Mobility and Security Management in

the GSM System and Some Proposed

Future Improvements
ASHA MEHROTRA, MEMBER, IEEE, AND LEONARD S. GOLDING, LIFE FELLOW, IEEE

Important aspects of mobility and security in the Global System b) MS turned on, idle state: Here, the system can page
for Mobile communications (GSM) system are discussed in this the MS successfully. This is the situation in which
paper. Mobility management functions are broadly categorized the MS is considered attached (IMSI attached). While
into three groups: a) mobile turned on, b) mobile turned off,
and c) mobile in conversation. The paper first outlines the mo- on the move, the MS has to check that it is al-
bile synchronization sequence followed by its mobility functions: ways connected to the best received broadcast control
mobile identification, authentication, international mobile station channel (BCCH). This procedure is called roaming.
identity attach/detach, and its location update. The important While on the move, the mobile must also inform the
role of security in the GSM system is fully explored, including
authentication, encryption, and positive identification of mobile
system about changes of LA, which is called location
equipment before the user is provided with the service. The future updating.
of mobility management, with respect to subscriber identification c) MS busy: The radio network has traffic channels
module roaming, intersystem roaming, advancement in mobile
allocated for the data flow to/from the MS. While
service, and its impact on data base requirements, is covered in
subsequent paragraphs. moving, the MS must also be able to change to
a new traffic channel as the signal on the traffic
Keywords— Encryption, GSM signaling protocols, intersystem
roaming, mobile temporary ID, mobility management, security channel drops below an unacceptable level, which is
management, SIM roaming, subscriber, subscriber identity mod- called handover. In order to decide whether to hand
ule, TMSI attach and detach, white, black, and gray equipment over, the mobile switching center (MSC) base station
list.
controller (BSC in some cases) interprets information
received from the MS and base transceiver station
I. INTRODUCTION (BTS) known as locating.
Mobility management (MM) entails the Global System
In view of the above, we shall discuss the complete mobility
for Mobile communications (GSM) system’s keeping track
of the mobile while it is on the move. Basically, we have aspect of the system, which revolves around these three
two different situations: mobile idle and mobile busy. These states.
two cases lead to all the relevant cases we need to consider: Another important aspect of the GSM system is security.
a) mobile station (MS) is turned off, b) MS is turned on but At an early stage in the development of the Pan-European
is in the idle state, and c) MS is in the conversational mode. mobile radio system GSM, it was apparent that the weakest
part of the system was the radio path, as this could be
a) MS turned off: In this case, the mobile cannot be easily eavesdropped upon with radio equipment. There
reached by the network because it does not answer was also a need to authenticate users of the system so
a paging message. It does not inform the system that the resources were not misused by nonsubscribers.
about possible changes of location area (LA), as it It is easy to see that the public land mobile network
is simply inoperative. In this case, the MS is simply (PLMN) needs a higher level of protection than traditional
considered detached from the system [international telecommunications networks. Therefore, to protect the
mobile station identity (IMSI) detached]. system against the two cases mentioned above, the GSM
system has been reinforced by the following four security
techniques [1]–[3]:
Manuscript received June 13, 1997. • anonymity: mobile temporary identification (ID)
The authors are with Hughes Network Systems, Germantown, MD (TMSI);
20876 USA (e-mail: [email protected]; [email protected]).
Publisher Item Identifier S 0018-9219(98)04245-5. • authentication;

0018–9219/98$10.00  1998 IEEE

1480 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 1. GSM signaling protocols [3, p. 266].

• encryption; interfaces use the SS7 message transfer part (MTP) level
• user’s subscriber identity module (SIM) module and 1 with channel rates of 64 kb/s, where the medium can be
mobile equipment ID. coaxial cable, balanced wire pairs, or fiber-optic cable.
Among these, we shall elaborate on three important tech- The data link layer uses integrated services digital net-
niques: authentication, encryption, and mobile equipment work (ISDN) link access protocol D (LAP-D) on the
ID. -Interface and a version called LAP-D on radio links
To make the discussion complete, the last section of the to MS’s. LAP-D uses the GSM RF interface framing and
paper will deal with future improvements one should pursue synchronization scheme rather than that of ISDN. All other
in these areas. The following are candidates for discussion: interfaces use the SS7 MTP level 2 protocol for the data link
improvement in SIM roaming, intersystem roaming, future layer. The air and -Interfaces have no network layer.
service, and data base requirements. Before we discuss the All other interfaces within GSM use both MTP level 3 and
mobility aspect of the user, let us briefly introduce the the SS7 signaling connection control part (SCCP). MTP
GSM protocols and how the mobile synchronizes within 3 provides routing of general connectionless messages to
the GSM system. Both factors are intimately tied to the the various network nodes, while SCCP routes connection-
mobility aspect of GSM users. oriented-messages, specific to a particular user transaction,
all the way to the destination terminals. No GSM interfaces
II. GSM SIGNALING PROTOCOLS have need for use of the SS7 transport, session, and
GSM uses the International Consultative Committee on presentation layers. The rest of the interfaces are at the
Telegraphy and Telephony Signaling System 7 (SS7) proto- application layer 3. Interfaces to the fixed networks [public
cols for its signaling [1], [4]–[5]. Fig. 1 shows key elements switched telephone network, ISDN] use their own standard
of a GSM system as vertical bars, with the spaces between telephone user part and ISDN user part protocols. Once a
them representing interfaces among different subsystems. radio resource (RR) connection has been established, there
The protocol is based on open system interconnection (OSI) exists a physical point-to-point bidirectional connection
layers, which are shown at the left. between two RR entities. At one instant of time, there will
At the physical layer, the air interface uses radio fre- not be more than one RR connection available between a
quency (RF) radio transmission. The -Interface be- mobile station and the MSC. One RR connection may be
tween BTS and BSC uses 64 kb/s channels on wire cable, used to support several MM connections.
optical fiber, or microwave links based on the best avail- The SS7 application layer has several sublayers specific
ability, designer’s choice, and ease of installation. All other to the GSM system. The radio interface layer 3 (RIL3)

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1481
Fig. 2. MAP protocol connections [3, p. 297].

