A REVIEW OF SELECTED PROPOSALS FOR IMPROVING IDENTITY PRIVACY IN UMTS

International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 DOI: 10.5121/ijnsa.2019.11203 33 A REVIEW OF SELECTED PROPOSALS FOR IMPROVING IDENTITY PRIVACY IN UMTS Hiten Choudhury Department of Computer Science & Information Technology Cotton University, Guwahati, Assam, India A BSTRACT Universal Mobile Telecommunication System (UMTS) is a popular 3G standard for mobile telecommunication networks. ‘Vulnerability of the subscriber’s identity privacy and the need to eliminate this vulnerability’, is an established security issue in UMTS. This vulnerability continues to exist up to various extents in the descendent networks of UMTS, like LTE. Several solutions suggesting improvements to the identity privacy in UMTS is present in the literature. In this paper, we look into select few of these solutions, with the expectation that researcher envisioning to work in this area will get a direction in devising an efficient mechanism in improving identity privacy in UMTS, its descendants and future mobile networks. K EYWORDS Identity; Privacy; Authentication; Anonymity; IMSI; UMTS; LTE; Interworking 1. I NTRODUCTION 3rd Generation Partnership Project (3GPP) has standardised one of the most popular third generation mobile telecommunication network called the Universal Mobile Telecommunication System (UMTS). The security architecture of UMTS (Fig. 1) involves three primary participants namely: the Home Network (HN), the Serving Network (SN) and the Mobile Station (MS) that represents the subscriber. Every MS has to be registered with a HN (with their security credentials stored at the HN's data base). The HN contains key security elements like the Home Location Register (HLR) and the Authentication Centre (AuC). The HLR stores permanent sensitive information of the subscribers such as identity, service profile, activity status, etc., where as the AuC are a protected database that stores association between subscriber identities and long-term keys. The HN extends its services to its roaming subscribers through the SNs. The SN contains elements like the Visitor Location Register (VLR) and the Mobile Switching Centre (MSC). The VLR stores temporary information about subscribers visiting a given location area of the SN and maintains temporary to permanent identity associations, where as the MSC offer circuit-switching domain services. A MS directly communicates with a Base Transceiver Station or NodeB which covers the area the MS is located in. One or more NodeBs are connected with a Radio Network Controller (RNC). The RNC manages the radio resources and is the interface between the MS and the core network. Communication between the MS and the SN happens over radio link, whereas communication between the SN and the HN happens through wired link. While the radio link is considered to be vulnerable, it is assumed that the wired links are adequately secure. The Authentication and Key Agreement (AKA) protocol adopted by UMTS is called the UMTSAKA. This mutual authentication is done in two stages [1][2]: International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 34 In the first stage, the MS presents its identity to the SN. The SN, with the help of this identity, obtains the security credentials of the MS in the form of a set of Authentication Vectors (AVs) from the HN.  In the second stage, the SN utilises one of these AVs to perform mutual authentication of the MS through a challenge response mechanism. In this phase, a Cipher Key (CK) and an Integrity Key (IK) are established between the MS and the SN, so that communication over the otherwise vulnerable radio link can happen in a secured and reliable way. Figure 1. Simplified roaming architecture of UMTS. Each MS is assigned a unique and a permanent identity called the International Mobile Subscriber Identity (IMSI). This identity is assigned by the HN so that an MS may be uniquely identified. The IMSI is a precious piece of information that needs to be protected. Knowledge of the IMSI of a subscriber may allow an adversary to track and amass comprehensive profiles about individuals. Such profiling may expose an individual to various kinds of unanticipated risks, and above all may deprive an individual of his privacy. Thus, transmission of the IMSI is avoided for identity presentation during an AKA. To restrict the transmission of IMSI over the wireless link, an MS is assigned a short lived Temporary Mobile Subscriber Identity (TMSI). In spite of the above security arrangement, there are situations in UMTS-AKA where the identity privacy of a user may get compromised [3]. To address the vulnerabilities described above, researchers have suggested several new schemes, algorithms and protocols. In this paper, we discuss and analyse a selection of these solutions. The rest of the paper is organised as follows: section 2 presents a brief description of the UMTSAKA. The problem of user identity privacy vulnerability in UMTS-AKA is discussed in section 3. In section 4, we present the desirable features of an efficient identity privacy ensuring solution. In section 5, we discuss some of the threats to which a cellular network may be vulnerable. Section 6 reviews the solutions proposed by various researchers. In section 7, we present a couple of classifications based on which the identity privacy ensuring proposals may be categorised. Section 8 presents a comparative analysis of the proposed solutions. We conclude the paper in section 9. 