Foreword: Towards Trusted Cloud Ecosystems

Businesses are using Cloud, hosting and managed services to facilitate growth, not just cut costs. For business critical applications to move to the Cloud, however, significant challenges to widespread adoption still remain, mostly concerning security, assurance and compliance, notably data protection, control, availability and resilience. The UK government, for example, also created the G-Cloud Digital Market Place (previously CloudStore) that includes products and services that have been assessed and classified against standardized level of assurance and other sector specific requirements such as Public Services Network (PSN) connectivity. As cloud services mature, European providers such as Atos, BT and Telecom Italia start to differentiate their Cloud and IT services by specializing them to specific vertical market sectors. Trust, transparency and governance remain both significant challenges and opportunities for Cloud services. Those who manage to produce high-assurance Cloud services that allow businesses and consumers to have transparency and governance of their assets in the Cloud are more likely to attract Cloud-enabled business in the future. For Cloud business to flourish this has to be combined with vertical market sector specialization and policy harmonization, as is noted in the report "Trusted Cloud Europe: Have your Say" by the European Cloud Partnership (ECP) on Trusted Cloud. Harmonizing levels of service quality and assurance, compliance requirements, supply chain relationships and streamlining procurement and contract management underpins sector specific clouds that emerge in Government with Health and Finance following.

Another significant characteristic of the market evolution towards the Cloudenabled business of the future is the explosion of personal data and personal information in the Cloud. The amount of such data that is generated and collected on a daily basis is rapidly growing due to the increasing number of activities performed online especially following the commoditization of smart phones and tablets. The availability of such big data represents a novel opportunity for organizations and individuals to benefit from business intelligence and innovative services relating to an emerging "market of data". As is also recognized by EIT ICT Labs who have established a High Impact Initiative on Trusted Cloud, the enablement of an eco-system of trusted services and application that allows individuals to gain visibility and control of the exploitation of their data in the Cloud is another important to address.

The papers presented in this invited session of the IFIP Trust Management Conference present innovations that enable the realization of Trusted Cloud ecosystems for data, platforms, applications and services in vertical market sectors such as Government, Health, Finance, Retail and Consumer Services.

In the first paper, Ana Juan Ferrer examines the role of Service Level Agreements (SLAs) in building a Trusted Cloud for Europe by providing the mechanisms that allow both users and providers to establish a common understanding of the services to be provided and enforce guarantees around performance, transparency, conformance and data protection. It proposes a taxonomy of terms to support more tight and detailed SLA definitions that help improving reliability and transparency in the Cloud.

In the second paper, the STRATEGIC consortium present progress towards the vision of a Cloud store or a marketplace of Trusted Cloud applications, services and infrastructure that offer sufficient assurance for use in the public sector. The paper focuses on the "STRATEGIC Cloud Orchestrator"a key innovation that underpins the automation behind such market place of governmental servicesand explains how such innovations have been enabling local governments in Europe to use a Trusted Cloud in order to offer services to their citizens.

In the third paper, Joshua Daniel and Fadi El-Moussa focus on innovations that enable organizations to enforce homogeneous security, patching and application management policies across multiple Cloud environments and to analyze and remediate threats of cyber-attacks or data loss. Such innovations increase the confidence of organizations of all sizes in using the Cloud while enabling them to keep visibility and control of their assets and to limit their reliance on the Cloud providers offering such assurance guarantees in proprietary ways that cannot be easily inspected, validated or harmonized and controlled by the Cloud user. Embedding such innovations in platforms for Cloud application assembly, deployment and life-cycle management can potentially create a Trusted Cloud platform upon which future eco-systems of Trusted Cloud applications and services are built.

In the fourth paper, Pramod Pawar and Ali Sajjad explain how a federation of the European Future Internet experimental facilities has been used for validating, proving and analyzing Cloud-based security services at a large scale and over heterogeneous environments. Such experimentation results guide the evolution of Cloud-based services aiming at the protection of data and applications in the Cloud.

In the fifth paper, Michele Vescovi et al. focus on the complementary challenge of managing the exploitation of personal data and information in the Cloud. It examines the emerging market of personal data and presents innovations leading towards the development of an ecosystem of trusted applications, which offer individuals transparency and control on the exploitation of their data in the Cloud.

All these papers share a common vision of a Cloud-enabled market over a Trusted Cloud ecosystem. Freedom of choice prevails, stakeholders compete on differentiation on service delivery, businesses can use Cloud services to fulfil "concept-tomarket" processes without compromising assurance and compliance and while maintaining visibility and control of their applications, processes and data. In this vision, enterprises of all sizes can create high-assurance application and business services efficiently at lower costs and can manage complex supply networks from heterogeneous providers. Individuals benefit from the higher assurance and better transparency and control of how their data is exploited in the Cloud.

We hope you will enjoy the proceedings of IFIPTM 2015 and that you will find this invited session informative and useful for your ongoing and future research.

May 2015

Theo Dimitrakos Special Session Chair


Panagiotis Gouvas
email: pgouvas@gmail.com

Konstantinos Kalaboukas
email: kkalaboukas@singularlogic.eu

Giannis Ledakis
email: g.ledakis@gmail.com

Theo Dimitrakos
email: theo.dimitrakos@bt.com

Joshua Daniel
email: joshua.daniel@bt.com

Gery Ducatel
email: gery.ducatel@bt.com

Nuria Rodriguez Dominguez

A Cloud Orchestrator for Deploying Public Services on the Cloud -the Case of STRATEGIC Project

In recent times, public bodies are adopting IaaS solutions for deploying online governmental services. A sufficient number are adopting private cloud solutions while others hybrid or public offerings, making the necessity of a Cloud Orchestrator highly imperative. In this paper, the STRATEGIC Cloud Orchestrator is presented which targets deployment services in multi-cloud providers. The Cloud Orchestrator architecture and design have been developed using a purely top-down approach, driven by user requirements coming from the three different European Municipalities (London Borough of Camden-UK, Genoa-IT and Stari Grad-SR) that will adopt the STRATEGIC solution. Also, the summary of the user requirements, the technical approach and value proposition are being described.

Introduction

Cloud computing services (including public cloud services) hold the promise to deliver a host of benefits to both public sector organizations and enterprises, including reduced Capital Expenditure (CAPEX), improved performance and scalability, and enhanced reliability, as well as a reduced overall Total Cost of Ownership (TCO) for their ICT infrastructures and services. According to the European Union Agency for Network and Information Security (ENISA), public bodies can also benefit from the improvement of citizen interactions with government in respect of reducing information processing time, lowering the cost of government services and enhancing citizen data security [START_REF]Good Practice Guide for securely deploying Governmental Clouds[END_REF]. These benefits are particularly important for public bodies, especially for governmental agencies, municipalities and regions; the adoption of public cloud services as part of their numerous e-government interactions is expected to have a significant economic and social impact.

The main objective of STRATEGIC is to boost the adoption of public cloud services by the creation of a STRATEGIC Cloud Orchestrator. The STRATEGIC Cloud Orchestrator builds upon leading edge R&D results (Optimis Toolkit [START_REF]Optimis project consortium: Optimis project Website[END_REF], STORK [3] and Semiramis [START_REF]Semiramis project consortium: Semiramis Project Website[END_REF] projects), to provide tools and techniques for the interoperable migration and replication of public cloud services across different EU countries and their regions. It has the following principal features:

Cloud Enablement: Cloud enablement is the migration/porting of existing on-line distributed services to the Cloud. Replication: Replication and re-use of existing services, which have been already successfully deployed across EU countries and regions. This will result in localization and adaptation of the services to different legal, ethical and governance requirements.

Composition of new value-added services:

The ability to compose and integrate novel public cloud services based on other existing/legacy services could allow public administrations to streamline their processes thereby reducing overheads, alleviating bureaucracy and overall improve citizens' benefits and satisfaction [START_REF]STRATEGIC project consortium: Description of Work of "STRATEGIC: Service disTRibution network And Tools for intEroperable proGrammable, and UnIfied public Cloud services[END_REF].

The primary incentive for an organization/public body to adopt a Cloud Orchestrator is to increase automation. The need to orchestrate really becomes clear as when using cloud environments as the automation of storage, network, performance and provisioning are in most cases handled by miscellaneous solutions that have been added incrementally over time. Even for organizations that take a transformational approach, jumping to an advanced cloud to optimize their data centers, the management of heterogeneous environments with disparate systems can be a challenge not simply addressed by automation alone [START_REF]IBM Cloud Orchestrator[END_REF].

