Eavesdropping through mobile phone

(1)

3596 IEEE TRANSACTIONS ON VEHICULAR TECHNOLOGY, VOL. 56, NO. 6, NOVEMBER 2007

may effectively use power for better channels. However, such a scheme experiences a time delay when the channel gain is low, which is not appropriate for real-time (constant rate) transmission. We also note that when Smax/ST= 3 dB, the combined scheme does not satisfy the average power constraint (24), indicating that the combined MRT and truncated channel inversion cannot be employed for transmitters with very low peak-power limit.

In 3G wireless systems [1], the TAD is mostly adopted at the base station (BS), because it is cost effective and practical to employ multiple transmit antennas at the BS rather than at the mobile station (MS). The power amplifier employed at the BS can have a relatively higher peak-to-average power ratio than that at the MS. Therefore, the TAD in the downlink cannot be affected by the peak transmit power limit on the most practical range of system parameters. However, the implementation of multiple antennas at the MS is in considerable demand for high-performance next-generation wireless communica-tions [23], [24]. The transmission parameters of an uplink TAD require careful design consideration due to substantial limitation of the peak-to-average power ratio at the MS.

REFERENCES

[1] R. T. Derryberry, S. D. Gray, D. M. Ionescu, G. Mandyam, and B. Raghothaman, “Transmit diversity in 3G CDMA systems,” IEEE Commun. Mag., vol. 40, no. 4, pp. 68–75, Apr. 2002.

[2] T. Lo, “Maximum ratio transmission,” IEEE Trans. Commun., vol. 47, no. 10, pp. 1458–1461, Oct. 1999.

[3] J. K. Cavers, “Single-user and multiuser adaptive maximal ratio transmis-sion for Rayleigh channels,” IEEE Trans. Veh. Technol., vol. 49, no. 6, pp. 2043–2050, Nov. 2000.

[4] J. Choi, “Performance analysis for transmit antenna diversity with/ without channel information,” IEEE Trans. Veh. Technol., vol. 51, no. 1, pp. 101–113, Jan. 2002.

[5] A. F. Naguib, A. Paulraj, and T. Kailath, “Capacity improvement with base station antenna arrays in cellular CDMA,” IEEE Trans. Veh. Technol., vol. 43, no. 3, pp. 691–698, Aug. 1994.

[6] F. Rashid-Farrokhi, L. Tassiulas, and K. Liu, “Joint optimal power con-trol and beamforming in wireless networks using antenna arrays,” IEEE Trans. Commun., vol. 46, no. 10, pp. 1313–1324, Oct. 1998.

[7] F. Rashid-Farrokhi, K. Liu, and L. Tassiulas, “Transmit beamforming and power control for cellular wireless systems,” IEEE J. Sel. Areas Commun., vol. 16, no. 8, pp. 1437–1450, Oct. 1998.

[8] M. Schubert and H. Boche, “An efficient algorithm for optimum joint downlink beamforming and power control,” in Proc. IEEE VTC—Spring, May 2002, pp. 1911–1915.

[9] M. Schubert, D. Karadoulamas, H. Boche, and G. Lehmann, “Joint down-link beamforming and power control for 3G CDMA,” in Proc. IEEE VTC—Spring, Apr. 2003, pp. 331–335.

[10] A. J. Goldsmith and P. P. Varaiya, “Capacity of fading channels with channel side information,” IEEE Trans. Inf. Theory, vol. 43, no. 6, pp. 1986–1992, Nov. 1997.

[11] A. J. Goldsmith and S. G. Chua, “Variable-rate variable-power MQAM for fading channels,” IEEE Trans. Commun., vol. 45, no. 10, pp. 1218–1230, Oct. 1997.

[12] R. Knopp and G. Caire, “Power control and beamforming for systems with multiple transmit and receive antennas,” IEEE Trans. Wireless Commun., vol. 1, no. 4, pp. 638–648, Oct. 2002.

[13] S. T. Chung and A. J. Goldsmith, “Degrees of freedom in adaptive modulation: A unified view,” IEEE Trans. Commun., vol. 49, no. 9, pp. 1561–1571, Sep. 2001.

