  Localization and mapping is a key technology for bridging the virtual and
physical worlds in augmented reality (AR). Localization and mapping works by
creating and querying maps made of anchor points that enable the overlay of
these two worlds. As a result, information about the physical world is captured
in the map and naturally gives rise to concerns around who can map physical
spaces as well as who can access or modify the virtual ones. This paper
discusses how we can provide access controls over virtual maps as a basic
building block to enhance security and privacy of AR systems. In particular, we
propose VACMaps: an access control system for localization and mapping using
formal methods. VACMaps defines a domain-specific language that enables users
to specify access control policies for virtual spaces. Access requests to
virtual spaces are then evaluated against relevant policies in a way that
preserves confidentiality and integrity of virtual spaces owned by the users.
The precise semantics of the policies are defined by SMT formulas, which allow
VACMaps to reason about properties of access policies automatically. An
evaluation of VACMaps is provided using an AR testbed of a single-family home.
We show that VACMaps is scalable in that it can run at practical speeds and
that it can also reason about access control policies automatically to detect
potential policy misconfigurations.
