Giving customers control over their data: Integrating a policy language into the cloud

Cloud computing offers the potential to store, manage, and process data in highly available, scalable, and elastic environments. Yet, these environments still provide very limited and inflexible means for customers to control their data. For example, customers can neither specify security of inter-cloud communication bearing the risk of information leakage, nor comply with laws requiring data to be kept in the originating jurisdiction, nor control sharing of data with third parties on a fine-granular basis. This lack of control can hinder cloud adoption for data that falls under regulations. In this paper, we show in six use cases how cloud environments can be enriched with policy language support to give customers control over cloud data. Our use cases are based on realizing policy language support in all three cloud environment layers, i.e., IaaS, PaaS, and SaaS. Specifically, we present policy-aware resource management (with OpenStack) and dynamic network configuration. With CERN's big data storage and the in-memory database Hyrise, we show realization for storage and further exemplify policy-aware cloud processing by network function virtualization which enables Orange to offload customer home gateways to the cloud. Finally, we discuss benefits of policy support in F-Secure's Security Cloud. These use cases show the feasibility of realizing customer control with policy support in the cloud. Thus, our work enables customers with regulated data to tap cloud benefits and significantly broadens the market for cloud providers.