RR management protocols establish and release connections network parts is handled by the various mobile application
between an MS and various BSC’s for the duration of a call part (MAP) protocols, details of which are shown in Fig. 2
despite user movement. The radio subsystem management [2], [5]–[7]. These protocols are designated as MAP/B
protocol provides RR functions between the BTS and through MAP/H. For example, signaling between MSC and
BSC. The direct transfer application part (DTAP) protocols equipment ID register (EIR) is through MAP/F. Although
provide RR messages between the MS and MSC. The base these messages are not directly related for completing the
station subsystem management part (BSSMAP) protocols actual voice or data transmission path, they are essential for
provide RR messages between the BSC and MSC. The the proper establishment of the traffic channel, as we shall
distinction between DTAP and BSSMAP is provided by see in the mobility discussion.
a small “distribution” protocol below them.
The RIL3 MM protocols deal with MS location man- III. MOBILE INITIALIZATION
agement (cell assignment, location updating, paging for
Prior to establishing any communication links to other
incoming calls, etc.) and security aspects of the system parties, the MS must first acquire synchronization with the
(authentication, user identity protection, etc.). This pro- GSM system. This process begins after the MS is turned
tocol is the main interest of this paper. The RIL3 call on in a PLMN. The first step of the process is for the
control management protocols deal with call control (CC), MS to search for and acquire a frequency control channel
supplementary services, and short messages. All mobility (FCCH) burst on some common control frequency channel.
management and call control functions reside in the MSC. The mobile will scan all or part of 124 RF channels and
Thus, all CC and MM messages are interpreted neither obtain the average signal strength of each channel. During
by the BSC nor by the BTS. They are transparently con- the scanning process, several readings of the RF level have
veyed to its corresponding entity within the MSC. Before to be taken so that the mobile gets an accurate estimate
exchanging messages between MM entities of the mobile of the channel power. Thus, the scanning may take several
station and the network (MSC), an RR connection needs seconds.
to be established. For each of the 124 channels, starting with the one of
The transaction capabilities application part provides highest signal strength level, the mobile searches for the
correlation between individual operations and structured FCCH. This is the first step of the process known as
exchanges in building up a complete transaction. The frequency synchronization. The frequency correction burst
transaction sublayer manages transactions on an end-to-end is unique and easily recognizable. The FCCH burst is a
basis. The component sublayer correlates commands and re- long sine wave that is offset by 67.7 kHz from the carrier
sponses within a dialog. Noncall-related signaling between frequency. The cell transmits all zeros for the frequency

1482 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 3. Initial mobile acquisition [3, p. 113].

correction signal. The mobile has to take out this offset the internally stored synchronizing pattern is correlated,
before an estimate of the carrier frequency can be made. and at the peak of correlation, the channel is considered
This process of frequency synchronization is shown as the to be synchronized. If synchronization does not occur, the
first step in Fig. 3 [3]. If no frequency burst is detected, process of frequency synchronization with the next highest
then the mobile can go to a channel with the next highest channel in the list may start. If the synchronization is
signal strength level. successful, the mobile will read the time division multiple
After the frequency correction burst is detected, the MS access (TDMA) frame number and the base station identity
will try to synchronize with the time synchronization burst code. Assuming that the mobile is in sync and decodes
synchronization channel (SCH). The SCH always occurs the information on a BCCH, the BCCH information will
in the next frame in the same time slot as the FCCH. contain such items as adjacent cell list, BCCH location
This is eight burst periods later than the FCCH. The of adjacent cells, minimum received signal strength, and
SCH contains precise timing information on the timeslot location area identity. The BCCH information also provides
boundaries to permit refining the received slot timing. The beacon frequencies of surrounding BTS cells, etc. All
SCH message also contains the current frame number to BCCH transmissions are at a standard power level, which
which the MS synchronizes. This time synchronization is permits the MS to compare received power from its own
generally carried out in two steps: coarse and fine. Here, BTS as well as from adjoining BTS’s. Therefore, when the

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1483
Fig. 4. Mobile identification process.

