| Abstract: |
With the increasing demand and interest in users' data in various domains like energy and Internet of Things (IoT), access to these data should be protected, but also controlled by the user for transparent data access and sharing. Currently, there is no standard for user-centric authorization as in typical authorization and access control models due to challenges related to the different authorization processes and entities involved, which vary for each domain and use case. First, we explain user-centric authorization compared to traditional authorization and user consent along with related work. We propose a user-centric authorization approach to involve users in the authorization process to decide about access to their private data by requesters, share specific data with interested parties, and control even after granting the permission. Actors (e.g., user, requester, and data provider), resources (i.e., request and data), general states, and request structure are defined for the permission request, data access, and revoke processes. Our approach is implemented and applied within the European Distributed Data Infrastructure for Energy (EDDIE) project to access and share energy data. We provide a demo case, including implementation of the model and detailed steps from creating a permission request until getting a decision from the end-customer and receiving the requested energy consumption data. Finally, we discuss characteristics of our approach, such as multi-transparency, permission revocation, access audit, data granularity, and external termination. |