What is attribute-based authentication?
Attribute based authentication is a way of "minimal disclosure" authentication in that (at least in theory) it's only checked whether you have some attribute, rather than "who you are". This means that if a website requires you to have a certain age authentication will only leak your age, but not your identity.
This goes further in advanced systems which allow for predicates to be tested (i.e. 'age > 18') which means that even less information is leaked because now the website knows you're older than 18 but it's not leaked how old exactly.
In trivial systems you could just have somebody sign your attributes and then the website verifies the signature of your attributes. However, the problem with that is that if you try to authenticate twice you can be fingerprinted because if you just send your age signed then if you do it again you'll send the exact same content (signature is still the same) so the website knows it's the same person. Advanced systems don't do that as they create a new temporary pseudonym for each authentication which makes it impossible to fingerprint the person who tries to authenticate.
If you want to find out more you should read about 'privacy-preserving attribute-based credentials' and look into cryptoengines like UProve (Microsoft) and Idemix (IBM).
What are its advantages?
- Minimum disclosure
- Not linkable (you can authenticate twice without anybody knowing it's you again)
- Decentralized (you're in possession of your attributes)
However, not all attribute-based authentication schemes necessarily fulfill this. You could for example have an authentication provider and the website you try to authenticate to contacts that provider and asks whether you are older than 18. This however leaks information to the authentication provider about what websites you visit so in practice a scheme that is not decentralized isn't exactly good for your privacy.
How can it enhance privacy protection while online?
Same deal. In privacy-preserving attribute based credentials/authentication you are 100% anonymous (excluding of course that you leak your IP and things like that) and not linkable and only leak the minimum amount of information required and it can be done offline.
The funny thing is that once they started developing this they faced the problem that users are now 100% anonymous and in some contexts you're required to be able to tell the government who used your service so effort had to be spent to develop backdoors that leak information about you.
There are also issues with revocation. Some systems thus require also proof that your credentials have not be revoked yet. But anyway... in THEORY privacy-preserving attribute based credentials/authentication are really good for privacy but they have drawbacks (revocation / DE-anonymization for legal purposes) and more user interaction. A website for example might just ask for "everything" and if the user doesn't intervene they will leak everything so software has to display to the user what is being leaked and the user has to confirm it which means these systems require much more from the user which is a huge problem for your average user.
Also... you need additional architecture... such as an issuer a revocation authority an inspection authority you need a crypto engine you need storage for the credentials which are all things that don't really make it practical for web-based authentication YET unless you're willing to install a browser plugin... you need to synchronize your credentials somehow (for example to be able to login in from your tablet, phone and PC) which means you also need software to synchronized your credentials etc... In theory the technology is great... in practice it's just not there YET and maybe it will have the same fate as PGP: it'll be considered to cumbersome/difficult for your average user to manage. A centralized system will surely be accepted but you lose out on privacy.