Qompliance: Declarative Data-Centric Policy Compliance on SQL-based Data Movements
D.A.J. Oudejans (TU Delft - Electrical Engineering, Mathematics and Computer Science)
Jan S. Rellermeyer – Mentor (TU Delft - Data-Intensive Systems)
Johan Pouwelse – Graduation committee member (TU Delft - Data-Intensive Systems)
A Katsifodimos – Graduation committee member (TU Delft - Web Information Systems)
Anton Zorin – Graduation committee member (IBM Research)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
Data compliance is essential for ensuring that organizations do not run afoul of data protection and privacy legislation. Geographically distributed data is an especially relevant topic because of recent developments in cross-border data protection agreements between the United States and the European Union. We introduce Qompliance, a novel system for automated data-centric compliance evaluation in cloud environments. This approach fills a gap in the research for higher-level data-centric compliance systems with a particular focus on geographically distributed data. Its declarative and extensible policy model allows for defining policies that can govern data movements across borders and is intended to be understandable without explicit knowledge of the governed data by employing a tag-based abstraction layer. The particular challenge is to automate data-centric policy compliance on data movements in a maintainable manner. Qompliance analyzes SQL-defined data movements to extract what data is being addressed and combines this information with additional attributes to match policies in a static manner. Policies can decide whether data movements are allowed and specify requirements on the query and the execution that should be enforced. We provide a qualitative comparison between our approach and related work, and we performed a performance analysis that shows that compliance evaluation can be done in seconds for large sets of policies.