Towards location-based access control in healthcare emergency response

Abstract

Recent advances in positioning and tracking technologies have led to the emergence of novel location-based applications that allow participants to access information relevant to their spatio-temporal context. Traditional access control models, such as role-based access control (RBAC), are not sufficient to address the new challenges introduced by these location-based applications. Several recent research efforts have enhanced RBAC with spatio-temporal features. Nevertheless, the state-of-the-art does not deal with mobility of both subjects and objects and does not support the utilization of complex access control decisions based on spatio-temporal relationships among subjects and objects. Furthermore, such relationships change frequently in dynamic environments, requiring efficient mechanisms to monitor and re-evaluate access control decisions. In this position paper, we present a healthcare emergency response scenario which highlights the novel challenges that arise when enforcing access control in an environment with moving subjects and objects. To address a realistic application scenario, we consider movement on road networks, and we identify complex access control decisions relevant to such settings. We overview the main technical issues to be addressed, and we describe the architecture for policy decision and enforcement points.

Efficiently enforcing spatiotemporal access control under uncertain location information

“…For efficient processing of user access requests, Youssef et al [27] propose an index structure that stores authorizations suitable for mobile environment. Recently, Vicente et al [24] identify that current work does not deal with mobility of both subjects and objects and does not support the utilization of complex access control decisions based on spatiotemporal relationships among subjects and objects. However, our work is orthogonal to all of these work because the underlying assumption of these approaches is that the location measure is always accurate, and therefore, evaluating access requests based on the location measures are correct.…”