Data ecosystems are the foundation of emerging data-driven business models as they (i) enable an automated exchange between their participants and (ii) provide them with access to huge and heterogeneous data sources. However, the corresponding benefits come with unforeseen risks as also sensitive information is potentially exposed. Consequently, data security is of utmost importance and, thus, a central requirement for the successful implementation of these ecosystems. Current initiatives, such as IDS and GAIA-X, hence foster sovereign participation via a federated infrastructure where participants retain local control. However, these designs place significant trust in remote infrastructure by mostly implementing organizational security measures such as certification processes prior to admission of a participant. At the same time, due to the sensitive nature of involved data, participants are incentivized to bypass security measures to maximize their own benefit: In practice, this issue significantly weakens sovereignty guarantees. In this paper, we hence claim that data ecosystems must be extended with technical means to reestablish such guarantees. To underpin our position, we analyze promising building blocks and identify three core research directions toward stronger data sovereignty, namely trusted remote policy enforcement, verifiable data tracking, and integration of resource-constrained participants. We conclude that these directions are critical to securely implement data ecosystems in data-sensitive contexts.
software and develop defense-in-depth strategies for
protection [4]. Participants receive no additional security
Data-driven business models are an invaluable pillar for guarantees beyond this ahead-of-time certification and
modern industries, and their importance will increase have no means to verify that other participants handle
with growing demands requiring more complex and glob- their data as intended (and required). Here, the lack of
ally distributed operation, as well as sophisticated collab- stronger guarantees efectively ends sovereignty of
parorations to improve the status quo [1]. Data ecosystems ticipants in the moment of sharing.
provide the foundation for such data-driven business In this paper, we argue that data ecosystems need to
models as they center around automating data exchanges provide their participants with strong and continual
guarand value creation based on huge and heterogeneous data antees about the security of their provided data to
mainsources from various stakeholders [
However, current eforts to establish the necessary sated for the value of the data they provide and questions trust among stakeholders heavily rely on organizational whether data ecosystems are adequate to exchange data agreements and processes [6, 4]. For instance, the IDS subject to privacy regulation. Consequently, data owners certification process asserts that participants use audited might restrict their data-sharing eforts or leave the data ecosystem entirely. Hence, data ecosystems require solid Proc. of the First International Workshop on Data Ecosystems (DEco’22), technical measures, such as cryptographically enforceable September 5, 2022, Sydney, Australia guarantees and verifiable continual security monitoring, *$C olorrhemspooenllderin@gcaoumthsyosr.rwth-aachen.de (J. Lohmöller); to facilitate the establishment of trust between remote pennekamp@comsys.rwth-aachen.de (J. Pennekamp); and potentially mutually unknown participants. In this matzutt@comsys.rwth-aachen.de (R. Matzutt); paper, we provide more background on the current state wehrle@comsys.rwth-aachen.de (K. Wehrle) of data ecosystems, identify shortcomings of ongoing 0000-0003-2101-5562 (J. Lohmöller); 0000-0003-0398-6904 data ecosystem initiatives, and derive and discuss future (0J0. 0P0e-n00n0e1k-a7m25p2);-40108060-(0K0.0W2-e4h2r6l3e-)5317 (R. Matzutt); research directions steered toward improving the sover© 2022 Copyright for this paper by its authors. Use permitted under Creative Commons License eignty and trust of participants in data ecosystems. CPWrEooUrckReshdoinpgs IhStpN:/c1e6u1r3-w-0s.o7r3g ACttEribUutRion W4.0oInrtekrnsahtioonpal (PCCroBYce4.0e).dings (CEUR-WS.org)
operator association certify
certify To ensure a common understanding of the trust issues data owner data user with today’s data ecosystems, we first briefly introduce data data data ecosystems, the notion of data sovereignty, and com- provider consumer mon participants in this context. Moreover, we present a data ecosystem short overview of data ecosystem initiatives focusing on Figure 1: Participating entities in data ecosystems. Data their currently implemented security measures. flows from left to right, with data provider and data con
Ecosystem Goals. The need to share data with col- sumer implementing a common ecosystem interface. The
laborators within specific sectors has been recognized in data ecosystem’s operator also handles orthogonal tasks,
ina variety of domains, including supply chains [8], public cluding admission and discovery of participants and data.
