WiFi and Cell-ID based positioning - Protocols, Standards and Solutions

Jonas Willaredt
jwill@cs.tu-berlin.de

AbstractThe localization of handset devices gains more and more importance in various elds, such as advertisement, navigation, safety and also observation and tracking. The accuracy of localization improves by the years and offers more use to mobile applications, which make use of the knowledge of a users position. A well-known example of the apply of localization is the E911 mandate in the USA. It demands that that the GSM network providers must be able to locate a 911-caller within a radius of 300m in network based locating solutions, and 150m in handsetassisted solutions in 95% of all cases. [1] Further, localization heritages a big potential for commercial location based services. Matching a current location, services can be provided to users. Location-Based Services are expected to generate billions of dollars in annual revenue within the next few years. [2] Generally Location Based Services (LBS) can be classied into Commercial LBS, Internal LBS, Emergency LBS and Lawful Intercept LBS [3], so they are the base of a high percentage of todays and tomorrows applications and market possibilities. There are different ways how information about the location of a mobile device is generated. This paper explains the state of the art technology of WiFi and Cell-ID based positioning and describes some of its applications. The exchange of information for the positioning is realized via standardized protocols. The Secure User Plane Location Protocol (SUPL protocol) is the most common protocol in GSM networks, but can also be used over WiFi connections. Therefore this paper discusses SUPL in detail. By knowing how location data is collected and processed the reader understands how location-based solutions work. Some examples are given at the end of the paper.

methods in general and models on how to calculate a position out of these measurement data. It illustrates how to retrieve a position through Cell-IDs and WiFi signals, also comparing their accuracies and where it is better to use one or the other. The second chapter deals with common protocols used to retrieve the location of a mobile and how these protocols send the location to the device or location requester. The focus here is on the Secure User Plane Location (SUPL) protocol. In the third chapter some well-known solutions and applications for WiFi/Cell-ID based positioning are named, focusing on their technological background of location technique. The conclusion proposes a way to make WiFi positioning more accurate and points out why SUPL and MLP are designed for the future. Jonas Willaredt January 26, 2011

II. OVERVIEW OF POSITION LOCATION TECHNIQUES There are several approaches to get information about a devices position. The fastest way is to lookup the unique hardware address obtained by the signal of the closest cell in a database. This database is usually called radio map. The device then has to be within the geographic position of the closest cell plus the coverage of the signal sent from it. This can be from precise to very unprecise, depending on the coverage of the cell. To achieve more precise location information geometricmathematical models can be used to calculate a position. These models require information on surrounding points of the device. The points can be WiFi AccessPoints, GSM antennas or global navigation satellites (for example GPS, GALILEO, GLONASS). Depending on the underlying mathematical model, the information required is: how strong the signal is, what angle the signal comes from, what unique address the sender of the signal has. Based on this information, geometric mathematical models can calculate the position of a mobile device. A. Mathematical models of calculating a position The three following models are the base of almost every location technique used today. Sometimes they are enhanced, but these are the basic ones:

I. I NTRODUCTION The idea behind WiFi and Cell-ID positioning is to exploit the knowledge of GSM-Cells or AccessPoints (APs) geographic position and to calculate the position of a mobile device out of this data. It is an advantage that the infrastructure of needed for Cell-ID and WiFi based positioning already is installed almost everywhere in the world. Often location-based services are useful in urban areas. There the density of WiFi Access Points and GSM-Cells is very high. Therefore the positioning is accurate enough to meet todays standards. To understand how WiFi and Cell-ID based positioning works, this paper rst introduces mathematical methods, then measurement/calculation standards and nally common protocols used for location. In the end of the paper there are some example solutions. The rst chapter is on different positioning measurement

Figure 1. Trilateration example. t1, t2 and t3 are the different signal-run times and strengths which can be used to determine the location in question.

Figure 3.