BCCH information is correctly decoded, the mobile follows the VLR must get its file from the home location register
one of the two paths discussed below. (HLR) identified in the IMSI. To do this, the VLR sends
the HLR a MAP/D Update Location message. Assuming
a) If the BCCH information includes the present BCCH that the IMSI is in fact registered in the HLR, the HLR
channel, then the mobile will simply stay on the responds with a MAP/D Update Location Result message,
channel. followed by a MAP/D Insert Subscriber Data message
b) If the current channel is not in BCCH information containing other pertinent data needed by the VLR. The
list, or the received signal strength level is below the VLR acknowledges the data transfer with a MAP/D Insert
desired level, the mobile will continue searching for Subscriber Data result message to the HLR.
the next control channel.
B. Authentication
After the mobile has successfully synchronized to a valid
BCCH, the mobile is now ready to register, receive paging, The authentication process may be run at each and every
or originate an outgoing call. location update and at the initiation of every new service
request. The process starts at VLR. If the VLR determines
IV. MOBILITY FUNCTIONS that authentication is required, it sends a MAP/D Send
Parameters message to the HLR, which relays this message
Among all functions that the mobile is at liberty to to the authentication center (AuC). The AuC then draws a
perform, we shall consider only those connected with the value for the random challenge random number (RAND)
MM layer or the mobility aspect of the GSM system. Those and applies algorithms A3 and A8 to generate the signed
functions are [2]–[3], [5]–[8]: response (SRES) and the cipher key. The complete process
• mobile identification; of authentication is discussed in section 4.0. The AuC then
• authentication; returns the triplet (RAND, signed response, ) value to
• IMSI attach and detach; the VLR in a MAP/D Send Parameters Result message.
• location update. Actually, the AuC normally calculates and sends a few such
triplets at a time for each requesting MS, so the VLR only
A. Identification Procedure has to request parameters from the AuC if it has no stored
The identification procedure is used to identify the unused triplets for the particular MS [10]–[12].
MS/SIM by its IMSI if the visitor location register (VLR) The VLR then sends a MAP/B Authenticate message to
does not recognize the TMSI sent by the MS. This lack of the MSC, which in turn sends an RIL3-MM Authentication
recognition can be the result of the mobile user’s changing Request message containing RAND to the MS over the air.
the MSC/VLR area from the last time he accessed the The MS calculates the required signed response challenge
system or can be due to some other reason. If identification (SRESc) using the algorithm A3 and authentication key
is required, the VLR first sends a MAP/B Provide IMSI stored in the SIM. The SRESc is returned to the
message to the MSC, as shown in Fig. 4 [3]. As a result of MSC in a RIL3-MM Authentication Response message.
this message, MSC sends an RIL3-MM Identity Request The MSC compares the SRESc with the signed response,
message to the MS. The MS responds by returning an RIL3- and if they agree, it sends the MS an RIL3-MM Service
MM Identity Response message containing its IMSI to the Accept message. The MSC also sends the VLR a MAP/B
MSC. The MSC then sends the MAP/B IMSI acknowledge Authentication Complete message. The protocol for the
to the VLR. If the IMSI is currently not in the VLR, then authentication process is shown in Fig. 5.

1484 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 5. MS authentication process [3, p. 119].

C. IMSI Attach and Detach an MS if the MS is deactivated or if the SIM is detached

The IMSI attach and detach procedures register and from the MS. A flag (ATTN) broadcasted in the System
deregister the mobile to the system. If the mobile user is Information message on the BCCH is used by the network
attached, he will be paged in the location area of the user’s to indicate to the MS whether the detach procedure is
presence. If the mobile user is detached, the system will required. The procedure causes the MS to be declared
not waste its resources in paging for an incoming call. inactive in the network. Once the IMSI detach procedure is
1) IMSI Attach: The IMSI attach procedure is used by active, the MS can neither transmit nor receive. The system
the MS to indicate that it has reentered the active state will also not page the MS.
(power on). IMSI attach is invoked if the attach/detach The IMSI detach procedure starts with the MS’s sending
procedures are required by the network and an IMSI is an RIL3-RR Channel Request message on RACH to BSS.
activated in an MS (i.e., activation of an MS with plug- The BSS assigns an SDCCH channel and notifies the
in SIM or the insertion of a card in a SIM card-operated channel assignment to the MS over the AGCH. The MS
MS, etc.) within the coverage area of the network or if then sends an RIL3-MM IMSI Detach Indication message
an MS with an IMSI activated outside the coverage area to the BSS. The message identifies the MS (indicated here
enters the coverage area. The IMSI attached is marked as TMSI ) and contains an 8-bit code indicating IMSI
in the MSC/VLR with an “attached” flag. The following detach. After receiving an IMSI Detach Indication message
sequence of events describes the IMSI attach procedure, from MS, the BSS forward this message in a BSSMAP
shown in Fig. 6 [2]–[3]. Upon turning on the power, the complete layer 3 information message to the MSC. The
MS sends an RIL3-RR Channel Request message to the MSC in turn updates the state of the MS in the VLR
BSS on the random access channel (RACH). The network with a MAP/B Detach IMSI message. At this stage, all
assigns the channel, and the BSS sends an RIL3-RR IMM terminating calls to the MS are rejected, and the system
Assignment message to the MS over the access grant does not page the mobile anymore. The VLR forwards
channel (AGCH). This message assigns the stand-alone this message to the HLR as a MAP/D Deregister Mobile
dedicated control channel (SDCCH) channel to the mobile. Subscriber, and the HLR marks the MS as deregistered. The
After the channel is assigned, the MS sends an RIL3- HLR forwards a MAP/B Deregistration Accepted message
MM IMSI Attach message over the SDCCH channel to to the VLR, which, in turn, sends a MAP/B Acknowledge
the BSS, which is forwarded first to the MSC and then IMSI Detachment message to the MSC. No response is
to the VLR as a MAP/B protocol message. The VLR returned to the MS, as shown in Fig. 7 [2]–[3], [8]–[10].
sends an acknowledgment to the MSC, “IMSI Attach This is correct because the mobile would be switched off
Acknowledge,” as a MAP/B protocol, which is forwarded before the return message is sent from the BSS to the MS.
to the BSS and then to the MS. The MSC also sends The MSC sends a BSSMAP Clear Command to the BSS
“Clear Command” for the channel release to the BSS as to clear the SDCCH channel assigned to the MS. The BSS
the BSSMAP protocol, which is then forwarded to the MS. acknowledges with a BSSMAP Clear Complete message to
Upon receiving the RIL3-RR Disconnect signal from the the MSC.
MS, a Clear Complete message is sent to the MSC as a 3) Location Update: The MS location updating is per-
BSSMAP protocol. formed to tell the system where to search for the MS during
2) IMSI Detach Procedure: Similar to the IMSI attach paging for an incoming call. If the location is known to a
procedure, the IMSI detach procedure may be invoked by definite subregion of a particular PLMN, this will reduce

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1485
Fig. 6. IMSI attach.

Fig. 7. IMSI detach.

