Requirement-Oriented Privacy Protection Analysis Architecture in Cloud Computing

Transcription

1 Requrement-Orented Prvacy Protecton Analyss Archtecture n Cloud Changbo Ke 1, 2 *, Ruchuan Wang 1, 2, Fu Xao 1, 2, 4, and Zhqu Huang 3 1 School of Computer Sc. & Tech./School of Software, Nanjng Unv. of Posts and Telecom., Nanjng , Chna 2 Jangsu Hgh Tech. Research Key Laboratory for Wreless Sensor Networks, Nanjng, Jangsu, , Chna 3 College of computer Sc. and Tech., Nanjng Unv. of Aeronautcs and Astronautcs, Nanjng, Jangsu, Chna 4 Key Lab of Broadband Wreless Communcaton and Sensor Network Tech. (Nanjng Unversty of Posts and Telecom.), Mnstry of Educaton Jangsu Provnce, Nanjng, Jangsu, , Chna Emal: brobo.ke@njupt.edu.cn; wangrc@njupt.edu.cn, xaof@njupt.edu.cn; zhqhuang@nuaa.edu.cn Abstract As a new software paradgm, cloud computng provdes servces dynamcally accordng to user requrements. However, t s dffcult to control personal prvacy nformaton because of the openng, vrtualzaton, mult-tenancy and servce outsourcng characters. Therefore, how to protect user prvacy nformaton has become a research focus. In ths paper, we propose requrement-orented prvacy protecton theory analyss archtecture and mplementaton platform. Frstly, the theory analyss archtecture s depcted as layers, and we analyze the functon and key technologes of every layer. Secondly, we address the prvacy property descrpton method wth ontology and descrpton logc, and then analyze the theory modules of prvacy tems conflct checkng layer, prvacy polcy negotaton layer and prvacy agreement forenscs layer. Thrdly, accordng to theory archtecture, we desgn the mplementaton platform of requrement-orented prvacy protecton, and dscuss the functon and workflow. In the end, we conclude and pont out the future work. Index Terms Prvacy protecton, prvacy tems, prvacy polcy, prvacy property, cloud computng I. INTRODUCTION Cloud computng s a model for enablng convenent, on-demand network access to a shared pool of confgurable computng resources (e.g., networks, servers, storage, applcatons, and servces) that can be rapdly provsoned and released wth mnmal management effort or servce provder nteracton [1]. There are some characters, such as servce outsourcng, vrtualzaton, dstrbuton and mult-tenancy. These characters enhance the servce qualty and save the computng resources, for example, servce outsourcng enhances the servce capablty and specalzaton through servce composton [2]. However, the transparency of prvacy nformaton to the outsourcng servce provder, make users worry that prvacy data be llegally propagated and used. For Manuscrpt receved September 2, 2014; revsed January 30, Ths work s supported n part by the Natonal Scence Foundaton of Chna under grants (No , No , No ), Major Program of Jangsu Hgher Educaton Insttutons under grant No.14KJA520002, Sx Industres Talent Peaks Plan of Jangsu under grant No.2013-DZXX-014 and Jangsu Qnglan Project. Correspondng author emal: brobo.ke@njupt.edu.cn. do: /jcm example, Google was sued by some users n Amerca and was nvestgated by European Unon, because of ts new unfed prvacy polcy mplemented from Mar. 1st, Accordng to the analyss by Amerca Electronc Prvacy Informaton Center, Google new prvacy polces do not take nto account how to use prvacy data n the product, and to whom prvacy data be propagated accordng to user prvacy requrement, and may have conflcts wth local laws. Therefore, prvacy protecton n cloud computng has become research focus. Prvacy was proposed as the human rght n the begnnng [3]. In doman of software engneerng, prvacy protecton means the capablty of preventng ndvdual nformaton from beng collected, dsclosed and stored by others [4]. The Platform for Prvacy Preferences (P3P) [5] provdes a standard and machne-understandable prvacy polcy, whch matches wth user prvacy preference. Accordng to the matched results, user can select servces. However, the P3P lacks semantc nformaton and only apples to Web Ste, not supportng servce composton. Therefore, P3P does not apply to cloud computng, snce all enttles n cloud computng are servce or composte