Centroid of a Triangle [4]

B. Types of positioning and standard positioning methods 1) Lateration: Based on the distance of a point to its surrounding points it is possible to calculate the exact position of the location in question. To get to know the distance usually signal runtime differences or received signal strengths (RSS) are used. Receiving a minimum of three signals, each from different positions, enables an location calculation unit to calculate the location in question. Either the entity receiving the signals of n sites around it can measure their signals time difference or the signal runtime difference of signals sent from the entity can be measured from n sites around it. If three sites are used, the measurement technique is called Trilateration. If n > 3, this method is called Multilateration. A Trilateration example can be seen in gure 1. 2) Triangulation: In Triangulation the angles ( and in gure 2) of two sites P1 and P2 between the location in question are measured. With these angles it is possible to calculate the position of the desired location when the distance of the two points is known. The desired point has to be at the intersection of the two lines from the two sites. Based on the entity which measures and/or calculates the position, three different types of obtaining a geographic position can be classied:

Handset-based positioning: The handset measures the data needed for its approximate location and calculates its own position on its own out of this data. Network-based positioning: The network measures all data needed for the handsets approximate location and calculates the position of the handset. The handset is passive in the whole progress. Hybrid positioning: In hybrid positioning, the network and the handset work together to rst measure and then calculate the devices position. Usually the device measures the data needed for location calculation, then the network does the calculation. This way is usually taken because the handset usually has less calculation power than the network.

Figure 2.

Triangulation example

The following examples of positioning methods combine the geometry explained before with the three different types of positioning. These are the most common methods used in wireless networks today, but there are more possible methods than the ones explained here. The following positioning methods are sorted by their type (handset-based, networkbased or hybrid). C. Handset-based methods Handset-based methods have the advantage that they do not necessarily need access to a network, because they calculate the position on their own. On the other hand, when there is no network and therefore no signals, it is impossible for the handset to calculate its position. Common examples are: 1) Global Positioning System (GPS): The GPS consists of up to 32 satellites which all send signals containing the time stamp of sending, the orbital information and the almanac (positions of all satellites). With this information the mobile device can calculate the time the signal needed reach the device. When the device receives at least four different

3) Centroid Localization: This method is based on the knowledge of the location of sites signals received by the handset. The handset is then able to calculate the arithmetic mean. Figure 3 there is a example of the centroid of a triangle.

satellite signals, it can calculate its geographical position. The multilateration method is used to calculate the geographic position. The disadvantage of GPS is that indoor location is impossible and in urban areas the Time To First Fix (TTFF) sometimes takes a very long time because buildings hinder GPS signals from being received. 2) Time Of Arrival (TOA): The mobile device measures the arrival time of transmissions from a minimum of three sites. With these three values it is possible for the handset to calculate the position through trilateration or multilateration with the knowledge of where the sites are. An advantage is that there are no Location Measurement Units (LMUs) needed in the network. A disadvantage is that the device either has to have a big database with the sites geographic positions or an exact measurement unit for measuring the propagation of the signals. RADAR (explained later) uses this method to estimate the position of a mobile device. RADAR uses WiFi APs as sites. In gure 4 TOA is shown exemplary with three different sites.

Figure 5.

(Multipath-) Fingerprint [7]

1) Cell-ID, Cell of Origin (COO): Cell-ID/COO is based on the knowledge where every sites geographic position is. Every site has its own ID/Mac address. If one knows the location of this unique id/address the handset is connected to, it knows the handsets approximate geographic location. Because GSM network cells sometimes have very wide coverage the location is very inaccurate. Generally the accuracy of the Cell-ID method depends on how high the density of the cell net is. In rural areas, one cell sometimes covers an area up to 30km, while in cities one cell sometimes covers only 10meters. [2] In 43% of the cases in the study [2], the mobile was not connected to the closest cell, so the accuracy can be worse than the coverage of the closest cell. 2) (Uplink-) Time Difference Of Arrival ((U-)TDOA): (U)TDOA is based on the arrival time differences measured by sites between the received signals of a mobile device. It is then possible to calculate the position with (multi-)lateration. The advantage is that the mobile device does not need any additional hardware or software. The disadvantage is that the network has to be equipped with exactly time-synchronized Location Receivers/Location Measurement Units (LMUs) and a Location Calculation and Control Center to calculate the position of the handset. U-TDOA is a standard method used for E911. [1] The method is shown in Figure 6. 3) AOA: Angle of Arrival is based on the angle of the received signal of a handset at a site. To calculate a position, a minimum of two different sites is required. The disadvantage is that each site has to be equipped with an array of antennas to measure the angle of the incoming signal and a Location Calculation and Control Center is needed in the network to calculate the position of the handset. This mechanism is shown in Figure 7.

Figure 4.

Time Of Arrival (TOA) [7]

3) (Multipath-) Fingerprint: The (Multipath-) Fingerprint method compares the received signal(s) with known signal constellations saved in a database. The disadvantage is that its very expensive to create a database with the ngerprint of different signals of each location, for example in suburban areas and this database requires a lot of memory. Google maps uses this method with WiFi AP Hardware addresses. Figure 5 shows an example of multipath ngerprint.

