![](bg3.png)
fidentiality level. Both parts of the data access layer
hosted traditionally and in the public Cloud have to be
reconfigured to access the database layer only through
the confidentiality level data aggregator. It is assumed
that the data stores themselves have appropriate ac-
cess right configurations.
Results. For each request, several data stores are
queried. The data is routed through the aggregator,
which annotates the data with the appropriate confi-
dentiality level valid for the aggregated data set.
Example. The database layer of an application
built on Oracle Corporation MySQL (Oracle Corpo-
ration, 2011), version 5.1 is split into an Amazon
Virtual Private Cloud (Amazon VPC (Amazon.com,
Inc., 2011b)) data store hosting an AMI and Amazon
Relational Database Service (Amazon RDS (Ama-
zon.com, Inc., 2011a)). The AMI runs MySQL 5.1
relational database on OpenSolaris. Regarding Ama-
zon RDS, a MySQL DB instance is chosen. Thus,
the database functionality remains the same. The data
stored in the Amazon VPC is annotated with “NATO
Confidential” and the data stored in the Amazon RDS
is annotated with “NATO Restricted” (Department of
Defense Security Institute, 1993). The logic imple-
mented in the business layer is split into the one pro-
cessing critical and the one processing non-critical
data. The data access layer is also split and configured
to operate on the confidentiality level data aggregator.
The aggregator is fetching the data from the two dif-
ferent data sources. In case data is returned from the
Amazon VPC, the result set is annotated with “NATO
Confidential”, otherwise “NATO Restricted” is used.
On its own, this annotation does not prevent the dis-
closure of data. For instance, the disclosure itself may
be prevented in combination with the filter of critical
data pattern.
Next. In case the stored data should be updated,
the Confidentiality Level Data Splitter has to be con-
sidered.
2.2 Confidentiality Level Data Splitter
Context. The data formerly stored in
one traditionally hosted data store is
separated according to data stores with
different confidentiality levels. As the
application writes data to several data
stores, the data has to be categorized and split accord-
ing to the different confidentiality levels. This builds
the basis for avoiding disclosure of critical data when
storing it in the public Cloud.
Challenge. How can data of one common confi-
dentiality level be categorized and split into separate
data parts belonging to different confidentiality lev-
els?
Forces. The data has to be annotated and split
manually, in case the confidentiality level data splitter
is not used.
Solution. A splitter is placed within the Cloud
infrastructure of the data access layer. Thus, addi-
tional data movement, network traffic, and load can be
minimized. The splitter writes data to all Cloud data
stores. As the splitter processes data with the highest
confidentiality level, it has to be placed in a location
where the demands of the highest confidentiality level
are fulfilled.
Sketch Privacy and Security Data Level Splitter
Traditional
Presentation
Layer
Application
Business
Layer
Data Access
Layer*
Private
Cloud
Community
Cloud
Deployment
Models
Public
Cloud
Database
Layer
Database
Layer
Database
Layer
Legend
Dataflow
Migration
Partial Migration
Modified Component
*
Application Layers
Figure 3: Sketch of Confidentiality Level Data Splitter.
Sidebars. The data to be stored in the different
data stores might have to be separated and catego-
rized into different confidentiality levels from one se-
curity or privacy domain. The splitter gets input data
of a common security or privacy domain and outputs
a separation of this data according to the particular
security or privacy levels. The splitter has to be con-
figured for the mapping from one common confiden-
tiality level to different confidentiality levels from the
same security or privacy domain. The configuration
also includes a determination of the data store for each
level. It is assumed that the data stores themselves
have appropriate access right configurations. The data
access layer has to be configured to write data exclu-
sively through the Confidentiality Level Data Splitter
to the database layer. In order to avoid disclosure of
critical data, the data access layer has to be placed in a
location where the demands of highest confidentiality
level are fulfilled. Usually, this is the private Cloud.
Results. For each data write, several data stores
are used. The data is routed through the splitter, which
categorizes and separates the data of one common
confidentiality level into disjoint data sets of differ-
ent confidentiality levels. The data sets are stored in
the appropriate data store based on the corresponding
security level of each data set.
Example. The database layer of an application
used by the NATO for management of data of differ-
ent security levels consists of three data stores hosted
CLOUDDATAPATTERNSFORCONFIDENTIALITY
389