Location-Privacy Leakage and Integrated Solutions for 5G Cellular Networks and Beyond (original) (raw)
Related papers
Quantifying Location Privacy in Urban Next-Generation Cellular Networks
Proceedings of the 51st Hawaii International Conference on System Sciences, 2018
With urbanization and cellular subscribership rising sharply, cellular use in urban locales has become a normative behavior for the majority of the world's population. As the research community pushes the limits of what is possible in the next generation cellular arena, it is prudent to simultaneously hold in tension the responsibility to provide appropriate protections to the ultimate end users of such technology. To this end, this research illustrates a location-based attack in modern cellular networks. This attack leverages control information sent over the radio access network without the benefit of encryption. We show how this attack is particularly potent in urban localization where it is important to infer location in three dimensions. We quantify the efficacy of such an attack, and therefore the associated location privacy, through simulation both in a generic cellular environment and in an environment modeled after downtown Honolulu. Our results show that accuracy on the order of 15 meters is possible.
On Location Privacy in LTE Networks
IEEE Transactions on Information Forensics and Security, 2017
Location privacy is an ever increasing concern as the pervasiveness of computing becomes more ubiquitous. This is especially apparent at the intersection of privacy, convenience, and quality of service in cellular networks. In this paper, we show the long term evolution (LTE) signaling plane to be vulnerable to location-based attacks via the timing advance (TA) parameter. To this end, we adapt the Cramér-Rao lower bound for timing advance-based estimation and show the associated estimator to be efficient. The analysis is complemented with numerical studies that feature synthetic and real-world data collected in existing LTE network deployments. Additionally, the Cellular Synchronization Assisted Refinement algorithm, a method of TA-based attack augmentation is examined. We show how it can simultaneously improve location resolution and negate the effects of poor network infrastructure geometry. The analysis and simulation demonstrate that a localization attack can yield resolution as high as 40 m.
Location Privacy in LTE: A Case Study on Exploiting the Cellular Signaling Plane's Timing Advance
Proceedings of the 50th Hawaii International Conference on System Sciences (2017), 2017
Location privacy is an oft-overlooked, but exceedingly important niche of the overall privacy macrocosm. An ambition of this work is to raise awareness of concerns relating to location privacy in cellular networks. To this end, we will demonstrate how user location information is leaked through a vulnerability, viz. the timing advance (TA) parameter, in the Long Term Evolution (LTE) signaling plane and how the position estimate that results from that parameter can be refined through a previously introduced method called Cellular Synchronization Assisted Refinement (CeSAR) [1]. With CeSAR, positioning accuracies that meet or exceed the FCC's E-911 mandate are possible making CeSAR simultaneously a candidate technology for meeting the FCC's wireless localization requirements and a demonstration of the alarming level of location information sent over the air. We also introduce a geographically diverse data set of TAs collected from actual LTE network implementations utilizing different cell phone chipsets. With this data set we show the appropriateness of modeling the error associated with a TA as normally distributed.
IEEE Systems Journal, 2013
Mobile telephony (e.g., Global System for Mobile Communications [GSM]) is today's most common communication solution. Due to the specific characteristics of mobile communication infrastructure, it can provide real added value to the user and various other parties. Location information and mobility patterns of subscribers contribute not only to emergency planning, general safety, and security, but are also a driving force for new commercial services. However, there is a lack of transparency in today's mobile telephony networks regarding location disclosure. Location information is generated, collected, and processed without being noticed by subscribers. Hence, by exploiting subscriber location information, an individual's privacy is threatened. We develop a utility-based opponent model to formalize the conflict between the additional utility of mobile telephony infrastructure being able to locate subscribers and the individual's privacy. Based on these results, measures were developed to improve an individual's location privacy through a user-controllable GSM software stack. To analyze and evaluate the effects of specific subscriber provider interaction, a dedicated test environment will be presented, using the example of GSM mobile telephony networks. The resulting testbed is based on real-life hardware and opensource software to create a realistic and defined environment that includes all aspects of the air interface in mobile telephony networks and thus, is capable of controlling subscriber-provider interaction in a defined and fully controlled environment.