2. U MTS -A KA UMTS-AKA achieves mutual authentication between the MS and the SN. In order to facilitate the authentication mechanism, each MS shares with its HN a long term secret key Ki and a set of one way hash functions viz., f0, f1 to f5, f8 and f9. In order to assure freshness of authentication data, two counters, viz., SQN MS and SQN HN are maintained at the MS and the HN respectively. UMTSAKA consists of the following two stages: International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 35 A. Distribution of Authentication Data 1. The MS presents its identity to the SN by transmitting it through the radio channel. 2. If the presented identity is a temporary identity, SN locates the corresponding IMSI using the TMSI-IMSI mapping maintained in its local database. The SN then sends an authentication data request to the HN along with the IMSI. 3. Upon receipt of the message, HN generates an authentication vector denoted by AV. Each AV consisting of five elements, viz.: a Random Number (RAND), an Expected Response (XRES), a Cipher Key (CK), an Integrity Key (IK), and an Authentication Token (AUTH). An AV is generated according to the following steps (Figure 2): Figure 2. Generation of AV.  HN generates a Random Number RAND using the function f0, and a Sequence Number SQN from the counter SQN HN .  HN then calculates the following values: XRES = f2 Ki (RAND) CK = f3 Ki (RAND) IK = f4 Ki (RAND) AK = f5 Ki (RAND) MAC = f1 Ki (SQN || RAND || AMF) Where AK: Anonymity Key, MAC: Message Authentication Code, AMF: Authentication and Key Management Field, and '||' denote concatenation. AK is used to conceal the sequence number, as the later may expose the location of the user. If no concealment is needed, AK is set to zero. 4. HN assembles the Authentication Token AUTH = SQN ⊕ AK || AMF || MAC and the Authentication Vector AV = (RAND, XRES, CK, IK, AUTH), where, ' ⊕ ' is bit wise Exclusive OR operation. 5. HN increments SQN HN by 1. 6. Finally, HN sends AV back to the SN. B. Authentication and Key Agreement 1. SN selects extracts RAND and AUTH from AV and sends it to the MS as a challenge. 2. MS calculates AK = f5 Ki (RAND). Using the calculated AK, the sequence number SQN = AUTH ⊕ AK is calculated. SQN is then compared with SQN MS in order to verify freshness of the challenge. MS then computes MAC = f1 Ki (SQN || RAND || AMF) and compares this value with the MAC included in AUTH. If they are different, MS rejects the connection procedure, otherwise it accepts it. 3. Finally MS computes RES = f2 Ki (RAND) and sends it back to SN. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 36 4. Upon receipt of the RES, SN compares it with XRES. If these values match, the authentication process is considered successful. CK and IK, calculated at either end are used to secure further communications between the SN and MS. The mutual authentication and key agreement process is schematically expressed in Fig. 3. Figure 3. Authentication and Key Agreement. 3. I DENTITY P RIVACY IN UMTS-AKA To achieve identity privacy during UMTS-AKA, a subscriber is identified within the SN by a TMSI. A TMSI has a local significance and therefore in order to avoid ambiguities, outside the SN, a TMSI should be appended with the Location Area Identification (LAI) of the SN. To avoid compromise of identity privacy, a subscriber should not be identified by means of the same temporary identity for a long period. The allocation of a new temporary identity is initiated by the SN. The SN generates a temporary identity (TMSIn) and stores the association of TMSIn and the IMSI in its local database. The SN then sends this new TMSIn and (if necessary) the new location area identity LAIn to the user through a ciphered channel. This channel is secured using the CK and the IK established at either end. In spite of the above security mechanism, there are situations when the identity privacy of a subscriber may get compromised due to the transmission of its IMSI in clear-text. Some of the situations when the IMSI of an MS becomes vulnerable are as follows (Figure 4):  MS attaches for the first time with the SN and has not yet received a TMSI: In such a situation, the MS has to present its identity to the SN by transmitting its IMSI in clear-text through the wireless link.  A database failure at the SN prevents retrieval of IMSI from the TMSI: In such a situation the SN will be forced to request the MS for its IMSI. The later will then have to be transmitted in clear-text through the wireless link.  After roaming into a new SN's region, the old SN cannot be contacted for the TMSI-IMSI mapping: When an MS moves into the region of a new SN (SNn), it will present its identity to SNn through the TMSI allocated to it by the previous SN (SNo). In order to request for a new set of authentication vectors from HN, SNn will need to have the knowledge of the IMSI. Normally this will be obtained by presenting the TMSI to SNo. However, in case SNo cannot be contacted, SNn will be forced to ask the MS for its IMSI. The later will then have to be transmitted in clear-text over the radio link by the MS. This vulnerability can in fact be exploited by an attacker who can masquerade as a new SN.  