PaperlayerView exact revision on arXiv

Source-linked AI summary

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Aneet Kumar Dutta, Mihirraj Dixit, Kevin Gni, Wouter Lueks, Mridula Singh

arXiv:2609.09963v1cs.CR

TL;DR

Per-protocol identifier randomization leaves open whether passive tracking remains possible across independently rotating LTE, WiFi, and BLE identifiers. CrossLink links temporary identifiers across time, space, and protocols under noisy localization and mobility. In dense-urban simulations it reconstructs complete observed traces for about 83% of users, compared with about 22% for the best single-protocol baseline.

  • Problem

    Privacy analyses have largely studied each protocol in isolation, leaving open whether temporary identifiers prevent passive tracking when smartphones emit identifiers across independently rotating protocols.

    Source: §1 · p. 1

  • Method

    CrossLink uses uncertainty-aware spatiotemporal inference to link temporary identifiers across protocols, accounting for localization error and mobility.

    Source: §1 · pp. 1–2

  • Results

    83% of users’ complete observed traces are reconstructed in dense-urban simulations, compared with 22% for the best single-protocol baseline.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Identifier rotation protects privacy against a multi-protocol adversary only when ambiguity holds jointly across all monitored protocols.

    Source: §1 · p. 2

    The mobility model permits feasible but physically unrealizable paths, making reported leakage conservative.

    Source: Q1. How effectively can an adversary… · p. 13

Abstract

from arXiv · show

Smartphones simultaneously transmit temporary identifiers over LTE, WiFi, and BLE. Existing privacy defenses analyze identifier randomization per protocol, implicitly assuming that these protections compose across protocols. We show that they do not: Even when each protocol leaks only temporary identifiers and the adversary is fully passive, unsynchronized identifier rotations allow cross-protocol stitching of device traces. We present CrossLink, an uncertainty-aware tracing algorithm that links identifiers across time, space, and protocols under noisy localization and mobility. We evaluate CrossLink using controlled lab experiments with commodity devices and large-scale mobility simulation. Under large-scale mobility simulation, CrossLink reconstructs full traces for 83% of users, versus 22% for the best single-protocol baseline, showing that location privacy must be analyzed jointly across protocols. We further show that CrossLink remains effective under partial coverage: strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions retain sufficient cross-protocol evidence to bridge observation gaps, achieving substantially higher linkability than random deployments.

1 Introduction

The paper asks whether temporary-identifier rotation still limits passive tracking when smartphones emit identifiers across independently rotating protocols, and shows that unsynchronized rotations permit cross-protocol linking. CrossLink uses uncertainty-aware inference to reconstruct traces, while the paper models the joint mixing condition needed for rotation to prevent tracking.

1 Introduction

  • Prior privacy analyses largely treat protocols in isolation, although smartphones emit identifiers over LTE, WiFi, and BLE on independent schedules without coordinated rotation.The paper asks whether temporary identifiers alone still protect against a fully passive eavesdropper.Source: §1 · p. 1
  • Unsynchronized rotations let stable identifiers in one protocol bridge another protocol’s rotation, turning short unlinkable fragments into extended traces.The paper characterizes this as a structural consequence of per-protocol design, not an implementation flaw.Source: §1 · p. 1
  • CrossLink builds permissive intra- and inter-protocol candidate links from temporal overlap, coarse localization, and mobility constraints, then prunes inconsistent candidates using cross-protocol evidence.It reconstructs traces only when the remaining chains are unambiguous.Source: §1 · pp. 1–2
  • 83% of users’ complete observed traces are reconstructed by CrossLink in dense-urban simulations, versus 22% for the best single-protocol baseline.The evaluation also includes controlled commodity-device experiments and micro-deployments.Source: §1 · p. 2
  • Identifier rotation protects privacy only when devices remain jointly indistinguishable across monitored protocols during a common time window.The paper’s mixing condition requires both spatial indistinguishability and ambiguity about identifier changes on every monitored protocol.Source: §1 · p. 2
  • The paper evaluates sniffer-placement strategies and reports that even a few mobile sniffers can reconstruct long traces of the wider population.Its contributions also include lab experiments on real devices and large-scale simulations parameterized by BLE, WiFi, and LTE measurements.Source: §1 · p. 2

2 Background and Related Work

The background reviews temporary identifiers and prior tracking attacks in LTE, WiFi, and BLE. It contrasts those within-protocol methods with CrossLink’s use of independently rotating identifiers across protocols.

