# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 1 Introduction  
Authentication is considered the most important security service, being at the basis of security solutions for systems and networks. To perform authentication in online and ubiquitous computing environments, users authenticate themselves using various methods with a variable reliability degree. These methods can be classified into three main classes or factors: what the user knows, e.g., a static password or a one-time code), what the user is, e.g., a fingerprint, retinal scan, voice-recognition pattern, or other biometric data), and what the user has, e.g., an ID card, a security token, or a personal cell phone or tablet. When speaking about authentication, we observe that there is no \"one-size-fits-all\" solution:the number and types of authentication methods supported in the security products and services depend on the service provided and on the costs required for their implementation and deployment [1]. There is no unique authentication method that can fully protect against all types of security attacks. For example, the challenge-response one-time codes or application-level digital certificate-based authentication render phishing and malicious software attacks useless, but they do not fully protect against Man-In-The-Middle (MITM) attacks [2], even though both methods could be extended to achieve this protection too [3; 4]. Nevertheless, the more services or data are security-sensitive, the more they are appealing to the attackers, who would definitely employ various methods to obtain access to them, such as token/notes theft, hidden code, worms, e-mails with malicious code, smart-card analyzers or a reader card manipulator, brute-force attacks, web page obfuscation, session hijacking, security policy violation, or website manipulation [5; 6; 7]. Obviously, the type of security attacks executed depends also on the authentication mechanism employed by the authentication system, and it becomes clearer that, especially in \"remote\" usage scenarios, there is a need for stronger authentication methods. The term \"remote\" is used here to refer to any infrastructure in which the clients and the service providers are connected via some potentially insecure network channel, like the mobile network or a data connection using the short-message service (SMS). Considering the incredible advance of location sensing [8] and social-networking technologies, researchers have proposed even newer authentication classes, such as where the user is and when [9] or somebody you know [10], which should be used in combination with the classical authentication classes to protect (on one side) the service providers against the security attacks, and to have (at the same time) an attractive, transparent and usable service offered to the users. For example, the new types of authentication classes could be used in the mobile payment (m-payment) systems--like PayPal, PayCircle, or MobiPay--which are still considered \"not secure enough\", \"too difficult and slow to use\" [11], or available only for a limited variety of goods or a small selected clientele. Mobile payment systems have emerged in recent years, allowing users to pay with their devices (especially mobile phones) wherever they go. **Contribution. ** Many authentication solutions have been improved to guarantee high-assurance user identification. Even if a user enters the right username and password, there is still a probability that we might not deal with the legitimate user because the username and password could have been stolen. Some national systems or frameworks, like the electronic identity systems in Europe [12; 13], have addressed this concern by deploying identity cards to citizens that can also be used to perform authentication when accessing some public services, such as for tax declaration or to register children at schools. Even though such cards are useful for enabling smoother administrative procedures asking for user identification, they are not (typically) used for payments.