On Location Privacy in LTE Networks

• Published in: IEEE transactions on information forensics and security Vol. 12; no. 6; pp. 1358 - 1368
• Main Authors: Roth, John D., Tummala, Murali, McEachen, John C., Scrofani, James W.
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.06.2017; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: cellular networks; Cramér-Rao bound; GSM; Location based services; Long Term Evolution; Maximum likelihood estimation; position measurement; Privacy; Protocols; Quality of service architectures; Quantization (signal); Synchronism; time of arrival estimation; Timing
• ISSN: 1556-6013; 1556-6021
• DOI: 10.1109/TIFS.2017.2656470

Location privacy is an ever increasing concern as the pervasiveness of computing becomes more ubiquitous. This is especially apparent at the intersection of privacy, convenience, and quality of service in cellular networks. In this paper, we show the long term evolution (LTE) signaling plane to be vulnerable to location-based attacks via the timing advance (TA) parameter. To this end, we adapt the Cramér-Rao lower bound for timing advance-based estimation and show the associated estimator to be efficient. The analysis is complemented with numerical studies that feature synthetic and real-world data collected in existing LTE network deployments. Additionally, the Cellular Synchronization Assisted Refinement algorithm, a method of TA-based attack augmentation is examined. We show how it can simultaneously improve location resolution and negate the effects of poor network infrastructure geometry. The analysis and simulation demonstrate that a localization attack can yield resolution as high as 40 m.