Data Usage Control for Distributed Systems

Data usage control provides mechanisms for data owners to remain in control over how their data is used after it has been accessed. Corresponding technical solutions are thus applicable in many distinct areas such as the protection of business, military and government secrets, intellectual property, as well as private user data. However, most existing solutions focus on the enforcement of data usage control within single systems and disregard distributed aspects of data usage control, i.e. how the usage of data can be controlled once data has been shared across systems and organizations. In fact, many data usage policies can only be enforced on a global scale, as they refer to data as well as data usage events happening within several distributed systems, e.g. “at each point in time at most two clerks might have a local copy of this contract”, or “a contract must be approved by at least two clerks before it is sent to the customer”. While such policies can intuitively be enforced using a centralized infrastructure, major drawbacks are that such solutions constitute a single point of failure and that they are expected to cause heavy communication and performance overheads. In order to address these open challenges, this dissertation contributes by providing (i) a formal distributed data usage control system model, and (ii) the first fully decentralized infrastructure for the preventive enforcement of data usage policies. More precisely, the provided model allows to track the flow of usage controlled data both within and across systems, as well as to coordinate the decision process of multiple distributed and independent decision points. To this end, this dissertation introduces formal and technical means to (a) propagate data usage policies to all relevant decision points, (b) identify all decision points that are relevant to evaluate a given policy, and (c) identify situations in which no coordination between decision points is necessary without compromising policy enforcement. Proofs of correctness of the presented formal methods are provided. The evaluation shows that the additional overhead introduced for cross-system data flow tracking and policy propagation is negligible. Further, it reveals in which scenarios the developed decentralized enforcement infrastructure is superior to a centralized approach. A security evaluation discusses security relevant assumptions as well as shortcomings and limitations of the proposed solution.