UMTS-AKA assumes full trust relationship within the wired intermediary service network components, and hence the IMSI is transmitted freely amongst them. The possibility of an intermediary agent (like a third party SN) turning hostile and misusing or compromising the IMSI is ruled out. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 37 Thus, ensuring complete identity privacy still remains elusive in UMTS. Several works has been carried out to device enhanced identity privacy in UMTS. Each of these follows different approach and has different characteristics. Figure 4. Identity privacy in UMTS-AKA. 4. D ESIRABLE F EATURES OF AN I DENTITY P RIVACY E NSURING S OLUTION In this section, we discuss some of the characteristics that we believe are desirable in an efficient identity privacy ensuring solution for UMTS:  Less computational overhead at the MS: Computationally intensive algorithms must be avoided at the MS, as they are limited by low battery power and computational capability. Symmetric key based computations that are less processor intensive are more suitable compared to public key based computations for the MS.  Less computational overhead at the HN: Since the HN needs to cater to a large number of subscribers; it should avoid computationally intensive algorithms, because such algorithms may increase the overall processing time of the subscriber's requests. Thus, symmetric key based computations are more desirable compared to public key based computations, at the SN.  No impact at the SN: A migration to a new solution should be transparent to the SN. This would make adoption of the protocol easy for service providers who have to rely on third party SNs for providing services to its own subscribers.  End to end identity privacy: An ideal identity privacy ensuring solution should provide end to end identity privacy to the subscribers by restricting the transmission of IMSI in clear text throughout the entire path (wired and wireless) between the MS and the HN. Even key intermediary element like the SN should not have any knowledge about the IMSI of the MS. This would relax the trust requirement which otherwise is a prerequisite for roaming agreements between the HN and the SN. Such a relaxation would specifically be helpful in cases where the same service provider does not own both the HN and the SN.  Communication efficiency: Any kind of security mechanism introduces extra traffic as well as delay into a regular communication. An efficient identity privacy ensuring solution should achieve its objectives with as few signaling message exchanges as possible. This would ensure better performance in terms of traffic overhead and overall latency introduced in the communication. We consider a solution to have communication efficiency if the number of message exchanges involved in it is not more than the number of message exchanges involved in UMTS-AKA. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 38 5. T HREATS An identity privacy ensuring solution should be robust against perceived threats like: eavesdropping, denial of service attack, corrupt serving network, and fake serving network. Each of these threats is briefly discussed below: 1. Eavesdropping: Eavesdropping is the act of secretly listening to the private conversation of others without their consent or knowledge. The IMSI is a concatenation of the Mobile Country Code (MCC), the Mobile Network Code (MNC), and the Mobile Subscriber Identification Number (MSIN). The MCC and the MNC combined constitutes the IMSI prefix that identifies the MS’s HN, whereas the MSIN uniquely identifies an MS within the HN’s subscriber base. If the MSIN gets disclosed to an eavesdropper in the radio link, the user’s identity gets compromised. And, if the MCC and the MNC gets disclosed to an eavesdropper in the radio link, the MS’s HN identity gets compromised [4]. 2. Corrupt Serving Network: A corrupt serving network is a genuine SN having legitimate service agreement with the HN, but with malicious intention. Such a serving network may clandestinely share precious identity privacy related information entrusted to it by the MS and the HN [5]. 3. Fake Serving Network (Impersonation): A fake serving network is an impersonated SN that drowns the signals of a legitimate SN with its own signals and presents itself to the MS as a genuine SN [6]. 4. Denial of Service: A Denial-of-Service attack (DoS attack) is an attempt to make a computer resource or a service unavailable to its intended users. One common method of the attack involves inundating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be considered effectively unavailable [7][8]. 