health [
Definitions. So far, we have seen data ecosystems platform. Some initiatives rather bundle forces toward only as a means for exchanging data as required in emerg- the adoption of data ecosystems in general (Data Sharing data markets and other use cases [3]. In fact, data eco- ing Coalition, CEF, BDVA), while IHAN, for instance, systems emerged without a standard definition in mind. is in an early stage, without publicly released techniOliveira and Lóscio [15] address this gap by reviewing cal documentation so far. Out of the named initiatives, and merging concurring data ecosystem definitions; as IDS [4], GAIA-X [5], and FIWARE [27] have released a result, they define a data ecosystem as a combination technical documentation that permit a deeper analysis of independently operated networks that produce and with regard to implemented data security and trust meaprovide data, but also other assets like software or ser- sures. Specifically, IDS and GAIA-X both work toward vices. Furthermore, the authors highlight that such data a standard interface to locate and access data and proecosystems are self-regulated and driven by collabora- vide an organizational context, including identification, tion and competition between actors [15]. Additionally, admission, and certification of participants [ 14]. Thus, we emphasize that data ecosystems form platforms that in the remainder of this paper, we primarily study these have to define common interfaces and rules to enable general-purpose initiatives. While IDS aims to provide a collaboration across independent networks. Accordingly, framework under which data spaces can be built quickly, we refer to data ecosystem participants as networks that e.g., targeting a specific domain with coherent particiimplement the interfaces and accept the rules defined by pants, GAIA-X plans to establish a single central crossa given ecosystem. domain platform [14]. Moving toward domain-specific
Similarly, the notion of data sovereignty, i.e., one of concepts, initial projects such as CATENA-X [28], an inithe critical concepts of data ecosystems, currently lacks tiative inside the automotive domain, are picking up their a clear and common definition [ 16]. If used in the con- ideas, while established platforms such as FIWARE [24], text of data ecosystems, researchers generally agree that a framework to connect smart devices, start to provide data sovereignty relates to control and ownership of data compatible interfaces [29]. items, together with specific claims and obligations made Architecture. Despite their slightly diferent scopes, by involved parties [17, 18, 19, 20]. Hence, within this IDS and GAIA-X share a similar architecture, so we anpaper, we will focus on this aspect of data sovereignty. alyze both initiatives together as data ecosystem impleTo set this into a broader context, the review by Hum- mentations. Organizing the data exchange, data ecomel et al. [16] describes data sovereignty as covering systems commonly assign diferent roles to participants. Figure 1 shows the overall scenario we are considering to- data and enforcing certain duties to be adhered to when gether with the main participants. A single data exchange processing data. Such a policy could be, for instance, can be considered bilateral, such that we can suppose the permission to use a dataset for one week, with the the following roles [4]: First, a data owner legally owns obligation to delete it after that time. the data to be shared and is interested in enforcing their To implement usage control, IDS utilizes and extends rights on the data if it is shared. Second, a data provider ODRL [33], a policy language for digital rights managetakes over the technical part of ofering a dataset to be ment that allows fine-grained modeling of usage terms [ 4]. exchanged on behalf of the data owner. For enforcement, the data owner has to trust that the con
While a single entity certainly can take over both roles, suming party abides by the negotiated terms. To this end, i.e., host the infrastructure to provide their data, in certain he can only rely on the certification of the consumer resituations, the providing entity does not formally own the quired to join as a participant, but can neither monitor data. For instance, this situation is the case for electronic the process himself, nor receive a credible proof that ushealth records owned by patients, which typically do not age terms were enforced. However, since the negotiated provide the infrastructure on their own. On the receiving contracts might also involve monetary compensation, side, a data consumer requests and receives the data from the consuming party has incentives to disobey negotithe provider and passes it to a data user, who processes ated terms, e.g., using data more often than requested, the exchanged data, e.g., by visualizing it. Again, the sourcing it for other purposes, or sharing it with other consumer might also fulfill the data user role if both systems or third parties. processes are co-located. Noteworthy, GAIA-X does not Legal Context. Providing an environment for data exseparate the data consumer and data user [5], but we change, the IDS builds upon surrounding legal contracts continue using both terms to separate the logical roles, to equip participants with the means to establish credias described above. bility with each other [34]. Specifically, such contracts
