In the 20th century mobile communication becomes one of the most leading systems for the data and voice communication which uses digital concepts of communication. GSM (global system for mobile communications) is one of such type of mobile communication systems, it provides the user with best data rates and good quality of voice supported with enhanced security features. Since past ten years it becomes the most used radio communication system, approximately used by more than 700 million subscribers all over the world. Since past ten years it becomes the most used radio communication system, approximately used by more than 700 million subscribers all over the world.
When GSM was designed it was supposed to be very secure cellular system having really strong authentication algorithms. With the passage some of time some of the algorithms for GSM security were leaked out, and then further studies were made on GSM security model and then experts realized that GSM security model was not very good. .I am going to discuss some aspects regarding security in GSM. Further in my explanation, I will be discussing many security breaches that are present in GSM security model. My main emphasis will be on security features of GSM, the algorithms used, and limitations and flaws involved in GSM security model. At the end I will conclude my essay.
The use of radio communications for transmission to mobile subscribers makes GSM Public Land Mobile Network (PLMN), which makes it more prominent to be attacked by the unauthorized people. When we talk about security in GSM, it has mainly two goals, one is that there should be such an infrastructure which resists the unauthorized access to the services and the second one is to prevent the data related to customers to be leaked or disclosed to any unauthorized access for example when there is a conversation going between two persons, the third person who is not authorized to join the call listens to the conversation going on between the calling party and the called party.
In order to prevent unauthorized access GSM has included algorithms for authentication of only registered subscribers. For authentication of registered subscribers only, the mobile station sends its international mobile subscriber identity (IMSI) to the network. The Network then identifies the secret key Ki of the mobile and hence it generates a 128 bit random number (RAND) "r" and then sends it to the mobile station over the air interface [1]. Then after receiving the RAND from network the MS uses its known Ki from the SIM and the RAND received to implement A3 algorithm in order to generate a 32 bit security number that is called SRES [1]. After generation of SRES the MS sends the generated SRES to the network for validation, Network on its side calculates the SRES using the Ki of the MS and the RAND and then compares the both SRES, if both SRES are same the authentication is successful and mobile station can send or receive data.
For data encryption the key generated is known as the ciphering key Kc. GSM then makes use of the generated Kc the data and signaling. After the authentication goes successful the RAND (delivered from network) and K i (from SIM) are passed through A8 ciphering algorithm. This algorithm produces a ciphering key (Kc). A8 algorithm is then used with A5 ciphering algorithm to encipher or decipher the data.
Now coming towards the flaws present in the A3 and A8 algorithms, A3 and A8 are implemented in every SIM card and most of the Network operators uses these algorithms for authentication and data encryption. Both A3 and A8 use COMP128 algorithmic technique. The COMP128 algorithm is not very strong algorithm as it has so many flaws which allows eavesdropping and allows man in the middle attacks. The weakness present in COMP128 algorithm is that when it creates a 64 bits Kc, it sets the ten rightmost bits to zero which weakens the deployed algorithms 210 times, which is 1024 times weaker [2]. Another weakness in COMP128 algorithm is that attackers can extract the Ki which is the individual subscriber authentication key, from the mobile station by sending continuous random challenges for until they get succeeded. This type of attack is called SIM cloning. In 1998 ISAAC research group and SDA found a very crucial weakness in the COMP128 algorithm which was that they tried to send many RAND challenges to the Mobile station and were able to extract the Ki in eight hours [2]. IBM researchers also introduced some of the attacks to extract the 128 bit key with less then 1000 random inputs or by sending 255 selected inputs, it will only take a minute in order to capture the key [3]. There is another possibility of getting SIM card cloned which is that on the air interface, attacker can send known data several times to the SIM card and then analyzing the reply sent from SIM card the attacker can extract the Ki of the SIM card. There are more and more weaknesses which are present in COMP128 algorithms, but now I will come towards the efforts made to ride over these weaknesses then will suggest some of my ideas to improve the COMP128 algorithm.
