Geolocation of LTE subscriber stations based on the timing advance ranging parameter

Abstract

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington DC 20503. AGENCY USE ONLY (Leave blank)2. REPORT DATE December 2010 REPORT TYPE AND DATES COVEREDMaster's Thesis 4. TITLE AND SUBTITLE Geolocation of LTE Subscriber Stations Based on the Timing Advance Ranging Parameter 6. AUTHOR(S) Leslie A. Jarvis, Jr. FUNDING NUMBERS PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)Naval Postgraduate School Monterey, CA 93943-5000 12a. DISTRIBUTION / AVAILABILITY STATEMENTApproved for public release; distribution is unlimited 12b. DISTRIBUTION CODE ABSTRACT (maximum 200 words)The possibility of geolocating a Long Term Evolution (LTE) subscriber station based on the timing advance ranging parameter within the network signal internals is investigated in this thesis. The basic approach to geolocation based on radial distances from multiple base stations is outlined. Specifics of the timing parameters used during LTE network entry are examined as they relate to calculating these distances. Computer simulation is used to demonstrate expected geolocation accuracy in multiple base station networks when estimating likely locations of subscriber stations on a two-dimensional coordinate mapping system. Computer simulation is further refined to demonstrate expected geolocation accuracy in multiple base station networks when estimating likely locations of subscriber stations on a three-dimensional coordinate mapping scheme. The possibility of fixes with ten times greater accuracy than in previous results in literature are shown by applying timing advance techniques to Global System for Mobile communications networks when using a two-dimensional coordinate mapping scheme. Accuracy capable of being within 50 centimeters when using a three-dimensional coordinate mapping scheme, comparable to the accuracy in Global Positioning System technologies, are also shown. Submitted in partial fulfillment of the requirements for the degree of NUMBER OF PAGES 123 SUBJECT TERMS MASTER OF SCIENCE IN ELECTRICAL ENGINEERINGfrom the NAVAL POSTGRADUATE SCHOOL December 2010Author: Leslie A. Jarvis, Jr. are shown by applying timing advance techniques to Global System for Mobile communications networks when using a two-dimensional coordinate mapping scheme.

Quantifying Location Privacy in Urban Next-Generation Cellular Networks

“…In GSM, timing requirements were lax enough that the TA would only provide information accurate to 550 m at most, hardly enough to spur interest [11]. These limitations notwithstanding, the tighter timing requirements in LTE provide a level of accuracy up to 78.125 m [12], which bring the TA back under consideration as a viable method for cellular localization. Unfortunately, the security architecture of LTE does not afford for the confidentiality of the TA and other signaling plane information critical for the protection of user privacy as it is not encrypted [7], [13].…”

“…In the first step, the UE position p 2 in R 2 is estimated using (4) [7], [12]. To realize optimal or nearoptimal results we utilize the maximum-likelihood estimate (MLE) in R 2 found via [19] i…”

Location Privacy in LTE: A Case Study on Exploiting the Cellular Signaling Plane's Timing Advance

“…Here ∆f is the subcarrier spacing (nominally 15kHz) and 2048 is the maximum Fast Fourier Transform size [16], [17].…”

“…It was not until Jarvis et al [16] recognized the potential in the TA parameter in LTE networks that researchers reopened their study of the TA as a means to positioning. Although again a simulation only approach, the authors showed viable positioning accuracy in three dimensions when using a TA from three and four eNBs.…”

On mobile positioning via Cellular Synchronization Assisted Refinement (CeSAR) in LTE and GSM networks

“…We assume that a passive listener, or sensor, observes a timing advance parameter and can link that parameter to a specific UE of interest 1 . We illustrate in Figure 1 how with this information the listener knows that the UE is located within an annulus of width w T A meters [10]. Once the sensor has ascertained in which annulus the UE is located the sensor is then left to estimate the UE location,χ, randomly within that annulus.…”