1486 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 8. Location updating [10, p. 303].

the number of cells where the mobile has to be paged, and the new VLR records relevant parameters needed to
thereby reducing the load on the system. process calls.
The MS location is determined from the cell identification The message sequence is shown in Fig. 9. The MS is
of the strongest BCCH signal received by the MS. The switched on in a location area different from the previous
MS regularly measures the received signal strengths of the one, or it moves across boundaries of a location area in
BCCH’s for all surrounding cells at least once every six sec- the idle state RIL3-Location Updating Request message,
onds (superframe cycle). It stores at least the six strongest which is sent from the MS to the BSS and is relayed to
BCCH measurements and their identifications in the SIM, the MSC. The MSC in turn alerts the VLR by a MAP/B
which can subsequently be used for handover decisions. Update Location Area message. The message contains the
The MS also transmits the location area of the strongest old location area that the mobile had in its storage along
cell to the MSC during location updating. The location area with its TMSI (designated here as LAI , TMSI ). The
may be a single cell or a contiguous group of cells under process of authentication, ciphering, and TMSI reallocation
the control of one BSC, as shown in Fig. 8 [3]–[4]. can now start. After completion of the ciphering process,
A cellular system requires that the user location of all the message is sent from the VLR to the MSC for re-
active mobile units be known at all times as they roam. As allocation of the TMSI if desired (Forward New TMSI).
seen in Fig. 8, each cell is served by one BTS. Each location A TMSI Reallocation Complete message is sent from the
area is divided into many cells, which may be served by one MS to the BSS after reallocation of new TMSI. The
or more BSC’s. The VLR may serve one or more location HLR sends a MAP/D Location Update Result message
areas. An inactive mobile is ignored by the system. As to the VLR, which in turn sends a MAP/B Location
soon as the mobile switches its power, it retrieves its stored Update Acknowledge message to the MSC. This message is
location-area identity and compares it with the one being subsequently forwarded to the MS as a RIL3-RR Location
broadcast within its present cell. If they match, the mobile Update Accepted message. In the event that the HLR rejects
does not have to do anything, as the subscriber is already the request, the VLR RIL3-MM Location Update Reject
correctly located; however, if it does not match, the mobile message is sent from the MSC to the MS (shown dotted).
identifies itself by transmitting its IMSI together with the Either the accept or the reject message is initiated from
identities of the previous and present location areas. The MSC. Location area updating may not be accepted due to
BSS transmits this information to the associated VLR. the following reasons:
Each time an MS moves into a new location area, the • unknown subscriber;
corresponding VLR is informed. If both the present and • unknown location area;
previous areas are served by the same VLR, the mobile
station is given a new TMSI, and its location is updated in • roaming not allowed;
the VLR memory. On the other hand, if the mobile enters • system failure.
a new VLR area, its HLR, the old VLR, and the new VLR After the location update accept or reject message, the MSC
are informed. The old VLR erases the data for the mobile, asks the BSS to release the allocated dedicated resource

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1487
 (a)

(b)
Fig. 9. Location update process.

by sending a BSSMAP Clear Command message to the was an important issue that needed to be addressed. It was
BSS, which then forwards it to the MS. A BSSMAP Clear apparent that the weakest part of the system was the radio
Complete message follows from the BSS to the MSC, path, as this could be easily eavesdropped upon with radio
which completes the location updating process. equipment. There was also a need to authenticate users
In the next section, we shall discuss the most important
of the system so that the resources are not misused by
security aspects of the GSM system.
nonsubscribers [3], [10]–[12].
V. SECURITY ASPECTS OF THE GSM SYSTEM Therefore, the objective of this section is to outline
At an early stage in the development of the Pan European clearly the most important security features adapted in
mobile radio system GSM, it was realized that security GSM, including: a) authentication; b) ciphering; and c) an

