LRAP: A Location-Based Remote Client Authentication Protocol for Mobile Environments

Mobile networks are driven by the need to provide more advanced services to mobile or nomadic computing devices, such as security services requiring remote client authentication. In such services, the user's location might be used as authentication factor, in addition to the typical authentication factors, like passwords, or one time tokens combined with the use of a physical device that a person owns, such as a card or a phone. Since the location information itself is subject to forging attacks, additional mechanisms must be used to certify its integrity. We propose LRAP, a novel protocol combining several authentication factors to securely authenticate a mobile user. In LRAP, the user's location can be determined and its correctness is certified by a third trusted party, called Local Element. As use case, we considered the payment service at the self-service gas stations, a widely available service vulnerable to several types of security attacks, and we proposed an LRAP-based service exploiting one time codes and certified position for secure payment operations.