Abstract:Voice over LTE (VoLTE) and Voice over NR (VoNR), are two similar technologies that have been widely deployed by operators to provide a better calling experience in LTE and 5G networks, respectively. The VoLTE/NR protocols rely on the security features of the underlying LTE/5G network to protect users' privacy such that nobody can monitor calls and learn details about call times, duration, and direction. In this paper, we introduce a new privacy attack which enables adversaries to analyse encrypted LTE/5G traffic and recover any VoLTE/NR call details. We achieve this by implementing a novel mobile-relay adversary which is able to remain undetected by using an improved physical layer parameter guessing procedure. This adversary facilitates the recovery of encrypted configuration messages exchanged between victim devices and the mobile network. We further propose an identity mapping method which enables our mobile-relay adversary to link a victim's network identifiers to the phone number efficiently, requiring a single VoLTE protocol message. We evaluate the real-world performance of our attacks using four modern commercial off-the-shelf phones and two representative, commercial network carriers. We collect over 60 hours of traffic between the phones and the mobile networks and execute 160 VoLTE calls, which we use to successfully identify patterns in the physical layer parameter allocation and in VoLTE traffic, respectively. Our real-world experiments show that our mobile-relay works as expected in all test cases, and the VoLTE activity logs recovered describe the actual communication with 100% accuracy. Finally, we show that we can link network identifiers such as International Mobile Subscriber Identities (IMSI), Subscriber Concealed Identifiers (SUCI) and/or Globally Unique Temporary Identifiers (GUTI) to phone numbers while remaining undetected by the victim.

An Identity Privacy Protection Scheme in LTE-WLAN Heterogeneous Converged Network

An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

PLAM: A Privacy-Preserving Framework for Local-Area Mobile Social Networks.

Network Coding Based Privacy Preservation Against Traffic Analysis in Multi-Hop Wireless Networks

An Efficient Delegation-Based Anonymous Authentication Protocol

Enhanced Privacy and Authentication: an Efficient and Secure Anonymous Communication for Location Based Service Using Asymmetric Cryptography Scheme

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices

Anonymity guarantees of the UMTS/LTE authentication and connection protocol

Watching your call: Breaking VoLTE Privacy in LTE/5G Networks

Defeating the Downgrade Attack on Identity Privacy in 5G

Improved privacy-preserving authentication scheme for roaming service in mobile networks

Further Improvement of an Authentication Scheme with User Anonymity for Wireless Communications.

A Privacy Preserving Vertical Handover Authentication Scheme for Wimax-Wifi Networks

An Identity Authentication Scheme in Wireless Peer-to-peer Network

Improved LTE-R Access Authentication Scheme Based on Blockchain and secgear

A Self-Encryption Authentication Protocol with Identity Anonymity for Teleconference Services

Concealing IMSI in 5G Network Using Identity Based Encryption

A Secured and Efficient Anonymous Roaming Scheme of Mobile Internet

An efficient privacy-preserving authentication scheme that mitigates TA dependency in VANETs

Ad-hoc Anonymity: Privacy Preservation for Location-based Services in Mobile Networks

Preventing Wi-Fi Privacy Leakage: A User Behavioral Similarity Approach