Do attribute-base encryption (abe), key policy attribute-based encryption (KP-ABE) and ciphertext attribute-based encryption (CP-ABE) fall into the attribute-based access control (ABAC) paradigm or are they not related?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
This is an interesting question. ABAC itself is an access control model, and (at least should be) agnostic to how it is enforced (see some ABAC links below). ABE-schemes, on the other hand, are cryptographic schemes, where only the terminology links them to attributes (which are, in fact, algebraic group elements mapped into real-life attributes. This mapping is scheme-dependent, and sometimes non-trivial).
However, it seems evident that the designers of ABE-schemes had the ABAC paradigm in the back of their mind, as there are many parallels. I investigated this connection more closely in my dissertation (see the last link below) in connection with RBAC (in some sense, a subset of ABAC).
Currently ABE schemes have difficulties enforcing some RBAC-standardized features, such as role hierarchy and dynamic separation of duty. Thus their support for full ABAC seems dubious. Additionally, ABAC depends on environmental attributes, and obtaining cryptographically verifiable and reliable environmental references is difficult. For example, imagine that a document is allowed to be decrypted only in a certain country. How can the encryptor control the decryption location reliably?
In summary: ABE-schemes represent an independent dimension (an enforcement paradigm) to that of access control models. Yet the current capability to support full RBAC or ABAC features is not there. Core RBAC could, in theory, be supported, though.
Links for ABAC:
- NIST guide: "Guide to attribute based access control (ABAC) definition and considerations, NIST SP 800-162", http://dx.doi.org/10.6028/NIST.SP.800-162.
- An ABAC dissertation: Jin, X.: "Attribute-based access control models and implementation in cloud infrastructure as a service" (University of Texas at San Antonio Dissertations), https://pdfs.semanticscholar.org/c342/d13a011460df3392815ab74fd6252187d15b.pdf
Link for a RBAC-ABE dissertation
- Kiviharju M: Enforcing Role-Based Access Control with Attribute-Based Cryptography for Environments with Multi-Level Security Requirements http://urn.fi/URN:ISBN:978-952-60-6774-2
