Data Protection in the Cloud

Abstract This article discusses the data protection issues made topical by cloud computing. It takes its starting point in a decision made by the Danish Data Protection Agency which is probably the first decision concerning this issue in an EU member state. The article focuses on the relationship between controller and processor, data security, data transfer and data subject rights. It concludes that cloud computing is a challenge but that data protection law should be able to meet that challenge.

[1]  Xiaohui Liang,et al.  Attribute based proxy re-encryption with delegating capabilities , 2009, ASIACCS '09.

[2]  Ignacio Luengo.  Recent Trends in Cryptography , 2009 .

[3]  Siani Pearson,et al.  Taking account of privacy when designing cloud computing services , 2009, 2009 ICSE Workshop on Software Engineering Challenges of Cloud Computing.

[4]  Brent Waters,et al.  Fuzzy Identity-Based Encryption , 2005, EUROCRYPT.

[5]  Hovav Shacham,et al.  Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds , 2009, CCS.

[6]  P. Samarati,et al.  Access control: principle and practice , 1994, IEEE Communications Magazine.

[7]  Jörg Schwenk,et al.  The Accountability Problem of Flooding Attacks in Service-Oriented Architectures , 2009, 2009 International Conference on Availability, Reliability and Security.

[8]  Jörg Schwenk,et al.  On Technical Security Issues in Cloud Computing , 2009, 2009 IEEE International Conference on Cloud Computing.

[9]  S. Katzenbeisser,et al.  ON MULTI-AUTHORITY CIPHERTEXT-POLICY ATTRIBUTE-BASED ENCRYPTION , 2009 .

[10]  Ben Laurie,et al.  Under)mining Privacy in Social Networks , 2008 .

[11]  Siani Pearson,et al.  A client-based privacy manager for cloud computing , 2009, COMSWARE '09.

[12]  Brent Waters,et al.  Conjunctive, Subset, and Range Queries on Encrypted Data , 2007, TCC.

[13]  Behram F. T. Mistree,et al.  Gaydar: Facebook Friendships Expose Sexual Orientation , 2009, First Monday.

[14]  Richard Wolski,et al.  The Eucalyptus Open-Source Cloud-Computing System , 2009, 2009 9th IEEE/ACM International Symposium on Cluster Computing and the Grid.

[15]  Flaviu Cristian,et al.  Understanding fault-tolerant distributed systems , 1991, CACM.

[16]  T. Elgamal.  A public key cryptosystem and a signature scheme based on discrete logarithms , 1984, CRYPTO 1984.

[17]  Michel Riguidel,et al.  Threat Model for Grid Security Services , 2005, EGC.

[18]  Brent Waters,et al.  Attribute-based encryption for fine-grained access control of encrypted data , 2006, CCS '06.

[19]  Adi Shamir,et al.  How to share a secret , 1979, CACM.

[20]  Rakesh Agrawal,et al.  Privacy-preserving data mining , 2000, SIGMOD 2000.

[21]  Colin Boyd,et al.  Cryptography and Coding , 1995, Lecture Notes in Computer Science.

[22]  Elaine Shi,et al.  Predicate Privacy in Encryption Systems , 2009, IACR Cryptol. ePrint Arch..

[23]  Nils Gruschka,et al.  The Impact of Flooding Attacks on Network-based Services , 2008, 2008 Third International Conference on Availability, Reliability and Security.

[24]  Mihir Bellare,et al.  Code-Based Game-Playing Proofs and the Security of Triple Encryption , 2004, IACR Cryptol. ePrint Arch..

[25]  Rafail Ostrovsky,et al.  Public Key Encryption with Keyword Search , 2004, EUROCRYPT.

[26]  William Yurcik,et al.  Toward a threat model for storage systems , 2005, StorageSS '05.

[27]  Dan Boneh,et al.  Hierarchical Identity Based Encryption with Constant Size Ciphertext , 2005, EUROCRYPT.

[28]  Ian T. Foster,et al.  The Anatomy of the Grid: Enabling Scalable Virtual Organizations , 2001, Int. J. High Perform. Comput. Appl..

[29]  Josh Benaloh,et al.  Generalized Secret Sharing and Monotone Functions , 1990, CRYPTO.

[30]  Pieter H. Hartel,et al.  Ciphertext-Policy Attribute-Based Threshold Decryption with Flexible Delegation and Revocation of User Attributes (extended version) , 2009 .

[31]  Michael McIntosh,et al.  XML signature element wrapping attacks and countermeasures , 2005, SWS '05.

