GSM Security Feature, Threats and Solution

Global System for Mobile Communications security was based on circuit-switched transmission and switching, it also serves voice services over circuit-switched bearers, circuit-switched data services, it charges based on the duration of connection and text messaging. It is a standard for second generation digital cellular networks. Features of GSM would include Subscriber Identity Authentication, User and Signaling Data Confidentiality and Subscriber Identity Confidentiality. Subscriber Identity Authentication service is the heart of the GSM security, it is used to enable fixed network to authenticate the identity of mobile subscribers, to manage and establish the encryption keys needed to provide the confidentiality services. This service must be supported by all networks and mobiles although the frequency of application is at the discretion of the network. Authentication is initiated by the fixed network and is based upon a simple challenge-response protocol. User and Signaling data Confidentiality, it consists of three elements user data confidentiality, signaling information on physical connections, connectionless user data confidentiality and signaling information element confidentiality. First element provides privacy of all user generated data, both voice and non-voice transferred over the radio path on traffic channels. Second element provides privacy of user data transferred in packet mode over the radio path on a dedicated signaling channel while the third element provides privacy of certain user related signaling elements transferred over the radio path on dedicated signaling channels. Subscriber Identity Confidentiality service allows mobile subscriber to originate calls and update their location without revealing their International Mobile Subscriber Identity to an eavesdropper on the radio path. It also prevents location tracing of mobile subscribers by listening to the signaling exchanges on the radio path. 

 

Some of the GSM security threats would be lack of user visibility, vulnerability to DoS attacks, absence of integrity protection, vulnerability to replay attacks and increased redundancy due to the coding preference. Lack of user visibility is that the ciphering is controlled by the BTS, the user is not alerted when the ciphering mode is deactivated. A false BTS can also deactivate the ciphering mode and force MS to send data in an encrypted manner. Vulnerability to DoS attacks means a single attacker is capable of disabling an entire GSM cell via Denial Of Service attack, the attacker can send channel request message to the BSC for several times but user does not complete the protocol and requests another signaling channel. Since the number of signaling channels is limited, this lead to DoS attacks. It is feasible as the call setup protocol performs resource allocations without adequate authentication, this attack is economical since it does not have any charge for the attacker. Absence of integrity protection means that GSM security architecture considers authentication and confidentiality, there is no provision for any integrity protection of information, and therefore the recipient cannot verify that a certain message was not tampered with. Vulnerability to replay attacks means the attacker can misuse the previous exchanged messages between the subscriber and network in order to perform the replay attacks. Increased redundancy due to the coding preference is the Forward Error Correcting is performed prior to the ciphering so that there is a redundancy that increases security vulnerabilities of deployed cryptographic algorithms. Solutions would be to secure the backbone traffic by encrypting the backbone traffic between the network components as it can prevent the attacker to eavesdrop or modify the transmitted data, the cooperation of hardware manufactures is still required in this solution. End to end security would be the best, profitable and easiest solution to deploy end to end security. Most of the GSM security targets special groups so that it is economical and reasonable that such groups make their communications secure by end to end security.        

References: 

http://uib.academia.edu/toorani/Papers/146481/Solutions_to_the_GSM_Security_Weaknesses

http://www.dataman.ro/wp-content/uploads/2007/06/threats-and-countermeasures-in-gsm-networks.pdf