scope:

The present document specifies trust models, functions and protocols using attribute based encryption as a foundation of an attribute based access control scheme. It covers both the Ciphertext-Policy (CP-ABE) and Key-Policy (KP-ABE) variants of Attribute-Based Encryption.

The specifications address the following aspects:

• Identification of an ABE scheme covering both the Ciphertext-Policy and Key-Policy variants.

• Definition of interactions between the data sources, the service providers and the authority releasing attributes and key material.

• Mechanisms for keys, policies, and attributes distribution.

• Mechanisms for secret key expiration and revocation.

• Definition of semantics for a basic set of attributes to ensure interoperability.

• Mapping to a standard Public Key Infrastructure X.509.

• Mapping to a standard assertion protocol (SAML).

• Definition of a policy schema for data access control.

• Identification of limitations compared to traditional ABAC features.

• Translation rules to XACML.

• Definition of new protocol bindings when existing bindings do not cover the deployment scenario (e.g. a CoAP binding for the IoT case).