In this paper, a summary of the identified user requirements for a Cloud Orchestrator are provided, STRATEGIC Cloud Orchestrator is presented in terms of technical approach and value proposition offered. Furthermore, the pilot scenarios of the three different European Municipalities (London Borough of Camden-UK, Genoa-IT and Stari Grad-SR) that will evaluate the STRATEGIC Cloud Orchestrator are depicted.

STRATEGIC Cloud Orchestrator

1 Requirements Identification

The methodology for requirements identification comprised two main axes: a questionnaire supported by selected interviews to get input from a diverse set of stakeholders, including both cloud users and providers and analysis of pilot Municipalities applications' requirements. The requirements of the target communities were identified after analyzing a diverse set of public and private sector organizations. Public sector bodies covered included central government agencies, and municipalities and other regional or local governments, while the private sector bodies covered included cloud application developers, cloud solution providers, cloud services providers, cloud solution integrators, Independent Software Vendors (ISVs) and more. A total of 117 questionnaire responses were received and analysed [START_REF]STRATEGIC project consortium: D2. 1 Report on Stakeholders Requirements[END_REF].

Regarding users who want to adopt cloud services, the most important requirements that were considered as functional, identified from the questionnaire analyses are:

 Security and privacy.  High Availability  Interoperability, portability. In the same time the requirements of lowering costs and having good performance have been identified, but were considered non-functional.

In addition, specific technical requirements were raised after analyzing 11 applications that are operated by the three large European Municipalities within the STRATEGIC project. These will now be described. Common Application Packaging Format: This will be expressive enough to cover many aspects of the application lifecycle. The challenges here are many, since the notion of cloud enabling an application entails many difficulties. Applications may be monolithic, or multi-tier with several interdependencies between them. Furthermore, applications may have external dependencies at the service-level, at the OS-level or even at hardware-level. In addition, a proper application-packaging should take under consideration interoperability and "docking points" between packages. Beyond dependency-management, a packaging format should take under consideration the notion of application and configuration and application scalability. Configuration Management: This deals with post-installation configuration management and covers many issues such as the setup of encryption channels, the configuration of logging handlers, the installation and configuration of security management services etc. in a multi-cloud context. Interoperability at the hypervisor level: A critical requirement is the avoidance of vendor lock-in at the hypervisor level. Many mature hypervisors (KVM, ESXI etc) are already able to process VMs that comply to specific formats. However these hypervisors expose their functionality with different API; therefore any Orchestrator should be able to use an abstraction layer on-top of these diverse APIs. Interoperability on Monitoring: Additionally, a de-facto need of any orchestrator is for interoperability with monitoring platforms. Indeed, most of the core entities that are deployed in a Cloud Environment can be "patched" in order to expose performance measurements on many levels (application-level, VM-level). This exposed information can be used for anomaly detection, deployment optimization or even SLA enforcement.

STRATEGIC Cloud Orchestrator Architecture

Taking under consideration the requirements identified for the creation of the Cloud Orchestrator, a modular high-level architecture has been defined.

Fig. 1. STRATEGIC Cloud Orchestrator High Level architecture components

The Packaged-Applications Repository contains all applications that can be instantiated in an Infrastructure as a Service (IaaS) environment. The critical aspect regarding the repository is the formulation of an expressive enough applicationpackaging schema. This repository can be used as the basis of a STRATEGIC marketplace. A separate OS Virtual Machines (VM) Template Repository contains the available Operating Systems that can be instantiated by various IaaS environments.

The Credential Management Component is responsible for persistently storing the credentials of an end-user for each IaaS provider. The Application Instantiation Workflow coordinates the deployment of an Application to an IaaS provider. This implies the selection of the proper host-OS (based on the application packaging information), the target-IaaS and the initialization of the configuration-logic that is dependent to the application. The instantiation process combines user-oriented and system-imposed information that is required in order for a successful deployment to be performed.

One of the most crucial components is the Configuration Recipes Repository that contains the available configuration templates that can be applied after an Application instantiation. A configuration template is valuable only in the context of the adoption of a Configuration Management Framework. Therefore, although a Configuration Server is not an organic part of the Orchestrator, it constitutes a critical point since it assures that running instances maintain during runtime of a proper configuration.

Beyond that, the Configuration Framework acts as a single point of reference for any functionality that has to be horizontally integrated. Indicative functionalities that are subjected to horizontal integration are Monitoring and Security.

Finally, the Governance Component is responsible for interacting with several underlying IaaS providers to start, stop, pause or delete workloads. This has to rely on an abstraction layer between the Orchestrator and the various Hypervisors. Since the risk of vendor-lock-in is high, the exploitation of Open Cloud Computing Interface (OCCI) interfaces is imperative [START_REF] Rodriguez Dominguez | [END_REF]. OCCI is a set of specifications delivered through the Open Grid Forum for cloud computing service providers that provides is a boundary API that acts as a service front-end to an IaaS provider's internal infrastructure management framework [START_REF]The Open Cloud Computing Interface Website[END_REF].

STRATEGIC Workload Metadata Model

Workloads are a key concept and capability in the STRATEGIC Cloud Orchestrator, and are designed to make it possible to manage not just simple (single server) apps, but also much more complex multi-tier applications, as found in the enterprise or distributed applications consisting of many distinct server elements.

The STRATEGIC Workload Metadata Model has been created in order to capture the semantics of any possible workload. The metadata model has several sections. The first section covers basic details about the <Name>, <Version>, <License> and <Category> of the application. These elements of the schema are indexableinstances of the model will be aggregated in a central repository in order for a customer (public body) to be able to search and deploy them.

The next section is a group of <Informational> elements. These elements are used for guiding the end-user through installation and support actions. Moreover, the <SupportedOS> element is intended to capture the compatible OS that can be used for installation. Additionally, the <DeployMethod> element is used to identify the target Cloud of the installation.

One of the most crucial parts is the <ConfigurationParameters> section where the entire configuration layer of the application is exposed and initialized. In parallel, the <DeploymentDescriptor> is used to capture the Installation scripts that are required in order to perform the systemic installation.

Finally, the <ServerConfiguration> element is used to model the post-installation part. The Puppet Framework has been used in order to automate the DevOps tasks. Puppet uses <Recipes> as the basic notion of orchestration-bundle. The Workload Metadata Model contains placeholders for Recipes [START_REF][END_REF].

The XSD schema is provided in the following figure: Table 1 provides a summary of the application and the expected usage of the STRATEGIC cloud orchestrator for each scenario. The primary incentive for an organization/public body to adopt the STRATEGIC Cloud Orchestrator is to increase automation. The need to orchestrate really becomes clear when various aspects of cloud management are brought together. The value of adopting an orchestrator derives from the convergence of multiple hypervisors, the need for efficient resource usage, availability, scalability, performance and more. Through the STRATEGIC Marketplace, the pieces are woven together and can be managed more effectively to ensure smooth and rapid service delivery -and delivered in a user-friendly catalogue of services accessible through a single pane. In essence, STRATEGIC orchestration implies simultaneous speed of automation, ease of integration and clear adoption of best practices.

In addition to rapid service delivery, adoption of STRATEGIC Cloud Orchestrator and Marketplace can deliver significant cost savings by eliminating manual intervention and management of varied IT resources or services. Specific benefits include:

 Integration of cloud capabilities across heterogeneous environments and infrastructures to simplify, automate and optimize service deployment.  Self-service portal for selection of cloud services, including storage and networking, from a predefined menu of offerings.  Reduced need for intervention to allow lower ratio of administrators to physical and virtual servers.  Automated high-scale provisioning and de-provisioning of resources with policy-based tools to manage virtual machine sprawl by reclaiming resources automatically.  Ability to integrate workflows and approval chains across technology silos to improve collaboration and reduce delays.  Real-time monitoring of physical and virtual cloud resources, as well as usage and accounting chargeback capabilities to track and optimize system usage.  Pre-packaged automation templates and workflows for most common resource types to ease adoption of best practices and minimize transition time.  Ability to create cross-Authentication applications and share them in a reusable manner through an app-store. In short, many of the capabilities that we associate with cloud computing are in essence elements of orchestration. Using the STRATEGIC cloud orchestrator, public bodies can manage their cloud workloads through a single interface, providing greater efficiency, control and scalability. As cloud environments become more complex and organizations seek greater benefit from their computing resources, the need for sophisticated management solutions that can orchestrate across the entire environment will become ever clearer.

