Controlling the usage of business-critical data is essential for every company. While the upcoming age of Industry 4.0 propagates a seamless data exchange between all participating devices, facilities and companies along the production chain, the required data control mechanisms are lacking behind. We claim that for an e ective protection, both access and usage control enforcement is a must-have for organizing Industry 4.0 collaboration networks. Formalized and machine-readable policies are one fundamental building block to achieve the needed trust level for real data-driven collaborations. We explain the current challenges of specifying access and usage control policies and outline respective approaches relying on Semantic Web of Things practices. We analyze the requirements and implications of existing technologies and discuss their shortcomings. Based on our experiences from the speci cation of the International Data Spaces Usage Control Language, the necessary next steps towards automatically monitored and enforced policies are outlined and research needs formulated.
Industry 4.0, the disruptive development arising from new, internet-based automation and data exchange technologies, has drawn much attention in the recent times. New solutions become evident in the context of the production industry, enabling the interconnection of heterogeneous devices, machines, and facilities but also to link suppliers, manufacturers, and customers along the whole supply chain. However, current solutions are mostly limited to closed domains with strictly de ned use cases, which results in isolated silos.
Consequently, only the establishment of secure and e ective data protection
mechanisms will provide the necessary trust level. In this paper, we explicitly do
not focus on methods to establish secure communication channels or to harden
a system against malicious attacks. In contrast, we present our insights in the
Copyright c 2019 for this paper by its authors. Use permitted under Creative
Commons License Attribution 4.0 International (CC BY 4.0).
aspect of data access and usage control and how Semantic Web technologies can
make a di erence if used on top of secure communication channels. To this end,
we present our experiences in the development of an end-to-end usage control
framework for the International Data Space (IDS) [
In this context we make the following contributions: (1) we present the current state of the art on formulating usage policies and their implications on usage enforcement systems, (2) describe our assumptions and the challenges in the current technology stack, (3) outline feasible solutions by relaying on Semantic Web of Things practices, and (4) conclude with a description of the existing research gaps but also depict necessary progress in the attitudes towards the topic from a business decider and legal view on usage control in Industry 4.0 settings. 2
One of the most in uential usage control models is UCONABC [
Mazzoleni et al. [
Pretschner and Walter [
Speiser [
The Open Digital Rights Language (ODRL2.2) [
https://www.specialprivacy.eu/
A formalized usage control language has several advantages. While the most obvious one is the enabling of e ective enforcement of usage rules, proactively preventing misuse, an according implementation requires an extensive control regime with strict demands on the deployed IT landscape but also the related interaction processes. However, the sole provision of machine-processable descriptions of contract o ers and requests already allows new search and discovery services. A commonly understood, semantically de ned language enables the seamless exchange of contractual constraints, capabilities and applicable actions. Even though a comprehensive end-to-end usage control framework still has to be developed, the various enhancements by machine-interpretable policies in combination with cryptographic veri cation methods and transparent certi cation processes already increase the trustworthiness through technical approaches. 3.1
In the context of the Web, identi cation of resources is done by URIs and, in case of locating, URLs. In SWoT, identifying `things' with URIs has the bene t of globally unique identi ers. Still, the distinction between the actual physical thing and digital representations providing information about the physical thing (referred to as data documents in the following) is essential. In the context of usage control, a policy may (a) refer to either the thing itself or (b) the documents. In the rst case, the challenge is to reliably and transparently identify all data documents, in any possible format or appearance, related to the physical thing. In particular, it is a non-trivial task to connect a potentially anonymous JSON or XML with a speci c resource in a situation where usually only incomplete information about its provenance are available. For case (b), any transformation or multiplication must be controlled. For instance, if an edge gateway processes and aggregates a sensor stream, the output may not have any explicit attribution to the facility it origins. Still, an informed expert of a related company can derive critical insights and may gain a competitive advantage. 3.2
Connectivity in Industry 4.0 has many aspects. The most prominent view on connectivity is the ability to connect the heterogeneous devices and systems of a production plant with each other and further services. In the case of usage control, we take the general connectivity and interoperability challenges as solved by SWoT approaches and primarily focus on the exchange of unambiguous policy formalizations. In this context, a common data format has to be speci ed, a shared vocabulary with a suitable expressiveness has to be de ned and standardized APIs and interaction patterns are needed. Similar to proposed data interoperability by SWoT best practices, policies and contracts need to be shared and have to be unambiguously understood. Still, respective standards in particular for vocabularies and their interpretation for the usage control domain have to be formulated and implemented.
