Bridging the Cloud Trust Gap: Using ORCON Policy to Manage Consumer Trust Between Different Clouds

摘要

If we send our data to the cloud, how do we know the cloud will not outsource our data to another cloud provider? We leverage the originator controlled access control policy (ORCON) which is originator focused and provides the opportunity to express consumer specific desires relating to our data in the cloud. We present a novel cloud trust policy framework which allows for the consumer to make more expressive choices regarding the handling of her data across distributed clouds using ORCON as a mechanism. We also identify a trust gap between a cloud consumer and the cloud. A cloud consumer (specifically first time user), who is provided with privacy and security guarantees and promised a level of service, must decide to take a leap of faith and trust the cloud. This 'trust gap' is a both short term and long term trust issue. We explore ways to bridge this gap. Finally, we identify a conflict-of-interest that exists within the cloud trust research space and explain how to mitigate it. This is achieved principally by moving attestation servers out of the cloud that it is supposed to be attesting to. This effectively creates Attestation as a Service (AaaS).