[32]  H. Nissenbaum.  Privacy as contextual integrity , 2004 .

[33]  Adi Shamir,et al.  A method for obtaining digital signatures and public-key cryptosystems , 1978, CACM.

[34]  Zhen Liu,et al.  On Efficiently Transferring the Linear Secret-Sharing Scheme Matrix in Ciphertext-Policy Attribute-Based Encryption , 2010, IACR Cryptol. ePrint Arch..

[35]  Melissa Chase,et al.  Multi-authority Attribute Based Encryption , 2007, TCC.

[36]  Xiaohui Liang,et al.  Secure Threshold Multi Authority Attribute Based Encryption without a Central Authority , 2008, INDOCRYPT.

[37]  Rizos Sakellariou,et al.  Euro-Par 2001 Parallel Processing , 2001, Lecture Notes in Computer Science.

[38]  Craft Silicon,et al.  SaaS (software as a service) , 2005 .

[39]  Saikat Guha,et al.  NOYB: privacy in online social networks , 2008, WOSN '08.

[40]  Robbert van Renesse,et al.  Toward a cloud computing research agenda , 2009, SIGA.

[41]  Alvaro A. A. Fernandes,et al.  An Approach to Ad hoc Cloud Computing , 2010, ArXiv.

[42]  NetComm Limited,et al.  QoS(Quality of Service) , 2010 .

[43]  Yevgeniy Dodis,et al.  ID-based encryption for complex hierarchies with applications to forward security and broadcast encryption , 2004, CCS '04.

[44]  Clifford C. Cocks.  An Identity Based Encryption Scheme Based on Quadratic Residues , 2001, IMACC.

[45]  Christopher Krügel,et al.  A Practical Attack to De-anonymize Social Network Users , 2010, 2010 IEEE Symposium on Security and Privacy.

[46]  Murat Kantarcioglu,et al.  A Survey of Privacy-Preserving Methods Across Horizontally Partitioned Data , 2008, Privacy-Preserving Data Mining.

[47]  Paul T. Jaeger,et al.  Cloud Computing and Information Policy: Computing in a Policy Cloud? , 2008 .

[48]  Matthew K. Franklin,et al.  Identity-Based Encryption from the Weil Pairing , 2001, CRYPTO.

[49]  Atsuko Miyaji,et al.  A ciphertext-policy attribute-based encryption scheme with constant ciphertext length , 2009, Int. J. Appl. Cryptogr..

[50]  Avi Wigderson,et al.  On span programs , 1993, [1993] Proceedings of the Eigth Annual Structure in Complexity Theory Conference.

[51]  Brent Waters,et al.  Ciphertext-Policy Attribute-Based Encryption , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).

[52]  Brian Hayes,et al.  What Is Cloud Computing? , 2019, Cloud Technologies.

[53]  Brent Waters,et al.  Secure attribute-based systems , 2006, CCS '06.

[54]  Craig Gentry,et al.  Practical Identity-Based Encryption Without Random Oracles , 2006, EUROCRYPT.

[55]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[56]  David A. Couillard.  Defogging the Cloud: Applying Fourth Amendment Principles to Evolving Privacy Expectations in Cloud Computing , 2009 .

[57]  Andrew Martin,et al.  A Critical Survey of Grid Security Requirements and Technologies , 2003 .

[58]  Silvio Micali,et al.  Proofs that yield nothing but their validity and a methodology of cryptographic protocol design , 1986, 27th Annual Symposium on Foundations of Computer Science (sfcs 1986).

[59]  Dan Boneh,et al.  A Brief Look at Pairings Based Cryptography , 2007, 48th Annual IEEE Symposium on Foundations of Computer Science (FOCS'07).

[60]  Carlisle Adams,et al.  Understanding PKI: Concepts, Standards, and Deployment Considerations , 1999 .

[61]  Manoj Prabhakaran,et al.  Attribute-Based Signatures , 2011, CT-RSA.

[62]  Mladen A. Vouk,et al.  Cloud Computing – Issues, Research and Implementations , 2008, CIT 2008.

[63]  Randy H. Katz,et al.  Above the Clouds: A Berkeley View of Cloud Computing , 2009 .

[64]  Adi Shamir,et al.  Identity-Based Cryptosystems and Signature Schemes , 1984, CRYPTO.

[65]  Jin Tong,et al.  Attributed based access control (ABAC) for Web services , 2005, IEEE International Conference on Web Services (ICWS'05).