![](bg3.png)
in the message exchanges. It is the information
needed by the provider in order to perform the
correct computations in the service consumption.
Message payload, as an item of interest, impacts
both ID and content privacy.
Vis-à-vis ID privacy, message payload can be
inspected and analyzed to reveal the consumer’s
identification, as consumer’s data can have semantic
links to consumer’s ID. As for content privacy, the
message payload is comprised of the actual
consumer’s data. Location and behavior privacy are
not considered in this type of consumer information.
2.2.3 Network-level Communications
Messages are sent through the network, typically in
the Internet, which implies that both consumer and
provider know each other’s network credentials
(e.g., IP addresses).
IP addresses affect both ID and location privacy.
Current IP addressing schemes link easily the IP
address to its owner and can be rapidly tied to a
geographic position (Beresford and Stajano, 2003).
Network traffic analysis, for instance, of TCP
connections transporting service messages, can
expose behavior privacy, revealing the correlation
between successive service usages over time.
Network protocols’ payload eavesdropping (content
and ID privacy) are not considered here, as this
information is the same as those in message
metadata and message data discussed before.
3 SaaS ANONYMITY
FRAMEWORK
3.1 Multi-layer Design
Safeguarding the anonymity of the consumer during
SaaS service consumption enables the protection of
business’ interests, avoiding the link between
message requests and their respective consumer.
However, as seen in the last section, ID, location,
behavior and content privacy relate to various types
of consumer information present in different layers
of interaction between consumer and provider.
Therefore, anonymity techniques can be employed
in a multi-layer design, enabling the use of different
and complementary techniques. In our framework,
the overall anonymity is preserved by adding up the
protection provided at each layer.
We are currently considering three different
layers in our anonymity framework, corresponding
to each type of consumer information described in
the previous privacy assessment: Message Metadata,
Message Data and Network.
Each layer utilizes specific anonymity
technology to enhance privacy of the respective
items of interest. The multi-layer design is a salient
feature of our framework: the anonymity technology
used in each level can be replaced or adapted to
meet specific requirements. Our goal is to make the
design flexible enough so it can be adjusted and also
evolve accordingly to privacy requirements,
producing the best fit to the privacy needs.
The first layer, Message Metadata, is a
distinguishing characteristic of the cloud computing
scenario. As for the remaining layers, Message Data
and Network, the approach can leverage on
established anonymity technologies, not directly
specific to the cloud computing model. Hence, in
this Section, we discuss general solutions for each
layer, but we present a detailed design only for the
first layer, in the next Section.
In a companion paper, we consider the case of
traceable anonymous service consumption, using
group signatures as the main anonymity technology
(Pacheco and Puttini, 2011).
The challenge in anonymous service
consumption in a cloud computing environment
relates to the need of the consumer to have access to
services, with appropriate SLA, and the need of the
provider to account and receive the payment related
to service provision. In conventional SaaS scenarios,
such as the one described in Section 2, SLAs are
usually specified in the service contract (WSDL),
which can be easily searched for and selected
anonymously by the consumer. However, the service
provision itself requires the consumer to be
authenticated in order to allow the accounting and
the billing for service usage. Moreover, consumer
and provider are directly bond by the invoice-
payment process, which represents a strong
impairment to anonymity.
In our design, we aim at anonymous service
consumption, implying consequently also in
anonymous payment. The basic idea consists in
using an anonymous electronic payment to be
performed at the time of service consumption. Our
approach is based on e-cash systems (Chaum, 1982),
(Okamoto and Ohta 1992), (Camenisch et al., 2005),
which fulfills two basic requirements: (1) consumers
must be able to obtain and use (pay for) e-cash
anonymously; and (2) providers must be able to
securely verify the payment immediately, during the
service consumption, i.e., after receiving the service
request (request message) and before providing the
service (response message). Note that in this
scheme, each service consumption instance is paid
CLOSER2012-2ndInternationalConferenceonCloudComputingandServicesScience
98