Privacy-Preserving Proof-of-Location With Security Against Geo-Tampering

A Proof-of-Location (POL) system is used to issue a proof-of-location token (<inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq1-3128073.gif"/></alternatives></inline-formula>) to a user who has been present at a location <inline-formula><tex-math notation="LaTeX">$\ell oc$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>ℓ</mml:mi><mml:mi>o</mml:mi><mml:mi>c</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq2-3128073.gif"/></alternatives></inline-formula>, such that it can be later presented to a verifier to assure the presence of the user at <inline-formula><tex-math notation="LaTeX">$\ell oc$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>ℓ</mml:mi><mml:mi>o</mml:mi><mml:mi>c</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq3-3128073.gif"/></alternatives></inline-formula>. Basic POL security requirements are <italic>unforgeability</italic> of <inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq4-3128073.gif"/></alternatives></inline-formula>, and its <italic>non-transferability</italic> (a <inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq5-3128073.gif"/></alternatives></inline-formula> issued to user <inline-formula><tex-math notation="LaTeX">$u_1$</tex-math><alternatives><mml:math><mml:msub><mml:mi>u</mml:mi><mml:mn>1</mml:mn></mml:msub></mml:math><inline-graphic xlink:href="akand-ieq6-3128073.gif"/></alternatives></inline-formula> cannot be used by <inline-formula><tex-math notation="LaTeX">$u_2$</tex-math><alternatives><mml:math><mml:msub><mml:mi>u</mml:mi><mml:mn>2</mml:mn></mml:msub></mml:math><inline-graphic xlink:href="akand-ieq7-3128073.gif"/></alternatives></inline-formula>). An additional important property of POL systems is <italic>user privacy</italic> against the issuers and verifiers. We make two contributions. First, we formalize the POL security and privacy properties, and construct the first system providing provable security and privacy against the issuer and the verifier, both. Second, we introduce a <italic>geo-tampering attack</italic> that completely breaks POL system security, by simply changing the location of a <inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq8-3128073.gif"/></alternatives></inline-formula> issuing node. The attack applies to portable infrastructure nodes that are not continually monitored. We propose an algorithm that is used by a <inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq9-3128073.gif"/></alternatives></inline-formula> issuer to provide a location integrity “proof”, that will be embedded in a <inline-formula><tex-math notation="LaTeX">$pol$</tex-math><alternatives><mml:math><mml:mrow><mml:mi>p</mml:mi><mml:mi>o</mml:mi><mml:mi>l</mml:mi></mml:mrow></mml:math><inline-graphic xlink:href="akand-ieq10-3128073.gif"/></alternatives></inline-formula> to protect against this attack. The proof relies on a novel application of euclidean Distance Matrices. We implemented our POL on an off-the-shelf Android smartphone to show the practicality of the proposed algorithms.