servce. Extensble Access Control Markup Language (XACML) 2.0 [6] [7] extends the prvacy polcy through profle and apples to the cloud servce. However, t hardly guarantees the composte servce satsfyng user prvacy requrement. Pearson, S et al. [8] [9] defned prvacy protecton n cloud computng as the capablty of user controllng Personal Senstve Informaton (PSI) not be collected, used, dsclosed and stored by cloud servce provder. They provded certan theoretcal gudance, but do not put forward specfc soluton method. In order to satsfy user prvacy requrement and protect user prvacy data n the busness process, we propose requrement-orented prvacy protecton analyss archtecture n cloud computng, and develop a prototype system and run a case to prove the feasblty and practcablty of the archtecture. The other parts of ths paper are structured as the follows: Secton 2 we ntroduce related works. Secton 3 we address descrpton of prvacy requrement. Secton 4 we depct prvacy protecton archtecture and analyss, ncludng prvacy tems conflct checkng, prvacy polcy 55

2 negotaton and prvacy agreement supervsng. Secton 5 we put forward prvacy protecton mplementaton platform. In the end, we conclude and pont out the future work n secton 6. II. RELATED WORKS We classfy the related works of prvacy protecton as computng process orented and data orented prvacy protecton. The former s classfed nto fve categores, whch are modelng and verfcaton of prvacy requrement, matchng and negotaton of prvacy polcy, dsclosure and rsk. In the mean tme, we compare them from contrbuton, appled computng paradgm, whether supportng servce composton and whether supportng semantc, and hghlght our work n the table. The prvacy polces are defned by dfferent users or servce provders, whch may cause varous understandng of the same words. The prvacy polces supportng semantc can mprove the matchng chance. Most of servces n cloud computng are composte servces. Therefore, whether supportng servce composton s very mportant. We specally compare related works from aspects of semantc and servce composton. In ths paper, we major dscuss the requrementorented prvacy protecton analyss archtecture n cloud computng. Our work apples to servce composton and contans semantc nformaton, whle most of other works do not. Detals showed as below Table I. TABLE. I: COMPARISON OF RELATED WORKS Methods Authors Contrbutons Modelng and Verfcaton Matchng Negotaton Dsclosure Rsk Analyss Archtecture Jajun Lu et al. [10] N. Guermouche, S et al. [11] Mokhtar K et al. [12] LnYuan Lu et al. [13] Changbo ke et al. [14] WEI Zhqang et al. [15] Changbo ke et al. [16] Tbahrt S et al. [17] ZHANG Yan et al. [18] Jan Kolter et al. [19] LnYuan Lu et al. [20] Verfcaton of Behavor-aware Prvacy Requrements n Web s Composton Prvacy-aware Web servce protocol replaceablty Verfcaton of Prvacy Tmed Propertes Mnmal prvacy authorzaton n web servces collaboraton Outsourcng Character Orented Prvacy Conflct Detecton Method n Cloud Prvacy-Protecton Polcy for Pervasve Supportng negotaton mechansm prvacy authorty method n cloud computng Prvacy-Enhanced Web Composton Paradgm Cloud Pervasve Cloud Support for Composton Support for Semantc Parsmonous Semantc Trust Negotaton N/A N/A Vsualzng Past Personal Data Dsclosures Analyss of the mnmal prvacy dsclosure T. Yu, Y et al. [21] Modelng and Measurng Prvacy Rsks Dan Svantesson et al. [22] Our work N/A: NOT APPLICABLE : SUPPORT : NOT SUPPORT Prvacy and consumer rsks n cloud computng Requrement-orented Prvacy Protecton Analyss Archtecture n Cloud Cloud Cloud N/A N/A *Answer: how to forenscs? Prvacy agreement audtng Prvacy agreement supervsng Prvacy agreement based on IFC Prvacy agreement supervsng based on DDL Forenscs Layer Prvacy agreement negotaton *Answer: what s accountablty bass? Consstency check of user requrement and servce provder polces Consstency check Consstency check Semantc asserton negotaton based on DL-PNL Ontology reason based on Tableau algorthm *Answer: how to accountablty? Negotaton Layer Checkng Layer provder prvacy polces User prvacy requrement Descrpton based on ontology and descrpton logc Descrpton Layer Fg. 1. Requrement-orented prvacy protecton archtecture 56