The unambiguously interpretability of the e ecting policy patterns must be guaranteed. Each statement of a policy must allow the unambiguous derivation to either `true' or `false' for any situation. The resolvement of sequences, requirements but also negotiations or concatenations must be de ned.
Several further challenges hinder automatic decision making for usage control systems. We de ne several stages of increasing complexity in order to structure the topic and illustrate dependencies. At the rst stage, only feature-value based comparisons (1) are regarded. Decision factors, for instance number of usages, have to be unambiguously identi ed and the location and request method dened. Next, the deciding parameters are provided by an external third party (2). The trustworthiness of this third party and its provisioning endpoint depends on its resilience against attacks and manipulations but also on its ability to reliably provide `the truth'. Examples are scenarios where a payment services con rms whether or not a payment has been received.
For the next category, crucial information is only locally available at the consumer-side (3). In particular, details of the connected back-end systems or data exchange channels a ect the decision-making. In addition, role-based restrictions fall into this category as the membership of user accounts is in general too critical for publication. This is especially demanding as no company is willing, and in many cases also prohibited by anti-trust regulations, to enable full transparency of its IT landscape to an external organization.
Even more demanding are use cases where required events or states are temporally or spatially separated from the usage control system (4). For instance, the obligation to pay before using data is a very reasonable constraint for Industry 4.0 scenarios. Still, the triggering of a payment and the point in time when the payment nally arrives are usually not the same. Usage control systems must be able to react accordingly. 3.4
Beginning with stage (2), the usage control system needs to integrate external information. Information on made payments or other relevant events cannot be trusted if coming from an operator with related, own business interests. In order to stay independent of manipulations by either the provider- or the consumerside, the usage control system must rely on an independent, trustworthy component. The identity of this trusted context provider must be technically veri able and the interaction channel must be secured against manipulation attempts. Most importantly, the provided attributes have to be deployed in a transparent and reliable manner. 3.5
Integration of systems and facilities across company boundaries is at the heart of Industry 4.0. Interactions need to be established and revoked on the y in order to gain the necessary exibility in the creation of work ows. We claim that manually negotiated, designed, and maintained connections are not e cient enough for such use cases. Consequently, systems need to become autonomous to some degree.
Still, the sovereignty and protection of its IT landscape is vital for every participant in an Industry 4.0 network. However, the non-resolvable information asymmetry between di erent companies requires bidirectional negotiations on the level of abilities and requirements. For instance, a data provider cannot reasonably restrict data usage down to the level of used software. It would require complete transparency and control other the consumers IT network. In a typical, decentralized Industry 4.0 setting, with several equally empowered companies, such requirements are unacceptable for the other companies. On the other hand, requesting certain system abilities, like e.g. protected data access or non-proliferation of information, is certainly reasonable and gives the opposite party the necessary options to adjust its systems accordingly. 3.6
Formalized policies currently do not have the same legal quality as typical, fulltext contracts. Currently, policies only describe the willing to cooperate in certain manners without any legally enforceable consequences. Even though data-driven developments and business models have a high priority and visibility for politics, the required legal blurriness of contract formulations. As stated before, no usage control system can work with fuzzy or vague constructs, the requirements and obligations of a contract must allow as little interpretation as possible. 4
The Web of Things comprises several conventions and best practices to target the challenges of the upcoming Industry 4.0. While its core advantages might be seen in its ability to reliably operate decentralized networks and to scale nearly without limits. Still, especially when combined with Semantic Web technologies, the Web of Things provides noteworthy propositions for the previously outlined challenges. 4.1
URIs have proven their value as global identi ers throughout the internet. They are especially useful when pointing at the corresponding data endpoint. In such cases, there the identi er actually also serves as an URL, location and identi cation can be solved at the same time. In the context of usage control, URIs and URLs are well suited for distant resources. That are, for instance, stable endpoints for requesting Linked Data but also remote attributes to make decisions upon. Remote attributes are necessary to formulate constraints on events and states which information upon are provided by a third party. Information about a (not) executed payment for instance might be accessible via a URL.
