On Location Privacy in LTE Networks

Abstract

Location privacy is an ever increasing concern as the pervasiveness of computing becomes more ubiquitous. This is especially apparent at the intersection of privacy, convenience, and quality of service in cellular networks. In this paper, we show the long term evolution (LTE) signaling plane to be vulnerable to location-based attacks via the timing advance (TA) parameter. To this end, we adapt the Cramer-Rao lower bound for timing advance-based estimation and show the associated estimator to be efficient. The analysis is complemented with numerical studies that feature synthetic and real-world data collected in existing LTE network deployments. Additionally, the Cellular Synchronization Assisted Refinement algorithm, a method of TA-based attack augmentation is examined. We show how it can simultaneously improve location resolution and negate the effects of poor network infrastructure geometry. The analysis and simulation demonstrate that a localization attack can yield resolution as high as 40 m.