Periodic Reporting for period 2 - KRAKEN (Brokerage and market platform for personal data)
Période du rapport: 2021-06-01 au 2022-11-30
One of the main pillars of the digitalization and the European Digital Single Market is the development of the European Data Economy. The volume of data, industrial and personal data, is growing rapidly in the EU and worldwide and the value of the data economy will continue to grow in the coming years creating new opportunities, products, services and jobs. Europe aims to lead this new sector of the economy and has designed a European strategy for data, setting-up the framework conditions that will enable the development of the European Data Economy based on European values, and on the safeguard of citizens rights in the digital world. The strategy addresses the following aspects: (1) legislation on data governance, (2) data availability, public dataset for reuse, (3) development of data sharing tools and data processing infrastructures, and (4) secure and competitive cloud-based data processing services.
KRAKEN (Brokerage and market platform for personal data) aims to bring personal data sharing and trading at a level of maturity that does not yet exist, answering to the overall strategy of the European Data Economy, fostered by the European Commission, by leveraging on:
(1) The emerging paradigm of self-sovereign identity built upon a stack of distributed ledger technologies (multi-ledger) which ensures future compatibility with different specific blockchain implementations for identity management. It will provide a decentralized user-centric approach on personal data sharing and proving that it can incorporate the trust and security assurance levels deriving claims from national identity schemas (eIDAS-compliant);
(2) Tested data marketplace technologies which support data sharing as well as aggregated data sharing;
(3) A set of different data protection techniques based on advanced crypto tools (P/F/HE, FE, MPC, ABE…) coupled with privacy preserving (AI/ML) analytics, featuring management of privacy / utility trade-offs and metadata privacy.
The project provides market-ready tools and services with industrial strength and suitable privacy metrics that convey to data subjects with high usability.
Taking advantages of the emergent models and lessons learned from previous experiences, Kraken proposes an unprecedented approach, which creates an alternative to mainstream paradigms while fully granting the privacy and self-sovereignty of the data subject. KRAKEN enables advanced, convenient data sharing control relying on innovative end-to-end encryption and use of sophisticated proxy cryptography schemes grants data subjects with unprecedented control over their data. Furthermore, this ensures that even the cloud provider (data processor) cannot access the data in plain-text and hence protect access to personal data.
KRAKEN (Brokerage and market platform for personal data) aims to bring personal data sharing and trading at a level of maturity that does not yet exist, answering to the overall strategy of the European Data Economy, fostered by the European Commission, by leveraging on:
(1) The emerging paradigm of self-sovereign identity built upon a stack of distributed ledger technologies (multi-ledger) which ensures future compatibility with different specific blockchain implementations for identity management. It will provide a decentralized user-centric approach on personal data sharing and proving that it can incorporate the trust and security assurance levels deriving claims from national identity schemas (eIDAS-compliant);
(2) Tested data marketplace technologies which support data sharing as well as aggregated data sharing;
(3) A set of different data protection techniques based on advanced crypto tools (P/F/HE, FE, MPC, ABE…) coupled with privacy preserving (AI/ML) analytics, featuring management of privacy / utility trade-offs and metadata privacy.
The project provides market-ready tools and services with industrial strength and suitable privacy metrics that convey to data subjects with high usability.
Taking advantages of the emergent models and lessons learned from previous experiences, Kraken proposes an unprecedented approach, which creates an alternative to mainstream paradigms while fully granting the privacy and self-sovereignty of the data subject. KRAKEN enables advanced, convenient data sharing control relying on innovative end-to-end encryption and use of sophisticated proxy cryptography schemes grants data subjects with unprecedented control over their data. Furthermore, this ensures that even the cloud provider (data processor) cannot access the data in plain-text and hence protect access to personal data.
At the end of the project provided a fully functional personal data marketplace, the KRAKEN marketplace platform, an integrated infrastructure that facilitates personal data sharing in a privacy preserving way and tested in two pilots. The platform facilitates three data exchange modalities: encrypted batch data transfer, privacy-preserving analytics using MPC, and data streams managed under the Data Unions framework.
The project main results are summarized below:
• Final architecture of the KRAKEN platform with a detailed description of all its components.
• Final design and technical specifications of the three KRAKEN pillars: (1) SSI - Self Sovereign Identity components providing a user-centric approach on personal data sharing, (2) Crypto - Privacy-Preserving Analytics (PPA) components that enable privacy-enhanced data analyses, and (3) marketplace
• Contacts with eSSIF and EBSI organisations and the proposed solutions to establish a liaison between these bodies and the KRAKEN project.
• More than 760 user stories and 10 epics as results of applying Agile methodology to technical work packages
• Two KRAKEN marketplace prototypes implemented for the two project pilots: health and education.
