Architecture and benefits of the Eclipse Dataspace Connector (EDC)

Sovereignty, interoperability, security paired with trust and transparency are key elements for the development of new business models in the digital data economy for companies and organizations.

New business models are created through cooperation and the exchange, use and networking of data assets. This will secure the future competitiveness of companies. The basis for this is a secure and dedicated exchange of data across the boundaries of companies and organizations. The basis for this is formed by dedicated rules and guidelines while maintaining data sovereignty.

EDC - a framework for secure data exchange

The "International Dataspaces" (IDS) is a concept for enabling sovereign and secure data exchange across company and organizational boundaries while maintaining data sovereignty.
This involves the exchange of data assets between trustworthy participants in accordance with clearly defined rules and guidelines. The key aspect here is that participants who make data available in a data room have data sovereignty at all times. [8]
Eclipse Dataspace Connector (EDC) is a framework designed to put the concept of IDS into practice. [2]
This blog post looks at the EDC, what has been achieved so far and how it relates to other standards and projects such as IDS and GAIA-X. It provides an insight into the underlying architectural aspects and concepts of the EDC.

Context and environment of the Eclipse Dataspace Connector

Initiatives and standards that have a significant influence on the development of the EDC are listed below.

International Data Spaces Association (IDSA)

The International Data Spaces Association (IDSA) is an association with the aim of creating cross-domain data spaces. Data exchange should be based on the principles of self-determination and control. Cooperation should be possible across industry boundaries and the size of the company should not be a limiting factor. [1][4]
The result should be a de facto standard and a reference architecture model for secure and sovereign data exchange between trustworthy partners - the IDS (International Data Spaces). [1]

International Data Spaces (IDS)

"Dataspaces" (data rooms) are an approach to information integration. [1] Data is shared within a data space in accordance with clearly defined rules and framework conditions. The decentralized approach of data spaces aims to preserve the digital sovereignty of the participants and to maintain data sovereignty over their data assets. Data remains with the data originator until it is retrieved. [9]

CATENA-X

The CATENA-X Automotive Alliance see themselves as pioneers in the creation of data rooms and are therefore one of the driving forces behind the development of the EDC. [3]
CATENA-X aims to create its own data space for the automotive industry and is based on the ideas, infrastructure and technologies of GAIA-X. [19]

Eclipse Dataspace Connector (EDC)

The Eclipse Dataspace Connector (EDC) project offers a connector framework for sovereign, cross-company data exchange[7]. The EDC is developed and published by the Eclipse Foundation as a FOSS (Free and Open Source Software) solution under the Apache 2 open source license. This enables free and commercial use of the EDC and the expandability of the solution without license costs, as well as minimally restricting its use and further distribution [10].
The aim of the EDC initiative is to create a concrete implementation that implements the protocols of the IDS standard and strives for compatibility with the requirements of the GAIA-X project. [7] [10]
Data is exchanged via defined data-sovereign contracts that are automatically negotiated and thus regulate access to the data assets.

EDC architecture

The architecture of the EDC focuses on expandability. The implementation of this principle and other architectural aspects of the EDC are described below.

The connector

The central component is the connector, which links the individual participants in a data room and thus forms the end point for the actual data exchange. It handles the automatic contract negotiation and subsequent exchange of data assets for connected applications.

Control and data plane

A central architectural aspect is the separation of the control and data plane (management and data transmission layer) of the connector.
The management layer has the following central tasks:

Data queries (which data is offered)
Establishing a connection (connectivity)
Authentication (before data can be exchanged, the identity is verified via an identity provider)
Automatic contract negotiation
Enforcement of guidelines (policy enforcement)
Auditing and testing. [8]

After successful negotiation, the data plane is responsible for transferring and receiving the data. Companies store their data assets in a variety of storage solutions. Proprietary storage solutions are often used here. By using the Java Service Provider Interface (SPI) both the Data Plane and the Control Plane can be extended via an extension mechanism.

