# Context Analysis of Cloud Computing Systems Using a Pattern-Based Approach
## 3 Pattern-Based Context Analysis for Cloud Computing Services
### Description of the ReAs-CSAP
For the development, the _development environment and API_ of the PaaS are used. * is the central point for referencing all relevant physical resources of the cloud that are necessary for providing the appropriate cloud computing services. * is the central point for referencing all resources in the form of _locations_, _software_ and _hardware_. * represents all locations that contain cloud resources (e.g., the computing center) or are relevant to the provided cloud computing service in another way (e.g., development site). * represents necessary cloud hardware resources, e.g., server racks or network components. * represents cloud resources in the form of necessary software (e.g., software for managing the cloud or virtualization). * specifies the personally identifiable information and/or sensitive personal information of the _data subject_ that is processed and/or stored by the according SaaS. The rights for accessing and using this data by _data consumers_ are specified by (1) a legal specification by the contract between the data subject and the data controller and (2) a formal specification in the associated _sticky policies_. * defines requirements regarding the access and usage of the _data_ of a _data subject_. They are derived from the _contract_ between the _data subject_ and _data controller_. * provides security and privacy mechanisms. These mechanisms constrain the PaaS level for enforcing the relevant _sticky policies_ (e.g., in the transfer, processing and storage). The data protection platform might provide different _data protection components_ that implement the appropriate security and privacy mechanisms. The different components can be hosted by either _data controllers_ themselves in an according infrastructure or provided by _data protection providers_ that provide the functionality of the components as a service. * defines the components that implement security and privacy mechanisms for the considered cloud computing service. The _data protection component_ could include concrete technologies for data protection, such as attribute-based encryption (e.g., reference [28]), fully homomorphic encryption (e.g., reference [29]) or secure enclaves (e.g., references [26; 27]). The _indirect environment_ represents the external context of a cloud computing service. The relevant information about the external context is represented by different types of _indirect stakeholders_ that are contained in the _indirect environment_. Here, the different types of _indirect stakeholders_ represent the following information:  
* Representation of the laws and regulations of legislators (e.g., Germany or the European Union) that are relevant for the cloud computing service. This type of _indirect stakeholder_ is especially important, because it enables the representation of laws regarding data privacy. In the context of the European Union, the \(GDPR\) is especially relevant. Relevant _legislators_ can be derived from the _location_ of the considered cloud computing service. * Specification of domain-specific rules and guidelines that the cloud computing service has to comply with. * Representation of contractual provisions (e.g., service level agreements with customers) that have to be fulfilled by the cloud computing service. The representation of the contracts between data subjects and data controllers are particularly important because they specify the security and privacy requirements for the data of the data subjects. The _sticky policies_ that specify these privacy requirements in a machine-readable way are derived from such _contracts_. It should be ensured that the content of a _contract_ conforms to the relevant _legislators_ and _domains_. * Evaluate the level of security and/or privacy that is provided by the considered cloud computing service. The evaluation can be performed with respect to an existing standard, such as ISO 27001 [11]. Assessors can analyze the results of the performed risk assessment. Here, they can map information about the risk assessment to the real system.