Location Privacy on DVB-RCS using a “Spatial-Timing” Approach

710 A. AGGELIS, E. T. SARRIS, LOCATION PRIVACY ON DVB-RCS USING A “SPATIAL-TIMING” APPROACH Location Privacy on DVB-RCS using a “Spatial-Timing” Approach Aggelis AGGELIS, Emmanuel T. SARRIS Department of Electrical and Computer Engg., Democritus Univ. of Thrace, Kimeria Univ. Campus, 67100 Xanthi, Greece [email protected], [email protected] Abstract. DVB-RCS synchronization scheme on the Return Channel requires the RCSTs to be programmed with their location coordinates with an accuracy of no more than a few kilometers. RCSTs use this location information in their ranging calculation to the servicing satellite. For certain users this location information disclosure to the network operator can be seen as a serious security event. Recent work of the authors overcame this requirement by cloaking the location of an RCST in such a way (based on "spatial/geometric" symmetries of the network) that the respective ranging calculations are not affected. In this work we argue that timing tolerances in the Return Channel synchronization scheme, accepted by the DVBRCS standard, can be used in combination to the "spatial" method, further enhancing the location privacy of an RCST. Theoretical findings of the proposed "spatialtiming" approach were used to develop a practical method that can be used by workers in the field. Finally this practical method was successfully tested on a real DVB-RCS system. Keywords DVB-RCS security, location privacy, satellite communications, data cloaking, spatial accuracy, timing tolerances. 1. Introduction Security has always been a key issue in satellite communication systems. Inspection of related bibliography [4], [8] reveals that security in DVB-RCS networks focuses on traditional areas such as confidentiality and integrity of data as well as source authentication. There is also an effort, due to the particular nature of satellite communications, to secure the physical layer against jamming, detection/interception, traffic analysis, Denial of Service and replay attacks [4]. Although location privacy has raised a number of concerns with the wide adoption of GPS / Internet enabled mobile devices [3] it has received little attention in the field of DVB-RCS security and relied only on scrambling the forward and return link to prevent unwanted leakage of information [8]. Location based privacy is an ever growing concern [10] as ubiquitous computers such as smart phones have exhibited a wide adoption and an unreserved access to the location of a large population may raise practical, legislative and ethical concerns. Both software and hardware vendors provide the facilities to seamlessly collect the mobile computer’s location. Latest web browser versions include the geolocation functionality which provides location awareness on web sites leveraging Google’s location services. Although upon a user visiting a site for the first time he/she will be presented with a list of terms and conditions and consent whether his/her location being disclosed, the complex structure of Web 2.0 and the interoperability of web syndicates will make it very challenging to maintain control over who will have access to such private information. In this paper we focus on a device with a relative limited adoption, namely DVB-RCS modem, but our conclusions could be generalized and adopted to future enhancements of the technology e.g. modems using Regenerative Satellites [9]. Location information is vital for synchronization purposes in the Return Link of an RCST (Return Channel Satellite Terminal) in a DVB-RCS network. Its location (latitude, longitude and altitude), according to the standard [7], must be known to the network operator with an accuracy of no more than a few kilometers. This requirement prevented the user from providing dummy coordinates [12] to RCST’s, or use other privacy enhancing (e.g. mix-networks [11]) technologies. For certain users and sectors (such as government, law enforcement and military for example) revealing location details can be viewed as an unacceptable leakage of information opening the door to other security events e.g. a physical attack. Despite the RCST location accuracy arguments of the DVB-RCS standard, a previous work of the authors [1] overcame the standard’s location requirements using a methodology based on spatial properties of the components (Hub station, satellite, RCST) of a DVB-RCS network, whilst not altering the RCST’s internal ranging calculations, making cloaking of the RCST location possible. The main research goal of this work is to propose a method for cloaking the location