A Novel Variable Pseudonym Scheme for Preserving Privacy User Location in 5G Networks
Security and Communication Networks
Due to the development in 5G mobile communications, user privacy becomes the main challenge, especially with the multiplicity of services and applications that can be accessed. Location privacy is related to the user privacy in terms of the possibility of tracking and unwanted advertisements, as well as the possibility of exposure to suspicious activities and terrorist attacks based on the user location. Accordingly, previous mobile systems use pseudonyms instead of a permanent identity to preserving the user’s location privacy in mobile networks, by what is known as the Cellular Radio Network Temporary Identifiers (C-RNTIs). The C-RNTI protects the user privacy relatively, but it faces some problems due to the clear text of the user in CRNI exchange, which will make the user easily trackable by man-in-the-middle attack. This article aims at proposing a new algorithm that improves the user’s location privacy and enhances the capabilities of the 5G infrastructure in terms of confiden...
Location privacy in wireless personal area networks
Proceedings of the 5th ACM workshop on Wireless security - WiSe '06, 2006
Location privacy is one of the major security problems in a Wireless Personal Area Network (WPAN). By eavesdropping on the transmitted packets, an attacker can keep track of the place and time of the communication between the mobile devices. The hardware address of the device can often be linked to the identity of the user operating the mobile device; this represents a violation of the user's privacy. Fortunately, this problem can be solved quite efficiently in a WPAN. We consider four communication scenarios and present several techniques to solve the location privacy problem in each of these scenarios. As mobile devices in a WPAN are typically operated by a user and energy constrained, we focused on user-friendliness and energy consumption during the design of our solutions.
Managing location privacy in cellular networks with femtocell deployments
2011 International Symposium of Modeling and Optimization of Mobile, Ad Hoc, and Wireless Networks, 2011
Femtocell deployments allow for high precision in localizing mobile devices. Many of today's location based services have long been mapping the placements of wireless base stations and using the obtained maps to localize mobile devices. Allowing unauthorized third parties to obtain the locations of femtocell base stations may not be desired by network operators. Localizing mobile devices using the information about femtocell base stations' locations is a service that an investor in a femtocell deployment may want to exploit exclusively. In this work we present a station identity management system that enables preserving femtocell base stations location privacy. Through the use of dynamic base station identifiers, the system ensures that unauthorized third parties are not able to map the locations of the base stations for use in their localization services. We analyze the design tradeoffs of the presented approach for different femtocell technologies. Results indicate that complexity will be limited, and that the presented system creates network dynamics smaller than the existing dynamics due to mobility. Additionally, we present an approach for providing location information to authorized systems at different resolution levels.
Phantom: Physical layer cooperation for location privacy protection
2012
Localization techniques that allow inferring the location of wireless devices directly from received signals have exposed mobile users to new threats. Adversaries can easily collect required information (such as signal strength) from target users, however, techniques securing location information at the physical layer of the wireless communication systems have not received much attention. In this paper, we propose Phantom, a novel approach to allow mobile devices thwart unauthorized adversary's location tracking by creating forged locations. In particular, Phantom leverages cooperation among multiple mobile devices in close vicinity and utilizes synchronized transmissions among those nodes to obfuscate localization efforts of adversary systems. Through an implementation on software-defined radios (GNU Radios) and extensive simulation with real location traces, we see that Phantom can improve location privacy.
Enabling Location Privacy in Wireless Personal Area Networks
2007
Location privacy is one of the major security problems in a Wireless Personal Area Network (WPAN). An eavesdropper can keep track of the place and time mobile devices are communicating. The hardware address of a device can often be linked to the identity of the user operating the mobile device; this represents a violation of the user's privacy. In this paper, we consider four communication scenarios and present several techniques to solve the location privacy problem in each of these scenarios. We will also show that these scenarios are related to each other. As mobile devices in a WPAN are typically operated by a user and energy constrained, we focused on user-friendliness and energy consumption during the design of our solutions.