GECKO: Securing Digital Assets Through(out) the Physical World (Extended Technical Report)

TL;DR

GECKO introduces GeoCerts to extend the web PKI with location-based trust, enabling bidirectional verification between physical spaces and digital assets. It builds a geo-aware Sparse Merkle Hash Tree (SMT) to store and prove spatial bindings efficiently, supported by geo log and map servers and a consistency tree to deter tampering. The approach supports two deployment modes (web PKI extension and standalone) and demonstrates scalable performance, capable of ingesting hundreds of millions of GeoCerts and handling tens of thousands of queries per second on a single server. By enabling use cases like payment-fraud prevention, fake-store detection, and land/space verification, GECKO promises tangible security gains with incremental deployability and flexible trust policies. The work also discusses location-verification strategies, privacy considerations, and related geo-PKI research, outlining a path toward practical, scalable geo-enabled PKI in the near term.

Abstract

Although our lives are increasingly transitioning into the digital world, many digital assets still relate to objects or places in the physical world, e.g., websites of stores or restaurants, digital documents claiming property ownership, or digital identifiers encoded in QR codes for mobile payments in shops. Currently, users cannot securely associate digital assets with their related physical space, leading to problems such as fake brand stores, property fraud, and mobile payment scams. In many cases, the necessary information to protect digital assets exists, e.g., via contractual relationships and cadaster entries, but there is currently no uniform way of retrieving and verifying these documents. In this work, we propose the Geo-Enabled Cryptographic Key Oracle (GECKO), a geographical PKI that provides a global view of digital assets based on their geo-location and occupied space. GECKO allows for the bidirectional translation of trust between the physical and digital world. Users can verify which assets are supposed to exist at their location, as well as verify which physical space is claimed by a digital entity. GECKO supplements current PKI systems and can be used in addition to current systems when its properties are of value. We show the feasibility of efficiently storing millions of assets and serving cryptographic material based on precise location queries within 11 ms at a rate of more than 19000 queries per second on a single server.

Figures (11)

• Figure 1: Visual representation of the space claimed by a GeoCert.
• Figure 2: System Overview.
• Figure 3: The surface tree divides the world into smaller regions encoded by bit strings. Arrows point from parent nodes to their children. Red dashed arrows indicate longitude splits and blue solid arrows indicate latitude splits.
• Figure 4: Red dashed, blue solid, and green dotted arrows indicate longitude, latitude, and altitude splits, respectively.
• Figure 5: Discretization and Encoding of (longitude, latitude, altitude) tuples