# Cloud Security Using Fine-Grained Efficient Information Flow Tracking
## 5 Data Leak Prevention Using CloudMonitor
### The Data Tracking Policy Framework  
The founding concept, which informs an information recipient and leverages a basic and scalable unit of data granularity for access control is the essence of our policy framework. A policy construct (i.e., principal) might represent a single user inside a CSC organization or a group of users with the same or equal access permissions (e.g., employees in the research department). The CloudMonitor's method for policy design and reinforcement is dependent on the Dynamic label standard, an effective paradigm of access control that allows more than a principal to secure the sensitive information and be shared under specified conditions. In the Dynamic label paradigm, each data value has allocated a label that represents a particular set of distribution restrictions. A label conceptually reflects an unorganized collection of privacy policies. Each policy has a designated owner and eligible readers. The owner of the policy related to a data item (\(d\)) is a principal whose details have been identified as having established the value of the data item. This principle also aims to restrict the data's exposure by declaring a policy. The reader set, indicated by the policy, represents the individuals or entities authorized by the owner (\(o\)) to monitor and perform calculations on \(d\). An individual principle can appear in numerous readers' sets with their own various policies. In addition, a principal can change (weaken or strengthen) its own policy on a particular data item by modifying the set of readers (\(r\)). As the default behavior, all data items recently created are given an empty label (denoted \(L\phi\equiv\{\}\)), which does not contain policies and reflects data that is entirely accessible to the public. A data item is considered contaminated if it contains a non-empty label. When dealing with labels that have multiple policies, a principal \(P\) may observe data if and only if each policy specifies \(P\) as an approved reader. The effective reader set is constituted by the intersection of all reader sets included within a label form. Consider the data item \(d\) labeled to show these definitions. \[La=\{\{o1:r1,r2\},\{o2:r2,r3\},and\{o3:r2,r4\}\}\]  
The three policies in this label are owned by \(o1,o2\), and \(o3\), respectively. The policy of principal \(o1\) permits \(r1\) and \(r2\) to witness the value of \(d\); the policy of principal \(o2\) permits \(r2\) and \(r3\) to observe \(d\); and the policy of principal \(o3\) permits \(r2\) and \(r4\) to observe \(d\). Therefore, in this instance, the efficient reader set comprises the common element \(r2\), and as a result, only this principle has access to and control over \(d\). Consider [PERSON] and [PERSON] as hypothetical employees collaborating on an internal project involving confidential information and serve as concrete examples for discussion. Let us assume that [PERSON] possesses a secret file, denoted as \(f1\), which she intends to securely exchange with [PERSON]. To achieve this, [PERSON] can establish a new secrecy policy, denoted as \(pA=\{\mathit{[PERSON]}:\mathit{[PERSON]},\mathit{[PERSON]}\}\), thereby permitting [PERSON] to access, store, and manipulate \(f1\) while explicitly prohibiting disclosure to unauthorized parties. Suppose [PERSON] also possesses a separate file, denoted as \(f2\), with the label \(pB=\) \"[PERSON]: [PERSON], [PERSON]\". At a later point, [PERSON] may seek to integrate the information from \(f1\) and \(f2\), such as by cross-referencing their contents. The resulting computation yields a new file, named \(f3\), labeled with the union of their respective policies: \(pA,pB\). However, [PERSON] inadvertently attempts to share \(f3\) with [PERSON], overlooking the fact that it contains data derived from [PERSON]'s secret file. As per [PERSON]'s policy, [PERSON] is not authorized to access her data, highlighting the necessity for the system to prevent such actions and thus prevent data leakage.