D. Network-based methods Network-based positioning methods have the advantage, that they do not require (costly) hardware units on the mobile device to locate its position. The disadvantage is that hardware units on the network are very expensive as well. Common examples are:

Figure 6.

Time Difference Of Arrival for GSM [7]

Figure 8.

Reduced possible location with timing advance

2) Assisted Global Positioning System (A-GPS): A-GPS is based on normal GPS localization but has the enhancement that additional data for the location of the GPS satellites relative to the location of the mobile device is transferred to the mobile device by the network. The location of the handset has to be known in advance (for example through TDOA). The handset then can nd the GPS signals much faster and is sometimes able to get a GPS signal in areas where usually it would not work. Figure 9 shows this:
Figure 7. Angle of Arrival example for GSM [7]

E. Hybrid methods The mobile device and the network work together to calculate the position. This can be very effective because network and handset can share the tasks for positioning. Examples are: 1) Timing Advance (TA) (GSM only): GSM Networks use Time Division Multiple Access (TDMA) which makes it possible for several users to share one frequency. Every user has one assigned time slot. The timing advance value in GSM networks is calculated by the network for the cell a mobile device is connected to. The timing advance value is based on the distance of the device to the cell. It tells the device at what time ahead to the time slot reserved for the mobile device it has to send a signal to the cell. This is necessary due to the propagation delay so that the signal receives the cell at its designated time slot. In combination with the knowledge of the cells geographic position (for example through Cell-ID) the timing advance parameter helps to make the position information of the mobile device more accurate than just the position of the cell and its coverage, because then it is possible to reduce the radius of the coverage area. This process can be seen in gure 8.

Figure 9.

Assisted GPS [7]

3) A-GANSS: Assisted Galileo and Additional Navigation Satellite Systems is the same like A-GPS except that is uses the Galileo satellites instead of GPS-satellites. F. Positioning accuracy and use-cases for the methods Sometimes it is useful to mix different positioning methods. For example mixing AOA with Received Signal Strength (RSS) usually results in a better accuracy than one of these methods alone. The coordinate system in gure 10 illustrates the accuracy over different locations (indoor and outdoor). Table I shows the accuracies for the methods described

Figure 10. Coordinate System of different location techniques and their accuracies [5]

earlier. Usually TTFF (mostly relevant in urban areas) and accuracy

WiFi has signicantly less coverage (except for WiMAX), numerous different Internet providers behind the APs etc. C-Plane protocols are in the signaling layer. They depend on the underlying network type. The advantage is that they usually do not need sophisticated hardware on the device, because they are not on the application layer. So the device does not have to understand TCP/IP for example. Also they can be much faster. A disadvantage of C-Plane localization is that it requires network-specic upgrades to work. This is very expensive for the provider: He needs to install new hardware and upgrade all hardware required for C-Plane localization on every network upgrade. Also he needs to reserve dedicated channels and frequencies for positioning, depending on the measurement used for locating a handset. [7] C-Plane protocols serve to fulll the E-911 mandate because not every mobile device has the ability of understanding TCP/IP but the law has to be fullled for every cellphone on the market. In contrast to C-Plane, U-Plane protocols are in the application layer. They are independent of the underlying network type because they use TCP/IP for positioning determination. It is easier to create new and to maintain old services on U-Plane based positioning because no network specic changes are required for implementing new and changing old services. A disadvantage of U-Plane is that calculating/estimating the location of a handset sometimes takes longer than in the C-Plane. One reason is that the way of the packets is longer, there is more overhead due to the higher layer and there are usually more hops between the handset and the calculation unit in hybrid- or network-based location infrastructure. The following section will list some C-Plane Protocols used in GSM Networks. B. C-Plane Protocols

are the important parameters of location based services. But as seen in gure 10 and table I they are opposed. So the developer has to chose which method is best tting, depending on the needs of the location based service he wants to implement. III. P ROTOCOLS Protocols are being used to bring information on the position to the location requester. This paper focuses on protocols used in WiFi and GSM/UMTS networks, because they are todays standard in Europe. There are similar protocols for other wireless technology standards like for CDMA2000 the TIA-801-protocol explaining these protocols would exceed this papers limits. A. C-Plane vs. U-Plane Protocols In GSM here are two different types of protocols and localization measurements: Control Plane (C-plane) and User Plane (U-plane). In WiFi networks, there are only U-Plane positioning protocols. Reasons are that WiFi Routers usually only transmit data from network clients known by the AP,