Another category of referents consists of pointers to information, which are only accessible inside a company network. For instance, user roles and a liation data is usually not opened to external validation. In such scenarios, the restriction to URIs is typically not feasible. Shorter identi ers might be su cient as long as the deployed usage control system can interpret them. Still, a respective trust level can be achieved by either additional contractual agreements or a third party certifying the correctness of the delivered information.
Sets and collections are another challenge which can be solved by a Webbased approach. Again, using URIs can allow a usage control system to dynamically request information on members. However, a recognized information provider (either external for uncritical data or internal for e.g. user permission management) needs to be operated in a long-term fashion.
In addition, an identi cation throughout the attributes of data objects can be feasible. Patterns de ning required attribute manifestations can enable a membership assignment, similar to the identi cation through path patterns approach described above. For instance, a policy construct can express its applicability to a set of data assets by requiring an ID attribute in a certain value range. However, indirect assignments like this are more error-prone than explicit meta data as its adaptability to unpredicted changes of data formats or modeling schemes is lower and hard to track down. 4.2
Connectivity in the context of Industry 4.0 can be examined through several views. For this paper, connectivity is related to the unambiguous exchange of contracts, policies and the additional information resources necessary to interpret and enforce them. The Semantic Web of Things has several contributions to this challenge. First, the ability to dereference resources enables the direct linkage to context information and further descriptions. The application of RDF integrates di erent data formats and API requirements. Widely used conventions, like RESTful interactions, are standardized in combination with Linked Data by the Linked Data Platform recommendations.
The main advantage for a semantically de ned usage control language is its self-descriptive nature. As such, it can contribute best when used as an intermediator between local languages or con gurations. As such, the full expressiveness of the whole language is not necessarily supported by every local systems. Still, every participating component must be able to at least specify non-conformance when requested. 4.3
Depicting attributes by URLs and providing respective information on their current and past manifestation is an obvious approach for category (1). Linked Data promotes a proliferation in such a way.
Comparison operators have to be standardized. While the semantics of commonly used mathematical operators, like equals, lower than, or greater than, is trivially clear, the application of operators on more complex datatypes requires signi cantly more e ort.
Furthermore for the Semantic Web, the issue of datatype comparison has not been solved yet. In order to implement a usage control system working with RDF data, the inability of comparisons like \2"^^xsd:integer == \2.00"^^xsd:double == \2"^^xsd:string is a major obstacle. The further propagation of RDF and Linked Data in this context requires standardized methods to solve this issue.
In cases of integrating additional resources or endpoints (see category (2)), the SWoT approaches give direct guidelines. Interacting with remote data by Linked Data or Linked Data Platform speci cations standardizes the interactions and gives mature and well-known patterns. These approaches are also applicable when decision factors are only accessible at certain locations (3). Still, there is the risk that the semantics and structure of URIs or other identi ers already exposes protected information. A URI for instance might give hints to back-end components, which existence would not have been recognizable otherwise. More generally, the indirect but necessary outlining of abilities and requirements in the form of policies (or other exchanged meta data) may already constitute a risk for one of the participants.
If such actions are unavoidable through the nature of the necessary decisions, a framing contract between the respective organizations must specify the allowed interactions. In that case, one can argue that the policy formalizations are overruled by the framing contract in any case as this contract must act as the source of trust. Consequently, the necessity of human interactions limits the usability of usage control systems to the current state of explicitly regulated company-to-company interactions backed by extensive, textual contracts. 4.4
In a typical usage control setting, decision factors that are not observable to one party always reduce the level of trust. In order to avoid such situations, as much as possible should be hosted by a trusted party, which might also be the data provider but does not need to. Such a trusted Policy Information Point (PIP) serves as a source of truth, accepted by both parties.
As a result, we consider a trusted PIP as a necessary technical component with high requirements related to the acquiring of context information but also as an important business role in the usage control environment. One can think of several models to reimburse the provisioning of trustworthy information, similar to other infrastructure service providers like an identity provider, a certi cation authority and so on. 4.5
The di ering requirements and conditions of the involved parties necessarily lead to a process of aligning the respective o ers, prohibitions and constraints. For long-term scenarios, the time-consuming dialog between human actors is still su cient. However, in scenarios with data requests and consumption on the y, (semi)autonomic agents have the potential to quickly reach agreements in dened ranges. In order to do so, the problem of agreeing on usage contracts needs a mathematical formalization with suitable utility functions and formalized constraints. To the best of our knowledge, no current system is able to translate contracts and contractual clauses into suitable equation systems.
