Research On Data Privacy Perservation Mechanism For Saas

With the development of Internet technology and the requirement of software market, a new model of software service emerged, known as Software as s Service (SaaS). SaaS is a new type of software development and delivery model, software service provider provides services to people through Internet. The tenants can subscribe and pay for the online services on demand. The main feature of SaaS model is "single-instance multi-tenancy", a software instances can serve many tenants. The scale effect of the SaaS reduces the operating cost and increases benefits for service provider. Tenants only pay for the part of the software service that they are used, which can reduce the cost of software purchase. The development, maintenance and upgrade of software service are delivered to service provider.Although the SaaS model has many advantages, there are still many obstacles for the application and development of SaaS model. Data privacy is a key problem. In the SaaS model, tenants’data is deployed in the service provider side and managed by it. How to prevent the data privacy of the tenants from being disclosed is an urgent problem of the SaaS model.First, this paper introduces the concept of SaaS model. SaaS has three main features, which is configurability, scalability and multi-tenancy. According to its features, SaaS is divided into four kinds of maturity models. This paper analyzes the characteristics of all levels of maturity model, summarizes the common data storage architectures and their advantages and disadvantages, and introduces the data privacy problems in the SaaS model. The service provider may analyze the data and get the private data of tenants directly. It can also pretend to be the right tenant in order to steal the privacy policy and get the privacy information.Then, this paper proposes a three parties interaction model for SaaS to implement tenant authentication. We use a trusted third party to support the data privacy customization and maintenance for tenants. The three parties in the model are tenant, service provider and trusted third party. We implement the interaction and authentication process among them through identity-based cryptographic techniques and analyze the safety of the interaction model.Finally, this paper proposes our SaaS data privacy protection approach to protect tenants’private data. We describe the definition of privacy constraints and define value privacy constraint and dependency privacy constraint based on the attribute privacy constraint. Combined with horizontal fragmentation technology and vertical fragmentation technology of database, we propose privacy hybrid fragmentation technology and a heuristic hybrid fragmentation algorithm. We made some experiments to analyze our approach in the paper.