Any real world examples of GPS location data being used with authentication?

Question

Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?

Specifically

• Highlighting new or unusual locations
• Simultaneous / concurrent usage (a session in the US and also in China may be indicative of an attack)
• Reduced PW challenges for "known" locations

I'm interested in using Browser Location data, source IP, GPS (on phone devices) or any other metatata that can be used to identify and separate "good "authentication sessions from "bad" sessions.

By the way: Confused deputy attacks are out of scope for this, since that attack will likely have valid location data. I'm mainly focused on validating good sessions, or challenging risky sessions instead of or in combination with a permanent cookie

What I hope to learn is how the implementer has addressed roaming users, VPNs and other data validation techniques. I'd also be interested in seeing the "user story" on what process flow would look like.

Answer 1

I attended a workshop for Splunk a few months ago. Splunk, if you are unfamiliar with it, is a type log viewer. You can find more out about them at their website: http://www.splunk.com. Essentially, you dump all of your log data into one place, and then analyze it, correlate, report on it, etc.

One of the use cases for Splunk was to correlate VPN logs with Physical Badge access logs. An alert was drafted so that if a user was signed into the VPN and used their access badge in the building, it would flag it and notify on that event. You could use really any sort of logs, I could see an example case where a user signs in from an IP address in Kansas and had done so for the last 30 days, now all of sudden they sign in from an IP address in Canada. Splunk could detect that and alert on it.

Splunk is free for up to 2 GB of data per day, so if you have the data, you could begin testing something like this. The trick is getting the log data in a location so that you can dig through it.

Answer 2

A similar idea has been proposed in the following research papers:

• Short Paper: Smartphones: Not Smart Enough?, Ian Fischer, Cynthia Kuo, Ling Huang, Mario Frank, ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM 2012).

• Intuitive security policy configuration in mobile devices using context profiling, Aditi Gupta, Markus Miettinen, N. Asokan. Technical report CERIAS-2011-13.

Here's one version of a proposed scheme:

They propose using location to make unlock PIN codes more convenient for smartphones. In particular, the phone remembers the locations where you've unlocked the phone before. If you've unlocked the phone before at a particular location (or unlocked it several times at that location), the phone infers that it is a safe location, and in the future doesn't require you to unlock your phone when you are in that location.

The idea is that if a thief steals your phone, they are probably going to run off with the phone and then try to use it in some other location -- and that other location won't be one where you've unlocked the phone before, so the thief won't be able to access your phone. However, when you use your phone from (say) your home or your office, the phone will recognize it is in a safe location and automatically unlock, sparing you from having to enter a PIN code. Thus, you get the security benefits of a PIN lock code, with greater convenience.

I don't know of anyone who has implemented this.