C-Plane protocols were developed to fulll the E-911 mandate. They support mobile phones which are unable to understand TCP/IP, so they cover a wider spectrum than U-Plane protocols. In the following, the two most common C-Plane protocols are presented: 1) Radio Resource Control (RRC) (for UMTS): The Radio Resource Control Positioning Protocol is a C-Plane protocol that is used to control signaling and transfer of information between the mobile handset and radio network control elements. RRC supports the exchange of data for AGPS and E-OTD positioning in the C-Plane. [8] It was developed by 3GPP. 2) Radio Resource LCS Protocol (RRLP): RRLP was developed by the 3GPP. It is used to exchange information between a mobile station its Serving Mobile Location Center (SMLC). [9] The SMLC is a network entity that calculates the position of a mobile device based on the network-based or hybrid positioning technique. As positioning methods, E-ODT and A-GPS are used in RRLP.

A big problem with RRLP is that it requires no authentication from the network. So if something pretends to be the network then he can request the geographic position of a mobile device. This approach was shown by Harald Welte, see [10] for details. A RRLP message can be one of the following 5 components [9]: Measure Position Request: This component is sent from the SMLC to the handset. The purpose of this procedure is to enable the SMLC to request for position measurement data or location estimate from the handset, and the handset to respond to the request with measurements or location estimate. [9] Measure Position Response: This component is sent from the handset to the SMLC when the handset was able to calculate its position, has required location measurements, a location estimate or an error indication. [9] If the device was able to fulll the quality of position request it contains the location information. Assistance Data: This component is used in the Assistance Data Delivery procedure of RRLP. It is sent from the SMLC to the handset in order to provide assistance data for the handset to calculate its position. Assistance Data Acknowledgement: This component is also used in the Assistance Data Delivery procedure. It is sent from the handset to the SMLC to indicate that the handset has received a complete Assistance Data Component. Protocol Error: This component is sent from the handset to the SMLC if there is a problem that prevents the MS to receive a complete and understandable Measure Position Request component [9] C. U-Plane protocols 1) Mobile Location Protocol (MLP) (GSM only): The MLP was specied by the location interoperability forum (LIF) in 2002. The standard is now maintained by the Open Mobile Alliance (OMA). The protocol is on top of the OSI Application Layer and can be used in order of getting positions of mobile devices independent of the underlying network technology. [11] The MLP is used as an interface between a Location server and a mobile device in order to exchange location information. The information lays in an XML format and can be transported over a protocol bearer like HTTP or SOAP for example. The three layers of MLP are illustrated in gure 11 The transport layer is used to exchange the XML content in the two upper layers. For this purpose MLP can use HTTP, SOAP etc., for the information this does not matter. In the Element Layer there are the elements needed for the services in the service layer. The Elements are dened in XML DTD format. [12] On top of the protocol layer the service layer species the services of MLP. Important MLP Services are: Standard Location Immediate Service (SLIS): This service can be used when a Location server wants to know the position of the device.

Figure 11.

Simplied MLP Protocol layers, see also [12]

Emergency Location Immediate Service (ELIS): This service can be used when a mobile device initiated an emergency call. Triggered Location Reporting Service (TLRS): This service can be used when a application wants periodic updates about the devices position. Triggers can be a periodic time, or switching on the device. In the future area specic triggers are planned to be implemented. [11] When using http as bearer, a location requesting client can request a location service via an HTTP POST request with the host of the Location Server. This server then responds with a HTTP response. An exemplary message ow for ELIS over HTTP is illustrated in gure 12.

Figure 12. MLP Emergency Location Immediate Service message ow, see also [11]

2) Secure User Plane Location (SUPL) (WiFi & GSM): SUPL is an Enabler which uses standards and protocols where available and possible [13] to determine the position of a mobile device. SUPL was developed by the OMA (Open Mobile Alliance (200 international companies, including many mobile operators built OMA in 2002 to support the creation of inter-operable end-to-end mobile services [14])) to standardize the communication between the SUPL network and a client device. It works in the U-plane. Since version 1.0 of SUPL supported RRLP and RRC in GSM networks as positioning protocols. As positioning methods in GSM networks it supported A-GPS, Autonomous GPS, E-OTD and Enhanced Cell/Sector ID. [13] In the current (2011) version 2.0 and future version 3.0 some changes were introduced (among others) [15], [13]: Triggered positioning procedures: its possible to set triggers, for example do something when a SET entered an area, send periodic signals of the SUPL enabled devices location.