Due to the distribution of providers and consumers, regulate the terms of usage and the overall setting, e.g., data ecosystems operate as a federation of independent regarding a monetary compensation [4] or a penalty for deployments that jointly form a decentralized system. breach of contract. Contracts can be bilateral or multilatThereby, data owners can keep their sensitive datasets eral but will typically not cover the entirety of data space under their control until they actively decide to share participants [4], thereby limiting spontaneous data acthem with selected participants. To this end, data eco- cess. Within negotiated legal contracts, data ecosystems systems enable data sovereignty up to the point where a such as IDS then plan to (automatically) negotiate a redata sharing decision has been made and data is actually fined technical contract. This refined contract translates transferred to the data consumer. terms into machine-readable policies that grant specific
Trust. To not let sovereignty end at the point of data permissions on the exchanged dataset and potential obliexchange, data ecosystems currently require a certifica- gations [4]. tion of participants. Hence, they ensure that all entities handling data adhere to a common baseline w.r.t. data protection. Certification includes, but is not limited to, 3. Data Ecosystems Need Technical defense-in-depth strategies and security event monitor- Security Guarantees ing systems [30, 31]. Specifically, the IDS requires prior certification steps and attests successful certification via Having outlined the fundamental ideas of sovereign data a public key infrastructure, establishing a trusted iden- exchange and the technical and organizational frametity layer [4, 14]. Contrarily, GAIA-X does not target work data ecosystems provide, we now critically review a specific certification but requires participants to pro- the design decisions of security mechanisms implemented vide a standardized self-description with claims that are in state-of-the-art data ecosystems. To this end, we anachecked before a participant’s admission [14]. In both lyze the available technical documentation and reference cases, the ecosystem equips participants with the means architecture for IDS and GAIA-X. Primarily, we identify a to identify each other and establishes a common ground lack of technical means to facilitate strong security guarfor mutual trust decisions. antees and establish strong trust between participants.
Based on the ecosystem-wide identity layer, data eco- Namely, the current ecosystem initiatives can only partly systems can provide fine-granular access control to data address the security and trust requirements with their and let data owners limit the target audience they are frail certification-based approaches. willing to share their data with. However, access control Attacker Model. Guiding our position that data ecoalone is insuficient, as data sovereignty would end once systems require stronger data protection mechanisms, we the flow of data between participants took place after apply the notion of a malicious-but-cautions attacker [35]. access has been legitimately granted. Usage control [32] Specifically, the malicious-but-cautious attacker can miscould possibly fill this gap by granting specific rights on behave in all possible ways but aims not to leave any verifiable evidence of its misbehavior [ 35]. Compared data owner depends on fortunate coincidence to notice to an honest-but-curious (or semi-honest) attacker, this malicious behavior retrospectively. Consequently, we definition includes explicitly local deviation from proto- argue that data owners will refrain from ever sharing cols unless they are verifiable by externals. With data sensitive data. With such datasets covering manufacturecosystems exchanging data within established legal con- ing plans [8], the identity of suppliers [39], or privacytracts, we argue that participants aim to avoid being sued sensitive health records [40] the lack of enforcement for their misbehavior and hence, have incentives not to guarantees severely limits the kind of data exchangeable. leave any evidence. To this end, a malicious-but-cautions Hence, such scenarios require stronger data sovereignty attacker reflects the typical power and incentives of data guarantees than the currently envisioned (weak) organiecosystem participants who source, process, and utilize zational measures. somebody else’s data. Partly addressing this issue, IDS can utilize trusted