In order to remove the weaknesses present in basic COMP128 algorithm the researchers proposed enhancements of the COMP128 algorithm, which are COMP128/1, COMP128/2 and COMP128/3. In COMP128/1 and COMP128/2 these problems were not completely diminished but attack risks were minimized, but when we actually talk about COMP128/3 it is certainly able to remove some of the weaknesses present in basic COMP128 algorithm, what it does is that instead of padding 10 rightmost bits to zeros it creates whole 64 bit key hence almost removes the threat for the SIM to be cloned. But my point here is that is it possible to interchange all the old SIM cards with the new ones ? my answer is no because there are millions of millions of subscribers of GSM, one will think why should we change the SIM card the answer is that A3 and A8 and COMP128 are implemented in the SIM card, hence in order to introduce the new COMP128 algorithms, all old SIMS should be interchanged with the new SIM cards which include all new COMP128 algorithms, which is not a best solution because it is very costly and is difficult to approach every subscriber to give him the new SIM card. So in my opinion researchers should find some other techniques which could be implemented in the HLR (Home Location Register) in order to remove the weaknesses present in GSM authentication. After discussing authentication I will now discuss data encryption and flaws present in algorithms used for data encryption in GSM networks.
For the purpose of encryption GSM makes use of A0 /0, A5/1, and A5/2, which varies from region to region. Amongst all A5/1 is the strongest algorithm used for securing the information sent over the network. But recent studies found some flaws in this technique too which shows that it is also susceptible to various attacks. When we talk about description of A5/1, it creates 228 bits long key which is XOR with frame bits, and the length of the frame is also 228 bits long. The A5/1 is initialized with 64 bit long key and the 22 bit frame number. It makes use of linear feedback shift registers which are irregularly clocked.
The A5/1 stream cipher is vulnerable to some cryptographic attacks like correlation attacks, algebraic attacks, and plaintext attacks [4]. Amongst all mentioned attacks very common attack is the plaintext attack, which uses the output of the A5/1 to compute the secret key. It is done in a way that attacker sends known plaintext to the mobile station and after having conversation of several minutes it can compute the secret key with in a second. The algebraic attacks use systems of equations and output and input of the bit shift registers to know the initial state of algorithm. There are many ways to avoid these attacks but recent researchers have proposed some new techniques for data encryption in order to get rid of these attacks. Hence A5/3 was proposed for GSM which is the stronger version.
Now after discussing the major algorithms used in GSM security and flaws present in them I will now discuss short messaging service's flaws and security breaches. Short messaging service (SMS) is gaining huge importance in recent years because it is now used worldwide for E-Commerce, mobile banking and a lot of other business uses such as share staking etc. All messages sent using short messaging service are sent in a conventional, text format. The sender's address can be fake one, and this weakness allows the fraudulent people to send harmful instructions or messages to anyone [5]. So it is very important to secure SMS services, but it is a huge wonder that still in this era of mobile banking and E-Commerce short messaging service uses plaintext data to send it over the network. The SMS is not encrypted or digitally signed to secure this service. According to me this is a huge flaw which needed to be filled up. I will suggest some idea in order to make SMS trusted and secure service. My idea is to use the basic A3 and A8 and A5 algorithms present in the mobile station to encrypt the SMS and treat SMS as a voice service and using same algorithms we can secure short messaging service. Another problem with SMS is that when someone sends an SMS, if the recipient's phone is off, the SMS will be stored in Network's SMS database and will be delivered to the recipient when he or she turns on the phone, my point here is that as SMS is not digitally signed hence anybody can read that SMS either it is the man in the middle who belongs to the network or any other hacker. So providing digital signatures with every SMS will solve this problem.
There is another huge drawback present in GSM, which is that all the encryption and security done in GSM is for the communication going through air interface, which is that the data is only encrypted between the MS and BS. All the signaling and voice or data communication which is wired is done using plaintext without any enhanced security measures.
Now at the end of the essay I will conclude the essay with summary and several ideas which I would suggest and some measures which should be taken in order to avoid any security breaches present in GSM and to avoid them in coming enhancements.
The algorithms used in GSM are not open source i.e. no one other than the experts of GSM can explore them, at first this think looks like good but in actual it is not the good thing to be done. If the algorithms become open source, then millions of millions of people will be going to explore them hence the weaknesses will come into front, hence after removing those weaknesses the algorithms can be implemented to the mobile phones. This will increase the security very much because all the weaknesses can be removed using this technique. But if GSM will not take these measures in the future, it will become very difficult to overcome the problem which will be spread to millions of subscribers.
In this essay I discussed about GSM security and different algorithms used for authentication, data encryption and key generation. There are some flaws and weaknesses present in GSM security model but some enhancements have been proposed in order to make GSM a very secure Mobile communication system. Instead of having some security issues with GSM, still it has got more benefits over other cellular systems. Despite of the security concerns more and more companies of the cellular world are upgrading their existing systems to the GSM systems in order to get benefits of the services provided by the GLOBAL SYSTEM FOR MOBILE COMMUNICATION.