2 Background and Related Work

  • LTE uses temporary identifiers including TMSI and C-RNTI; C-RNTI changes during handovers, radio link failures, and connection re-establishment.Prior C-RNTI/TMSI linkage methods have limits including setup-phase scope, protected handover messages, or active attacks.Source: §2 · p. 2
  • WiFi and BLE randomize MAC addresses, but prior attacks have used fingerprints, implementation weaknesses, timing, or other protocol-specific signals to track devices.The cited prior attacks operate within individual protocols or exploit specific implementation features.Source: §2 · pp. 2–3
  • Localization is protocol-dependent: BLE and WiFi use physical-layer measurements such as RSSI, while LTE timing advance supports distance estimation.CrossLink must account for the resulting differences in measurement uncertainty.Source: §2 · pp. 2–3
  • CrossLink targets a composition gap: it links temporary identifiers across protocols without static information, fingerprints, protocol-specific flaws, or active interaction.The paper contrasts this with prior tracking techniques that operate within a single protocol.Source: §2 · p. 3

3 Threat Model & Attacker Goal

The threat model is a passive adversary that records wireless transmissions with geographically distributed fixed or mobile sniffers. The goal is to recover device location traces, not identify the people carrying the devices.

3 Threat Model & Attacker Goal

  • The adversary only eavesdrops and does not inject, relay, jam, or modify traffic or compromise devices or network infrastructure.Sniffers may monitor LTE, WiFi, BLE, or multiple protocols, and need not be co-located.Source: §3 · p. 3
  • Range observations use RSSI for WiFi and BLE and timing advance for LTE, modeled as disks around sniffers with radii determined by measurement error.The evaluation assumes range estimates; multilateration and angle-of-arrival techniques would tighten the constraints.Source: §3 · p. 3
  • The target is device location traces rather than attribution to individuals, which the paper treats as a separate task.Its privacy metric is the duration of the longest correctly reconstructed trace divided by the maximum duration the attacker observed that device.Source: §3 · p. 3

4 Motivation and Technical Challenges

Temporary identifiers are assumed to bound tracking, but independently rotating protocols can let passive adversaries link observations beyond any one identifier’s lifetime. The section illustrates the privacy stakes and explains why reliable linking requires reasoning through localization uncertainty, asynchronous transmissions, and mobility.

4 Motivation and Technical Challenges

  • A passive adversary can track devices beyond any single protocol’s rotation interval by exploiting unsynchronized temporary identifiers across LTE, WiFi, and BLE.The attack does not use IMSI catchers, protocol manipulation, or active interaction.Source: §4 · p. 3

4.1 Tracking Protesters: An Example Scenario.

  • At a protest, a stable identifier in one protocol can bridge another protocol’s rotation and connect attendance to later movement, including home or work locations.The passage notes that such locations may identify users and expose participants to legal scrutiny, retaliation, or harassment.Source: §4.1 · p. 3

4.2 Challenges in Cross-Protocol Linking

  • Reliable large-scale linking must address three challenges that simple co-occurrence checks cannot resolve.The challenges are localization uncertainty, asynchronous transmissions, and mobility.Source: §4.2 · p. 4
  • Overlapping localization uncertainty regions can make one BLE identifier plausibly match many nearby LTE devices.RSSI and timing-advance errors create uncertain regions that overlap in crowded areas.Source: §4.2 · p. 4
  • Independent transmission schedules make same-device identifiers rarely simultaneous across protocols, so timing alone cannot establish links.Devices also move between observations, expanding feasible regions and creating individually plausible but jointly inconsistent associations.Source: §4.2 · p. 4
  • CrossLink’s uncertainty modeling recovers more traces than ablated variants that omit it.The figure caption says the full method recovers longer traces, leading to higher privacy leakage.Source: §4.2 · p. 4, Figure 3 · p. 4

5 Protocols Characterization

The section characterizes identifier-bearing transmissions, localization signals, and rotation behavior across LTE, WiFi, and BLE. Its measurements and prior-work estimates show that observations are frequent but noisy, while rotations vary by protocol and rarely align.

