Graduated Trust Gating for IoT Location Verification: Trading Off Detection and Proof Escalation

TL;DR

This paper introduces a graduated trust gating mechanism for IoT location verification that balances detection accuracy and proof escalation, improving robustness against spoofing.

Contribution

It proposes a multi-signal integrity score with a session-latch mechanism and step-up actions, enabling more reliable spoofing detection in IoT systems.

Findings

The graduated gate maintains zero false-deny rate at 11% false-accept rate.

Real-device traces show evasion at lower thresholds but effective escalation at higher thresholds.

A minimal two-signal configuration achieves high accuracy with low resource overhead.

Abstract

IoT location services accept client-reported GPS coordinates at face value, yet spoofing is trivial with consumer-grade tools. Existing spoofing detectors output a binary decision, forcing system designers to choose between high false-deny and high false-accept rates. We propose a graduated trust gate that computes a multi-signal integrity score and maps it to three actions: PROCEED, STEP-UP, or DENY, where STEP-UP invokes a stronger verifier such as a zero-knowledge proximity proof. A session-latch mechanism ensures that a single suspicious fix blocks the entire session, preventing post-transition score recovery. Under an idealized step-up oracle on 10,000 synthetic traces, the gate enables strict thresholds (theta_p = 0.9) that a binary gate cannot safely use: at matched false-accept rate (11%), the graduated gate maintains zero false-deny rate versus 0.05% for binary, with 5 microseconds scoring overhead. Real-device traces from an Android smartphone demonstrate the session-latch mechanism and show that a nearby mock location (~550 m) evades theta_p = 0.7 but is routed to step-up at theta_p = 0.9. Signal ablation identifies a minimal two-signal configuration (F1 = 0.84) suitable for resource-constrained scoring layers.