{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,19]],"date-time":"2026-02-19T13:57:16Z","timestamp":1771509436003,"version":"3.50.1"},"reference-count":35,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2023,6,8]],"date-time":"2023-06-08T00:00:00Z","timestamp":1686182400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Distrib. Ledger Technol."],"published-print":{"date-parts":[[2023,6,30]]},"abstract":"<jats:p>The recognition of capabilities supplied by cloud systems is presently growing. Collecting or sharing healthcare data and sensitive information especially during the Covid-19 pandemic has motivated organizations and enterprises to leverage the upsides coming from cloud-based applications. However, the privacy of electronic data in such applications remains a significant challenge for cloud vendors to adapt their solutions with existing privacy legislation standards such as general data protection regulation (GDPR). This article first proposes a formal model and verification for data usage requests of providers in a cloud composite service using a model checking tool. A cloud pharmacy scenario is presented to illustrate the connectivity of providers in the composite service and the stream of their requests for both collection and movement of patient data. A set of verifications is then undertaken over the pharmacy service in accordance with three significant GDPR obligations, namely user consent, data access, and data transfer. Following that, the article designs and implements a cloud container virtualization based on the verified formal model realizing GDPR requirements. The container makes use of some enforcement smart contracts to only proceed with the providers\u2019 requests that are compliant with GDPR. Finally, several experiments are provided to investigate the performance of our approach in terms of time, memory, and cost.<\/jats:p>","DOI":"10.1145\/3585538","type":"journal-article","created":{"date-parts":[[2023,2,27]],"date-time":"2023-02-27T12:03:22Z","timestamp":1677499402000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["Compliance Checking of Cloud Providers: Design and Implementation"],"prefix":"10.1145","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7829-2240","authenticated-orcid":false,"given":"Masoud","family":"Barati","sequence":"first","affiliation":[{"name":"Carleton University, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2418-9314","authenticated-orcid":false,"given":"Kwabena","family":"Adu-Duodu","sequence":"additional","affiliation":[{"name":"Newcastle University, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3597-2646","authenticated-orcid":false,"given":"Omer","family":"Rana","sequence":"additional","affiliation":[{"name":"Cardiff University, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2870-8938","authenticated-orcid":false,"given":"Gagangeet Singh","family":"Aujla","sequence":"additional","affiliation":[{"name":"Durham University, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6610-1328","authenticated-orcid":false,"given":"Rajiv","family":"Ranjan","sequence":"additional","affiliation":[{"name":"Newcastle University, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,6,8]]},"reference":[{"key":"e_1_3_2_1_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.robot.2019.06.003"},{"key":"e_1_3_2_2_2","volume-title":"48th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W\u201918)","author":"Nuno A.","unstructured":"A. Nuno , L. Balby , F. Figueiredo , N. Lourenco , W. Meira , and W. Santos . 2018. Fairness and transparency of machine learning for trustworthy cloud services . In 48th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W\u201918) . 188\u2013193. A. Nuno, L. Balby, F. Figueiredo, N. Lourenco, W. Meira, and W. Santos. 2018. Fairness and transparency of machine learning for trustworthy cloud services. In 48th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W\u201918). 188\u2013193."},{"key":"e_1_3_2_3_2","volume-title":"IEEE World Congress on Services (SERVICES\u201918)","author":"Elluri L.","unstructured":"L. Elluri and K. P. Joshi . 2018. A knowledge representation of cloud data controls for EU GDPR compliance . In IEEE World Congress on Services (SERVICES\u201918) . 