Vulnerabilities in UMTS Location Update Procedure and Its Countermeasures

Mobile communication systems have been developing for decades. Universal Mobile Telecommunications System (UMTS) is a third-generation mobile cellular system for networks based on the GSM standard. As an evolved technology of GSM, UMTS has adopted a more reliable security mechanism. Integrity protection and mutual authentication were added in UMTS. However we carefully analyzed UMTS location update procedure specifications and uncover several vulnerabilities in UMTS. By sending specific types of LOCATION UPDATING REJECT messages during location update procedure, the rogue base station can deny all services to a target UMTS device. We also present several countermeasures including increasing the rate of TMSI reallocation, rebooting or re-inserting the SIM/USIM card and installing the protection application on UE to resist these vulnerabilities.