Certainly, there are legal questions that would pop up regarding cloud computing. Putting data into a public cloud would invite governments to scan it with national security concern. Here, cloud providers have responsibility to answer organizations of who’s looking into their data. Would encryption be the answer to this question?
It depends on the jurisdiction whether encryption is a viable solution, based on whether court orders can be used to force cooperation in decryption (e.g. UK), or whether the level of encryption has legal constraints in the first place (e.g. US).
Additionally, the hosting platform of the actual application is the key concern. Cloud-hosted applications are still running the software in a "public" sphere, where the memory space contains unencrypted data at runtime. Which would either necessitate cloud-based databases with application servers running in a private environment, or more comprehensive measures designed to deny access to and monitor the servers, virtually and physically.
This is also an attack vector favored by intruders aiming for cloud providers, like Amazon EC2 data centers. The purpose isn't to gain access to an individual system, it's to gain access to the virtualization layer that contains raw runtime data of all hosted services attached to it. Data can be secured at rest, but despite that if one were to breach said layer now, it would grant access to the servers of a litany of e.g. government services and credit card companies. More alarmingly it wouldn't just grant access to say an administrative terminal, but to the actual virtualized memory modules and network connections.
While this in itself isn't a legal issue but a security one, security considerations are a major legal constraint in the approval or deployment of public services where project requirements need to follow set standards, or private ones where legal risks are involved in handling customer data. (e.g. http://www.tomsguide.com/us/PSN-Hack-Lawsuit-Negligence-Breach-of-Contract-Privacy,news-11662.html)
It depends on the jurisdiction whether encryption is a viable solution, based on whether court orders can be used to force cooperation in decryption (e.g. UK), or whether the level of encryption has legal constraints in the first place (e.g. US).
Additionally, the hosting platform of the actual application is the key concern. Cloud-hosted applications are still running the software in a "public" sphere, where the memory space contains unencrypted data at runtime. Which would either necessitate cloud-based databases with application servers running in a private environment, or more comprehensive measures designed to deny access to and monitor the servers, virtually and physically.
This is also an attack vector favored by intruders aiming for cloud providers, like Amazon EC2 data centers. The purpose isn't to gain access to an individual system, it's to gain access to the virtualization layer that contains raw runtime data of all hosted services attached to it. Data can be secured at rest, but despite that if one were to breach said layer now, it would grant access to the servers of a litany of e.g. government services and credit card companies. More alarmingly it wouldn't just grant access to say an administrative terminal, but to the actual virtualized memory modules and network connections.
While this in itself isn't a legal issue but a security one, security considerations are a major legal constraint in the approval or deployment of public services where project requirements need to follow set standards, or private ones where legal risks are involved in handling customer data. (e.g. http://www.tomsguide.com/us/PSN-Hack-Lawsuit-Negligence-Breach-of-Contract-Privacy,news-11662.html)
I refer back to the original question: "Would encryption be the answer to this question?".
In pure data storage clouds, encryption can be part of the answer. But what about cloud scenarios where customers send virtual machines to the provider? These virtual machines may contain sensitive information. Encryption is no option in this scenario because the VM should be hosted (i.e. executed) on the cloud providers hypervisor/ site.
Solutions to this would be homomorphic encryption but this solution is not ready for use in practice yet.
Another solution is a technology just recently published: SGX and Haven: Shielding Applications from an Untrusted Cloud with Haven Andrew Baumann, Marcus Peinado, and Galen Hunt, in 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI '14), 6 October 2014
Still another solution - which is quite complex, because it is based on several technologies , is based on Trusted Computing technologies and Mandatory Access Control. This solution gives the customer assurance (security) that the provider can not access the virtual image easily.
We have build a system (including a running prototype) that allows the cloud customer to get a proof that a reference platform is running on the providers site. This proof is called "attestation". We used Trusted Computing technology for this "proof". Additionally we used trusted boot (also a TCG technology) which allows to measure all executed HW and SW components during startup of the provider's system. The measurement (=integrity) values can be sent in a secure way to the customer. We also implemented Mandatory access control to prevent the cloud providers administrator to change/manipulate the log files.
If you are interested in this, see my paper: "Retaining Control Over Private Virtual Machines Hosted by a Cloud Provider". you get the full text via research gate (see below)
Conference Paper Retaining Control Over Private Virtual Machines Hosted by a ...
Hi Almabruk,
from my personal experience, one of the most important legal questions, e.g. for companies in europe, is the question whether you are allowed to store personal related data (so everything that allows to identify a person) outside europe. This becomes especially interesting if you consider Cloud Computing scenarios with large providers like Amazon, in which you can not be 100% sure where exactly your data is located.
Of course there are already solutions for this (e.g. by restricting your buckets to remain in a european data center), but this is still a considerable issue. Here, cryptography would not help solving this problem.
Best,
Marc
No, encryption does not substitute for retaining control of your systems: encryption merely moves the vulnerability of your system around. There is good work (sited above) which discusses trust and attestation in a cloud context. It all depends on a root of trust, so your question merely becomes "how much government pressure does it take to compromise the trust-root?" I'm not claiming that Intel would be a push-over, but as a thought experiment, suppose the cloud infrastructure could be emulated sufficiently fast, but with the emulator leaking data from the (emulated) "trusted" infrastructure?
Some of the legal questions relate to all flavors of cloud computing, but are particularly germane to a public cloud architecture. The main question is that of data ownership in the event you wish to change providers for example, or your provider goes out of business. Other questions have to do with data and privacy rights and concerns, from both a legal and ethical standpoint.
While I do believe encryption is very important in the scenario you have outlined, I think there is one key factor that you have missed: Data location in the cloud. Due to the cloud's very nature - data put in the cloud could be stored anywhere. With various legal issues in various countries about data retention, trying to delete the data my be complicated. This is especially problematic in the legal profession where control and privacy of the data is paramount. Just something to think about.
Very Interesting point, Micheal. Does the cloud allow you to delete your data/information/records completely? Would it be an issue?
Dr. Mohamed,
That is a very good question. It would depend upon the country/locale or the service. For example (bad one I know), Facebook will allow you to "delete" your account, but they retain the information - I don't know for how long. I don't have my Facebook account anymore. If you are concerned about the data retention issue, my recommendation is to create a private cloud where you have full control over the contents and the deletion policy (aside from local laws that is).
>Due to the cloud's very nature - data put in the cloud could be stored anywhere
That is totally correct: migration of data or VMs within the cloud is easy - even migration from one country to another - and thus, a different "legal base" must be applied.
The problem for the cloud customer: he typically does not know the physical location of the data center where the data/ VM is hosted.
On the other side there are existing solutions to this "geofencing" problem. If you are interested in this: there is already a researchgate discussion on this issue based on the question: "Do you think that after the NSA scandal, the importance of the location of data centers has increased in cloud computing adoption?"
https://www.researchgate.net/post/Do_you_think_that_after_the_NSA_scandal_the_importance_of_the_location_of_data_centers_has_increased_in_cloud_computing_adoption
- Badges
- Science method