45\u201346. L. Elluri and K. P. Joshi. 2018. A knowledge representation of cloud data controls for EU GDPR compliance. In IEEE World Congress on Services (SERVICES\u201918). 45\u201346."},{"key":"e_1_3_2_4_2","volume-title":"Proc. of the 8th International Conference on Information, Intelligence, Systems & Applications.","author":"Virvou M.","unstructured":"M. Virvou and E. Mougiakou . 2017. Based on GDPR privacy in UML: Case of e-learning program . In Proc. of the 8th International Conference on Information, Intelligence, Systems & Applications. M. Virvou and E. Mougiakou. 2017. Based on GDPR privacy in UML: Case of e-learning program. In Proc. of the 8th International Conference on Information, Intelligence, Systems & Applications."},{"key":"e_1_3_2_5_2","volume-title":"IEEE International Smart Cities Conference (ISC2\u201916)","author":"Ducato R.","year":"2016","unstructured":"R. Ducato . 2016 . Cloud computing for s-health and the data protection challenge: Getting ready for the General Data Protection Regulation . In IEEE International Smart Cities Conference (ISC2\u201916) . 1\u20134. R. Ducato. 2016. Cloud computing for s-health and the data protection challenge: Getting ready for the General Data Protection Regulation. In IEEE International Smart Cities Conference (ISC2\u201916). 1\u20134."},{"key":"e_1_3_2_6_2","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1109\/MCC.2018.064181121","article-title":"2018. Cloud computing and the new EU general data protection regulation","volume":"5","author":"Russo B.","year":"2018","unstructured":"B. Russo , L. Valle , G. Bonzagni , D. Locatello , M. Pancaldi , and D. Tosi . 2018. Cloud computing and the new EU general data protection regulation . IEEE Cloud Computing 5 , 6 ( 2018 ), 58\u201368. B. Russo, L. Valle, G. Bonzagni, D. Locatello, M. Pancaldi, and D. Tosi. 2018. Cloud computing and the new EU general data protection regulation. IEEE Cloud Computing 5, 6 (2018), 58\u201368.","journal-title":"IEEE Cloud Computing"},{"key":"e_1_3_2_7_2","volume-title":"IEEE 7th International Conference on Future Internet of Things and Cloud. 117\u2013124","author":"Barati M.","unstructured":"M. Barati , O. Rana , G. Theodorakopoulos , and P. Burnap . 2019. Privacy-aware cloud ecosystems and GDPR compliance . In IEEE 7th International Conference on Future Internet of Things and Cloud. 117\u2013124 . M. Barati, O. Rana, G. Theodorakopoulos, and P. Burnap. 2019. Privacy-aware cloud ecosystems and GDPR compliance. In IEEE 7th International Conference on Future Internet of Things and Cloud. 117\u2013124."},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.5852"},{"key":"e_1_3_2_9_2","volume-title":"IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA\u201918)","author":"Tom K.","unstructured":"K. Tom , J. Lambrecht , and C. Horn . 2018. A privacy-aware distributed software architecture for automation services in compliance with GDPR . In IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA\u201918) . 1067\u20131070. K. Tom, J. Lambrecht, and C. Horn. 2018. A privacy-aware distributed software architecture for automation services in compliance with GDPR. In IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA\u201918). 1067\u20131070."},{"key":"e_1_3_2_10_2","volume-title":"IEEE\/ACM International Conference on Utility and Cloud Computing Companion (UCC Companion\u201918)","author":"Shirley C.","unstructured":"C. Shirley and J. Jensen . Towards a secure and gdpr-compliant fog-to-cloud platform . In IEEE\/ACM International Conference on Utility and Cloud Computing Companion (UCC Companion\u201918) . 296\u2013301. C. Shirley and J. Jensen. Towards a secure and gdpr-compliant fog-to-cloud platform. In IEEE\/ACM International Conference on Utility and Cloud Computing Companion (UCC Companion\u201918). 296\u2013301."},{"key":"e_1_3_2_11_2","volume-title":"39th International Conference on Distributed Computing Systems (ICDCS\u201919). 1891","author":"Zhou W.","year":"1900","unstructured":"W. Zhou , A. B. Williams , and D. Perouli . 2019. Dependable public ledger for policy compliance, a Blockchain based approach . In 39th International Conference on Distributed Computing Systems (ICDCS\u201919). 