A Proof-of-Location (POL) system is used to issue a proof-of-location token ($pol$) to a user who has been present at a location$\ell oc$, such that it can be later presented to a verifier to assure the presence of the user at$\ell oc$. Basic POL security requirements areunforgeabilityof$pol$, and itsnon-transferability(a$pol$issued to user$u_1$cannot be used by$u_2$). An additional important property of POL systems isuser privacyagainst the issuers and verifiers. We make two contributions. First, we formalize the POL security and privacy properties, and construct the first system providing provable security and privacy against the issuer and the verifier, both. Second, we introduce ageo-tampering attackthat completely breaks POL system security, by simply changing the location of a$pol$issuing node. The attack applies to portable infrastructure nodes that are not continually monitored. We propose an algorithm that is used by a$pol$issuer to provide a location integrity “proof”, that will be embedded in a$pol$to protect against this attack. The proof relies on a novel application of euclidean Distance Matrices. We implemented our POL on an off-the-shelf Android smartphone to show the practicality of the proposed algorithms.

We propose a privacy enhanced location verification system that uses in-region location verification to verify if a location claim is from within an area specified by a policy. The novelty of our work is the use of distance bounding protocols to construct a pseudo-rectangle (P-rectangle) that optimizes coverage of the policy area, and uses it to verify the claim with respect to the P-rectangle, thereby minimizing error. We propose a privacy enhancement for the system that ensures that the prover's location cannot be inferred by an adversary who monitors protocol messages. We discuss our results and propose directions for future research.