The rationale of this paper is to provide an overview of STATEGIC Cloud Orchestrator. For this reason a brief description of STRATEGIC project main goals and the identified requirements and desirable features of a Cloud Orchestrator are provided. For the conception of STRATEGIC Cloud Orchestrator, the high level architecture and component overview has been briefly described, along with the proposed Workload Metadata Model. Finally the pilot use cases overview and the value proposition of the STRATEGIC Cloud Orchestrator are provided.

Fig. 2 .

 2 Fig. 2. Workload Metadata Model

Table 1 .

 1 Usage of STRATEGIC cloud orchestrator from the applications of pilot use cases.

	Application Description	Usage of STRATEGIC cloud orchestrator	Involved Pilot
	Application for managing OpenData based on SharePoint.	Migration of existing SharePoint to Cloud with usage of STRATEGIC Cloud Orchestrator, publish on STRATEGIC Marketplace for reselling and deploy to	London Borough Camden	of
		selected IaaS
	Application for managing Citizen Blue-Badge information	Cloud Enable Application with usage of STRATEGIC Cloud Orchestrator, publish on STRATEGIC Marketplace for reselling and deploy to	London Borough Camden	of
		selected IaaS
	Application for managing user identity and their associated attributes in Camden.	Cloud Enable Application with usage of STRATEGIC Cloud Orchestrator and deploy to selected IaaS	London Borough Camden	of
	Service for business activities	STRATEGIC Cloud Orchestrator and deploy to Cloud Enable Application with usage of	City of Genoa
		selected IaaS
	Cross-border business activities, based authentication service for	STRATEGIC and deploy to selected IaaS Integrate Cross-Border features offered by	City of Genoa
	on Stork project
	Semiramis-based, cross-service for Cross-border border authentication	STRATEGIC and deploy to selected IaaS Integrate Cross-Border features offered by	City of Genoa
	issuance of resident
	certificate
	Application for managing OpenData	STRATEGIC Cloud Orchestrator, publish on Cloud Enable Application with usage of	City of Genoa
		STRATEGIC Marketplace for reselling and deploy to
		selected IaaS
	Certificate issuance service	Cloud Enable Application with usage of STRATEGIC Cloud Orchestrator, publish on	Municipality of Stari Grad
		STRATEGIC Marketplace for reselling and deploy to
		selected IaaS
	Semiramis-based, cross-border certificate issuance service	Integrate Cross-Border features offered by for reselling and deploy to selected IaaS STRATEGIC, publish on STRATEGIC Marketplace	Municipality of Stari Grad
	Mail server for Municipality of Stari Grad	Cloud Enable Application with usage of STRATEGIC Marketplace for reselling and deploy to STRATEGIC Cloud Orchestrator, publish on	Municipality of Stari Grad
		selected IaaS
	Application for managing OpenData	Configure an application that is already published in STRATEGIC Marketplace and deploy to selected	Municipality of Stari Grad
		IaaS

Acknowledgments

The work performed in this paper is funded by the Strategic CIP-PSP Project (http://www.strategic-project.eu).


Michele Vescovi
email: michele.vescovi@telecomitalia.it

Corrado Moiso
email: corrado.moiso@telecomitalia.it

Mattia Pasolli
email: mattia.pasolli@telecomitalia.it

Lorenzo Cordin
email: lorenzo.cordin@telecomitalia.it

Fabrizio Antonelli
email: fabrizio.antonelli@telecomitalia.it

Building an Eco-System of Trusted Services via user Control and Transparency on Personal Data

The amount of personal information that is generated and collected on a daily basis is rapidly growing due to the increasing number of activities performed online and, in particular, in mobility. The availability of such a huge amount of data represents an invaluable opportunity for organizations and individuals, respectively to enable precise business intelligence and innovative services. Nevertheless, it represents the commodity of a flourishing "market of data", mostly fostered by the biggest ICT companies, from whereof benefits users are almost excluded, significantly increasing the public concern on data privacy. In this scenario we developed a framework, based on a personal data store, enabling the development of an eco-system of trusted application, which allow users to full transparency and control on the exploitation of their data.

Introduction

The increasing adoption of smartphones and their capability of collecting personal and contextual information have generated a tremendous increment in the production of Personal Data (PD). The amount of PD that is available and generated on a daily basis is rapidly growing also due to the increasing number of activities performed online and, in particular, in mobility. Nowadays, a constantly increasing number of users access the internet mostly (or exclusively) by means of their smartphones/tablets; they use an innumerable variety of online/Web services, often through specifically designed mobile applications (shortly apps). Very often these apps, which possibly connect to external devices/sensors, are their self-generated source of novel types of PD that are transmitted and collected server-side.

The availability of such a huge amount of data (ranging from locations or interactions record, to the content produced by users, e.g. describing choices, preferences, etc.) represents an invaluable opportunity for organizations and individuals to enable new application scenarios and to benefit from innovative services. Nevertheless, they represent the commodity of a flourishing market mostly fostered by the biggest ICT companies. The collected data are exploited for internal business analytics or sold to drive third party business intelligence or advertisement.

However, it has also significantly increased the public concern on data privacy. In fact users have, in general, very scarce opportunities to control how their data are accessed and collected and to use them for their purposes. Some Operating System (OS), such as Android, informs users about the accessed resources at installation time but, mainly, such information is not user-friendly and users can either avoid installing the App or grant unrestricted access to all the required resources, without means to further control permissions or to audit the access to PD. Increasingly this phenomenon is widespread due to wide adoption of the so called social logins (i.e. the use of the credentials of a particular social network to log also into third party services) through which, third party service-providers can directly access the plethora of users' information collected through their use of social networks. This further sharpens the incongruity between the information consciously and transparently disclosed by users and the users' personal data concretely accessed by third parties. Nevertheless, the benefits of the usage of personal data are always more imbalanced between the users and, mainly, the world-wide biggest ICT companies. This is far from the desired scenarios in which PD enable and contribute to the generation of widespread socioeconomic benefits to the collectivity. In order to reach these benefits, we believe that we need a fair PD management, where individuals, empowered with control and awareness over their PD, are enabled to actively and knowingly participate (in)to a PD eco-system. We present the design of My Data Store, currently validated in a living-lab: a privacy preserving service that enables users to collect, control and exploit PD generated in mobility. We integrated My Data Store into an innovative framework which enables the development of trusted and transparent (in terms of access and use of PD) services and apps: a user can control and audit their behavior. In this way, it is possible to create an eco-system of PDbased trusted apps/services. The framework, acting as a broker, would also potentially allow users to gain direct economic benefit from the disclosure/exchange of their data.

The Context

We are experiencing a rapid change of paradigm in technology and in business, where data are becoming an essential resource for the design of new and better services and products. The amount of data available, generated and processed on a daily basis is so huge and rapidly increasing. "Big Data" has become the keyword around which innovation, competition, and productivity in ICT are orbiting, so as to create a new data-driven society. One of the most interesting classes of data is Personal Data (PD, i.e., any information relating to an identified or identifiable person): they are data about people, their behavior, their preferences, etc. When handled and interpreted such data can describe an individual's actions, behaviors and habits [START_REF] Dong | Modeling the Coevolution of Behaviors and Social Relationships using Mobile Phone Data[END_REF]. While so far most of the PD had been static (e.g. socio-demographic profiles), the smartphones, jointly with many other connected personal devices (e.g., environmental sensors, wristbands, etc.), have enabled the collection of highly dynamic PD, describing the behavior of people in the real life (e.g. locations, communication patterns, social interactions, apps usage, etc.). The exploitation of this data is a key element for enabling the design of novel personal services able to improve users' experience. These services, moreover, can generate novel types of PD, becoming also source, not only consumer, of PD that continuously enriches the user's "digital trace". Assuming it is possible to gather all these data from people, we have a perfect example of "Personal Big Data" with enormous potentials. The availability of such a huge amount of PD is an invaluable resource and opportunity for organizations and individuals to enable new applications and businesses. Organizations can leverage on these PD to have a deeper understanding of people's needs and behavior, either as single individuals or communities, and can provide tailored services. Accordingly, people (the actual data "owners") can benefit from the creation of novel personalized apps with an enhanced user-experience that help them measure/track and improve the quality of their life.

