On the Privacy of LEO Two-Way-Ranging

Authors: Daniele Coppola, Harshad Sathaye, Giovanni Camurati and Srdjan Capkun

Low Earth Orbit (LEO) satellite-based positioning, navigation, and timing (LEO-PNT) is being investigated as an alternative to traditional broadcast-based satellite navigation systems. LEO satellites make bidirectional communication possible, and organizations like ESA, GMV, and Thales have considered Two Way Ranging (TWR) as an alternative to classical broadcast PNT systems. Previous work has shown that TWR poses a threat to the location privacy of its users and proposes countermeasures. In this work, we analyze this problem in the context of LEO-PNT. First, we quantify the location leakage in LEO-PNT. Second, we identify that due to the relative motion between high-speed satellites and users, mitigations proposed in the context of distance bounding cannot be directly used - they introduce inaccuracies with an average of 36.7 m m in the computed position. Third, we propose a new TWR system which combines previously proposed countermeasures with Intertial Measurement Unit (IMU) sensing such that it provides privacy protection and eliminates ranging inaccuracies. We study the performance of our system in simulation and show that short-term error introduced by privacy-protection measures can be very well mitigated with the short-term stability of IMU output.