Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to measure queuing time, similar to what they're doing in Finland. Instead of detecting bluetooth (which is disabled in most phones) I thought of detecting EDGE/3G.

I'd like to log the following information:

  • Phone 1 entered the zone at 14:00 and left at 14:30
  • Phone 2 entered the zone at 19:05 and left at 19:30

etc.

  1. How do I uniquely identify EDGE/3G/etc phones that enter a zone?
  2. Is there a better/easier way to uniquely identify phones entering/exiting a physical location in a manner that allows them to remain anonymous?

By "uniquely identify" I mean I want to be able to differentiate between the same phone entering the zone multiple times versus different phones entering.

By "anonymously" I mean I don't want to record any information that would allow anyone to track down the phone's owner.

share|improve this question
1  
What are you trying to protect? (Is there a security question here?) There are better ways to detect queuing times than mobile phone signatures, especially if you will not have sophisticated RF equipment. I'm don't understand why you need to detect someone getting back into the same queue. A queue is processed at a rate independent of individuals joining or leaving the queue. –  this.josh Sep 18 '11 at 4:36
    
This question relates to security tools (e.g. packet sniffing). You need multiple sensors along the length of a queue (or scattered throughout the airport) to gauge a person's progress through the check-in process. For that reason, you need be able to differentiate between a new device entering Zone 2 or an existing device leaving Zone 1 and entering Zone 2. –  Gili Sep 18 '11 at 14:30
    
A tool which may be used in a security context does not necessarily make the question a security question. Just as using a hammer does not make the user a carpenter. –  this.josh Sep 19 '11 at 7:20
    
Which StackExchange site do you feel this question is best suited for? –  Gili Sep 19 '11 at 15:29
    
If you are dead set on mobile phones maybe android.stackexchange.com or electronics.stackexchange.com For queuing theory cstheory.stackexchange.com or math.stackexchange.com –  this.josh Sep 20 '11 at 23:55
add comment

1 Answer 1

Okay, this is very easy if you are the GSM base station as the phone sends unique codes on first contact to that base station. However the legality of setting up your own base station and such may be problematic, depends on country, frequency, power and what radio spectrum licenses you have. As for anonymously doing it, fundamentally, you want to track phones uniquely in your area someone else can track them too, from that data. In fact, phone operators deliberately designed it not to be anonymous so they can track phones for charging the going rates for placing calls and the like.

share|improve this answer
1  
Ideally I'd want to read some unique data from the phone, but only store hash(value) to disk, thereby making it impossible for someone to track my logs back to the phone. I'll never have access to a GSM base station. Any other ideas? :) –  Gili Sep 17 '11 at 17:39
    
Without base station, you have to crack the encryption. But one can make a base station for GSM. It was don't for blackhat and defcon last year. The difficult bit is the actual radios. –  ewanm89 Sep 17 '11 at 22:49
    
As for how you analyze and store the data, that's another matter. But even if we take the IMEI (internationally unique to each handset) and hash that, it's likely the hashes will be unique as the IMEI isn't longer than the hash. –  ewanm89 Sep 17 '11 at 22:52
    
I don't think it matters that the hash is unique. The point is you can't go back from the hash back to the IMEI or MAC address. Unless you happen to run across that phone a second time (which is quite unlikely in my situation) you'd never be able to link the records back to it. –  Gili Sep 18 '11 at 14:24
    
but if you are trying to track a particular handset, the hash of the IMEI is no different from the IMEI itself. But, you exactly what data you store and what you discard is your choice. –  ewanm89 Sep 18 '11 at 23:03
show 6 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.