Open Digital Rights Enforcement Framework (ODRE): from descriptive to enforceable policies

Andrea Cimmino,Juan Cano-Benito,Raúl García-Castro

2024-09-26

Abstract:From centralised platforms to decentralised ecosystems, like Data Spaces, sharing data has become a paramount challenge. For this reason, the definition of data usage policies has become crucial in these domains, highlighting the necessity of effective policy enforcement mechanisms. The Open Digital Rights Language (ODRL) is a W3C standard ontology designed to describe data usage policies, however, it lacks built-in enforcement capabilities, limiting its practical application. This paper introduces the Open Digital Rights Enforcement (ODRE) framework, whose goal is to provide ODRL with enforcement capabilities. The ODRE framework proposes a novel approach to express ODRL policies that integrates the descriptive ontology terms of ODRL with other languages that allow behaviour specification, such as dynamic data handling or function evaluation. The framework includes an enforcement algorithm for ODRL policies and two open-source implementations in Python and Java. The ODRE framework is also designed to support future extensions of ODRL to specific domain scenarios. In addition, current limitations of ODRE, ODRL, and current challenges are reported. Finally, to demonstrate the enforcement capabilities of the implementations, their performance, and their extensibility features, several experiments have been carried out with positive results.

Cryptography and Security,Artificial Intelligence

What problem does this paper attempt to address?

The core problem that this paper attempts to solve is: **How to provide execution capabilities for Open Digital Rights Language (ODRL) so that the data use policies it describes are not only descriptive but also can be actually enforced**. Specifically, the paper aims to enhance the practicality of ODRL by introducing the Open Digital Rights Enforcement (ODRE) framework, ensuring that data use policies can be effectively verified and executed when third - party requests to use data resources.

### Problem Background

With the shift from centralized platforms to decentralized ecosystems (such as Data Spaces), data sharing is becoming increasingly important. Defining data use policies has become crucial in these areas, highlighting the need for effective policy enforcement mechanisms. Although ODRL, as a W3C - standard ontology, provides a vocabulary for describing data use policies, it lacks built - in execution capabilities, limiting its practical applications.

### Main Challenges

1. **Lack of Execution Capability**: Although ODRL can describe data use policies, it cannot evaluate these policies to allow or deny data use, nor can it trigger corresponding behaviors.
2. **Risk of Privacy Leakage**: Existing policies may need to explicitly write out conditions, leading to privacy information leakage. For example, location - based policies will expose specific geographical information.
3. **Inadequate Dynamic Data Processing**: ODRL lacks the ability to handle dynamic data (such as real - time GPS locations), which may lead to privacy leakage or policy ineffectiveness.

### Solutions

The paper proposes a new framework - ODRE, aiming to provide execution capabilities for ODRL. The main contributions include:

- **New Policy Expression Method**: Combine ODRL's descriptive terms with other languages to allow behavior specifications (such as dynamic data processing or function evaluation).
- **Execution Algorithm**: Propose an execution algorithm aligned with the ODRL standard vocabulary to check data use limitations and trigger related actions.
- **Open - source Implementations**: Provide two open - source implementations in Python and Java, and verify their performance and extensibility through experiments.
- **Support for Future Expansion**: Design an expansion mechanism that supports domain - specific scenarios, enabling ODRL to adapt to different application scenarios.

### Summary

By introducing the ODRE framework, the paper solves the key problems of ODRL in practical applications, enabling descriptive data use policies to be effectively executed, thereby improving the security and controllability of data sharing.