Protecting IMSI and User Privacy in 5G Networks

In recent years, many cases of compromising users' privacy in telecom networks have been reported. Stories of "fake" base stations capable of tracking users and collecting their personal data without users' knowledge have emerged. The current way of protecting privacy does not provide any protection against an active attacker on the air-interface, claiming to be a legitimate network that has lost the temporary identity. Moreover, there is also no protection against passive eavesdroppers who are present when requests for International Mobile Subscriber Identity (IMSI) are made. This paper presents a new method for protecting the IMSI by means of establishing a pseudonym between the user equipment and the home network. The pseudonym is derived locally at the user equipment and the home network without affecting existing Universal Subscriber Identity Modules (USIMs). We analyse the solution from a technical perspective, as well as from a regulatory and operational perspective. The presented method protects the IMSI from passive and active IMSI-catchers as well as honest but curious serving networks. Moreover, it can recover from lock-out situations where one party has lost the pseudonym.