## 3 Proposed Security Protocol for Initial Attach in LTE
### Initial Attach with IMSI  
The first protocol is shown in Figure 5 and is carried out after the \"initial state after radio link synchronization\" process in the initial attach with the IMSI case. It was designed to protect IMSI leaked from the \"ECM connection establishment\" process in plain text and RNTI leaked from the \"EPS session establishment\" process in plain text.  
After the \"initial state after radio link synchronization\" process, UE and MME start an \"ECM Connection\" process. The UE transmits a generated random number and the \"UE network capability\" to MME for the attach request. MME receiving the attach request MME generates a random number and transmits it to the UE, and the UE and the MME carry out a series of arithmetic operations to safely transmit IMSI.  
The UE and the MME enter the transmitted and received random numbers and the Public Land Mobile Network ID (PLMN ID) into the f() function, secretly shared according to Mobile Network Code (MNC), and generate an F string with 4n bits. The generated F string is divided into four numerical progressions with n bits each. After this process, the MME generates a random number progression used as challenge bits, the UE the second random number, and through lrnumerical progression and exclusive OR arithmetic operation, it generates RN\({}^{{}^{\prime}}_{UE\_2}\).  
f() = hash( Expansion P-Box( hash( S-Box(RN\({}_{UE\_1}\)), S-Box(RN\({}_{MME\_1}\) ), PLMN ID ) ) )  
The MME generates challenge bits C\({}_{i}\) using lr\({}_{i}\), ad\({}_{i}\) and c\({}_{i}\). If lr\({}_{i}\) is zero, C\({}_{i}\) = c\({}_{i}\)\(\parallel\)ad\({}_{i}\) and if lr\({}_{i}\) is one, C\({}_{i}\) = ad\({}_{i}\)llc\({}_{i}\). The MME transmits C\({}_{i}\) to UE to verify it through the response value, and the UE verifies the MME through C\({}_{i}\).  
The UE is aware of lr, so it can differentiate C\({}_{i}\) transmitted by the MME into C\({}_{i}\) = c\({}_{i}\)\(\parallel\)ad\({}_{i}\) and C\({}_{i}\) = ad\({}_{i}\)llc\({}_{i}\). The UE generates R\({}_{i}\) = RN\({}^{{}^{\prime}}_{UE\_2}\)\(\parallel\)lr\({}_{i}^{0}\) or R\({}_{i}\) = RN\({}^{{}^{\prime}}_{UE\_2}\)\(\parallel\)lr\({}_{i}^{1}\) if lr\({}_{i}\) is zero and R\({}_{i}\) = r\({}_{i}^{0}\)\(\parallel\)RN\({}^{{}^{\prime}}_{UE\_2}\)\(\parallel\)  
\begin{table}
\begin{tabular}{l l} \hline
**UE** & **User Equipment** \\ \hline eNB & evolved Node B \\ MME & mobility management entity \\ HSS & home subscriber server \\ IMSI & International Mobile Subscriber Identity \\ RNTI & Radio Network Temporary Identity \\ GUTI & Global Unique Temporary Identifier \\ PLMN ID & Public Land Mobile Network ID (MCC + MNC) \\ MCC & Mobile Country Code \\ MNC & Mobile Network Code \\ RN & random number \\ h() & hash function \\ F & 4n bit string by f() \\ C & challenge bits \\ \hline \end{tabular}
\end{table}
Table 1: The terms and symbols used in the proposed security protocol.  
R\({}_{i}\) = r\({}_{i}^{1}\|\)RN\({}_{UE\_2i}^{\prime}\) if lr\({}_{i}\) is one. At this time, r\({}_{i}^{0}\) and r\({}_{i}^{1}\) transmits r\({}_{i}^{0}\) if c\({}_{i}\) transmitted by the MME is zero and r\({}_{i}^{1}\) if c\({}_{i}\) is one. At this time, the MME receives the transmission of RN\({}_{UE\_2}\) of the UE and saves it.  
For ad\({}_{i}\) transmitted by the MME (ad\({}_{i}\
eq\) ad\({}_{i}\)), the UE detects an error and transmits the response value as a random value. The MME, too, halts the attach process if an error is detected through r\({}_{i}^{0}\
eq\) r\({}_{i}^{0}\) and r\({}_{i}^{1}\
eq\) r\({}_{i}^{1}\).  
After the challenge-response process, the UE uses unused r\({}_{i}^{0}\) and r\({}_{i}^{1}\) concatenated value as a key to encrypt IMSI to transfer it to the MME. The MME generates a key through the same process as that of the UE and then decrypts the transmitted cypher text to get the IMSI.  
Figure 5: Proposed protocol: initial attach with IMSI.