Requirement-Oriented Privacy Protection Analysis
Architecture in Cloud Computing
Changbo Ke
1, 2
*, Ruchuan Wang
1, 2
, Fu Xiao
1, 2, 4
, and Zhiqiu Huang
3
1
School of Computer Sci. & Tech./School of Software, Nanjing Univ. of Posts and Telecom., Nanjing 210023, China
2
Jiangsu High Tech. Research Key Laboratory for Wireless Sensor Networks, Nanjing, Jiangsu, 210003, China
3
College of computer Sci. and Tech., Nanjing Univ. of Aeronautics and Astronautics, Nanjing, Jiangsu, 210016 China
4
Key Lab of Broadband Wireless Communication and Sensor Network Tech. (Nanjing University of Posts and
Telecom.), Ministry of Education Jiangsu Province, Nanjing, Jiangsu, 210003, China
Email: brobo.ke@njupt.edu.cn; wangrc@njupt.edu.cn, xiaof@njupt.edu.cn; zhqhuang@nuaa.edu.cn
Abstract—As a new software paradigm, cloud computing
provides services dynamically according to user requirements.
However, it is difficult to control personal privacy information
because of the opening, virtualization, multi-tenancy and
service outsourcing characters. Therefore, how to protect user
privacy information has become a research focus. In this paper,
we propose requirement-oriented privacy protection theory
analysis architecture and implementation platform. Firstly, the
theory analysis architecture is depicted as layers, and we
analyze the function and key technologies of every layer.
Secondly, we address the privacy property description method
with ontology and description logic, and then analyze the theory
modules of privacy items conflict checking layer, privacy policy
negotiation layer and privacy agreement forensics layer. Thirdly,
according to theory architecture, we design the implementation
platform of requirement-oriented privacy protection, and
discuss the function and workflow. In the end, we conclude and
point out the future work.
Index Terms—Privacy protection, privacy items, privacy policy,
privacy property, cloud computing
I. INTRODUCTION
Cloud computing is a model for enabling convenient,
on-demand network access to a shared pool of
configurable computing resources (e.g., networks, servers,
storage, applications, and services) that can be rapidly
provisioned and released with minimal management
effort or service provider interaction [1]. There are some
characters, such as service outsourcing, virtualization,
distribution and multi-tenancy. These characters enhance
the service quality and save the computing resources, for
example, service outsourcing enhances the service
capability and specialization through service composition
[2]. However, the transparency of privacy information to
the outsourcing service provider, make users worry that
privacy data be illegally propagated and used. For
Manuscript received September 2, 2014; revised January 30, 2015.
This work is supported in part by the National Science Foundation of
China under grants (No.61272083, No.61373137, No.61373017), Major
Program of Jiangsu Higher Education Institutions under grant
No.14KJA520002, Six Industries Talent Peaks Plan of Jiangsu under
grant No.2013-DZXX-014 and Jiangsu Qinglan Project.
Corresponding author email: brobo.ke@njupt.edu.cn.
example, Google was sued by some users in America and
was investigated by European Union, because of its new
unified privacy policy implemented from Mar. 1st, 2012.
According to the analysis by America Electronic Privacy
Information Center, Google new privacy policies do not
take into account how to use privacy data in the product,
and to whom privacy data be propagated according to
user privacy requirement, and may have conflicts with
local laws. Therefore, privacy protection in cloud
computing has become research focus.
Privacy was proposed as the human right in the
beginning [3]. In domain of software engineering, privacy
protection means the capability of preventing individual
information from being collected, disclosed and stored by
others [4]. The Platform for Privacy Preferences (P3P) [5]
provides a standard and machine-understandable privacy
policy, which matches with user privacy preference.
According to the matched results, user can select services.
However, the P3P lacks semantic information and only
applies to Web Site, not supporting service composition.
Therefore, P3P does not apply to cloud computing, since
all entitles in cloud computing are service or composite
service. Extensible Access Control Markup Language
(XACML) 2.0 [6] [7] extends the privacy policy through
profile and applies to the cloud service. However, it
hardly guarantees the composite service satisfying user
privacy requirement. Pearson, S et al. [8] [9] defined
privacy protection in cloud computing as the capability of
user controlling Personal Sensitive Information (PSI) not
be collected, used, disclosed and stored by cloud service
provider. They provided certain theoretical guidance, but
do not put forward specific solution method.
In order to satisfy user privacy requirement and protect
user privacy data in the business process, we propose
requirement-oriented privacy protection analysis
architecture in cloud computing, and develop a prototype
system and run a case to prove the feasibility and
practicability of the architecture.
The other parts of this paper are structured as the
follows: Section 2 we introduce related works. Section 3
we address description of privacy requirement. Section 4
we depict privacy protection architecture and analysis,
including privacy items conflict checking, privacy policy
of Communications Vol. 10, No. 1, January 2015
55
©2015 Engineering and Technology Publishing
doi:10.12720/jcm.10.1.55-63