5G Positioning: Security and Privacy Aspects 301
and “location leakage or theft” (with techniques providing confidentiality and
authentication), discussed earlier in Section 13.5.1.3.
Unfortunately, the above solutions can be problematic in positioning schemes because
of limited communication or computation resources. Consider, for example, AGNSS
systems, where communication is unidirectional (from a satellite to a receiver) and the
bandwidth is very limited, preventing straightforward use of public‐key digital signatures [44]. Also, a system‐wide secret key is not a secure option, because building a
tamper‐proof device is extremely difficult (confer, side‐channel attacks [121]). If such a
system‐wide secret key would leak from any of the millions of AGNSS receivers, then
the whole system would be compromised. Solutions to this problem are available in the
open literature, in particular, for the Galileo European GNSS system which is planned
to offer authentication even for civilian use. Many of the proposed solutions are based
on the TESLA scheme [14], which replaces the requirement to compute expensive digital signatures for each communicated message with considerably cheaper cryptography.
Specifically, they authenticate messages with a secret‐key message authentication code
with a frequently changing key so that a key disclosure is delayed until the end of transmission with that key. Only the authenticity of the delayed key disclosure must be verified with expensive digital signatures and the rest is verified with the cheaper message
authentication code. A solution based on TESLA that was derived specifically for
Galileo is given in [93]. Similar solutions could be applied also in the case where a network includes trusted beacon nodes whose location is known (Section 13.6). In that
case, the end‐users’ devices can use the above techniques to ensure the integrity and
authenticity of the messages from the beacon nodes, in s similar way to the satellites in
the AGNSS setup.
13.10.2 Cryptographic Distance‐Bounding
If an entity, called here the verifier (e.g. LISP), needs to verify the location of an untrusted
entity, called here the prover (e.g. an end‐user’s device), then the above schemes are no
longer adequate, because the location provided by the prover cannot be trusted. Instead,
the verifier needs to have the means to obtain undeniable proofs about the prover’s
physical location.
Cryptographic distance‐bounding protocols give an upper bound for the distance
between two entities: a prover P and a verifier V. Typically, such distance‐bounding
protocols have been used successfully in RFID door access, road tolling, prisoner tagging or some wireless sensor network‐based applications [47,67].
Here we present the cryptographic distance‐bounding protocol introduced by Brands
and Chaum [101]. P generates k uniformly distributed bits m i , i = 1,…,k, and commits to
them using a cryptographically secure commitment scheme. The commitment prevents
P from changing m i and allows V to verify this in the end of the protocol. Also V generates the uniformly distributed bits a i with i = 1,…,k. After this, the actual distance‐
bounding phase takes place by repeating the following steps for i = 1,…,k:
a) V sends the bit a i to P;
b) P sends the bit b i = m i ⊕ a i to V immediately when it receives a i ; where ⊕ stands for
the exclusive‐or (xor) operation; and
c) V measures the time t i between sending a i and receiving b i .
and “location leakage or theft” (with techniques providing confidentiality and
authentication), discussed earlier in Section 13.5.1.3.
Unfortunately, the above solutions can be problematic in positioning schemes because
of limited communication or computation resources. Consider, for example, AGNSS
systems, where communication is unidirectional (from a satellite to a receiver) and the
bandwidth is very limited, preventing straightforward use of public‐key digital signatures [44]. Also, a system‐wide secret key is not a secure option, because building a
tamper‐proof device is extremely difficult (confer, side‐channel attacks [121]). If such a
system‐wide secret key would leak from any of the millions of AGNSS receivers, then
the whole system would be compromised. Solutions to this problem are available in the
open literature, in particular, for the Galileo European GNSS system which is planned
to offer authentication even for civilian use. Many of the proposed solutions are based
on the TESLA scheme [14], which replaces the requirement to compute expensive digital signatures for each communicated message with considerably cheaper cryptography.
Specifically, they authenticate messages with a secret‐key message authentication code
with a frequently changing key so that a key disclosure is delayed until the end of transmission with that key. Only the authenticity of the delayed key disclosure must be verified with expensive digital signatures and the rest is verified with the cheaper message
authentication code. A solution based on TESLA that was derived specifically for
Galileo is given in [93]. Similar solutions could be applied also in the case where a network includes trusted beacon nodes whose location is known (Section 13.6). In that
case, the end‐users’ devices can use the above techniques to ensure the integrity and
authenticity of the messages from the beacon nodes, in s similar way to the satellites in
the AGNSS setup.
13.10.2 Cryptographic Distance‐Bounding
If an entity, called here the verifier (e.g. LISP), needs to verify the location of an untrusted
entity, called here the prover (e.g. an end‐user’s device), then the above schemes are no
longer adequate, because the location provided by the prover cannot be trusted. Instead,
the verifier needs to have the means to obtain undeniable proofs about the prover’s
physical location.
Cryptographic distance‐bounding protocols give an upper bound for the distance
between two entities: a prover P and a verifier V. Typically, such distance‐bounding
protocols have been used successfully in RFID door access, road tolling, prisoner tagging or some wireless sensor network‐based applications [47,67].
Here we present the cryptographic distance‐bounding protocol introduced by Brands
and Chaum [101]. P generates k uniformly distributed bits m i , i = 1,…,k, and commits to
them using a cryptographically secure commitment scheme. The commitment prevents
P from changing m i and allows V to verify this in the end of the protocol. Also V generates the uniformly distributed bits a i with i = 1,…,k. After this, the actual distance‐
bounding phase takes place by repeating the following steps for i = 1,…,k:
a) V sends the bit a i to P;
b) P sends the bit b i = m i ⊕ a i to V immediately when it receives a i ; where ⊕ stands for
the exclusive‐or (xor) operation; and
c) V measures the time t i between sending a i and receiving b i .