VeriMetrix

The trend toward cloud computing shows no signs of slowing down. Nevertheless, many companies and government agencies are hesitant to entrust their data to external cloud providers. They are unsure whether their data is sufficiently protected there and therefore choose not to reduce their own IT costs.

The VeriMetrix project aimed to make cloud data security measurable. Potential users should be able to assess, compare, and verify whether cloud providers ensure data protection and data security and comply with compliance guidelines.

As part of the project, partners from academia, the legal sector, and industry developed new methods and tools to describe data protection requirements and the degree to which they are met in a cloud application. The concepts and techniques developed in the project form the basis for certified and compliant cloud services, thereby enabling new business models and markets.

VeriMetrix considered the entire lifecycle of cloud applications: from the collection and formulation of data protection requirements, the selection of a suitable cloud provider using verifiable criteria, the verification of compliance with data protection requirements during operation, to the deletion of data after the end of use.

Focus Areas of Fraunhofer SIT

As part of the VeriMetrix project, Fraunhofer SIT identified general data protection requirements for the use of cloud services. The identified requirements are mapped to a catalog of metrics to make them measurable and comparable. Furthermore, the project determines and tests how specific metrics can be technically measured and evaluated.

Part of the project is also to ensure that the collection and evaluation of the data itself is carried out in compliance with data protection regulations.

Funding

The project was funded by the Federal Ministry of Education and Research.