of an RCST, based on forcing errors in its internal ranging calculations up to the RADIOENGINEERING, VOL. 20, NO. 3, SEPTEMBER 2011 711 point accepted by the system. In addition, the proposed method was combined with the spatial method presented in [1] to produce a “spatial-timing” approach greatly increasing the area that can be used for RCST location cloaking. A practical method utilizing this approach, suitable for workers on the field, was also developed and tested successfully on a real DVB-RCS system. Finally the experimental results are presented. This paper is structured as follows. In Section 2 we develop the proposed privacy preserving “spatial-timing” based approach and investigate its integration within the DVB-RCS specification. Section 3 describes a proposed practical method utilizing the theoretical findings of Section 2 along with experimental results on a real DVBRCS network, empirically validating the proposed approach. Finally Section 4 contains the conclusions. 2. “Spatial-Timing” Based Cloaking In the “Spatial-Timing” method we propose for RCST location cloaking, the “timing” portion depends on timing tolerances, accepted by the DVB-RCS standard, during RCST’s login/synchronization procedure. For the benefit of the reader, we briefly describe DVB-RCS Return link synchronization concepts [6] necessary for understanding the proposed method. Fig. 1. RCST synchronization state diagram. Yellow color represent states, blue color represents procedures [6]. 2.1 Timing Tolerances on DVB-RCS Synchronization Terminal burst synchronization in DVB-RCS Return channel is affected not only by the RCST-to-satellite range; there are timing inaccuracies introduced by other factors [13]. For example, there is a deviation between the scheduled start time of a burst and the actual start time at transmitter output, introduced by the RCST circuitry. DVBRCS standard provides compensating mechanisms for these timing errors by Coarse, Fine synchronization and Maintenance synchronization procedures. Fig. 1 presents in a synchronization state diagram the overall event sequencing in order for the RCST to be able to logon. In our study we are interested in the following states and accompanying procedures:  Off / stand by state, Initial sync procedure.  Ready for Coarse sync state, Coarse sync procedure.  Ready for Fine sync state, Fine sync procedure, Sync Maintenance Procedure. In the following we provide a brief description of the above states and procedures of Fig. 1 [6] in order to identify the timing attributes that will permit us to cloak the location of the RCST. In the DVB-RCS standard, for an RCST to be able to join the network it has to get into various states following specific procedures. After boot up (Off/Stand-by state) the Terminal starts the Initial synchronization procedure. During this procedure RCST receives all necessary control information related to the operation of the DVB-RCS network through Forward link, including NCR (Network Clock Reference) used for initiating RCST’s internal clock. Then the RCST performs ranging calculations for both Forward and Return link using satellite ephemeris data contained in the Satellite Position Table (SPT, acquired through Forward link) plus a knowledge of its own location (configured by the user). These ranges are then used to calculate the corresponding RCST-to-Satellite propagation delays. If no errors occur RCST proceeds to Receive Sync state. The RCST then proceeds to the Logon procedure requesting initial access to the network. Initial burst timing errors can be low when satellite and terminal positions are known. If NCC (Network Control Center) receivers can handle these small timing errors there is no need for the RCST to perform the ranging process of the Coarse Synchronization Procedure, and it enters directly the Ready for “Fine Synchronization State”. Otherwise RCST performs Coarse Synchronization Procedure. In this procedure NCC assigns specific time slots for the Terminal to transmit its bursts and then measures the corresponding timing, frequency and power error relative to the system reference. Then the NCC sends this information (Correction Message Table) back to the RCST through Forward link signaling. The RCST then adjusts its transmission parameters and retries. This loop is continued until the accuracy is within the “coarse synchronization threshold”. Fine synchronization procedure is quite similar to the Coarse Synchronization Procedure. It is optional and only performed if the errors indicated in the latest Correction Message Table are larger than the “Fine Synchronization Threshold”. Finally, after achieving fine synchronization procedure, the RCST is allowed to transmit TRF (Traffic) bursts. In parallel the RCST maintains synchronization. 