3 III. PRIVACY PROTECTION THEORY ANALYSIS ARCHITECTURE A. Prvacy Protecton Archtecture Requrement-orented prvacy protecton archtecture ncludes descrpton layer, checkng layer, negotaton layer and forenscs layer. Descrpton Layer: Prvacy requrement of user and servce provder s depcted wth ontology and descrpton logc, so that formal expresson have context semantc and machne-understandable. Ths layer s bass of other layers. Checkng Layer: Accordng to context semantc, check the consstency of both the prvacy requrement of user and prvacy polcy of servce provder respectvely. Then check the consstency between the prvacy requrement of user and prvacy polcy of servce provder, to gan the prvacy tems sequence. Negotaton Layer: To match correspondng prvacy polcy of prvacy tems wth prvacy negotaton language based on descrpton logc. Msmatched prvacy polcy wll be negotated wth prvacy asserton negotaton mechansm, to obtan the prvacy agreement that meet both user and servce provder. Forenscs Layer: To nstrument for cloud servce composton executon flow BPEL, and then verfy wth dynamc descrpton logc to supervse requrement. For prvacy requrement wth tme property, analyze and audt the supervsng log after BPEL s executed, n order to fnd the servce provders that volate the prvacy agreement, namely, to forensc the volatons. Detals as showed n Fg. 1. B. Descrpton of Prvacy Requrement Through analyzng the descrpton document of atom servce, whch jons n servce composng n cloud computng, negotaton engne obtans the user prvacy nformaton to be used or dsclosed from nput and precondton. In the mean tme, through analyzng user prvacy requrement, negotaton engne obtans the prvacy nformaton to be protected by user. Both obtaned prvacy nformaton are known as prvacy attrbutes. Under the framework of prvacy polcy negotaton, conflct detecton of prvacy attrbutes and exchange of prvacy dsclosure asserton between negotatng partes are automatcally done by respectve negotaton engne. Therefore, prvacy polcy asserton needs to be machneunderstandable, supportng context semantc reasonng. In ths paper, we take advantage of ontology and descrpton logc, to descrbe and reason the prvacy polcy at the bottom of the framework. Before elaborate the relatve theory of prvacy descrpton, we present an nstance that appled throughout the text. Instance: There are followng partcpants n ths nstance, Seller, Buyer, ES ( Composer), Bank, Shpper, Post offce. ES has the busness lcense ssued by Industral and Commercal Bureau, certfcated as legal E-commerce platform. ES can ssue reputaton certfcaton for those VIP sellers who have reputaton value over 600, or have credt over 6000 ssued by bank. Bank can ssue credt card certfcaton to both Seller and Buyer. One day, Tom wants to purchase some Furnture from servce provder corporaton S va cloud servce composer CSC. Tom has the followng prvacy requrements. Furnture Corporaton S needs better to be VIP seller. In transacton, only VIP seller can obtan Tom realname and phonenumber (Moble phone), whle non- VIP seller can only obtan Tom nckname or offcephonenumber. All phone number can only be provded to corporaton S and Shpper. Tom bank account can only be provded to Bank. Address and zp code can only be provded to Shpper. In certan perod after transacton s done, all partcpants have to delete all prvacy nformaton automatcally. Mantenance servce s provded through trackng number and phone number. Corporaton S especally requres gettng feedback about servce qualty through phone number and address, from those customers wth amount over $20,000. Consderng the above requrements, the pont s that whether Tom can successfully negotate wth S to obtan nteracton sequence, and then place an order or not. We obtan the relatonshp of prvacy attrbutes through mappng among knowledge ontology, and then descrbe t wth ontology tree. The ontology tree of prvacy attrbutes s showed n Fg. 2. Thng s root node, whch s super class of all prvacy attrbutes. Except the bottom layer, the relatonshp between all the other layers s subsumng, namely, relatonshp of class and subclass. For example, class name ncludes subclass realname and nckname. Only the bottom layer belongs to ts upper layer, for example, Country, Provnce and Cty belong to class Address. a b b a Thng Prvacy Item Prvacy Polcy Fg. 2. Ontology Descrpton of Prvacy Attrbutes Prvacy Attrbute Defnton 1 Prvacy Attrbute: We descrbe prvacy attrbute as 5-tuple, namely, PA S / PA U Issuer, Owner, Subject, PDA S / PDA U, Sgnature Issuer represents the mark of prvacy attrbute, to record the farther class and son class of a prvacy attrbute class. Owner represents partcpants of servce 57

