🤖 AI Summary
This work addresses a critical gap in existing encrypted geo-search and zero-knowledge proximity proof systems, which fail to link proximity proofs to their original searches after session state erasure, thereby undermining authorized provenance. We propose Search-Bound Proximity Proofs (SBPP), which securely bind search authorization to proofs by decoupling session nonces, Merkle-root commitments over result sets, and signed receipts into independently auditable components—without modifying the underlying ZKP circuitry. We formalize, for the first time, a security model for Search Authorization Proofs (SAP), identifying and mitigating forensic misattribution attacks arising from cross-session parameter reuse, and enabling attribute-level fault isolation in offline audits. Evaluated on 110,776 OpenStreetMap points of interest across real-world and synthetic datasets, our approach incurs only sub-millisecond overhead over a 125 ms baseline.
📝 Abstract
Location-based systems that combine encrypted geographic search with zero-knowledge proximity proofs typically treat the two phases as independent. Under an honest-but-curious server, this leaves an authorization provenance gap: once session state is purged, no forensic procedure can attribute a proof to its originating search session, because the proof's public inputs encode no session-identifying information.
We formalize this gap as the search-authorized proof (SAP) security notion and show via a concrete audit re-association attack that proof-external mechanisms, where authorization evidence remains outside the proof, cannot prevent forensic misattribution when the same drop parameters recur across sessions. Search-Bound Proximity Proofs (SBPP) realize the SAP requirements without modifying the ZKP circuit: session nonce, Merkle-root result-set commitment, and signed receipt are decomposed into independently auditable components, enabling property-level fault isolation in offline audit. Experiments on synthetic and real-world data (110,776 OpenStreetMap POIs) show sub-millisecond absolute overhead on a 125 ms Groth16 baseline.