Location-based web access control via short-time passwords broadcast by Bluetooth low energy beacon

We present the design and implementation of a web page that allows access to private information, such as the availability of professors in their office, only when it is accessed from a specific location (e.g., entrance hall of a building on a university campus). The web page initially contains no private information; instead, it contains some buttons to request it. When one of the buttons is tapped by a user, a JavaScript function acquires a short-time password broadcast by a Bluetooth Low Energy beacon installed at the location and sends it to the web server. If the password is valid, the web server returns the private information, which is used to replace the button labels. Access to the private information is thus limited to those present at the specific location. The ability to check the availability of professors in advance will save students and visitors time and effort.