A-GNSS/A-GANNS to support other Global Navigation Satellite Systems such as GLONASS, GALILEO etc. as positioning method. Positioning procedures for delivering the own location to another SUPL Enabled Terminal (SET) and to retrieve a different SETs position. [16] Among others, LTE, WiMAX, WiFi and xed broadband such as DSL as data bearer [16] LPP as additional positioning method over LTE Improved TTFF [16] Improved indoor location accuracy [16]

The initialization of a SUPL session is possible on four different ways: OMA Push, SMS, UDP/IP and SIP Push [15], depending on the networks circumstances, SETs capabilities and the provider. If using SUPL through a WiFi network, only UDP/IP connections are used. To initiate a network-initiated SUPL session to a mobile the SLP can send a WAP Push message to the device with the IP of the SLP. The mobile then has to initialize a TCP/IP connection to the SLP to initiate a SUPL session. Example of a user-initiated location request with A-GPS A more detailed view of the SUPL architecture is shown in gure 13, where a solution of a A-GPS SUPL architecture is shown: To send assistant data for A-GPS to a SET,

Since version 2.0 SUPL makes use of these positioning methods in its Position Calculation Function: A-GPS, A-GANSS, Autonomous GPS/GANSS, Enhanced Cell/Sector, AFLT, EOTD, OTDOA and (Enhanced) Cell ID. [15] SUPLs most important entities and their functions are shown in Table II. To make communication between the SLP and the SET
Table II SUPL S MOST IMPORTANT ENTITIES Shortcut SLP Full name SUPL Location Platform SUPL Positioning Center SUPL Location Center SUPL Enabled Terminal Description Responsible for Location Service Management and Position Determination. The SLP contains the SLC and SPC Functions. Responsible for all messages and procedures required for position calculation and for the delivery of assistance data. Coordinates the operations of SUPL in the network and interacts with the SET over User Plane bearer. A logical entity in a device that is capable of communicating with a SUPL Network.

SPC

SLC

Figure 13. Example SUPL Architecture for A-GPS positioning with Cell-ID aid

SET

possible, SUPL uses and supports following protocols (among MLP and others) :

UserPlane Location Protocol (ULP): ULP was developed by the OMA. The TCP/IP ULP is used in the exchange of location data between a SLP and a SET. To ensure privacy and data integrity, all SUPL messages except SUPL INIT have to be exchanged in a TLS/PSK-TLS session. [15] ULP is used to determine which positioning methods the SET supports and to exchange information relevant for positioning. LTE Positioning Protocol (LPP): LPP was specied by 3GPP. LPP is used point-to-point between a location server (E-SMLC or SLP) and a target device (UserEquipment or SET) in order to position the target device using position-related measurements obtained by one or more reference sources. [17]

some entities in the SUPL network have access to a GPS measurement unit and maintain an up-to-date database with the measurement data. The SLP can convert this data to meet SETs requirements for A-GPS. When receiving a AGPS assistant data request, the SPC can calculate the GPS assistance data for the requesters approximate location. This assistant data is then transferred to the SET. The sequence diagram of a mobile requesting assistance data for GPS from a Cell-ID obtained approximate position is shown in gure 14 (next page) Description of Figure 14 1) The data connection between the SET and the SLP is set up. This can be a GPRS/HSDPA/LTE/WiFi connection for example. For SUPL it doesnt matter which connection is established, it has to be a TCP/IP connection to the SLP. The GPS World Wide Reference Network (WWRN) server updates the satellite Coordinates and some other GPS related information in the SLP so that i can provide A-GPS services. 2) The SET sends a ULP SUPL START message to the SLP. This is the initialization of the SUPL session. The message contains information about the SETs capabil-

A Network initiated SUPL positioning request with triggering A network initiated positioning request can origin from a SUPL agent that has authorization to do a location lookup on a device. The agent can request a time or location triggered notication, for example when a SET enters an area, leaves an area etc. In Figure 15 an example of a Entering Area trigger event can be seen. In Figure 16 the outside trigger is enabled. There

Figure 14. Set initiated A-GPS positioning sequence diagram, see also [15], [12] and [17]

3)

