Project Description

The planned work is motivated by the general data protection regulation of the European Union. Operational data protection solution will be designed for this regulation.The main focus will be on mechanisms for managing digital identities of human users for digital services and for establishing data sovereignty for the human user. The challenge regarding the digital services is that the requirements and conditions of interactive assistance systems and modern methods of human-machine interaction must already be taken into account. Such systems are characterised by the fact that they work with data provided by the user, that they independently collect data of the user after his consent and finally that they evaluate this data in order to obtain further data which aim at recognizing situations or work phases or to learn characteristics of the user in order to be able to adjust as optimally as possible to an individual.

Data sovereignty includes concepts for the administration and control of digital identities as well as infrastructures that are needed to establish trust in externally controlled IT systems or, based on this trust, to transfer security guidelines to externally controlled IT systems whose enforcement can be guaranteed. Concretely, concepts are to be developed which bring digital service offers and their requirements in relation to information to be made available or to be collected/learned by the service itself in line with the data protection requirements of the users. For this it is necessary to examine how an identity management platform can be designed, which standardized service offerings can process and negotiate, and which can generate and manage corresponding digital identities.

The management of digital identities requires the handling of attributes and their assignment to different profiles, whereby individual access rights, access points, consents and usage guidelines can be attached. An attribute can be stored directly as a key-value pair in the management platform, but it can also be an access point, i.e. a resource/data source that can be obtained from another communication endpoint, e.g. an interface to a service that records time series of a user's heart rate monitor. Consents are relevant when a service wants to collect certain required data itself or evaluate it from other data. Usage guidelines in turn indicate, for example, whether a used service may store data internally, whether and under what conditions it may pass them on to third parties (for example, only in anonymous form) or when they must be deleted at the latest. Finally, an identity also contains a value of trust to a service or to which proof of trustworthiness the user attaches the transfer/usage of his data.

Since the human user is at the centre of all the above-mentioned questions, an essential focus of the work is on the usability of the concepts to be developed, which must be explicitly evaluated.