# Is it feasible to use combination of ABE schemes for encrypting the data?

I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV file.

1-100 records --> ORG-A;
101-200 records --> ORG-B;
.
.
901-1000 records --> ORG-Z;


In the initial set 1-100 records the data should be decrypted only by ORGANZATION-A users, out of those 100 records, few records are accessible by Administrators and other 90 records are accessible by normal users (basically users with particular role can access some set of records among those 100 records).

I am trying to solve the above problem using combination of ABE schemes viz., KP-ABE and CP-ABE schemes:

Encryption

1. Basically I would encrypt each of record fields 1-100 using CP-ABE scheme (ciphertext policy). I choose CP-ABE because it allows RBAC (role based access control) policies to be embedded into the cipher text.

2. I would encrypt the records 1-100 again using tags related to organization using KP-ABE scheme. This means that only users of particular organization can decrypt the records.

Decryption

Use private keys associated with KP-ABE scheme first and then CP-ABE scheme to access the data.

I am still learning how to use ABE schemes in real world. I will be happy if someone can validate my thoughts in solving the problem related shared-logs along with RBAC policies.

• CP-ABE should be sufficient. Why not give every user of organisation $A$ a key for attribute orgA and encrypt the 90 that should be decryptable by all users from $A$ under policy p=orgA. Admins of $A$ additionally receive a key for attribute adminA and those 10 only readable for admins of $A$ are encrypted under policy p=(orgA AND adminA)? – DrLecter Sep 18 '14 at 20:00
• First of all thanks for the answer. Will the CP-ABE scheme work even if user hierarchy is different in different organizations in my example. I mean ORG-A may have Level-1 and Level-2 only where as ORG-2 has Level-1, Level-2 and Level-3. Will the suggested CP-ABE scheme still work in this case? – Bhanu Gopularam Sep 19 '14 at 9:57
• Jup, if you have a hierarchy of depth $n$ in the organization, then you can encrypt the basic level entries under $attr_n$ (where everybody has a key for $attr_n$), the next level under policy p=$attr_n$ AND $attr_{n-1}$ (where people on level $n-1$ have keys to attributes $attr_n$, $attr_{n-1}$). On the next level you use policy p=$attr_n$ AND $attr_{n-1}$ AND $attr_{n-2}$ and so forth. – DrLecter Sep 19 '14 at 10:28
• What do you exactly mean by "restricts the key generation process"? The hirarchy oft the org is likely to be known before. Maybe your example in your question does not reflect all cases you are thinking of? – DrLecter Sep 19 '14 at 16:38
• I agree to that, it does allow encrypting data records segregated by ORG NAME and ORG_HIERARCHY using in POLICY tree. As ORG_NAME is part of policy tree attribute in ciphertext, I think it restricts the key gen/enc process. As same masterkey/public key is used for encrypting. The case in point is, if one of the user key gets compromised it requires regeneration of all keys for users across ALL organization. If I could separate the ORG_NAME attribute from this process this might give me one more level of protection to the users. CP-ABE allows inclusion of such a methodology is a puzzle to me? – Bhanu Gopularam Sep 19 '14 at 16:57