Location Privacy in LTE: A Case Study on Exploiting the Cellular Signaling Plane's Timing Advance

Abstract

Abstract-Location privacy is an oft-overlooked, but exceedingly important niche of the overall privacy macrocosm. An ambition of this work is to raise awareness of concerns relating to location privacy in cellular networks. To this end, we will demonstrate how user location information is leaked through a vulnerability, viz. the timing advance (TA) parameter, in the Long Term Evolution (LTE) signaling plane and how the position estimate that results from that parameter can be refined through a previously introduced method called Cellular Synchronization Assisted Refinement (CeSAR) [1]. With CeSAR, positioning accuracies that meet or exceed the FCC's E-911 mandate are possible making CeSAR simultaneously a candidate technology for meeting the FCC's wireless localization requirements and a demonstration of the alarming level of location information sent over the air. We also introduce a geographically diverse data set of TAs collected from actual LTE network implementations utilizing different cell phone chipsets. With this data set we show the appropriateness of modeling the error associated with a TA as normally distributed.

Threat modeling framework for mobile communication systems

“…For example, radio link a ackers can use fake base stations either to check whether UEs are present in a given location or to obtain precise coordinates of the UE [92,106,133,163]. Similarly, adversaries with access to core network can misuse signaling protocols (e.g., SS7 [55,56] and Diameter [80,145]) or exploit vulnerabilities in the signaling plane [149] for obtaining location information. IP-based a ack vectors from the IMS domain (e.g., over VoLTE) also yields similar results [100].…”

Quantifying Location Privacy in Urban Next-Generation Cellular Networks

“…These limitations notwithstanding, the tighter timing requirements in LTE provide a level of accuracy up to 78.125 m [12], which bring the TA back under consideration as a viable method for cellular localization. Unfortunately, the security architecture of LTE does not afford for the confidentiality of the TA and other signaling plane information critical for the protection of user privacy as it is not encrypted [7], [13]. As this information is sent in the clear, it provides the vehicle for location exploitation in LTE.…”

“…The TA has been previously considered formally as a location privacy preserving mechanism (LPPM) [13], [14] with both a user anonymization component (the cell-radio network temporary identifier (C-RNTI) [9]) and an information obscurity component (the discretization of distance via the TA [15]). The obscurity component of the LPPM is described with the model…”

“…Further, the introduction of a extra-network sensor facilitates a higher level of accuracy through introduction of a new node and the flexibility to mitigate the dilution of accuracy of potentially poor network infrastructure geometry (which LBS is typically beholden to) [22]. These effects come at no cost of bandwidth to the network due to its passive nature, which simultaneously act as a force multiplier for network operators [22] and a latent signaling plane vulnerability making attribution and detection of unauthorized positioning difficult [13].…”