Complying with Data Handling Requirements in Cloud Storage Systems

TL;DR

This paper introduces PRADA, a practical layer for cloud storage systems that ensures compliance with data handling requirements, addressing a critical need driven by increasing data privacy legislation.

Contribution

PRADA provides a transparent, client-driven data handling layer for cloud storage systems, enabling compliance with regulatory, organizational, and contractual data requirements.

Findings

PRADA is effectively implemented on Cassandra.

Compliance with data handling is practical in real-world deployments.

PRADA supports various cloud use cases like IoT and email storage.

Abstract

In past years, cloud storage systems saw an enormous rise in usage. However, despite their popularity and importance as underlying infrastructure for more complex cloud services, today's cloud storage systems do not account for compliance with regulatory, organizational, or contractual data handling requirements by design. Since legislation increasingly responds to rising data protection and privacy concerns, complying with data handling requirements becomes a crucial property for cloud storage systems. We present PRADA, a practical approach to account for compliance with data handling requirements in key-value based cloud storage systems. To achieve this goal, PRADA introduces a transparent data handling layer, which empowers clients to request specific data handling requirements and enables operators of cloud storage systems to comply with them. We implement PRADA on top of the distributed database Cassandra and show in our evaluation that complying with data handling requirements in cloud storage systems is practical in real-world cloud deployments as used for microblogging, data sharing in the Internet of Things, and distributed email storage.