Location Assurance and Privacy in Location-based Services

The author was employed at the University of Luxembourg and supported by the Fonds National de la Recherche Luxembourg (FNR) in the project " Secure and Private Location Proofs: Architecture and Design for Location Based Services " (reference SECLOC 794361). Part of the research in this thesis is funded by the European Space Agency (ESA) project " Developing a Prototype of Localisation Assurance Service Provider (LASP) " (contract number 000102584-10-NL-HE), in collaboration with itrust consulting s. ` Summary Nowadays, most mobile devices are equipped with positioning capabilities thanks to the free and ubiquitous access to global navigation satellite systems (GNSS) such as the global positioning system (GPS). With such mobile devices, people are able to obtain their precise locations, which in turn leads to a wide range of location-based services (LBS). Through an LBS, a user can acquire information customised to his locations. However, the vulnerabilities of GNSS systems and the exposure of information such as locations and queries in LBS requests impose a strong need from users on security. In this thesis, we study two security requirements in LBSs: location assurance and privacy. Location assurance expresses users' requirement for trustworthy locations in terms of correctness and precision. To make use of LBSs, users rely on positioning systems to calculate their locations. However, these systems are vulnerable to attacks which can maliciously affect the calculation of locations. For instance, GPS suffers from spoofing attacks which can fool GPS receivers to calculate incorrect locations by sending false satellite signals. These attacks degrade the precision of calculated locations or even result in incorrect ones. Privacy addresses users' concern about personal information leakage in LBSs. To make use of an LBS, a user needs to expose his location and query to an LBS provider. When such information is abused, for instance, by attackers who eavesdrop the public channel used for sending LBS requests or malicious LBS providers, users' private information such as habits and occupations will be inferred. Two types of privacy in LBSs have been identified in the literature and will be discussed in this thesis: query privacy and location privacy, which are related to privacy leakage from what users asked and where users went, respectively. The first part of this thesis considers the vulnerability of GNSS systems to spoof-ing attacks and presents a trust framework to detect spoofing by evaluating the integrity of GNSS signals. The framework combines existing spoofing detection …