network has switched on encryption it assigns a temporary identity TMSI 1 l When the user next accesses the network he uses TMSI 1 to identify himself l The network assigns TMSI 2 once an encrypted channel has been established

36 © 2003 Vodafone Group HLR AuC Access Network (GSM BSS) Visited Network Mobile Station (MS) BSC BTS SIM ME A SGSN MSC Home Network (2) Authentication (1) Distribution of authentication data GSM Radio Access Link Security (4a) Protection of the GSM circuit switched access link (ME-BTS) (3) Kc (3a) Kc (4b) Protection of the GPRS packet switched access link (ME-SGSN) MSC – circuit switched services SGSN – packet switched services (GPRS)

37 © 2003 Vodafone Group Significance of the GSM Security Features l Effectively solved the problem of cloning mobiles to gain unauthorised access l Addressed the problem of eavesdropping on the radio path - this was incredibly easy with analogue, but is now much harder with GSM

38 © 2003 Vodafone Group GSM Security and the Press l Some of the concerns were well founded, others were grossly exaggerated l Significance of ‘academic breakthroughs’ on cryptographic algorithms is often wildly overplayed

39 © 2003 Vodafone Group Limitations of GSM security (1) l Security problems in GSM stem by and large from design limitations on what is protected l design only provides access security - communications and signalling in the fixed network portion aren’t protected l design does not address active attacks, whereby network elements may be impersonated l design goal was only ever to be as secure as the fixed networks to which GSM systems connect

40 © 2003 Vodafone Group Limitations of GSM security (2) l Failure to acknowledge limitations l the terminal is an unsecured environment - so trust in the terminal identity is misplaced l disabling encryption does not just remove confidentiality protection – it also increases risk of radio channel hijack l standards don’t address everything - operators must themselves secure the systems that are used to manage subscriber authentication key l Lawful interception only considered as an afterthought

41 © 2003 Vodafone Group Specific GSM security problems (1) l Ill advised use of the COMP 128 authentication algorithm by some operators l vulnerable to collision attack - key can be determined if the responses to about 160,000 chosen challenges are known l later improved to about 50,000 l attack published on Internet in 1998 by Briceno and Goldberg, but known to a number of operators since 1989/90

42 © 2003 Vodafone Group Specific GSM security problems (2) l The GSM cipher A5/1 is becoming vulnerable to l exhaustive search on its 54 bit key l advances in cryptanalysis l time-memory trade-off attacks by Biryukov, Shamir and Wagner (2000) and Barkan, Biham and Keller (2003), based on original time-memory trade-off by Babbage (1995) l statistical attack by Ekdahl and Johansson (2002)

43 © 2003 Vodafone Group False Base Stations l Used as IMSI Catcher l Used to intercept mobile originated calls l encryption controlled by network and user generally unaware if it is not on l Risk of radio channel hijack, especially if encryption is not used

44 © 2003 Vodafone Group Lessons Learnt from GSM Experience l Security must operate without user assistance, but the user should know it is happening l Base user security on smart cards l Possibility of an attack is a problem even if attack is unlikely l Don’t relegate lawful interception to an afterthought - especially as one considers end-to-end security l Develop open international standards l Use published algorithms, or publish any specially developed algorithms

45 © 2003 Vodafone Group Third Generation Mobile Phones – The UMTS Standard

46 © 2003 Vodafone Group Third Generation Mobile Phones – The UMTS Standard l Third generation (3G) mobile phones are characterised by higher rates of data transmission and a richer range of services l Universal Mobile Telecommunications System (UMTS) is one of the new 3G systems l The UMTS standards work started in ETSI but was transferred to a partnership of regional standards bodies known as 3GPP in 1998 l the GSM standards were also moved to 3GPP at a later date l UMTS introduces a new radio technology into the access network l Wideband Code Division Multiple Access (W-CDMA) l An important characteristic of UMTS is that the new radio access network is connected to an evolution of the GSM core network

47 © 2003 Vodafone Group Principles of UMTS Security l Build on the security of GSM l adopt the security features from GSM that have proved to be needed and that are robust l try to ensure compatibility with GSM to ease inter-working and handover l Correct the problems with GSM by addressing security weaknesses l Add new security features l to secure new services offered by UMTS to address changes in network architecture

