Patent Application
20120289205
The present invention pertains to the preservation of anonymity for the users for cellular telephones and for the remote parties with whom those users communicate.
There are so-called secure cellular phones in the market today, however these phones can actually pose an even greater security risk than ordinary phones, since the use of the specially secured signal can draw the attention of an intelligence service to a call that may otherwise have been ignored. The user of of such a secured telephone and anyone he/she contacts will automatically become intelligence targets. The resulting exposure of identity and calling information could be just as damaging to security as the actual content of the call. A better approach is to “blend into the crowd” and not give the intelligence service any reason to focus attention on a call or any reason to suspect that a specific cellular handset is of any intelligence value.
An object of this invention is allow a cellular telephone user (“user”) to make and receive telephone calls while preventing the operator of the cellular network from determining the identity of the user.
It is a further object of this invention to prevent the operators of telephone networks from determining the identities of the remote parties with whom the user is communicating.
While the patent invention shall now be described with reference to the preferred embodiments shown in the drawings, it should be understood that the intention is not to limit the invention only to the particular embodiments shown but rather to cover all alterations, modifications and equivalent arrangements possible within the scope of appended claims.
The invention comprises two or more components: a modified cellular handset (“handset”) running special software to automatically modify its identity parameters and at least one remote private branch exchange (“PBX”) that has been specially programmed to obfuscate its call routing activities.
In an initial embodiment, the invention is described in terms of the GSM cellular standard, although analogous techniques can be used to produce equivalent results with many other cellular standards, including but not limited to iDEN, IS-95, cmda2000, UTMS and LTE.
The invention comprises
The handset is modified so that it will constantly shift its identity parameters, appearing to the service cellular network as any one of a large number of handsets at any given time. These handset identities will be novel to the foreign intelligence service and not associated with any particular user or group of interest.
The long-term identity of a GSM cellular handset has three components:
The handset extracts IMSI and Ki values from a plurality of SIMs and stores these values internally. (The IMSI values can be read directly and the Ki values can be extracted using a known attack on the SIM.) For each stored IMSI, the handset also generates a semi-random IMEI that mimics the IMEI of some widely used model of handset. Given a plurality of {IMSI,IMEI,Ki} tuples, the handset can choose from any of the plurality of plausible electronic identities, each associated with a different telephone number and subscriber account. Prior to use, the handset is programmed with several such identity tuples, drawn from SIMs that are purchased anonymously and not traceable to the user. Once in use, the handset's active identity can be changed regularly according to a clock, according to calling activity or according to any other algorithm than can be known or communicated to the remote PBXs. Ideally, no identity will be used for more than one telephone call, although practical limitations may require identities to be recycled during long missions.
In the first embodiment, the PBX is implemented as a voice-over-internet (VoIP) system comprising
The PBX is assigned a large collection of direct inbound dialed (DID) telephone numbers at which it can receive calls and which it can use to provide CLID and ANI information for outbound calls. The pool of telephone numbers is large enough that the numbers are reused infrequently, if ever. Calls to the DID numbers are then relayed to their true destinations by the PBX following the methods shown in
It is critical for the proper operation of the system that these PBXs not be placed in legal jurisdictions that are likely to cooperate with the operators of the hostile PLMN. It is critical for the proper operation of the system that these PBXs not use PSTN origination/termination services in legal jurisdictions that are likely to cooperate with the operators of the hostile PLMN. It is recommended that each PBX use multiple PSTN origination/termination services so that the inbound and outbound segments of a forwarded call be connected to the PSTN in different countries.
In a second embodiment, the handset takes its IMSI and Ki value directly from a standard subscriber identity module (SIM), preferably a SIM issued by a carrier that operates or has significant number of roaming subscribers the area where the handset is to be used and obtained from an untraceable source. The handset is modified to automatically generate a new semi-random IMEI value whenever the SIM is changed. (By “semi-random” we mean that the IMEI value is chosen to match a known model of cellular handset, but is otherwise random.) When the new SIM is first installed into the handset, the user calls one of a pool of designated telephone numbers at a remote PBX and identifies himself or herself through a spoken passphrase or series of key-presses. Once the user is identified to the PBX as using a particular SIM with a particular, known telephone number, the PBX can use this information to route inbound calls as shown in
The security of the invention can be enhanced by automatically limited the number of telephone calls that might be made or received with a given SIM or given telephone number. Limits on outbound calls are most safely enforced by a modification to the handset so that the call attempt can be blocked before there has been any interaction with a potentially hostile network. Limits on inbound calls are best implemented in the remote PBX so that the call attempt can be blocked before there has been any interaction with a potentially hostile network.
In many countries, telephone carriers, including cellular telephone carriers, operate in close cooperation with government intelligence services. These intelligence services can use call routing data (records of who is calling whom) determine patterns of communication among a group, and identify members of a given group who might not otherwise be detected. These intelligence services can also use cellular telephone mobility data (records of which tower is serving a handset at a given time) to track the movements of individuals from one neighborhood or city to another. Calling patterns and identify information are also used as triggers to invoke call interception; if a call is not associated with an individual or group of interest, it is unlikely to be subject to interception.
For some visitors to foreign countries, such as diplomats, journalists, aid workers or US government employees working under cover, the exposure of calling patterns and location information to a foreign intelligence service creates an immediate danger, both for the visitor and for that visitor's contacts within the country. The invention protects the identity, privacy and safety of its user and his or her associates.
Although this invention has been described with respect to preferred embodiments (GSM cellular, for example), it should be understood that many variations and modifications will now be obvious to those skilled in the art, and it is preferred, therefore, that the scope of the invention be limited, not by the specific disclosure herein, but only by the appended claims.
This application is based upon Disclosure Document “Utility Patent Application (Provisional) Mechanism for Anonymous Calls to and from Cellular Telephones” filed 10 May 2010.
