Location Based Trust for Mobile User

1
Location Based Trust for Mobile User Generated
Content Applications, Challenges and
Implementations
USC

• Presented By Anand Dipakkumar Joshi

2
Paper
USC

• Vincent Lenders
• Emmanouil Koukoumidis
• Pei Zhang
• Margaret Martonosi
• DEPT. of Electrical Engineering
• Princeton University

3
Agenda
USC

• Introduction
• Application
• Verification System for Mobile contents
• Localization / Certificate Services Implementation

4
Introduction
USC

• Advance in Web 2.0
• You Tube , Facebook , Flickr , Wikipedia ,
  Blogger , Orkut etc .
• Advance in Gadgets
• Mobiles , PDA , Camcorder , High end cameras etc
  .
• User generated contents
• Blogs
• Podcasts
• Sharing of video on you tube
• etc .
• Social Networking with sharing of videos ,
  pictures , data etc .

5
Introduction (cont )
USC
YOU TUBE
Content Producer
Content Consumer
6
Introduction (cont )
USC

• How to trust authenticity and quality of
  published information ?
• How to provide consumer a level of trust for the
  content provided by the mobile user ?
• How to protect the identity and privacy of the
  content producer ?

Protection from malicious producers
Protection from malicious consumers
7
Introduction (cont )
USC

• Solution
• Application of traditional identity based
  security.
• Application of trusted geotagging service.
• Benefits
• Consumers know where and when the data has been
  actually published.
• Trust relation between the content providers and
  consumers in this open system.
• Protection from Sybil attack.

8
Application
USC

• NEWS
• Photo Sharing
• Distributed Sensing
• Filtering Email Spam
• Mapping Data
• Traffic Updates

9
Verification System for mobile contents
USC

• Design Goals
• Generality
• Scalability
• Retain user privacy / anonymity
• Support for users mobility
• Support for content mobility

10
Verification System for mobile contents (cont )
USC

• System Overview

Localization / Certificate Authorities
Ask to verify certificate / CAs public key
SHA
DLT Certificate
Untrusted Network
Content Producer
Content Consumer
11
Verification System for mobile contents (cont )
USC

• Trust Model
• Content producers
• They can verify the location from the certificate
  issued to them by CA.
• They trust the certificate issuing authority that
  they do not store and revel information about the
  content producers and maintain their privacy and
  anonymity.
• Content consumers
• They trust the certificate issuing authority that
  they only issue certificate to genuine content
  producers.
• Privacy Issues
• Producer at risk of potential attack
• Producer has lot of contents
• Content created is not at heavily populated
  location.
• Solution
• Needs to specify the level of accuracy and
  anonymity for location and time values.
• Accuracy of coordinates depends on privacy E.g.
  blurring of coordinates and time values.

12
Verification System for mobile contents (cont )
USC

• Possible Attacks
• Mobility Attack
• Botnet Attack
• Delay Attack
• Mobility Considerations
• Assign multiple DLT to content, allowing one to
  track the mobility of the content over the
  creation time.
• Helps to know the path on which the content is
  captured before its delivered to content
  consumers.

13
Verification System for mobile contents (cont )
USC

• Alternative Certificate Mechanisms

Verify Data
SHA
Untrusted Network
Content Producer
Content Consumer
14
Localization Service Implementation
USC

• Secure Wireless Location
• Satellite Based positioning
• GPS based systems to determine location
• Tower localization
• Use of cell phone towers to determine location.
• 802.11 access points
• Hybrid
• GPS / infer location information from past data
  using cell location
• Used by Yahoo!s ZoneTag

15
Certificate Service Implementation
USC

• Certificate Authority
• Centralized
• Implicit trust given to central authority.
• Central server is responsible for verifying the
  location the generator is claiming to have and
  issues corresponding DLT certificate.
• It assumes that the content producer have an
  access to the server by any means.
• The certificate makes possible for the authority
  to track him and invade his privacy.
• More susceptible to denial of service attack.

S
16
Certificate Service Implementation (cont )
USC

• Certificate Authority
• Decentralized
• Users ask multiple devices to obtain multiple DLT
  certificate.
• The generating device will keep track of the
  trustworthy level of the other nodes.
• Receivers of the data query the DLT certificate
  source nodes to validate the data, or simply work
  offline if the certificate resources are known.
• Here the public key is device specific and not
  user specific.
• System more scalable than the centralized method.
• Difficult to fake an authentication.
• Overhead of the system is high.
• Prone to Sybil attack if the community contains
  more fake devices.
• To verify the certificate the receiver device
  must be online as well as the sender device also
  must be online

17
Certificate Service Implementation (cont )
USC

• Certificate Authority
• Community Model
• Somewhat similar to distributed method.
• Community of devices will vote and decide on
  trust level of certificates.
• Multiple certificate issuers are voted on by its
  users.
• This decides different weights and trust levels
  associated with them
• Scheme adopted by Digg and reputation scheme in
  eBay.
• Community gets votes on each others trust level.
• Super Users can boast or reduce the trust level.

18
Conclusion
USC

• Beneficial to many applications where trust is
  associated with time and location.
• Tagging of a content is done using location and
  time and not on users identity. Hence user
  privacy is maintained.
• System increases the difficulty to tag the
  contents with false locations unless they move to
  that location to tag it.
• Thus by limiting various attack, it proves to be
  a good verification service based on location and
  time for user generated data.

19
References
USC

• Paper "Location-based Trust for Mobile
  User-Generated Contents Applications, Challenges
  and Implementations, Vincent Lenders, Emmanouil
  Koukoumidis, Pei Zhang and Margaret Martonosi,
  The 9th IEEE Workshop on Mobile Computing Systems
  and Applications (HotMobile 2008), Feb 2008
• Web Resources
• http//www.flickr.com/tour/maps/
• http//www.wunderground.com/wundermap/
• http//www.wikipedia.org/

20
Questions ???