scope:

The present document specifies high level requirements for the application of Attribute Based Encryption (ABE) to protect PII and personal data on IoT devices/services, cloud services, Wireless Local Area Networks and mobile services, where access to data has to be given to multiple parties and under different conditions. With a main focus on the confidentiality of data, including personal data and Personally Identifiable Information, the present document may help in supporting the General Data Protection Regulation [i.19].

The following use cases are described:

1) The Mobile use case describes a situation of user access from less trusted networks. The objective is to provide user identity protection preserving disclosure to unauthorized entity.

2) The federated WLAN use case where users can access different WLAN networks using their credentials - issued by different authorities/domains - while preserving their privacy.

3) Many Internet of Things use cases or edge scenarios where data access mechanisms are actioned either in the network or on the device.

4) The Cloud use case where a third party accesses personal data from the Cloud Service Provider.

The present document also provides recommendations on the ABE scheme to use for each use case.