Interoperable Europe logo
Rolling Plan for ICT standardisation
Join this collection

-CLOUD AND EDGE COMPUTING

(A.) Policy and legislation

(A.1) Policy objectives

Establishing a coherent framework and conditions for cloud computing was one of the key priorities of the digital agenda for Europe. The digital single market strategy confirmed the importance of cloud computing, which is driving a paradigm shift in the delivery of digital technologies, enhancing innovation, digital single market and access to content. 

(A.2) EC perspective and progress report

The key role of cloud computing is established through the European Cloud Initiative and through the initiative on Building a European Data Economy. Cloud computing is developing fast. Estimates indicate that these developments could lead to the growth of the European cloud market from €9.5bn in 2013 to €44.8bn by 2020, i.e. almost five times the market size in 2013. The latest Eurostat data available (end of 2018) shows the current state of play in the European Union regarding the use of cloud computing by enterprises. The main findings are summarised below:

  • 26 % of EU enterprises used cloud computing in 2018, mostly for hosting their e-mail systems and storing files in electronic form.
  • 55 % of those firms used advanced cloud services relating to financial and accounting software applications, customer relationship management or to the use of computing power to run business applications.
  • In 2018, many more firms used public cloud servers (18 %) than private cloud servers (11 %), i.e. infrastructure for their exclusive use.
  • Compared with 2014, the use of cloud computing increased particularly in large enterprises (+21 percentage points).

The development of the cloud computing market and the efficient delivery of cloud services particularly depend on the ability to build economies of scale. The establishment of a Digital Single Market will unlock the scale necessary for cloud computing to reach its full potential in Europe.

In 2012, the Article 29 data protection working party issued on opinion on cloud computing . This opinion has outlined how the wide scale deployment of cloud computing services can trigger a number of data protection risks, mainly a lack of control over personal data as well as insufficient information with regard to how, where and by whom the data is being processed/sub-processed.

The proposed actions follow the direction as outlined in the EU Communication on ICT standardisation priorities which identified cloud as a key priority for Europe. The actions include a follow-up of cloud standards coordination started in 2012/2013 when the Commission asked ETSI to coordinate stakeholders to produce a detailed map of the necessary standards (e.g. for security, interoperability, data portability and reversibility).

The Cloud Select Industry Group (C-SIG) has been open to all organisations, groups and individuals having a professional interest in cloud computing matters and are active in the European cloud market. The Communication “Unleashing the Potential of Cloud Computing in Europe” (2012) identified key actions to be supported by Cloud Select industry Groups. See section C1 below.

The Commission is also pursuing international cooperation in the field of cloud computing, and a number of policy and joint research initiatives have been put in place with Japan, Brazil and South Korea and are ongoing with USA.

The Commission has also funded the CloudWatch2 project which, among others, reported on the status of interoperability and security standards, developed a catalogue of cloud services and mapped EU cloud services and providers.

When it comes to certification and ways for customers to know and be assured that their data is equally safe no matter where they are located or who provides the service, the Commission launched the study Certification Schemes for Cloud Computing (SMART 2016/0029) and a public consultation which ended in October 2017.

In the view of facilitating a fair market for the consumers, the Commission also launched a study on Switching cloud providers (SMART 2016/0032) to collect evidence on legal, economic, and technical issues when switching from provider.

In April 2018 the Commission launched two DSM (Digital Single Market) Cloud Stakeholder groups (https://ec.europa.eu/digital-single-market/en/news/cloud-stakeholder-wo…). The DSM Working Group on Cloud Certification Scheme will begin exploring an EU certification scheme on cloud security. The Group consists of national cyber security authorities, cloud service provider, cloud service customer as well as auditing entities.

The European Security Certification Framework (EU-SEC) strives to address the security, privacy and transparency challenges associated with the greater externalisation of IT to Cloud services. EU-SEC will create a certification framework under which existing certification and assurance schemes can co-exist. EU-SEC is funded by Horizon 2020 and publishes its results at www.sec-cert.eu.

The other DSM Cloud Stakeholder group (working group on cloud switching/ porting data - SWIPO) has defined a self-regulatory codes of conduct to facilitate data portability and cloud switching.(https://swipo.eu/) These portability codes intend to support article 6 of the Regulation on the free-flow of non-personal data. The objective of SWIPO is to reduce the risk of ‘vendor lock-in’, as it will be easier to switch providers when it is clear which processes, technical requirements, time frames and charges apply in case a professional user wants to switch to another provider or port data back to its own IT systems.

On 15 October 2020 all EU Member States signed a Declaration on building the next generation European cloud. A key role in building the European cloud plays the launch of the European Alliance for Industrial Data and Cloud. The objective of the Alliance is to establish a competitive European cloud supply and to foster cloud adoption in the EU private and public sectors, in order to build technological autonomy and data sovereignty in Europe. The Alliance will bring together the key EU industrial actors on the supply side and the demand side with Member States’ authorities. Its aim will be to substantially increase the share of EU suppliers on the European public cloud infrastructure market by 2030. More concretely the aim of the Alliance is to:

  • Build the next generation cloud supply: the Commission is committed to co-invest in the interconnection and deployment across the EU.
  • Deploy pan-European cloud marketplaces, which will offer users a single portal to cloud offerings meeting key EU standards and rules.
  • Define common requirements for cloud services operating on the EU market. The future EU Cloud Rulebook will be developed by the Commission in close cooperation with Member States and in consultation with relevant stakeholders.