5 Protocols Characterization

  • The characterization measures identifier-bearing transmission frequency, physical-layer localization signals, and identifier-rotation timing and conditions.An observation pairs a protocol-specific temporary identifier with a localization measurement; Table 2's localization-error values are baseline uncertainty ranges, not maximum-error bounds.Source: §5 · p. 4, Table 2 · p. 5

5.1 Measurement Setup

  • Measurements used five commodity smartphones in inactive and active modes, with approximately two hours of traffic collected per device and setting.LTE, WiFi, and BLE traffic were captured with protocol-specific testbed and sniffer equipment.Source: §5.1 · p. 4

5.2 Key Findings

  • LTE Timing Advance provides coarse range information, but its availability and update frequency depend on network configuration and implementation.Reported typical update intervals range from 500 ms to 10 s.Source: §5.2 · p. 4
  • Prior-work localization errors vary by protocol and setting, from BLE ranging RMSE of 1.20 m to urban WiFi mean errors up to 4.21 m.The cited urban WiFi study reports only 66–73% of estimates within 4 m and discards 17–21% of observations for poor signal quality.Source: §5.2 · p. 5
  • LTE C-RNTI traffic appears frequently (<30 s), while BLE transmissions occur at intervals below 35 s in both inactive and active modes.WiFi devices that remain associated transmit control, ACK, and QoS packets roughly every 1–20 s; disconnected probe requests arrive in vendor-dependent bursts from under 1 minute to 5 minutes.Source: §5.2 · p. 5
  • Identifier rotations rarely align: WiFi MAC stability depends on association state, while measured BLE randomization intervals are roughly 7–20 minutes.LTE-only passive tracking is unreliable across inter-eNodeB handovers, estimated from pedestrian logs to occur every ∼7 min on average.Source: §5.2 · p. 5

6 Recovering Location Traces

CrossLink builds permissive same- and cross-protocol identifier links from noisy observations, iteratively refines them using cross-protocol consistency, and reconstructs traces from unambiguous chains.

6 Recovering Location Traces

  • CrossLink has three phases: candidate-link construction, iterative cross-refinement, and trace reconstruction from unambiguous links and unique chains.The overview describes candidate links as permissive and based on noisy observations and mobility constraints.Source: §6 · p. 5, Figure 4 · p. 6

6.1 Linking Device Identifiers

  • CrossLink models noisy distance estimates with protocol-specific error tolerance and bounds feasible movement using an assumed upper bound on device speed.A tolerance below actual measurement error can discard true links; a larger tolerance admits more false positives for later refinement.Source: §6.1 · p. 6
  • Inter-protocol candidates must satisfy mobility and localization constraints across observations and have overlapping identifier lifetimes; intra-protocol candidates must also appear soon after the prior identifier disappears.Candidate links are intentionally permissive to minimize false negatives, so the initial maps can contain false positives.Source: §6.1 · pp. 6–7

6.2 Refining Links

  • CrossLink prunes a same-protocol successor when its inter-protocol candidate set has no overlap with the predecessor’s, then propagates resolved singleton links to competing predecessor sets.When only one successor remains, the link is treated as resolved and removed from other predecessor sets.Source: §6.2 · pp. 7–8
  • Inter-protocol candidates are retained when supported across identifier rotation, expanded backward when the other protocol rotates, and checked for bidirectional consistency.Refinement repeats across intra- and inter-protocol maps until no further changes are possible.Source: §6.2 · pp. 7–8

