Secure and Privacy Preserving Scalable GDPR Enforcement System

Protecting personal data has become a major issue of concern in the whole world. As per the General Data Protection Regulation (GDPR), Data Owners (DO) are given back control over their data, which is maintained by the Service Providers (SP). However, SP needs to be fully GDPR compliant. In the existing GDPR enforcement technologies, DO is severely facing the scalability issue considering it has to manage separate keys for different data. Clearly, it would be highly impractical to manage such a huge and proportionally increased amount of keys for resource constrained devices of DO. Furthermore, the integrity of the data received by the Data User (DU) is not addressed in the existing works. We propose a proxy re-encryption based secure protocol where DO has to manage only one key. We propose a threat model to analyze our proposed protocol. In this analysis, we use a random oracle model to assess security and privacy. We use Burrows-Abadi-Needham (BAN) logic to verify the correctness. Simulation through AVISPA and ProVerif, formal verification tools, also confirms the security and privacy of the proposed protocol. A testbed simulation is conducted to estimate the computational, communication, and storage requirements, ensuring the practicality of the proposed protocol.