1891 \u2013 1900 . W. Zhou, A. B. Williams, and D. Perouli. 2019. Dependable public ledger for policy compliance, a Blockchain based approach. In 39th International Conference on Distributed Computing Systems (ICDCS\u201919). 1891\u20131900."},{"key":"e_1_3_2_12_2","volume-title":"IEEE 6th International Conference on Big Data Security on Cloud (BigDataSecurity\u201920)","author":"Abhishek M.","unstructured":"M. Abhishek and K. P. Joshi . 2020. Automating GDPR compliance using policy integrated blockchain . In IEEE 6th International Conference on Big Data Security on Cloud (BigDataSecurity\u201920) , IEEE International Conference on High Performance and Smart Computing (HPSC\u201920), and IEEE International Conference on Intelligent Data and Security (IDS\u201920). 86\u201393. M. Abhishek and K. P. Joshi. 2020. Automating GDPR compliance using policy integrated blockchain. In IEEE 6th International Conference on Big Data Security on Cloud (BigDataSecurity\u201920), IEEE International Conference on High Performance and Smart Computing (HPSC\u201920), and IEEE International Conference on Intelligent Data and Security (IDS\u201920). 86\u201393."},{"key":"e_1_3_2_13_2","first-page":"5","article-title":"2020. COM-PACE: Compliance-aware cloud application engineering using blockchain","volume":"24","author":"Aujla G. S.","year":"2020","unstructured":"G. S. Aujla , M. Barati , O. Rana , S. Dustdar , A. Noor , J. T. Llanos , M. Carr , and R. Ranjan . 2020. COM-PACE: Compliance-aware cloud application engineering using blockchain . IEEE Internet Computing 24 , 5 ( 2020 ), 45\u201353. G. S. Aujla, M. Barati, O. Rana, S. Dustdar, A. Noor, J. T. Llanos, M. Carr, and R. Ranjan. 2020. COM-PACE: Compliance-aware cloud application engineering using blockchain. IEEE Internet Computing 24, 5 (2020), 45\u201353.","journal-title":"IEEE Internet Computing"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.ipm.2021.102511"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2948287"},{"key":"e_1_3_2_16_2","volume-title":"IEEE International Symposium on Networks, Computers and Communications.","author":"Barati M.","unstructured":"M. Barati , G. Theodorakopoulos , and O. Rana . 2020. Automating GDPR compliance verification for cloud-hosted services . In IEEE International Symposium on Networks, Computers and Communications. M. Barati, G. Theodorakopoulos, and O. Rana. 2020. Automating GDPR compliance verification for cloud-hosted services. In IEEE International Symposium on Networks, Computers and Communications."},{"key":"e_1_3_2_17_2","doi-asserted-by":"crossref","unstructured":"M. Barati and O. Rana. 2021. Design and verification of privacy patterns for business process models. In Blockchain Technology and Innovations in Business Processes S. Patnaik et\u00a0al. (Eds.). Springer.  M. Barati and O. Rana. 2021. Design and verification of privacy patterns for business process models. In Blockchain Technology and Innovations in Business Processes S. Patnaik et\u00a0al. (Eds.). Springer.","DOI":"10.1007\/978-981-33-6470-7_8"},{"key":"e_1_3_2_18_2","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1515\/comp-2019-0005","article-title":"2019. Privacy-aware blockchain for personal data sharing and tracking","volume":"9","author":"Onik M. H.","year":"2019","unstructured":"M. H. Onik , C.-S. Kim , N.-Y. Lee , and J. Yang . 2019. Privacy-aware blockchain for personal data sharing and tracking . Open Computer Science 9 ( 2019 ), 80 \u2013 91 . M. H. Onik, C.-S. Kim, N.-Y. Lee, and J. Yang. 2019. Privacy-aware blockchain for personal data sharing and tracking. Open Computer Science 9 (2019), 80\u201391.","journal-title":"Open Computer Science"},{"key":"e_1_3_2_19_2","volume-title":"Proc. of the 5th IEEE International Conference on Big Data Security on Cloud (BigDataSecurity\u201919)","author":"Murthy S.","unstructured":"S. Murthy , A. Abu Bakar , F. Abdul Rahim , and R. Ramli . 2019. A comparative study of data anonymization techniques . In Proc. of the 5th IEEE International Conference on Big Data Security on Cloud (BigDataSecurity\u201919) , High Performance and Smart Computing (HPSC\u201919), and Intelligent Data and Security (IDS\u201919). 