6.3 Reconstructing Traces

  • Trace reconstruction uses singleton same-protocol mappings and requires inter-protocol identifiers to lie on a unique intra-mapping chain.The longest trackable trace is defined by the longest graph path, measured from the first identifier’s first observation to the final identifier’s last observation.Source: §6.3 · p. 8

7 When Does Randomization Prevent Tracking?

The section characterizes when identifier randomization can prevent passive tracking, using mixing to describe uncertainty about matching devices before and after rotation. Across protocols, perfect mixing requires all monitored protocols to mix within the same time window, so a slowly mixing protocol can bottleneck protection.

7 When Does Randomization Prevent Tracking?

  • A mix zone is a window in which two devices remain location-indistinguishable, preventing deterministic matching of their post-rotation identifiers.The section uses this definition to characterize the strongest protection randomization can provide against a passive multi-protocol adversary.Source: §7 · p. 8
  • Within one protocol, perfect mixing requires both devices to rotate and transmission ordering that prevents observing the other device’s old identifier before its new one appears.This ordering prevents deterministic linkage when one new identifier appears while the other device’s old identifier remains visible.Source: §7 · pp. 8–9
  • Across protocols, perfect mixing requires every monitored protocol to mix within the same duration, and its probability shrinks multiplicatively as more protocols are monitored.A slowly mixing protocol dominates the overall probability; the analysis assumes location-indistinguishable devices and independent protocol processes.Source: §7 · pp. 8–9

8 Real-Device Validation

Controlled experiments with commodity smartphones test whether CrossLink can connect identifiers across protocols. Cross-protocol observations improve mapping accuracy, while the experiments find that linkage fails only when both protocols satisfy the mixing condition simultaneously.

8 Real-Device Validation

  • The validation tests CrossLink on real devices for cross-protocol identifier linkage and its failure boundary under perfect mixing.The experiments use controlled devices and micro-deployments.Source: §8 · p. 9

8.1 Experimental Setup

  • The experiment uses 12 commodity smartphones in a controlled mix zone, restricting observations to LTE and BLE because WiFi MAC rotation approaches its transmission rate.Devices remain location-indistinguishable for 40 minutes; the adversary receives entry and exit identifier pairings as anchors, and separate ground truth assesses recovered links.Source: §8.1 · p. 9

8.2 Results

  • Cross-protocol evidence raises BLE accuracy from 61.9% to 71.4% and LTE accuracy from 25.0% to 75.0% in the 12-device experiment.BLE singleton chains help resolve ambiguous LTE handovers, while stable LTE identifiers can bridge ambiguous BLE rotations.Source: §8.2 · p. 9
  • In a four-device test with simultaneous LTE handovers, BLE singleton chains resolve LTE ambiguity, and CrossLink fails to recover a unique chain only when both protocols mix simultaneously.The observed boundary case is consistent with Theorem 2.Source: §8.2 · p. 9

9 Large-Scale Evaluation

The large-scale evaluation simulates passive tracking in a dense urban environment using measured device parameters. It examines different sniffer deployments, localization-error models, and per-user privacy leakage under full and partial coverage.

9 Large-Scale Evaluation

  • The simulation models passive surveillance across a 3.87 km^2 urban region for two hours, with pedestrian mobility and BLE, WiFi, and LTE transmissions and identifier rotations parameterized by device measurements.Pedestrian mobility uses SuMO with the Monaco scenario configuration.Source: §9 · p. 9, §9.1 · p. 10

9.1 Simulation Setup

  • Four deployment strategies vary sniffer placement: random locations, eNodeB overlap regions, full coverage of a contiguous subregion, or a small number of mobile sniffers.The overlap-region strategy targets handover areas where deterministic C-RNTI linking is not possible without observations.Source: §9.1 · p. 10