4) 5)

6)

7)

8)

ities of location measurement (in this case it is A-GPS) and a location identier (in this case a Cell-ID). The SLP queries the Cell-ID in a database provided by the Gateway Mobile Location Center (GMLC). The protocol used for this lookup is MLP. The GMLC responds with the geographical location of the Cell owning the Cell-ID. MLP is used again. The SLP sends a ULP SUPL RESPONSE message to the SET, conrming that a session was established. The message also contains the positioning method which will be used to locate the SET. It also contains the coarse location estimation, based on the Cell-ID lookup. The SET sends a ULP SUPL POS INIT message to the SLP to start the positioning procedure. It again contains information about the SETs capabilities of location measurement (in this example A-GPS), a location identier Cell-ID and the requested data, for example the almanac of GPS. The SET responds with a ULP SUPL POS INIT message which initiates a RRLP/RRC/TIA801 session with the SLP. The SLP calculates the GPS assistant data relative to the SETs approximate position which is known from the Cell-ID lookup and sends it to the SET through RRLP. The SET then tries to nd the GPS satellites and their signals aided with the assistance data provided by the SLP. The SLP sends updated assistance data until the Quality of Positioning (QoP) requirements of the SET are fullled. If the SUPL session was network initiated (not in this case) the SET would send its GPS position back to the SLP. When the QoP of the SET is fullled, the SET sends a ULP SUPL END message to the SLP, indicating this. The TCP/IP connection is then closed and all resources needed for the session are released.

Figure 16. Repeated notication while outside trigger area [15] Figure 15. Location trigger, notication when entering area [15]

are more possible triggers, for example a repeated location trigger when a SET is outside an area. These triggers can be used for marketing purposes or surveillance for example. IV. W I F I /GSM BASED POSITIONING SOLUTIONS There is a big variety of solutions of positioning on the market. With increasing demand of location based services, more solutions of positioning will be realized. Because abilities of devices differ signicantly, one positioning method is useful for one, but useless on other devices. There are more possibilities of locating solutions but that would exceed this paper. A. WiFi solutions WiFi solutions are increasingly popular in the last few years. This is because specially in urban areas there are many different wireless networks which make it relatively easy to calculate the position of a device. There are much more wireless networks than GSM sites. Also a WiFi positioning solution provider does not need to pay for the WiFi networks. He just needs to have a database containing WiFi ngerprints and their corresponding geographic positions. Because wireless routers usually stay in place for years, maintaining this database is not too much effort too. The following solutions base on WiFi positioning. 1) RADAR: RADAR is one of the rst approaches to WiFi localization. It was developed by Microsoft in 1998-2000 to make localization possible in buildings. It exploits the signals of WiFi routers and operates by recording and processing signal strength information. It then compares the ngerprint

of the location to a ngerprint database and looks up the geographic information to the closest matching ngerprint in the database. 2) Cisco Wireless Location Appliance: The Cisco WLA is a system to track WiFi devices in a WiFi infrastructure. First, a network map with all APs has to be created. Then (Cisco) access points measure RSS information from all WiFi devices in their surrounding and send this information to the Cisco Wireless Location Appliance. Then this information is saved and it is possible to calculate the position of every WiFi device in the reach of the whole system. See also [18]. B. GSM solutions GSM solutions benet of the coverage of the GSM net. In Germany it is hard to a place with no GSM coverage and the need of location based services. This advantage makes GSM positioning interesting especially for emergency location based services. The following two solutions use GSM positioning techniques: 1) E-911: When a caller dials the emergency number 911 in the USA, the call-taker can see the number of the caller and also his approximate position. The GSM provider of the caller has to make positioning possible and accurate. Because there are different ways of fullling the E-911 accuracy mandate, every provider has its own solution. For example AT&T uses TDOA [19] while T-mobile uses U-TDOA. [20] 2) eCall: In the European Union a similar system is currently in the state of becoming a standard: eCall. eCall will become a standard in new cars. When a car accident happens, eCall will automatically send a notication to a Public Safety Answering Point (PSAP). The PSAP will then know the approximate location, possible severity of the crash and number of passengers, depending on the implementation of the eCall system. [21] The positioning technique is up to the provider among others U-TDOA and A-GPS are in discussion. [22] C. Hybrid solutions Hybrid solutions combine WiFi/GSM/GPS location techniques. They can achieve faster TTFF and accuracy because they are not dependent on one underlying network and they can combine different positioning techniques to make positioning more accurate. The most famous hybrid solutions are presented in the following: 1) Google Latitude: Google latitude is a program which allows others to view another handsets location. This is done by GPS/WiFi/GPS measurements and ngerprint lookup in a Google database. [23] Using WiFi gives Latitude an accuracy of about 200 meters. [23] If you use GPS locations service for Latitude, the accuracy can be within a few meters. [4] The WiFi/GSM ngerprints Google collected while making