6. S OLUTIONS In this section, we present brief and simplified interpretation of a select few solutions that are proposed by various researchers to achieve enhanced user identity privacy in UMTS. While, different authors have used different naming conventions, for clarity and uniformity, we follow a common naming convention for the various components involved in the AKA procedure. A. Coupon Based Solution (CBS) This scheme proposes one time coupons to be transmitted instead of the IMSI [9]. Since, a coupon is used only once, no correlation between the coupon and the corresponding IMSI can be found by an adversary. These onetime coupons are generated at the HN and provided to the MS. During an authentication process, these onetime coupons are transmitted by the MS prefixed with the MCC and the MNC. The association between the coupons and the IMSI is maintained at the home network's local database. For every new connection, the MS uses a new one time coupon to communicate with the SN. This coupon is then forwarded to the appropriate HN along with the request for authentication data. HN in turn, sends to the MS a new set of one time coupons C1...Cn for future connections along with the authentication data. B. PKI Based Solution (PBS) A Public Key Infrastructure (PKI) based solution is also proposed in [9]. In this solution, the MS generates a random value and builds the following bit sequence: Seq=00001<random value>00<IMSI> International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 39 This bit sequence is then encrypted with the HN's public key and is sent to the HN through the SN. The encrypted bit sequence is used as an alias and is prefixed with the MCC and the MNC. Each time the alias needs to be renewed, a new random value is generated by the MS, and the aforementioned procedure is repeated. At the HN's end, the IMSI is recovered from the alias. C. Anonymous Number Based Solution (ANBS) Another technique that is proposed in [9] is an extension of UMTS-AKA, where both the HN and the MS independently derive one time aliases called the International Mobile Anonymous Number (IMAN). An IMAN is derived from the AK that is generated as a part of UMTS-AKA, as follows: IMAN = MD5 (AK || SQN || RAND) where MD5 is a hash function and '||' denotes concatenation. The concatenation of the SQN and RAND ensures the freshness of the result. During the protocol flow an IMAN is used to identify a given MS, instead of the IMSI. A mapping between the most recent IMAN and the IMSI is maintained at the MS. At the end of a successful mutual authentication process, the MS updates its IMAN. Like the other protocols proposed in [8], this protocol also needs MCC and MNC to be prefixed to an IMAN. Figure 5. States of the system: (a) initial (b) final D. I UIC A mechanism called the Improved User Identity Confidentiality (IUIC) is proposed in [10]. In this mechanism, anonymous tickets are employed as aliases for the IMSI. The IMSI is never exposed over any interface including the wired path. The TMSI plays the same role as in UMTS-AKA. IUIC uses UMTS symmetric cryptography algorithms to ensure anonymity of tickets.  A separate module called Anonymous Ticket Manager Module (ATMM) is introduced at the HN to handle ticket related functions. The ATMM manages some of the key ticket management operations such as:  Mapping tickets and their corresponding IMSI.  Generating new tickets for the MS and releasing already used tickets.  The assigned tickets should be unique, and hence a single ticket should not be allocated to more than one MS at a particular instance of time. Also, there should not be any logical relationship between the anonymous tickets and the IMSI of an MS. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 40 Two tickets, viz., TKa with in-use status and TKb with future-use status are stored at both the MS and the HN along with the IMSI (Figure 5.a). The SN knows only the ticket with in-use status (TKa), and keeps the relation between TMSI and TKa in its database. A TMSI identifies the MS for the SN, whereas a TKa identifies the MS for the HN. While sending a request for authentication data, SN sends TKa to the HN instead of the IMSI. On receipt of such a request, HN first retrieves IMSI from TKa and then continues with its normal operations. Whenever a TMSI cannot identify its owner MS, or the relation between the TMSI and an associated ticket is lost, a process called Anonymous Ticket Exchange procedure (ATEP) is invoked. During ATEP, the MS sends TKb to the SN. The SN temporarily stores TKb and forwards a copy of it to the HN. Taking TKb as the parameter, the HN obtains the next free ticket TKc and the corresponding IMSI from the Anonymous Ticket Manager Module (ATMM). The ATMM then frees TKa and sets TKb to in-use status and TKc to future-use status (Figure. b). HN then generates the next AV in the same way as in UMTS-AKA, except that TKc is XORed with the AK instead of the SQN. The HN then forwards the AV to the SN. The SN in turn sends the challenge extracted from the AV to the MS; in the process TKc reaches the MS. MS then sets TKb to in-use and TKc to future-use status. Next time, when TMSI fails to identify an MS, TKc can be used in place of the IMSI as explained above. E. P P 3 WAKA A privacy preserving 3-way authentication and key agreement (PP3WAKA) protocol is proposed in [11] that protects user identity and location data from eavesdropping. It also provides location privacy with respect to the HN. This protocol is devised to deal with the following privacy related security issues:  Long Term Security Context: These security contexts are based on roaming agreements (SNHN) and service subscriptions (MS-HN).  