Privacy‐aware cloud ecosystems: Architecture and performance

Abstract

With an increasing number of cloud providers offering services made use of by both individual users and other providers, there is a realization that service provision now involves an "ecosystem" of providers. Some providers may be directly visible to a user, while others may be contributors to composite services and not directly known to the user-as only the provider offering the composite service is visible. Such services may include: domain specific services (eg, simulation), advertising services, or profiling/analytics services. Understanding the impact on data privacy of a user for such a composite service remains a challenge, and providing transparency (and obtaining user consent for data use) remains a key requirement of the European General Data Protection Regulation (GDPR). An architecture that makes use of blockchains and smart contracts is proposed that addresses this requirement. An implementation of the architecture is used to demonstrate how access control can be managed and audited. The scalability and cost of undertaking access control, as the number of actors (both service providers and "voters") increases, is also described. The proposed approach can be used to support service aggregation across both private and public clouds. K E Y W O R D Sblockchain, cloud architecture, data privacy, general data protection regulation, smart contracts INTRODUCTIONWith increasing number of on-line services, often hosted over cloud infrastructure, there is a realization that such services can involve an interlinked set of cloud providers. To access a service, users primarily interact through a Web interface, and are (often) unaware of the larger collection of services that are made available behind the Web interface, and deployed across a distributed infrastructure. Users entrust their data without realizing that the providers may share their data with back-end services such as cloud hosted analytics and advertisers-the growth in Internet-connected devices adds further complexity to this challenge. In order to address this, the general data protection regulation (GDPR) is implemented to impose obligations on providers to ensure that consent is obtained from users before their data are made use of, thereby enabling nonexpert users to make informed decisions about their privacy. 1The key elements introduced in GDPR are a data subject, a controller or joint controller, and a processor. 2 The data subject is the data owner and the controller a person/organization specifying aims of processing a user's personal data. The notion of joint controller is introduced where two or more controllers jointly specify the purpose of data processing. Finally, the processor is responsible for processing personal data on behalfThis is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

Enhancing Digital Advertising with Blockchain Technology

“…Pärssinen et al (2018) describe how Brave and AdEx, by storing only critical user data, sought to increase and improve users’ data privacy in the DAE. Apart from Shi, Gao, and Guan (2022) and Aujla et al (2020), who present their own application guides for cross-app advertising and compliance-aware applications that might be adopted by advertising ecosystems, we find no other concrete applications for user data security purposes in publications discussing this topic (Barati and Rana 2020; Chen et al 2018; Maestre 2019; Lax and Russo 2019; Marthews and Tucker 2023; Peres et al 2023; Tan and Saraniemi 2022; Yun and Strycharz 2022).…”

Compliance Checking of Cloud Providers: Design and Implementation

“…In this approach, the violation of the shared agreements by the providers were detected by a number of voters listed in a voting contract. Similarly, the integration of Blockchain and GDPR resulted in the design of a privacy-aware architecture for cloud ecosystems -promoting access control [7,8]. For instance, MeDShare [24] system has been proposed to manage medical data sharing in an untrusted cloud environment.…”

“…For example, under GDPR, a provider as a data processor is responsible for implementing safe guards or encryption mechanisms before maintaining personal data in its local cloud storage. In order to automatically verify the compliance of GDPR obligations over the activities of cloud providers on user data, Blockchain and smart contracts technologies have presently been used to implement GDPR rules as programming codes and flag data breaches in a secure, automated and transparent way [8]. Blockchain as a public decentralized ledger has also been exploited in cloud container-based virtualization to improve data accountability, which is a key GDPR principle, by recording any action (e.g., read, write etc.)…”

Privacy & Cloud Services: Are We There Yet?

“…Our architecture and implementation [20] enables messages exchanged between the client app. and the cloud-hosted service to also be explicitly identified.…”