306\u2013309. S. Murthy, A. Abu Bakar, F. Abdul Rahim, and R. Ramli. 2019. A comparative study of data anonymization techniques. In Proc. of the 5th IEEE International Conference on Big Data Security on Cloud (BigDataSecurity\u201919), High Performance and Smart Computing (HPSC\u201919), and Intelligent Data and Security (IDS\u201919). 306\u2013309."},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2018.2880722"},{"key":"e_1_3_2_21_2","volume-title":"Proc. of the 1st Italian Conference on Cybersecurity. 146\u2013155","author":"Gaetani E.","unstructured":"E. Gaetani , L. Aniello , R. Baldoni , F. Lombardi , A. Margheri , and V. Sassone . 2017. Blockchain-based database to ensure data integrity in cloud computing environments . In Proc. of the 1st Italian Conference on Cybersecurity. 146\u2013155 . E. Gaetani, L. Aniello, R. Baldoni, F. Lombardi, A. Margheri, and V. Sassone. 2017. Blockchain-based database to ensure data integrity in cloud computing environments. In Proc. of the 1st Italian Conference on Cybersecurity. 146\u2013155."},{"key":"e_1_3_2_22_2","volume-title":"Proc. of the International Conference on Computing, Electronics & Communications Engineering. 77\u201382","author":"Al-Zaben N.","year":"2018","unstructured":"N. Al-Zaben , M. M. H. Onik , J. Yang , N.-Y. Lee , and C.-S. Kim . 2018 . General data protection regulation complied Blockchain architecture for personally identifiable information management . In Proc. of the International Conference on Computing, Electronics & Communications Engineering. 77\u201382 . N. Al-Zaben, M. M. H. Onik, J. Yang, N.-Y. Lee, and C.-S. Kim. 2018. General data protection regulation complied Blockchain architecture for personally identifiable information management. In Proc. of the International Conference on Computing, Electronics & Communications Engineering. 77\u201382."},{"key":"e_1_3_2_23_2","volume-title":"Proc. of the 3rd IEEE International Conference on Computer and Communications. 2470\u20132473","author":"Zhang Y.","unstructured":"Y. Zhang , S. Wu , B. Jin , and J. Du . 2017. A blockchain-based process provenance for cloud forensics . In Proc. of the 3rd IEEE International Conference on Computer and Communications. 2470\u20132473 . Y. Zhang, S. Wu, B. Jin, and J. Du. 2017. A blockchain-based process provenance for cloud forensics. In Proc. of the 3rd IEEE International Conference on Computer and Communications. 2470\u20132473."},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2730843"},{"key":"e_1_3_2_25_2","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1049\/iet-sen.2018.5293","article-title":"2019. Service level agreement-based GDPR compliance and security assurance in (multi) Cloud-based systems","volume":"13","author":"Rios E.","year":"2019","unstructured":"E. Rios , E. Iturbe , X. Larrucea , M. Rak , W. Mallouli , J. Dominiak , V. Munt\u00e9s , P. Matthews , and L. Gonzalez . 2019. Service level agreement-based GDPR compliance and security assurance in (multi) Cloud-based systems . IET Software 13 , 19 ( 2019 ), 213\u2013222. E. Rios, E. Iturbe, X. Larrucea, M. Rak, W. Mallouli, J. Dominiak, V. Munt\u00e9s, P. Matthews, and L. Gonzalez. 2019. Service level agreement-based GDPR compliance and security assurance in (multi) Cloud-based systems. IET Software 13, 19 (2019), 213\u2013222.","journal-title":"IET Software"},{"key":"e_1_3_2_26_2","doi-asserted-by":"crossref","unstructured":"H. Desai K. Liu M. Kantarcioglu and L. Kagal. 2018. Enforceable Data Sharing Agreements Using Smart Contracts arXiv:1804.10645v1[cs.CY].  H. Desai K. Liu M. Kantarcioglu and L. Kagal. 