Auszug. © Genehmigter Nachdruck. Alle Rechte vorbehalten.

Privacy, Identity, and Cloud Computing

iUniverse, Inc.

Contents

1. On the Privacy of Cloud Computing...........................................................152. Identity as a Service.......................................................................413. Identity Analytics and Belief Structures....................................................594. Compatibility Relations in Identity Analysis................................................715. Conspectus of Cloud Computing...............................................................856. Cloud Computing Economics: Democratization and Monetization of Services.....................997. Ontological View of Cloud Computing.........................................................1218. Privacy as a Service........................................................................1339. Liberty, Freedom, and Rights................................................................18110. Principles of Data Regulation..............................................................191

Chapter One

INTRODUCTION

It seems as though most computer users would like privacy and information security while having convenient access to interlinked computing services both on-premises and in the cloud. In this instance, the cloud is a metaphor for the Internet, which can be used as the delivery vehicle for computing services and the storage of information. Advocates of cloud computing are faced with two major problems, that is, in addition to the usual problem of transferring one's resources from one operational environment to another. The first of the major problems is the ongoing feeling that we are experiencing the "dj vu all over again" syndrome. Many of us have gone through an avalanche of new technological advances intended as solutions to our administrative and operational problems - at least, the ones involving management and information systems. Some of the technical innovations we have experienced include scalable main-frame computers, advanced operating systems, time sharing, client/server, online systems, mini computers, personal computers, artificial intelligence, hand-held computers, the Internet and the World Wide Web, mobile computers, social networking, and by the time this paper is published, there will no doubt be several more entries to add to the list. So one has reason to be skeptical of someone writing that cloud computing is worthy of serious attention. Of course, we think it is, for obvious reasons.

The second major issue is privacy, and it stems from the fact that with cloud computing, data and programs are stored off-premises and managed by a service provider. When a third party gets a hold of your data, who knows what is going to happen to it. Many proponents of cloud computing conveniently characterize it as analogous to the electric utility. The basic idea is that the private generators of the twentieth century were replaced by the electricity grids of today without undue concern. It is easy to imagine, however, that the measurement of electricity usage would have been of concern to some people in the early 1900s. Although similar in some respects, cloud computing is different in one important way. The cloud will typically handle information, which is the basic unit of exchange, about which security and privacy are of paramount concern. With electricity, there is no interest in individual electrons. With information, the key issues are identity, security, and privacy. The side issues are one's inherent identity attributes (such as age, gender, and race), accountability (for online computing activities), and anonymity (in order to preserve free speech and other forms of behavior for the parties involved). The main consideration may turn out to be a matter of control, because from an organizational perspective, control over information has historically been with the organization that creates or maintains it. From a personal perspective, on the other hand, a person should have the wherewithal to control their identity and the release of information about themselves, and in the latter case, a precise determination of to whom it is released and for what reason.. Who owns the data? Is it the person about whom the data pertains? Is it the organization that prototypically manages the data? Or, is it the cloud provider that physically stores the data somewhere out in cyberspace? Consider your financial information. Is it your property or is it your bank's business property? We will try to provide a perspective on this important issue in the following sections. Privacy issues are not fundamentally caused by cloud computing, but they are exacerbated by employing the technology for economic benefit. To put it as diplomatically as possible, if a business employs cloud computing to save money on its IT bill, should it be allowed to do so at the "privacy" expense of its customers?

CLOUD COMPUTING CONCEPTS

Cloud computing is an architectural model for deploying and accessing computer facilities via the Internet. A cloud service provider would supply ubiquitous access through a web browser to software services executed in a cloud data center. The software would satisfy consumer and business needs. Because software availability plays a major role in cloud computing, the subject is often referred to as software-as-a-service (SaaS). Conceptually, there is nothing particularly special about a cloud data center, because it is a conventional web site that provides computing and storage facilities. The definitive aspect of a cloud data center is the level of sophistication of hardware and software needed to scale up to service a large number of customers. Cloud computing is a form of service provisioning where the service provider supplies the network access, security, application software, processing capability, and data storage from a data center and operates that center as a utility in order to supply on-demand self service, broad network access, resource pooling, rapid application acquisition, and measured service. The notion of measured service represents a "pay for what you use" metered model applied to differing forms of customer service.

Cloud Service Characteristics

The operational environment for cloud computing supports three categories of informational resources for achieving agility, availability, collaboration, and elasticity in the deployment and use of cloud services that include software, information, and cloud infrastructure. The software category includes system software, application software, infrastructure software, and accessibility software. The information category refers to large collections of data and the requisite database and management facilities needed for efficient and secure storage utilization. The category of cloud infrastructure is comprised of computer resources, network facilities, and the fabric for scalable consumer operations. We are going to adopt a description of a cloud framework that necessarily includes three forms of description: terminology, architectural requirements, and a reference model. The description generally adheres to the National Institute of Standards and Technology (NIST) cloud-computing paradigm. (Mell 2009b, Brunette 2009)

Agility generally refers to the ability to respond in a timely manner to market and product changes through business alignment, which is achieved by decreasing the lead time to deploy a new application...