Researchers Design Relationship-Based Access Control for Data Spaces

Published in the journal Data Science and Engineering, the study introduces a system based on Relationship-Based Access Control, or ReBAC, to address the complex challenges of managing data sovereignty and interoperability in modern digital ecosystems. The team designed, implemented, and evaluated this solution to ensure that data owners can retain control over their resources while allowing authorized consumers to access information through standardized interfaces.

Data spaces are emerging as a transformative approach to digital ecosystems, aiming to drive data-driven innovations across various industries. Initiatives such as the International Data Spaces Association, GAIA-X, and FIWARE have established frameworks to promote these platforms, which prioritize data sovereignty and trust. However, enforcing effective data usage policies remains a critical challenge. Traditional access control models, such as role-based and attribute-based access control, often rely on static policy models that struggle to accommodate the dynamic, relationship-driven nature of data spaces. These conventional systems typically require significant manual intervention to update access rights as organizational structures or data relationships evolve.

To illustrate the specific requirements of this new approach, the researchers presented a data sharing use case involving a Smart City and a Technical University. In this scenario, the Smart City deployed IoT devices, including smart plugs and environmental sensors, which generate data accessible through a standardized API. The Smart City signed a memorandum of understanding with the Technical University, granting its Computer Science Department read access to energy consumption data from smart plugs in the City Hall. This setup highlights the need for policies that consider contextual factors, such as user affiliation, device location, and resource grouping, rather than relying solely on static user roles.

The proposed solution leverages the ReBAC paradigm, which enables the explicit definition of relationships among protected items and the creation of policies that leverage these associations. By reflecting the current graph of associations among users, devices, and organizations, the system allows access rights to be granted or revoked automatically as relationships change. This eliminates the need for explicit policy rewrites or attribute reconfigurations when a device is moved or a user changes departments. The design ensures that access control decisions remain aligned with the evolving structure of the data space, supporting fine-grained and continuous enforcement of permissions.

The architecture integrates with the ETSI NGSI-LD API, a standardized interface for interacting with data spaces, to ensure compatibility with existing data-sharing standards. The system comprises several key components, including an Identity Provider for user registration, a Policy Administration Point for managing authorization models, a Policy Decision Point for evaluating requests, and a Policy Enforcement Point that acts as a transparent HTTP proxy. When a consumer requests data, the system intercepts the API call, verifies the user’s identity token, and queries the authorization model to determine if the user has the appropriate relationship with the target entity before forwarding the request to the context broker.

A significant contribution of the study is the development of a distributed version of the solution, which facilitates the segregation of access control management across different administrative domains. In this decentralized architecture, each organization manages its own identity information and access rights for its users, while data owners manage the relationship tuples pertaining to the entities they control. This separation of concerns improves scalability and enhances data sovereignty by allowing each stakeholder to retain administrative control over its own resources without requiring a globally agreed set of tuples or a centralized access management authority.

To secure the distributed environment, the researchers incorporated OAuth 2.0 Token Exchange and proof-of-possession mechanisms. The system uses Demonstrating Proof of Possession to cryptographically bind identity tokens to a public and private key pair controlled by the consumer. This prevents unauthorized use or sharing of identity tokens and ensures that the requestor holds the corresponding private key. The Policy Decision Point can also use contextual queries to temporarily augment the authorization model with ephemeral relationships, allowing for access control decisions without modifying the underlying persistent state. This approach reduces latency and avoids repeated round-trips to the organization’s Policy Administration Point.

The team conducted a security evaluation to assess the robustness of the distributed ReBAC-based solution against various threats. They defined a threat model assuming trusted Identity Providers and Policy Administration Points, while considering adversaries who might attempt to impersonate legitimate users or act as malicious intermediaries. The analysis formally proved that the system maintains authorization soundness, meaning a consumer is granted access only if they present a valid identity token, a valid proof of possession, and are authorized according to the policy model. The study also demonstrated that the design is secure against impersonation attacks, as the cryptographic binding of tokens to specific domains prevents malicious intermediaries from reusing valid access credentials to trick legitimate systems into granting unauthorized access.

Performance was evaluated using a prototype implemented with OpenFGA, Keycloak, and FIWARE Orion, running on a Dockerized deployment on macOS with an Apple M4 CPU. The experiments investigated four scenarios representing different depths of relationship-based access control, ranging from direct access rights to fourth-level nested group hierarchies. In all scenarios, the system was pre-loaded with relationship tuples, and 100 access queries were executed in a serialized manner. The results indicated that response times increase slightly with the number of stored relationships, but even with 120,000 relationships, the average response time for direct access remained below 5 milliseconds.

Further performance tests examined the impact of increasing relationship depth and the use of contextual relationships. With 120,000 total relationships and a maximum hierarchy depth of four, the mean response time remained below 10 milliseconds. The evaluation of contextual queries showed that offloading some relationships to the context can reduce server-side computation and improve performance compared to non-contextual equivalents. These findings suggest that the approach is feasible for large-scale data spaces with complex relationship structures, maintaining low latency even as the number of entities and associations grows.

The study also addressed the challenge of continuous access enforcement, particularly in the context of data subscriptions. In dynamic environments, a consumer might continue to receive updates via the NGSI-LD subscription mechanism even if their access rights change after the initial authorization. The researchers proposed an extension to the architecture where a function deployed alongside the Policy Decision Point periodically re-evaluates the consumer’s access rights. If the evaluation indicates that the consumer is no longer authorized, the system can revoke access by canceling the subscription. Although the implementation of this specific function is left as future work, the design supports the principles of usage control and continuous authorization necessary for secure real-time data sharing.

Compared to existing systems, this solution offers a distinct advantage by allowing each data owner to maintain its own Policy Administration Point, rather than relying on a single centralized point managed by an intermediary. This decentralized approach supports the heterogeneity of data spaces, where multiple autonomous owners retain control over their resources. The system is also data semantic-aware, which enhances the functionality of the data space by aligning access control policies with the specific attributes and relationships of the data entities. This capability is critical for fostering trust and facilitating secure data sharing within diverse and dynamic environments.

The researchers concluded that the ReBAC solution provides a strong foundation for secure, sovereign, and collaborative data sharing. By enabling fine-grained access control that captures intricate relationships among data objects and user organizational structures, the approach strengthens data sovereignty and ensures that owners retain full control over how their data is accessed. The distributed architecture, supported by OAuth 2.0 token exchange and proof-of-possession mechanisms, enhances scalability and flexibility, making it well-suited for real-world data spaces involving numerous stakeholders with varying requirements and responsibilities.

Subject of Research: Design and evaluation of a distributed Relationship-Based Access Control system for data spaces

Article Title: Relationship-based Access Control for Data Spaces

Article References: Fotiou, N., Dimitra Nassar Kyriakidou, C., Maria Papathanasiou, A., Siris, V., & Polyzos, G. (2026). Relationship-based Access Control for Data Spaces. Data Science and Engineering, 11(2), 343-359. https://doi.org/10.1007/s41019-025-00320-y

Image Credits: AI Generated

DOI: 10.1007/s41019-025-00320-y

Keywords: data spaces, access control, ReBAC, data sovereignty, ETSI NGSI-LD, cybersecurity, distributed systems, OAuth 2.0, IoT, data sharing, Relationship-based, Access