Usage Control Specification, Enforcement, and Robustness: A Survey

Akaichi, Ines; Kirrane, Sabrina

doi:10.48550/arxiv.2203.04800

Cited by 3 publications

(5 citation statements)

References 77 publications

(457 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The following concrete requirements are derived from our motivating scenario. The two top level requirements, which are inspired by the seminal work of Akaichi and Kirrane (2022b), are subdivided into more concrete sub-requirements.…”

Section: Requirementsmentioning

confidence: 99%

“…(R1) Resource utilization and policy fulfillment must be managed by trusted entities. According to Akaichi and Kirrane (2022b), a usage control framework must provide an enforcement mechanism that ensures usage policies are adhered to both before and after data are accessed. Therefore, the data market must be able to able to handle the access control and additionally the nodes of a decentralized environment must be equipped with a dedicated component managing the utilization of resources owned by other nodes.…”

Section: Requirementsmentioning

confidence: 99%

“…Frontiers in Blockchain frontiersin.org (R2) Policy compliance must be monitored via the entities of a governance ecosystem. According to Akaichi and Kirrane (2022b), usage control frameworks must incorporate a policy monitoring component. The monitoring, performed through one or more services, enables nodes to detect misconduct and unexpected or unpermitted usage.…”

Section: Subject Action Object Constraintmentioning

confidence: 99%

“…In order to better cater for use case scenarios that involve data sharing across various distributed data stores underpinning decentralized applications, there is a need for tools and technologies that are not only capable of working with distributed data but are also able to manage data resources that come with a variety of usage terms and conditions specified by data producers. However, the vast majority of decentralized web initiatives, which aim to provide users with a greater degree of control over personal resources, manage data access via simple access control mechanisms (Tran et al, 2005;Toninelli et al, 2006;Ouaddah et al, 2016) that are not able to verify that usage conditions are adhered to after access has been granted (Akaichi and Kirrane, 2022b). For example, access control rules can determine if users can retrieve data or not.…”

Section: Introductionmentioning

confidence: 99%

“…Bonatti et al (2020) introduce the SPECIAL usage control policy language, which considers a policy as the intersection of basic entities governing data, processing, purposes, location, and storage of personal data. A comprehensive overview of existing usage control frameworks and their respective languages is provided by Akaichi and Kirrane (2022b) and Esteves and Rodríguez-Doncel (2022).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Blockchain based resource governance for decentralized web environments

et al. 2023

View full text Add to dashboard Cite

Decentralization initiatives such as Solid, Digi.me, and ActivityPub aim to give data owners more control over their data and to level the playing field by enabling small companies and individuals to gain access to data, thus stimulating innovation. However, these initiatives typically use access control mechanisms that cannot verify compliance with usage conditions after access has been granted to others. In this paper, we extend the state of the art by proposing a resource governance conceptual framework, entitled ReGov, that facilitates usage control in decentralized web environments. We subsequently demonstrate how our framework can be instantiated by combining blockchain and trusted execution environments. Through blockchain technologies, we record policies expressing the usage conditions associated with resources and monitor their compliance. Our instantiation employs trusted execution environments to enforce said policies, inside data consumers’ devices. We evaluate the framework instantiation through a detailed analysis of requirments derived from a data market motivating scenario, as well as an assessment of the security, privacy, and affordability aspects of our proposal.

show abstract

Section: Requirementsmentioning

confidence: 99%

Section: Requirementsmentioning

confidence: 99%

Section: Subject Action Object Constraintmentioning

confidence: 99%