Towards Zero Trust and Attribute-Based Encryption

Overall, in cybersecurity, we need to realise that role-based access security (RBAC) is often not a sensible solution for protecting data and services. While it simplifies things, it does not efficiently scale across multiple domains and can end up being a rats-nest of access rights.

The way it works is that users get rights of access to data or services based on the role(s) they have been granted. These tend to be fairly large-ranging roles, such as where a GP role would get access to all the things that a GP needs, even though they might only need access to specific things at a specific time. One GP might actually need more rights than another one, and so typically add another role for the specific additional tasks. It then all becomes a tangled mesh of roles, and where if someone gains access to someone’s account, they inherit all of the rights of the roles assigned.

An improved approach would be to define a zero-trust environment, where every user must provide that they have the correct attributes to access a service or data. For example, we might define that access to a specific patient requires that there must be proof that someone is in a certain location, has authenticated themself with a wearable device, and that the time is between 9am and 5pm. For this, we need Attribute-Based Access Control (ABCL), and where a user must…