[14] E. N. Onggosanusi, A. Gatherer, A. Dabak, and S. Hosur, “Performance analysis of closed-loop transmit diversity in the presence of feedback delay,” IEEE Trans. Commun., vol. 49, no. 9, pp. 1618–1630, Sep. 2001. [15] M. Schwartz, W. R. Bennett, and S. Stein, Communication Systems and

Techniques. New York: McGraw-Hill, 1966.

[16] J. G. Proakis, Digital Communications, 3rd ed. New York: McGraw-Hill, 1995.

[17] G. S. G. Beveridge and R. S. Schechter, Optimization: Theory and Prac-tice. New York: McGraw-Hill, 1970.

[18] Y. H. Lee, “Power and rate adaptation in CDMA communications,” Ph.D. dissertation, Inf. Transmiss. Lab, Korea Adv. Inst. Sci. Technol. (KAIST), Daejeon, Korea, Feb. 2000.

[19] R. M. Corless, G. H. Gonnet, D. E. G. Hare, D. J. Jeffrey, and D. E. Knuth, “On the Lambert W function,” Adv. Comput. Math., vol. 5, no. 4, pp. 329– 359, 1996.

[20] A. Heck, Introduction to Maple. New York: Springer-Verlag, 1993. [21] D. A. Barry, P. J. Cullingan-Hensley, and S. J. Barry, “Real values of the

W-function,” ACM Trans. Math. Softw., vol. 21, no. 2, pp. 161–171, 1995. [22] D. A. Barry, J.-Y. Parlange, L. Li, H. Prommer, C. J. Cunningham, and F. Stagnitti, “Analytical approximations for real values of the Lambert W-function,” Math. Comput. Simul., vol. 53, no. 1/2, pp. 95–103, Aug. 2000.

[23] Y. Kim et al., “Beyond 3G: Vision, requirements, and enabling technolo-gies,” IEEE Commun. Mag., vol. 41, no. 3, pp. 120–124, Mar. 2003. [24] H. Sampath, S. Talwar, J. Tellado, V. Erceg, and A. Paulraj, “A

fourth-generation MIMO-OFDM broadband wireless system: Design, perfor-mance, and field trial results,” IEEE Commun. Mag., vol. 40, no. 9, pp. 143–149, Sep. 2002.

Eavesdropping Through Mobile Phone Yi-Bing Lin, Fellow, IEEE, and Meng-Hsun Tsai, Student Member, IEEE

Abstract—Mobile telecommunication services have become very

popu-lar recently, and many people bring mobile phones with them wherever they go. However, we observe that mobile phones can be modified to become remote microphones for eavesdropping. The eavesdropping tech-nique only requires modifications to the mobile phone to be spied on and does not require any network changes. This paper describes mobile-phone eavesdropping and analyzes how serious it can be. Based on our study, we provide suggestions to avoid being eavesdropped upon.

Index Terms—Eavesdropping, session initiation protocol (SIP), signaling system number 7 (SS7), voice over IP (VoIP).

I. INTRODUCTION

Mary was curious about John’s everyday life. She decided to eavesdrop on John through his mobile phone. She purchased a pair of “spy” mobile phones: a spying phone and a spied-on phone. She gave the spied-on phone to John as a birthday gift. When she wanted to eavesdrop on John, she used the spying phone to dial the number of the spied-on phone. Thus, the spied-on phone of John became a remote microphone through which Mary could hear all sounds around John when he was not using the spied-on phone for conversation. Based on the technique, we will describe later that John (the victim) is typically Manuscript received April 17, 2006; revised July 10, 2006, November 3, 2006, and February 20, 2007. The work of Y.-B. Lin was supported in part by NSC Excellence Project Grants NSC 95-2752-E-009-005-PAE, NSC 95-2218-E-009-201-MY3, NSC 94-2219-E-009-001, and NSC 94-2219-E-009-024, by the NTP SIP-based B3G Project under Grant NSC 95-2219-E-009-010, by the NTP IMS Integration Project under Grant NSC 95-2219-E-009-019, by Intel, by Chung Hwa Telecom, by IIS/Academia Sinica, by the ITRI/NCTU Joint Research Center, and by MoE ATU. The work of M.-H. Tsai was supported by a Microsoft Fellowship and by a ZyXEL Fellowship. The review of this paper was coordinated by Dr. Q. Zhang.

