The expanding cloud computing services offer great opportunities for consumers to find the best service and best pricing. Meanwhile, it also raises new challenges for consumers who need to select the best service out of such a huge pool since it will be time-consuming for consumers to collect the necessary information and analyze all service providers to make the decision. Therefore, in this paper, we propose a novel brokerage-based architecture in the cloud, where the cloud brokers is responsible for the service selection. We also design an efficient indexing structure, called B$^{cloud}$-tree, for managing the information of a large number of cloud service providers. We then develop the service selection algorithm that recommends most suitable cloud services to the cloud consumers. We carry out extensive experimental studies on real and synthetic cloud data, and demonstrate a significant performance improvement over previous approaches.

Cloud brokers have been recently introduced as an additional computational layer to facilitate cloud selection and service management tasks for cloud consumers. However, existing brokerage schemes on cloud service selection typically assume that brokers are completely trusted, and do not provide any guarantee over the correctness of the service recommendations. It is then possible for a compromised or dishonest broker to easily take advantage of the limited capabilities of the clients and provide incorrect or incomplete responses. To address this problem, we propose an innovative cloud service selection verification (CSSV) scheme and index structures (MMBcloud-tree) to enable cloud clients to detect misbehavior of the cloud brokers during the service selection process. We demonstrate correctness and efficiency of our approaches both theoretically and empirically.

With the increasing volume of images users share through social sites, maintaining privacy has become a major problem, as demonstrated by a recent wave of publicized incidents where users inadvertently shared personal information. In light of these incidents, the need of tools to help users control access to their shared content is apparent. Toward addressing this need, we propose an Adaptive Privacy Policy Prediction (A3P) system to help users compose privacy settings for their images. We examine the role of social context, image content, and metadata as possible indicators of users' privacy preferences. We propose a two-level framework which according to the user's available history on the site, determines the best available privacy policy for the user's images being uploaded. Our solution relies on an image classification framework for image categories which may be associated with similar policies, and on a policy prediction algorithm to automatically generate a policy for each newly uploaded image, also according to users' social features. Overtime, the generated policies will follow the evolution of users' privacy attitude. We provide the results of our extensive evaluation over 5,000 policies, which demonstrate the effectiveness of our system, with prediction accuracies over 90 percent.

The expanding Cloud computing services offer great opportunities for consumers to find the best service and best pricing, which however raises new challenges on how to select the best service out of the huge pool. It is time-consuming for consumers to collect the necessary information and analyze all service providers to make the decision. This is also a highly demanding task from a computational perspective, because the same computations may be conducted repeatedly by multiple consumers who have similar requirements. Therefore, in this paper, we propose a novel brokerage-based architecture in the Cloud, where the Cloud brokers is responsible for the service selection. In particular, we design a unique indexing technique for managing the information of a large number of Cloud service providers. We then develop efficient service selection algorithms that rank potential service providers and aggregate them if necessary. We prove the efficiency and effectiveness of our approach through an experimental study with the real and synthetic Cloud data.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that users' data are usually processed remotely in unknown machines that users do not own or operate. While enjoying the convenience brought by this new emerging technology, users' fears of losing control of their own data (particularly, financial and health data) can become a significant barrier to the wide adoption of cloud services. To address this problem, in this paper, we propose a novel highly decentralized information accountability framework to keep track of the actual usage of the users' data in the cloud. In particular, we propose an object-centered approach that enables enclosing our logging mechanism together with users' data and policies. We leverage the JAR programmable capabilities to both create a dynamic and traveling object, and to ensure that any access to users' data will trigger authentication and automated logging local to the JARs. To strengthen user's control, we also provide distributed auditing mechanisms. We provide extensive experimental studies that demonstrate the efficiency and effectiveness of the proposed approaches.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that users' data is usually processed remotely in unknown machines that users do not own or operate. While enjoying the convenience brought by this new emerging technology, users' fears of losing control of their own data(particularly financial and health data) can become a significant barrier to the wide adoption of cloud services. To address this problem, in this paper, we propose a novel highly decentralized information accountability framework to keep track of the actual usage of the users' data in the cloud. In particular, we leverage the programmable capability of Java JAR files to enclose our logging mechanism together with users' data and policies. Our approach ensures that any access to users' data will trigger authentication and automated logging local to the JARs. To strengthen user's control, we also provide distributed auditing mechanisms. Our experimental study demonstrates the efficiency and effectiveness of the proposed approaches.

Social networking sites are ingrained in the fabric of our day-to-day lives, with these sites being widely used to exchange personal information and content. Some forms of access control are provided by the sites themselves to protect the user-uploaded content. However, these types of control are

The increasingly sensitive nature of data shared over the Web calls for a new approach to cross-domain content protection. Towards addressing this need, in this paper we introduce a novel Java-based architecture for distributed content protection Java - based Distributed Content Protection (JUICE). JUiCE takes a policy-driven approach that strongly couples data and content protection policies. JUiCE constitutes an effective and practical solution for content protection for a number of reasons. First, both the CPPs and the protection mechanism travel with the content, which is stored in its original form. Second, users do not need to rely on any dedicated management system to specify and apply the CPPs. Further, CPPs do not require any additional cryptographic setup such as passwords or keys to be shared. Through evaluation, we show that our architecture is scalable while being robust against a range of attacks.

The adoption of XACML as the standard for specifying access control policies for various applications, especially web services is vastly increasing. This calls for high performance XACML policy evaluation engines. A policy evaluation engine can easily become a bottleneck when enforcing XACML policies with a large number of rules. In this paper we propose an adaptive approach for XACML policy optimization. We apply a clustering technique to policy sets based on the K-means algorithm. In addition to clustering we find that, since a policy set has a variable number of policies and a policy has a variable number of rules, their ordering is important for efficient execution. By clustering policy sets and reordering policies and rules in a policy set and policies respectively, we formulated and solved the optimal policy execution problem. The proposed clustering technique categorizes policies and rules within a policy set and policy respectively in respect to target subjects. When a request is received, it is redirected to applicable policies and rules that correspond to its subjects; hence, avoiding unnecessary evaluations from occurring. We also propose a usage based framework that computes access request statistics to dynamically optimize the ordering access control to policies within a policy set and rules within a policy. Reordering is applied to categorized policies and rules from our proposed clustering technique. To evaluate the performance of our framework, we conducted extensive experiments on XACML policies. We evaluated separately the improvement due to categorization and to reordering techniques, in order to assess the policy sets targeted by our techniques. The experimental results show that our approach is orders of magnitude more efficient than standard Sun PDP.

Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. While cloud computing is expanding rapidly and used by many individuals and organizations internationally, data protection issues in the cloud have not been carefully addressed at current stage. Users' fear of confidential data (particularly financial and health data) leakage and loss of privacy in the cloud may become a significant barrier to the wide adoption of cloud services. In this paper, we explore a newly emerging problem of information leakage caused by indexing in the cloud. We design a three-tier data protection architecture to accommodate various levels of privacy concerns by users. According to the architecture, we develop a novel portable data binding technique to ensure strong enforcement of users' privacy requirements at server side.

In this paper, we propose PriMa (Privacy Manager), a privacy protection mechanism which supports semi-automated generation of access rules for users' profile information. PriMa access rules are tailored by the users' privacy preferences for their profile data, the sensitivity of the data itself, and the objective risk of disclosing this data to other users. The resulting rules are simple, yet powerful specifications indicating the adequate level of protection for each user, and are dynamically adapted to the ever changing setting of the users' preferences and SN configuration.