The application scheme of dynamic data protection in SaaS based on DIFC

Abstract

Data security concerns are one of obstacles to adopt cloud computing on a large scale. Especially users cannot control the behavior of SaaS applications how to use their data in SaaS cloud. It is hard to verify whether the security protocols have been performed or not. In addition, the service model of single instance multi-tenant causes the threat of data leakage between tenants who share the same application instance. A universality dynamic data protection scheme in SaaS cloud services is proposed in the paper. This scheme focus on how to use decentralized information flow control (DIFC) model to prevent cloud programs revealing users' private data and stop the data leakage between tenants. A project application example is given, and its security is analyzed. The scheme has the advantage that the security policy can be set by the user independent. It can realize distributed authorization, and can be made of a small number of trusted codes to implement the strategy execution. This made the code monitoring easier.