Our
Framework
The iSHARE Trust Framework puts data rights holders in control: they decide who may access their data, for what purpose and on what terms — and delegate that access explicitly, while the data stays at the source.
The framework brings together a full set of specifications and agreements — functional, legal, operational and technical — so that access granted once is recognised by every participant, in any environment. Data rights holders keep governance over their data; data users get one standardised way to prove who they are and what they may access.
iSHARE Roles
Roles within the framework ensure that a single legal entity can perform multiple functions, while the interface specification always promotes possible federation. For example, creating a seamless integration of roles. Despite this, all APIs to the Data Provider and the Authorization Registry are similarly exposed.
Organisations with rights to access
specific services or data
Organisations offering
services for consumption
Organisations using services for
a specific application or use case
Organisations offering
identification services for people
Organisations acting as intermediaries
between Service Providers and Identity Providers
in case of multiple identity providers
The Authorisation Registry holds
and manages the access-control rules
and
permissions that determine which parties
are allowed to request or receive specific data
The Participant Registry ensures
smooth membership management
and is responsible for participant
admission into the iSHARE network
The iSHARE Foundation serves
as the Scheme owner. It is responsible
for maintaining the Trust Framework and
admitting certified parties into the ecosystem
An organisation that facilitates the
admission of new participants, governs
the data space and assesses the adherence
of different roles to the data space agreement.
Participant Registry role can be performed by
the Data Space Governance Body.
iSHARE Trust Framework Aspects
01. Functional Aspects
Introduction
When an organisation seeks to access a service or data from another party, the Framework establishes the trust mechanisms governing how requests are initiated, verified, and fulfilled. Specifically, it addresses three fundamental principles:
→ Identity — Who is the requesting party?
→ Authentication — Can the requesting party’s identity be validated?
→ Authorisation — Does the requesting party hold the necessary permissions to participate in data sharing transactions?
All interactions fall into one of two categories:
→ Machine-to-Machine (M2M) — a computer system requests a service from another computer system automatically, without a human actively involved in the request itself
→ Human-to-Machine (H2M) — a person directly requests a service, and their identity needs to be verified by an Identity Provider before access is granted.
How a typical interaction works
Regardless of the specific scenario, every interaction follows the same basic logic:
- The Service / Data Consumer requests a service from the Service / Data Provider.
- The Service / Data Provider checks that the consumer is a legitimate iSHARE participant.
- The Service / Data Provider checks whether the consumer is entitled to access the data.
- Once access is granted, licences define what the consumer is actually allowed to do with the data. Licences are legally binding on all participants.
In H2M scenarios, an additional step verifies the human user’s identity via an Identity Provider before step 2.
02. Operational Aspects
Introduction
The iSHARE Trust Framework is governed by a set of subsequent operational processes that manage a participant’s entire lifecycle in the network from joining, through day-to-day compliance, to eventual exit, while keeping the wider ecosystem informed and up to date.
Admission
Prospective parties join a Data Space by signing the accession agreement, holding a valid party identifier, providing an eIDAS Qualified Certificate (or onboarding via a certified Identity Provider), and passing the conformance test (Certified Parties additionally need to complete an Assessment Framework). Verification takes up to 5 working days for Adhering roles, and up to 30 days for Certified Parties.
Incident Management
The Incident Management Processes requires the reporting party, in conjunction with the causing party (if not the same), to assess together whether the event deemed an incident is indeed an incident. At any point, the reporting party can approach a legal entity (local or international) for the resolution of the incident. This needs to be informed to the concerned Data Space as well.
Change Management
Any party can submit a Request for Change with rationale and business case, which the Scheme Owner logs and either forwards to the Change Advisory Board or rejects with justification. Approved changes are scheduled on a release calendar.
03. Legal Aspects
Introduction
The iSHARE Trust Framework includes the following agreements:
→ Terms of Use
→The Accession Agreements for Certified Parties and Adhering Parties
→ Data Space agreement
Terms of use and the Accession Agreements are mandatory for all, while the Data Space Governance Body signs the Data Space agreement.
Licences & Agreements
→ Licences are a vital part of the iSHARE Trust Framework, offering clear, legally supported guidelines for service consumption and data exchange.
→ Agreements are vital to ensure data exchanges, by holding parties who are signed into an agreement on data transaction of certain obligations.
Privacy Laws
When you exchange data within the iSHARE Trust Framework and you adhere to the iSHARE technical specifications, this means that you comply with GDPR and ISO27001 with respect to the technical security measures required for the exchange of personal data.
Competition Law
Whether EU or national competition law applies depends on an agreement’s geographic effect. Competition law prohibits agreements that restrict competition unless justified, with stricter rules for horizontal agreements (those at the same production level) than vertical ones.
04. Technical Aspects
Introduction
The iSHARE Trust Framework provides technical specifications to govern interactions among various organisations’components. These specifications focus on essential aspects such as identification, authentication, and verification within these interactions
Roles and architecture
Within the broader architecture, the Data Space Governance Body defines the rules for participation, while the Participant Registry operationalises them through a distributed ledger (in practice the two roles can even be performed by the same organisation).
Participant Registry
It sits at the heart of trust in the iSHARE ecosystem. Defined in the iSHARE Trust Framework as a certified role (formerly known as the Satellite), it acts as one of a data space’s ‘trust anchors’ by verifying whether another party is recognised, compliant, and eligible to interact based on the exchange of cryptographic tokens.
Technical capabilities
Technically, the flows of the Framework go via Application Programming interface (API) calls, or Verifiable Credential (VC) Schemas.
- For the full API reference, see the Swagger Specification and the Deployment Guide for implementation details.
- For the full Verifiable Credential schemas, the structure of the participant credentials can be viewed here.