Group-based Discretionary Access Control for Epidemiological Resources

Scientific repositories promote information sharing at a global scale. However, users will share sensitive resources in such repositories only if they are trustable. In addition, they must provide intuitive mechanisms to manage who can access to resource collections. Current approaches, which rely on a central administration, are not flexible and do not scale to cope with large numbers of users. Moreover, discretionary access control is a legal standard for health-related resources. This work proposes a group-based discretionary access control model with decentralized permission and group management The model also differentiates permissions for data and meta-data, enabling the sharing of meta-data while protecting sensitive data. The access control model is introduced and formalized using Barker's Unifying Metamodel. We also describe how the model has been implemented in the Epidemic Marketplace, an open software information platform for epidemic studies, designed to foster cooperative behavior and data sharing.