CARPOOL: Secure And Reliable Proof of Location

Sayon Duttagupta; Dave Singelée; Xavier Carpent; Takahito Yoshizawa; Farhad Aghili; Aysajan Abidin; Bart Preneel

Paper 2025/1502

CARPOOL: Secure And Reliable Proof of Location

Sayon Duttagupta

, COSIC, KU Leuven

Dave Singelée

, DistriNet (Group T), KU Leuven

Xavier Carpent

, University of Nottingham

Takahito Yoshizawa

, COSIC, KU Leuven

Farhad Aghili, Sirris

Aysajan Abidin

, COSIC, KU Leuven

Bart Preneel

, COISC, KU Leuven

Abstract

Multiple authentication solutions are widely deployed, such as OTP/TOTP/HOTP codes, hardware tokens, PINs, or biometrics. However, in practice, one sometimes needs to authenticate not only the user but also their location. The current state-of-the-art secure localisation schemes are either unreliable or insecure, or require additional hardware to reliably prove the user's location. This paper proposes CARPOOL, a novel, secure, and reliable approach to affirm the location of the user by solely relying on location-bounded interactions with commercial off-the-shelf devices. Our solution does not require any additional hardware, leverages devices already present in a given environment, and can be integrated effortlessly with existing security components, such as identity and access control systems. To demonstrate the feasibility of our work and to show that it can be deployed in a realistic closed environment setting, we implemented a proof of concept realisation of CARPOOL on an Android phone and multiple Raspberry Pi boards and integrated CARPOOL with Amazon Web Services (AWS) Cognito.

Metadata

Available format(s): PDF
Category: Applications
Publication info: Published elsewhere. Minor revision. ACM SACMAT 2026
DOI: 10.1145/3750555.3811885
Keywords: Location-based Authentication IoT
Contact author(s): sayon duttagupta @ esat kuleuven be
dave singelee @ kuleuven be
xavier carpent @ nottingham ac uk
takahito yoshizawa @ esat kuleuven be
farhad aghili @ sirris be
aysajan abidin @ esat kuleuven be
bart preneel @ esat kuleuven be
History: 2026-05-05: revised; 2025-08-20: received; See all versions
Short URL: https://ia.cr/2025/1502
License: CC BY

BibTeX

@misc{cryptoeprint:2025/1502,
      author = {Sayon Duttagupta and Dave Singelée and Xavier Carpent and Takahito Yoshizawa and Farhad Aghili and Aysajan Abidin and Bart Preneel},
      title = {{CARPOOL}: Secure And Reliable Proof of Location},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/1502},
      year = {2025},
      doi = {10.1145/3750555.3811885},
      url = {https://eprint.iacr.org/2025/1502}
}