The current adopted models of managing PD often do not fully allow a controlled and effective exploitation of these opportunities; in addition, people are currently excluded from the life-cycle of their data, relegated to the role of PD producer with limited ability to control and to exploit them. PD are collected by several services in a fragmented (often redundant) way and then spread in the data centers of a multitude of organizations, which manage them according to the specific agreement signed by people. This results in several limitations: (i) it is not possible to have a holistic view of individuals, as their PD are collected and stored in several independent silos; (ii) there is a limited involvement of people, thus resulting in a scarce possibility for them to understand how their PD have been used; (iii) people cannot manage a copy of their PD, with great limitation on the possibility for them to fully exploit their PD.

In order to overcome the drawbacks of current "organization-centric" approach, a new user-centric model for PD management has been proposed [START_REF]World Economic Forum: Unlocking the Value of Personal Data: From Collection to Usage[END_REF], [START_REF] Pentland | Society's Nervous System: Building Effective Government, Energy, and Public Health Systems[END_REF]. In general these initiatives promote the possibility for people to have a greater control over the lifecycle of their PD (e.g., collection, storage, processing, sharing) and they recognize the crucial and active role played by a person into a righteous and fruitful PD ecosystem. As mentioned by [START_REF] Searls | The intention economy: when customers take charge[END_REF] a user-centric paradigm should complement and not replace the organization-centric one. A key aspect of the PD user-centric model is the right of the user to have copy of all their PD [START_REF] Pentland | Society's Nervous System: Building Effective Government, Energy, and Public Health Systems[END_REF]. While this is a first step this right does not necessarily create value for people, if not combined with tools for their PD management and for easily and dynamically control how PD must be accessed and exploited by the services. A Personal Data Store (PDS) platform [START_REF] Wang | A Survey on Personal Data Cloud The Scientific World Journal[END_REF], [START_REF] Moiso | How Do I Manage My Personal Data? -A Telco Perspective[END_REF] delivers a set of services enabling the owners of PD to collect, manage, track and control their data according to their wills and needs.

The Mobile Territorial Lab Experience

We designed and experimented My Data Store, a PDS platform able to manage heterogeneous PD, from those collected by apps and sensors on smartphones or on connected devices (e.g. environmental sensors, etc.), to those gathered from online services (such as social networks) or organizations in relation with their customers/users to whom they offer services (e.g. network operators, service/utility providers, retailers, etc.). We then devised an innovative framework for a trusted PD management built around the role of My Data Store, as far as any other PDS. Its architecture supports developers in building trusted and transparent apps compliant with a user-centric PD management model. Specifically, it provides users with a mobile UI allowing them to dynamically control and audit the accesses, collection and usages of PD by means of the compliant apps. In this way we aim at creating an ecosystem of trusted and transparent apps, feeding and exploiting the data stored in the PDS, pushing forward paradigms and common practices in PD management.

In cooperation with other partners, we are currently experimenting [START_REF] Vescovi | My data store: toward user awareness and control on personal data[END_REF] the usercentric PD paradigm within the "Mobile Territorial Lab" (MTL, www.mobileterritoriallab.eu), a long-term living lab where a real community (involving about 150 families) experiments this new paradigm in a real living environment: in fact the participants to MTL collect, manage and use their PD while they act in their real life, e.g., by interacting and performing digital activities through their smartphones, and by using ad-hoc designed apps exploiting their PD. The project and its objectives have been included in the World Economic Forum reports of the Rethinking Personal Data initiative (pg. 28 of [START_REF]World Economic Forum: Unlocking the Value of Personal Data: From Collection to Usage[END_REF]). Participants to MTL are provided with a smartphone empowered with a sensing SW continuously and passively collecting users' data in independent users' silos. The data automatically sensed consist of: i) call and SMS logs, ii) proximity data scanning for near-by devices, iii) locations from GPS and WiFi. Additional PD such as iv) mood and v) expenses done by the participants are collected through experience sampling methods by means of ad-hoc apps. MTL participants collect also vi) the air-quality in their surroundings (e.g. CO and other gasses levels) by geo-referencing the values measured by an environmental sensor connected to the smartphone. Each MTL participant is then provided with a private My Data Store account, through which they can access, visualize and transparently manage all the mentioned PD collected about them.

My Data Store

My Data Store offers a set of tools to manage, control and exploit PD by enhancing an individual's awareness on the value of their PD. The My Data Store development has been driven by principles emerging from existing studies on PD management, as in [START_REF] Mun | Personal Data Vaults: A Locus of Control for Personal Data Streams[END_REF], [START_REF] Shilton | Designing the Personal Data Stream: Enabling Participatory Privacy in Mobile Personal Sensing[END_REF]. In particular, the principles followed are:  Participant Primacy: users should be provided with appropriate functionalities that enable them to have complete control over the management of their PD. This includes a nuanced process of permission-granting ensuring that users can easily move through the collection and sharing settings and take clear actions over them (decide which data gather in their space, share/delete sub-sets of them, etc.);  Data Legibility: users should be supported in understanding the meaning and the potential of different kinds of data, as well as the risks and the consequences associated to PD usage (e.g. the data which can be inferred, also from aggregated or anonymous collection of data, when PD are shared with 3 rd parties);

 Long-term Engagement: it is necessary to provide users with technologies for controlling their data (collection, sharing, visualization, etc.) but it is equally important that the system and the process of collecting and managing PD is perceived to be relevant. Services and tools provided to users over their data and exploitation opportunities can help and enhance such engagement. While the above general principles inspire the design of any PDS service, the methodology followed during the design of My Data Store included a specific focusgroup study whose goal was to identify elements and guidelines relevant for users in a real setting, to be used as drivers. The results highlighted the following:  PD Awareness: participants did not really realize the extent of the PD impact on their life and initially struggled to understand the value of PD and thus the need of a technology to manage them. This raised the need of providing support for guiding the users in the discovery of the PD risks and opportunities to make them aware of the meaning, the value and potentials of their data (as in Data Legibility). One of the solutions adopted is the usage of visual elements that lower the barrier for non-skilled;  Personally Meaningful Data as Triggers: one goal in the focus groups was to identify the scenarios perceived as valuable by the users and that ensure the Long Term Engagement general principle. The scenarios emerged as more relevant to the users are those related to time or cost savings. The design of the system should hence consider personal values to enforce users' engagement with PD and thus must provide relevant and intuitive data management features. The increasing exploitation of PD contextually to the growth of an eco-system of services/apps built on top of PD further foster the effects of this driver;  Social Comparison of users with other users (single, similar or particular groups/communities of users): it can both work as a tool to improve awareness and to stimulate the user engagement.

My Data Store Services

My Data Store is a Web portal with a controlled access that makes available to the granted users a set of tools for managing their PD, collected from several sources. The design of My Data Store was driven by the principles described above. In particular, we focused on three drivers: empowering people with full control over the life-cycle of their PD, improving their awareness on the data and enabling the exploitation and use of PD in accordance to their needs and willingness. The design aimed also at simplifying the user experience by providing people a limited, but clear and powerful set of capabilities.

Data Regions

In order to increase users' awareness and their ability to control, the data collected in My Data Store are organized in Data Regions (DR). Under the principle of Data Legibility DRs are created by grouping in the same region different data sources w.r.t. their (i) perceptiveness, i.e. considering the information that can be inferred from the data, abstracting from technical details (e.g., both GPS and nearby WiFi AP, bring along the localization concept, etc.) (ii) sensibility to privacy, i.e. data with comparable levels of privacy-risks (e.g., data concerning interactions between individuals, such as calls, SMS, Bluetooth contacts, etc.). Every DR is associated with a brief description of the information brought by the PD and its list of data sources (Fig. 1). At this stage all the My Data Store's features operate in an uniform way w.r.t. the DR, but in future it will allow expert users to customize their settings w.r.t. the single sources or service/application generating data.