1488 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

 carried out in order to produce one triplet. A nonpredictable
RAND is produced. RAND and are used to calculate
the signed response and the ciphering key using two
different algorithms (A3, A8). This triplet (RAND, signed
response, and ) is for each and every user and is then
delivered to the HLR. This procedure is shown in Fig. 11
[3], [9]–[11].
The AuC begins the authentication and cipher key gener-
ation procedures after receiving an identification of the sub-
scriber from the MSC/VLR. The AuC first queries the HLR
for the subscriber’s authentication key . It then generates
Fig. 10. Generic authentication process.
a 128-bit RAND for use as a challenge, to be sent to the MS
for verification of the MS’s authenticity. RAND is also used
equipment ID, which ensures that no stolen or unauthorized by the AuC, with in the algorithm A3 for authentication,
mobile equipment is used in the system. to calculate the expected correct signed response from the
MS. RAND and are also used in the AuC to calculate
A. Authentication the cipher key with algorithm A8. The signed response
The authentication feature ensures that, to a very high is a 32-bit number, and is a 64-bit number.
level of probability, the user is the one he claims to be. The values of RAND, signed response, and are
The purpose of the authentication is to protect the network transmitted to the MSC/VLR for interaction with the MS.
against unauthorized use. It also enables the protection of Algorithms A3 and A8 are not fully standardized by GSM
the GSM PLMN. Subscriber authentication is performed and may be specified at the direction of PLMN operators.
at each registration, at each call setup attempt (mobile Different PLMN’s may use different and proprietary ver-
originating or terminated), and before performing some sions of these algorithms. Also, to protect the secrecy of the
supplementary services, such as activation or deactivation user, the authentication key is not sent to the MSC/VLR.
of the mobile (IMSI attach, IMSI detach). Authentication is Based on the discretion of the PLMN operator, can
not mandatory prior to IMSI attach and detach procedures. be of any format and length. The MSC/VLR forwards
The frequency with which a particular PLMN applies the the value of the RAND to the MS, which also has the
authentication procedure to its own subscribers is their correct and algorithm A3, which is stored in its SIM.
responsibility. However, a PLMN shall apply the authen- The SIM then uses RAND and in these algorithms
tication procedure to visiting subscribers as often as this to calculate the authentication SRESc and the cipher key,
feature is applied to those subscribers in their home PLMN. . The MS sends the calculated response, SRESc back
GSM uses a sophisticated technique for authentication to the MSC/VLR, which compares it with the value signed
that consists of asking a question that only the right response received from the HLR/AuC. If the SRESc and the
subscriber equipment (in this case, the SIM) can answer. signed response agree, the subscriber access to the system is
The heart of this method is that a large number of such granted, and the cipher key is transferred to the BTS for
questions exist, and it is unlikely that the question can be use in encrypting and decrypting messages to and from the
answered correctly by the wrong MS. The generic process MS. If the SRESc (computed signed response at the mobile)
of authentication is shown in Fig. 10 [3], [10]. The authen- and the signed response disagree, the subscriber access
tication algorithm (called A3 in the GSM specifications) to the system is denied. In summary, the VLR initiates
computes from a RAND, both at the MS and at the AuC, a authentication toward the MS and checks the authentication
signed response, using an individual secret key attached result. The complete process is shown in Fig. 12.
to the mobile subscriber. The number RAND, whose value
is drawn randomly between 0 and 2 , is used to B. Encryption
generate the response by the mobile as well as by the Obtaining good protection against unauthorized listening
fixed part of the network. It should be noted that the is not an easy matter with analog transmission, but digital
authentication process is carried out both at the mobile and transmission brings an excellent level of protection by
at the MSC simultaneously. The BSS remains transparent using digital cryptographic methods. The confidentiality
to this process. It should also be noted that the mobile feature on physical connections (physical radio channels)
only receives the random number over the radio path and means that the user information and signaling exchanged
in turn returns the signed response to the network. Thus, between the BTS and the MS are not made available or
an air interface mobile designation is not disclosed. At disclosed to unauthorized individuals, entities, or processes.
subscription time, the subscriber authentication key is The purpose of this feature is to ensure the privacy of
allocated to the subscriber together with its IMSI. The key the user information (voice and nonvoice) as well as the
is stored in the AuC and used to generate a triplet ( , user-related signaling elements.
signed response, RAND) within the GSM system. As stated All speech and data are ciphered, and all associated
above, the same is also stored at the mobile in the signaling information is protected. The ciphering algorithm
subscriber ID (SIM). In the AuC, the following steps are is synchronized with the TDMA clock and adds very little

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1489
Fig. 11. Generation of Kc , signed response, and RAND at the AuC [3, p. 157].

Fig. 12. Authentication process in GSM system [3, p. 158].

complexity to the MS. The cipher key is obtained as a side algorithm is used for protection of all transmitted data in
product of the authentication procedure and differs from call dedicated mode, whether it is user information (speech or
to call. The GSM is designed so that a single encryption data), user-related signaling (e.g., the messages carrying

1490 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

the called phone numbers, etc.), or even system-related C. Equipment Identification Definition
signaling (e.g., the messages carrying radio measurement The administrative use of the international mobile equip-
results to prepare for handover). Encryption is a process in ment identity (IMEI) enables the operator to check the
which a series of bits is transformed by mathematical or mobile equipment identity at call setup [1]–[10]. The pur-
logical functions into another series of bits. The number pose of this feature is to make sure that no stolen or
of transformations is determined by the key so that, for unauthorized mobile equipment is used in the system, which
an exhaustive search, all possible keys must be tried. is another security aspect of the system.
The confidentiality of the information elements carried on The equipment identification procedure consists of the
the radio path (signaling and user data) is ensured by MSC/VLR’s requesting the IMEI from the MS and sending
systematic encryption. The ciphering/deciphering algorithm it to a stand-alone entity called EIR.
(called A5) uses a cipher key , which is allocated to each On reception of the IMEI at the AuC, the EIR makes use
mobile subscriber during the authentication procedures. The of three possible defined lists.
key is computed from the RAND by an algorithm • A white list containing all numbered series of all
(called A8) driven by the mobile subscriber authentication equipment identities that have been allocated in the
key . Algorithm A8 is common to all GSM’s. Fig. 11 has different participating GSM countries.
shown the process of generating . For the authentication
procedure, when a signed response is being calculated at • A black list containing all equipment identities that
the mobile, the ciphering key is also calculated using are barred. This listing may be the result of stolen
another algorithm (A8), as shown in Fig. 12. This key equipment.
setting takes place in the fixed system and in the MS. • A gray list containing (at the operator’s decision) faulty
At the ciphering start command (from VLR to BSS), or nonapproved mobile equipment. This equipment is
is used by the MS and the BTS in order to cipher and under observation but not barred for service.
decipher the bitstream that is sent over the radio path. In Although the GSM specification recommends using the
addition to the authentication procedures, a key setting may equipment ID at each and every call, the frequency of iden-
be initiated by the network as often as the network operator tification really lies with the individual operator. The system
wishes. The command to use the encryption key is sent over operator can make decisions in this regard. The equipment
the logical channel and dedicated control channel, as soon identification process starts with the MSC/VLR’s requesting
as the identity of the mobile subscriber is known by the MS for its IMEI. In response, the MS sends its ID that, if
network [2]–[7], [11]–[12]. positively checked by the equipment ID register, allows
The key must be agreed upon by the mobile station the mobile to proceed further with the call. Mobile is
and the network prior to the start of encryption. The choice not allowed to continue with the call if the equipment
in GSM is to compute the key independently from ID does not match the stored value of the ID in the
the effective start of encryption during the authentication register. The complete equipment identification process is
process. is then stored in a nonvolatile memory inside shown in Fig. 15 [3]. As shown in the figure, an IMEI
the SIM so as to be remembered even after a switched-off request is initiated by the MSC/VLR combination as a result
phase. This key is also stored in the visited MSC/VLR of the MS’s requesting a call setup. Upon receiving the
on the network side and is ready to be used for the IMEI request, the MS sends the equipment identification to
start of encryption. It should be noted that the actual the MSC/VLR, which is subsequently checked against the
encryption/decryption of user data (e.g., speech) takes place stored values in the EIR.
within the mobile station and the BSS. For this purpose, the In the next section, we shall discuss future enhancement
encryption key is downloaded from the MSC to the BTS via in those areas where there are presently limitations.
the BSC. After authentication, the transmission is ciphered,
and is used for ciphering/deciphering. This process is
shown in Fig. 13. VI. SOLUTION APPROACH FOR FUTURE SYSTEMS
Data flow on the radio path is obtained by a bit-per-bit
In this section, we shall discuss approaches to some
binary addition of the user data flow and ciphering bitstream
solutions for the future systems based on the present
generated by the GSM algorithm A5 using a ciphering
limitations of the GSM system. The areas discussed are:
key . This exact process of encryption/decryption at
the mobile and at BTS is shown in Fig. 14. Code words • SIM roaming;
and for downlinks and uplinks are changed at • intersystem roaming;
every frame. When modulo 2 is added with plain text, • future mobile service;
outputs cipher text. On the other side, the cipher text, when • data base requirements.
modulo 2 is added with , outputs the plain text. The
ciphering/deciphering function is placed on the transmission
chain between the interleave and the modulator. Since A. SIM Roaming
A3 and A8 are always running together, these two are One solution of roaming can be solved by having a SIM
implemented as a single algorithm in most cases. The card that works on multiple standards. Such a card will be
algorithm A3 is standardized in the whole of GSM. highly desirable for future use and will allow the subscriber

