在云架构中跟踪数据流
Towards Tracking Data Flows in Cloud Architectures
摘要：
随着云服务在越来越多的应用程序中成为核心，它们处理和存储更多的个人和业务关键数据。与此同时，GDPR、欧盟电子隐私法规、PCI和即将出台的欧盟网络安全法案等隐私和合规法规提高了关键数据的安全处理和可追溯性。特别是，提供个人现有数据记录信息的要求以及按需删除这些记录的能力是隐私法规的核心。这些要求的共同点是，云提供商必须能够跟踪数据在不同服务之间流动，以确保数据永远不会移动到合法领域之外，并且始终知道属于特定个人或业务流程的记录的特定副本位于何处。然而，当前的云架构既不提供跨不同服务全面跟踪数据流的手段，也不提供对数据流实施策略的手段。在本文中，我们指出的缺陷，数据流跟踪功能的主要云提供商通过一组实际的实验。然后，我们从这些实验中概括出一个通用架构，旨在解决云范围内的数据流跟踪问题，并展示如何在基于Kubernetes的原型实现中构建它。
英文摘要：
As cloud services become central in an increasing number of applications, they process and store more personal and business-critical data. At the same time, privacy and compliance regulations such as GDPR, the EU ePrivacy regulation, PCI, and the upcoming EU Cybersecurity Act raise the bar for secure processing and traceability of critical data. Especially the demand to provide information about existing data records of an individual and the ability to delete them on demand is central in privacy regulations. Common to these requirements is that cloud providers must be able to track data as it flows across the different services to ensure that it never moves outside of the legitimate realm, and it is known at all times where a specific copy of a record that belongs to a specific individual or business process is located. However, current cloud architectures do neither provide the means to holistically track data flows across different services nor to enforce policies on data flows. In this paper, we point out the deficits in the data flow tracking functionalities of major cloud providers by means of a set of practical experiments. We then generalize from these experiments introducing a generic architecture that aims at solving the problem of cloud-wide data flow tracking and show how it can be built in a Kubernetes-based prototype implementation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