Main functions

My Data Store includes PD Management features to fulfill the Participant Primacy principle over the entire PD life-cycle (i.e., from the collection to the deletion of a data record). Its main functions are:  Collection Area: In the Collection Area users can choose how DRs are collected and stored (Fig. 1). Users then have a complete set of controls for tuning the settings the best fit with their privacy concerns, exploitation or usage wills (indeed, the PDS is associate to a collector application, running on the users' devices, which is the responsible of collecting and sending the information desired by users);  Sharing Area: Users can set the disclosure level of the collected data by granting those who can access them and the level of detail. So far the choice concern only the disclosure with the participants of our experimentation community, but further options will be considered in future providing finer granularity;  Deletion Area: users can delete single records or all PD collected in a specific DR and time interval. My Data Store makes use of visualization elements such as graphs, chart, etc. to show the data in the above areas at different levels of details/aggregation. First, this choice aims at increasing users' awareness on the value of their PD, in terms of perception on the data informative power and on the level of risks arising from PD disclosure and exploitation (Data Legibility principle). Second, being able in providing intuitive, interesting and representative visualizations play a crucial role for a Long-term Engagement of users and in stimulating users toward the exploitation and use of their PD (Data as Triggers), e.g. by sharing them for apps/services or social comparison. The types of visualizations provided by My Data Store are (Fig. 2): 1. Detailed "Auditing" Views in tables or maps, where every available piece of raw data for every data source is represented in detail; 2. Aggregated Individual Views with aggregations, at different levels, of the PD owned by a single person (e.g. charts, pies, clusters of frequent locations, distance travelled, quantity of contacts, etc.) which aims at increasing his/her consciousness on daily behavior); 3. Social Views built from the PD voluntarily shared (with different levels of details) by other users enabling a social comparison of a person's behavior (e.g., "How much am I social?", "How my spending pattern does compare with others' one?") with the ones of similar users (e.g. by gender, age). My Data Store differs from similar systems, such as [START_REF] Hong | An Architecture for Privacy Sensitive Ubiquitous Computing[END_REF], for the wide types of dynamically collected PD and for the flexibility and the user-friendliness of its Personal Data Management (PDM) features.

Toward an Eco-System of Trusted Personal Applications and "the Bank of Personal Data"

On top of the PDM features provided by My Data Store we designed a framework to manage applications (e.g., offered either as online services or as apps on devices) accessing PD in a trusted way. The goal is dual: 1. to provide users with a way to discriminate PD Trusted and Transparent Applications, i.e., those compliant with the user-centric approach, and to empower them with a clear description of the potential impact of each of such apps on PD (e.g. the generated/accessed PD, declared granularity/quality) and with tools to monitor/audit PD access at real time; 2. to provide apps developers with a workflow process and architecture enabling them to be compliant with the requirements of a trusted and transparent usercentric approach, easily interacting with solutions for PD collection and control, such as a PDS. To achieve the goal the applications that want to be compliant with the framework must define (and keep updated) a "Statement", which declares the list of PD types handled by the application and for each of them:  the quality and granularity of the data acquired or generated (type, accuracy, tolerance, etc.);  the terms by which these PD will be handled by the application (frequency, purposes, etc.); and distinguishing also among different usages:  Dynamically accessed (i.e. required instantly at run-time) by the application (e.g. accessing the current user location in order to provide location-aware hits when searching the Web);  Collected (i.e. stored for future uses into a repository such as the PDS);  Accessed "historically" (i.e. the requirements and usages of historic data accessed from the repository, e.g. for providing maps, charts, or inferences based on long-term analysis of user behaviors);  Shared (i.e. used and transmitted -possibly aggregated and/or anonymized-into applications which are not only personal but also shown or used, for any reason, to/by other users or third parties). Potentially the Statement could include further information "describing" the application capabilities that require each specific PD usage, i.e. those that could stop properly working on the chance that the user revokes the grant to perform that action on that particular data (so that the user can be properly informed).

Users are provided with a Mobile or Web UI (the Apps Area) allowing them to check the list of enabled (e.g., those installed on their devices) trusted applications (Fig. 3, left) and to control at any time (granting or denying usages) how they can access/use the different PD (Fig. 3, right) accordingly to their Statement.

The framework provides a set of APIs for the development of compliant trusted applications, thus for the run-time access, collection and historical usage of the user PD. These APIs could be provided either server-side by the PDS, or device-side as a layer on top of the device OS or directly ensured by it. These APIs guarantee that any access to the PD is performed (and thus contextually monitored and logged) in compliance with the application Statement and the user settings. Applications could be certified on the basis of their exclusive usage of "trusted and transparent" APIs. The framework middleware, thus, automatically carries out the retrieval and collection in/from the PDS of the PD for which the user requested/granted the collection (so that the user is empowered with full transparency on the accesses PD, exploiting the PDM features of the PDS, and further put into value/exploit the collected data) and the collection of the auditing information. Similarly (mobile-) browsers and Web applications could provide the same set of APIs enabling the collection and monitoring of other PD (e.g. browsing history, bookmarks, published content, etc.). On the basis of the auditing logs the framework can provide to the user reports on PD collection and usage, on services/applications behaviors and reports if a service/application behaves in line with its statement.

Interestingly our technology enables a very diverse variety of applications. One specific application scenario could concern the direct monetization of users' personal data, gaining personally an economic remuneration from the disclosure of their personal data. In this last scenario the PDS could play the role of the "Bank of the users Personal Data" [START_REF] Moiso | Towards a User-Centric Personal Data Ecosystem -The Role of the Bank of Individuals' Data[END_REF] where, not only the data of the user can flow and be stockpiled from different data sources, but also various exploitation opportunities can be proposed to the users as a data brokerage platform, on the basis of their choices/policies, with all the appropriate protections (e.g. anonymization and/or aggregations of data from large, selected user bases). The framework, in fact, allows for the complete auditing of data accesses and usages enabling, contextually, the automatic accounting and the dynamic user control on data exploitations.

Conclusions and Challenges

Introducing My Data Store we tried to push further user-centric Personal Data Management, extending the concept of Personal Data Store (PDS) so as to provide users with full control and awareness along the whole life-cycle of their PD from data collection, to data exploitation into added-value services and even data monetization.

In particular we focused our effort in letting the PDS be the core element of a novel framework enabling a new generation of personal apps and services. Our framework provides apps developers a way to access PD in a fully transparent way, consistently with the user choices, and aims at supporting users and developer in the process of PD collection (improving user awareness and widening the set of controlled exploitation opportunities) and in monitoring the apps/services real behavior. This framework could be included, e.g., as middleware of (mobile) platform or OS, while the PDS features could be provided as cloud services.

Even if it cannot prevent from misuses (e.g. illegal copies) of the PD to which the access has been granted and cannot prevent from the coexistence of "non-trusted and non-transparent" applications, our framework shows the way toward the provisioning of transparent, privacy-preserving applications. This solution will fully satisfy the user "right of copy", enabling them to benefit from data reuse, data fusion or monetization scenarios. The main challenges consist of creating the user demand (and thus developer and OS provider availability) towards this kind of applications and to let the PDS-like services become "the Bank of users' PD" [START_REF] Moiso | Towards a User-Centric Personal Data Ecosystem -The Role of the Bank of Individuals' Data[END_REF].

We believe that a change of paradigm in PD management and the construction of a fruitful eco-system of data producers and consumers pass only through such an enhanced transparency and the empowerment of individuals; in particular, individuals should have the possibility of controlling and exploiting their PD, consciously and actively participating in the eco-system, In this way, the value of PD is unlocked and transformed into business and societal value,

Fig. 1 .

 1 Fig. 1. Example of Collection Area (organized by Data Regions).

Fig. 2 .

 2 Fig. 2. Examples of Individual Views: (a) Expenses (auditing), (b) Locations (aggregated), (c) Mood (aggregated), (d) Expenses (social).

Fig. 3 .

 3 Fig. 3. Example Trusted Applications: app list (left); user settings for air-quality app (right).


Ana Juan Ferrer

Enric Pages
email: enric.pages@atos.net

Montanera

The role of SLAs in building a Trusted Cloud for Europe

Keywords: trust, cloud, sla

The European commission recognises Cloud potential to improve competitiveness by enabling transformation to better connected and efficient society. However, still trust and security concerns hamper its massive adoption, both in private and public sectors. Towards a establishing a Trusted Cloud Europe this paper stresses the role that Service Level Agreements (SLAs) play by providing the mechanisms that allow both users and providers to establish a common understanding on the services to be provided and enforce guarantees around performance, transparency, conformance and data protection. To this end, the paper explores trust stakeholders and factors per cloud layer in the Cloud computing environment; it analyses the role of SLAs and provides a taxonomy of terms to support more tight and detailed SLA definitions that support users' requirements in order to improve reliability and transparency in Cloud.