4 composton and also the owner of prvacy attrbute. Subject represents name of the prvacy attrbute. PDA- S/PDA-U represents Prvacy Dsclosure Asserton of s or users. Sgnature s dgtal sgnature. Each prvacy attrbute corresponds to one concept n prvacy attrbute ontology. Subject can be descrbed as follows: Subject C( op : I, op : I, op : I... op : I ) C( dp : D, dp : D, dp : D... dp : D ) where C represents class of prvacy attrbute ontology, op and dp represents object property and dgtal property respectvely, belongng to class, satsfyng ( j) ( op op j ) ( dp dp j ), I represents nstance of prvacy attrbute ontology, and s one certan value or constant. Defnton 2 Delegaton of Authorty Statement DAS: DAS s part of prvacy dsclosure asserton, namely, DAS must be satsfed for each dsclosure of prvacy attrbute, to prove f servce partcpants have the authorty of prvacy attrbute or not. It can be expressed as below: DAS : serverconstr authorzer asserton Suppose authorzer = {offcal, servcecomp}, whereas offcal represents offcal organzaton, servcecomp represents servce composer, serverconstr represents the rules or law constrant on servce partcpants ssued by offcal organzaton or servce composer. For example, ES s e-commerce platform. DAS clarfed that servce partcpants must satsfy the asserton expresson. Vald DAS must nclude sgnature on the asserton by offcal organzaton or servce composer, and n the mean tme, the sgnature s ncluded n the prvacy attrbute. Example 1: The DAS ssued by ES s as follows. To be VIP user of ES, the user must have reputaton value over 600 or have credt over 6000 ssued by bank. It can be express as below: n VIP EBay credt 6000( ratng) Bank reputaton 600( value) ES Defnton 3 Prvacy Dsclosure Asserton PDA-S: Prvacy Dsclosure Asserton s a constrant asserton for certan servce partcpant to own certan prvacy attrbute, t can be expressed as below: PDA S subjconstr ownerconstr; n n n subjconstr C op : ow ow... op : ow ow ownerconstr DAS; C op : ow ( vt ) op : ow ( vt ) ; n n n Prvacy Dsclosure Asserton PDA-S s composed of two parts, namely, constrant on subject of prvacy attrbute subjconstr, and constrant on servce partcpant who own the prvacy attrbute ownerconstr. The former subjconstr manly set constrants on the ownershp of prvacy attrbute and valdty perod of usng the prvacy n n n D (1) attrbute by servce partcpants. C represents class of prvacy attrbute, specfyng that prvacy attrbute exchange can only be processed among correspondng class or subclass. op1: ow1... ow n, n whch op1 represents some nstance of class and ow... 1 ow n represents servce partcpants correspondng to the op : ow ow op : ow ow represents nstance. 1 1 n n 1 n all nstances of class that owned by certan servce partcpants. op1 : ow1 ( vt1 ) opn : own ( vt n) represents valdty tme for servce partcpants ownng the prvacy attrbute nstance. If data doman of vt s nteger, then ow s a 1-tuple predcate based on data doman of vt. Common predcate s a or a, n whch a s constant. The latter ownerconstr manly set constrants on servce partcpants who own prvacy attrbutes, ownerconstr DAS means that servce partcpants who own prvacy attrbutes must also meet DAS requrement. Example 2: Corporaton S plans to sell furnture va ES on nternet. The prvacy dsclosure asserton of user address ssued by ES s as follows: Supposng corporaton S s ES VIP seller. ES requres buyer address can only be dsclosed to shpper, and be deleted wthn 2 hours after goods delvered and deal s fnshed, we can express t as below, address : shpper address : 2hours ( valdtme) Seller : VIP ES Take formula (1) nto formula (2), we can obtan: 600( ) address : shpper address : 2 hours ( valdtme) credt 6000( ratng) Bank reputaton value ES Defnton 4 Prvacy Dscloser Strategy (PDS): PDS s an ordnal sequence of prvacy dscloser asserton, namely, PDS PDA S1 PDA S2 PDA S3 PDA Sn Defnton 5 Prvacy Dsclosure Asserton of User (PDA-U): Prvacy Dsclosure Asserton of User s a constrant asserton for certan servce provder to own certan prvacy attrbute, t can be expressed as below: PDA U subjconstr serverconstr; n n n subjconstr C op : ow ow op : ow ow C op1 ow1 vt1 opn own vt n serverconstr trustdegree; : ( ) : ( ) ; Prvacy Dsclosure Asserton PDA-U s composed of two parts, namely, constrant on subject of prvacy attrbute subjconstr, and constrant on servce provder who own the prvacy attrbute serverconstr. The expresson of subjconstr s the same as that n Defnton 3, whle serverconstr s determned by user trust degree on servce or servce provder. Trust degree can be expressed as trustdegree = {S, DAS, Re}, whereas S (2) (3) 58

5 Journal of Communcatons Vol. 10, No. 1, January 2015 represents Securty, to certfy the truth and ntegrty of data and trustworthy of QOS. DAS s delegaton authorty statement that owned by servce or servce provder. Re represents reputaton of servce or servce provder. DAS usually s ssued by offcal organzaton or servce composer to servce provder, for example, statng whether Seller s VIP, whether Shpper or Bank have busness lcense ssued by offcal organzaton or not. We assume all shpper and bank have busness lcense n ths paper. Defnton 6 Prvacy Preference PP: PP s an ordnal sequence of prvacy dscloser asserton. Namely, framework, as showed n Fg. 3. Pre-detecton Layer: The part wth slash background n Fg. 3 represents Prvacy Conflct Pre-detecton Layer. Ths part manly mplements three functons as follows: 1) User prvacy requrement s translated nto prvacy preference asserton { 1, 2, 3,, n } by user prvacy preference edtor (PPE). 2) User comment nformaton and Qos n servce descrpton document (SDD) are evaluated by trust degree calculator (TDC), so as to obtan the trust degree value for servces. 3) The nput and precondton n servce descrpton document s captured by Xpath, and nput and precondton s refned nto prvacy property. At last, the prvacy preference asserton, trust degree and prvacy property are saved nto prvacy conflct detecton knowledge base. PP PDA U1 (C1 (op1 )) PDA U 2 (C2 (op2 )) PDA U 3 (C3 (op3 )) PDA U n (Cn (opn )) C. Prvacy Items Conflct Checkng There are two layers for prvacy conflct detecton SDD Knowledge base Trust Degree PPE ABox{ 1, 2, TBox TDC n } Precondton Input Internet Cloud_ 1 PCR Requester Cloud_ 2 Pre-detecton Layer Detecton Layer Fg. 3. Framework of prvacy conflct detecton User Negotaton Engne Prvacy Preference (PP) Server Negotaton Engne Prvacy tems Prvacy Dsclosure Strategy (PDS) Polcy send Macthng Prvacy Dsclosure Asserton (PDA) feedback Delegaton of Authorty Statement (DAS) Prvacy Dsclosure Asserton (PDA) Requester s Composer Mappng Knowledge Doman Ontology Prvacy Attrbute Collecton (PAC) Fg. 4. Prvacy polcy negotaton framework Detecton Layer: The part wth grd background n Fg. 3 represents Prvacy Conflct Detecton Layer. Prvacy conflct detecton layer contans knowledge base and prvacy conflct reasoner (PCR), n whch knowledge base s made up of prvacy preference asserton, trust degree and prvacy property. In ths layer, prvacy conflct detecton for knowledge base s mplemented by prvacy conflct reasoner and the detecton result s returned to user. D. Prvacy Polcy Negotaton The framework of prvacy polcy negotaton has two layers, as showed n Fg.4. 1) Mappng layer, whch supports the mappng 59

