John D. Roth

Cellular Synchronization Assisted Refinement (CeSAR): A Method for Accurate Geolocation in LTE-A Networks

The vulnerability of cellular networks to location-based attacks via uplink timing management commands has been studied since the advent of GSM. However, the introduction of heterogenous networks as the answer to increasing demand for data throughput has resulted in a new vulnerability to such attacks. In this work, we propose Cellular Synchronization Assisted Refinement (CeSAR), an entirely passive method of leveraging available LTE-A downlink synchronization messaging to refine uplink timing advance commands issued by the network. Our results suggest that CeSAR is capable of providing positioning improvement, not only in LTE-A networks but also in legacy deployments, of up to 254 meters.

Location Privacy in LTE: A Case Study on Exploiting the Cellular Signaling Plane's Timing Advance

Location privacy is an oft-overlooked, but exceedingly important niche of the overall privacy macrocosm. An ambition of this work is to raise awareness of concerns relating to location privacy in cellular networks. To this end, we will demonstrate how user location information is leaked through a vulnerability, viz. the timing advance (TA) parameter, in the Long Term Evolution (LTE) signaling plane and how the position estimate that results from that parameter can be refined through a previously introduced method called Cellular Synchronization Assisted Refinement (CeSAR) [1]. With CeSAR, positioning accuracies that meet or exceed the FCC’s E-911 mandate are possible making CeSAR simultaneously a candidate technology for meeting the FCC’s wireless localization requirements and a demonstration of the alarming level of location information sent over the air. We also introduce a geographically diverse data set of TAs collected from actual LTE network implementations utilizing different cell phone chipsets. With this data set we show the appropriateness of modeling the error associated with a TA as normally distributed.

Maximum likelihood geolocation in LTE cellular networks using the timing advance parameter

Wireless geo location is an increasingly relevant area of research as cellular technology becomes ever more ubiquitous. In this work we consider the timing advance parameter in Long Term Evolution cellular networks to this end. We also evaluate a previously introduced method of position estimation augmentation called Cellular Synchronization Assisted Refinement (CeSAR). We first develop the concept of geometric dilution of precision and the Cramer-Rao Lower Bound (CRLB) to motivate an intuition for positioning accuracy. We then derive an exact maximum likelihood estimator (MLE) for TA-specific position estimation. While the exact MLE proves to be computationally difficult, it is shown to be equivalent to the MLE in the general case of Gaussian noise. This equivalency is then used to propose an approximate MLE (AMLE). Through simulation, the AMLE is shown to meet the CRLB. Real-world data that includes urban, suburban, line-of-sight, and non-line-of-sight channels are also presented and used to build a realistic model of the TA-specific channel. This model is then used to evaluate the performance of the AMLE and CeSAR in non-line-of-sight and line-of-sight conditions. Our results suggest that the proposed method may be appropriate for meeting the Federal Communication Commissions E-911 requirements.

A configurable fingerprint-based hidden-Markov model for tracking in variable channel conditions

A novel scheme for mobile subscriber positioning is proposed based on the hidden-Markov model (HMM) and the cell-ID maximum-likelihood database correlation method also known as fingerprinting. Using a simulated channel environment, based on the Clearwire deployment of WiMAX base stations in San Jose, CA, we show that matching the right configuration of the model to the deployment environment can realize significant gains in performance. The proposed scheme balances the scalability inherent in hidden-Markov-based motion models deployed in large areas of interest against the existing channel conditions and computational capability. By utilizing a simulated channel this paper demonstrates the effect of base station deployment and shadowing on the fingerprint-based HMM motion model. Further, the benefits gained through scaling the HMM are explored.

A computationally efficient approach for hidden-Markov model-augmented fingerprint-based positioning

This paper presents a computationally efficient approach for mobile subscriber position estimation in wireless networks. A method of data scaling assisted by timing adjust is introduced in fingerprint-based location estimation under a framework which allows for minimising computational cost. The proposed method maintains a comparable level of accuracy to the traditional case where no data scaling is used and is evaluated in a simulated environment under varying channel conditions. The proposed scheme is studied when it is augmented by a hidden-Markov model to match the internal parameters to the channel conditions that present, thus minimising computational cost while maximising accuracy. Furthermore, the timing adjust quantity, available in modern wireless signalling messages, is shown to be able to further reduce computational cost and increase accuracy when available. The results may be seen as a significant step towards integrating advanced position-based modelling with power-sensitive mobile devices.

