UE Positioning in LTE for Surveillance

Today there is a lot of emphasis to get the current location of the UEs (users) to provide better services. This is required to provide location based services like advertising and infotainment to the end users. Service providers are interested to know the current location of the user as it helps in pushing relevant advertisements which in turn helps in revenue generation.

UE Positioning in LTE for Surveillance
Ethical Surveillance by law enforcement agencies is another use case where the positioning of UE is important. This can also be used to track the user in case of emergency. In this scenario, most of the information should be available on eNodeB and EPC as nodes like Location Measurement Unit or Location Server will increase the turnaround time.

The eNodeB and EPC nodes need to be fine-tuned to help derive the UE position. Fine tuning of these nodes includes collection of timing advance related information and tweaking some of the standard 3GPP call flows.

Over and above this data, a simple application can be prepared to retrieve all relevant information and works on the inputs to get the UE location.

Many such applications are already available and they are generally called IMSI Catcher or StingRay. These applications may be used for below purposes:

  • Monitoring & Interception
  • Jamming mobile operation in a particular area or a particular UE
  • DoS (Denial of Service) attacks
  • Other purposes specific to the requirements of law enforcement agencies

UE location can be derived from the information using Timing Advance, Measurement Reports, Angle of Arrival etc. Location derived from this information is accurate up to few 100 meters. In the latest 3GPP releases some more sophisticated methods are introduced to get a more precise location of the UE. A solution can utilize these new procedures along with the existing ones to get more precise location information.

In this blog, we will discuss the methods related only to the eNodeB where information is retrieved from the eNodeB and further used to derive the location of the UE. This way we don’t need to go through the E-UTRAN UE Positioning Architecture involving many nodes & protocols like MME, SLP, E-SMLC, LMU etc. More details on E-UTRAN UE Positioning Architecture is captured in 3GPP specification 36.305 and supported positioning methods are listed below. This kind of architecture is feasible for a commercial service provider but not useful for a standalone and use and go surveillance model.

  • A-GNSS – Assisted GNSS
  • OTDOA – Observed Time Difference of Arrival
  • E-CID – Enhanced Cell Identification
  • UTDOA – Uplink Time Difference of Arrival
  • Barometric
  • WLAN
  • Bluetooth
  • Terrestrial Beacon System (TBS)

For a standalone and use and go kind of surveillance system which involves eNodeB and EPC and a separate entity to derive UE locations, we need at least below information to derive a UE location:

  • Timing Advance Type 1 or Type 2
  • Received Signal Strength Indicator (via Measurement Reports)
  • Angle of Arrival

Timing Advance and RSSI are used to measure the distance from eNodeB and Angle of Arrival is used to derive the direction. In the absence of “Angle of Arrival” information, we can use the trilateration method but for that purpose we need reports from at least 3 eNodeBs. Timing Advance Type 1 can provide distance with accuracy up to 80m and Type 2 can provide distance with accuracy up to 10m.

Above information is useful for the static UE but a moving UE requires continuous information to derive location. In this case, it can drive information from relative TA as per the TA value received from PHY/L1 for every UL information or the eNodeB can force the UE to send absolute TA for every downlink message by triggering RACH message. To get absolute TA corresponding to every downlink message, eNodeB should send dedicated RA preamble to the UE. Moreover eNodeB can configure UE such that Measurement Reports are shared by the UE periodically so that every movement of a particular UE is tracked.

3GPP specifications have additional features through which more location related information for a UE can be derived. Some of them are GNSS based location information, logged measurements in idle mode, OTDOA based positioning, UE Rx – Tx time difference measurement, Measurement Reports for rs-sinr & RSSI, rlf reports etc. These features were introduced by 3GPP in different versions of specifications and the below table is useful  In better understanding them.

S.No. Feature List 3GPP Release Usefulness
1 GNSS based Location information 10 May be used to derive 3-D coordinates of UE location
2 Logged Measurements in Idle Mode 10 Provides information related to the serving & neighboring eNodeBs and may be used for deriving moving UE information
3 UE Rx-Tx Time Difference Measurement 9 May be used to derive Timing Advance Type 2 information for better distance accuracy
4 RS-SINR Measurement 13 May be used to derive distance accuracy
5 RSSI Measurement 13 May be used to derive distance accuracy
6 RLF Reports 9 Provides information related to the last served eNodeBs and location. If we know the exact coordinates to the eNodeB location then we may derive history of UE movement
7 OTDOA based Positioning Measurement 10 Provides observed time difference of arrival information and may be useful in deriving UE location but LPP protocol is additionally needed to get this information.
8 Dedicated PRACH preambles for downlink data to get PRACH from UE 9 Provides absolute Timing Advance information which is further used to derive UE location.
9 UE release with redirection information to move UE to 2G or 3G network 9 Provides flexibility to use the other radio access technologies like 2G and 3G to get more information or for any other purpose.
10 Network Monitoring Mode (NMM) Provides details of surrounding LTE cells and their SIBs information. It helps in simulating IMSI catcher LTE cell.


To get the precise UE location and its movement details it is advisable to use the hybrid approach instead of just focusing on only one approach. So, it’s good to have a mix of above approaches and use as per the availability of these data points to get more precise and accurate location results. Some of these approaches are governed by the support of related features by UEs and therefore eNodeBs should take cognizance of the UE capability before requesting any information from the UE.

We can further include the other nodes to access more UE positioning methods as described above and mentioned in 3GPP specifications 36.305 and 36.214 (L1 layer measurements by UE & eNodeB). For that purpose we can integrate LMU and E-SMLC nodes to the EPC nodes itself with the intention of just getting the required information (without full implementation & functionality).

Amid all these available features and methods, it is very important that we get the UE location easily and precisely. The precise determination of the UE location is further complicated by the fact that the different UEs available in the market do not have consistent features. So, it is advisable that a proof of concept should be performed for all approaches before integrating them in the actual solution.

Aricent is already in the league of LTE specialists and has a proven base platform for eNodeB & EPC to help reduce time-to-market of the final solution. Aricent also has a base platform for UE identification which is ready for immediate use in any location based solution.


Leave a Reply

Your email address will not be published. Required fields are marked *