Role Based Access Control with Spatiotemporal Context for Mobile Applications

  • Subhendu Aich
  • Samrat Mondal
  • Shamik Sural
  • Arun Kumar Majumdar
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5430)


Role based access control (RBAC) is an established paradigm in resource protection. However, with the proliferation of mobile computing, it is being frequently observed that the RBAC access decision is directly influenced by the spatiotemporal context of both the subjects and the objects in the system. Currently, there are only a few models (STRBAC, GSTRBAC) in place which specify spatiotemporal security policy on top of the classical RBAC. In this paper we propose a complete RBAC model in spatiotemporal domain based on the idea of spatiotemporal extent. The concept of spatiotemporal role extent and spatiotemporal permission extent introduced here enables our model to specify granular spatiotemporal access control policies not specifiable in the existing approaches. Our model is also powerful enough to incorporate classical role hierarchy and other useful RBAC policies including Role based Separation of Duty and Permission based Separation of Duty in spatiotemporal domain.

Healthcare is an area in which information security is of utmost importance. The risk of personal medical data leakage is especially high in mobile healthcare applications. As a proof of concept, we have implemented the proposed spatiotemporal access control method in a mobile telemedicine system.


Spatiotemporal domain Role extent Permission extent Spatiotemporal SOD and Telemedicine 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Ahn, G., Sandhu, R.: Role-Based Authorization Constraints Specification. ACM Transactions on Information and System Security 3(4), 207–226 (2000)CrossRefGoogle Scholar
  2. 2.
    Aich, S., Sural, S., Majumdar, A.K.: STARBAC: Spatiotemporal Role Based Access Control. In: Meersman, R., Tari, Z. (eds.) OTM 2007, Part II. LNCS, vol. 4804, pp. 1567–1582. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  3. 3.
    Atluri, V., Chun, S.A.: A Geotemporal Role-based Authorisation System. International Journal of Information and Computer Security 1(1/2), 143–168 (2007)CrossRefGoogle Scholar
  4. 4.
    Bertino, E., Bettini, C., Ferrari, E., Samarati, P.: An Access Control Model Supporting Periodicity Constraints and Temporal Reasoning. ACM Transactions on Database Systems 23(3), 231–285 (1998)CrossRefGoogle Scholar
  5. 5.
    Bertino, E., Bonatti, P.A., Ferrari, E.: TRBAC: A Temporal Role-Based Access Control Model. ACM Transactions on Information and System Security 4(3), 191–223 (2001)CrossRefGoogle Scholar
  6. 6.
    Covington, M.V., Long, W., Srinivasan, S., Dey, A.K., Ahamad, M., Abowd, G.D.: Securing Context-aware Applications using Environment Roles. In: Proceedings of ACM Symposium on Access Control Models and Technologies, pp. 10–20 (2001)Google Scholar
  7. 7.
    Damiani, M.L., Bertino, E., Catania, B., Perlasca, P.: GEO-RBAC: A Spatially Aware RBAC. ACM Transactions on Information and System Security 10(1) Article 2, (February 2007)Google Scholar
  8. 8.
    Ferraiolo, D.F., Sandhu, R., Gavrila, S., Kuhn, D.R., Chandramouli, R.: Proposed NIST Standard for Role-based Access Control. ACM Transactions on Information and System Security 4(3), 224–274 (2001)CrossRefGoogle Scholar
  9. 9.
    Hansen, F., Oleshchuk, V.: Spatial Role-Based Access Control Model for Wireless Networks. In: Proceedings of IEEE Vehicular Technology Conference, pp. 2093–2097 (2003)Google Scholar
  10. 10.
    Joshi, J.B.D., Bertino, E., Latif, U., Ghafoor, A.: A Generalized Temporal Role based Access Control Model. IEEE Transactions on Knowledge and Data Engineering 17(1), 4–23 (2005)CrossRefGoogle Scholar
  11. 11.
    Maji, A.K.: Vulnerability Analysis of a Multi-tier Architecture for Web-based Services with Application to Tele-healthcare, MS Thesis, IIT Kharagpur, India (2008) Google Scholar
  12. 12.
    McAlearney, A.S., Schweikhart, S.B., Medow, M.A.: Doctors’ Experience with Handheld Computers in Clinical Practice: Qualitative Study. British Medical Journal 328, 1–5 (2004)CrossRefGoogle Scholar
  13. 13.
    Ray, I., Kumar, M., Yu, L.: LRBAC: A Location-Aware Role-Based Access Control Model. In: Proceedings of International Conference on Information Systems Security, pp. 147–161 (2006)Google Scholar
  14. 14.
    Ray, I., Toahchoodee, M.: A Spatio-Temporal Role-Based Access Control Model. In: Proceedings of 21st Annual IFIP WG 11.3 Working Conference on Data and Applications Security (2007)Google Scholar
  15. 15.
    Samuel, A., Ghafoor, A., Bertino, E.: A Framework for Specification and Verification of Generalized Spatio-Temporal Role based Access Control Model, CERIAS Tech Report 2007-08, Purdue University, West Lafayette, IN 47907-2086. Google Scholar
  16. 16.
    Sandhu, R.: Role Activation Hierarchies. In: Proceedings of ACM Workshop on Role-Based Access, pp. 33–40 (1998)Google Scholar
  17. 17.
    Sandhu, R., Coyne, E.J., Feinstein, H.L., Youman, C.E.: Role-Based Access Control Models. IEEE Computer 29(2), 38–47 (1996)CrossRefGoogle Scholar
  18. 18.
    Schoen, C., Osborn, R., Huynh, P.T., Doty, M., Peugh, J., Zapert, K.: On the Front Lines of Care: Primary Care Doctors’ Office Systems, Experiences, and Views in Seven Countries. Health Affairs 25(3), 555–571 (2006)CrossRefGoogle Scholar
  19. 19.

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Subhendu Aich
    • 1
  • Samrat Mondal
    • 1
  • Shamik Sural
    • 1
  • Arun Kumar Majumdar
    • 2
  1. 1.School of Information TechnologyIndia
  2. 2.Department of Computer Science and EngineeringIndian Institute of TechnologyKharagpurIndia

Personalised recommendations