Data Security. Current notions of data security in- platform modules (TPMs) as a trust anchor on remote clude security at-rest, in-transit, and in-use [36]. At-rest systems [4]. However, merely providing verification of security and in-transit security are considered solved the running software, but essentially lacking memory problems in the context of data ecosystems as they can encryption, TPMs still contribute little to an efective use widely available building blocks such as storage en- protection against malicious-but-cautious attackers. cryption and transport layer security (TLS), respectively I2: Trusted Data Usage Reporting. Besides efective [4]. Contrarily, in-use data security targets data at the usage control, usage transparency is a second cornermoment of processing, e.g., when the decrypted data is stone to strong data sovereignty and essential to increase loaded into memory and is hence more dificult to ensure the participation of data owners. To this end, data ownand implement. Technical or cryptographic measures ers that grant permissive access to their data shall still to protect data by providing in-use security include, for be able to track usages of their data in remote systems instance, hardware-assisted security or homomorphic transparently. Within IDS, a clearing house entity is encryption [37, 38]. However, despite these measures, designated to address part of this problem by enabling today’s data ecosystems build their guarantees regarding billing-relevant usage logging [4]. However, similarly data in-use security upon remote participants’ honesty to I1, there is currently no technically or cryptographito enforce certain rights on shared data. Unfortunately, cally enforced guarantee that data usage must be logged. with monetary compensation handled as part of data Hence, data users can easily circumvent the implemented exchange and transfers entrusted for a specific purpose, logging features of today’s data ecosystems and thereby incentives to evade enforcement clearly exist. exceed granted usage terms without being caught, such
Hence, we argue that the following questions are criti- as evading downstream payments for data usage. cal to the adoption of data ecosystem initiatives in data- I3: Sovereign Participation without Own Infrassensitive domains: tructure. A third cornerstone of strong data sovereignty is the free choice of data owners with whom to exchange • I1: How can data owners trust remote infrastructure to data under which conditions. Within the currently proenforce their granted rights once data has been shared? posed architecture (cf. Figure 1), data owners entirely rely on and trust data providers to serve their data within • I2: How can data owners track their data in a trusted the ecosystem. However, if both roles are distributed way if processed by remote facilities? between separate entities, similar trust issues as between • I3: How can participants with little resources maintain the providing and consuming parties also apply here. sovereignty without requiring them to host their own Specifically, the owner needs to trust the provider to infrastructure? serve the agreed policies and not misuse data locally.
Moreover, usage reporting systems must not assume the In the following, we elaborate on these high-level de- provider to be trusted in this case. Hence, the providing sign questions regarding strong data sovereignty when side of a data exchange requires the same measures to implemented in practice. implement reliable trust as the consumer side.
I1: Trust in Remote Rights Enforcement. A first Takeaway. Today’s data ecosystems only provide data cornerstone of end-to-end data sovereignty is the guar- protection via organizational means, such that there is no anteed enforcement of digital rights on remote systems, protection against malicious-but-cautious inside attacki.e., usage control. However, suppose a privileged user on ers on remote systems. At the same time, monetary data the consuming side, e.g., a system administrator, copies usage compensation and usage restrictions create incenexchanged data without leaving traces in audit-relevant tives to evade enforcement mechanisms. Currently, these logging systems. This unintended behavior renders us- shortcomings limit the applicability of data ecosystems age control enforcement inefective. While we anticipate to share sensitive datasets and thus need a remedy. that such an action would violate negotiated terms, the
insuficient when considering, a malicious-but-cautious adversary who does not provide a trustworthy environment for storing or processing the exchanged data.
