Contract No.: 285248 Strategic Objective
FIWARE OpenSpecification Security Data_Handling_Generic_Enabler
Download 1.78 Mb.
|
- Navigate this page:
- 15.4.1Relevant Concepts and Ideas
- 15.4.3PPL Architecture
- 15.4.4Example Scenarios
- Store Data with Sticky Policies
- Retrieve Data from the file store
15FIWARE OpenSpecification Security Data_Handling_Generic_Enabler
15.1PrefaceWithin this document you find a self-contained open specification of a FI-WARE generic enabler, please consult as well the FI-WARE_Product_Vision, the website on http://www.fi-ware.eu and similar pages in order to understand the complete context of the FI-WARE project. 15.1.1Copyright
15.2Legal NoticePlease check the following FI-WARE Open Specification Legal Notice (essential patents license) to understand the rights to use this open specification. As all other FI-WARE members, SAP has chosen one of the two FI-WARE license schemes for open specifications. To illustrate this open specification license from our SAP perspective:
15.3OverviewThe Data Handling GE is a privacy-friendly attribute-based access control system, which targets mainly sensitive data. It permits to store information together with an attached privacy policy, which regulates its usage. Thus, the Data Handling GE can reveal certain attributes, according to specific supplied conditions. The Data Handling GE supports integrated data handling (two-sided detailed data handling), that takes into account specific preferences/policies expressed using PPL (Privacy Policy Language)[PPL]. PPL is based on the XACML standard [XACML]. Data usage purpose must always be declared, as it is a relevant part of the policy that must be expressed, as well as downstream usage, i.e., whether one can disclose collected data with third parties. PPL supports the enforcement of a number of obligations, which are bound tightly to data. For instance, one can impose a specific retention period, as well as the production of user's notifications and/or logging under certain conditions. For the third release of this GE, we propose a new feature called Identity Based Data encryption. This feature offers the possibility to ecrypt the data that will be stored in the database. We use the identity of the receiver or the delegate as public key for encryption. Only the owner of this identity will be able to decrypt the data with the private key associated to its identity. 15.3.1Target usageThe Data Handling GE provides a mechanism for controlling the usage of attributes and data (more precisely, of Personal Identifiable Information or PII) based on the concept of ‘sticking’ a data usage policy to the data to which it applies. When the data is accessed by an application, an access control technology is then used to verify that the intended use of the data matches the scope defined in the usage policy. Therefore, the Data Handling GE can be used by any application or service that would offer a transparent data handling policy to users and third parties. In the example scenario later proposed, we propose to use the API of the Data Handling GE for a file storage website that is collecting private data of the subscribed users. 15.4Basic Concepts15.4.1Relevant Concepts and IdeasIn this section, the more important concepts shall be presented. The used terminology is coherent with definitions contained in the European Parliament Directive 95/46/EC, "on the protection of individuals with regard to the processing of personal data and on the free movement of such data". More detailed information is provided in the Terminology section. Data Controller "Data Controller" indicates the entity which (alone or jointly with others) determines the purposes and means of the processing of personal data. Data Subject The Data Subject is the person whose personal data are collected, held or processed by the Data Controller. The Data Subject has the right to access his data and to require the Controller to rectify without delay any inaccurate or incomplete personal data. The Data Subject has the right to require the Controller to erase data if the processing is unlawful.
Personal Data means any information relating to an identified or identifiable natural person or "Data Subject". An identifiable person is someone who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.
A software system (such as a web browser) acting on behalf of a user. The user agent acts on user preferences when dealing with a server acting on behalf of a Data Controller. 15.4.2PII and PPLThe Data Handling GE regulates the access to sensitive data, collected from users. This can be achieved through the association of a set of preferences/policies to each PII; privacy policies are expressed using the PPL. PPL is used:
In fact, for each data access, the Data Handling GE evaluates its purpose, which must always be declared. Access purpose is a relevant part of the policy that must be expressed, and if and only if there is compatibility between the data policy and the request policy, the information is provided to the requester. The Data Handling GE is also responsible for fulfilling obligations contained in PPL policies, like for instance, sending an email to the data owner at each access. 15.4.3PPL ArchitectureThe PPL engine used as core reasoning and enforcing engine for access control and usage control policies has the following structure: 
15.4.4Example ScenariosUse Case: Privacy Aware Online File StoreIn this scenario we describe how the Data Handling Generic Enabler can be used jointly with an online file store service (de ployed in the cloud or in a server) in order to provide the access and usage control functionalities. The data handling GE offers to the user of a traditional file store the possibility to select the users with whom he wants to share his files. He can specify a retention period for his data or his sharing permission. He can configure notification messages alerting him about the access to his files. 
The scenario is executed on two main steps: Store Data with Sticky PoliciesThe user who wants to store his data in a secure manner defines: the list of delegates who can access his data, the deletion period or life time of his data in the store, and a contact medium to be notified on the activities and events happened to his data. The data owner can encrypt the data with the identity of the delegate. Once his data is saved in the store (encrypted or not), a sticky policy representing his privacy preferences will be stored together with the files and the obligation engine of the Data Handling GE service executes the obligation (retention period) monitoring system. 
Retrieve Data from the file storeThe delegates receive a notification when they have access to new files in the store. They can access to the shared files through the file navigator. If the data is encrypted, the receiver has to use the private key related to his identity in order to decrypt the data. Once they access and retrieve accessible files, the Data Handling Service will send a notification to the data owner to inform him about the access details (who accessed, when, where, etc.). The Data Handling GE is in charge of enforcing the Access Control rules imposed by the data owner and execute the obligations on the usage of the data. 
Download 1.78 Mb. Share with your friends:
|