Authors:
Yaira K. Rivera Sánchez
1
;
Steven A. Demurjian
1
and
Lukas Gnirke
2
Affiliations:
1
University of Connecticut, United States
;
2
Oberlin College
Keyword(s):
Access Control, Application Programming Interface (API), Authorization, Data Management, Mobile Application, Mobile Computing, Representational State Transfer (REST), Role-Based Access Control (RBAC).
Related
Ontology
Subjects/Areas/Topics:
Mobile APIs and Services
;
Mobile Information Systems
;
Web Information Systems and Technologies
Abstract:
Mobile device users employ mobile applications to realize tasks once limited to desktop devices, e.g., web browsing, media (audio, video), managing health and fitness data, etc. While almost all of these applications require a degree of authentication and authorization, some involve highly sensitive data (PII and PHI) that must be strictly controlled as it is exchanged back and forth between the mobile application and its server side repository/database. Role-based access control (RBAC) is a candidate to protect highly sensitive data of such applications. There has been recent research related to authorization in mobile computing that has focused on extending RBAC to provide a finer-grained access control. However, most of these approaches attempt to apply RBAC at the application-level of the mobile device and/or require modifications to the mobile OS. In contrast, the research presented in this paper focuses on applying RBAC to the business layer of a mobile application, specificall
y to the API(s) that a mobile application utilizes to manage data. To support this, we propose an API-Based approach to RBAC for permission definition and enforcement that intercepts API service calls to alter information delivered/stored to the app. The proposed intercepting API-based approach is demonstrated via an existing mHealth application.
(More)