Enforcing mobile security with location-aware role-based access control

Abstract

This paper describes how location-aware role-based access control (RBAC) can be implemented on top of the Geospatial eXtensible Access Control Markup Language (GeoXACML). It furthermore sketches how spatial separation of duty constraints (both static and dynamic) can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations, which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC can be used to implement location-dependent access control and also other security enhancing solutions on mobile devices, such as location-dependent device locking, firewall, intrusion prevention or payment anti-fraud systems. The system has been implemented and tested, both to verify the server capacity and also the client capacity running on a mobile device.

Programmable In-Network Security for Context-aware BYOD Policies

“…One promising approach to BYOD security is to use context-aware policies, which enforce access control based on devices' runtime context [62]. For instance, a policy may deny access from devices whose TLS libraries have not been updated [105], or grant access to devices that are physically located in the enterprise boundary [95], or only allow the use of a sensitive service only if administrators are online [59,94]. In each of these scenarios, we desire to make security decisions based on additional "threat signals", such as the device location, library version, or even the status of other devices in the network.…”