TY - GEN
T1 - SoK
T2 - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023
AU - Ernstberger, Jens
AU - Lauinger, Jan
AU - Elsheimy, Fatima
AU - Zhou, Liyi
AU - Steinhorst, Sebastian
AU - Canetti, Ran
AU - Miller, Andrew
AU - Gervais, Arthur
AU - Song, Dawn
N1 - This work is partially supported by the Center for Responsible, Decentralized Intelligence at Berkeley (Berkeley RDI), Chainlink Labs, and the Algorand Centres of Excellence programme managed by Algorand Foundation and the Federal Ministry of Education and Research of Germany in the programme of "Souverän. Digital. Vernetzt.". Joint project 6G-life (project number 16KISK002).
Acknowledgement. We thank Deevashwer Rathee, Sriram Sridhar and Bryan Ford for their valuable comments. This work is partially supported by the Center for Responsible, Decentralized Intelligence at Berkeley (Berkeley RDI), Chainlink Labs, and the Algorand Centres of Excellence programme managed by Algorand Foundation and the Federal Ministry of Education and Research of Germany in the programme of “Souverän. Digital. Vernetzt.”. Joint project 6G-life (project number 16KISK002).
PY - 2023
Y1 - 2023
N2 - Society appears to be on the verge of recognizing the need for control over sensitive data in modern web applications. Recently, many systems claim to give control to individuals, promising the preeminent goal of data sovereignty. However, despite recent attention, research and industry efforts are fragmented and lack a holistic system overview. In this paper, we provide the first transecting systematization of data sovereignty by drawing from a dispersed body of knowledge. We clarify the field by identifying its three main areas: (i) decentralized identity, (ii) decentralized access control and (iii) policy-compliant decentralized computation. We find that literature lacks a cohesive set of formal definitions. Each area is considered in isolation, and priorities in industry and academia are not aligned due to a lack of clarity regarding user control. To solve this issue, we propose formal definitions for each sub-area. By highlighting that data sovereignty transcends the domain of decentralized identity, we aim to guide future works to embrace a broader perspective on user control. In each section, we augment our definition with security and privacy properties, discuss the state of the art and proceed to identify open challenges. We conclude by highlighting synergies between areas, emphasizing the real-world benefit obtained by further developing data sovereign systems.
AB - Society appears to be on the verge of recognizing the need for control over sensitive data in modern web applications. Recently, many systems claim to give control to individuals, promising the preeminent goal of data sovereignty. However, despite recent attention, research and industry efforts are fragmented and lack a holistic system overview. In this paper, we provide the first transecting systematization of data sovereignty by drawing from a dispersed body of knowledge. We clarify the field by identifying its three main areas: (i) decentralized identity, (ii) decentralized access control and (iii) policy-compliant decentralized computation. We find that literature lacks a cohesive set of formal definitions. Each area is considered in isolation, and priorities in industry and academia are not aligned due to a lack of clarity regarding user control. To solve this issue, we propose formal definitions for each sub-area. By highlighting that data sovereignty transcends the domain of decentralized identity, we aim to guide future works to embrace a broader perspective on user control. In each section, we augment our definition with security and privacy properties, discuss the state of the art and proceed to identify open challenges. We conclude by highlighting synergies between areas, emphasizing the real-world benefit obtained by further developing data sovereign systems.
UR - http://www.scopus.com/inward/record.url?scp=85168134216&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85168134216&partnerID=8YFLogxK
U2 - 10.1109/EuroSP57164.2023.00017
DO - 10.1109/EuroSP57164.2023.00017
M3 - Conference contribution
AN - SCOPUS:85168134216
T3 - Proceedings - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023
SP - 122
EP - 143
BT - Proceedings - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 3 July 2023 through 7 July 2023
ER -