Cloud Computing

Controlling Data in the Cloud: Outsourcing Computation without Outsourcing Control

Richard Chow, Philippe Golle, Markus Jakobsson, Elaine Shi, Jessica Staddon

PARC

Ryusuke Masuoka, Jesus Molina

Fujitsu Laboratories of America

{rchow,pgolle,mjakobss,eshi,staddon} @parc.com

{ryusuke.masuoka, jesus.molina} @us.fujitsu.com

regulatory reasons and to ease concern over the potential for data breaches. Because of today’s perceived lack of control, larger companies are testing the waters with smaller projects and less sensitive data. In short, the potential of the cloud is not being realized. When thinking about solutions to cloud computing’s adoption problem, it is important to realize that many of the issues are essentially old problems in a new setting, although they may be more acute. For example, corporate partnerships and offshore outsourcing involve similar trust and regulatory issues. Similarly, open source software enables IT departments to quickly build and deploy applications, but at the cost of control and governance. Finally, virtual machine attacks and Web service vulnerabilities existed long before cloud computing became fashionable. Indeed, this very overlap is reason for optimism; many of these “cloud problems” have long been studied and the foundations for solutions exist. In our vision, integrity of the cloud infrastructure is ensured through the use of Trusted Computing. In addition, we advocate the seamless extension of control from the enterprise into the cloud through the powerful combination of high-assurance remote server integrity, and cryptographic protocols supporting computation on ciphertext. With our approach, content is protected in a manner consistent with policies, whether in the enterprise or the cloud. Yet, because the protection mechanisms support computation, it is possible for all cloud participants to mutually benefit from the cloud data in a controlled manner. Hence, there are business intelligence advantages derived from...