Y.-B. Lin is with the Department of Computer Science, National Chiao Tung University, Hsinchu 300, Taiwan, R.O.C., and also with the Institute of Information Science, Academia Sinica, Nankang, Taipei 115, Taiwan, R.O.C. (e-mail: liny@csie.nctu.edu.tw).

M.-H. Tsai is with the Department of Computer Science, National Chiao Tung University, Hsinchu 300, Taiwan, R.O.C. (e-mail: tsaimh@csie.nctu. edu.tw).

(2)

Fig. 1. Mobile call termination message flow.

not spied on (overheard) when he is using the spied-on phone for conversation.

Mobile telecommunication services have become very popular re-cently, and many people bring mobile phones with them wherever they go. However, we observe that mobile phones can be modified to become remote microphones for eavesdropping as we just showed in the aforementioned scenario. This paper describes mobile-phone eavesdropping [1] and analyzes how serious it can be.

II. MOBILE-PHONEEAVESDROPPING

Fig. 1 shows the simplified setup for mobile call termination [2] with the following steps.

1.1) The calling party dials the phone number of the called party. The signaling system number 7 (SS7) Initial Address Message (IAM) is sent from the originating switch to the terminating mobile switching center (MSC) of the called party. The terminating base station system (BSS) pages the called party.

1.2) If the called party is in the radio’s coverage, it sends the page response signal to the terminating BSS. The terminating MSC then returns the SS7 Address Complete Message (ACM) to the originating switch.

1.3) If the spied-on phone is not busy, a ringing signal is sent to the called party, and a ringback signal is sent to the calling party. Both the calling and called phones are ringing.

1.4) When the called party picks up the handset, an answer signal is sent to the terminating MSC. The terminating MSC sends the SS7 Answer Message (ANM) to the originating switch. The ringing and the ringback tones are removed, and the conversation starts.

To eavesdrop through a mobile phone, the software of the spied-on phspied-one is modified to accommodate the eavesdropping procedure shown in Fig. 2.

2.1) The eavesdropper dials the phone number of the spied-on phone. The IAM message is sent from the originating switch to the terminating MSC of the spied-on phone. The terminat-ing BSS pages the called party.

2.2) If the called party is in the radio’s coverage, it sends the page response signal to the terminating BSS. The terminating MSC returns the ACM message to the originating switch.

2.3) If the spied-on phone is not busy, a ringing signal is sent to the spied-on phone, and a ringback signal is sent to the spying phone.

2.4) The spied-on phone obtains the caller ID from the ringing sig-nal. It checks if the caller ID is the phone number of the spying phone. If not, the normal call setup procedure is performed [step 1.4) in Fig. 1]. If the caller ID matches, the spied-on phone disables the ringing tone and turns off the speaker such that the victim is not alerted.

2.5) Without having the victim to pick up the handset, the spied-on phspied-one automatically turns spied-on the transmitter (microphspied-one) and sends an answer signal to the terminating MSC. The terminating MSC considers that the called party (the victim) has picked up the phone, and it sends the ANM message to the originating switch. The ringing tone is removed.

2.6) At this point, the call is connected, and the eavesdropper can hear all sounds from the spied-on phone. Since the speaker of the spied-on phone is disabled, any noise generated by the eavesdropper will not be detected by the victim.

In this scenario, the originating switch and the terminating MSC exercise the standard SS7 call setup procedure [i.e., steps 2.1), 2.2), 2.3), and 2.5) are exactly the same as steps 1.1), 1.2), 1.3), and 1.4)] and do not detect the eavesdropping activity. If the calling party is not the eavesdropper, the call is set up as a normal call [as described in step 1.4)]. Therefore, the victim can receive calls from other normal calling parties. When an incoming call arrives during an eavesdropping session, the eavesdropping session is immediately terminated, and the newly arrived call is connected. Therefore, the victim will not lose any normal calls.