The current data ecosystem initiatives strive for seam- Hardware-based Trusted Execution Environments lessly interconnecting businesses and facilitating the au- (TEEs), such as Intel SGX, AMD SEV, or ARM TrustZone, tomation of valuable data exchanges. However, in the are promising candidates for closing this gap in the last section, we identified severe open issues ( I1–I3) that future [49]. The goal of TEEs is to provide a trustworthy impede each participant’s data sovereignty in situations computing environment that can be established even where organizational trust mechanisms, such as required on untrusted remote infrastructure. To this end, a certification prior to admission to the ecosystem, are in- TEE provides an isolated (i.e., memory-encrypted) suficient. Given the competitive advantage a participant environment for running applications with the ability can gain by acting in a malicious-but-cautious manner (cf. to verify the integrity of the executed program code Section 3), these open issues only become more pressing. remotely. A CPU-embedded cryptographic key provides Hence, with the data sovereignty of their participants in the required trust anchor that allows the data owner to mind, data ecosystems must deploy additional means to verify correct execution independently of the remote allow them to establish trust in that new market. host’s operating system [49]. Consequently, TEEs
In this paper, we argue that only technical means provid- allow for trustworthy remote execution by hiding the ing strong cryptographic guarantees are suitable to reach program’s execution state and hardening it against the goal of trustworthy data ecosystems that retain partic- hampering. ipants’ data sovereignty. Next, we discuss how available Implementing policy enforcement and data processing building blocks can be integrated into data ecosystems inside such environments has the potential to resolve to address each of the open issues I1–I3. the trust issues data ecosystems are currently facing. However, TEE technology is an active field of research, and current implementations still experience security 4.1. Trusted Remote Policy Enforcement issues [50]. For example, today’s TEE implementations (I1) are prone to side-channel attacks that allow for limited data extraction [51]. Countermeasures such as oblivious RAM [52] are being investigated to fix these vulnerabilities, and we expect that future enclave designs will provide further remedies against other technical issues as they are being discovered. Hence, TEEs are a promising building block for improving data sovereignty in data ecosystems via technically enforceable data policies.
However, further research into hardening TEEs against unintended security breaches is required to improve their applicability to data ecosystems. In fact, in a related context, first work [ 37] demonstrates the applicability of TEEs in a trusted data sharing setting.
We thus call for the established initiatives and researchers to further investigate the utility of TEE technology for data ecosystems to reliably address the lack of trustworthy and technically backed policy enforcement.
The foundation of strong data sovereignty in data ecosystems is providing data owners with an assurance that the data ecosystem will enforce terms and conditions on their behalf. Although today’s data ecosystems lack trustworthy remote enforcement of data usage terms (I1), promising building blocks for addressing this issue are already available and used in other contexts. Examples of related building blocks are distributed usage control, trusted execution environments, and diferent cryptographic schemes. In the following, we discuss these building blocks, their application areas, and their relation to data ecosystems.
Distributed usage control [41, 42, 43, 44, 45, 46] is an established field of research that focuses on modeling and technically enforcing usage terms, so-called policies for data usage. Data ecosystems have already adopted the notion of policies in their organizational architecture [4, 47].
