This thesis investigates the performance of positioning systems in Wi-Fi and 5G networks using a single node, such as a Wi-Fi Access Point (AP) or a Next Generation Node B (gNB). Specifically, the goal is to enable the AP or gNB to estimate the location of the User Equipment (UE), rather than for the UE to perform self-localization. Then, considering the sensitivity of location information and the importance of ensuring user privacy in positioning systems, the thesis analyzes the security and privacy (S&P) features provided by commercial 5G deployments.

First, this thesis addresses how single-node positioning can be achieved in Wi-Fi networks, focusing on realistic scenarios where the UE is a smartphone. Most existing literature relies on dense deployments of APs, which are not available in real-

world scenarios, such as residential homes. In the case of single-node positioning systems, non-commodity equipment, such as prototyped APs, and advanced features, such as the support of multi-band frequency operation have been studied in prior work. Moreover, existing solutions fail to rely solely on Wi-Fi measurements, instead requiring the integration of inertial sensors. This approach further limits the applicability of single-node positioning systems in standard deployment environments. To address these limitations, we introduce SPRING+, a positioning system that is capable of localizing the target device with measurements obtained by a single off-the-shelf Wi-Fi AP. Through an extensive evaluation in realistic indoor scenarios, including environments dominated by Non-Line-of-Sight (NLOS) conditions, we show that SPRING+ achieves robust and accurate localization. Consequently, SPRING+ addresses the single-node positioning research problem, and its code is released as open-source to support reproducibility and further research.

Afterwards, the thesis explores the positioning capabilities of commercial 5G networks using a single gNB and a smartphone as the UE, with a focus on real-world applicability. Although significant standardization efforts have been recently made to enhance 5G positioning, most existing studies rely on Software Defined Radio (SDR) testbeds, and little is known about the performance of commercial 5G deployments. To bridge this gap, we investigate the positioning performance of commercial networks based on 3GPP Release 15.

Continuing within the context of recent cellular networks, this thesis also investigates their security and privacy (S&P) features, which are critical for safeguarding user data and ensuring user identity and location privacy. Motivated by these issues, we conduct an in-depth analysis of the S&P vulnerabilities affecting both legacy and current generations of cellular networks, providing practical insights towards secure and privacy-preserving positioning. While 5G has introduced major modifications to the 5G standard to address these legacy issues, it remains unclear whether these changes have been properly implemented by network operators, and whether new S&P vulnerabilities have emerged in practice. Based on this outlook, this thesis presents the first comparative analysis of 5G Standalone (SA) and Non-Standalone (NSA) deployments under the same carrier, evaluating their resilience against well-known attacks. In addition, this thesis is the first to identify two novel S&P attacks in 5G SA commercial networks. Furthermore, we provide the first S&P analysis of the OpenAirInterface (OAI) platform, demonstrating its strong potential as an open-source tool for privacy-focused research and experimentation.

Through its extensive investigation and proposed solutions, this thesis advances the state of the art in both positioning systems and cellular network security, encouraging continued research in these critical areas.

About Stavros Eleftherakis

Stavros Eleftherakis is a PhD Candidate within the Pervasive Wireless Systems Group at Imdea Networks Institute and Universidad Carlos III de Madrid (UC3M). He has worked as a Research Intern at Telefonica Research in Barcelona, Spain and Ericsson in Linköping, Sweden. His primary research interests include Positioning Systems, Cybersecurity and AI with related publications in top-tier venues, such as ACM MobiCom, ACM WiSec, and IEEE Transactions on Mobile Computing.

PhD Thesis Advisor: Dr. Domenico Giustiniano, IMDEA Networks Institute, Spain

University: Universidad Carlos III de Madrid

Doctoral Program: Telematic Engineering

PhD Committee members:

• President: Ana Aguiar, Assistant Professor, University of Porto, Portugal
• Secretary: Carlos Jesus Bernardos Cano, Professor, Universidad Carlos III de Madrid, Spain
• Panel member: Stefania Bartoletti, Associate Professor, University of Rome Tor Vergata, Italy