GUTI Reallocation Demystified: Cellular Location Tracking with Changing Temporary Identifier

Speaker/Bio

David is a rising junior studying computer engineering with an interest in software defined radio and network security. David is a researcher in the NISLAB working with Professor Starobinski at Boston University.

Abstract

(taken from the paper, referenced below)

To keep subscribers’ identity confidential, a cellular network operator must use a temporary identifier instead of a permanent one according to the 3GPP standard. Temporary identifiers include Temporary Mobile Subscriber Identity (TMSI) and Globally Unique Temporary Identifier (GUTI) for GSM/3G and Long-Term Evolution (LTE) networks, respectively. Unfortunately, recent studies have shown that carriers fail to protect subscribers in both GSM/3G and LTE mainly because these identifiers have static and persistent values. These identifiers can be used to track subscribers’ locations. These studies have suggested that temporary identifiers must be reallocated frequently to solve this privacy problem. The only mechanism to update the temporary identifier in current LTE implementations is called GUTI reallocation. We investigate whether the current implementation of the GUTI reallocation mechanism can provide enough security to protect subscribers’ privacy.

Reference

NDSS. N.p., 2018.