Note that the victim will detect abnormal call records if the billing method is called-party-pay (e.g., if the spied-on phone is a cellular phone in the U.S.). If the billing method is calling-party-pay (e.g., if the on phone is a fixed-line phone or if the spied-on phspied-one is a cellular phspied-one in Taiwan, R.O.C.), the eavesdropped calls will not be shown up on the telephone bill. Based on the aforementioned discussion, the eavesdropping scenario works as follows.

1) The eavesdropper purchases the spied-on mobile phone. The phone is initially set up with the eavesdropper’s phone number as the caller ID that will trigger the eavesdropping procedure shown in Fig. 2.

(3)

Fig. 2. Mobile-phone eavesdropping.

Fig. 3. VoIP eavesdropping.

2) The eavesdropper gives this mobile phone to the victim (e.g., as a birthday gift). In the countries exercising called-party-pay, the eavesdropper should also cover the billing of this spied-on phone so that the telephone bill will not go to the victim.

III. VOICEOVERIP (VoIP) EAVESDROPPING

In advanced mobile networks (3G or 4G systems), voice services may be provided through packet-switched domain, i.e., through VoIP [1]. In mobile all-IP network, such as IP Multimedia Core Network Subsystem (IMS), VoIP is provisioned through session initiation pro-tocol (SIP). Fig. 3 shows the call flow for the SIP-based VoIP call eavesdropping, and the steps are described as follows.

3.1) The SIP INVITE message is sent from the spying user agent (UA) to the spied-on UA. The spying UA and the spied-on UA may be directly or indirectly connected through the IMS VoIP network.

3.2) From the caller ID, the spied-on UA detects the eavesdropping event.

Fig. 4. Timing diagram for eavesdropping behavior.

3.3) Without alerting the victim, the spied-on UA automatically disables the ringing tone, turns off the speaker, turns on the transmitter (microphone), and returns the SIP 180 Ringing and the SIP 200 OK messages to the spying UA.

3.4) The spying UA sends the SIP ACK message to the spied-on UA, and the connection is then established for eavesdropping. Like circuit-switched mobile-phone eavesdropping, the VoIP signal-ing messages that are exchanged between the spysignal-ing and the spied-on UAs follow the standard SIP call setup procedure, and intermediate nodes (of the IMS VoIP network) in the call path do not detect the eavesdropping activity.

IV. ANALYSIS OFEAVESDROPPINGBEHAVIOR

This section proposes an analytic model to investigate eavesdrop-ping behavior. We first derive the probability of successful eaves-dropping in Section IV-A and then derive the expected potential eavesdropping period in Section IV-B.

A. Probability of Successful Eavesdropping

Fig. 4 shows the timing diagram for the normal telephone usage and eavesdropping activities. Let ts= t3− t1be the call holding time and tc= t5− t3 be the interval between the call completion and the next call arrival. It is clear that tcis the period that can be spied on. Suppose that the eavesdropper attempts to eavesdrop at times t2and t4, respectively. Since the spied-on phone is busy at t2and idle at t4, the

(4)

attempt at t2fails, and the attempt at t4succeeds. The call activities of the spied-on phone can be modeled by an alternating renewal process where the sequence of random variables ts and tc is independently and identically distributed. Let α be the probability of successful eavesdropping. Since the eavesdropping attempt is a random observer, from [3, Th. 3.4.4], we have

α = E[tc] E[ts] + E[tc]

.