• Multi-dimensional evaluation of those prototypes, by users selected from the relevant user groups, regarding the usability and user experience with the KRAKEN solution.
• The technical and legal frameworks applicable to the KRAKEN project and technologies as well as the evaluation of the implementation of the ethical requirements and recommendations for future implementations and policy makers.
• A market analysis of personal data marketplaces with focus on education and health market segments, and an exploitation plan identifying the main revenues and cost streams. Also a market analysis and exploitation plans for the individual components that compose KRAKEN subsystems.
• Liaisons with 13 EU projects, participation in EBDV Forum events, crypto and security events and conferences, and 28 scientific publications
The project main results are summarized below:
• Final architecture of the KRAKEN platform with a detailed description of all its components.
• Final design and technical specifications of the three KRAKEN pillars: (1) SSI - Self Sovereign Identity components providing a user-centric approach on personal data sharing, (2) Crypto - Privacy-Preserving Analytics (PPA) components that enable privacy-enhanced data analyses, and (3) marketplace
• Contacts with eSSIF and EBSI organisations and the proposed solutions to establish a liaison between these bodies and the KRAKEN project.
• More than 760 user stories and 10 epics as results of applying Agile methodology to technical work packages
• Two KRAKEN marketplace prototypes implemented for the two project pilots: health and education.
• Multi-dimensional evaluation of those prototypes, by users selected from the relevant user groups, regarding the usability and user experience with the KRAKEN solution.
• The technical and legal frameworks applicable to the KRAKEN project and technologies as well as the evaluation of the implementation of the ethical requirements and recommendations for future implementations and policy makers.
• A market analysis of personal data marketplaces with focus on education and health market segments, and an exploitation plan identifying the main revenues and cost streams. Also a market analysis and exploitation plans for the individual components that compose KRAKEN subsystems.
• Liaisons with 13 EU projects, participation in EBDV Forum events, crypto and security events and conferences, and 28 scientific publications
Next a list of KRAKEN innovations beyond the state of the art:
• Cryptographic Service Provider for Group Signatures
• HPRA Key Sharing Process for asynchronous Key Sharing
• Privacy-Preserving Analytics (PPA)
• Responsible data marketplaces using SMPC for privacy-preserving analytics
The wider societal and economic impacts at the end of the project are:
KRAKEN has incorporated personal data protection and the GDPR framework to personal data marketplaces giving users the control of their personal data and offering adequate security measures to gain user trust and remove the current obstacles and barriers to the sharing of personal data. KRAKEN addresses security and privacy challenges by adopting a ‘security and privacy by default’ approach. This is partially achieved through the use of strong end-to-end encryption and Personal Information Management Systems (PIMS) and self-Sovereign Identity which allows control of personal data and identity data to remain with the user. This leads to a higher level of citizens’ trust in data platforms and the sharing of data.
From the economic view although the KRAKEN outcomes has been piloted in health and education, the KRAKEN ecosystem can be adopted by personal data providers and data consumers from different domains, giving companies access to relevant data and at the same time protect the privacy of the data subject. The use of these protected personal or sensitive data allows third parties, such as companies, research organizations or public institutions, to leverage data usage to monetise, to develop research studies or to treat data, respectively. At the same time, the data owners obtain a revenue monetising their data being rewarded financially when sharing data.
• Cryptographic Service Provider for Group Signatures
• HPRA Key Sharing Process for asynchronous Key Sharing
• Privacy-Preserving Analytics (PPA)
• Responsible data marketplaces using SMPC for privacy-preserving analytics
The wider societal and economic impacts at the end of the project are:
KRAKEN has incorporated personal data protection and the GDPR framework to personal data marketplaces giving users the control of their personal data and offering adequate security measures to gain user trust and remove the current obstacles and barriers to the sharing of personal data. KRAKEN addresses security and privacy challenges by adopting a ‘security and privacy by default’ approach. This is partially achieved through the use of strong end-to-end encryption and Personal Information Management Systems (PIMS) and self-Sovereign Identity which allows control of personal data and identity data to remain with the user. This leads to a higher level of citizens’ trust in data platforms and the sharing of data.
From the economic view although the KRAKEN outcomes has been piloted in health and education, the KRAKEN ecosystem can be adopted by personal data providers and data consumers from different domains, giving companies access to relevant data and at the same time protect the privacy of the data subject. The use of these protected personal or sensitive data allows third parties, such as companies, research organizations or public institutions, to leverage data usage to monetise, to develop research studies or to treat data, respectively. At the same time, the data owners obtain a revenue monetising their data being rewarded financially when sharing data.