712 A. AGGELIS, E. T. SARRIS, LOCATION PRIVACY ON DVB-RCS USING A “SPATIAL-TIMING” APPROACH This procedure is carried out continuously for the duration of the session. As we can see, Maintenance synchronization procedure watches for timing errors which must be within the same limits (fine sync thresholds) as for the fine sync procedure. 2.2 Cloaking through Timing Errors As we have shown in the previous paragraphs, all of these procedures concerning timing calibration of the whole system are a feedback mechanism. Timing errors in the arrival of terminal bursts are measured on the NCC and timing correction information, through forward channel signaling, is sent to the terminals to adjust their burst transmission time accordingly. The key point here, regarding our effort to conceal the true location of our RCST, is that the NCC identifies a total timing error and cannot recognize the source responsible for parts of that error. Let us assume that a terminal’s burst during logon phase is received from the NCC at time t = t1 when ideally should have been received at t = t0. This error Et = t1 - t0 can be viewed as the sum of the error caused by inaccuracies in ranging calculations Er plus timing errors accounted on other factors Eof (e.g. internal delays of the RCST circuitry): . of E r E t E (1) In the case where the initial Et error, measured by the NCC (also referred as Hub station), is small (below Fine synchronization threshold) there is no need for Coarse and Fine Synchronization procedures to be performed and the RCST completes the logon procedure. We have to note here that if the RCST is configured with its true location coordinates and the satellite position is maintained in a tight box, initial Er is small. If a big initial timing error value (Et BIG) is detected by the Hub during logon the Coarse and Fine synchronization procedure will attempt to correct the RCST behavior so that Et is brought bellow Fine Synchronization Threshold (Et FST). . FST t E t E (2) If the terminal cannot correct its transmission time to satisfy (2) it does not synchronize with the Hub. This means that the initial measured timing error Et BIG is greater than the correcting capabilities of the system Et MAX. In the case where initial total timing error Et (= Er + Eof) is small, when terminal is configured with its true location coordinates, we have the ability to increase Et timing error by providing false coordinates to the RCST (thus increasing Er), up to the limit (Et MAX) that it cannot synchronize with the Hub station. For example let us assume that the true distance between an RCST and the satellite is DistanceR-S. If we provide the RCST with coordinates (LatR’, LongR’, AltR’) of a location R’ that produce a false DistanceR’-S to the satellite, we force an initial timing error of:   of SRSR rt E C DistanceDistanceabs EE        ' '' (3) where C is the speed of light. If this initial timing error E’t is smaller than Et MAX, the fine synchronization procedure can cope with it and we can use the LatR’, LongR’ and AltR’ to conceal the true location of our RCST. Of course the same timing error is produced by any point R’’ on Earth’s surface that has LatR’’, LongR’’ and AltR’’ coordinates, satisfying the following equation: . ''' SR Distance SR Distance    (4) Due to spatial properties of the system the geometric place of LatR’’, LongR’’ and AltR’’ that satisfies (4) is a circle on Earth’s surface like the one depicted in Fig. 2, resulting in this combined “spatial-timing” approach for concealing our terminal true location. Fig. 2. The combined “spatial-timing” approach. The two red circles on Earth’s surface, at distances D1 and D2 from satellite S, produce the maximum timing error Fine Synchronization procedure can handle, when terminal located at red X mark is configured with false coordinates lying on these circles. In theory, any location’s coordinates on Earth’s surface between these red circles (RCST Synchronization Zone) can be used to successfully synchronize the RCST with the Hub Station (of course in reality they must also lie inside satellite’s footprint). From (3) it is clear that the initial timing error E’t increases when the absolute value of the difference between the true distance from the satellite (DistanceR-S) and the false one (DistanceR’-S) increases too. We can increase this difference, by increasing or decreasing DistanceR’-S, up to the point that the resulting initial error Et MAX cannot be compensated by the Fine Synchronization