The term "Cloud" is everywhere these days – and it carries just as many meanings. "I use the Cloud," "we're moving to the Cloud" – these are phrases we hear more and more often. Recently, a new concept has been added to the mix: the Sovereign Cloud. Sovereignty is a word we primarily know from the context of national independence, autonomy, freedom of trade, or political decision-making. But what does it actually mean when we link that term to the Cloud? What exactly is a Sovereign Cloud, and why is it relevant to you and your organization?
In this blog post, Fundaments CTO Larik-Jan Verschuren explores the meaning of sovereignty in combination with the Cloud.
Let’s start with the definition of sovereignty. According to Wikipedia, sovereignty is the right of a governing body to exercise supreme authority without having to account for it to any other body. In modern states, this is enshrined in the constitution: the fundamental agreements on how that state operates. If you place this in an international context, it means that countries respect each other's borders and that each country decides for itself what happens within those borders. Simply put: other countries are not allowed to interfere in domestic affairs.
The word interfere is interesting here, because it is also relevant when we talk about the Cloud.
There is a lot to be said about what the Cloud actually is, what forms it takes, and why it has become such a popular concept. You can read more about this in, among other places, this blog post. For now, we will limit ourselves to the meaning of Cloud within the context of a Sovereign Cloud: a place where data is stored and processed. When we combine that with sovereignty, it comes down to data landing in a place where the interference regarding that data is clear.
And that data plays a role in almost everything we do daily: from apps on your phone and forms on websites to video meetings within your organization. All those applications generate data, and that data eventually ends up in the Cloud.
The promise of the Sovereign Cloud
More and more providers are claiming to have a ‘Sovereign Cloud’: an environment where your data is stored and processed without third-party interference. But is that actually the case? Is there a certification, a standard, or a verifiable way to determine if your data is truly protected against outside ‘interference’? To determine this properly, it is important to understand how data lands in a Cloud. Where does it enter? Which layers does it pass through? And who has access?
The path of data within the Cloud
When you look at how data moves within the Cloud, you quickly see that it doesn't just ‘land’ anywhere. Data follows a route through various layers and components before it is finally stored and processed. You can clearly visualize this data path using a layered model, similar to the well-known OSI model used for data communication standards.
In the context of a Sovereign Cloud, such a layered model provides a useful framework. For each layer, you can assess the extent of interference—in other words: who has control, access, or influence over that specific layer?
Figure 1 visually represents the data path: from the user to the application running in the Cloud. The various components of the Cloud environment are identified so that it can be examined at each step where data is processed and who might have access to it.
Figure 1. Visual representation of the data path
The figure above shows 10 layers of the Cloud where data is processed. Each layer is explained below.
Layer 1 - Transport
The path data takes in the Cloud begins with the user. Data is generated and sent via a device, such as a laptop or smartphone. Internet of Things (IoT) devices, such as smart cars, security systems, or home automation solutions, can also send data independently. From these sources, data is transported to the Cloud. In most cases, this happens via the public internet. However, in sectors where security and reliability are critical, such as defense, private networks or dedicated infrastructures are often used. But simpler solutions are also possible: how often do you come across a project in an industrial park where fiber optics are being installed? This fiber-optic connection can also be used to connect a local business premises directly to a data center, enabling data transport without using the internet. This significantly increases security.
Layer 2 - Data transport – Cloud Edge
After transport, the data arrives at the so-called Cloud Edge: this is the connection point for the specific Cloud. When connecting via the internet, this often happens through a Cloud provider's edge router, using protocols such as BGP. With private, dedicated connections, this is often via a 'meet-me-room' in a data center, where a physical line is terminated and connected to the Cloud provider's edge routers.
Layer 3 - Data locality in data center
From the Cloud Edge, data is distributed further within the Cloud provider's infrastructure. This infrastructure consists of various availability zones and data center locations. This can be regional, but also international. Especially with larger hyperscalers, operations are international, which means data locality can be widely distributed.
Layer 4 - Application
The application that presents and processes the data is, in a functional sense, a processor of the transported data. Driven by a user or procedure, the application acts as an exchanger of data.