Medium Term Security Context: This context is established dynamically on the basis of long term contexts, and it includes the MS, SN and HN. The validity is restricted according to area, time and usage patterns.  Short Term Security Context: This context is derived from the medium term context. It encompasses session key material. These contexts are short lived and will only have local validity (MS-SN).  Spatial home control: HN may need to know if the MS is located within some Validity Area (VA), but no other information should be disclosed to the HN. To get spatial home control, the HN must define a VA for the roaming MS. In this scheme, the long term shared secret key between the MS and the HN forms a part of the long term security context. The PP3WAKA is an MS initiated scheme. The MS initiates by choosing a pseudorandom value called the Context Reference Identity (CRID). CRID is chosen such that it has no correlation with the user’s permanent identity IMSI. The CRID acts as common (authenticated) reference to the three party medium term security context and is valid for exactly one medium-term 3-way security context. Since the HN should be able to forward data to the MS, the HN is allowed to learn the IMSI-CRID association. The CRID-IMSI association is forwarded to the HN without disclosing the same to the SN. SN shall not learn permanent identity (IMSI), but will know that HN acknowledges CRID. For short term security context, a local Temporary Alias Identity (TAID) is assigned by a SN during a confidentiality protected session. The TAID is used for paging and access request purposes. The TAID should ideally be assigned for one time use. There should be no correlation International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 41 between CRID and TAID and amongst TAIDs. SN and MS know TAID-CRID association. The following cryptographic algorithms are used for implementation of the PP3WAKA protocol:  Secure Multi-party Computation (SMC): With the help of this algorithm, the SN is enabled to transfer the MS's location (x, y) in protected form to the HN. The HN will not be able to learn the (x, y) location, but will be able to determine whether the MS is within the validity area by running a point inclusion algorithm.  Identity Based Encryption (IBE): This is an unconventional asymmetrical cryptographic method in which there is no need for a prior distribution of digital certificates, the MS can enter a new area and immediately construct and use the public id key. This allows for fast set-up and for improved flexibility in the context binding.  Deffie-Hellman Exchange: Deffie-Hellman Exchange is used between the SN and the HN to derive the medium term-security context shared secret. It may be noted that the DH-secret is actually used between the SN and the MS. F. G SZV A LGORITHM The GSZV algorithm proposed in [12][13] uses public key infrastructure, public key certificates and sequence numbers for its protocol flow. Public keys are used for secured communication of the messages, certificates are used for mutual authentication, and sequence numbers are used to avoid replay attacks. The algorithm proceeds as follows:  MS sends the following message to the SN: msg1=E SN (CERT, E HN (SQN MS )) where CERT is the certificate issued to the MS by the HN: CERT = E HN ((IMSI, Kp) C HN ) E SN (M) and E HN (M) indicates encryption of a value M with the public key of SN and HN respectively; (M)C SN and (M)C HN indicates encryption of M with the private certification key of SN and HN respectively; SQN MS is the most recent sequence number at the MS; Kp is the public key of the MS.  SN decrypts msg1 and discovers the home address of the MS from the CERT. It then generates the following message, which is certified by its private certification key and encrypted with the HN's public key. msg2=E HN {CERT, E HN (SQN MS ), TMSI, SQN SN , C SN } Here TMSI is the temporary mobile subscriber identity generated by the SN and SQN SN is the sequence number maintained at the SN. msg2 is then forwarded to the HN.  HN extracts the IMSI from the message and hence authenticates the MS. It then composes the following reply: msg3=E SN {SQN MS , TMSI} C HN , {SQN HN , KP} C HN The public key of the MS (KP) is recovered from the CERT.  SN checks for the authenticity of the HN's signature. The SN then sends the following message to the MS. msg4=E KP {SQN MS , TMSI} C HN )  MS decrypts the message and validates the digital certificate of the HN. MS then forwards the following message back to the SN for mutual authentication purpose. msg5=E SN (SQN MS ) International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 48  The functioning of the SN will be significantly influenced, as format of message used for identity presentation is different from UMTS-AKA.  Since a bit sequence is presented to the SN in lieu of the IMSI, end to end identity privacy is ensured in this scheme.  Since the number of messages exchanged between the agents in this protocol is same as 3GPPAKA, it ensures communication efficiency. PKI based technique vis-a-vis threats:  In this protocol, every bit sequence is prefixed with the MCC and the MNC. This will enable an eavesdropper to determine the home network identity of a subscriber.  