Even though several approaches have been made to tackle the resolution of con icting policies, we claim that there is still signi cant research potential. One exemplary fact contributing to this issue is that, regarding the ODRL 2.2 recommendation, prioritization of policies cannot be su ciently modeled.
Furthermore, an automated negotiation of usage contracts requires a high
degree of situation-awareness at all involved components. Even though many
papers discuss steps to assign agents with this task ([
As stated, currently policies are not su cient to replace textual contracts. While the unambiguous description of their content has advantages for assisted searching or matchmaking, no existing system can reasonably state whether a formalized policy passes an examination at court or not. However, we identify a number of core obstacles in the related (EU-wide) legislation: The prohibition of automized decision making, the primacy of textual contracts, the necessity of interpretation of contractual clauses and the privacy regulations framed by GDPR. It is not the scope of this paper to discuss the necessary evolution of these principles but to make aware of their implications.
The prohibition of automized decision making reserves the nal decision making to a human. This restriction is hard to accomplish when decisions are necessary on the y and with high frequency. Framework agreements might help to describe general patterns but cannot be speci c enough for in situ decisionmaking. The primacy of textual contracts refers to the fact that the nal escalation stage in any business context is always a court trial. For now, legal experts will only decide on the textual version of a contract. In contrast to that, the usage control system can only decide based on the formalized policy. The crucial assumption herein is the consistency of the textual and formalized versions. If that cannot be guaranteed { and no system known to the authors is able to do so { unpredictable consequences arise. 5
The International Data Space [
While the proposals of the previous section were mainly also introduced into the IDS Usage Control Language, at several points stricter restrictions had to be made in order to avoid currently unsolved problems. The trade-o in the form of a decreased expressiveness was made on purpose in order to avoid some of the outlined pitfalls. For instance, currently no sequences of activities are supported. Even though that may change in the near future, we claim that currently the implicit and explicit consequences are not su ciently understood.
This results in a very limited amount of supported constructs. We deliberately decided to select this strategy in order to establish a stable foundation for future extensions. For now, only rules with one possible action type and primitive, not nested constraints. Further re nement constructs as introduced by the ODLR 2.2 speci cation are not supported in order to restrict the complexity of the policies. In order to control these restrictions and to support users with testing and validation capabilities of their policies, SHACL constraint shapes are supplied for all major classes.
The IDS approach sets white-listing as its default behaviour. We state that this is the only reasonable way as otherwise the consequences of allowing usages that should have been restricted result in unforeseeable consequences. Restricting too many events on the other hand may break work ows but is better manageable as the a ected environment is still limited. A contrary approach would drastically increase the risk of non-allowed usages and thereby unintentionally made obligations. 6
The presented list of challenges depicts the obstacles we faced during the development of the IDS Usage Control Language. This process was driven by the speci c requirements of the IDS and therefore can only constitute an incomplete list. However, we think that most of the drawn conclusions are relevant for usage control languages in general.
Choosing RDF vocabularies for a usage control language has many advantages (e.g. self-descriptive, information linking, clear semantics, etc.), especially for sharing and integrating policies in a Web-powered environment. However, The IDS Usage Control Language is part of the IDS Information Model and can be accessed at https://github.com/IndustrialDataSpace/InformationModel/ the inability to directly specify property links, for instance with priorities or provenance information, hampers the formal representation of usage contracts.
Several of the outlined challenges are still open and require future research. These inabilities, from which we only examined the ones in the context of the usage control language, currently prevent a complete, end-to-end usage control system. Still, we want to strengthen the fact that an iterative approach already has signi cant bene ts at every step. The ability to describe o ers and requests, capabilities to automatically interpret and derive conclusions and, nally, a gradual increase of control and autonomy of the usage control systems enables new business models at each stage.
While at rst proper search engines for actually usable data can be created, a more and more enforced usage control will reduce the concerns regarding misuse and fraud. We see this development as a necessary process to realizable, datadriven business cases for and beyond Industry 4.0.