System and method for decrypting communication over a UMTS network
Systems and methods for monitoring voice and SMS communication exchanged over a UMTS network is described wherein a technique for quickly testing different Count-C values, until the correct value is ascertained is used. The Count-C parameter consists of a HyperFrame Number (HFN) and the system iteratively attempts to decrypt the packets using a series of candidate HFNs. For each of these candidate HFNs, and for each of the packets, the system produces a candidate Count-C by appending the sequence number (SN). The system then uses the candidate Count-C to calculate a candidate keystream block. Subsequently, the system uses the candidate keystream blocks to decrypt the packets, and then tests whether the packets were correctly decrypted. If the system deems the decryption successful, the system stops iterating through the candidate HFNs, and uses the candidate HFN that correctly decrypted the packets to decrypt subsequent packets in the communication session.
1. A system for decrypting a communication session on a Universal Mobile Telecommunications System (UMTS) network, the system comprising:
a receiver; and
a processor, configured:
to receive, via the receiver, one or more packets, belonging to the communication session, that were encrypted using a HyperFrame Number (HFN) that is unknown to the processor,
to attempt, iteratively, to decrypt the packets using a series of candidate HFNs, by:
calculating, from each candidate HFN in the series, respective keystream blocks for the one or more packets,
decrypting the packets using the respective keystream blocks, and
testing whether the packets were correctly decrypted,
to identify among the candidate HFNs, based on the testing, a correct HFN using which the packets were correctly decrypted, and
to decrypt one or more further packets belonging to the communication session, using the correct HFN;
wherein the processor is configured to test whether the packets were correctly decrypted by applying one or more initial tests to the decrypted packets, and, in response to at least one of the initial tests indicating at least a given likelihood that the packets were correctly decrypted, applying at least one subsequent test to the decrypted packets, and
wherein the processor is configured to identify the correct HFN in response to the subsequent test indicating that the packets were correctly decrypted.
2. The system according to claim 1 , wherein the processor is configured to calculate the respective keystream blocks from the candidate HFN by:
generating respective 32-bit candidate Count-C numbers, by appending respective Sequence Numbers specified in the packets to the candidate HFN, and
calculating the respective keystream blocks from the respective candidate Count-C numbers.
3. The system according to claim 1 , wherein the processor is configured to attempt, iteratively, to decrypt the packets by repeatedly incrementing the candidate HFN in response to ascertaining that the packets were not decrypted correctly.
4. The system according to claim 1 , wherein the processor is further configured to initialize the candidate HFN to a value that is independent of any prior communication session.
5. The system according to claim 4 , wherein the processor is configured to initialize the candidate HFN to a value of zero.
6. The system according to claim 1 , wherein the processor is configured to apply the initial tests to the decrypted packets by comparing, to a threshold, an absolute difference between a number of ones in the packets and a number of zeros in the packets.
7. The system according to claim 1 , wherein the processor is configured to apply the initial tests to the decrypted packets by performing a chi-squared test on a distribution of data in the decrypted packets.
8. The system according to claim 1 , wherein the processor is configured to apply the subsequent test to the decrypted packets by decoding the decrypted packets.
9. The system according to claim 1 , wherein the processor is configured to apply the subsequent test to the decrypted packets by comparing a structure of each of the packets to a respective template.
10. A method for decrypting a communication session on a Universal Mobile Telecommunications System (UMTS) network, the method comprising:
receiving, by a monitoring system, one or more packets, belonging to the communication session, that were encrypted using a HyperFrame Number (HFN) that is unknown to the monitoring system;
using the monitoring system, iteratively attempting to decrypt the packets using a series of candidate HFNs, by:
calculating, from each candidate HFN in the series, respective keystream blocks for the one or more packets,
decrypting the packets using the respective keystream blocks, and
testing whether the packets were correctly decrypted;
based on the testing, identifying among the candidate HFNs a correct HFN using which the packets were correctly decrypted; and
decrypting one or more further packets belonging to the communication session, using the correct HEN;
wherein testing whether the packets were correctly decrypted comprises applying one or more initial tests to the decrypted packets, and, in response to at least one of the initial tests indicating at least a given likelihood that the packets were correctly decrypted, applying at least one subsequent test to the decrypted packets, and
wherein identifying the correct HFN comprises identifying the correct HFN in response to the subsequent test identifying that the packets were correctly decrypted.
11. The method according to claim 10 , wherein calculating the respective keystream blocks from the candidate HFN comprises:
generating respective 32-bit candidate Count-C numbers, by appending respective Sequence Numbers specified in the packets to the candidate HFN; and
calculating the respective keystream blocks from the respective candidate Count-C numbers.
12. The method according to claim 10 , wherein iteratively attempting to decrypt the packets comprises repeatedly incrementing the candidate HFN in response to ascertaining that the packets were not decrypted correctly.
13. The method according to claim 10 , further comprising initializing the candidate HFN to a value that is independent of any prior communication session.
14. The method according to claim 13 , wherein initializing the candidate HFN comprises initializing the candidate HFN to a value of zero.
15. The method according to claim 10 , wherein applying the initial tests to the decrypted packets comprises comparing, to a threshold, an absolute difference between a number of ones in the packets and a number of zeros in the packets.
16. The method according to claim 10 , wherein applying the initial tests to the decrypted packets comprises performing a chi-squared test on a distribution of data in the decrypted packets.
17. The method according to claim 10 , wherein applying the subsequent test to the decrypted packets comprises applying the subsequent test to the decrypted packets by decoding the decrypted packets.
18. The method according to claim 10 , wherein applying the subsequent test to the decrypted packets comprises applying the subsequent test to the decrypted packets by comparing a structure of each of the packets to a respective template.