A corrupt SN does not have a chance, as the IMSI is not shared with it.  A Fake SN may frequently request the MS its permanent identity. This will make the MS generate a random value every time, which is then encrypted with the HN's public key. Since public key cryptography is resource intensive, the MS will be kept engaged with this cryptographic computation rather than the actual service, resulting in Denial of Service. O. A NONYMOUS N UMBER B ASED T ECHNIQUE Anonymous number based technique vis-a-vis desirable features.  Calculation of a new IMAN value at the MS is not computationally intensive, since MD5 algorithm having low computational requirement is used in this process [22][23].  The above is not true for the HN where extra computational cycles are introduced to check for IMAN collisions.  Since an IMAN is transmitted instead of the IMSI, the SN has to make adjustments to accommodate the same.  This scheme ensures end to end identity privacy, since the MSIN is never transmitted at any stage of the communication between the MS and the HN.  No extra message is introduced in this scheme compared to UMTS-AKA, thereby ensuring communication efficiency. Anonymous number based technique vis-a-vis threats.  An IMAN is prefixed with the MCC and the MNC, this may enable an eavesdropper to discover the home network identity of a subscriber.  Since the IMSI is not shared with the SN, a corrupt and a fake serving network cannot compromise the permanent identity. P. I UIC IUIC vis-a-vis desirable features:  In this scheme, the MS's additional responsibility is to store the token that is received from the previous ticket exchange procedure and to transmit it in place of the IMSI when required. Thus, very little computational overhead is imposed on the MS.  Although considerable computational overhead is imposed at the HN due to introduction of the ATMM, the same may be considered to be insignificant considering the computational capability of the HN.  The protocol introduces adjustments on all the agents including the SN  End to end identity privacy is ensured in this protocol, as the permanent identity is never transmitted at any stage of the protocol flow.  The number of message exchange involved in this solution is same as that of UMTS-AKA. Thus, we infer that this solution achieves communication efficiency. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 49 IUIC vis-a-vis threats.  In this protocol, every token should be prefixed with the MCC and the MNC. This provides scope for an eavesdropper to compromise the home network identity of a subscriber.  Since tokens are transmitted instead of the IMSI, a corrupt and a fake serving network cannot compromise the permanent identity. Q. P P 3 WAKA PP3WAKA vis-a-vis desirable features.  Due to the use of processor intensive cryptographic algorithms, the computational overhead introduced at the MS and the HN is very high.  The solution is totally different from the state of the art security architecture. Thus, the SN will have full impact if the solution has to be adopted in place of the current security protocol.  End to end identity privacy is achieved in this solution, as the IMSI is not shared with any intermediary elements including the SN.  The numbers of messages exchanged in this solution is more than that of UMTS-AKA. Thus, we infer that this solution is not as efficient as UMTS-AKA in terms of communication. PP3WAKA vis-a-vis threats.  In the first message of the authentication procedure, the MS sends the home networks identity to the SN through the radio link in clear text. This leaves scope for adversaries to eavesdrop and compromise the home network identity of the MS.  A corrupt and a fake serving network do not have any chance, as the permanent identity is never transmitted by the MS.  A Fake SN may request the MS to initiate an authentication process. The MS in reply generates a message that is secured with the public key, and forwards it to the SN. Through this exercise the Fake SN cannot achieve much in terms of compromised information, but can easily generate many such requests for the MS that will be enough to keep the MS busy with computationally intensive cryptographic calculations. This may result in denial of regular cellular services that the MS has subscribed to. R. G SZV GSZV vis-a-vis desirable features:  Being a public key infrastructure based algorithm, the MS and the HN are imposed with extra overhead.  The SN is also expected to participate in the protocol implementation.  End to end identity privacy is achieved by this protocol as IMSI is not transmitted throughout the entire path between the MS and the HN.  The number of message exchange in this solution is same as that of UMTS-AKA. Thus, we conclude that it achieves communication efficiency. GSZV vis-a-vis threats:  This protocol protects the home network identity form eavesdroppers in the radio path by protecting the IMSI through the use of public key cryptography.  