# QuietPlace: An Ultrasound-Based Proof of Location Protocol with Strong Identities
## 3 A Proposal for Strong Identities  
Most of the protocols in literature prove the location of the user's device, but not of the user themselves. The user can still give their device to others or even login with their credentials on many devices. In cases where higher security standards are required--i.e., in a crime investigation--most protocols fail to provide a PoL for the user of the device, making the protocol useless. PoL protocols rely on a procedure which inserts intermediates between the users. The intermediates are the devices that execute the protocol. However, although the devices belong to physical users, they must be with them at the time of the proof's creation. As a result, to provide a complete PoL for the user of the device, three correlations must be made:  
1. Correlation A relates the witnesses to a particular location. It is satisfied by either trusted devices with known location or by other users' devices that determine their position using a localization method, such as GPS. The PoL protocol itself may provide an infrastructure and a mechanism for localization [3]. 2. Correlation B relates the user's device (prover) with the witnesses. It is satisfied by the PoL protocol executed between the prover and witnesses. The aim is to certify that the prover is near the witnesses at the specific time. Most PoL protocols in the bibliography make only this correlation. They certify that the device with the user's credentials is in the vicinity of the witnesses. However, there can be many prover devices carrying the same user's credentials. Thus, connection B does not bind the user to the location. 3. Correlation C relates the user with the device, at the specific time that the PoL protocol is executed. In order to satisfy this connection, a medium is produced by the prover during the protocol session. This medium certifies that the prover is at the user's possession during the PoL creation. It is called'strong identity', because it does not only certify the location of the device, but also the location of the user per se. A PoL protocol may satisfy all of the above correlations. At the very least, it must satisfy B. The connections between the entities during the collection of LPSs are depicted in Figure 1.  
In [13], strong identities are satisfied by exchanging a medium in a challenge-response schema between the witness and prover. We briefly discuss the authors' proposals. In the simple case, the prover just sends a photo that includes the user of the device to the witness. However, this test is not sufficient on its own, since a malicious user can reuse an old saved photo of themselves. As such, the authors include a random number (nonce) in the procedure. The witness sends the nonce to the prover and then, the user must write this number on a piece of paper and send a photo that incudes themselves and the written number as a response to the witness. This method prevents using an old saved photo; however, a malicious user can still have a saved template of themselves (i.e., themselves holding a blank piece of paper) and add the required nonce by using photo manipulation software. Figure 1: Entities participating in the creation of a proof of location with strong identities. Apart from using pictures, the authors investigate the possibility of using voice recordings as the identifying medium. They propose that the witness sends a unique sentence as a challenge to the prover. The user of the prover device must record themselves reading that sentence and send the recording back to the witness as a response. However, another's voice that resembles the one of the legitimate user may be used, with or without editing. Also, the user can have saved prerecorded words in their device and let the device assemble the required sentence by using audio editing software. In the second case, the result would be probably very unnatural. In all of the above scenarios, replay attacks should be taken into consideration.