On mobile positioning via Cellular Synchronization Assisted Refinement (CeSAR) in LTE and GSM networks

Inferring user equipment (UE) location in cellular networks via uplink timing management presents attractive possibilities in an increasingly mobile-connected world. Power constrained mobile devices with ever more common applications that rely on location-based services demand an alternate solution to positioning than a Global Navigation Satellite System (GNSS) and its derivatives. In this paper we provide analysis of mobile positioning via timing advance (TA), an LTE parameter also accounted for in legacy network deployments. Specifically, we provide analysis for a TA-based method Cellular Synchronization Assisted Refinement (CeSAR). We demonstrate through analysis and simulation how CeSAR can increase accuracy in timing advance-based positioning by several hundreds of meters with no impact to radio link level traffic. CeSAR is shown to be robust to situations where unassisted TA-based positioning can provide poor positioning accuracy.

A Scalable Hidden-Markov Model Algorithm for Location-Based Services in WiMAX Networks

Hidden-Markov Models (HMM) have shown promise as viable solutions to providing location based services (LBS) within cellular networks. Previously established work includes a scheme to merge the stochastic contribution of the HMM and maximum likelihood decisions based on signal strength measurements and timing adjust parameters. A novel scalable positioning algorithm that utilizes the aforementioned techniques along with reorientation of the state vector in order to favor the local measurements within the area of interest is proposed in this paper. The resulting scheme is presented and its performance validated through simulations built from a scenario based on a real world WiMAX network. The results demonstrate improved performance over previous work, and the effect of scaling the algorithm is discussed.

On Location Privacy in LTE Networks

Location privacy is an ever increasing concern as the pervasiveness of computing becomes more ubiquitous. This is especially apparent at the intersection of privacy, convenience, and quality of service in cellular networks. In this paper, we show the long term evolution (LTE) signaling plane to be vulnerable to location-based attacks via the timing advance (TA) parameter. To this end, we adapt the Cramér-Rao lower bound for timing advance-based estimation and show the associated estimator to be efficient. The analysis is complemented with numerical studies that feature synthetic and real-world data collected in existing LTE network deployments. Additionally, the Cellular Synchronization Assisted Refinement algorithm, a method of TA-based attack augmentation is examined. We show how it can simultaneously improve location resolution and negate the effects of poor network infrastructure geometry. The analysis and simulation demonstrate that a localization attack can yield resolution as high as 40 m.

Location Estimation via Sparse Signal Reconstruction in Subsampled Overcomplete Dictionaries for Wireless 4G Networks

We present a simple and effective means for position estimation designed to be deployed in urban and dense multipath environments characteristic of 4G wireless networks. To address the multipath channel of such environments a fingerprinting scheme is proposed. One of the drawbacks to this class of methods is the large initial cost associated with establishing a database matrix. This issue is addressed by using a multi-channel filtering method adapted from the H.264 video standard to recover the incomplete data. Position estimation is accomplished via a modified k-nearest neighbor approach to pattern matching. We show through simulation that not only are we able to achieve compelling fidelity in the reconstructed databases from highly incomplete data, but that we are able to do so at a relatively low computational cost. Finally, our results demonstrate that we are able to achieve accurate position estimates vis-à-vis severe under sampling and noisy channel conditions.

Quantifying Location Privacy in Urban Next-Generation Cellular Networks

With urbanization and cellular subscribership rising sharply, cellular use in urban locales has become a normative behavior for the majority of the world’s population. As the research community pushes the limits of what is possible in the next generation cellular arena, it is prudent to simultaneously hold in tension the responsibility to provide appropriate protections to the ultimate end users of such technology. To this end, this research illustrates a location-based attack in modern cellular networks. This attack leverages control information sent over the radio access network without the benefit of encryption. We show how this attack is particularly potent in urban localization where it is important to infer location in three dimensions. We quantify the efficacy of such an attack, and therefore the associated location privacy, through simulation both in a generic cellular environment and in an environment modeled after downtown Honolulu. Our results show that accuracy on the order of 15 meters