Towards safer information sharing in the cloud

Abstract

Web interactions usually require the exchange of personal and confidential information for a variety of purposes, including enabling business transactions and the provisioning of services. A key issue affecting these interactions is the lack of trust and control on how data are going to be used and processed by the entities that receive it. In the traditional world, this problem is addressed using contractual agreements, those are signed by the involved parties, and law enforcement. This could be done electronically as well but, in addition to the trust issue, there is currently a major gap between the definition of legal contracts regulating the sharing of data, and the software infrastructure required to support and enforce them. How to enable organisations to provide more automation in this process? How to ensure that legal contracts can be actually enforced by the underlying IT infrastructure? How to enable end-users to express their preferences and constraints within these contracts? This article describes our R&D work to make progress towards addressing this gap via the usage of electronic Data Sharing Agreements (e-DSA). The aim is to share our vision, discuss the involved challenges and stimulate further research and development in this space. We specifically focus on a cloud scenario because it provides a rich set of use cases involving M. Casassa-Mont interactions and information sharing among multiple stakeholders, including users and service providers.

Object based Accountability Framework for Information Sharing in Cloud Computing

“…In the Existing system, the user can share information over the cloud using the Electronic Data Sharing Agreements (e-DSA). [1] In this, many rules and policies are defined between the user and the local service provider. This agreement is a way to give the user an option to have the accountability of his data or information over the cloud.…”

“…This was how the existing system provides the accountability to the user. [1] In the previous system, the e-DSA was divided into following: This all mentioned integrally used in the e-DSA to provide a singular way of providing this service. Along with that, many roles were also defined.…”

“…Suppose, once the agreement is done between the user and the local service provider, after that if a data is available over the server for more than year, it will be deleted after that. [1] The thing is that if once the agreement is finalized between the user and the local service provider, it is the responsibility of the local service provider to retain the security and the privacy of the user data. If the service provider shares the user data with another service provider, he needs to inform the user about that.…”

“…The user has no awareness of his data being used by some other individual or an organization without the proper permission or authentication and there was no accountability of that provided to the user. [1] The other drawback is that the previous technologies were prone to many security attacks like Man-In-Middle. The main reason for that, earlier the agreement was done between the user and the local service provider.…”

An architecture for privacy-preserving sharing of CTI with 3rd party analysis services

“…The C3ISP Gateway retrieves the raw CTI from the MSS using the Tenant Manager. Once received, the raw CTI has to be formatted and processed by the C3ISP Gateway in accordance with the DSA [8][9][10] set by the SME. This is where the DSA Manager comes in, by letting the SMEs select DSAs by either configuring a set of pre-formulated policy templates [11,12], or even creating a completely new DSA.…”