the photos from Google street view [24] 2) Skyhook: Skyhook also is a proprietary solution. It uses a hybrid GSM/GPS/WiFi system and has ngerprints collected by measurements stored in a database. The Skyhook client measures raw data of all three sources and tries to calculate its own position. If this fails, it sends the data to a Skyhook server who responds with the geographic position. Developers can use Skyhooks Software Development Kits (SDKs) for all main operating systems (also mobile OSs). Based on the libraries provided, a developer is able to implement a location-sensitive application without the need of implementing positioning techniques because Skyhooks libraries do this. They provide the users location which can be used in the developers program. [25] 3) Placelab: Placelab is a free and open source hybrid GSM/WiFi/Bluetooth localization system released under GNU license agreement that works handset-based. A handset client logs all received bacons from these carriers and looks up the ngerprint in a locally cached database/map. This ngerprint is usually unique because GSM/WiFi/Bluetooth transmitters usually have a unique hardware address (MAC address). The data for the database is collected from the community which uses placelab. Place Lab can achieve accuracy in the range of 1340 meters [5]. Table 17 shows the measured accuracy of placelab in Seattle, Ravenna and Kirkland:

Figure 17.

Measured Placelab accuracies in 2005 [26]

D. Find my iPhone Find my iPhone is a service which lets users nd their iPhone if it was lost or stolen. Users with a Apple ID login to a website and if their iPhone/iPad/iPod is switched on and connected to either a WiFi or a GSM network they can see the devices current location. Find my iPhone uses a combination of WiFi and GSM positioning [27] and if possible A-GPS [28]. Depending on the capabilities of the device, it reports the location data to the services website via a GPRS/WiFi connection over TCP/IP with encrypted packets. [28] Apple uses databases maintained by Google and Skyhook Wireless (Skyhook) [29] An Example how a location lookup looks like can be seen in Figure 18. Since January 2008 Apple let users generate a comprehensive WiFi/GSM ngerprint database which contains GPS locations of the ngerprints by letting devices send these informations (if available):

Figure 18.

Example of Find my iPhone map [30]

Cell-IDs of received GSM sites Received Signal Strength (RSS) of GSM sites WiFi Mac Addresses GPS data to these measurements These data gets packet, encrypted and is then sent to Apple [29] if a user does not turn off the Location-based services setting. [29] The accuracy is from about one kilometer [31] up to a few meters in ideal environment. [32]

E. Conclusion The accuracy differences of the solutions described vary from about 10m to 1km. There is still the lack of a cheap, worldwide usable and standard method on how to retrieve a position with an error of about one meter, outdoors and especially indoors. There are some ideas to solve this issues, like adding a time-stamp to WiFi signals to make WiFi positioning more accurate or combining different global navigation systems. As protocol SUPL and MLP are well designed for the future because of their supported different underlying network technologies and SUPL for its customizable measurement methods. When the demand of accurate positioning measurement will grow in the future there will be a better positioning solution because then this will be nance-able. The solutions especially in the WiFi sector need to become more standard. In the near future hybrid methods will have best success because they make seamless positioning possible in different environments, they provide better accuracy in most cases and TTFF is best with hybrid methods. R EFERENCES
[1] S. Wang, M. Green, and M. Malkawa, E-911 location standards and location commercial services, in Emerging Technologies Symposium: Broadband, Wireless Internet Access, 2000 IEEE, 2000, p. 5 pp. [2] E. Trevisani and A. Vitaletti, Cell-id location technique, limits and benets: an experimental study, in Mobile Computing Systems and Applications, 2004. WMCSA 2004. Sixth IEEE Workshop on, 2004, pp. 51 60.

