In past years, cloud storage systems saw an enormous rise in usage. However, despite their popularity and importance as underlying infrastructure for more complex cloud services, today's cloud storage systems do not account for compliance with regulatory, organizational, or contractual data handling requirements by design. Since legislation increasingly responds to rising data protection and privacy concerns, complying with data handling requirements becomes a crucial property for cloud storage systems. We present PRADA, a practical approach to account for compliance with data handling requirements in key-value based cloud storage systems. To achieve this goal, PRADA introduces a transparent data handling layer, which empowers clients to request specific data handling requirements and enables operators of cloud storage systems to comply with them. We implement PRADA on top of the distributed database Cassandra and show in our evaluation that complying with data handling requirements in cloud storage systems is practical in real-world deployments such as microblogging and distributed storage of email.
To enforce storage location requirements, a class of related work proposes to split data between different storage systems. W "u @cite_54 and CloudFilter @cite_51 add proxies between clients and operators to transparently distribute data to different cloud storage providers according to s, while NubiSave @cite_13 allows combining resources of different storage providers to fulfill individual redundancy or security requirements of clients. These approaches can treat individual storage systems only as black boxes. Consequently, they do not support fine-grained s within the database system itself and are limited to a small subset of s.
@cite_13 @cite_54 @cite_51
1972808979 2002028225
Effortless data storage ''in the cloud'' is gaining popularity for personal, enterprise and institutional data backups and synchronisation as well as for highly scalable access from software applications running on attached compute servers. The data is usually access-protected, encrypted and replicated depending on the security and scalability needs. Despite the advances in technology, the practical usefulness and longevity of cloud storage is limited in today's systems, which severely impacts the acceptance and adoption rates. Therefore, we introduce a novel cloud storage management system which optimally combines storage resources from multiple providers so that redundancy, security and other non-functional properties can be adjusted adequately to the needs of the storage service consumer. The system covers the entire storage service lifecycle from the consumer perspective. Hence, a definition of optimality is first contributed which is bound to both the architecture and the lifecycle phases. Next, an ontology for cloud storage services is presented as a prerequisite for optimality. Furthermore, we present NubiSave, a user-friendly storage controller implementation with adaptable overhead which runs on and integrates into typical consumer environments as a central part of an overall storage system. Its optimality claims are validated in real-world scenarios with several commercial online and cloud storage providers. A major obstacle for the adoption of cloud services in enterprises is the potential loss of control over sensitive data. Companies often have to safeguard a subset of their data because it is crucial to their business or they are required to do so by law. In contrast, cloud service providers handle enterprise data without providing guarantees and may put confidentiality at risk. In order to maintain control over their sensitive data, companies typically block all access to a wide range of cloud services at the network level. Such restrictions significantly reduce employee productivity while offering limited practical protection in the presence of malicious employees. In this paper, we suggest a practical mechanism to ensure that an enterprise maintains control of its sensitive data while employees are allowed to use cloud services. We observe that most cloud services use HTTP as a transport protocol. Since HTTP offers well-defined methods to transfer files, inspecting HTTP messages allows the propagation of data between the enterprise and cloud services to be monitored independently of the implementation of specific cloud services. Our system, CloudFilter, intercepts file transfers to cloud services, performs logging and enforces data propagation policies. CloudFilter controls where files propagate after they have been uploaded to the cloud and ensures that only authorised users may gain access. We show that CloudFilter can be applied to control data propagation to Dropbox and GSS, describing the realistic data propagation policies that it can enforce.