Procedure. This is depicted in Fig. 2 and expressed mathematically with the following equation : 2)(1 ,',',' DDistanceD AltSAltRLongRLatR SR'    (5) where LatR’, LongR’, AltR’ represent locations on Earth’s surface. The geometric place of places satisfying (5) is the ribbon on Earth’s surface called “RCST Synchronization Zone” (Depicted in Fig. 2). RADIOENGINEERING, VOL. 20, NO. 3, SEPTEMBER 2011 713 2.3 Location Privacy Improvement Metric A simple metric, called LPI, was devised in [1] in order to quantify the improvement in location privacy that the “spatial” cloaking method offered to an RCST. LPI is practically the ratio of the area AIF that is available for cloaking the RCST’s coordinates, to the minimum area At that DVB-RCS standard [7] requires an RCST to reside within. Since the “spatial-timing” method increases AIF compared to the plain “spatial” method we can use the same metric. . t IF IA A LP  (6) The area At, as defined in [1] according to requirements stated in [7], is the area of a circle with center the true location of the RCST and a radius of 2 km: .km 56.122** 222   rAt (7) The area AIF in “spatial-timing” method is defined as the intersection of area ASZ and the servicing satellite footprint. ASZ is the result of (5) which produces an “RCST Synchronization Zone” depicted in Fig. 2. 3. Practical Method and Experimental Results In order to test the theoretical findings presented in the previous paragraphs, we developed a practical method, suitable for workers in the field and tested it in a real DVBRCS network. The proposed method extends the “spatial” method presented in [1]. For the demonstration of the proposed “spatialtiming” method, and for comparison reasons to the “spatial” experimental results presented in [1], a DVB-RCS terminal (SATNET 4100 [15]) was installed at the premises of Democritus University of Thrace (DUTH). The satellite terminal was connected to the DVB-RCS network of Hellenic Aerospace Industry which uses the Hellas Sat 2 satellite. The terminal was initially configured with coordinates obtained by a GPS device at the installation location. Based on Fig. 3 (satellite footprint) and the installation location of our test terminal (DUTH), we have downloaded from ASTER website [2] the freely available DEM (Digital Elevation Model) data (WGS84 reference frame [5]), in GeoTIFF format [16], for the region which is depicted in Fig. 4. Using the DEM data we calculated for every point i (having Lati, Longi, Alti coordinates) on the terrain the distance (Distancei-S) from Hellas Sat 2 satellite located at 39oE. The points whose distance from Hellas Sat 2 satisfies the following equation: 21 D Si DistanceD    (8) Fig. 3. Footprint of Hellas Sat 2 satellite (adopted from LyngSat Maps [14]). Fig. 4. Digital Elevation Model for the area of interest (lies inside Hellas Sat 2 footprint). Color represents the altitude above sea level. can be considered to pass the fine synchronization procedure (their timing errors can be compensated by the DVB-RCS system) and that their latitude, longitude and altitude (Lati, Longi, Alti) coordinates can be used on the RCST instead of the true ones (LatDUTH, LongDUTH, AltDUTH). Since D1 and D2 depend on the tolerances of the DVB-RCS network (Fine Synchronization Threshold), which are not announced to the user, we devised for their calculation the following empirical procedure. We provide the RCST with false coordinates that lie on the direction of the Azimuth to the satellite at the installation location, moving towards and away from the satellite. This procedure continues until the RCST cannot synchronize with the Hub station. We choose to test coordinates that lie on the previously described direction, since this is the fastest way to increase the errors in RCST ranging calculations. This procedure produces two “outer” points, which define the limits on the timing errors that the Hub can tolerate. For the RCST located at DUTH premises the results of this procedure are depicted in Fig. 5 and presented in Tab. 1. From Fig. 5 we use the coordinates of Points P3N and P4S in order to find the Distances D1 and D2 of (8). P3N and P4S are the last coordinates that our modem synchronized to the hub moving away and towards the satellite respectively. 