2018. Enforceable Data Sharing Agreements Using Smart Contracts arXiv:1804.10645v1[ cs.CY ].","DOI":"10.1109\/Cybermatics_2018.2018.00261"},{"key":"e_1_3_2_27_2","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/TII.2018.2800693","article-title":"Renewable energy-based multi-indexed job classification and container management scheme for sustainability of cloud data centers","volume":"15","author":"Kumar N.","year":"2019","unstructured":"N. Kumar , G. S. Aujla , S. Garg , K. Kaur , R. Ranjan , and S. K. Garg . Renewable energy-based multi-indexed job classification and container management scheme for sustainability of cloud data centers . IEEE Transactions on Industrial Informatics 15 , 5 ( 2019 ), 2947\u20132957. N. Kumar, G. S. Aujla, S. Garg, K. Kaur, R. Ranjan, and S. K. Garg. Renewable energy-based multi-indexed job classification and container management scheme for sustainability of cloud data centers. IEEE Transactions on Industrial Informatics 15, 5 (2019), 2947\u20132957.","journal-title":"IEEE Transactions on Industrial Informatics"},{"key":"e_1_3_2_28_2","volume-title":"Proc. of the 14th International Conference on Smart Cities: Improving Quality of Life Using ICT & IoT (HONET-ICT\u201917)","author":"Wasim M. U.","unstructured":"M. U. Wasim , A. A. Z. A. Ibrahim , P. Bouvry , and T. Limba . 2017. Law as a service (LaaS): Enabling legal protection over a blockchain network . In Proc. of the 14th International Conference on Smart Cities: Improving Quality of Life Using ICT & IoT (HONET-ICT\u201917) . 110\u2013114. M. U. Wasim, A. A. Z. A. Ibrahim, P. Bouvry, and T. Limba. 2017. Law as a service (LaaS): Enabling legal protection over a blockchain network. In Proc. of the 14th International Conference on Smart Cities: Improving Quality of Life Using ICT & IoT (HONET-ICT\u201917). 110\u2013114."},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2020.2999559"},{"key":"e_1_3_2_30_2","doi-asserted-by":"crossref","unstructured":"G.\n      Behrmann A.\n      David and \n      K. G.\n      Larsen\n  . \n  2004\n  . A tutorial on Uppaal. In Formal Methods for the Design of Real-time Systems Lecture Notes in Computer Science M. Bernardo F. Corradini (Eds.). \n  Springer Vol. \n  3826 200\u2013236.  G. Behrmann A. David and K. G. Larsen. 2004. A tutorial on Uppaal. In Formal Methods for the Design of Real-time Systems Lecture Notes in Computer Science M. Bernardo F. Corradini (Eds.). Springer Vol. 3826 200\u2013236.","DOI":"10.1007\/978-3-540-30080-9_7"},{"key":"e_1_3_2_31_2","doi-asserted-by":"crossref","unstructured":"M. Corrales P. Jurcys and G. Kousiouris. 2018. Smart contracts and smart disclosure: Coding a GDPR compliance framework. SSRN Electronic Journal.  M. Corrales P. Jurcys and G. Kousiouris. 2018. Smart contracts and smart disclosure: Coding a GDPR compliance framework. SSRN Electronic Journal .","DOI":"10.2139\/ssrn.3121658"},{"key":"e_1_3_2_32_2","unstructured":"L. Richardson and S. Ruby. 2007. RESTful Web Services - Web Services for the Real World. O\u2019Reilly Media Inc.  L. Richardson and S. Ruby. 2007. RESTful Web Services - Web Services for the Real World. O\u2019Reilly Media Inc."},{"key":"e_1_3_2_33_2","unstructured":"Ropsten. 2021. Ropsten Testnet POW Chain. https:\/\/github.com\/ethereum\/ropsten.  Ropsten. 2021. Ropsten Testnet POW Chain. https:\/\/github.com\/ethereum\/ropsten."},{"key":"e_1_3_2_34_2","unstructured":"Ganache. 2021. Nethereum Documentation. https:\/\/docs.nethereum.com\/en\/latest\/ethereum-and-clients\/ganache-cli\/.  Ganache. 2021. Nethereum Documentation. https:\/\/docs.nethereum.com\/en\/latest\/ethereum-and-clients\/ganache-cli\/."},{"key":"e_1_3_2_35_2","unstructured":"OSHI. 2021. Operating System & Hardware Information. https:\/\/github.com\/oshi\/oshi.  OSHI. 2021. Operating System & Hardware Information. https:\/\/github.com\/oshi\/oshi."}],"container-title":["Distributed Ledger Technologies: Research and Practice"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3585538","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3585538","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:46:08Z","timestamp":1750178768000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3585538"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,8]]},"references-count":35,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2023,6,30]]}},"alternative-id":["10.1145\/3585538"],"URL":"https:\/\/doi.org\/10.1145\/3585538","relation":{},"ISSN":["2769-6472","2769-6480"],"issn-type":[{"value":"2769-6472","type":"print"},{"value":"2769-6480","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,6,8]]},"assertion":[{"value":"2022-06-22","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-02-13","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-06-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}