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1491
Fig. 13. Sequential steps for encryption and decryption process [3, p. 160].

not to carry a privately owned handset from place to place. enable the mobile subscriber to have the necessary data for
Wherever the user goes, he can rent a cellular telephone, all cellular standards on one SIM card, enabling a mobile
and it will work with the user’s SIM card. subscriber to choose different systems based on personal
In this case, the SIM card will have data according to choice and the availability of the system. This multisystem
several standards. For example, such a dual-mode SIM SIM card has many advantages.
card can operate on the GSM system when inserted into a • It allows for use of already existing terminals.
GSM terminal, i.e., a GSM terminal would access the GSM
directory on the SIM. Similarly, a packet data terminal — No new terminal development is required for end
would access the packet data directory on the SIM when the users roaming among different standards.
SIM is inserted into a packet data terminal. In the future,
• The use of such a SIM card would enable the mobile
this concept can be expanded, and one SIM card can work subscriber to have the necessary data for all cellular
on many standards. standards on one SIM card.
This solution has many advantages. First, it allows for the
use of already existing terminals (thus not requiring new — This enables a mobile subscriber to choose dif-
terminals to be developed) for end users to roam among ferent systems based on personal choice and the
different standards. Second, the use of such a SIM card can availability of the system.

1492 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 14. Encryption/decryption process [3, p. 161].

Fig. 15. Equipment identification process.

Fig. 16 shows such a SIM card working on systems A and be interconnected using commonly agreed upon signaling
B [3], [15]–[18]. procedures. One standard is GSM, which supports inter-
national roaming. Other examples include the Advanced
B. Intersystem Roaming Mobile Phone System (AMPS) standard, which supports
roaming within North America today, and packet data
Currently, a number of cellular standards exist, each
of them supporting seamless roaming and call delivery terminals, which support roaming within Japan. In most
within each standard. These standards include air interface of the above-mentioned cellular standards, the MAP is the
procedures, whereby an MS can access a visited network in signaling protocol that handles the roaming signaling in
the same way as it would access its home network. Network the respective network. For a standard to provide roaming,
interfaces allow networks run by different operators to it is equally important that the standard include a fully

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1493
 Fig. 18. Network architecture for roaming from packet data to
GSM [3, p. 386].

example below provides the basic scheme for international

Fig. 16. SIM roaming. roaming.
1) Example: Let us consider an example of two inde-
pendent systems having an ILR/IMSC interface between
them. Let us also assume that a subscriber belonging to the
GSM system switches on the power. The location updating
procedure from the GSM terminal will be handled by the
MSC/VLR in the GSM network. The GSM MSC/VLR will
communicate with the ILR using the normal GSM MAP
protocol, assuming the ILR to be the GSM HLR described
previously. When receiving the GSM MAP location update
procedure from the GSM MSC/VLR, the ILR will perform
a packet data MAP location registration procedure toward
the packet data HLR to update the location data for the
subscriber in the packet data HLR. When the GSM MAP
procedure is completed between the GSM MSC/VLR and
the ILR, the GSM location is stored in the GSM MSC/VLR
Fig. 17. General network architecture. and the ILR in accordance with the GSM standard. Now
a call from a fixed subscriber to a packet data subscriber
who is roaming in GSM will work as follows. The gateway
specified air interface as well as the necessary network
mobile switching center (GMSC) in the packet data network
interface(s). However, all the standards mentioned here
will, when receiving the call from the fixed network, ask
contain their own specific air interface specifications as
the packet data HLR to terminate call-routing information.
well as their specific MAP protocols, which do not allow
The packet data HLR will thus provide the packet data
roaming between two different systems. Thus, it is not
GMSC with routing information, which enables the packet
possible to roam between GSM and AMPS, nor is it
data GMSC to route the call to the IMSC. The ILR will,
possible to roam between GSM and packet data terminals. when asked for GSM routing information, provide a GSM
At a future date, the scheme presented here will allow roaming number to the IMSC. The IMSC will now forward
roaming between two different systems, each signaling the call to the GSM MSC/VLR using the received GSM
within its own system and in its own MAP protocol. roaming number, and the call is completed in the GSM
The scheme shown in Fig. 17 introduces new nodes that MSC/VLR as a normal GSM mobile terminated call. The
have the purpose of providing interworking between two main reason for having the IMSC is that the functional
different systems [3], [19]–[24]. The nodes that perform in- interface between the GMSC and the MSC/VLR differs
terworking between two different cellular standards are the in the GSM and packet data systems. To enable routing
interworking location register (ILR) and the interworking of a call originally set up for a packet data subscriber
mobile switching center (IMSC). The ILR works as follows. when the subscriber is roaming in a GSM network, the
In the view of the HLR in the home network (Network 1 IMSC has the role of interworking between packet data
in the figure), the ILR is seen as a VLR. In view of the and GSM, specifically handling routing of calls to roaming
MSC/VLR in the visited network, the ILR is seen as an subscribers. This scheme is shown in Fig. 18.
HLR. This circumstance implies that the ILR can ensure The approach described above will allow subscribers
that the two interconnected standards can cooperate. An to roam internationally by making use of the multimode

