Cellular Network Infrastructure » IMSI Pseudonymization

## In Detail

The HLR allocates a new pseudo IMSI as random choice from the pool of available

IMSIs. The pseudo IMSI must not be used by any other subscriber as pseudo IMSI,

The pseudo IMSI is saved to the SIM as IMSI, instead of the real IMSI. The SIM

is also provisioned with the IMSI pseudonymization applet.

a) If this was the first Location Update after provisioning the SIM, the

subscriber has only one pseudo IMSI allocated. The HLR waits for some time.

IMSI. The HLR deallocates the old pseudo IMSI and sends a Purge MS request to

the VLR with the old pseudo IMSI. Then the HLR proceeds like in a).

The SIM applet verifies, that imsi_pseudo_i is higher than the last

imsi_pseudo_i it has seen (initially: 0). If that is not the case, it discards

The imsi_pseudo_i counter will not be higher than the value the SIM applet

already knows. Therefore, the applet will discard the message.

An attacker could possibly block the SMS from arriving at the SIM applet. In

that case, the SIM would continue using the old pseudo IMSI indefinitely.

applet, and warn the user if the same pseudo IMSI has been used more than N

(e.g. 5) times.

When deploying the IMSI pseudonymization, the operator should make sure that

the pseudo IMSI related SMS between the HLR and the SIM cannot be read or