6 between Prvacy Attrbute Collecton (PAC) and Knowledge Doman Ontology (KDO), so that the semantc relatonshp among prvacy attrbutes can be determned and prvacy attrbute ontology can be set up. Durng the perod of the prvacy polcy pre-negotaton, once conflcts are detected, negotaton engne can substtute the conflcted attrbute wth brother attrbute of ontology tree, whch s found by semantc relatonshp among prvacy attrbutes, and fnd the prvacy attrbute sequence that satsfyng user prvacy requrement. 2) Negotaton layer, whch has two perods, namely, pre-negotatng perod and Prvacy Dsclosure Asserton (PDA) exchange perod. Durng the perod of pre-negotaton, frstly, negotaton engne analyzes the user requrement document and servce nput and pre-condton provded by servce provder, respectvely, obtanng user Prvacy Preference (PP) and servce Prvacy Attrbute Collecton (PAC). Secondly, detects the conflct between PP and PAC, to dscover prvacy attrbute that not satsfyng user prvacy requrement. Thrdly, search engne substtutes the dscovered prvacy attrbute wth brother attrbute of ontology tree through callng the mappng layer. Durng the PDA exchange perod, exchange the correspondng PDA of servce prvacy attrbute and user prvacy requrement, and terate ths exchange process. Through ths process, PDA collecton that satsfyng both servce provder and user, namely, Prvacy Dsclosure Strategy (PDS) may be found. Then PDS s ncluded n Level Agreement (SLA). E. Prvacy Agreement Supervsng Prvacy agreement-orented supervsng framework can be expressed wth two layers, as showed n Fg.5. 1) Analyss layer: Statc analyze the BPEL process wth BPEL Analyss Engne before executon. Detaled analyss process as follows: at frst, we capture nvoke mark by usng Xpath, then nsert probe DAS as precondton of callng outsourcng servce. If precondton DAS s unsatsfed, then termnate BPEL process. If satsfed, then supervse the executon of outsourcng servce wth Supervsor, n whch each prvacy tem {subject: name} corresponds wth PDA n SLA. 2) Supervsng layer: Wth BPEL Executon Engne execute the BPEL process that have been analyzed and nstrumented, and n the mean tme save the supervson log nto Supervson Log Repostory. If precondton DAS s unsatsfed for an outsourcng servce, then termnate the process and substtute the outsourcng servce wth canddate by usng BPEL Analyss Engne. If one or more PDAs n SLA are volated, then punsh the outsourcng servce accordng to correspondng punshment rule n SLA and decrease the trust degree. Level Agreement BPEL Executon Engne Supervson Log 1. PDA1 2. PDA2 3. PDA3 n. PDAn Supervsng Layer BPEL Analyss Engne nvoke nvoke DAS supervsor DAS supervsor Analyss Layer Fg. 5. Prvacy agreement-orented supervsng framework Prvacy tems /Prvacy Polces 1 Prvacy Requrement Prvacy Agreements 1 OWL-S 4 BPEL *See secton B *Obtan prvacy tems and polcy ; *OWL-S formal descrpton ; prvacy Property Management Module * User prvacy requrement formal descrpton ; 2 Prvacy Items of users and provders 2 Prvacy Items Sequence 3 Prvacy polcy 3 Prvacy Agreements 4 Prvacy Agreements Prvacy Agreement Supervsng Module * See secton E Prvacy Items Conflct Checkng Module * See secton C Prvacy Polcy Matchng and Negotaton Module *See secton D 4 Supervsng logs Fg. 6. Prvacy protecton mplementaton platform 60

7 IV. PRIVACY PROTECTION IMPLEMENTATION PLATFORM Prvacy protecton mplementaton platform s made up of four modules, ncludng prvacy property management module, prvacy tems conflct checkng module, prvacy polcy matchng and negotaton module and prvacy agreement supervsng module. As showed n Fg. 6. Prvacy Property Management Module: Resolvng user prvacy requrement and servce descrpton document OWL-S, to obtan the prvacy property, namely prvacy tems and correspondng prvacy polcy asserton, and then descrbng them wth ontology and descrpton logc. Prvacy Items Conflct Checkng Module: Detectng the conflct of both user and servce provder prvacy tem, and then detectng the conflct between user and servce provder prvacy tem, namely check the consstency wth Tableau algorthm. Prvacy Polcy Matchng and Negotaton Module: Accordng to matchng rules, matchng module match the correspondng prvacy polces of prvacy tem between user and servce provder. If msmatch s trggered, matchng module wll nvoke the negotaton module to obtan the prvacy agreement satsfyng user and servce provder. Prvacy Agreement Supervsng Module: Frstly, wth dynamc descrpton logc we verfy whether outsourcng servce s authorzed to obtan the user prvacy