What is Data Usage Control?
In information security, access control selectively restricts access to resources. Depending on the implementation of access control (e.g., ABAC, RBAC, MAC), various aspects are taken into account, when deciding if a subject can attempt a certain action on a specific resource. Data usage control is an extension to these traditional access control models. It is about the specification and enforcement of restrictions regulating what must (not) happen to data, after access has been granted. Data usage control is able to prevent IDS connectors from treating data in an undesired way, for example, by forwarding personal data to public endpoints. In addition, it can work as an audit mechanism that creates evidence and transparency of a compliant data usage. The data-centric perspective of data usage control therefore allows users to continuously control data flows, rather than accesses to services. It is a core building block to establish transparency and self-determination with respect to data usages in the IDS.
Data sovereignty is a key capability of the IDS and the basis for a successful data economy between companies. It is about finding a balance between the need for protecting one’s data and the need for sharing one’s data with others. In order to bring data sovereignty into practice, the IDS makes use of data usage control concepts and provides everything a connector builder needs to implement data usage control: A language to specify usage restrictions, an editor that supports data owners or data providers in the creation of their data usage restrictions (independent of the Data Usage Control technology), and the technology itself to enforce the data owners’ usage restrictions at the consumer side. Besides, the IDS provides strategies for the negotiation of restrictions between data provider and data consumer and the transformation of independent IDS Contracts to technology dependent usage restrictions.
Contents of the position paper
The position paper Data Usage Control in the IDS 3.0 introduces the concept of data usage control in detail – starting by the definition of access control, up to the specification, management and negotiation of policies. Furthermore, it explains, how the IDS technically implements the concept of data usage control within IDS connectors.
The authors dedicate one chapter to the topic of policy specification. They explain the relation to the information model and IDS policy language, the IDS policy editor as well as policy transformation, negotiation and handshake.
Another chapter introduces available and ready to use data usage control Technologies such as the MYDATA Control Technologies, LUCON or Degree. For every technology, the authors explain how the respective technology integrates with IDS connectors. In addition, they compare all technologies based on various aspects in order to support readers in decision-making about what technology to use.
Before discussing ongoing future work, a chapter introduces the reader to the topic of Data Provenance, Transparency and Accountability, which uses the MYDATA Control Technologies to provide a data owner or data provider with the ability of finding out when, how and by whom data was used, and which other data influenced the process of creating new data items.
What is new?
More than one year is a long time in a field like data sovereignty that is the focal point of many discussions. Since our last release, we refined many aspects of data usage control in the IDS. The authors of the document provide the readers with a new chapter describing what is new in the document in order to guide readers of the old document versions to the new content. Besides, the structure changed slightly by a new chapter called “Policy Specification” as the topic evolved over the past years. Moreover, the authors introduce former future work topics (e.g., policy handshake and negotiation, usage control object, in new sections of the main document as they found their way into the IDS connectors. Throughout the document, the authors clarify the usage and define various Usage Control specific terminology in IDS Contracts. Remaining topics like IDS Usage Control Technologies and Provenance Tracking are now up to date again.
Download the position paper ‘Data Usage Control in the IDS’ here:
