# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 2 Related Work
Other solutions, like [46], propose to exploit the location-positioning capabilities of a wireless network to check out the location information. Specifically, the wireless network is instructed to determine whether the GPS position supplied by the node (directly or encrypted) is consistent with the network's own internal signal measurements. The return of low consistency would imply that the node has tampered its position identifier, and likely represents a malicious threat. Other solutions proposed to guarantee the authenticity of location information against the most common location-related attacks are briefly presented in [36]. Concerning the security of mobile banking, some security shortfalls in mobile-banking implementations [47] include authentication problems with GSM network, SMS/GPRS protocols, and security problems with the current bank's mobile-banking solutions [48; 49; 50]. [PERSON] et al. [51] proposed, for example, a secure SMS message, in case a secure messaging protocol is used, and a secure GPRS (SGP) protocol used to create and conduct secure connections between mobile devices (acting as clients) and the bank servers (acting as servers). In the secure SMS solution, the authentication is performed by simply validating the message PIN with the receiver's stored PIN. The PIN has been previously selected by the user when he registered for a mobile-banking account. Thus, the authentication strength depends on the password policy (stating PIN length and syntax) used. For the confidentiality of the messages, the scheme employs symmetric cryptography. The key used for encryption is generated from the one-time password entered by the user. The one-time passwords are only known by the server and the user. The server stores the one-time password in its database. The password is indexed by the account identifier and the sequence number. Thereafter, the server uses the retrieved password as the decryption key to decode the encrypted contents. If the decryption is successful, the used OTP is discarded, and the server sequence counter for that account is incremented by 1. In the SGP protocol, mutual authentication is established using certificates: each mobile application is packed with the server's certificate, and in this certificate, there is the server's public key, which is used to authenticate the server. The server also uses the client's SGP certificate to authenticate the clients. We think both approaches have intrinsic drawbacks: using just PIN-based authentication might not be secure enough because the users are often not cautious with their password selection [52], while in the second case, it is necessary to use SGP certificates, which are not available on most mobile devices. In our solution, we try to exploit data that are already available on most platforms (suchas the location data provided by the GPS receivers) or that can be easily configured or generated (such as static passwords or one-time passwords) in order to obtain an adaptive security solution. [PERSON] et al. [53] proposed, instead, a geolocation-based QR-code authentication scheme using mobile phones, which is resistant to ART (Active Real-Time) MITM phishing attacks. In this attack, an attacker collects authentication data (e.g., OTP, ID/password, a two-channel number from a user in plaintext) and then forwards this information to log into a web server. This solution combines the login history of the user's computer and location-based mutual authentication by assuming that the user already has an account on the web server and that the user and the web server share a (secret) key. [PERSON] et al. [40] designed and implemented an authentication mechanism that uses the location of a mobile phone as detected by the mobile network operator instead of relying on the location detected by the phone itself. Their approach has used an anonymous credential system to follow the privacy-by-design principle to ensure that sensitive information, e.g., location and subscriber data, are only revealed to parties that need to know.