As the IMSI is not shared with the SN, a corrupt SN does not have any chance. International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 50  A Fake SN may request the MS to initiate an authentication process. The MS in reply generates a message that is secured with the public key, and forwards it to the SN. Through this exercise the Fake SN cannot achieve much in terms of compromised information, but can easily generate many such requests for the MS that will be enough to keep the MS busy with computationally intensive cryptographic calculations. This may result in denial of regular cellular services that the MS has subscribed to. Table III. Identity privacy ensuring solutions in terms of robustness against threats . Solution Eavesdropping DoS Corrupt SN Fake SN CBS × × √ × PBS × × √ × ANBS × √ √ √ IUIC × √ √ √ PP3WAKA × × √ × GSZV √ × × × AIRAM √ × × × HAAP × √ √ √ E2EUIC × √ √ √ 3GPP-AKA with IP × √ × √ S. A IRAM Since this algorithm is proposed as an improvement over GSZV, most of its features are same as GSZV. The only difference being the fact that the SN is confided with the long term shared secret key between the MS and the HN by the HN. Such a level of trust shown on the SN is not practical and may be considered as a serious security loophole. T. H AAP HAAP vis-a-vis desirable features:  In this scheme, public key cryptography is used for communication between the MS and the SN. Thus extra computational overhead will be imposed at the MS.  Communication between the MS and the HN relies on symmetric key. Thus the cryptographic calculations imposed at the HN may be considered negligible.  The protocol flow is different from UMTS-AKA and thus needs considerable change at the SN.  The IMSI is not transmitted in clear text in the entire path between the MS and the HN. Thus end to end identity privacy is ensured.  This protocol achieves its objectives with less number of messages compared to UMTS-AKA and thus, we consider it to be an efficient solution in terms of communication. HAAP vis-a-vis threats:  During authentication, the MS sends the home network identity (IDH) in plain text to the SN. This leaves scope for adversaries to eavesdrop and compromise the home network identity of the MS (Type II vulnerability). International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 51  As the transmission of the permanent identity is replaced by temporary identities, this protocol is robust against corrupt and fake SNs. U. E2 EUIC E2EUIC vis-a-vis desirable features:  Minimal overhead of storage and transmission of the RIC at a later time is imposed at the MS.  The burden of generation and maintenance of RIC is introduced at the HN. Considering the sound processing capability of the HN, this may be considered insignificant.  Since the format of the messages does not change compared to UMTS-AKA, there is no impact on the functionality of the SN.  End to end identity privacy is achieved, as the knowledge of the IMSI is not shared with anyone except the MS and the HN.  Since the number of messages exchanged in this protocol is same as UMTS-AKA we may infer that the protocol ensures communication efficiency. E2EUIC vis-a-vis threats:  The Dynamic Mobile Subscriber Identity that is transmitted in place of the International Mobile Subscriber Identity is prefixed with the MCC and the MNC of the HN. This provides scope for adversaries to eavesdrop and compromise the home network identity of the MS.  A corrupt/fake SN does not have a chance as the IMSI is not transmitted in any situation. V. 3GPP-AKA W ITH I DENTITY P ROTECTION 3GPP-AKA with Identity Protection vis-a-vis desirable features:  As simple one way hash functions are used for encryption/decryption of the IMSI, minimal overhead is imposed at the MS and the HN.  The effect of migration to this protocol will impact the SN, since new message formats and protocol flow is introduced.  Since IMSI is transmitted freely between the SN and the HN and as such we may conclude that end to end identity privacy feature is not satisfied.  The number of messages exchanged in this protocol is more compared to UMTS-AKA. 3GPP-AKA with Identity Protection vis-a-vis threats:  Since the home network identity of the MS is transmitted over the radio link in clear text, an eavesdropper may easily compromise the home network identity of the MS.  In this protocol the IMSI of a MS is shared with the SN. This makes the permanent identity of a MS vulnerable to Corrupt Serving Networks. 9. C ONCLUSION AND F UTURE W ORK Identity privacy is a crucial security issue in cellular networks. The current authentication and key agreement protocol adopted by UMTS does not assure perfect identity privacy. A selection of proposed solutions towards strengthening identity privacy in UMTS were analysed in this paper. The same could be useful in providing a background in formulating a strong identity privacy ensuring solution. Though many schemes and protocols have been proposed to strengthen identity privacy, each of them is inept in fulfilling all the identity privacy related requirements at the same time. Thus, none of the proposed strategies could be adopted convincingly to strengthen the International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 52 condition of identity privacy in cellular networks. As a result, the status of identity privacy remains as it earlier used to