Probability α is affected only by the expected length of tsand tc. When an eavesdropping attempt fails, the eavesdropper may retry after some random time te. Let β be the probability of successful next eavesdropping; then

β = Pr[te> τs]

where τs is the excess life of ts. Consider the call holding time random variable tswith the mean 1/µ, the density function f (·), and the Laplace transform f∗(s). The excess life τs has the distribution function R(·), the density function r(·), and the Laplace transform r∗(s). Since the eavesdropping attempt is a random observer, from the excess life theorem [4], we have

r∗(s) =

_µ

s

[1− f∗(s)] . (1)

Suppose that tehas an exponential distribution with mean 1/γ. Based on (1), we derive β as β = Pr[te> τe] = ∞ te=0 te τs=0 r(τs)γe−γtedτsdte = γr ∗_(s) s s=γ = µ γ [1− f∗(γ)] . (2)

Assume that ts has a Gamma distribution with the mean 1/µ, the variance Vs, and the Laplace transform

f∗(s) = 1 Vsµs + 1 1 Vsµ2 . Then, (2) is rewritten as β = µ γ 1− 1 Vsµγ + 1 1 Vsµ2 .

The Gamma distribution is selected because it has been shown that the distribution of any positive random variable can be approximated by a mixture of Gamma distributions (see [5, Lemma 3.9]). Following the past experience [6]–[8], we can measure the call holding times from the field and then generate the Gamma distribution from the measured data. Fig. 5 plots β for the Gamma call holding time with different variance values. The figure indicates that β decreases as Vs increases. This phenomenon is explained as follows. When the call holding times become more irregular, more longer and shorter call holding times are observed. Since the failed eavesdropping attempts

Fig. 5. Effects of the variance of the call holding time on β.

Fig. 6. Effects of the variance of tcon E[τc].

more likely fall on longer call holding times, more longer τsperiods are observed (this is called the inspection paradox). These longer τs pe-riods make it more difficult to retry. Therefore, the next eavesdropping attempt more likely fails when the call holding times become more irregular.

B. Expected Potential Eavesdropping Period

The potential eavesdropping period τc= t5− t4 in Fig. 4 is the excess life of tc. Since the eavesdropping attempt is a random ob-server, the expected potential eavesdropping period E[τc] can be expressed as [4] E[τc] = E[t2 c] 2E[tc] . (3)

Suppose that tc has an arbitrary distribution with the mean 1/λ and the variance Vc. Since E[tc] = 1/λ and Vc= E[t2c]− E[tc]2, (3) is rewritten as E[τc] = 1 2λ+ λVc 2 .

The E[τc] curves are shown in Fig. 6. The figure indicates that E[τc] is an increasing function of Vc. As Vc increases, more longer and shorter tc periods are observed. Since the successful eavesdropping attempts more likely fall on longer tcperiods, more longer τcperiods

(5)

are observed. Therefore, the expected potential eavesdropping period increases as Vcincreases.

V. CONCLUSION

Mobile telecommunication services have become very popular re-cently. We observe that mobile phones can be modified to become remote microphones for eavesdropping.

For the eavesdropping techniques described in this paper, only the spied-on phone is modified. The network is left unchanged. On the Internet, the SIP UA is usually implemented as a computer program, which can be easily distributed through free software download. On the other hand, all cellular/public switched telephone network (PSTN) phones for eavesdropping are “hard phones” with a built-in software that cannot be easily obtained through, for example, free software download. Therefore, installing spied-on cellular/PSTN phones is not as easy as installing VoIP “spyware.”

Since people bring mobile phones with them, the eavesdropping events can be triggered any place the victim goes. Therefore, the eavesdropping targets a specific person. On the other hand, the PSTN/VoIP phones are fixed at their locations, and eavesdropping targets the surrounding areas where the “fixed” spied-on phones are located.

To avoid eavesdropping, it is always safer for the cellular/PSTN users to purchase their own handsets and investigate/pay their own telephone bills. A VoIP user should read the license carefully before downloading the VoIP software and turn off the microphone after each phone conversation (and also ensures that the camera and the microphone programs of the computer are not illegally turned on remotely).

REFERENCES

[1] Y.-B. Lin and A.-C. Pang, Wireless and Mobile All-IP Networks. Hoboken, NJ: Wiley, 2005.

[2] Y.-B. Lin and I. Chlamtac, Wireless and Mobile Network Architectures. Hoboken, NJ: Wiley, 2001.

