Attribute-Based Access control for nested attributes

Question

Nested attributes were introduced for the first time in the paper with the title "SmartABAC: Enabling Constrained IoT Devices to Make Complex Policy-Based Access Control Decisions". What is the difference between nested attributes, multiple attributes, and hierarchy attributes? In this paper, the authors make 6 policy examples and claimed that their paper only supports P2, P3 and P5 policies. I think this is possible to support in other schemes like multi attribute ABAC or Hierarchical ABAC. Please explain more about it. Is nested atts only for simply expressiveness?

another question: Is the EAPs model in access control identityless? Isn't it equl to Access Control List (ACL)?

Answer 1

Nested attributes are a form of hierarchy, but they are most useful for organization of attribute names. Examples: user.degree.university and user.job.

Hierarchical attributes are used to represent semantic or sub-grouping rules in attribute values. Examples:

• considering that the attribute user.job accepts values {BachelorStudent, PhDStudent, AssistantProfessor}
• hierarchy: BachelorStudent is a specialization of Student; PhDStudent is a specialization of Student.

Regarding EAP, is not necessarily identityless. It is possible to make a rule {user1, read, documentA}, which is equivalent to an ACL. So you are right, ACLs are EAP -- and EAP is ACL with the possibility of being identityless.

(by the way, the paper claims to all support policies from p1 to p6: "As mentioned, all of the example policies in Table III are expressed using SmartABAC")