Do attribute-base encryption (abe), key policy attribute-based encryption (KP-ABE) and ciphertext attribute-based encryption (CP-ABE) fall into the attribute-based access control (ABAC) paradigm or are they not related?


This is an interesting question. ABAC itself is an access control model, and (at least should be) agnostic to how it is enforced (see some ABAC links below). ABE-schemes, on the other hand, are cryptographic schemes, where only the terminology links them to attributes (which are, in fact, algebraic group elements mapped into real-life attributes. This mapping is scheme-dependent, and sometimes non-trivial).

However, it seems evident that the designers of ABE-schemes had the ABAC paradigm in the back of their mind, as there are many parallels. I investigated this connection more closely in my dissertation (see the last link below) in connection with RBAC (in some sense, a subset of ABAC).

Currently ABE schemes have difficulties enforcing some RBAC-standardized features, such as role hierarchy and dynamic separation of duty. Thus their support for full ABAC seems dubious. Additionally, ABAC depends on environmental attributes, and obtaining cryptographically verifiable and reliable environmental references is difficult. For example, imagine that a document is allowed to be decrypted only in a certain country. How can the encryptor control the decryption location reliably?

In summary: ABE-schemes represent an independent dimension (an enforcement paradigm) to that of access control models. Yet the current capability to support full RBAC or ABAC features is not there. Core RBAC could, in theory, be supported, though.

Links for ABAC:

Link for a RBAC-ABE dissertation


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.