From event to evidence: An approach for multi-tenant cloud services' accountability

Accountability provides effective means for data protection in the cloud. On the provider's side, it consists in accepting to take responsibility for the users' data protection and governance in light of explicit agreements between them. Accountability is guaranteed through multiple measures ranging from preventive controls, violation detection, and analysis to compensatory and rectification measures. All the mentioned measures rely on proof concepts using forensic evidences. On the other hand, one of the properties making cloud popular is the multi-tenancy which reduces services costs and maximize resource usage. Therefore, it is important for a forensic evidence to support multi-tenancy. For this purpose, we propose a model-based approach which provides a description of multi-tenant aware evidence. We also define an algorithm for the definition of evidences from recorded transactions (a.k.a., event logs) between tenants and multi-tenant services. Furthermore, we propose a middleware layer on which we apply our approach to evaluate, through different scenarios, its efficiency.