48 © 2003 Vodafone Group UMTS Network Architecture Home network Switching and routing Other Networks (GSM, fixed, Internet, etc.) Visited core network (GSM-based) HLR/AuC RNC USIM New radio access network VLR

49 © 2003 Vodafone Group GSM Security Features to Retain and Enhance in UMTS l Authentication of the user to the network l Encryption of user traffic and signalling data over the radio link l new algorithm – open design and publication l encryption terminates at the radio network controller (RNC) l further back in network compared with GSM l longer key length (128-bit) l User identity confidentiality over the radio access link l same mechanism as GSM

50 © 2003 Vodafone Group New Security Features for UMTS l Mutual authentication and key agreement l extension of user authentication mechanism l provides enhanced protection against false base station attacks by allowing the mobile to authenticate the network l Integrity protection of critical signalling between mobile and radio network controller l provides enhanced protection against false base station attacks by allowing the mobile to check the authenticity of certain signalling messages l extends the influence of user authentication when encryption is not applied by allowing the network to check the authenticity of certain signalling messages

51 © 2003 Vodafone Group UMTS Authentication : Protocol Objectives l Provides authentication of user (USIM) to network and network to user l Establishes a cipher key and integrity key l Assures user that cipher/integrity keys were not used before l Inter-system roaming and handover l compatible with GSM: similar protocol l compatible with other 3G systems due to the fact that the other main 3G standards body (3GPP2) has adopted the same authentication protocol

52 © 2003 Vodafone Group UMTS Authentication : Prerequisites l AuC and USIM share l subscriber specific secret key, K l authentication algorithm consisting of l authentication functions, f1, f1*, f2 l key generating functions, f3, f4, f5, f5* l AuC has a random number generator l AuC has a sequence number generator l USIM has a scheme to verify freshness of received sequence numbers

53 © 2003 Vodafone Group UMTS Authentication MSC/VLRHLR/AuCUSIM RAND,SQN  AK || AMF||MAC RES {RAND, XRES, CK, IK, SQN  AK||AMF||MAC} Authentication Data Request XRES, CK, IK, AK, MAC RAND K f1-f5 SQN Verify MAC using f1 Decrypt SQN using f5 Check SQN freshness RES, CK, IK RAND f2-f4 K AMF RES = XRES?

54 © 2003 Vodafone Group UMTS Authentication Parameters K = Subscriber authentication key (128 bit) RAND = User authentication challenge (128 bit) SQN = Sequence number (48 bit) AMF = Authentication management field (16 bit) MAC= f1 K (SQN||RAND||AMF) (64 bit) (X)RES = f2 K (RAND) = (Expected) user response (32-128 bit) CK = f3 K (RAND) = Cipher key (128 bit) IK = f4 K (RAND) = Integrity key (128 bit) AK = f5 K (RAND) = Anonymity key (48 bit) AUTN= SQN  AK|| AMF||MAC (128 bit) Authentication quintet = {RAND, XRES, CK, IK, AUTN} (544-640 bit)

55 © 2003 Vodafone Group UMTS Mutual Authentication Algorithm l Located in the customer’s USIM and in the home network’s AuC l Standardisation not required and each operator can choose their own l An example algorithm, called MILENAGE, has been made available l open design and evaluation by ETSI’s algorithm design group, SAGE l open publication of specifications and evaluation reports l based on Rijndael which was later selected as the AES

56 © 2003 Vodafone Group UMTS Encryption Principles l Data on the radio path is encrypted between the Mobile Equipment (ME) and the Radio Network Controller (RNC) l protects user traffic and sensitive signalling data against eavesdropping l extends the influence of authentication to the entire duration of the call l Uses the 128-bit encryption key (CK) derived during authentication