However, enforcing these policies proves dificult as the 4.2. Verifiable Data Tracking (I2) data owner cannot directly observe the misconduct of a data user or the consequences thereof [48]. Hilty and Besides policy enforcement, establishing transparency Pretschner [42] hence propose to provide data owners in data usage is equally important to gain data owners’ with evidence of policy enforcement and limit possible trust. For instance, a data owner might consider granting computations. Both approaches are hard to realize within generous accessibility to their data but require proper ata data ecosystem as they require some technical trust an- tribution by any data user. In such a case, the data owner chor on remote systems. Specifically, data ecosystems would profit from technically guaranteed notifications currently do not ofer such trust anchors as the data user whenever a data user accessed the data. gains full control over the exchanged data once it has Currently, IDS implements a clearing house instance, been obtained from the data owner. This situation is which can log data usage if mandated in a policy, making it transparent to data owners [4]. However, data users have neither a strict technical constraint to log data 4.3. Integration of Resource-Constrained usage, nor can the system enforce it by some means. Con- Participants (I3) sequently, IDS cannot currently provide trusted monitoring unless data usage can be observed externally. Hence, With the separation between the data provider and data the current clearing house instance does not solve the owner, data ecosystems also address scenarios that inproblem of verifiable data tracking ( I2). volve particularly resource-constrained or especially pri
Instead, technical or cryptographic means would vacy-aware data owners who are unable or unwilling to help to incentivize logging. To this end, we consider run the complete infrastructure themselves. However, transparency logging, data-flow tracking, and distributed infrastructure control is the foundation of self-sovereign ledger technology promising for establishing verifiable participation in distributed environments [4]. Hence, this data tracking in data ecosystems. approach is not viable for resource-constrained partic
For instance, certificate transparency logging allows ipants. Such participants could be, for instance, small modern web browsers to reject digital certificates that are to mid-sized enterprises (SMEs) in a supply chain connot tracked in a public log for auditors to verify [35]. A text, which have no technical expertise to provide the similar approach might improve data usage transparency infrastructure to participate in a data ecosystem. In this as well. Namely, cryptographically tying the decryption case, their customers may be capable of assuming the role of exchanged data or the transfer of results to a publicly of a data provider collecting data from their contracted verifiable log entry would force data users to log their SMEs and ofering that data on their behalf within the actions accurately. Such approaches are being researched ecosystem. For instance, large automotive manufacturin the field of verifiable computing [ 53, 54] and data eco- ers can assume the role of a data provider on behalf of systems could profit by utilizing corresponding building their, typically numerous, suppliers [8]. In this case, howblocks. ever, data owners lose their sovereignty and depend on
Besides logging, related work also proposes data flow trust in their customers. Thus, appropriate (technical) tracking [55] and data fingerprinting [ 56] to allow for guarantees for such situations are desirable. identifying the source of identified data breaches after A scenario that would give data owners assurance that the fact. However, the cryptographic data fingerprints re- their data is treated as intended would be considering the quired to apply these techniques necessitate knowledge data provider as a diferent party than the data owner; of the exact data representation and a suficient tolerance however, current ecosystem initiatives do not rigorously for minor statistical noise in the monitored data [56]. satisfy this demand [4]. Under this assumption, however, Unfortunately, these fingerprints typically cannot sur- one could implement the same measures discussed in vive intermediate processing steps [56], rendering them Section 4.1 also on the provider side, i.e., realize a trusted inapplicable in some situations. Hence, more research data provider. Moreover, concerning usage transparency, maturing resilient data flow tracking or fingerprinting this scenario requires logs, as discussed in Section 4.2, techniques is required to determine and improve their to be accessible with no own infrastructure. Hence, not applicability in the context of data ecosystems. only the consumer-side aspect of logging must be trusted,
Finally, distributed ledger technology has emerged but also the instance that provides logging on behalf of
in recent years with the explicit goal of facilitating dig- data owners.
ital interactions among participants who do not fully
trust each other. While Bitcoin started by establishing 4.4. Summary
a decentralized and publicly accessible digital currency
based on a blockchain [57], it spawned more versatile Cryptographic building blocks that have been
successdistributed ledgers for any information using smart con- fully applied in the past are promising also to address
tracts [
To avoid additional privacy or data confidentiality text of certificate transparency logging or distributed problems, such transparency mechanisms need to take ledger technology may help satisfy the requirement for privacy into account, e.g., by encrypting log entries [59]. verifiable tracking in data ecosystems ( I2) once they are Overall, technical building blocks for verifiable data track- adapted to the scalability demands of envisioned deploying are already available. However, they still need to be ments. Finally, these measures can also potentially be tailored to the specific verifiable data tracking require- applied when data providers operate on behalf of the ments for utilization in data ecosystems regarding per- original data owner to incorporate resource-constrained formance, scalability, flexibility, and privacy. participants in the process (I3). can provide for their use cases as well as for society in general.