attrbute, to prevent unauthorzed outsourcng servce from obtanng user prvacy nformaton. Secondly, we supervse authorzed outsourcng servce accordng to the prvacy agreement, to assure the prvacy agreement s kept. Executon flow of prvacy protecton mplementaton platform as follows: Step 1: Prvacy property management module obtan the user prvacy requrement and servce descrpton document from user and servce provder, and resolve them to get prvacy tems and prvacy polces. Then save them to prvacy tems/prvacy polces database. Step 2: Prvacy conflct checkng module gan the prvacy tems through prvacy property management module, check the consstency between user and servce provder prvacy tems. And save the prvacy tems sequence to prvacy tems/prvacy polces database. Step 3: prvacy property management module obtan correspondng prvacy polcy accordng to prvacy tems sequence. Prvacy polcy negotaton module matches the correspondng prvacy polcy of every prvacy tem. When msmatch s found, Negotaton module wll trgger negotaton mechansm to gan the prvacy agreements, and save them to prvacy agreement database. Step 4: When servce composer provde the servce for user, prvacy agreement supervsng module obtan the servce composton executon process BPEL, nstrument prvacy agreement asserton nto BPEL accordng to prvacy agreement and BPEL context semantc. So as to supervse the executon process, save the supervsng logs nto database. In ths paper, we develop a prototype system CloPP and run a case to verfy our method feasblty and practcablty. The prototype system s developed wth java; the graphc nterface s desgned wth MyEclpse Swng Matsse and the prvacy data s stored wth MySql. We buld prvacy conflct detecton ontology wth ontology edtng tool Protégé based on java language, whch s developed by Stanford Unversty. And then the knowledge base s reasoned wth reasoner Pellet to obtan the prvacy tems sequence. Pellet was developed by Mnd Swap lab n Unversty of Maryland. Pellet verson number used n ths experment s V The system negotates the correspondng prvacy polces of the prvacy tem to gan the prvacy agreement satsfyng user and servce provder. In the end, the BPEL s supervsed by prvacy agreement supervsng module, to dscover the servce provder volatng the prvacy agreement. Fg. 7. Operaton vew of the prototype system 61

8 Fg. 7. s operaton vew of prototype system. The user and servce partners are lsted on the fgure top-left. The cloud servces descrpton document and BPEL are lsted on the fgure bottom-left. The wndow of prvacy tems conflct detecton, prvacy agreement negotaton and supervsng are lsted on the fgure rght. Through analyze the prvacy requrement, servce descrpton document OWL-S and busness process executon language BPEL, we can gan the prvacy tem sequence, prvacy agreement and servce partners volatng prvacy agreement. V. CONCLUSIONS AND FUTURE WORK Ths paper proposes a requrement-orented prvacy protecton methods n cloud computng. Accordng to the analyss of prvacy protecton theory archtecture, we desgn the prvacy protecton mplementaton platform. Future works s to mplement the theory frame of every module. ACKNOWLEDGMENT Ths work s supported n part by the Natonal Scence Foundaton of Chna under grants (No , No , No ), Major Program of Jangsu Hgher Educaton Insttutons under grant No.14KJA520002, Sx Industres Talent Peaks Plan of Jangsu under grant No.2013-DZXX-014 and Jangsu Qnglan Project. REFERENCES [1] V. Rajaraman, Cloud computng, Resonance, vol.19, pp , March [2] M. Armbrust, A. Fox, R. Grffth, A. D. Joseph, R. H. Katz, A. Konwnsk, et al., Above the clouds: A berkeley vew of cloud computng, Unversty of Calforna, Berkeley, Tech. Rep. UCB-EECS , Feb [3] K. Bagha, Prvacy as a human rght: A socologcal theory, Socology, vol. 46, pp , [4] I. Goldberg, D. Wagner, and E. Brewer, Prvacy-enhancng technologes for the nternet, n Proc. 42nd IEEE Internatonal Computer Conf., New Jersey, 1997, pp [5] F. Xao, Z. Huang, Z. Cao, J. Hu, and L, Lu. Modelng costaware Web servces composton usng PTCCS, n Proc Internatonal Conf. on Web, New Jersey, 2009, pp [6] G. Yee and L. Korba, Prvacy polcy complance