Re: some capability queries

Jithu Joseph wrote:
> 
> 7. Can capabilities be as expressive as ABAC , which is said to be
> used in medical systems [e.g. access to the patient record can be
> restricted to specific cardiologists involved in that patient’s care
> as these doctor’s attributes can be included in the ABAC policy of the
> record]
>
We can use the ABAC policy to grant capabilities and the flexibility of capabilities for rich sharing.  Hence, capabilities are strictly more expressive than ABAC.

Let's say that the patient's records are available to any doctor in a practice with the attribute Cardiologist.  With ABAC, there is no way for the doctor to delegate to a nurse access to some of the patient's records without getting an administrator to set up an ad hoc policy.  In practice, doctors make up for this deficiency by sharing their credentials with the nurses they work with.  With capabilities, the doctor's attributes are used to decide which capabilities the doctor gets, any of which the doctor can choose to delegate to the nurse.  Such a system is quite easy to use.  When the doctor logs in, the screen shows a link for each permission granted by the ABAC policy.  Each view also has a Share button that allows the doctor to share  that view and its associated permissions with someone else, a nurse or even a doctor in another practice.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
1 (650) 386-4568
http://www.hpl.hp.com/personal/Alan_Karp


_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk