# SAM-PAY: A Location-Based Authentication Method for Mobile Environments +
## 2 Related Work  
Authentication is the act of establishing or confirming something (or someone) as authentic, such as confirming the identity of a person. Often, a combination of authentication factors is employed for user authentication. For example, using a card and a PIN, we have a two-factor authentication. [PERSON] noted in [24] that two-factor authentication is not adequate for security problems encountered today since \"it won't defend against phishing. It's not going to prevent identity theft. It's not going to secure online accounts from fraudulent transactions. It solves the security problems we had ten years ago, not the security problems we have today\". Historically, biometric identification (such as fingerprints) has been used as the most authoritative method of authentication, but court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Moreover, they can be used only locally, such as to unlock devices used for authentication supporting asymmetric cryptography, as in FIDO [25]. Other biometric methods are promising (such as retinal and fingerprint scans) but have shown themselves to be easily spoofable in practice. [PERSON] notes in [26] that new, cost-effective technology tools should be in every bank's online security arsenal to protect their customers against security fraud. Geolocation information has been used in the past in several location-based services, such as emergency and information services [27, 28], tracking and monitoring systems [29], or even for establishing pairwise keys in the sensor networks [30]. Sensor networks are the ideal candidate for a wide range of applications like military operations, health monitoring, and data acquisition in hazardous environments, and sensor location plays a fundamental role in fulfilling their task. In the presence of attackers, most localization protocols for sensor networks are vulnerable to hostile environments [31]. In such contexts, some schemes like [32], also have methods for location estimation that tolerate malicious attacks against beacon-based location discovery. The beacon nodes are assumed to know their location, e.g., through GPS receivers, while the non-beacon nodes receive radio signals called beacon signals from the beacon nodes. Without protection, an attacker can mislead the location estimation at sensor nodes and subvert their normal operation. Thus, each beacon packet should provide authentication with a cryptographic key only known to the sender and intended receivers, while a non-beacon node should accept a beacon signal only when the beacon packet (carried by the beacon signal) can be authenticated. Other works have also considered insider attacks in wireless sensor networks [33] and proposed solutions for providing location-aware end-to-end data security in such networks. In the security field, some location-authentication schemes have been proposed [34, 35], but location authentication is still considered a novel security service [36], mainly because location data need to be authenticated or certified by a trusted third party in order to be considered reliable [37]. Prominent among those tools is geolocation technology that determines the true geographic location (the country, state, or even city) of an online customer when they log into a bank website. When access to the account is made from a mismatched or unknown location, the bank's website could apply additional authentication measures. Thus, geolocation would not be just a fancy feature but may prove beneficial in a multifactor authentication strategy. This fact is also indicated in the guidance document released by the Federal Financial Institutions Examination Council (FFIEC) on authentication in the Internet-banking environment [38]. Moreover, in the past, some research proposals have explored the possibility of enhancing server authentication with location verification. For example, [PERSON] et al.