Data is the key to AI, but its use requires the highest security standards. This is where the TRUSTED project from the European Commission steps in: Over the next three years, the project will develop a prototype data space for personal data that complies with the requirements of current data protection regulations (GDPR, eIDASv2, EUDI wallet, etc.) as well as the specifications of European data spaces (GAIA-X, IDSA, etc.) and provides a trustworthy service for federated learning* in the medical sector. The Fraunhofer Institute for Applied and Integrated Security AISEC is a research partner and supports TRUSTED with state-of-the-art cybersecurity and data protection technologies. The project is to receive around four million euros from the Horizon Europe program and comprises a consortium of ten partners, two research organizations, three SMEs, two large companies, two NGOs and one clinical partner.

Innovations that utilize artificial intelligence (AI) can be of great added value for the economy and society, particularly when they generate new findings, e.g., on the understanding and treatment of diseases. In order for AI methods to be used reliably with personal data, it is important to ensure that users retain control over what data will be accessed. A promising concept for this is access control using self-sovereign identities* (SSI). In addition, privacy-enhancing technologies* (PET) can increase the level of data protection applied to the data during machine learning.

To drive AI-based innovation, the TRUSTED (Enabling Trustworthy European Data Spaces through Self-Sovereign Identity and Privacy Preserving Technologies) project, funded by the European Commission, aims to create a prototype of a trusted data space for personal data that complies with European data protection regulations (GDPR, eIDASv2, EUDI wallet, etc.) and European data space specifications (GAIA-X, IDSA, etc.). Within this data space, TRUSTED is developing two scalable and reliable services:

1. A trusted service for federated learning in the medical sector that uses privacy-enhancing technologies (PET) to enable AI-powered studies with data sets that are protected from misuse and manipulation.
2. A scalable and reliable service for self-sovereign identities that combines AI-supported validation of documents, e.g., ID cards or driving licenses, multimodal biometrics and cryptography based on zero-knowledge proofs* (ZKP). This enables, for example, authorization to be electronically confirmed and revoked, or certain identity attributes to be shared in a privacy-friendly manner.

Fraunhofer AISEC is contributing to the EU project with the specialized knowledge of its “Service and Application Security” department. The cybersecurity experts analyze how existing SSI technologies can be applied in data spaces and adapt identity management tools to the specifications of existing data spaces. They develop technologies to improve privacy and cryptographic methods, such as zero-knowledge proofs, in order to utilize data across organizations for machine learning. The experts are contributing their knowledge to help standardize tools and regulations.

The project partners

The TRUSTED consortium consists of ten research institutions and one associate research institution from five countries: Gradiant (lead), Tree Technology, Fundación Cibervoluntarios (Spain), Infocert SPA, Cybersocial Lab (Italy), Fraunhofer Institute for Applied and Integrated Security AISEC, Fraunhofer-Institut für Software- und Systemtechnik ISST (Germany), Promptly, Centro Hospitalar Universitário de Coimbra (Portugal), Sestek (Turkey), Fondazione Mondo Digitale (associate research institution, Italy).

*Glossary

• Self-sovereign (digital) identities (SSI) are a concept in which users have full control over their own digital identities. Instead of central institutions storing identity data, users manage their information themselves. This allows users to decide which data they share and with whom.
• A digital identity is based on information and data available online that represent a person or organization and facilitate their interactions on the Internet.
• Privacy-enhancing technologies (PET) are technologies and concepts that make it possible to process data securely while protecting the privacy of the owners of this data.
• Federated learning is a method of training an AI model without the need to collect sensitive data centrally. Instead, data is processed locally on the user's device.
• The zero-knowledge proof (ZKP) is a cryptographic method that makes it possible to prove knowledge of sensitive information, e.g., an access password, without disclosing the sensitive information itself.