Technical Solutions for Data Sharing. Besides idenThe potential to improve data ecosystems and the need tifying novel use cases for sharing data via data ecosysto address their current issues has also been recognized tems, other research successfully applied technical and in previous work. All in all, data ecosystems are subject especially cryptographic building blocks to tackle the to past and active research alike, especially due to on- general challenges of data sharing in more narrow scegoing large-scale initiatives. In this section, we present narios. For instance, Huang et al. [78] propose a datanotable recent research eforts in data ecosystems. Specif- sharing scheme to later identify sources of data breaches ically, we provide an overview of fundamental research based on oblivious transfers and embedded fingerprints. regarding the organization of data ecosystems, research Moreover, a variety of work considers sharing data with eforts investigating the use cases that would benefit from cloud providers [79, 80, 81, 82, 83, 84], which can be data ecosystems, and works that apply technical security considered conceptually similar to data ecosystems with measures to facilitate data sharing eforts. multiple stakeholders. Such work includes querying en
Fundamental Data Ecosystem Advancements. Oli- crypted data [85], attribute- or identity-based
encrypveira and Lóscio [15] survey the components data eco- tion for access control [86, 74, 87, 39], and distributed
systems typically comprise. Furthermore, several works ledgers together with TEEs to enforce accountability and
discuss requirements and possible ways toward imple- access control [37]. Then again, Bonatti et al. [88]
idenmenting data ecosystems in general, i.e., independent of tify correctness and completeness as desirable properties
specific initiatives [
Use Cases. Another critical aspect of research on framework that allows users to trust the overall system data ecosystems revolves around the use cases they are w.r.t. enforcing their rights at any time, including proparticularly well-suited for. Other works have identi- cessing in remote systems after access was granted and ifed many relevant or desirable use cases in this regard. data was shared.
Among these use cases are the sharing of medical health Based on our analysis of the status quo as well as
onrecords [
With cryptographic and technical solutions, the ways toward stronger guarantees are two-fold and not straightforward. The discussed cryptographic approaches to- 7. Conclusion ward stronger guarantees, i.e., providing usage control and transparency via cryptographic means, implement Today’s data ecosystems facilitate an automated the strongest protection among the discussed techniques exchange of data in a standardized manner while simulbut currently either allow only limited expressiveness taneously providing access to huge and heterogeneous or sufer from a severe performance penalty. Hence, we data sources. Given that these data exchanges and argue that they are currently not suited for general ap- corresponding higher-level applications across domains plication in data ecosystems but should be selectively (e.g., in the automotive industry) also frequently deal applied for the most sensitive datasets, where the named with sensitive information, including business secrets limitations and overheads are acceptable [40]. and data subject to privacy regulations, data ecosystems lutNioenesdpfroovriHdeaardtrwuasrtea-nbcahsoerduSnedceurrtihtey.mHaalircdiwouasr-ebsuot-- umnudsetsiirmabplleeemxepnotsurreelioafbsleensmiteivaesudraetsa. tCourprreenvtelyn,tthaensye cautious attacker model. Moreover, they are less afected measures are mostly based on organizational means, by performance penalties and eventually allow the same which we argue, fail to provide suficient guarantees in operations as standard hardware. However, TPMs, as cur- settings with malicious-but-cautious participants, i.e., rently envisaged by the IDS [4], cannot provide adequate participants who aim to remain unnoticed while still protection of sensitive data due to the lacking memory trying to infer all possible information from the data encryption. Hence, Trusted Execution Environments ecosystem and associated data exchanges. (TEEs), despite current known side-channel attacks and We raise the crucial issue that today’s data ecosystems related weaknesses, seem to be a better choice for strong lack appropriate guarantees w.r.t. confidential processing guarantees regarding data sovereignty expanding to re- on systems operated by third parties, transparency of data mote systems. access and usage, and the participation of parties with
With hardware-based TEEs being available for a few no infrastructure under their control (I1–I3). We have years, the question arises as to why today’s data eco- further surveyed corresponding technical solutions to systems do not yet implement TEE-based security. One these issues and highlight that they are available but have reason might be known weaknesses, which need to be not yet been adopted in practice. To this end, we argue addressed in future designs. However, these weaknesses that the success of data ecosystems directly depends on do not seem to hinder deployment in further applications, their ability to address the present need for strong data as, for instance, Microsoft Azure ofers commercial sup- sovereignty of participants. As such, especially modern port for TEEs in its cloud service [93]. Hence, we argue technical solutions, such as TEEs, promise to provide data that data ecosystems should consider employing TEEs owners with strong guarantees of correct data handling, as a measure to enforce data owner’s rights on remote increasing their willingness to participate in available infrastructure, which would fill the current gap toward data ecosystems. implementing end-to-end data sovereignty.