for Web servces, n Proc IEEE Internatonal Conf on Web s, New Jersey, 2004, pp [7] J. Zhang, C. K. Chang, L. J. Zhang, and P. C. K. Hung, Toward a servce-orented development through a case study, IEEE Transacton on Systems, Man, Cybernetcs, Part A, vol. 37, pp , [8] S. Pearson, Takng account of prvacy when desgnng cloud computng servces, HP Labs Techncal Report, HPL , London, HP Labs, [9] S. Pearson and A. Charlesworth, Accountablty as a way forward for prvacy protecton n the cloud, HP Labs Techncal Report, HPL , London, HP Labs, [10] J. J. Lu, Z. Q. Huang, and C. Ke, Verfcaton of behavor-aware prvacy requrements n web servces composton, Journal of Software, vol. 9, pp , [11] N. Guermouche, S. Benbernou, E. Coquery and M. S. Hacd, Prvacy-aware Web servce protocol replaceablty, n Proc. of the Internatonal Conf. on Web s, New Jersey, 2007, pp [12] K. Mokhtar, S. Benbernou, M. Hacd, E. Coquery, and F. Leymann, Verfcaton of prvacy tmed propertes n Web servce protocols, n Proc. IEEE nternatonal Conf. on s, New Jersey, 2008, pp [13] L. Y. Lu, H. B. Zhu, Z. Q. Huang, and D. Q. Xe, Mnmal prvacy authorzaton n web servces collaboraton, Computer Standards & Interfaces, vol. 33, pp , [14] C. Ke, Z. Q. Huang, W. W. L, Y. Sun, and F. X. Xao, outsourcng character orented prvacy conflct detecton method n cloud computng, Journal of Appled Mathematcs, vol. 2014, May [15] Z. Q. We, M. J. Kang, et al., Research on Prvacy-Protecton Polcy for Pervasve, Chnese Journal of Computers, vol. 33, pp , [16] C. Ke, Z. Q. Huang, and M. Tang, Supportng negotaton mechansm prvacy authorty method n cloud computng, Knowledge-Based Systems, vol. 51, pp , Oct [17] S. Tbahrt, C. Ghedra, B. Medjahed, and M. Mrssa, Prvacyenhanced web servce composton, IEEE Transactons on s, vol. 7, pp , June [18] Y. Zhang and D. G. Fen, Parsmonous semantc trust negotaton, Chnese Journal of Computers, vol. 32, pp , [19] J. Kolter, M. Netter, and G. Pernul, Vsualzng past personal data dsclosures, n Proc. 17th Int. Conf. on Avalablty, Relablty and Securty, New Jersey, 2010, pp [20] L. Y. Lu, H. B. Zhu, and Z. Q. Huang, Analyss of the mnmal prvacy dsclosure for web servces collaboratons wth role mechansms, Expert Syst. Appl, vol. 38, pp , [21] T. Yu, Y. Zhang, and K. J. Ln, Modelng and measurng prvacy rsks n QoS web servces, n Proc. 8th IEEE Internatonal Conf on E-Commerce Technology/3th IEEE Internatonal Conf on Enterprse, E-Commerce and E-s, New Jersey, 2006, pp. 4. [22] D. Svantesson and Roger, Clarke prvacy and consumer rsks n cloud computng, Computer Law and Securty Revew, vol. 26, pp , Changbo Ke was born n Shanx Provnce, Chna, n He receved the B.S. and M.S. degree from the Kunmng Unversty of Scence and Technology of Chna, Kunmng, n 2008 and 2010 respectvely, and receved the PH.D degree from the Nanjng Unversty of Aeronautcs and Astronautcs, Nanjng, n Now s lecturer of Nanjng Unversty of Posts and Telecommuncatons. Major research nterests nclude securty and prvacy of nformaton system, cloud computng and ontology-based software engneerng. Ruchuan Wang was born n Anhu Provnce, Chna. He researched on graphc processng at Unversty of Bremen and program desgn theory Ludwg Maxmlan Muenchen Untverstaet from 1984 to He s a professor and tutor of Ph.D. canddate n Nanjng Unversty of Posts and Telecommuncatons snce Major 62

9 research nterests nclude wreless sensor networks, nformaton securty. Fu Xao was born n Hunan Provnce, Chna, n He receved the B.S. degree and the Ph.D. degree from the Nanjng Unversty of Scence and Technology of Chna n 2002 and 2007 respectvely. Now he s professor of Nanjng Unversty of Posts and Telecommuncatons. Major research nterests nclude wreless sensor networks. Zhqu Huang was born n Jangsu Provnce, Chna, n He receved the B.S. degree and the M.S. degree from the Natonal Unversty of Defense Technology of Chna, receved the Ph.D. degree from Nanjng Unversty of Aeronautcs and Astronautcs of Chna. Now he s a professor and tutor of Ph.D. canddate n Nanjng Unversty of Aeronautcs and Astronautcs of Chna. Major research nterests nclude formal method, software engneerng, cloud computng. 63