9.2 Evaluation

  • Privacy leakage is measured per user and normalized by total time in the simulation; under partial coverage, time outside sniffer range remains in the denominator unless observations are linked across the gap.Figures 6 and 8–13 plot users ranked by leakage, with larger area under the curve indicating greater privacy loss; Figure 6 covers 512 users under full coverage.Source: §9.1 · p. 10, §9.2 · p. 11, Figure 6 · p. 11

9.1 Simulation Setup

  • The evaluation uses bounded and heavy-tailed localization-error models, with protocol-specific matching tolerances of 1.5 m for BLE, 5 m for WiFi, and 10 m for LTE in the bounded baseline.The heavy-tailed model uses distance-scaled log-normal errors with protocol-specific parameters.Source: §9.1 · p. 10
  • Transmission intervals and identifier rotations are modeled from device measurements, including periodic BLE lifetimes and either time-based or handover-triggered LTE rotations.WiFi is modeled as an inactive, disconnected device sending one probe per minute with a fresh MAC.Source: Table 4 · p. 10, §9.1 · p. 11

Q1. How effectively can an adversary conduct physical tracking of users through cross-linking?

Cross-protocol observations substantially increase trace reconstruction, while deployment strategy and localization, mobility, and protocol conditions shape the remaining linkability. Limited-coverage deployments can still support prolonged tracking, and synchronization-based defenses face trade-offs.

Q1. How effectively can an adversary conduct physical tracking of users through cross-linking?

  • 83.39% of users had LPD = 1 with LTE–BLE–WiFi, versus 21.87% for BLE and 4.1% for LTE; WiFi alone fully reconstructed no users.LTE–BLE alone reconstructed 82.61% of users (LPD = 1), nearly matching LTE–BLE–WiFi.Source: Q1. How effectively can an adversary… · p. 11
  • Under the same 198-sniffer budget, SPOT outperformed RAND by placing sniffers in eNodeB overlap regions where LTE identifiers are more likely to rotate.PATCH concentrated sniffers in a contiguous subregion; MOB used 30 mobile sniffers and outperformed random static deployments.Source: Figure 8 · p. 11, Q1. How effectively can an adversary… · p. 12
  • With heavy-tailed localization error, increasing tolerance yielded full traces for 60.93% of users and LPD ≥0.9 for 73.04%, versus 0.90% and 1.10% at matching tolerances.The comparison is for the full-coverage, 512-user setting; greater uncertainty still reduces leakage relative to bounded error.Source: Q1. How effectively can an adversary… · p. 12, Table 5 · p. 12
  • Privacy leakage decreases as transmission intervals increase and identifier randomization becomes more frequent; the baseline uses conservative inactive-device behavior.The authors note that more frequent transmissions in real deployments may produce higher leakage under comparable randomization.Source: Q1. How effectively can an adversary… · pp. 12–13, Figure 10 · p. 12
  • Privacy leakage decreases as users move faster and as user density rises; with less interaction in synthetic trajectories, tracking improves.The authors attribute the density pattern to mixing opportunities and report reduced mix-zone duration in the synthetic setting.Source: Q1. How effectively can an adversary… · p. 13, Figure 11 · p. 13
  • 75 of 113 protest-site devices (66%) remained trackable for at least one hour with PATCH, compared with 64 (57%) with MOB and 25 (22%) with RAND.Median tracking durations were 70, 65, and 44 minutes, respectively.Source: Q1. How effectively can an adversary… · p. 13, Figure 12 · p. 13
  • In the Monaco setting, RAND and SPOT each used 198 sniffers per protocol at about $40k total hardware cost, while full coverage cost about $72.3k.The full-coverage deployment required 1,778 BLE, 670 WiFi, and 185 LTE sniffers.Source: Q1. How effectively can an adversary… · p. 14
  • Reducing local synchronization from 10-minute to 3-minute periods lowered fully trackable users from 254 to 54, while perfect mixing approached single-protocol identifier-lifetime baselines.Perfect mixing requires costly coordination across devices; synchronization alone remains difficult as a robust privacy defense.Source: Figure 13 · p. 13, Q1. How effectively can an adversary… · p. 14

10 Conclusion

CrossLink demonstrates that independently rotating temporary identifiers can enable passive cross-protocol trace reconstruction, including with limited mobile sniffers. The paper reports controlled data collection, describes its artifacts and AI assistance, and analyzes conditions affecting mixing.