57 © 2003 Vodafone Group UMTS Encryption Mechanism l Encryption applied at MAC or RLC layer of the UMTS radio protocol stack depending on the transmission mode l MAC = Medium Access Control l RLC = Radio Link Control l Stream cipher used, UMTS Encryption Algorithm (UEA) l UEA generates the keystream as a function of the cipher key, the bearer identity, the direction of the transmission and the ‘frame number’ - so the cipher is re-synchronised to every MAC/RLC frame l The frame number is very large so keystream repeat is not an issue

58 © 2003 Vodafone Group UMTS Encryption Algorithm l One standardised algorithm: UEA1 l located in the customer’s phone (not the USIM) and in every radio network controller l standardised so that mobiles and radio network controllers can interoperate globally l based on a mode of operation of a block cipher called KASUMI

59 © 2003 Vodafone Group UMTS Integrity Protection Principles l Protection of some radio interface signalling l protects against unauthorised modification, insertion and replay of messages l applies to security mode establishment and other critical signalling procedures l Helps extend the influence of authentication when encryption is not applied l Uses the 128-bit integrity key (IK) derived during authentication l Integrity applied at the Radio Resource Control (RRC) layer of the UMTS radio protocol stack l signalling traffic only

60 © 2003 Vodafone Group UMTS Integrity Protection Algorithm l One standardised algorithm: UIA1 l located in the customer’s phone (not the USIM) and in every radio network controller l standardised so that mobiles and radio network controllers can interoperate globally l based on a mode of operation of a block cipher called KASUMI

61 © 2003 Vodafone Group UMTS Encryption and Integrity Algorithms l Two modes of operation of KASUMI l stream cipher for encryption l Message Authentication Code (MAC) algorithm for integrity protection l Open design and evaluation by ETSI SAGE l Open publication of specifications and evaluation reports

62 © 2003 Vodafone Group Ciphering And Integrity Algorithm Requirements l Stream cipher f8 and integrity function f9 l Suitable for implementation on ME and RNC l low power with low gate-count hardware implementation as well as efficient in software l No export restrictions on terminals, and network equipment exportable under licence in accordance with international regulations

63 © 2003 Vodafone Group General Approach To Design l ETSI SAGE appointed as design authority l Both f8 and f9 constructed using a new block cipher called KASUMI as a kernel l An existing block cipher MISTY1 was used as a starting point to develop KASUMI l MISTY1 was designed by Mitsubishi l MISTY1 was fairly well studied and has some provably secure aspects l modifications make it simpler but no less secure

64 © 2003 Vodafone Group HLR AuC Access Network (UTRAN) Visited Network User Equipment D RNC BTS USIM ME SGSN H MSC Home Network (2) Authentication (1) Distribution of authentication vectors UMTS Radio Access Link Security (4) Protection of the access link (ME-RNC) (3) CK,IK MSC – circuit switched services SGSN – packet switched services

65 © 2003 Vodafone Group Summary of UMTS Radio Access Link Security l New and enhanced radio access link security features in UMTS l new algorithms – open design and publication l encryption terminates at the radio network controller l mutual authentication and integrity protection of critical signalling procedures to give greater protection against false base station attacks l longer key lengths (128-bit)

66 © 2003 Vodafone Group Other Aspects of 3GPP Security l Procedure for handling loss of synchronisation of sequence numbers used for 3G authentication l Mechanisms for generating and verifying the sequence numbers used for 3G authentication l User configurability and visibility of security features l Lawful interception interface l USIM application toolkit security l Security of network domain signalling l User access control to USIM (PIN protection) l ME personalisation (USIM-ME lock) l Access security for IP multimedia subsystem l Security of presence/location services l Security for WLAN interworking with 3GPP systems l Mechanisms to protect against terminal theft l Generic authentication architecture l Multicast/broadcast security

67 © 2003 Vodafone Group Further Reading l 3GPP standards, http://www.3gpp.org l TS 03.20/43.020 – for GSM security features TS 33.102 – for UMTS security features

68 © 2003 Vodafone Group GSM and UMTS Security Peter Howard Peter.Howard@vodafone.com Vodafone Group R&D


Download ppt "© 2003 Vodafone Group GSM and UMTS Security Peter Howard Vodafone Group R&D Royal Holloway, University of London, IC3 Network Security, 10 November 2003."

Similar presentations


Ads by Google