Introduction

Cloud Computing has reshaped the IT industry, and has the potential to change businesses and the economy by enabling higher IT efficiency and reliability. The European commission through the Steering Board of the European Cloud partnership [START_REF]Content and Technology: Establishing a Trusted Cloud Europe[END_REF] has recognised Cloud potential to boost growth, innovation and competitiveness in Europe [9] while enabling transformation to more connected and efficient society driving to benefits to citizens, business and public administrations alike. For this to happen it is fundamental that Cloud services become reliable, trustworthy and secure for all users. The more extensive use of Cloud computing technologies bring to the users concerns on its data security, privacy issues and legal concerns, especially for public Cloud adoption. These concerns, in many cases are associated to intrinsic factors the nature of the Cloud computing model, such as multi-tenancy. Service Level Agreements (SLAs) play a key role by being the mechanism that users have to enforce guarantees around performance, transparency, conformance and data protection. As cloud adoption increases, cloud users, from both private enterprises and the public sector, will be seeking more tightly defined SLAs as a mean to build up dependable and trustworthy relationship terms with cloud providers. This document first explores trust stakeholders and factors per cloud layer in the Cloud computing environment. Then, it analyses the role of SLAs. Finally it provides a taxonomy of terms to support more SLA detailed definitions [START_REF] Mell | The NIST Definition of Cloud Computing Recommendations of the National Institute of Standards and Technology[END_REF], applicable to both private and public sector, aiming to support the development for trustworthy Cloud for Europe.

Cloud Computing Trust Stakeholders and Factors

Cloud computing differs from traditional IT security scenarios by its multitenant nature. Multi-tenancy refers to the ability for multiple customers (tenants) to share applications and/or infrastructure resources. This characteristic is the factor that allows Cloud providers to efficiently manage resource utilization among several users in a shared environment; and therefore, it is the enabler for providers to achieve economies of scale and commercial benefits. However, it is the main source of concern for cloud users, if insufficient protection mechanisms are in place to guarantee security and privacy for both data and applications. In the trustful provision and consumption of Cloud services, there is a difficult balance among confronted actors interests: cloud service providers and cloud users, where none of them can provide an overall solution for the issue at a general level. Depending on the nature of the cloud service offering (IaaS, PaaS, SaaS) providers are not aware of the contents and security requirements for the applications, while users, in the current state of development of Cloud, do not have sufficient vision of the security mechanisms and controls in place at providers facilities neither for detecting security incidents or holes. The following sections analyse specific security and trust factors in each Cloud layer by providing details on the specific issues and relevant research.

Software as a Service(SaaS)

SaaS completely decouples application execution from the users IT infrastructure. In this model, all application services are solely accessed by the user by a Web browser or thin client over the internet. While enterprise data is stored into the SaaS providers infrastructure, which can be based on a PaaS or IaaS provider or in a traditional infrastructure provisioning model. SaaS, despite being the Cloud model in which users information is more exposed to Cloud providers threats, given the complete loss of control from the user, is the lesser explored at security research levels, accounting for only a few references addressing concretely this topic [START_REF]Software Progress, SaaS Security and privacy Whitepaper[END_REF][START_REF] Somorovsky | All Your Clouds are Belong to us Security Analysis of Cloud Management Interfaces[END_REF]. This can be motivated by the fact that SaaS applications are commonly delivered in the form of web applications for which security issues are a well-known and deeply analysed problem.

Platform as a Service (PaaS)

Nowadays, there is a truly diverse array of capabilities being offered as PaaS offerings. A PaaS cloud provides a container platform where users deploy and run their components. Diversities are present in supported programming tools (languages, frameworks, runtime environments and databases), in the various types of underlying infrastructure, and even on capabilities available for each PaaS. Taking the example of Google App Engine, Googles PaaS platform, it provides an execution environment where applications run on a virtualised technology foundation that scales automatically on demand. Google App Engine is often criticized for not providing transparency to the user to control infrastructure and how this infrastructure is used. Developers do not have direct control over resource allocation, because the underlying system and hardware resources are masked by the App Engine layer. Other existing PaaS platforms, such as Cloud Foundry automatize the application deployment to a set of template VMs, with complete and isolated platform stack. Vulnerabilities of these types of PaaS are the same than in IaaS environments.

Infrastructure as a Service (IaaS)

IaaS is by far the most analysed Cloud layer with regards security and data protection. In order to produce a systematic view on the question four different issues will be analysed separately: Security of Cloud APIs, VM repositories security and network issues. It has to be noted that security concerns on virtualisation technologies, are intentionally not further elaborated but in the context of public cloud IaaS implications.

-Security of API and interfaces: Cloud APIs or Cloud control interfaces are the means that the Cloud providers offer to manage VM images in an IaaS environment. They provide the capacities to add VMs, to modify them, as well as to manage their life-cycle (start, stop and resume). [START_REF] Somorovsky | All Your Clouds are Belong to us Security Analysis of Cloud Management Interfaces[END_REF] analyses the security of these interfaces in a public Cloud environment, Amazon EC2, and a private Cloud management system, Eucalyptus. In it, two different classes of attacks XML Signature wrapping attacks and XSS attacks on browser front ends are demonstrated. It is important to notice that vulnerabilities in this aspect expose important security breaches of providers, given that the attacker get access to all virtual infrastructure of the user, and therefore its data. -Security of VM repositories: Public VM repositories are a useful mechanism that both private cloud and public cloud providers can offer in order to simplify to users the task of creating their own VM images from scratch. Regardless of the usefulness of the mechanism, research demonstrates it can be a source of security risks both for the publisher or the image, the consumer and even the provider in which an instance of this VM is executed [START_REF] Wei | Managing security of virtual machine images in a cloud environment[END_REF] in their work identify that the publisher can release sensitive information inadvertently. From both the receiver and the provider result is that they get VMs that contain malicious or illegal content. [START_REF] Balduzzi | A security analysis of amazons elastic compute cloud service on Applied Computing[END_REF] have performed an exhaustive analysis over a period of 5 months for all virtual images publicly available in the Europe, Asia, US East, and US West Amazon datacenters. In total 8.448 Linux images and 1202 Windows images were available. Of those available 5.303 images were analysed. The result of this analysis presented images containing software with critical vulnerabilities and leftover credentials. -Secure Networking of VMs: Once again, the main source of concern about networking in public clouds is multi-tenancy. VMs from different customers may reside in the same physical network through which data traffic generated by VMs is transported. In order to overcome this issue techniques as network virtualization, through VLAN or other logical network segmentation are applied, so it segregates and isolates traffic among different user groups or subnets. However, some authors claim that these techniques were designed for the context of an enterprise, and therefore not securely applicable in the context of a public cloud due to limitations in the scale e.g. firewall policies ability to support load, or susceptibility to large scale DDoS attacks [START_REF] Popa | CloudPolice: taking access control out of the network[END_REF].

Users needs and requirements

Common concerns with regards cloud adoption; compliance, security, privacy and integrity, rely on the inability for users to measure, monitor and control activities and operations in Clouds third party platform or infrastructure. This is commonly understood as providers lack of transparency. Improving transparency of Cloud services increases uptake of cloud, and this is beneficial for everyone: users and providers. A few concrete examples will help explain how benefits can be made by a dialogue between the different points of view to establish SLA model terms:

Benefits for Cloud Users:

-Provide mechanisms and a framework through which organizations make informed decisions when selecting a provider, using criteria such as: service availability, performance, monitoring, data privacy conditions, or penalties in case of SLA non-fulfillment. -Compare Cloud Service levels with on-premise service levels (features and prices are easier to compare). -Make informed decisions about Hybrid Cloud in the mix between public and private clouds. -Easier ability for public sector to agree on EU-wide service expectations.

Benefits for Cloud Providers:

-Allow providers to make clear statements of differentiation by offering different levels of service at different prices.