714 A. AGGELIS, E. T. SARRIS, LOCATION PRIVACY ON DVB-RCS USING A “SPATIAL-TIMING” APPROACH Fig. 5. Yellow marker represents the true location of the RCST (DUTH premises). Green markers represent the coordinates that when inserted to the RCST, the synchronization to the Hub was maintained. Red markers represent the locations that when inserted to the RCST, synchronization to Hub was not possible. Fig. 6. In the gray area lie the points that satisfy (8) for D1 = 37721387.41 m and D2 = 37780244.51 m. This means that if we configure the RCST with coordinates that lie in the gray zone the RCST will synchronize with the Hub station. Test Point Lat(o) Long(o) Alt(m) Dist. From Satellite (m) RCST Sync. (YES/NO) P1S 41.028519 24.969171 22 37738148 YES P2S 40.973225 25.018415 14 37732669 YES P3S 40.890607 25.070411 0 37724983 YES P4S 40.855478 25.107001 0 37721387 YES P5S 40.834664 25.127264 0 37719289 NO P1N 41.265897 24.811874 890 37759958 YES P2N 41.408245 24.740939 1011 37772804 YES P3N 41.495369 24.715894 1105 37780244 YES P4N 41.549274 24.712915 1041 37784643 NO Tab. 1. Coordinates of Test Points (latitude, longitude, altitude). Timing errors in ranging calculation are caused by configuring RCST with fake coordinates. Fig. 7. The yellow X marker represents the true location of the RCST. Markers denoted as PiUL and PiDL represent points with coordinates that lie inside the “grey” zone of Fig 6. Markers denoted as PiUU and PiDU represent points with coordinates outside the “grey” zone of Fig. 6. A green marker indicates that the RCST located at X synchronized with Hub when configured with markers coordinates. A red marker indicates that the RCST could not synchronize with the Hub when configured with markers coordinates. Distances D1 and D2 are derived from Tab. 1 and are: m, 41.377213871  D m. 51.377802442  D Substituting D1 and D2 in (8) the resulting cloaking area for the Digital elevation map of Fig. 4 is presented in Fig. 6. Unfortunately we cannot test for every point that lies in the gray zone of Fig. 6. Configuring the RCST with coordinates and waiting for it to synchronize with the hub station is a procedure that usually takes about 4 minutes. In order to test our theory we have chosen a number of points that lie inside the gray zone and a number of points that lie outside the gray zone. Results are depicted in Fig. 7. Points inside the gray zone are named PiUL and PiDL and are chosen to be near the edges of the gray zone of Fig. 6. Points outside the gray zone are named PiUU and PiDU. If the modem synchronized, when configured with the coordinates of a point, the marker of the point was painted green, else it was painted red. As we can see from Fig. 7 the experimental results verify our calculations. We now have to see how these results improve the location privacy of our RCST. In the case of the terminal located at DUTH the gray zone of Fig. 6, excluding the sea areas is .km 43200 2  IF A (9) Location privacy was improved by a factor of ~3439 times: RADIOENGINEERING, VOL. 20, NO. 3, SEPTEMBER 2011 715 .3439 km 56.12 km 43200 2 2  t IF IA A LP (10) If we compare the above LPI result, produced by the “spatial-timing” method for the DUTH experiment, to the corresponding “spatial” method produced LPI (~131) of [1], we find that the “spatial-timing” method increased the LPI by a factor of 26 for the specific experiment setup. The same test procedure was repeated successfully for a terminal located at: m. 28 ,690662.23 ,962939.37 2 2 2    TEST o TEST o TEST Alt Long Lat (11) The cloaking “grey” zone for this location along with experimental results for finding the width of the zone along verification experiment are presented in Fig. 8 and 9 respectively. 4. Conclusions and Areas of Further Research In this work we presented that spatial attributes and timing tolerances of the DVB-RCS return link synchronization design can be exploited in combination and improve significantly the location privacy of an RCST. A practical methodology for this “spatial-timing” approach was also presented for the calculation of the area inside the satellite’s footprint where the user can effectively and systematically “hide” his terminal. The theoretical findings and the proposed methodology were successfully tested on a real DVB-RCS system. Although location privacy was greatly improved, and the RCST synchronized successfully with the Hub station, we have not tested the relation between the introduced timing errors and the degradation of QOS if any. It is our intent to explore, in a following work, this relation in order to find if there is any side channel information that can be used to reveal the true location of the RCST. Acknowledgements The authors would like to thank the staff at Satellite and Space Applications Department of Hellenic Aerospace Industry S.A. for their invaluable help. References [1] AGGELIS, A, SARRIS E. T., KATOS, V. A location privacy extension for DVB-RCS. Radioengineering, 2011, vol. 20, no. 1, p. 151 - 158. Fig. 8. Cloaking zone for RCST physically locate at yellow X marker. Zone boundaries resulted from the experiment presented in Fig. 9a. Fig. 9. (a) Cloaking zone timing boundaries experiment for RCST located physically at yellow X marker. (b) Verification experiment for cloaking zone of Fig. 8. [2] ASTER Global Digital Elevation Model (ASTER GDEM) data. [Online] Available at: http://www.gdem.aster.ersdac.or.jp/. [3] DOTY, N., MULLIGAN, D, WILDE, E. Report 2010-038: Privacy Issues of the W3C Geolocation API. Berkeley (CA, USA): UC Berkeley School of Information, 2010. 