Future Work. These required research eforts mo- Acknowledgments tivate our call for future work in the domain of data ecosystems. Regarding the reliable enforcement of us- Funded by the Deutsche Forschungsgemeinschaft age terms (I1), future work must address tailoring exist- (DFG, German Research Foundation) under Germany’s ing data protection schemes to data ecosystems. Here, Excellence Strategy – EXC-2023 Internet of Production – a promising idea seems to employ TEEs as a trust an- 390621612. chor on remote infrastructure. However, further research must clarify to which degree current limitations, such as performance penalties, afect application within data ecosystems. Subsequently, this can be integrated with transparency mechanisms (I2) where current work demon[87] B. Waters, Ciphertext-Policy Attribute-Based En- Boston, MA, 2010, pp. 133–146. doi:10.1007/ cryption: An Expressive, Eficient, and Provably 978-1-4419-6794-7_11.
Secure Realization, in: D. Hutchison, T. Kanade, [90] Q. H. Cao, M. Giyyarpuram, R. Farahbakhsh, J. Kittler, J. M. Kleinberg, F. Mattern, J. C. Mitchell, N. Crespi, Policy-based usage control for a trustM. Naor, O. Nierstrasz, C. Pandu Rangan, B. Stef- worthy data sharing platform in smart cities, Future fen, M. Sudan, D. Terzopoulos, D. Tygar, M. Y. Generation Computer Systems 107 (2020) 998–1010. Vardi, G. Weikum, D. Catalano, N. Fazio, R. Gen- doi:10.1016/j.future.2017.05.039. naro, A. Nicolosi (Eds.), Public Key Cryptogra- [91] F. Cirillo, B. Cheng, R. Porcellana, M. Russo, G. Solphy – PKC 2011, volume 6571, Springer Berlin maz, H. Sakamoto, S. P. Romano, IntentKeeper: Heidelberg, Berlin, Heidelberg, 2011, pp. 53–70. Intent-oriented Data Usage Control for Federated doi:10.1007/978-3-642-19379-8_4. Data Analytics, in: 2020 IEEE 45th Conference [88] P. Bonatti, S. Kirrane, A. Polleres, R. Wenning, on Local Computer Networks (LCN), IEEE, Sydney, Transparent Personal Data Processing: The Road NSW, Australia, 2020, pp. 204–215. doi:10.1109/ Ahead, in: S. Tonetta, E. Schoitsch, F. Bitsch LCN48667.2020.9314823. (Eds.), Computer Safety, Reliability, and Secu- [92] F. Kelbert, A. Pretschner, Data Usage Control for rity, volume 10489, Springer International Pub- Distributed Systems, ACM Transactions on Prilishing, Cham, 2017, pp. 337–349. doi:10.1007/ vacy and Security 21 (2018) 1–32. doi:10.1145/ 978-3-319-66284-8_28. 3183342. [89] M. Colombo, A. Lazouski, F. Martinelli, P. Mori, [93] F. Y. Rashid, The rise of confidential computing: A Proposal on Enhancing XACML with Con- Big tech companies are adopting a new security tinuous Usage Control Features, in: F. De- model to protect data while it’s in use-[news], IEEE sprez, V. Getov, T. Priol, R. Yahyapour (Eds.), Spectrum 57 (2020) 8–9.
Grids, P2P and Services Computing, Springer US,