Automating Privacy Enforcement in Cloud Platforms

Privacy in cloud computing is a major concern for individuals, governments, service and platform providers. In this context, the compliance with regards to policies and regulations about personal data protection is essential, but hard to achieve, as the implementation of privacy controls is subject to diverse kinds of errors. In this paper we present how the enforcement of privacy policies can be facilitated by a Platform as a Service. Cloud applications developers can use non-obtrusive annotations in the code to indicate where personally identifiable information is being handled, leveraging the aspect-oriented programming (AOP) features. Subsequently the evaluation of user defined preferences is performed by trustful components provided by the platform, liberating developers from the burden of designing custom mechanisms for privacy enforcement in their software.

[1]  Ayman I. Kayssi,et al.  Privacy as a Service: Privacy-Aware Data Storage and Processing in Cloud Computing Architectures , 2009, 2009 Eighth IEEE International Conference on Dependable, Autonomic and Secure Computing.

[2]  David J. DeWitt,et al.  Limiting Disclosure in Hippocratic Databases , 2004, VLDB.

[3]  S. Sudarshan,et al.  Extending query rewriting techniques for fine-grained access control , 2004, SIGMOD '04.

[4]  Andrew Charlesworth,et al.  Accountability as a Way Forward for Privacy Protection in the Cloud , 2009, CloudCom.

[5]  Gregory Neven,et al.  Matching Privacy Policies and Preferences: Access Control, Obligations, Authorisations, and Downstream Usage , 2011, Privacy and Identity Management for Life.

[6]  Lorrie Faith Cranor,et al.  P3P: Making Privacy Policies More Useful , 2003, IEEE Secur. Priv..

[7]  Ulrich Lang,et al.  OpenPMF SCaaS: Authorization as a Service for Cloud & SOA Applications , 2010, 2010 IEEE Second International Conference on Cloud Computing Technology and Science.

[8]  Alec Wolman,et al.  Lockr: better privacy for social networks , 2009, CoNEXT '09.

[9]  Elisa Bertino,et al.  Privacy Protection , 2022 .

[10]  Marc Langheinrich,et al.  A Privacy Awareness System for Ubiquitous Computing Environments , 2002, UbiComp.

[11]  Kai Rannenberg,et al.  Privacy and Identity Management for Life , 2011, Privacy and Identity Management for Life.

[12]  Brian Hayes,et al.  What Is Cloud Computing? , 2019, Cloud Technologies.

[13]  Latanya Sweeney,et al.  k-Anonymity: A Model for Protecting Privacy , 2002, Int. J. Uncertain. Fuzziness Knowl. Based Syst..

[14]  Marco Casassa Mont,et al.  A Systemic Approach to Automate Privacy Policy Enforcement in Enterprises , 2006, Privacy Enhancing Technologies.

[15]  Siani Pearson,et al.  A client-based privacy manager for cloud computing , 2009, COMSWARE '09.

[16]  Da-Wei Wang,et al.  An Aspect-Oriented Approach to Privacy-Aware Access Control , 2007, 2007 International Conference on Machine Learning and Cybernetics.

[17]  Joaquin Garcia-Alfaro,et al.  Data Privacy Management and Autonomous Spontaneous Security, 4th International Workshop, DPM 2009 and Second International Workshop, SETOP 2009, St. Malo, France, September 24-25, 2009, Revised Selected Papers , 2010, DPM/SETOP.

[18]  Lars Erik Holmquist,et al.  UbiComp 2002: Ubiquitous Computing , 2002 .

[19]  Ramakrishnan Srikant,et al.  Implementing P3P using database technology , 2003, Proceedings 19th International Conference on Data Engineering (Cat. No.03CH37405).

[20]  Chun Zhang,et al.  Storing and querying ordered XML using a relational database system , 2002, SIGMOD '02.

[21]  Werner Nutt,et al.  Rewriting aggregate queries using views , 1999, PODS.

[22]  Muhammad Sabir Idrees,et al.  Evolving Security Requirements in Multi-layered Service-Oriented-Architectures , 2011, DPM/SETOP.

[23]  Tomaz Klobucar,et al.  Privacy-Enhancing Technologies - approaches and development , 2003, Comput. Stand. Interfaces.