# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 2 Related Work
[39] explored the use of the Location Service (LCS) proposed by the telecommunication industry to achieve location-enhanced server authentication, which typically relies on public-key certificates in the X.509 format. This solution, named SALVE, defends against server impersonation by attackers with bogus certificates or exploiting stolen private keys of the legitimate server. Table 1 compares some selected locationbased authentication methods, their main characteristics and whether the method has been prototyped in a real context or in an environment with hardware specific to the service provider. Short discussion on location authentication. When speaking about location, one could think that the Global Positioning System (GPS) is the key to enhancing some of the authentication mechanisms already in place. GPS is a US space-based radio-navigation system that provides positioning, navigation and timing services to civilian users on a continuous worldwide basis, freely available to all. For anyone with a GPS receiver, the system provides accurate location and time information in all weathers, day and night, anywhere in the world. However, from a security point of view, obtaining secure (that is  
\begin{table}
\begin{tabular}{p{14.2 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Scheme/Paper Year** & **Short Description** & **Practical Test-Bed Implementation** \\ \hline \multirow{8}{*}{[17]} & \multirow{8}{*}{2005} & \multirow{8}{*}{Proposes an authentication architecture and system to combat identity theft. The system combines a physical location cross-check (every user has a personal device, e.g., a cell phone or PDA, which can be used to securely detect location), a method for assuring the uniqueness of location claims, and a centralized verification process. Discusses extensively device cloning, theft, and device uniqueness. Location-based server authentication using secure Domain Name System (DNS) resolution and by leveraging Location Service proposed by the telecommunication industry. Proposes a mechanism to verify whether a mobile device currently resides within a geographical area at a given time, enabling the use of the location as an additional authentication factor. Addresses extensively trustworthiness, privacy, and practicability (uses the location of the phone as detected by the mobile network operator). & yes (lab prototype) \\ \cline{1-1} \cline{2-3}  & \multirow{8}{*}{2016} & \multirow{8}{*}{2015} \\ \cline{1-1} \cline{3-  
authentic) location information using just a GPS receiver and civil GPS signal is (still) not possible [44]. In practice, the authenticity of the GPS signal cannot be guaranteed because the signal can be spoofed, i.e., a false signal could be generated by a dedicated GPS signal simulator, and a typical (GPS) receiver would not be able to detect that. Some \"advanced\" GPS receivers have been enhanced with antispoofing modules in order to detect whether the GPS signal comes from the satellite or a fake GPS simulator. However, in recent years, more and more advanced GPS simulators have also become readily available (e.g., they can be hired relatively cheaply), and thus, it is not possible to guarantee that a GPS signal really comes from the \"right\" source or not. Some security solutions have tried to overcome a GPS signal authentication problem using additional components to certify the location information. For example, Denning & Doran defined in [34] a \"location signature sensor\" (LSS) tamper-proof device whose role is to create (and verify) a location signature (LS). An LS contains a geodetic position and is valid for a short time, like, for example, for 5 ms. Thus, an LS acts more or less like an unpredictable one-time password. Nevertheless, [PERSON] notes in [45] some critical points of this solution, such as \"this system only provides symmetric authentication and anyone able to verify the output of an LSS in a geographical region will also be able to fake the output of such a sensor from anywhere within the same region\".