I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV file.
1-100 records --> ORG-A;
101-200 records --> ORG-B;
.
.
901-1000 records --> ORG-Z;
In the initial set 1-100 records the data should be decrypted only by ORGANZATION-A users, out of those 100 records, few records are accessible by Administrators and other 90 records are accessible by normal users (basically users with particular role can access some set of records among those 100 records).
I am trying to solve the above problem using combination of ABE schemes viz., KP-ABE and CP-ABE schemes:
Encryption
Basically I would encrypt each of record fields 1-100 using CP-ABE scheme (ciphertext policy). I choose CP-ABE because it allows RBAC (role based access control) policies to be embedded into the cipher text.
I would encrypt the records 1-100 again using tags related to organization using KP-ABE scheme. This means that only users of particular organization can decrypt the records.
Decryption
Use private keys associated with KP-ABE scheme first and then CP-ABE scheme to access the data.
I am still learning how to use ABE schemes in real world. I will be happy if someone can validate my thoughts in solving the problem related shared-logs along with RBAC policies.