Spatial Context in Role-Based Access Control

Controlling access to resources in location-based services and mobile applications require the definition of spatially aware access control systems. However, traditional RBAC model does not specify these requirements. In this paper, we present an extension of the RBAC model to deal with spatial and location-based information, which called LRBAC. In LRBAC, the final permission set of a user depends on the physical location in which a user is situated. The ability to specify the spatial boundary of the role allows LRBAC to be flexible and express a variety of access policies that can provide tight and just-in-time role activation. Besides a real position obtained from a specific mobile terminal, users are also assigned a logical location domain that is application dependent. Then, we extend LRBAC to deal with hierarchies and present how complex spatial role hierarchies in the location-dependent case can be generated by applying Cartesian products as an arithmetic operation over role hierarchies and logical location domain hierarchies.