1494 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

Fig. 19. Multimode terminal [3, p. 386].

terminals (multimode terminals will allow a subscriber to or a few countries). The telecom operator to whom I am
access different systems) as shown in Fig. 19 [18]–[20]. connected may now contact a location agency (LA). The
This terminal will allow a mobile to have worldwide service LA will search a data base to see what it knows about
just by having a single multimode terminal. you. Based on knowledge of your habits and any recent
calls to or from you, the search may then proceed by one
C. Future Mobile Service and Data Base Requirements or more of the following ways. You are working late: try
As discussed above, future universal mobile telecommu- your office. Ask all personal communications network and
nications service (UMTS) will consist of a wide variety cellular operators within the country, “Can you connect to
of interconnected networks and facilities. For mobile origi- X, and if so, what is the charge?” Ask the local paging
nated transactions, let us assume that a terminal can access operators to page you, but suppose the LA data base knows
the base station, which responds to a request for service its last contact with you was an hour before from XYZ
and can then proceed to negotiate conditions and price. hotel in New York. A call is made to your personal number
Because payment can be by electronic cash over the air, a via the hotel switchboard. No response is obtained from
user does not have to subscribe to or belong to the network either your room extension or the hotel’s cordless telephone
being used. The base station or the network to which it system. Therefore, a New York radio-paging operator is
is attached will have sufficient intelligence to carry out an asked to page you. A response comes back from your
electronic cash or credit transaction. This is likely to be a pocket phone.
commonplace function in the near future for many types of The LA computer will then calculate the cost of a
remote shopping. Because cash is transferred electronically, call using its knowledge of networks and organizations to
the subscriber does not have to belong to the specific determine the lowest cost options and then call me back
network from which he wants the service. We then have and offer to connect me to you at a cost of $2 per minute
the problem of locating the mobile terminal and establishing for voice or $5 per megabyte of data transmission. The
the connection via one or more competing networks. The associated data base requirements, based on the complex
following example is provided to show how the mobile can problem we have just shown, will now be discussed.
be located potentially in a UMTS/future public land mobile
telephone system. D. Data Base Requirements
Consider the following example. There is an urgent To locate an individual, a comprehensive data base must
need to contact you: I call your personal number. It is contain all relevant information for the user. The data
routed to your home because, after 6 p.m., you are most base might also keep success statistics for some or all
often at home. The phone in your home rings. After five of the “usual places” for an individual. For instance, it
seconds with no response, I am asked if I wish to pay could generate and keep hour-by-hour probabilities. Other
for a search or to be connected to an answering machine information in the data base might include which services
or voice mail service. Because I need to speak to you the user subscribes to or authorizes to use, etc. The usual
urgently, I ask for a “grade I search” (assume grade I is information about the subscriber, which has to be stored in
a worldwide search, no expense spared, costs up to my the data base, is shown in Table 1 [20]–[23]. It should be
credit limit; lesser grades possible can be activated also noted that possibly there will be many LA’s maintaining
with a limitation of an area search, such as one country the data base. Each individual agency will only have to

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1495
Table 1 Location Agency Data Base Entries
the correct brand of transceivers. True mobility for the user
can be achieved only by multiple entries on the SIM card,
by design of multimode terminals, and by the availability
of fast and large data bases.

