Nested attributes were introduced for the first time in the paper with the title "SmartABAC: Enabling Constrained IoT Devices to Make Complex Policy-Based Access Control Decisions". What is the difference between nested attributes, multiple attributes, and hierarchy attributes? In this paper, the authors make 6 policy examples and claimed that their paper only supports P2, P3 and P5 policies. I think this is possible to support in other schemes like multi attribute ABAC or Hierarchical ABAC. Please explain more about it. Is nested atts only for simply expressiveness?

another question: Is the EAPs model in access control identityless? Isn't it equl to Access Control List (ACL)?


1 Answer 1


Nested attributes are a form of hierarchy, but they are most useful for organization of attribute names. Examples: user.degree.university and user.job.

Hierarchical attributes are used to represent semantic or sub-grouping rules in attribute values. Examples:

  • considering that the attribute user.job accepts values {BachelorStudent, PhDStudent, AssistantProfessor}
  • hierarchy: BachelorStudent is a specialization of Student; PhDStudent is a specialization of Student.

Regarding EAP, is not necessarily identityless. It is possible to make a rule {user1, read, documentA}, which is equivalent to an ACL. So you are right, ACLs are EAP -- and EAP is ACL with the possibility of being identityless.

(by the way, the paper claims to all support policies from p1 to p6: "As mentioned, all of the example policies in Table III are expressed using SmartABAC")


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.