-Open new avenues for innovative business models such as cloud brokerage and cloud aggregation. -Make clear statements of differing cloud services from best effort to minimum commitment

In addition, for providers, the benefits anticipated by the development of detailed SLAs are twofold: First, by more concretely describing their services they can extend their usage levels thereby incrementing their customer base and profitability (enabled by economies of scale); Second, it can drive to richer Cloud scenarios by facilitating the development of Bursting, Brokerage or any type of multi-cloud scenarios. In these scenarios Cloud providers do not offer Cloud services themselves, but they rely on a more complex cloud ecosystem, enabling Cloud providers to offer better and more advanced services at a reduced price. At all levels of its Stack (IaaS, PaaS, SaaS), the requirement of establishing adequate SLAs is to assure that both applications and infrastructure meet the promised performance and reliability benchmarks. This requirement is needed by any type of adopter, being applicable both for public sector and in general by any business environment or particular user.

-Allow providers to make clear statements of differentiation by offering different levels of service at different prices. -Open new avenues for innovative business models such as cloud brokerage and cloud aggregation. -Make clear statements of differing cloud services from best effort to minimum commitment 4 Service Level Agreements (SLAs)

SLAs specify cloud service provider and cloud service user consensus in the services to be provided. From a legal perspective, SLAs are a binding contract among users and providers. Analysis of current SLAs offered by public Cloud providers performed in the context of the Cloud Legal project from Queen Mary School of Law Legal Studies [START_REF] Bradshaw | Contracts for Clouds: Comparison and Analysis of the Terms and Conditions of Cloud Computing Services, Queen Mary School of Law Legal Studies Research Paper[END_REF] show clear limitations. It demostrates that many Cloud providers include elements in their Terms and Conditions asserting wide-ranging disclaimers of liability or of any warranty that the service will operate as described. In addition this research also found out that SLAs will often be couched in such terms as to exclude the majority of causes of a Cloud service outage, and will provide remedies only in the form of credits against future service. An additional remark done in the context of the OPTIMIS European research project [START_REF]Cloud legal guidelines final report[END_REF] refers to the lack of clarity on how the layers of contract take into consideration the data subjects interests and rights where personal data are processed due to the complexity of cloud architectures and functions. SLA terms must be defined in a way that all parties have the same understanding of what is being provided therefore, it is clear that the need for a consistent definitions will only become more important as time goes on.

The following sections elaborate on SLA terms' taxonomy that aims to provide definitions relevant for the EU public and private sectors, based on common outsourcing practices that are applicable also to Cloud services cases. These are structured according to three main categories: Access, Dependability and Security:

Access

Availability of service

It is commonly understood as the degree of uptime for the service.

The ITIL [START_REF]ITIL Availability Management: Beyond the Framework[END_REF] model provides the following definitions:

-A system is available when the customer receives the service stated in the SLA. The measurement and reporting of availability has to be based on a common understanding between the service provider and the service consumer.

-The degree of availability of a component or service is often expressed as the percentage of time for which the service is available. These figures can be determined in terms of downtime over a fixed period. -Common formulas to calculate availability include:

• Availability % =Actual Availability/Agreed Availability * 100

• Actual Availability = Size of measurement interval Downtime • Downtime =Time to repair or Service restoration time detection time ENISA [START_REF]Procure Secure, A guide to monitoring of security service levels in cloud contracts[END_REF] makes important remarks to be taken into account:

-SLA should clearly define when a service is considered available -An SLA may define a recovery time objective (RTO), which is measured against mean recovery time (MRT) -SLA may define MTBF (mean time between failures), which can be useful in the case where long periods of uninterrupted operation are critical Problem Resolution / Incident Response:

Using ITIL Terminology [START_REF]ITIL Availability Management: Beyond the Framework[END_REF]:

-An incident is defined as an event which is not part of the standard operation of a service and which causes or may cause disruption to or a reduction in the quality of services and customer productivity. -A problem is a condition often identified as a result of multiple incidents that exhibit common symptoms. Problems can also be identified from a single significant incident, indicative of a single error, for which the cause is unknown, but for which the impact is significant. The primary objectives of Problem Management are to prevent Incidents from happening and to minimize the Impact of Incidents that cannot be prevented.

According to ENISA [START_REF]Procure Secure, A guide to monitoring of security service levels in cloud contracts[END_REF], the service level of a providers detection and response to incidents is often defined by means of:

-Severity: It has to be based in a well-defined scheme.

-Time to respond (from notification/alerting): the time to implement a remedial response.

Reporting and Quality of Service monitoring

Reporting refers to make available information in order to provide an overview of service performance and its operational status.

ENISA [START_REF]Procure Secure, A guide to monitoring of security service levels in cloud contracts[END_REF] provides the following classification of parameters:

- -Data life-cycle management: It includes aspects such as: back-up test frequency and results, restoration speed, success or failure of operational backups, data recovery points, percentage of response to requests for data export successfully completed, data loss prevention system logs and system test results, data durability. -Technical compliance and vulnerability management, such as: Information on patches and controls in place vs open vulnerabilities, information on compensating controls applied, data on specific vulnerabilities and trends, such as their classification and severity scores. -Change management. Among others it may include: change notice time, change triggers, loss of certification status, changes or extension of jurisdictions in which data processing occurs, patches and major system changes, significant changes in security controls and processes used, time to implement security-critical customer change requests.

For the identified parameters, their reporting, based on the time-criticality of the information, can be provided based on three categories:

-Real-time service level data/feeds, including service level dashboards.

-Regular service level reports.

-Incident reports raised by the provider.

Data Portability

This refers to the users ability to create, copy and/or perform transmissions of data among cloud providers or between users facilities and a cloud provider.

Several initiatives and projects are working on developing and identifying common standards or frameworks for cloud solutions to increase the data and application interoperability between different cloud providers, such as the European Telecomunications Standards Institute (ETSI). Current lack of data interoperability standards, leads to significant effort for the customers to port data among providers in a usable format to avoid vendor lock-in. usable format to avoid vendor lock-in. Article 18 of the draft Data Protection Regulation [13] specifically addresses this issue, by granting data subjects the right of data portability. So that, e.g. to transfer data from one electronic processing system to and into another, without being prevented from doing so by the controller. As a precondition and in order to further improve access of individuals to their personal data, it provides the right to obtain from the controller those data in a structured and commonly used electronic format. It is expected that this characteristic takes on a relevant role in cloud adoption in the future.

The following parameters are proposed as part of the SLA:

-Data Format: Specification on structured and commonly used electronic formats available for the users to get its data from the provider.

-Data availability: Mechanisms in with data is made available, potentially including the specification of transport protocols and the specification of APIs, or any other mean, for the user to effectively get its data from the cloud provider. -Data Sanitation Period: Transition at the end/termination of service: Period in which the data will be available in a usable format when the services are no longer needed or the service has terminated for any reason. -Data Retention and Deletion clauses: Retention period for the provider to keep the data for the user, the period in which the provider is obligated to delete all personal data (including backups, Virtual Machine (VM) images, etc.) after service termination.

Dependability

Trust parameters reference parameters that allow determining the providers trust.

Auditability

Auditability refers to the ability of an organization, or defined systems or processes of the organization, to be evaluated on how the cloud computing service provider addresses the control frameworks of the specification.

A right to audit clause in a cloud SLA gives customers the ability to audit the cloud provider, which supports traceability and transparency. The goal of such an audit is to provide cloud service providers with a way to make their performance and security data voluntarily available. Using Audit specifications could provide a standard way to present and share information about performance and security needed by users to evaluate the service. Standardized information, in addition, could make comparison among providers easier. Three different types of audit and assurance information can be provided by cloud providers to its users and reflected in SLA terms:

-Third-Party Attestations, Reports and Certifications: Reports and certifications produced by third-party auditors which attest to the design and operating effectiveness of the cloud provider environment such as: HIPAA, SOC 1/SSAE 16/ISAE 3402, SOC 2, SOC 3, PCI DSS, ISO 27001, CSA STAR. -Documentation on procedures, standards, politics as well as configuration information, such as information about standard configurations and documentation for the current configuration of the users systems.

-Continuous logging and monitoring information. See Reporting and Quality of Service monitoring.

Certification and Compliance

Compliance refers to the act of fulfilling the requirements of a regulation.