[3] S. M. Ross, Stochastic Processes, 2nd ed. New York: Wiley, 1996. [4] Y.-B. Lin, “Performance modeling for mobile telephone networks,” IEEE

Netw., vol. 11, no. 6, pp. 63–68, Nov./Dec. 1997.

[5] F. P. Kelly, Reversibility and Stochastic Networks. Hoboken, NJ: Wiley, 1979.

[6] FarEasTone Telecom, private communication, 2003.

[7] I. Chlamtac, Y. Fang, and H. Zeng, “Call blocking analysis for PCS networks under general cell residence time,” in Proc. IEEE WCNC, New Orleans, LA, Sep. 1999, pp. 550–554.

[8] H. Zeng and I. Chlamtac, “Handoff traffic distribution in cellu-lar networks,” in Proc. IEEE WCNC, New Orleans, LA, Sep. 1999, pp. 413–417.

Suboptimal Search Algorithm in Conjunction With Polynomial-Expanded Linear Multiuser Detector

for FDD WCDMA Mobile Uplink Mahdi Mozaffaripour and Rahim Tafazolli

Abstract—A suboptimum search algorithm that considers the users’

power profile in conjunction with a primary stage of polynomial-expanded (PE) linear multiuser detector for mobile uplink is proposed to suppress interference level. The initial stage is improved by mathematical analysis using two new ideas based on the Rayleigh–Ritz and Gershgorin theorems for both synchronous and asynchronous users. The performance of the PE structure is further enhanced by a new suboptimum search algorithm as the second stage. The structure of the search algorithm is based on starting from a point close to the optimum search and performing sequential steps to modify it. The proposed structures of the PE method and the suboptimum search algorithm are well suited together and make them collaboratively work without encountering a high level of complexity, since they use similar information as the correlation matrix. The power profile of the users is also considered in the suboptimum search algorithm, which led to more than a 50% reduction of the complexity, while keeping the performance almost the same. The performance of the final structure is carried out by means of computer simulations, and it has been compared to a partial parallel interference cancellation method with optimized partial coefficients. One of the main features of the structure proposed in this paper is that it performs its operations on the canonical formulation of the system, which makes it highly suitable for a broad range of systems such as multicarrier code division multiple access and multiinput multioutput.

Index Terms—Direct-sequence code division multiple access (DS-CDMA), polynomial-expanded (PE) multiuser detection (MUD), suboptimum search algorithm.

I. INTRODUCTION

Conventional detectors for direct-sequence code division multiple access (DS-CDMA) systems are composed of a bank of matched filters, which suffer from multiple access interference (MAI). Since the work of Verdu [1] on the optimum detector, several suboptimum multiuser detectors have been proposed to improve the capacity and mitigate the MAI problem of the conventional method [2]–[4]; among them are the decorrelator and minimum mean square error (MMSE) [5]–[7]. Although these methods have several attractive properties, they suffer from implementation complexity, which is mainly due to a need to invert a large matrix. Some research has been carried out for approximating the inverse matrix [8]–[15]. The polynomial-expansion (PE) method is one of these methods, which needs to calculate a set of coefficients. Lei and Lim [9] have proposed a simplified PE, in which, according to its inaccurate parameter estimation, the convergence rate is rather slow. Another approach uses random matrix theories and is addressed in [13]. Reference [27] addresses the use of polynomial de-tectors for CDMA systems. However, it confines its limit to downlink scenarios.

Manuscript received April 13, 2006; revised October 23, 2006, February 18, 2007, and February 19, 2007. The review of this paper was coordinated by Prof. T. J. Lim.

M. Mozaffaripour was with the University of Surrey, GU2 7XH Surrey, U.K. He is now with ArrayComm LLC, Guildford GU2 7YD Surrey, U.K. (e-mail: mahdi@arraycomm.com).

R. Tafazolli is with the Centre for Communication Systems Research, University of Surrey, Guildford GU2 7XH Surrey, U.K. (e-mail: R.Tafazolli@ surrey.ac.uk).

Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org.