The increased usage of mobile devices and mobile applications makes location awareness more important than before. The need of adding a location-aware access control component to the existing Role-Based Access Control is also more urgent than before. There are already several researches in integrating location information into access control model. While those researches proposed good location-aware access control models, there is a lack of implementation to enforce these models. This thesis presents a novel approach which incorporates location-aware component in a Role-Based Access Control system. The proposed approach provides an automatic permission change for the user, which reflects the user’s real-time location and the corresponding access privilege he/she is supposed to have. This thesis describes the design criteria and requirements needed for building such a system. This thesis also presents a working prototype based on the proposed approach and give a security analysis of the system.

[1] .NET Framework. Available: http://en.wikipedia.org/wiki/.NET Framework
[2] .NET Micro Framework. Available: http://netmf.codeplex.com/
[3] E. Bertino and M. S. Kirkpatrick, Location-based access control systems for
mobile users: concepts and research directions, presented at the Proceedings of
the 4th ACM SIGSPATIAL International Workshop on Security and Privacy
in GIS and LBS, Chicago, Illinois, 2011.
[4] BlueSMiRF Silver Bluetooth Module. Available:
https://www.sparkfun.com/products/10269
[5] M. L. Damiani and E. Bertino, Access Control and Privacy in Location-Aware
Services for Mobile Organizations, presented at the Proceedings of the 7th International
Conference on Mobile Data Management, 2006.
[6] M. L. Damiani, E. Bertino, B. Catania, and P. Perlasca, GEO-RBAC: A spa-
tially aware RBAC, Acm Transactions on Information and System Security,
vol. 10, Feb 2007.
[7] D. F. Ferraiolo, D. R. Kuhn, and R. Chandramouli, Role-Based Access Control :
Artech House Books, 2007.
[8] GIS Toolkit. Available: http://gistoolkit.sourceforge.net/
[9] Global Positioning System. Available: http://en.wikipedia.org/wiki/
Global Positioning System
[10] F. Hansen and V. Oleshchuk, Application of rolebased access control in wireless
healthcare information systems, in Scandinavian Conference in Health Infor-
matics, 2003, pp. 30-33.
[11] F. Hansen and V. Oleshchuk, SRBAC: A spatial role-based access control model
for mobile systems, in Proceedings of the 7th Nordic Workshop on Secure IT
Systems (NORDSEC03), 2003, pp. 129-141.
[12] J. Heather, G. Lowe, and S. Schneider, How to prevent type
aw attacks on
security protocols, in Computer Security Foundations Workshop, 2000. CSFW-
13. Proceedings. 13th IEEE, 2000, pp. 255-268.
[13] H. C. Chen, S. J. Wang, J. H. Wen, and C. W. Chen, Temporal and Location-
Based RBAC Model, in INC, IMS and IDC, 2009. NCM '09. Fifth International
Joint Conference on, 2009, pp. 2111-2116.
[14] M. S. Kirkpatrick and E. Bertino, Enforcing spatial constraints for mobile rbac
systems, in Proceedings of the 15th ACM symposium on Access control models
and technologies, 2010, pp. 99-108.
[15] M. S. Kirkpatrick, M. L. Damiani, and E. Bertino, Prox-RBAC: a proximity-
based spatially aware RBAC, presented at the Proceedings of the 19th ACM
SIGSPATIAL International Conference on Advances in Geographic Information
Systems, Chicago, Illinois, 2011.
[16] M. S. Kirkpatrick, G. Ghinita, and E. Bertino, Privacy-Preserving Enforcement
of Spatially Aware RBAC, Dependable and Secure Computing, IEEE Transac-
tions on, vol. 9, pp. 627-640, 2012.
[17] W. Li, H. Wan, X. Ren, and S. Li, A Re ned RBAC Model for Cloud Com-
puting, in Computer and Information Science (ICIS), 2012 IEEE/ACIS 11th
International Conference on, 2012, pp. 43-48.
[18] G. Loukas and G. ke, Protection against denial of service attacks: a survey,
The Computer Journal, vol. 53, pp. 1020-1037, 2010.
[19] S. Malladi, J. Alves-Foss, and R. B. Heckendorn, On preventing replay attacks
on security protocols, DTIC Document2002.
[20] Netduino. Available: http://netduino.com/netduinoplus2/specs.htm
[21] OpenDocMan. Available: http://www.opendocman.com/
[22] I. Ray and Y. Lijun, Towards a Location-Aware Role-Based Access Control
Model, in Security and Privacy for Emerging Areas in Communications Net-
works, 2005. SecureComm 2005. First International Conference on, 2005, pp.
234-236.
[23] I. Ray, M. Kumar, and L. Yu, LRBAC: A location-aware role-based access
control model, Information Systems Security, pp. 147-161, 2006.
[24] R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman, Role based
access control models, Computer, vol. 29, pp. 38-&, Feb 1996.
[25] R. Sandhu, Role activation hierarchies, presented at the Proceedings of the
third ACM workshop on Role-based access control, Fairfax, Virginia, USA,
1998.
[26] R. Sandhu, D. Ferraiolo, and R. Kuhn, The NIST model for role-based access
control: towards a uni ed standard, in Symposium on Access Control Models
and Technologies: Proceedings of the fth ACM workshop on Role-based access
control, 2000, pp. 47-63.
[27] P. Syverson, A taxonomy of replay attacks [cryptographic protocols], in Com-
puter Security Foundations Workshop VII, 1994. CSFW 7. Proceedings, 1994,
pp. 187-191.