Cloud providers privacy compliance is a major area of concern. Diverse initiatives are emerging in order to provide independent certification by reputable third parties so to provide a credible means for cloud providers to demonstrate their compliance with data protection principles. Besides, these initiatives could establish an assurance level to potential cloud users to evaluate providers level of privacy compliance. Among others, the following initiatives are highlighted:

-Safe Habor certification [START_REF]Safe Habor Regulation[END_REF], as created under the EU-US Safe Harbor Programme refers to US companies aim to process personal data from the EU. It evaluates compliance with the Data Protection Directive. The certification is renewed annually, and failure to renew this certification implies that the provider directly loses Safe Harbor benefits. -Cloud Security Alliance (CSA) Privacy Level Agreement [15] (PLAs), aim to define an extension to SLAs for privacy, in which the Cloud provider will clearly declare the level of privacy and data protection that it maintains with regards to relevant data processing. A Privacy Level Agreement (PLA) has a double aim: first, act as a tool for cloud users to assess a cloud providers commitment to address personal data protection and secondly, to offer contractual protection against possible damages due to lack of compliance by the provider with privacy and data protection regulation. The PLA Working Group recently published a PLA outline for the sale of cloud services in the EU that is based on the EU and the OECD privacy principles, and aims to provide a common structure for PLA worldwide. -European Privacy Seal (EuroPriSe) [16], this certification is offered to manufacturers and vendors of IT products and IT-based services. The certification process is required of the evaluation of the product or service by legal and IT experts, as well as, the validation of the evaluation report by an independent certification body established at the Office of the Data Protection Commissioner of Schleswig-Holstein in Kiel, Germany.

The SLA could include terms to reflect compliance with data protection principles available, similarly to Third-Party Attestations, Reports and Certifications section with regards to Auditability.

Limitations

Limitations define the scope and restrictions of the provided service. Commonly it also defines providers liability terms.

These could include:

-Warranties and excluded warranties -Disclaimer -Liability

Penalties

SLA penalties define what will happen in the case that a provider fails to deliver the agreed service.

According to Web Services Agreement Specification (WS-Agreement), Penalties terms when present in a SLA express the penalty to be assessed for not meeting a business level objective. WS-Agreement specification [17] defines a language and a protocol for advertising the capabilities of service providers and creating agreements based on providers offers, and for monitoring agreement compliance at runtime. Violation of guarantee terms during an assessment window can incur certain penalties. The penalty assessment is measured in a specified unit and defined by a value expression, which can be assessed from service monitoring information. The WS-Agreement defines term language and SLA templates to express this parameter. Multiple research initiatives such as SLA@SOI, CLOUD4SOA, OPTIMIS, and others have assessed its applicability to Cloud environments [START_REF] Benno | Legal Restraints and Security Requirements on Personal Data and Their Technical Implementation in Clouds Workshop for E-contracting for Clouds[END_REF].

Security

Security refers to parameters related to safety and protection mechanisms for cloud users.

Data privacy conditions

As reported by OPTIMIS European Research project [START_REF]Cloud legal guidelines final report[END_REF], the Data Protection Directive makes clear that one of the main aims is the protection of fundamental rights and freedoms and in particular the right to privacy with respect to the processing of personal data. In addition, the Directive shall ensure the free flow of personal data between Member States. The Directive deals with the processing of personal data. Personal data is defined as any information relating to an identified or identifiable natural person. As opposed to anonymous data, personal data is any information relating to persons who can be identified with reasonable effort. Although encrypted by technical means, this data is still considered personal. Anonymous data is data where the data subject can only be identified with an unreasonable amount of costs, capacities and time. This directive applies to the processing of personal data, going in detail through the terms:

processing means any operation or set of operations which is performed upon personal data. addressee of the Data Protection Directive is the controller, this is the body which determines the purposes and means of the processing.

Whether data protection law is applicable depends on the establishment of the controller and the processor.

European Data Protection Directive is rather fragmented with regard to data security measures to be implemented by controllers and processors and the level of harmonization among different EU countries, where often technical and organizational data security measures are low. However, a minimum security requirements for cloud computing can be extracted. All measures mentioned aim to ensure confidentiality, integrity, authenticity and availability of the data. Destruction: Personal data must be protected against accidental or unlawful destruction to ensure integrity and availability as well as business continuity.

-Loss: The Data Protection Directive aims to protect the logical and physical availability of personal data by requiring the Member States to implement security measures against unplanned events (natural disasters, hardware failures). -Alteration: Protection of personal data against alteration aims to ensure the authenticity and integrity of the data processed. -Disclosure: One of the cornerstones of data protection is confidentiality of personal data. Therefore, the Data Protection Directive requires controllers and processors to protect personal data against disclosure. -Access: Access to personal data must be controlled by specific security measures in order to maintain the confidentiality of personal data. Finally, data must be protected against all other unlawful forms of processing. This vague legal term aims to promote the use of privacy enhancing technologies when planning an information system designed to process personal data. -State of the art: Security measures have to consider the state of the art.

-Appropriate measures: Security measures must be appropriate with regard to the anticipated risks inherent in the data processing, as well as with regard to the nature of data and the costs of their implementation

Based on this it is proposed to include the following terms in the SLA, using the terms provided by OPTIMIS project [19]:

-Data Protection Level:

• None: when data is not sensitive, and it can be transferred without restriction. • DPA: Data can only be moved to countries that have a sufficient level of protection. It specifies whether the data included in the service under consideration is sensitive or not. -Data Encryption Level: Defines data encryption algorithm to be applied (AES, Twofish, ). -Data Breach Notification: In addition, based on the proposal for a new data protection regulation and the obligation to notify data breach, SLA parameters to consider this are also included. -Eligible Country List / Non Eligible Country List: Specific allowed and not allowed countries to host the data.

Security Provisions including backup and disaster recovery

ENISA [START_REF]Procure Secure, A guide to monitoring of security service levels in cloud contracts[END_REF] refers to these set of parameters as Data lifecycle management. It considers the group of parameters that measure the efficiency and effectiveness of the providers data handling practices (data export, data loss prevention and services back-up). Based on this SLA terms proposed under this category are the following:

-Back-up test frequency and results availability.

-Restoration speed: the time taken to obtain data from back-up from the time of request. -Frequency of operational back-ups.

-Data durability: some providers specify a durability parameter which relates to the amount of data which can be lost in a time period.

Conclusions

SLA terms and taxonomy presented in this document aim to improve reliability and transparency in Cloud usage for all kinds of organizations. However, as remarked in the European Cloud Strategy [START_REF]Unleashing the Potential of Cloud Computing in Europe[END_REF], the public sector has a strong role to play in shaping the cloud computing market. As the EU's largest buyer of IT services, it can set stringent requirements for features, performance, security, interoperability and data portability and compliance with technical requirements.

Early cloud computing deployments for governmental agencies have demonstrated tangible benefits for both the public administration and the citizens.

A very significant example in Europe is UKs G-Cloud Cloud store. This Government eMarketplace enables departments and organisations across the UK public sector to easily access centrally negotiated deals. At the time of writing this paper, it is on its sixth iteration, G-Cloud 6, with numerous accredited suppliers offering a high variety of services [START_REF]G-Cloud raises the ceiling again for government IT procurement[END_REF] to public-sector buyers. Among them, the percentage of SMEs is remarkable. Ovum research reports that the majority if contracts so far have focused on consultancy with Agile and Cloud enablement [22], and it is increasingly becoming the procurement mechanism of choice.

Generic benefits gained from adoption of cloud computing in Government, such as economies of scale, reduced maintenance costs, and the ability to leverage elastic and reliable computing infrastructures, have the potential to provide improved services in terms of reliability, availability, cost-efficiency and security.

In order to make reality of this potential, SLAs are a key tool, as they can provide transparency, assurance and therefore trust in European companies. Welldefined SLAs can offer fair and transparent conditions for Cloud service trading in Europe.

-

  Availability of service -Problem Resolution / Incident Response -Reporting and Quality of Service -Data Portability Dependability -Auditability -Certification and Compliance -Limitations -Penalties Security -Data privacy conditions -Security Provisions including backup and disaster recovery 4.1 Access Access parameters refer to service characteristics details.

  Service availability: Based on services' definition of availability. Examples of means to monitor this parameter are the following: relying on users, relying on providers' logs, by executing service health-checks, relying on providers' monitoring tools.-Incident response: Examples of incident data to be provided include: time of first reporting incident discovery time, incident resolution time, incident severity, and affected assets. -Service elasticity and load tolerance: the main aspect to monitor is the ability of the service to securely provision required resources when they are needed.

	It is proposed to verify it by means of regular testing. Depending on the
	nature of the provided service it can include: Number of CPU cores, CPU
	Speed, Memory size, VM quantity, VM storage, VM storage throughput,
	Bandwidth, Application response capacity.