Location-based systems that combine encrypted geographic search with zero-knowledge proximity proofs typically treat the two phases as independent. Under an honest-but-curious server, this leaves an authorization provenance gap: once session state is purged, no forensic procedure can attribute a proof to its originating search session, because the proof's public inputs encode no session-identifying information. We formalize this gap as the search-authorized proof (SAP) security notion and show via a concrete audit re-association attack that proof-external mechanisms, where authorization evidence remains outside the proof, cannot prevent forensic misattribution when the same drop parameters recur across sessions. Search-Bound Proximity Proofs (SBPP) realize the SAP requirements without modifying the ZKP circuit: session nonce, Merkle-root result-set commitment, and signed receipt are decomposed into independently auditable components, enabling property-level fault isolation in offline audit. Experiments on synthetic and real-world data (110,776 OpenStreetMap POIs) show sub-millisecond absolute overhead on a 125 ms Groth16 baseline.

翻译：将加密地理搜索与零知识邻近证明相结合的基于位置系统通常将这两个阶段视为独立过程。在诚实但好奇的服务器模型下，这导致一个授权溯源鸿沟：一旦会话状态被清除，任何取证程序都无法将证明归属到其原始搜索会话，因为证明的公开输入不编码任何会话标识信息。我们将这一鸿沟形式化为搜索授权证明（SAP）安全概念，并通过具体审计重关联攻击表明，当相同撤回参数跨会话重复出现时，授权证据保留在证明外部的证明外部机制无法防止取证误归属。搜索绑定邻近证明（SBPP）在不修改ZKP电路的情况下实现SAP要求：会话随机数、Merkle根结果集承诺及签名收据被分解为独立可审计组件，从而在离线审计中实现属性级故障隔离。在合成数据及真实数据（110,776个OpenStreetMap兴趣点）上的实验表明，在125毫秒Groth16基线基础上，绝对开销低于亚毫秒级。