Security and privacy in location-aware mobile systems

For centuries, methods to obtain location information were crucial for our economic success. While initially requiring expert training and cumbersome tools like astrolabes and compasses, advances in material and engineering sciences have brought the ability to determine one’s position on Earth to our fingertips. Devices as small and mobile as smart phones can now acquire and process location information. Fuelled by this new data source, social media companies immediately realised the potential to enhance their users’ experience and embedded location-based features into their products. Simultaneously, platforms which allow users to use location information as triggers for automation tasks emerged. Beyond these use cases for entertainment and convenience, recent advances in academic and industrial research have started to leverage location information for security and safety purposes. While the advantages of location-aware mobile systems to improve security are undisputed, methods to ensure the reliability of location information and minimise the impact on user privacy still require further research. In this dissertation, we aim to extend the knowledge about security and privacy implications of location information. To achieve this, we first analyse the different paths a mobile system can come in contact with this type of information. Based on these insights, we identify threats associated with the acquisition and processing of location claims. We recognise that in many cases, the absolute location of mobile devices is not needed but rather their constellation is sufficient. For example, the proximity of two devices can aid to validate location claims before relying on them for security or safety critical applications. We propose to use the trajectory a device takes to approach a location as that location’s fingerprint. To show the feasibility of this idea and its potential applications, we evaluate two scenarios: user authentication and collective awareness in future intelligent transportation systems. Finally, we analyse the consequences of data sharing for user privacy. More specifically, we investigate Vehicular Ad-hoc Networks (VANETs) as an open network where location information is essential to ensure its safe operation but also vastly available to malicious actors. We develop solutions to improve passenger privacy while providing more fine grained accountability in these networks which are a cornerstone in the future of intelligent transportation systems.