Using Detaspace’s IDS Connector to Enforce ODRL Usage Policies

Problem: exchanging data while keeping usage under control

When two sovereign parties need to share a dataset, the provider often wants to limit how the consumer can use it – for example, allowing analysis only for a specific purpose, within a certain region, or for a limited time. Pure transport security (TLS, authentication) does not express these constraints, so providers must rely on separate agreements that are hard to enforce automatically.

Thesis: the Detaspace IDS Connector translates ODRL policies into runtime enforcement

Detaspace provides an IDS‑compliant connector that sits between applications and the data plane. It interprets ODRL usage policies attached to each dataset, checks the consumer’s credentials against those policies, and only decrypts and returns the payload when all conditions are satisfied. The connector handles encryption, authentication, and policy evaluation transparently, letting developers call ordinary REST endpoints.

Worked example: attaching a purpose‑based ODRL policy and testing denial

1. Deploy the sample connector (requires a Detaspace runtime and admin rights).

   # Run the connector on localhost:8080 (adjust as needed)
   docker run -d --name detaspace-connector \
     -p 8080:8080 \
     -e IDS_MODEL_VERSION=4.0 \
     detaspace/ids-connector:latest
   

2. Prepare an ODRL policy** that requires the attribute "purpose" with value "fraud‑detection".

   
   {
     "@context": "https://www.w3.org/ns/odrl/2/",
     "uid": "policy:fraud-detection",
     "permission": [
       {
         "target": "dataset:sample‑sales",
         "action": "use",
         "constraint": [
           {
             "leftOperand": "purpose",
             "operator": "eq",
             "rightOperand": "fraud-detection"
           }
         ]
       }
     ]
   }
   

3. Attach the policy to a dataset** via the Detaspace management API (requires a provider token).

   
   curl -X POST https://detaspace.example.com/api/v1/datasets/sample-sales/policy \
     -H "Authorization: Bearer " \
     -H "Content-Type: application/json" \
     -d @odrl-policy.json
   

4. Attempt to read the dataset as a consumer lacking the required purpose attribute**.

   
   curl -i https://detaspace.example.com/api/v1/datasets/sample-sales/data \
     -H "Authorization: Bearer " \
     -H "Accept: application/json"
   

   Expected response:

   HTTP/1.1 403 Forbidden
   Content-Type: application/json
   
   {"error":"policy_violation","message":"ODRL policy denies use: missing purpose attribute"}

5. Verify successful access when the purpose attribute is present**.

   
   curl -i https://detaspace.example.com/api/v1/datasets/sample-sales/data \
     -H "Authorization: Bearer " \
     -H "Accept: application/json"
   

   Expected response:

   HTTP/1.1 200 OK
   Content-Type: application/json
   
   {"sales":[{"region":"EMEA","amount":12345},...]}
   

Trade‑offs and limitations

• Policy complexity – ODRL expressions with many nested constraints increase evaluation time. The research brief notes that latency stayed below 200 ms for a simple request on a LAN, but you should measure under your expected load and policy size.
• Version coupling** – The connector is built against a specific IDS Information Model version (see release notes). Using a mismatched model can cause schema validation errors and break interoperability.
• Identity‑provider trust** – The connector relies on the IdP to supply correct attributes (e.g., purpose). If credentials are compromised or the IdP issues false assertions, usage controls can be bypassed.

Practical way to check the result

1. Enable debug logging on the connector (set environment variable LOG_LEVEL=debug) and watch for lines containing "policy evaluation" and the outcome (ALLOW/DENY).
2. Measure end‑to‑end latency with a simple 1 KB payload using time curl ... and confirm it stays within your acceptable range (e.g., < 500 ms on LAN).
3. Confirm encryption by capturing traffic with tcpdump -i any -w trace.pcap port 8080 and verifying that payloads are not readable in the capture.

Actionable closing

To start using Detaspace for sovereign data exchange:

1. Run the connector with the IDS model version that matches your ecosystem.
2. Define ODRL policies that reflect your usage constraints and attach them to datasets via the management API.
3. Test both negative and positive cases as shown above, inspecting logs and latency to ensure the connector behaves as expected.
4. Monitor policy evaluation time in production and simplify policies if latency approaches your SLA thresholds.

By treating the connector as a policy enforcement point, you move usage rules from informal contracts into executable code, reducing reliance on manual audits.