OpenPDS Software. Human Dynamics, MIT Media Lab. October 25, 2012

Transcription

1 OpenPDS Software Human Dynamics, MIT Media Lab October 25, 2012

2 Table of Contents 1 Introduction to OpenPDS Answers, not Data Permissions for Sharing Auditability Governance OpenPDS Software Sample Installation and Demo Downloading Funf Journal Syncing your PDS and Funf Journal Setting Encryption/Decryption Password/Key Setting your Configuration URL

3 1 Introduction to OpenPDS In collaboration with ID3 ( the Human Dynamics group at the MIT Media Lab has created the OpenPDS software. This is part of a project towards creating a full Trust Network reference platform, known as the Open Mustard Seed project. A Trust Network is focused on individuals control of personal data as a personal asset, including rights to possession, sharing and redistribution, and disposal. We refer to a collection of personal data, with the various mechanisms to manage and control access, as a Personal Data Store (PDS). Because the software is open source and utilizes open standards as much as possible, we refer to it as OpenPDS. OpenPDS is implemented with related Trust Network services. An OAuth2 or OpenID Connect Authorization Server manages authentication and authorization processes, and issues access tokens. A Registry server holds a directory of enrolled participants. We use the Funf open sensing framework ( to collect a multitude of sensor data on Android phones, and securely uploading these rich and highly identifiable data sets to OpenPDS. All software is provided on an open source basis, under the LGPL license. The modules are available on Github. Please contact jschmitz@media.mit.edu or sandell@media.mit.edu if you would like access to the Github repositories. 1.1 Answers, not Data Instead of simply protecting sensitive and identifiable data sets, we turned the issue on its head. Raw data is not permitted to leave the personal store, and instead OpenPDS can be programmed to answer a set of questions. This enables highly dimensional data to be mapped to much less dimensional answers. For example, a question could be Do you spend time in Boston? Instead of providing a set of location coordinates with timestamps, the answer could be as simple as a yes or no. In another example, an OpenPDS based Reality Analysis application has been developed, displaying what we call the Mobile Health Triangle. Funf sensor data from multiple sensors collected over time are analyzed and mapped to three numerical scores, one each for Social, Activity, and Focus: None of the raw data need be transmitted outside of OpenPDS, exposing only the three scores which are now disconnected from time, location, and identity. 2

4 1.2 Permissions for Sharing OpenPDS includes a mechanism to manage fine-grained permissions for sharing of data. In designing an application, developers map use cases onto scopes, purposes, and roles between individuals. This is an extension of the common role-based access control used in many enterprise systems, enabling the individual to exercise control without having to define elaborate mechanisms from scratch. The principles are as follows: The individual always has full access to all data in his or her PDS. OAuth2 (or OpenID Connect) scopes are used to manage access to sets of related functionality. For example, a funf_write scope enables access to routines supporting uploading sensor data collected on Android phones. An explicit purpose for access must always be presented, such as to aggregate data from multiple individuals, or to visualize results for display. Each purpose can be tied to different contractual commitments and remedies. Role relationships link two individuals. For example, an individual may have designated a Child role relationship with his or her children. The children could have reciprocal role Parent relationships to the parent. The originating individual controls the role relationship, in order to preserve the individual s control over sharing of data in that individual s PDS. Once the use cases have been mapped out, developers can use these mappings to present users with meaningful options for sharing. Multiple sharing levels enable sets of use cases to be presented, with one coherent set activated for each level. With increased sharing, more services are enabled, with the accompanying increase in overall risk exposure balancing the added value provided. The user decides the optimal selection, and can easily change it at any time. Returning to the Mobile Health Triangle in the Reality Analysis application, users see a coherent set of options. In this case, all three sensor groups are selected (Activity, Focus, Social), and shared for the sole purpose of aggregating scores. The resulting display shows the individual s score, against a backdrop that displays a band representing the range of low to high scores for the group as a whole. 3

5 1.3 Auditability All access requests to OpenPDS are collected an in audit log, with the full set of sharing parameters (identity of requesting individual, token scope, stated purpose, and the role relationship between the OpenPDS owner and the requestor) to set the context. The audit log facilitates debugging of the system, during development as well as after deployment. It also facilitates the need to establish finer grained use cases, when a subset of access requests should have been treated differently. A more critical application is to detect and protect against longitudinal abuse. Consider a number of colluding individuals, each asking one target individual a single question. Should they combine the answers, they may be able to puzzle together clues that increase the risk of the targeted individual being re-identified or of having more sensitive personal information inferred. The mere existence of these requests in the audit log could be cause for investigation. 1.4 Governance A key component of our approach to Trust Frameworks is to combine the technical implementation with legally binding agreements. We refer to our agreements as Personal Data and Sharing System Rules. These documents provide combined policy and governance rules directly applicable to the business, legal and technology dimensions of a Trust Network. The document is designed to be usable for the OpenPDS implementation supporting a peer to peer use case. Essentially, it spells out a way of defining and enforcing policies such as FIPPs (Fair Information Practice Principles). We are in the process of finalizing a first release of Model System Rules, which have been drafted in a collaborative authoring and review process, to facilitate future interoperability across industries and across instances of Trust networks. A good analogy is the SWIFT interbank network for funds transfers. This is a highly secure private network, governed by a multi-lateral set of contracts which bind all participating banks into a common contractual framework. While relying on the shared infrastructure of the private network, fund transfers take place directly between the two institutions and no other entity has any knowledge of the transfer. The transfer is subject to the rules and commitments defined in the set of contracts that all participating institutions must sign. 4

6 2 OpenPDS Software OpenPDS is part of the Open Mustard Seed Trust Network which primarily uses Django and Python to implement its web services. The main Django projects are labeled OMS-ResourceServer and OMS-PDS. OMS-PDS is a service interface for back-end personal data resources and OMS-ResourceServer serves application specific logic such as visualizations. The main data source is Funf remote sensing data ( The data is collected from Android smartphones, and loaded into the individual s PDS through service connectors. There is a sample Reality Analysis application that can be given access to your OpenPDS, and it will provide a Mobile Health Triangle computed from your Funf data. Please contact jschmitz@media.mit.edu or sandell@media.mit.edu if you would like access to the Github repositories, to install the software to run on your own server. 2.1 Sample Installation and Demo You can access a sample installation of the Funf connector by browsing to The demo walks through the steps needed to pair Funf 5

7 Journal (an Android app using the Funf framework, available from the Google Play store) with an OpenPDS installation on our server Downloading Funf Journal Go to the Google Play store ( and search for Funf Journal. Select the Funf Journal app, and install it on your phone Syncing your PDS and Funf Journal Start the Funf Journal app on your Android phone. By pressing the button in Funf journal located on the bottom right of the screen, we bring up an options menu. We must set two options in order to sync Funf Journal with the sample installation of OpenPDS Setting Encryption/Decryption Password/Key First, click the button in Funf Journal labeled Set Password. We recommend you use changeme for the purposes of this tutorial as it makes testing and verification easier at the end. The keys must be the same on both ends for your data to be uploaded correctly. 6

8 2.1.4 Setting your Configuration URL Next, we need to link our Funf Journal to our PDS. By clicking Set Key from our browser menu, we obtain a configuration URL string to add to our Funf Journal. Below, we see the string :8002/connectors/config?bearer_token=e00a0168fa, it is missing the prefix, so add as the Configuration URL in Funf Journal, and click the Save button. Funf journal should notify you that it has connected successfully, and your Journal will now start uploading data to your PDS! 7