Layer 5 - Middleware
An application requires various components, such as a database, specific application languages like PHP, as well as modules like a web server or a load balancer. All these components support the application and ensure that data is processed in a specific way.
Layer 6 - Operating System or Container
To run an application and middleware, an operating system is required. This operating system ensures that physical computing power (RAM and CPU) and storage (hard drive) can be used to process all data and operations by the middleware and application. When functionality is further specified, the middleware and application can be combined into a container, which also handles the connection to physical computing power and storage through orchestration.
Layer 7 - Virtualization | Containerization | Bare metal
The operating system or container can be virtualized. With virtualization, physical computing power and storage are further divided into virtual computing power, allowing multiple instances of an operating system or container to use the same physical infrastructure. In a so-called bare metal application, the physical infrastructure is accessed directly from a single operating system.
Layer 8 - Hardware: Network
The network infrastructure consists of routers, firewalls, and switches that establish various data connections and ensure transport from the Cloud Edge to the physical infrastructure used to access the different layers. This equipment thereby transports and moves data.
Layer 9 - Hardware: Compute
Compute hardware forms the ultimate processing power of the Cloud. It is often said that the Cloud is just someone else's computer, and in essence, this is true. Without the actual server with compute resources, an application, operating system, and data processing cannot take place.
Layer 10 - Hardware: Storage
Storage hardware captures data that is not temporary (as that is processed in the compute through application layers). These storage systems are the most concrete and tangible form of data storage in the Cloud. When you know which device stores your Cloud data, you can 'touch' your data and know exactly where 'in the Cloud' it resides.
The 10 layers mentioned above show the path data follows. But does this tell us exactly who is involved and, consequently, the level of sovereignty? No, because technology is a solution offered as a service—which is what the Cloud is to the end user.
The operation behind the technology
Behind every technical Cloud layer lies an operational reality: technology is managed by companies, and those companies consist of people. This operation is carried out according to guidelines partly established by the company itself, but always within the framework of applicable laws and regulations. These regulations are geographically determined. A Dutch company operating in the Netherlands is subject to Dutch and European law. But as soon as that same company establishes itself on another continent, the playing field changes. Ownership can also be important here: consider EU investors who are part of a multinational with a non-European parent company. In that case, not only do Dutch rules apply, but also the laws of the country where the company is located. This leads to legal complexity and makes it essential, in the context of Sovereign Cloud, to examine which legislation applies to the location of the operation. Therefore, to determine the level of sovereignty, it is important to understand who manages the Cloud environment, where it is managed, and under which jurisdiction that occurs.
Looking back at Figure 1, we see that multiple parties can be involved in each layer. An internet provider, for example, is rarely the application manager, and the layer 1 service provider is almost always different from the service provider for layers 2 through 10. While many options are available for the underlying layers, there are several common scenarios:
Cloud Service Providers organize layers 2 and 3 and 6 through 10.
Managed Service Providers use one or more Cloud Service Providers and manage layers 4 through 6 within them.
For specific solutions, Fundaments can facilitate a large portion of these layers, even 2 through 10. This makes it easy to determine the level of involvement in the sovereignty discussion.
Conclusion: sovereignty begins with insight
Sovereign Cloud is a comprehensive definition and can be interpreted in many different ways. For the end user, it is essential to understand where data goes, who processes it, and under what conditions. In short: what is the level of 'involvement'? You gain this insight by looking at the technical layers of the Cloud and determining:
Where is the technology located?
Which party is responsible for the operation?
Under which jurisdiction does this party fall?
This combination of technology, operation, and location determines how a service is delivered and which management measures apply to it. These measures are always determined by the locality of the technology and the locality of the management organization's governance.
Once you have a clear understanding of the level of involvement, you can qualify the sovereignty of a Cloud service. You can then examine the risks to the availability, confidentiality, and integrity of storage in a Cloud service using the user organization's data. It is therefore important to classify data properly within the organization. If this seems complicated, looking at the application is a good starting point. The application can then be linked to the Cloud service where it is hosted, allowing the level of sovereignty of the application and the data to be determined.
At Fundaments, we can support you with data classification to establish a data-driven Cloud strategy. Any form of Cloud can be applied here, with Fundaments also able to realize a portion when it comes to the private cloud. Want to know more?Get in touch!