716 A. AGGELIS, E. T. SARRIS, LOCATION PRIVACY ON DVB-RCS USING A “SPATIAL-TIMING” APPROACH [4] ESA, European Space Agency. Final Report: Security for DVBRCS at Management and Control Planes. [Online] Cited 2010-0527. Available at http://telecom.esa.int. [5] EUROCONTROL, European Organization for the Safety of Air Navigation. WGS 84 Implementation Manual. [Online] Cited 1998-02-12. Available at http://www2.icao.int. [6] ETSI, European Telecommunications Standards Institute. Digital Video Broadcasting (DVB); Interaction Channel for Satellite Distribution Systems. ETSI EN 301 790 V1.5.1. [Online] Cited 2009-05. Available at http://www.etsi.org. [7] ETSI, European Telecommunications Standards Institute. Digital Video Broadcasting (DVB); Interaction channel for Satellite Distribution Systems; Guidelines for the use of EN 301 790. ETSI TR 101 790 [Online] Cited 2009-07. Available at http:// www.etsi.org. [8] ETSI, European Telecommunications Standards Institute. Satellite Earth Stations and Systems (SES); Broadband Satellite Multimedia (BSM); IP Internetworking over Satellite; Security Aspects. ETSI TR 102 287. [Online] Cited 2004. Available at http://www.etsi.org. [9] GOUTA, M. On the harmonization of terminals for regenerative satellite multimedia systems. In Proceedings of the 19th International Communications Satellite Systems Conference. Toulouse (France), 2001. [10] IACHELLO, G., SMITH, I., CONSOLVO, S., ABOWD, G. HUGHES, J., HOWARD, J., POTTER, F., SCOTT, J., SOHN, T., HIGHTOWER, T., LAMARCA, A. Control, deception, and communication: Evaluating the deployment of a location-enhanced messaging service. In Proceedings of the 7th International Conference on Ubiquitous Computing UBICOMP 2005. Tokyo (Japan), 2005, p. 213 - 231. [11] JIANG, J., HE, C., JIANG, L. A novel mix-based location privacy next term mechanism in Mobile IPv6. Computers & Security, 2005, vol. 24, no. 8, p. 629 - 641. [12] KIDO, H., YANAGISAWA, Y., SATOH, T. Protection of location privacy using dummies for location-based services. In Proceedings of the 21st International Conference on Data Engineering Workshops. Tokyo (Japan), 2009. [13] NEALE, J., BEGIN, G. Terminal timing synchronization in DVBRCS systems using on-board NCR generation. Space Communications, 2001, vol. 17, no. 1-3, p. 257 - 266. [14] LyngSat Maps. [Online] Available at http://lyngsatmaps.com. [15] Advantech Wireless, Canada. SatNet SIT Series S4120 IDU datasheet, rev. 2. [Online] Cited 2009-07. Available at: http://www.advantechwireless.com/file/product_sheets/Product_Sh eet_VSAT_S4120.pdf. [16] GeoTIFF project. GeoTIFF Format Specification; Specification Version 1.8.2. [Online] Cited 2000-12-28. Available at: http://www.remotesensing.org/geotiff/spec/geotiffhome.html. About Authors ... Aggelis AGGELIS obtained his BSc in Electrical and Computer Engineering from Democritus University of Thrace, Greece; and MSc in Telecommunications from Democritus University of Thrace. He is currently a PhD candidate in Electrical and Computer Engineering in Democritus University, Greece. Aggelis is currently working as a Telecommunications Engineer at the Hellenic Aerospace Industry. His research interests include DVBRCS, embedded computing and signal processing. Emmanuel T. SARRIS is Professor of Electrodynamics at the Department of Electrical Engineering of the University of Thrace and Director of the Space Research Laboratory, 1977-present. He received the Physics Diploma, from Univeristy of Athens (1967) and PhD in Space Physics from University of Iowa (1973, w. J. A. Van Allen). He has experience in space plasma electrodynamics, design, construction and testing of space instruments and systems, satellite communications. He hasn been a Co-I or P-I of experiments on the spacecraft: Ulysses, Geotail, InterballAurora, Interball-Tail, Cluster, Spektr-R. He has published over 300 refereed publications and received 1700 citations. He is a member of COSPAR Council, Corresponding Member of the Academy of Athens, 2003. He has received ESA and/or NASA Awards for outstanding contributions to the Ulysses, Geotail and Cluster Missions.