Unveiling confidentiality-related vulnerabilities in an IMS-based environment

Long Term Evolution (LTE) is spreading and becoming the dominant cellular networking technology. This revolution of telecommunication network implementation methodology from its circuit-switched pattern towards a packet-switched network that resembles the ordinary packet-based networks, like Internet. Moreover, cellular network operators have adopted a new mechanism, in order to handle voice calls over the LTE network, called Voice over LTE (VoLTE), which changes how these voice calls are handled, from both user equipment and infrastructure perspectives. As a result, the VoLTE setup is controlled and performed by the Application Server (AS), using Session Initiation Protocol (SIP) and Real-time Transport Protocol (RTP), unlike the traditional call setup in previous cellular network generations. This radical shift opens up a number of new vulnerabilities that could not be previously explored especially regarding confidentiality, which this paper presents a systematic security analysis, results and solution.