Graduated Trust Gating for IoT Location Verification: Trading Off Detection and Proof Escalation

1. Problem Statement

IoT location services (e.g., geofencing, proximity triggers) typically rely on client-reported GPS coordinates, which are trivially spoofable using consumer-grade tools (mock-location APIs or software-defined radio).

• The Limitation of Current Solutions: Existing spoofing detectors (sensor fusion, RAIM, ML classifiers) output a binary decision (Accept/Deny). This forces a rigid trade-off:
  • Strict Thresholds: High False Denial Rates (FDR), blocking legitimate users.
  • Lenient Thresholds: High False Accept Rates (FAR), allowing spoofers through.
• The Gap: There is no mechanism to handle "borderline" cases where a detector is uncertain. A binary gate cannot distinguish between a high-confidence legitimate user and a sophisticated attacker without sacrificing usability or security.

2. Methodology: Graduated Trust Gating

The authors propose a three-level decision layer that converts an imperfect lightweight detector into a robust access-control mechanism.

A. The Trust Scoring Engine

The system computes a continuous Trust Score ($T$) based on a weighted sum of multiple signals ($T = \sum w_i s_i$).

• Signals Used:
  1. Movement (S1): Speed plausibility (penalizes $>50$ m/s).
  2. Accuracy (S2): Flags unrealistically high accuracy (common in simulators).
  3. Temporal (S3): Detects "teleportation" violations in history.
  4. Fix Consistency (S4): RAIM-inspired scatter vs. accuracy ratio.
  5. Network (S5): Discrepancy between GPS position and cell/Wi-Fi hints.
• Adaptability: The system supports signal ablation. If certain signals (e.g., network data) are unavailable, weights are dynamically reallocated to remaining signals to maintain functionality.

B. The Three-Level Gate

Instead of a binary output, the gate maps the score $T$ to one of three actions based on thresholds $\theta_p$ (proceed) and $\theta_s$ (step-up):

1. PROCEED ($T \ge \theta_p$): Immediate access granted.
2. STEP-UP ($\theta_s \le T < \theta_p$): The request is routed to a stronger verifier (e.g., a Zero-Knowledge Proximity Proof like Groth16).
3. DENY ($T < \theta_s$): Access immediately blocked.

C. Session Latch Mechanism

To prevent attackers from "recovery" after a suspicious event, the system implements a session latch:

• Once a session transitions to STEP-UP or DENY, the state is latched.
• All subsequent location fixes in that session inherit the latched state, regardless of whether their individual scores improve.
• A DENY latch persists until the session restarts; a STEP-UP latch clears only after successful external verification.

3. Key Contributions

1. Graduated Gate Design (C1): A tunable mechanism that trades off False Accept Rate (FAR) against user friction (proof overhead) via a single threshold $\theta_p$. It allows strict security thresholds without penalizing legitimate users who fall into the "uncertain" zone.
2. Minimal Signal Configuration (C2): Through signal ablation, the authors identified that a two-signal configuration (Temporal + Network) achieves an F1 score of 0.84, outperforming the full five-signal set in specific sparse contexts. This is ideal for resource-constrained IoT endpoints.
3. Robustness Analysis (C3): Demonstrated that legitimate traffic consistently scores above the proceed threshold ($\theta_p$) even under six different signal-degradation scenarios (e.g., missing network data, intermittent GPS fixes), ensuring zero False Denial Rates (FDR) for legitimate users.

4. Experimental Results

The evaluation used 10,000 synthetic traces and real-world traces from an Android smartphone (Jelly Star).

• Performance vs. Binary Gates:
  • At a strict threshold ($\theta_p = 0.9$), a standard binary gate incurs a 0.05% FDR (blocking legitimate users).
  • The Graduated Gate maintains 0.00% FDR at the same threshold by routing borderline legitimate traffic to the "Step-Up" verifier instead of denying it.
  • The False Accept Rate (FAR) remains identical (11.4%) for both, but the graduated gate improves operational safety by recovering legitimate traffic.
• Real-Device Validation:
  • Honest Users: 100% of legitimate walking/stationary traces passed the gate.
  • Teleportation Attack: A mock location jump (~10,000 km) triggered a score of 0.22, resulting in DENY. The session latch successfully blocked all 31 subsequent fixes in that session.
  • Nearby Mock Attack: A subtle spoof (~550m deviation) evaded a lenient threshold ($\theta_p=0.7$) but was correctly routed to STEP-UP at a strict threshold ($\theta_p=0.9$).
• Overhead:
  • Trust scoring (V2, 5 signals) takes a median of 4.9 µs on a mobile device, which is negligible compared to cryptographic verification costs.

5. Significance and Conclusion

This work addresses a critical gap in IoT security: the inability of binary detectors to handle uncertainty without compromising usability.

• Paradigm Shift: It moves from "perfect detection" to "risk management." The system does not need a perfect detector; it only needs to separate high-confidence traffic from the rest, delegating the rest to a stronger, more expensive verifier.
• Practicality: The solution is lightweight enough for constrained IoT devices (microsecond scoring) while providing a scalable security model (escalation to ZK-proofs).
• Future Work: The authors note that the "Step-Up" evaluation currently assumes an idealized oracle. Future work must validate the success rates of real-world step-up mechanisms (e.g., TEE-backed proofs) across diverse device classes.

In summary, the Graduated Trust Gate enables IoT systems to enforce strict security policies (low FAR) without the unacceptable cost of blocking legitimate users (high FDR), effectively bridging the gap between lightweight heuristic detection and strong cryptographic verification.