On Location Privacy in LTE Networks

Location privacy is an ever increasing concern as the pervasiveness of computing becomes more ubiquitous. This is especially apparent at the intersection of privacy, convenience, and quality of service in cellular networks. In this paper, we show the long term evolution (LTE) signaling plane to be vulnerable to location-based attacks via the timing advance (TA) parameter. To this end, we adapt the Cramér-Rao lower bound for timing advance-based estimation and show the associated estimator to be efficient. The analysis is complemented with numerical studies that feature synthetic and real-world data collected in existing LTE network deployments. Additionally, the Cellular Synchronization Assisted Refinement algorithm, a method of TA-based attack augmentation is examined. We show how it can simultaneously improve location resolution and negate the effects of poor network infrastructure geometry. The analysis and simulation demonstrate that a localization attack can yield resolution as high as 40 m.

[1]  Zhansheng Duan,et al.  Posterior Cramer-Rao Bounds for State Estimation with Quantized Measurement , 2008, 2008 40th Southeastern Symposium on System Theory (SSST).

[2]  Lars Kulik,et al.  Location privacy and location-aware computing , 2006 .

[3]  Jin Cao,et al.  A Survey on Security Aspects for LTE and LTE-A Networks , 2014, IEEE Communications Surveys & Tutorials.

[4]  Giovanni Chiorboli.  Uncertainty of mean value and variance obtained from quantized data , 2003, IEEE Trans. Instrum. Meas..

[5]  Stephen B. Vardeman,et al.  Sheppard's correction for variances and the "quantization noise model" , 2005, IEEE Transactions on Instrumentation and Measurement.

[6]  Tapani Ristaniemi,et al.  Performance evaluation of LTE radio fingerprint positioning with timing advancing , 2015, 2015 10th International Conference on Information, Communications and Signal Processing (ICICS).

[7]  Pierangela Samarati,et al.  Location privacy in pervasive computing , 2008 .

[8]  Younghan Kim,et al.  Using Timing Advance to support proximity discovery in network-assisted D2D communication , 2015, 2015 Seventh International Conference on Ubiquitous and Future Networks.

[9]  G. P. Yost,et al.  Improvement in estimation of time of arrival (TOA) from timing advance (TA) , 1998, ICUPC '98. IEEE 1998 International Conference on Universal Personal Communications. Conference Proceedings (Cat. No.98TH8384).

[10]  Anind K. Dey,et al.  Location-Based Services for Mobile Telephony: a Study of Users' Privacy Concerns , 2003, INTERACT.

[11]  John C. McEachen,et al.  Maximum likelihood geolocation in LTE cellular networks using the timing advance parameter , 2016, 2016 10th International Conference on Signal Processing and Communication Systems (ICSPCS).

[12]  Martin Vetterli,et al.  Lower bound on the mean-squared error in oversampled quantization of periodic signals using vector quantization analysis , 1996, IEEE Trans. Inf. Theory.

[13]  John Krumm,et al.  A survey of computational location privacy , 2009, Personal and Ubiquitous Computing.

[14]  B. Widrow.  A Study of Rough Amplitude Quantization by Means of Nyquist Sampling Theory , 1956 .

[15]  Walter L. Smith.  Probability and Statistics , 1959, Nature.

[16]  Bernard Widrow,et al.  Quantization Noise: Roundoff Error in Digital Computation, Signal Processing, Control, and Communications , 2008 .

[17]  Clemens M. Zierhofer.  Quantization Noise as Superposition of Frequency-Modulated Sinusoids , 2009, IEEE Signal Process. Lett..

[18]  Pak-Chung Ching,et al.  Time-of-arrival based localization under NLOS conditions , 2006, IEEE Transactions on Vehicular Technology.

[19]  Gregory D. Abowd,et al.  Control, Deception, and Communication: Evaluating the Deployment of a Location-Enhanced Messaging Service , 2005, UbiComp.

[20]  Ismail Güvenç,et al.  A Survey on TOA Based Wireless Localization and NLOS Mitigation Techniques , 2009, IEEE Communications Surveys & Tutorials.

[21]  Murali Tummala,et al.  Cellular Synchronization Assisted Refinement (CeSAR): A Method for Accurate Geolocation in LTE-A Networks , 2016, 2016 49th Hawaii International Conference on System Sciences (HICSS).

[22]  W. Sheppard.  On the Calculation of the most Probable Values of Frequency‐Constants, for Data arranged according to Equidistant Division of a Scale , 1897 .

[23]  W. Marsden.  I and J , 2012 .

[24]  Torbjörn Wigren.  Fingerprinting localisation using round trip time and timing advance , 2012, IET Commun..

[25]  K. C. Ho,et al.  A simple and efficient estimator for hyperbolic location , 1994, IEEE Trans. Signal Process..

[26]  D. Brin.  The Transparent Society: Will Technology Force Us to Choose Between Privacy and Freedom? , 1998 .

[27]  John McEachen,et al.  Geolocation of LTE subscriber stations based on the timing advance ranging parameter , 2011, 2011 - MILCOM 2011 Military Communications Conference.

[28]  Jean-Pierre Hubaux,et al.  Security Issues in Next Generation Mobile Networks: LTE and Femtocells , 2010 .

[29]  John C. McEachen,et al.  Location Privacy in LTE: A Case Study on Exploiting the Cellular Signaling Plane's Timing Advance , 2017, HICSS.

[30]  Eija Kaasinen,et al.  User needs for location-aware mobile services , 2003, Personal and Ubiquitous Computing.

[31]  J.F. Bull.  Wireless geolocation , 2009, IEEE Vehicular Technology Magazine.

[32]  B. Widrow.  Statistical analysis of amplitude-quantized sampled-data systems , 1961, Transactions of the American Institute of Electrical Engineers, Part II: Applications and Industry.

[33]  Bin Ran,et al.  Intelligent Route-Based Speed Estimation Using Timing Advance , 2006, 2006 IEEE Intelligent Transportation Systems Conference.

[34]  B. Widrow,et al.  Statistical theory of quantization , 1996 .

[35]  J. J. Caffery,et al.  A new approach to the geometry of TOA location , 2000, Vehicular Technology Conference Fall 2000. IEEE VTS Fall VTC2000. 52nd Vehicular Technology Conference (Cat. No.00CH37152).

[36]  Anders Høst-Madsen,et al.  Effects of sampling and quantization on single-tone frequency estimation , 2000, IEEE Trans. Signal Process..

[37]  Erik Dahlman,et al.  4G: LTE/LTE-Advanced for Mobile Broadband , 2011 .

[38]  R. Curry.  Estimation and Control with Quantized Measurements , 1970 .

[39]  Wei Wang,et al.  Lower bounds in parameter estimation based on quantized measurements , 2013, 52nd IEEE Conference on Decision and Control.

[40]  Malcolm David Macnaughtan,et al.  Positioning GSM telephones , 1998, IEEE Commun. Mag..

[41]  F. Gustafsson,et al.  Mobile positioning using wireless networks: possibilities and fundamental limitations based on available wireless network measurements , 2005, IEEE Signal Processing Magazine.

[42]  Clemens Zierhofer.  Quantization Noise as Superposition of Frequency-Modulated Sinusoids , 2009, IEEE Signal Processing Letters.