IMSI Catchers and Mobile Security

Equipment Identity Register (EIR): This stores IMEI numbers of banned or stolen phones
to prevent them from accessing the GSM network.
2.4.2 Authentication and Encryption
Figure 2: Simplified GSM network architecture [9]
When a Mobile Station tries to access the network, it must authenticate itself to the Base
Station, although the reverse is not required. This procedure is outlined in Figure 3 below.
First, the Mobile Station sends its security capabilities to the VLR (through the Base
Station). This tells the network what A5 encryption protocols it is capable of. The VLR then sends
the Mobile Station an Identity Request command, which induces the Mobile Station to respond
with its IMSI number. Now having the IMSI, the VLR then sends an authentication parameter
request to the HLR which is forwarded to the AuC. The AuC first generates a 128 bit random
number, RAND, and calculates a 32 bit signed response SRES based on RAND and the stored
long-term secret key Ki that corresponds to the respective SIM:
SRES = A3(RAND, K i ) [VLR]
The AuC also generates a 64 bit session key Kc using the algorithm A8:
K c = A8(RAND) [VLR]
The random number RAND, signed response SRES, and session key Kc are sent back to
the VLR. However, only RAND is passed back to the Mobile Station. Using the secret key Ki
stored in its SIM card, the Mobile Station can calculate:
SRES ′ = A3(RAND, K i ) [SIM]
The Mobile Station then sends SRES’ back to the VLR. If SRES and SRES’ do not match,
the authentication request is rejected. Otherwise, it is accepted and the VLR assigns the Mobile
Station a Temporary Mobile Subscriber Identity (TMSI) and tells it what cipher mode A5 to use.
6