Attribute-based encryption could spell the end of data compromise

The future of data privacy is the end of compromise. With the world producing data at astounding rates, we need ways to put data to the best use while protecting against breaches and ensuring privacy, data protection and access control.

These principles are foundational to attribute-based encryption (ABE)—a novel form of encryption that after years of study is now beginning to be commercially deployed.

Compared to the prevailing coarse-grained access model of legacy encryption technologies, in which giving out a secret key essentially amounts to giving access to all the encrypted data, ABE is a more finely tuned approach that grants prescribed access of encrypted data to someone with a matching set of traits.

The paradigm is thus shifting from all-or-nothing to both-and. Both access to critical data for those with an authorized need-to-know and sustained encryption for all other data to be kept protected. The use cases for this policy-based approach are compelling, and behind them lies a distinguished theoretical foundation.

Definition and history

The history of ABE goes back to a ground-breaking 2005 paper titled “Fuzzy Identity-Based Encryption.” Fifteen years later, recognizing the paper’s significance, the International Association for Cryptologic Research (IACR) gave it a 2020 Test of Time Award. One of its co-authors, Dr. Brent Waters, later said the paper has had a three-fold impact.

First, there has been the concept of ABE as its own application with distinctive new use cases, several of which are discussed below. Second, the cryptographic research community not only has spent years studying ABE, but also used ABE as a building block, leveraging it to obtain new results in work on other problems. Third, according to Dr. Waters, the work in ABE “inspired us to rethink encryption in even bigger and grander ways.” One such overflow has been functional encryption, which allows a user to learn only a function of a data set.

For ABE, the end goal is fine-grained access to the data itself. On its own, that’s a revolution. An ABE scheme can provide the right user with a key to very specific data. Not to an entire file cabinet, so to speak, but to a single line item within a category of filed documents. The elegance of this approach is that it protects the data through encryption, and by embedding access control mechanisms directly into the data, it ensures proper protection at all times, regardless of the system or environment. This unique advantage significantly enhances traditional system-based access control.

ABE hackathon use cases and beyond

So how does this play out in practice? An ABE hackathon hosted by NTT Research in late 2022 provided several examples. The hackathon winner was an ingenious application of ABE to surveillance video, with advanced privacy protection.

Motivated by an incident involving leaked footage that revealed faces in a crowd, the data scientist and implementation engineer who created this app realized that they could use ABE to protect privacy and to make certain data (e.g., images of a criminal suspect) available to authorized personnel. Their hackathon demo extended privacy to a broader range of data, including building logos and license plates, as well as metadata containing GPS information.

This winning demo used a combination of artificial intelligence (AI), network edge processing, encryption, policy and data storage. First, using video they had shot in San Francisco, the site of the hackathon, they detected and labeled objects, through an edge-based convolutional neural network. Then they encrypted images, mapping between labels and ABE policies, such as allowing only an authenticated user with certain attributes to decrypt an object labeled “face.” Finally, they stored the video, including blurred images and encrypted metadata, in a database.

Demos from other hackathon participants illustrated more use cases, such as: ticketing and physical access to a transportation service; owner-control of data derived from a vehicle’s electronic sensors; employer access to employee’s personal mobile numbers; and a banking system’s migration from single-factor, role-based access control (RBAC) to ABE’s more granular control.

Another area ripe for ABE is the medical field. Two drivers are the acceleration of e-health and the demands of regulation, such as the U.S. Health Insurance Portability and Accountability Act (HIPPA). Back in 2011, the Johns Hopkins team had already explored the utilization of ABE to secure Electronic Medical Records (EMR).

Since then, numerous additional works have been conducted in this field.

ABE begins to roll out

While academics continue their research, deployments have begun. The hackathon winners, for example, are at work on several actual client projects. These include the monitoring of people in a hospital, surveillance in a manufacturing plant and the use of smart cameras while complying with the EU General Data Protection Regulation (GDPR).

The concept of the hackathon has evolved significantly. It now includes the processing of video and live-streaming content as well as still images. It is now possible to freely restrict privacy information visible to multiple recipients with different levels of security in a single real-time encrypted video. These innovative applications were introduced at the NTT R&D Forum 2023 and attracted great attention. The development is being tailored to a variety of use cases.

Another venue for vetting and rolling out ABE is at the intersection of academia, government and the private sector. A case in point is the University of Technology Sydney (UTS) Vault, a purpose-built, secure facility in New South Wales (NSW), Australia that enables collaboration between private sector tenants and a public university. In August 2023, UTS Vault announced an agreement to work with NTT DATA, an affiliate company of NTT, to validate ABE and co-develop use cases in cloud computing, healthcare, and IoT.

The world faces many conflicts today. One that has seemed intractable is the tension between data proliferation and demands for privacy. Introduced conceptually more than 15 years ago, ABE has become a plausible solution. ABE offers a compromise between data protection and access, and it’s a category that bears watching.