Automated usage control for secure data sharing based on Ricardian contracts
Eric Chiquito, Alex Chiquito, Ulf Bodin, Kåre Synnes · IECON 2022 – 48th Annual Conference of the IEEE Industrial Electronics Society · 2022
Data is important for the industry to take advantage of digitalization, realize automation, assure quality, and more. Values from data are not only created individually by companies, but also in eco-systems in which data is shared among participating organizations. Secure data sharing is essential in such eco-systems to prevent unauthorized access and use of the data. Usage control extends traditional access control with restrictions concerned with requirements that pertain to data processing contractual obligations, rather than data access provisions only. Thus, usage control is relevant in the context of intellectual property protection, compliance with regulations, and digital rights management. This paper presents a method to negotiate contractual obligations and access provisions, and automatically enforce those provisions with access control. Finalized negotiations establish Ricardian contracts at two levels; a superordinate level with a connected subordinate level. These contracts contain provisions in terms of access control attributes. Using our implementation of a negotiation engine we demonstrate the automatic creation of NIST Next Generation Access Control (NGAC) access control policies. Our negotiation engine uses a lightweight model for the storage of an unforgeable and immutable log of the established contracts based on digital signatures and hashing.