Nowadays, business is spurred by continuously sharing information between business partners. However, data is typically only protected by access control mechanisms. Once access to data is granted, data can be altered, copied, and disseminated by the recipient. It is comparable to giving somebody your house key and hoping the person will only use it the way you intended.
But of course, there are better ways. Data usage control offers possibilities to control future data usage beyond the initial access. Usage control prevents misuse of data, protects intellectual property, preserves the data value, and helps companies comply with legal obligations regarding the usage.
The IDS standard provides solutions to realize secure and trustworthy data sharing as well as data sovereignty. Data sovereignty means a data owner has full control over the data – a key success factor for data-driven business models. Usage control is necessary to uphold data sovereignty. It regulates data access and sharing within data spaces. IDS empowers participants to define access permissions and establish data sharing guidelines in contracts.
Understanding access control models
Let us take a closer look at how this works. Access control restricts the access to the resources. It is about authorization, the process of granting permission. There are two main models: role-based access control (RBAC), verifies if the user’s role matches the one requested. For example, only an administrator or developers can access the data. Attribute-based access control (ABAC) defines attributes and checks if these attributes meet the requirements before providing access to the resource. Attribute-based access control is also known as policy-based access control (PBAC) because it grants access rights to users based on defined policies. The policies can combine multiple attributes, including subject, resource, or environmental attributes.
How do you evaluate the policy and enforce it? Imagine a user seeking access to a document. The decision lies within a component, the policy enforcement point (PEP), but how does PEP know when to allow access to this data? PEP queries a policy decision point (PDP), the system’s decision-making core. However, this decision must be based on policies and attributes, which are stored in a repository managed by a policy retriever. The PDP, that wants to make the decision against the policy from the database, makes the decision. If all policies are fulfilled, the decision point (PDP) can let the data flow. Access is granted.
Find the second part of the article here: Data usage control – indispensable to enable data sovereignty | part 2 – International Data Spaces