REFERENCES

[1] European Telecommunication Standard Institute/Global System

for Mobility, “Mobile radio interface layer 3 specification,”
ETSI/GSM section 4.08, Apr. 1993.
[2] M. Mouly and M.-B. Pautet, “The GSM system for mobile
communications,” M. Mouly and M.-B. Pautet, Eds., section
2.3, 1992.
[3] A. Mehrotra, GSM System Engineering. Norwood, MA:
Artech House, 1997.
[4] A. Maloberti et al., “Radio subsystem functions and elements,”
presented at the GSM Seminar-Budapest, Hungary, session 3.1,
Oct. 1990.
[5] U. J. Brune, “The mobile application part protocol,” presented
maintain a fraction of the world’s capacity. Apparently at the GSM Seminar-Budapest, Hungary, session 4.2, Oct.
the activity (load) factor has to be estimated. Data base 1990.
information sources can be from telephone companies, [6] M.-B. Pautet and M. Mouly, “GSM protocol architecture: Radio
sub-system signaling,” in Proc. IEEE VT Conf., 1991, pp.
mobile network operators, national numbering authorities, 326–332.
and directly from the users for whom the data base has been [7] Global System for Mobility, “Mobile application part (MAP)
created. We now provide an example of a rough estimate specification,” GSM Recommendation 09.02.
[8] M. Mouly and M.-B. Pautet, “Security Management,” in The
for the total data base storage requirement and the number GSM System for Mobile Communications, M. Mouly and M.-B.
of location requests/second. Pautet, Eds., section 7.2, pp. 477–492, 1992.
[9] S. M. Redl, M. K. Weber, and M. W. Oliphant, “Security pa-
1) Example: Assuming that the world population is 6 rameter,” in An Introduction to GSM. Norwood, MA: Artech
billion and that only 20% will use the service, let us also House, 1995, section 3.8, pp. 44–48.
assume that, on the average, there are four transactions per [10] A. Mehrotra, Cellular Radio Analog and Digital Systems. Nor-
wood, MA: Artech House, 1994, section 7.5.2.4, pp. 305–309.
day per person and 10% of those will require locating the [11] European Telecommunication Standard Institute/Global System
destination terminal. Then, the number of location processes for Mobility, ETSI/GSM specification vol. 2.17, section 3, Jan.
per second is 1993.
[12] European Telecommunication Standard Institute/Global System
for Mobility, ETSI/GSM specification vol. 3.20, section 3, Jan.
1993.
per day [13] A. Mehrotra, Cellular Radio Performance Engineerings. Nor-
queries/second wood, MA: Artech House, 1994.
[14] O. Spaniol, A. Fasbender, S. Hoff, J. Kaltwasser, and J. Kas-
subek, “Impact of mobility on telecommunication and data
communication networks,” IEEE Personal Commun. Mag., pp.
Since this will vary during the time of the day, we can 20–33, Oct. 1995.
assume a safe factor of two, which will bring us to 11 000 [15] B. Gabelgaard, “Converging GSM and IN—Deploying PCS
services in GSM,” in Proc. Telecom 1995, session 5.1, pp.
queries/second. If each user requires about 300 bytes on the 21–25.
average, the total storage requirement for 6 10 people [16] J. S. da Silva, “Mobile and personal communications—The
is Gbytes. European R&D perspective,” in Proc. Telecom 1995, session
1.3, pp. 51–55.
Total data base size, update loads, and access times are [17] R. Prasad, “European radio propagation and subsystems re-
calculated assuming once again that only 20% of the world search for the evolution of mobile communications,” IEEE
population has the service and that each entry is updated Commun. Mag., Feb. 1996.
[18] M. Grant, “Personal mobility vs. terminal mobility: Devel-
on the average four times a day. The total number of opment of personal numbering services in Europe’s personal
transactions per day . communications industry,” in Proc. Telecom 1995, session 1.3,
Assuming that the peak load is double the average, the pp. 41–43.
[19] E. Damosso and G. de Brito, “Cost 231 achievements as a
total peak load becomes 4.8 10 . support to the development of UMTS: A look into the future,”
IEEE Commun. Mag., pp. 90–96, Feb. 1996.
[20] M. Mouly and M.-B. Pauted, “Current evolution of the GSM
systems,” IEEE Personal Commun. Mag., pp. 9–19, Oct.
VII. SUMMARY AND CONCLUSIONS 1995.
[21] R. W. Gibson, “Location Agencies” for universal mobile
Protocols using the MM layer have been discussed. telecommunications services,” in Proc. Telecom 1995, session
Important aspects of authentication, encryption, and the 1.3, pp. 45–49.
[22] P. Ramsdale, “The path to third generation personal commu-
positive identification of mobile equipment before pro- nications systems,” in Proc. Telecom 1995, session 5.4, pp.
viding the user with service have been fully explored. 174–180.
Authentication ensures that the network is accessed by the [23] D. MacFarlane, “Third generation mobile—UMTS and
FPLMTS,” in Proc. Telecom 1995, session 5.4, pp. 185–188.
legitimate subscribers. The radio path is protected due to [24] H. Sherry, “A united states perspective PCS standards,” in Proc.
ciphering. Equipment ID ensures that the mobile is using Telecom 1995, session 6.2, pp. 351–355.

1496 PROCEEDINGS OF THE IEEE, VOL. 86, NO. 7, JULY 1998

 Asha Mehrotra (Member, IEEE) received the Leonard S. Golding (Life Fellow, IEEE) re-
Ph.D. degree in electrical engineering from the ceived the A.B. and B.Sc. degrees from Co-
Polytechnic Institute of New York, Brooklyn. lumbia University, New York, and the doctorate
He is an Advisory Engineer with Hughes Net- degree from Yale University, New Haven, CT.
work Systems, a Hughes Electronics Corpora- He currently is a Vice President with Hughes
tion company, where he is working on problems Network Systems (HNS), a Hughes Electronics
of mobility management, handover, diversity, Corporation company. He is in charge of sys-
and encryption on the ICO project. Prior to tems engineering at HNS and has been involved
joining Hughes Network Systems, he was with in directing and working on projects in direct
TASC as a Senior Principal Engineer, where he broadcast satellite, mobile satellite system, and
worked on various classified and unclassified and new multimedia fixed satellite system pro-
projects, including a consulting role with the Systems Engineering Group grams. He also has been involved in terrestrial wireless communication
on the IRIDIUM project. He has been an Adjunct Professorial Lecturer at projects, including personal communications systems such as perceptual
George Washington University, Washington, DC, for nearly 20 years. He audio coder and broad-band wireless local loop systems in the millimeter-
has published three books on cellular communication, including his latest wave bands. He also oversees HNS’s standards activities and is involved
publication on GSM systems from Artech House. in new business development activities. He has served on numerous
professional and industry committees and has more than 40 publications.
He has received ten patents.

MEHROTRA AND GOLDING: MOBILITY AND SECURITY IN THE GSM SYSTEM 1497