Towards a trust management system for cloud computing marketplaces: using CAIQ as a trust information source

Cloud computing enables IT related services in a more dynamic and scalable way than before – more costeffective than before due to the economy of scale and of sharing resources. Usually, cloud providers describe their promised behaviour – regarding functional and non-functional aspects of the service provision – by way of Service Level Agreements (SLAs). For different providers offering similar functionality, SLAs are often insufficiently claimable and inconsistent with the aspects considered important by customers. Therefore, customers face problems identifying a trustworthy cloud provider based solely on its SLA. In order to support customers in reliably identifying trustworthy cloud providers, we propose a multi-faceted Trust Management (TM) system architecture for cloud computing marketplaces and related approaches. This system provides the means for identifying trustworthy cloud providers in terms of different attributes, e.g., compliance, data governance, information security. In this article, we present the first realization of our proposed TM system using the Consensus Assessment Initiative Questionnaire (CAIQ), initiated by the Cloud Security Alliance (CSA), as one of the sources of trust information. In particular, our proposed approach contributes to the challenge of extracting trust information from CAIQs completed by cloud providers. Finally, our implemented system and related approaches are experimented using real datasets. Copyright c © 0000 John Wiley & Sons, Ltd.