be in UMTS. Even next generation cellular network technologies like 3GPPWLAN interworking, LTE and non 3GPP to EPS interworking are unable to achieve any major breakthrough. Therefore, an open issue is to develop a single scheme that fulfils majority of the identity privacy related requirements. While designing such a solution adherence to some of the important features like less overhead on the network components, end to end user identity privacy, leaving out the serving network from migration, etc., will be vital for its success. It is also imperative that while trying to address the issue of identity privacy, the solutions should steer clear of introducing any additional vulnerability. A failure to do so would provide opportunities to adversaries, which in the first place such solutions are trying to nullify. R EFERENCES [1] G. Koien, “An introduction to access security in umts”, IEEE Wireless Communications, Vol. 11, Issue. 1, pp. 8–18, 2014. [2] C. Xenakis, L. Merakos, “Security in third generation mobile networks”, Computer communications, Vol. 27, Issue. 7, pp. 638–650, 2014 [3] M. Khan, A Ahmed, A Cheema, “Vulnerabilities of umts access domain security architecture” In the proceedings of Ninth IEEE ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing, pp. 350–355, 2008 [4] Y. Zhang, J. Zheng, M. Ma, “Handbook of research on wireless security”, Information Science Reference-Imprint of: IGI Publishing, 2008. [5] M. Zhang, “Adaptive protocol for entity authentication and key agreement in mobile networks”. In the proceedings of Information Security and Cryptology, pp. 166–183, 2004 [6] M. Zhang, Y. Fang, “Security analysis and enhancements of 3gpp authentication and key agreement protocol”, IEEE Transactions Wireless Communications, Vol. 4, Issue. 2, pp. 734-742, 2005 [7] G. Carl, G Kesidis, R Brooks, S Rai, “Denial-of-service attack-detection techniques”, IEEE Internet Computing, Vol. 10, Issue. 1, pp. 82–89, 2006 [8] S.A.Arunmozhi, Y.Venkataramani, “DDoS Attack and Defense Scheme in Wireless Ad hoc Networks”, International Journal of Network Security & Its Applications (IJNSA), Vol.3, Issue.3, pp. 182-187, 2011 [9] M. Barbeau, J. Robert, “Perfect identity concealment in umts over radio access links”, In the proceedings of IEEE Wireless And Mobile Computing, Networking And Communications, vol. 2, pp. 72-77, 2005 [10] B. Sattarzadeh, M. Asadpour, R. Jalili, “Improved user identity confidentiality for umts mobile networks”, In the proceedings of IEEE fourth European Conference on Universal Multiservice Networks, pp. 401-409, 2007 [11] G. Køien, V. Oleshchuk, “Location privacy for cellular systems; analysis and solution”, Privacy Enhancing Technologies, Springer, pp. 40-58, 2006 [12] G. Godor, B Varadi, S. Imre, “Novel authentication algorithm of future networks”. In proceedings of IEEE International Conference on Mobile Communications and Learning Technologies, pp. 80-80, 2006 [13] G. Godor, S. Imre, “Novel authentication algorithm – public key based cryptography in mobile phone systems”, IJCSNS, Vol. 6, Issue. 2B, pp. 126, 2006 International Journal of Network Security & Its Applications (IJNSA) Vol. 11, No.2, March 2019 53 [14] M. Naveed, A. Minhas, J. Ahmad, “Improved authentication algorithm for umts”, In the proceedings of the International Conference on Hybrid Information Technology, ACM, pp. 327-332, 2009 [15] M. Al-Fayoumi, S Nashwan, S. Yousef, A. Alzoubaidi, “A new hybrid approach of symmetric/asymmetric authentication protocol for future mobile networks”, In the proceedings of third IEEE International Conference on Wireless and Mobile Computing, Networking and Communications, 2007, pp. 29-29, 2007 [16] H. Choudhury, B. Roychoudhury, D. Saikia, “End-toend user identity confidentiality for umts networks” In the proceedings of 3rd IEEE International Conference on Computer Science and Information Technology, Vol. 2, pp. 46-50, 2010 [17] H. Choudhury, B. Roychoudhury, D. Saikia, “Umts user identity confidentiality: An end-to-end solution”, In the proceedings of eighth IEEE International Conference on Wireless and Optical Communications Networks, pp. 1-6, 2011 [18] W. Juang, J. Wu, “Efficient 3gpp authentication and key agreement with robust user privacy protection” In the proceedings of IEEE Wireless Communications and Networking Conference, pp. 2720-2725, 2007 [19] B. Schneier, P. Sutherland, “Applied cryptography: protocols, algorithms, and source code in C”, John Wiley & Sons, Inc., 1995. [20] J. Edney, W. Arbaugh,. “Real 802.11 security: Wi-Fi protected access and 802.11 i”, Addison-Wesley Professional, 2004 [21] T. Hardjono, L. Dondeti, “Security in wireless lans & mans”, Artech House Computer Security, 2005 [22] P. Ganesan, R. Venugopalan, P. Peddabachagari, A. Dean, F. Mueller, M. Sichitiu, “Analyzing and modelling encryption overhead for sensor network nodes”, In proceedings of the 2nd ACM international conference on Wireless sensor networks and applications, ACM, pp. 151-159, 2003 [23] W. Freeman, E. Miller. “An experimental analysis of cryptographic overhead in performance-critical Systems”, In the proceedings of 7th IEEE International Symposium on Modelling, Analysis and Simulation of Computer and Telecommunication Systems, pp. 348-357, 1999