Implementing Secure, Cross-Organizational Data Sharing with Eclipse Dataspace Components on AWS

The article explores the architectural fundamentals of implementing Eclipse Dataspace Components (EDC), a set of technical components for building secure and interoperable data spaces aligned with International Data Spaces Association (IDSA) standards and the Dataspace Protocol (DSP). A data space facilitates controlled data sharing between distinct entities (data consumers and providers) under the governance of a Dataspace Governance Authority (DSGA).

Core Components of a Data Space

Key components within the EDC framework enable the creation and management of data spaces:

• Federated Catalog (FC): An aggregated repository of data asset catalogs from multiple participants, periodically crawled and cached to reduce on-demand querying.
• Connector: The primary software component enabling secure data exchange between participants. It's split into a control plane for contract negotiation and a data plane for actual data transfer.
• Identity Hub: Manages participants' credentials within the data space, essential for establishing trust.
• Policies: Encompass membership, access, contract, and usage policies to govern data interactions.

Decentralized Trust with DCP

The Decentralized Claims Protocol (DCP), an overlay on DSP, is crucial for establishing decentralized trust. It leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). An issuer generates a DID containing identity information and stores VCs (like digital certificates) in their identity hub. Verifiers use the DID document to confirm the VC, establishing trust without a central authority.

EDC Connector Architecture and Customization

The EDC connector is architected for modularity and extensibility, crucial for integrating with cloud providers like AWS. It follows a Service Provider Interface (SPI) pattern, separating interfaces, core implementations, and extensions.

• /spi: Defines foundational interfaces and contracts for component communication, ensuring standardized integration.
• /core: Houses the actual working code and default implementations of essential services.
• /extensions: Provides modular plugins for real-world integrations, including AWS-specific functionality for services like S3, Secrets Manager, and DynamoDB. Custom builds are assembled using a version catalog, launcher modules (for control and data planes), and a project settings file.