Mapping Legal Requirements to SLAs: An Ontology Based Approach for Cloud-based Service Consumption

This work presents a new approach to ensure compliance to legal regulation in Cloud Computing, especially in Software-as-a-Service. Since high demanding business sectors, such as the health care sector, require high legal certainty, when contracting services offered by external providers. We provide a lightweight ontological representation of the German Federal Data Protection Act (BDSG) and a methodological approach how this work can be extended with additional laws. Furthermore, we integrate the generic ontology into the Linked Unified Service Description Language (Linked-USDL) as Compliance to External Services (Linked-USDL CES) module. This extension enables service customers and providers to negotiate services more fine grained related to legal obligations, which increases legal certainty and thus the acceptance of a cloud-based service consumption. We demonstrate the applicability of the proposed ontology with the concrete use case “physician’s letter” that is part of a running national project TRESOR, which aims at the development of a trusted cloud ecosystem.