[3] N. Deligiannis and S. Louvros, Hybrid toa-aoa location positioning techniques in gsm networks, Wireless Personal Communications, vol. 54, pp. 321348, 2010, 10.1007/s11277-009-9728-x. [Online]. Available: http://dx.doi.org/10.1007/s11277-009-9728-x [4] [Online]. Available: http://en.wikipedia.org/wiki/File:Triangle.Centroid.svg [5] Y.-C. Cheng, Y. Chawathe, A. LaMarca, and J. Krumm, Accuracy characterization for metropolitan-scale wi- localization, in Proceedings of the 3rd international conference on Mobile systems, applications, and services, ser. MobiSys 05. New York, NY, USA: ACM, 2005, pp. 233245. [Online]. Available: http://doi.acm.org/10.1145/1067170.1067195 [6] F. Loser, Position system mit gsm, Albert-Ludwigs-Universitat Freiburg Fakultat fur Angewandte Wissenschaften Lehrstuhl fur Kommunikationssysteme, Tech. Rep., 2006. [7] B. K. Y. Shu Wang, Jungwon Min, Location based services for mobiles: Technologies and standards, LG Electronics Mobile Research, USA, Tech. Rep., 2008, iEEE International Conference on Communication (ICC). [8] Broadcom, Secure user plane location white paper, Broadcom Corporation, Tech. Rep., 2007. [9] 3GPP, Digital cellular telecommunications system (phase 2+); location services (lcs); mobile station (ms) - serving mobile location centre (smlc) radio resource lcs protocol (rrlp) (3gpp ts 04.31 version 8.18.0 release 1999), 3GPP, Tech. Rep., 2007. [10] [Online]. Available: http://security.osmocom.org/trac/wiki/RRLP [11] O. M. Alliance, Mobile location protocol specication, Open Mobile Alliance, Tech. Rep., 2004. [12] M. D. Light P. Bitrou, Dene and implementation of secure user plane location, National Technical University of Athens, Tech. Rep., 2006. [13] O. M. A. Ltd. (2010, November) Secure user plane location architecture version 3, enabler release denition for secure user plane location. Open Mobile Alliance Ltd. [14] (2010, December) About the oma. Internet. Open Mobile Alliance Ltd. [Online]. Available: http://www.openmobilealliance.org/AboutOMA/Default.aspx [15] Secure User Plane Location Architecture Version 2, Open Mobile Alliance Std., 2010. [16] OMA, Secure user plane location requirements candidate version 3.0 21 sep 2010, OMA, Tech. Rep., 2010. [17] T. Goze, O. Bayrak, M. Barut, and M. Sunay, Secure user-plane location (supl) architecture for assisted gps (a-gps), in Advanced Satellite Mobile Systems, 2008. ASMS 2008. 4th, 2008, pp. 229 234. [18] CiscoSystems, Cisco wireless location appliance data sheet, CiscoSystems, Tech. Rep., 2006. [19] [Online]. Available: http://developer.att.com/developer/forward.jsp ?passedItemId=3100156 [20] [Online]. Available: http://www.tmobile.com/Company/Community.aspx?tp=Abt Tab Safety&tsp=Abt Sub PublicSafety [21] C. Pinart, J. Calvo, L. Nicholson, and J. Villaverde, Ecall-compliant early crash notication service for portable and nomadic devices, in Vehicular Technology Conference, 2009. VTC Spring 2009. IEEE 69th, 2009, pp. 1 5. [22] S. Tao, S. Rodriguez, and A. Rusu, Vehicle location using wireless wide area network, in Wireless and Mobile Networking Conference (WMNC), 2010 Third Joint IFIP, 2010, pp. 1 6. [23] [Online]. Available: www.computerworld.com/s/article/9127462/FAQ How Google Latitude locates you [24] [Online]. Available: http://googleblog.blogspot.com/2010/05/wi-datacollection-update.html [25] [Online]. Available: http://www.skyhookwireless.com/devices/devicesupport.php [26] T. Gloor, Ortsbestimmung mit place lab, Distributed Systems Seminar - ETH Zrich, Tech. Rep., 2005. [27] [Online]. Available: http://db.tidbits.com/article/11368 [28] [Online]. Available: http://www.taborcg.com/2009/06/17/nd-myiphone-on-os-221/ [29] [Online]. Available: http://www.scribd.com/doc/34546602/appleresponse-to-markey-barton [30] [Online]. Available: http://ktula.com/wpcontent/uploads/2009/06/nd my iphone page.png [31] [Online]. Available: http://discussions.apple.com/message.jspa ?messageID=12073864 [32] [Online]. Available: http://blog.cameronlaird.com/2009/06/amazingaccuracy-of-the-nd-my-iphone-feature.html