10 Conclusion

  • CrossLink reconstructs long mobility traces by exploiting unsynchronized identifier rotations, and limited-budget mobile sniffers can gather observations about the wider population.The conclusion frames the resulting privacy loss as a consequence of independently standardized protocols, not a patchable flaw in one implementation.Source: §10 · p. 14

A Ethical Considerations

  • Real-world experiments were conducted in controlled labs, using lab measurements and logs from the authors’ own devices rather than tracking arbitrary people.The authors state that they did not recover real people’s movement patterns.Source: A Ethical Considerations · p. 15
  • The authors identify potential misuse for tracking and report that no single entity can receive disclosure because the attack spans multiple protocols.They report findings to standards bodies and mobile OS vendors and recommend synchronizing identifiers within a device.Source: A Ethical Considerations · p. 15

B Open Science

  • The open-science artifacts include commodity-device captures, CrossLink code, movement and transmission datasets, and code for passive observations and evaluation.The artifact is identified by DOI 10.5281/zenodo.22499946.Source: B Open Science · p. 15

C Generative AI Usage

  • Claude and Grammarly assisted with manuscript editing and paraphrasing, but the authors state that AI tools were not used to generate data, implement evaluation, compute results, or formulate technical claims..Source: C Generative AI Usage · p. 16

D.1 Analysis of Theoretical Results

  • The theoretical analysis says mixing becomes less likely as the time window, transmission rate, or randomization rate decreases; for the example practical values, p_mix ≤ 0.0034.With multiple protocols, successful mixing requires all protocol identifiers to mix, making an already rare event rarer.Source: §D.1 · p. 16

D.2 Proof of Theorem 2

The proof models independent identifier randomization and transmission events to characterize when two devices achieve perfect mixing within a mix-zone. It derives bounds on mixing over a duration T from the probability of mixing at each opportunity.

D.2 Proof of Theorem 2

  • The proof models randomization and transmission intervals as independent exponential distributions, with randomization times R1 and R2 and transmission times T1 and T2.It treats each device’s randomization events as independent and defines T1 and T2 using exponential transmission intervals.Source: §D.2 · p. 16
  • Perfect mixing requires both devices to randomize within mix-zone duration T and a transmission order that avoids exposing the second device’s original identifier between rotations.The valid cases depend on the ordering of randomization and transmission events; the case T1 > R2 and T2 < R2 is impossible because T2 ≥ T1.Source: §D.2 · p. 16
  • The probability of perfect mixing at one opportunity is bounded by an expression whose second term becomes negligible as T increases.The passage attributes this to a factor λ_r^2 e^-BT, which decreases exponentially with T.Source: §D.2 · p. 17
  • The number of mixing opportunities in duration T is modeled as Poisson with rate 2λ_r, yielding an upper bound on the probability of mixing over T.The proof first bounds the probability of no mixing across opportunities, then derives the bound on mixing probability.Source: §D.2 · p. 17

E Derivation of the Error Expressions

This appendix derives distance-error statistics, points readers to notation and acronym tables, and documents real-device packet captures and transmission and randomization interval distributions.

E Derivation of the Error Expressions

  • The distance-error derivations obtain standard deviation, mean absolute error, and absolute-error quantiles from standard-normal moment identities.The appendix also gives model parameters for BLE, WiFi, and LTE distance errors.Source: E Derivation of the Error Expressions · p. 17

F Glossary

  • Tables 7 and 8 collect the notation used in the algorithm and analysis and the acronyms used throughout the paper.The passage identifies the tables’ contents but does not enumerate their entries.Source: F Glossary · p. 18, Table 7 · p. 18, Table 8 · p. 18

G Real Device Packet Captures

H Real Device Measurement

Loading 2609.09963v1…