Providing trustworthiness to the operation of location based services in mobile networks

Abstract

The development of low-cost, ubiquitous, wireless systems is leading to a future where location will define the next generation of computing applications. Location Based services (LBS) use location information as the basis for providing enhanced services to a mobile user. The development of LBS is still in a relatively young stage and many questions and challenges must be addressed before a robust, secure and trustworthy LBS system can be successfully developed. This thesis takes the viewpoint that the eventual successful development of LBS can be accomplished, if the system is carefully designed and appropriate techniques are integrated. In particular, this thesis maps out three steps needed to achieve the security and trustworthiness requirement: first, identify the security policies that regulate the LBS application; second, use appropriate mechanisms to enforce the security policies; and third, put the whole system into a secure framework to prevent manipulation by unscrupulous entities participating in the service. In this thesis, we first capture the essential features of policies that regulate an LBS and formulate a security policy model. Then in order to enforce the security policies it is essential to get the accurate location information of the users. We propose to use the environmental data from embedded sensor networks to support localization and position verification, and prove its viability through experiments. Further, we present a key distribution based location verification scheme. Particularly in this part, we investigate the relationships between the transmitter deployment density, the number of keys received and the location verification accuracy. Next, we take the viewpoint that the risk of location spoofing can be bypassed when an LBS infrastructure does not rely on a localization procedure to enforce the security policies. We show how this is made possible in spatio-temporal access control applications when we use the key distribution method. Finally, we study a practical Mobile Location Based Service (MLS) and present an ultimate MLS framework and communication protocols that represent a culmination of the mechanisms we have examined in this thesis and support the primary theme of this thesis, which is that it is possible to design a secure location based service using an appropriate combination of tools.