Towards coupling user and device locations using biometrical authentication on smartphones

The mobile access to resources via smartphones has caused the development of location-based access control (LBAC) policies: A permission is granted, if a user is within an authorized area. This needs to be checked for the time the permission is used by consulting the location of the user's device. The assumption that both locations coincide for this timespan can be asserted by continuous and implicit biometrical authentication, as knowledge or ownership factors easily allow a user to move away from his device after passing or dropping it. In this paper, requirements for such biometrical authentication schemes are presented that are necessary for asserting the assumption that device and user location coincide, i.e. are coupled. A carefully conducted literature survey is presented, where existing biometrical authentication schemes and modalities on smartphones are evaluated against these requirements. Finally, a discussion shows that in most cases a fusion of modalities is necessary but the chosen modalities should be carefully selected based on the characteristics of geographical areas where permissions are granted by the LBAC policy. The results allow for an improved coupling of user and device locations in LBAC scenarios and thus help to improve the security of such systems.