Control DataPlane — Figure 1: Management layer and data layer of the EDC; image source https://github.com/eclipse-dataspaceconnector/Collateral/blob/main/Latest%20Presentations/2022-04-26%20Eclipse%20Dataspace%20Connector%20-%20Overview%20Deck.pdf [7]

Contract & Policies

The exchange of data in data rooms takes place according to defined guidelines. In the EDC context, a distinction is made between usage policies and access policies. Usage policies can map the following dimensions:

Usage guidelines
- Usage guidelines define the purpose for which the data may be used. [7]
  - Temporal dimension (for example, that data must be deleted after a defined period of time)
  - Geographical dimension such as the directive that data must remain in Germany or in the European Union.
  - Earmarked Dimensions such as, for example, that data may only be used for a specific purpose, such as use in quality control or use for ML training.
  - Requirement for the Data processing. For example, it may be defined that data must be anonymized before processing.
  - With regard to the Data storage can be defined that data may only be stored in certified cloud environments.
Access guidelines
- Access guidelines define by whom the data may be used.
  - Guidelines that state that data is only shared with defined participants or groups, such as "Assets are only shared with partners" [7]

Guidelines can be linked or negated as desired. The provider can therefore precisely specify access to the data and the use of the data by the consumer.
The policies are checked and processed by the "Policy Engine". This ensures that the data is only shared with the desired partners and only used for the intended purpose.

Dataspaces mental model — Figure 2: Data exchange in Dataspace with EDC; image source: https://github.com/eclipse-dataspaceconnector/Publications/blob/main/Dataspaces/Dataspaces%20Vocabulary%20and%20Operations.md [14]

How is identity and trust established in the data room?

Trust in the data room can be organized both centrally and decentrally.

In the central scenario, the position of trust is implemented by a central dataspace authority to which the identity providers are connected. [11]
The participants' position of trust can be established in a decentralized manner using the DID:Web procedure.
It is mandatory that at least one identity provider exists in the data room, which ensures the identity of all connected participants. [11]
The following implementations are currently available in the EDC project: [18]

OAuth2 Identity Service
DAPS
DID:Web

OAuth2 Identity Service

The OAuth2 Identity Service is an extension that provides an identity service implementation based on the OAuth 2.0 protocol. The task of the service is the exchange of OAuth 2.0 bearer tokens. The service enables the EDC to be connected to common IAM systems.
This form of authentication is required in order to be compatible with the requirements of the GXFS-DE GAIA-X Federated Service Germany. [7]

Dynamic Attribute Provisioning Service (DAPS)

DAPS is an attribute server that enables the enrichment of the identities of organizations and connectors with additional attributes. The task of DAPS is to issue JSON Web Tokens (JWT) as OAuth 2.0 Bearer Tokens. These tokens are used to authorize other connectors. The DAPS acts as an IDS identity provider for the EDC. [15] [17]
DAPS is a component that is being developed by the Fraunhofer Gesellschaft in the context of the IDS. [7]

Distributed identity system with DID:Web

The DID:Web procedure uses the DNS (Domain Name System) to establish trust in the data room.
The position of trust is essentially determined by two factors: Firstly, the reputation of the domain.
Secondly, a DID document that is published in the domain must be classified as trustworthy. The DID document is a JSON file whose position is returned via the DNS when the DID web address is called. [16]
The DID document can contain information on a public key procedure that can be used for authentication or authorization. [6]
DID:Web is required to achieve compatibility with GAIA-X and IDSA. [7]

Ecosystem integration of the Eclipse Dataspace Connector — Figure 3: Ecosystem integration of the EDC ; Image source: https://github.com/eclipse-dataspaceconnector/Collateral/blob/main/Latest%20Presentations/2022-04-26%20Eclipse%20Dataspace%20Connector%20-%20Overview%20Deck.pdf [7]

CONCLUSION: EDC also promotes secure data exchange for SMEs

The EDC is currently under development, but is being used in the major European projects GAIA-X and CATENA-X [5]. The practical suitability of the EDC is being tested, as the framework is being aligned with specific use cases and developed further. [13]
This also leads to the assumption that further FOSS applications will emerge in the EDC environment, which will further simplify the exchange of data under the premises of sovereignty, interoperability, security, trust and transparency and make these solutions attractive for use in SMEs (small and medium-sized enterprises). SMEs have the opportunity to use these standard solutions for the development of new business models through cooperation with other companies or organizations. The maturity level of the EDC is further increased through its use in practice.
Interesting topics that can have a significant influence on the success of the EDC are:

What other open source applications will be developed in the EDC environment?
How are EDC policies and contracts created and managed?
How complex is the development of other "extensions", especially proprietary storage solutions?
Can the solution be used easily and cost-effectively by SMEs, adapted to their own solutions and implemented?

EDC promises to be an interesting and promising project with the potential to become the framework for data exchange in international data rooms. The EDC is currently released as version v0.0.1. [2] The timing and scope of the first major release can therefore point the way for further development and the future of the EDC.

Learn more about IoT system integration

Sources:

About ME

Martin Kanal

All contributions from Martin Kanal

The Eclipse Dataspace Connector (EDC) - architecture and benefits of the framework

Further information on our website and in our newsletter