What Is 3G

Security
Used
In
3G Technology
3G Technology:-
 3G is the third generation of wireless technologies. It comes
with enhancements over previous wireless technologies, like
high-speed transmission, advanced multimedia access and
global roaming.
 3G is mostly used with mobile phones and handsets as a
means to connect the phone to the Internet or other IP
networks in order to make voice and video calls, to download
and upload data and to surf the net.
 Message authentication and replay inhibition of the mobile’s
ciphering capabilities allows the network to verify that
encryption has not been suppressed by an attacker.
 The presence of a sequence number in the challenge allows
the USIM to verify the freshness of the cipher key to help
guard against forced re-use of a compromised authentication
vector.
 However, the architecture does not protect against force use
of compromised authentication vectors, which have not yet
been used to authenticate the USIM. Thus, the network is
still vulnerable to attacks using compromised authentication
vectors.
 Integrity protection of critical signaling messages protects
against this attack. More specifically, data authentication and
replay inhibition of the connection set-up request allows the
serving network to verify that the request is legitimate.
 In addition, periodic integrity protected messages during a
connection helps protect against hijacking of un-enciphered
connections after the initial connection establishment.
Introduction:-
 Third generation (3G) networks were conceived from the
Universal Mobile Telecommunications Service (UMTS)
concept for high speed networks for enabling a variety of
data intensive applications.
 3G systems consist of the two main standards, CDMA2000
and W-CDMA, as well as other 3G variants such as NTT
DoCoMo’s Freedom of Mobile Multimedia Access (FOMA)
and Time Division Synchronous Code Division Multiple
Access (TD-SCDMA) used primarily in China.
Need to Secure the 3G Networks:-

 The security implication is that with more users of varied
data-capable devices who are accessing content and
communicating with one another across multiple networks,
there will be more traffic on the cellular networks. That
implies a higher likelihood of attacks occurring from any
number of sources.
 For example, many sophisticated attacks disguise

themselves in data flows across sessions and ports-the
more traffic there is, the harder it is to identify the threats.
When considering security in mobile systems, in common with

most other systems, our main objectives are in preventing:
 Access and use of service to avoid or reduce a legitimate

charge.
 Loss of confidentiality or integrity of a user’s or operator’s

data.
 Denial of a specific user’s access to their service or denial of
access by all users to a service.
Threats to Mobile devices:-

 While most Indians are still in the transient process of
switching from the existing to 3G networks, there is a need
for the operators and the government agencies to educate
consumers and make them aware about the imminent
threats and dangers that exist with the advent of 3G.
 Because such a technology has never been provided by

operators till date, they are not equipped to deal with the IP
security on mobiles.
 The new world of IP data is relatively new for to them as till

now they were used to dealing with comparatively mundane
voice centric security threats.
The threats on the mobile networks can originate from

mainly two sources:
1. External - The public internet, private networks and other

operator networks
2. Internal - Data capable handsets, smart phones, notebook

computers and even desktop computers connected to 3G.
Given below are some types of attacks which can be
carried over the 3G mobile networks:
1) Denial of Service (DoS):-
 DoS has been one of the most prevalent attacks on the
wired ISPs. It essentially uses methods to overpower the
systems with data, such that the target system is either
slowed or stopped. Inflicting such damage typically
requires a lot of compromised systems which are also
referred to as bots and collectively called “botnets”.
 Essentially, botnets are computers that have been

compromised by attackers, generally through the use of
Trojans, which are then remotely controlled by the
organization orchestrating the DoS attack. Laptops,
smart-phones, Blackberry phones and/or PDAs,
connected to the Internet via a mobile broadband
connection, could be similarly compromised and used as
bots in a DoS attack.
2) Overbilling Attack:-
 Another major threat will be an attack called “Overbilling”.
This involves hijacking the IP of the subscriber and using
it for the attackers own purposes. Eventually, this leads to
the legitimate user being billed for activity which they did
not undertake.
 The risks of attacks and other threats to 3G will keep
increasing as technology keeps developing. There is a
need for a strong, multilayered security which will help in
protecting our networks and consumers, not just in today's
3G world, but also in the future with IMS (IP Multimedia
Subsystem). There should be deployment of various
firewalls, IDPs, VPNs and other such security products.
Security:-
 3G networks offer greater security than their 2G
predecessors. By allowing the UE (User Equipment) to
authenticate the network it is attaching to, the user can be
sure the network is the intended one and not an
impersonator. 3G networks use the KASUMI block crypto
instead of the older A5/1 stream cipher. However, a number
of serious weaknesses in the KASUMI cipher have been
identified.
 In addition to the 3G network infrastructure security, end-to-

end security is offered when application frameworks such as
IMS are accessed, although this is not strictly a 3G property.
3G Security Principles:-
It was agreed that any new security architecture must be based
on an evolution of GSM and must adopt four basic principles:-
 It will take into account the additional features needed for

actual or predicted change in theoperating environment.
 It will maintain compatibility with GSM wherever possible.

 It will retain those features of GSM that have proved to be
robust and useful to the user and network operator.
 It will add or enhance features to overcome actual or perceived

weaknesses in 2G system.
3G security model:-
1. Network access security:-

 This class deals with the set of security mechanisms that
provide users with secure access to 3G service, as well as
protect against attacks on the radio access link.
2. Network domain security:-
 The class deals with the set of security mechanisms that

enables nodes in provider domain to securely transmit
signaling data to each other, as well as protect against
various attacks on the wireline network.
3. User domain security:-

ensures secure access to the mobile station. It is based
on physical device called UMTS Integrated Circuit Card
(UICC), which can easily be inserted and removed from
terminal equipment, containing security application like
Universal Subscriber Identity Module (USIM). The USIM is
responsible for performing subscriber and network
authentication, as well as key agreement, when 3G
services are accessed.
4. Application domain security:-

enable messages of application between the mobile
station and the serving network or service provider over
the network with the level of security chosen by the
network operator or the service provider.
5. Visibility and configurability of security:-
 The class deals with the set of features that enables the
user to inform him whether a security mechanism is in
operation or not and whether the use and provision of
services should depend on the security mechanism.

What Is 3G

Uploaded by

Copyright:

Available Formats

What Is 3G

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

What Is 3G

Uploaded by

Copyright:

Available Formats

Security

Need to Secure the 3G Networks:-

 For example, many sophisticated attacks disguise

When considering security in mobile systems, in common with

 Access and use of service to avoid or reduce a legitimate

 Loss of confidentiality or integrity of a user’s or operator’s

Threats to Mobile devices:-

 Because such a technology has never been provided by

 The new world of IP data is relatively new for to them as till

The threats on the mobile networks can originate from

1. External - The public internet, private networks and other

2. Internal - Data capable handsets, smart phones, notebook

 Essentially, botnets are computers that have been

 In addition to the 3G network infrastructure security, end-to-

 It will take into account the additional features needed for

 It will maintain compatibility with GSM wherever possible.

 It will add or enhance features to overcome actual or perceived

1. Network access security:-

2. Network domain security:-

 The class deals with the set of security mechanisms that

 The class deals with the set of security mechanisms that

4. Application domain security:-

 The class deals with the set of security mechanisms that

You might also like