Practical Applications for Using Attribute-Based Encryption (ABE) to Protect Privacy

Attribute-based encryption dates to research published by NTT Research CIS Lab Director Brent Waters in 2005. Today, it’s close to coming to fruition in practical products, including a novel video privacy use case presented at the recent NTT Research Upgrade 2023 event.

Pascal Mathis, TS Implementation Engineer (L3), and Jean-Philippe Cabay, Senior Associate Data Scientist, both with NTT Belgium, were the winners of an ABE hackathon sponsored by NTT Research. Their work focused on using ABE to provide differing levels of access to a video to provide advanced privacy protection.

The idea stemmed from an incident at a metro station in Belgium when a man pushed someone onto the tracks. “Video footage from a surveillance camera leaked onto the internet with the faces of everybody there, completely visible,” Cabay said. “This story made us think about who really has access to those cameras.” He noted a Metro employee leaked the footage.

With ABE, different components of a file – or, as Mathis and Cabay showed, an image or video – can be encrypted according to varying policies. In practice, that means one person may be authorized to see all the components, another some subset, and a third a different subset.

In the example the pair demonstrated at Upgrade 2023, they showed a video they shot only a short time earlier of Cabay walking down a nearby San Francisco street. Some cars, license plates, people, and so on are clearly visible.

They demonstrated how different components could be blurred, making them unrecognizable. By assigning policies to each component, they could authorize different people to be able to decrypt certain components to make them accessible.

For example, perhaps a certain level of police officer would be authorized to see faces, while a different level could see license plates, and so on. For the sake of the demo, they used a simple drop-down menu to demonstrate the various levels of authentication. In practice, each person wishing to view the video would need to provide authentication at the appropriate level for whatever content they wanted to view.

Given the level of sophistication behind the cryptographic functions at play, it was impressive how quickly the authentications happened in the demo – and the fact that they clearly put the video together in just a short time prior to the conference.

Cabay also noted the video encryption technology could have applications beyond security footage. In the medical field, the technology could be used to control who has access to which components of CT and MRI scans, which contain myriad sensitive patient data, including name, age, medical condition and so on. Similarly, artificial intelligence technology could be used to scan anomalies in a series of CT scans, without compromising patient privacy.

In the financial sector, banks could use ABE to protect sensitive information in various scanned documents, such as social security and account numbers.

Beyond the theoretical, he said NTT Belgium is at work on several actual client projects that incorporate ABE technology. One involves monitoring the flow of people in a hospital without compromising anyone’s privacy, while another is a surveillance application to protect a manufacturing plant. A third is a project in Brussels involving the use of smart cameras while remaining in compliance with the EU General Data Protection Regulation (GDPR) on data protection and privacy.

Jean-Philippe Cabay is a Senior Associate Data Scientist at NTT based in Belgium. He is a certified predictive modeler (SAS Enterprise Miner 14), and with his expertise in computer vision he has acheived several First Place commendations at various sponsored hackathons. He holds a Master of Science degree in Data Sciences and Engineering from the University of Liège, Belgium.

Pascal Mathis received his PhD in computer science from Strasbourg University in France. As an associate professor for 15 years at ICube laboratory in Strasbourg, his research focused on artificial intelligence techniques for geometric modeling. He then worked in companies on numerous R&D projects such as real-time systems for the automotive industry and fraud detection in the telecom industry. He joined NNT in 2021 where he is involved in projects of the Client Innovation Center.