Smartphones as Practical and Secure Location Verification Tokens for Payments

Marforio, Claudio; Karapanos, Nikolaos; Soriente, Claudio; Kostiainen, Kari; Čapkun, Srđjan

doi:10.14722/ndss.2014.23165

Cited by 59 publications

(21 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most of TEE applications defined in the literature are designed for smartphones. It is used to provide a wide range of secure services: ticketing [54], [55], privacy-friendly public transport ticketing [56], online transaction confirmation [57], privacyfriendly online prepaid mobile payment [58], [59], media content protection [60], [61], authentication to access cloud storage services [62], [63], two factor authentication [64], [65], and trusted sensors [66].…”

Section: B Applicationsmentioning

confidence: 99%

Trusted Execution Environment: What It is, and What It is Not

Sabt

Achemlal

Bouabdallah

2015

2015 IEEE Trustcom/BigDataSE/Ispa

429

186

View full text Add to dashboard Cite

Nowadays, there is a trend to design complex, yet secure systems. In this context, the Trusted Execution Environment (TEE) was designed to enrich the previously defined trusted platforms. TEE is commonly known as an isolated processing environment in which applications can be securely executed irrespective of the rest of the system. However, TEE still lacks a precise definition as well as representative building blocks that systematize its design. Existing definitions of TEE are largely inconsistent and unspecific, which leads to confusion in the use of the term and its differentiation from related concepts, such as secure execution environment (SEE). In this paper, we propose a precise definition of TEE and analyze its core properties. Furthermore, we discuss important concepts related to TEE, such as trust and formal verification. We give a short survey on the existing academic and industrial ARM TrustZone-based TEE, and compare them using our proposed definition. Finally, we discuss some known attacks on deployed TEE as well as its wide use to guarantee security in diverse applications.

show abstract

Section: B Applicationsmentioning

confidence: 99%

Trusted Execution Environment: What It is, and What It is Not

Sabt

Achemlal

Bouabdallah

2015

2015 IEEE Trustcom/BigDataSE/Ispa

429

186

View full text Add to dashboard Cite

show abstract

“…AdAttester (Li et al 2015) uses TrustZone to secure online mobile Ad attestation, leveraging the secure world of TrustZone to implement unforgeable clicks and verifiable display. (Marforio et al 2014) uses TrustZone to ensure the trusted execution environment for the payment process. Similar to the two solutions, IM-Visor aims to protect one certain functional service in Android, but IM-Visor is more comprehensive as the trustlet in IM-Visor needs to complete some functional operation and needs more interaction with Android framework while the trustlet in other two solutions mainly complete the operation such as signature and encryption.…”

Section: Related Workmentioning

confidence: 99%

Using IM-Visor to stop untrusted IME apps from stealing sensitive keystrokes

et al. 2018

View full text Add to dashboard Cite

Third-party IME (Input Method Editor) apps are often the preference means of interaction for Android users' input. In this paper, we first discuss the insecurity of IME apps, including the Potentially Harmful Apps (PHAs) and malicious IME apps, which may leak users' sensitive keystrokes. The current defense system, such as I-BOX, is vulnerable to the prefix substitution attack and the colluding attack due to the post-IME nature. We provide a deeper understanding that all the designs with the post-IME nature are subject to the prefix-substitution and colluding attacks. To remedy the above post-IME system's flaws, we propose a new idea, pre-IME, which guarantees that "Is this touch event a sensitive keystroke?" analysis will always access user touch events prior to the execution of any IME app code. We design an innovative TrustZone-based framework named IM-Visor which has the pre-IME nature. Specifically, IM-Visor creates the isolation environment named STIE as soon as a user intends to type on a soft keyboard, then the STIE intercepts,Android event sub translates and analyzes the user's touch input. If the input is sensitive, the translation of keystrokes will be delivered to user apps through a trusted path. Otherwise, IM-Visor replays non-sensitive keystroke touch events for IME apps or replays non-keystroke touch events for other apps. A prototype of IM-Visor has been implemented and tested with several most popular IMEs. The experimental results show that IM-Visor has small runtime overheads.

show abstract

“…However, this requires large scale retrofitting of cellular celltowers or installation of new hardware, neither of which is practical at large geographic scales. Others propose to embed tamperproof location hardware on mobile devices [32,38], which incurs high cost per user, and is only effective if enforced across all devices. For our purposes, we need a scalable approach that works with current hardware, without incurring costs on mobile users or the map service (Waze).…”

Section: Defensesmentioning

confidence: 99%

Defending against Sybil Devices in Crowdsourced Mapping Services

Wang

et al. 2016

Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services

View full text Add to dashboard Cite

Real-time crowdsourced maps such as Waze provide timely updates on traffic, congestion, accidents and points of interest. In this paper, we demonstrate how lack of strong location authentication allows creation of software-based Sybil devices that expose crowdsourced map systems to a variety of security and privacy attacks. Our experiments show that a single Sybil device with limited resources can cause havoc on Waze, reporting false congestion and accidents and automatically rerouting user traffic. More importantly, we describe techniques to generate Sybil devices at scale, creating armies of virtual vehicles capable of remotely tracking precise movements for large user populations while avoiding detection. We propose a new approach to defend against Sybil devices based on co-location edges, authenticated records that attest to the one-time physical co-location of a pair of devices. Over time, colocation edges combine to form large proximity graphs that attest to physical interactions between devices, allowing scalable detection of virtual vehicles. We demonstrate the efficacy of this approach using large-scale simulations, and discuss how they can be used to dramatically reduce the impact of attacks against crowdsourced mapping services. of this attack against our own vehicles, quantifying the accuracy of the attack against GPS coordinates. Magnified by an army of ghost riders, an attacker can potentially track the constant whereabouts of millions of users, all without any risk of detection. Defenses.Prior proposals to address the location authentication problem have limited appeal, because of reliance on widespread deployment of specialized hardware, either as part of physical infrastructure, i.e., cellular base stations, or as modifications to mobile devices themselves. Instead, we propose a practical solution that limits the ability of Sybil devices to amplify the potential damage incurred by any single attacker. We introduce collocation edges, authenticated records that attest to the one-time physical proximity of a pair of mobile devices. The creation of collocation edges can be triggered opportunistically by the mapping service, e.g., Waze. Over time, collocation edges combine to form large proximity graphs, network structures that attest to physical interactions between devices. Since ghost riders cannot physically interact with real devices, they cannot form direct edges with real devices, only indirectly through a small number of real devices operated by the attacker. Thus, the edges between an attacker and the rest of the network are limited by the number of real physical devices she has, regardless of how many ghost riders are under her control. This reduces the problem of detecting ghost riders to a community detection problem on the proximity graph (The graph is seeded by a small number of trusted infrastructure locations).Our paper includes these key contributions:

show abstract

Smartphones as Practical and Secure Location Verification Tokens for Payments

Cited by 59 publications

References 26 publications

Trusted Execution Environment: What It is, and What It is Not

Trusted Execution Environment: What It is, and What It is Not

Using IM-Visor to stop untrusted IME apps from stealing sensitive keystrokes

Defending against Sybil Devices in Crowdsourced Mapping Services

Contact Info

Product

Resources

About