Think of it like VPN for your cell signal.
Could it be a viable product? (...combined with other features to resist alternative tracking techniques lingering from the privacy-reckless design of the protocols underpinning our mobile infrastructure)
This is why this paper also talks about determination of IMSI from TMSI.
https://en.wikipedia.org/wiki/Mobility_management#TMSI
But your idea is plausible as an added layer of security - the SIM card could generate a temporary IMSI somehow. I think you'd actually want the next IMSI (or next N IMSIs) to be assigned by the network and communicated to the phone/SIM, rather than deterministically generated. If you deterministically generated the numbers, you'd have to pre-assign each subscriber a pool of numbers that are guaranteed to never overlap with any other subscriber, and this scheme would have to:
1. assign a large enough pool of IMSIs to each subscriber to handle all future communications with the network
2. make it so it isn't trivial to determine whether two fake IMSIs are the same subscriber (so you can't do something like a fixed prefix + HOTP or something).So I guess you can just use this tech to continuously rotate IMSIs among a large pool every few hours if you'd want.
From LTrack:
>We propose a new type of IMSI Catcher, named IMSI Extractor. Our IMSI Extractor does not rely on fake base stations but instead uses a combination of low-power surgical message overshadowing and uplink/downlink sniffing. Even if our catcher injects a message, it does so in line with LTE protocol specification, making it hard to detect with existing IMSI Catcher detection techniques. We discuss the techniques that would be needed to detect this attack. We successfully tested our IMSI Extractor on 17 smartphones connecting to an industry-grade eNodeB.
Do they need the keys to the LTE network to perform this attack or is the encryption / protocol vulnerable to attackers without this info?
Note that this is just one part of the attack, the attack also includes fully passive localization of phones.
Much of the infrastructure around LTE & 5G is based on the assumption that noone but the operator has this key. However, since everyone has this key, it must now be considered public (since every SIM card can be used decode and encode any connection from any user).
This means that:
- The full connection plaintext will be leaked (yes, you should do TLS, but Metadata) - The IMEI (unique and persistent identifier of a phone) can be requested at will from an attacker (and is often requested by the operator at the beginning), thus allowing you to be tracked not only by the operator, but by any entity sniffing the wireless channel - Measurement Reports containing the exact GPS coordinates can be sniffed or requested by anyone
Still, it could be something for 6G for sure.
Finally, localization attacks could potentially still work as well.
[1] https://arxiv.org/pdf/1806.10360.pdf [2] https://dl.acm.org/doi/10.1145/3448300.3467826