POSITION ESTIMATE FIDELITY FROM TAG MULTILATERATION ATTACK WITHIN THE 5G ENVIRONMENT

The advent of 5G promises a new age of speed and connectivity of mobile devices. Location-based services will reach a new state of accuracy as well. 4G/LTE implemented the timing advance group (TAG) to increase throughput by allowing user equipment (UE) to connect to multiple base stations (BSs). Timing advance (TA) commands are utilized in order to maintain time synchronization between each servicing BS by directing when the UE should transmit based on the distance to each associated BS. For 4G/LTE, each TA is a multiple of 78.125 meters. As the subcarrier spacing increases in 5G, this distance resolution drops proportionately. These TA commands are sent frequently as the UE moves throughout the environment and are unencrypted. This opens the concern that if an adversary were to collect and correctly associate the TAGs of a specific target, they may be able to ascertain a position estimate using multilateration. The TAG exploit has been examined for 4G/LTE and has been shown to be significant, but the new subcarrier spacing for 5G theoretically will increase the fidelity with which locations can be determined. The focus of this thesis is to establish a Cramér-Rao Lower Bound (CRLB) for position estimates based on the TA commands for each of the 5G sub-carrier spacing and to implement and test an algorithm for finding a position estimate based on target TAs through simulation.
Lieutenant, United States Navy
Approved for public release. distribution is unlimited