Cellular Network Infrastructure » IMSI Pseudonymization

[[figure-imsi-pseudo]]

==== Update Location Request

When Update Location Request arrives, the HLR does not look up the subscriber

by the IMSI, but by the pseudonymous IMSI instead. Unless the subscriber has

two pseudonymous IMSI allocated and used the old pseudonymous IMSI in the

Update Location Request, this is followed by the existing logic to continue with

Insert Subscriber Data Request.

===== Update Location Request With New Pseudonymous IMSI

If the subscriber has two pseudonymous IMSIs allocated, and the newer entry was

used (higher imsi_pseudo_i, see <<hlr-imsi-pseudo-i>>), this section applies.

The older pseudonymous IMSI is deallocated in the HLR. This is done as early

as possible, so the timeframe where two pseudonymous IMSI are allocated for one

subscriber is short.

A Cancel Location Request with the old pseudonymous IMSI is sent to the VLR, so

the conflicting subscriber entry with the old pseudonymous IMSI is deleted from

the VLR. Receiving a Cancel Location Result is followed by the existing logic

to continue with Insert Subscriber Data Request.

===== Update Location Request With Old Pseudonymous IMSI

If the subscriber has two pseudonymous IMSIs allocated, and the older entry was

used (lower imsi_pseudo_i, see <<hlr-imsi-pseudo-i>>), the newer entry is _not_

deallocated. This could lock out the subscriber from the network if the SMS

with the new pseudonymous IMSI arrives with a delay.

==== Insert Subscriber Data Result

ISD works like before, then set Next_Pseudo_IMSI_Timer

==== Next_Pseudo_IMSI_Timer Expires

* if subscriber has only one pseudo IMSI:

  * abort if not enough IMSIs available

  * generate new pseudo IMSI as described earlier

  * set imsi_pseudo_i like last one + 1

* send SMS to subscriber's SIM with newer pseudo IMSI

[[sms-format]]

==== SMS Format

* min_sleep_time

* imsi_pseudo

* imsi_pseudo_i