Authors:
Walid Benghabrit
1
;
Hervé Grall
1
;
Jean-Claude Royer
1
;
Mohamed Sellami
1
;
Monir Azraoui
2
;
Kaoutar Elkhiyaoui
2
;
Melek Önen
2
;
Anderson Santana De Oliveira
3
and
Karin Bernsmed
4
Affiliations:
1
Mines Nantes, France
;
2
EURECOM, France
;
3
SAP Labs France, France
;
4
SINTEF ICT, Norway
Keyword(s):
Accountability, Data Protection, Framework, Policy Language, Policy Enforcement.
Related
Ontology
Subjects/Areas/Topics:
Cloud Computing
;
Cloud Computing Enabling Technology
;
Security, Privacy, and Compliance Management
Abstract:
Nowadays we are witnessing the democratization of cloud services. As a result, more and more end-users (individuals and businesses) are using these services for achieving their electronic transactions (shopping, administrative procedures, B2B transactions, etc.). In such scenarios, personal data is generally flowed between
several entities and end-users need (i) to be aware of the management, processing, storage and retention of personal data, and (ii) to have necessary means to hold service providers accountable for the usage of their data. In fact, dealing with personal data raises several privacy and accountability issues that must be considered before to promote the use of cloud services. In this paper, we propose a framework for the representation of cloud accountability policies. Such policies offer to end-users a clear view of the privacy and accountability obligations asserted by the entities they interact with, as well as means to represent their preferences. This framework
comes with two novel accountability policy languages; an abstract one, which is devoted for the representation of preferences/obligations in an human readable fashion, a concrete one for the mapping to concrete enforceable policies. We motivate our solution with concrete use case scenarios.
(More)