The JRC published a study on the relationship of open source software and standards setting at the end of 2019 (https://ec.europa.eu/jrc/en/publication/eur-scientific-and-technical-research-reports/relationship-between-open-source-software-and-standard-setting). The objective of the study was to identify possible commonalities and barriers for interaction between standardisation and open source (OSS) processes and in particular the interplay between OSS and FRAND licensing in standardisation.

(A.3) References 
  • Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union
  • COM(2016)176 “ICT Standardisation priorities for the digital single market”
  • COM(2016)178 “European cloud initiative — building a competitive data and knowledge economy in Europe” (Along with SWD(2016)106 and SWD(2016)107)
  • COM(2012)529 “Unleashing the potential of cloud computing in Europe”
  • COM(2015)192 “A digital single market strategy for Europe”
  • Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the EU (NIS Directive).

‘The new cloud computing action programme comprises four fields of activity: harnessing innovation and eIDAS market potential (research programme for secure Internet services, cloud computing for small and medium-sized enterprises and the public sector — trusted cloud); creating a pro-innovative framework (security and legal framework, standards, certification); co-shaping international developments;  providing informational guidance’.

(B.) Requested actions

The Communication on ICT Standardisation Priorities for the digital single market proposes priority actions in the domain of Cloud. Actions mentioned below reflect some of them.

Action 1 Identify needs for ICT standards and open source technologies to further improve the interoperability, data protection and portability of cloud services and continue or start respective development activities. This should also take into account available open source technologies and their role for interoperability, data protection and management of multiple clouds.

Action 2 Promote the use of the ICT standards needed to further improve the interoperability, data protection and portability of cloud services as well as multi-cloud management.

Action 3  Further strengthen the interlock between standardisation and open source in the area of Cloud and establish and support bilateral actions for close collaboration of open source and standardisation.

Action 4   Promote international standards on service level agreements (SLAs) and usage of the cloud code of conduct (CoC).

Action 5 Promote the use of the ISO/IEC JTC 1 reference cloud architecture and define generic cloud architecture building blocks. Map available standards to the generic cloud architecture building blocks. Define privacy, security and test standards for each building block. This will also help determine which standards can be used for open cloud platforms and architectures taking into account the key role of open source for cloud infrastructure design and implementations.

(C.) Activities and additional information  

(C.1) Related standardisation activities
CEN-CENELEC

When it comes to Cloud Security, CEN-CLC/JTC 13 ‘Cybersecurity and Data protection’ mirrors the activities of ISO/IEC JTC 1 SC 38 ‘Cloud Computing and distributed platforms’, and considers in this respect the potential adoption of International Standards as European Standards, where market relevant. CEN-CLC/JTC 13’s scope covers the development of standards for cybersecurity and data protection covering all aspects of the evolving information society. This includes notably: Management systems, frameworks, methodologies; Data protection and privacy; Services and products evaluation standards suitable for security assessment for large companies and small and medium enterprises (SMEs); Competence requirements for cybersecurity and data protection; Security requirements, services, techniques and guidelines for ICT systems, services, networks and devices, including smart objects and distributed computing devices.

ETSI

ISG NFV (Network Functions Virtualisation):  NFV adapts standard IT virtualisation technologies, consolidating heterogeneous network infrastructures based on disparate, ad hoc equipment types onto industry standard servers, switches and storage. 

ISG NFV develops and improves the NFV architectural framework to make more efficient the integration of edge computing and NFV, See: https://www.etsi.org/technologies/nfv.

GS NFV-EVE 011 documents the set of criteria to help characterize cloud-native VNFs

GS NFV-IFA 029 documents enhancements of the NFV architecture for providing “PaaS”-type capabilities and supporting virtualised network functions (VNFs) which follow “cloud-native” design principles . 

Specifications and reports on container infrastructure management:

Specifications and reports on multi-site / multi-domain deployments

ISG MEC (Multi-access Edge Computing)

Provides IT and cloud computing capabilities within the access segments of network infrastructure, in close proximity to network users.

ISG MEC is developing a set of standardized Application Programming Interfaces (APIs) to enable MEC services. To application developers and content providers, the access network offers a service environment with ultra-low latency and high bandwidth and direct access to real-time network information that can be used by applications and services to offer context-related services.

ISG NIN (Non-IP Networking)

Is investigating communications and networking protocols to provide the scale, security, mobility and ease of deployment required for a connected society. It is developing a forwarding plane standard that, while still supporting traditional Internet protocols, will also natively support new forms of routing, with a clean interface between the forwarding plane and the control and management planes. Thus, when accessing a service that might be provided at the edge or centrally, a client no longer needs to discover an IP address which identifies an interface to the equipment that provides the service, but can identify the service, content, etc, directly.

ISO/IEC JTC 1/SC 38 

Cloud computing and distributed platforms:

A full suite of standards is available and in progress in ISO/IEC JTC 1 SC 38 on cloud computing technologies including, most notably, the ISO Cloud Reference Architecture but also work on vocabulary, SLAs, etc. This is complemented by work in ISO/IEC JTC 1 SC27 on cybersecurity and on more specific work as on Virtualisation. Below is a non-exhaustive list of relevant ISO standards.

http://www.iso.org/iso/jtc1_sc38_home

  • ISO/IEC 27017 — Code of practice for information security controls based on ISO/IEC 27002 for cloud services
  • ISO/IEC 27018 — Code of practice for personally identifiable information (PII) protection in public cloud acting as PII processors
  • ISO/IEC 27036-4 — Information security for supplier relationships — Part 4: Guidelines for security of cloud services
  • ISO/IEC 19086-1 — Cloud computing — service level agreement (SLA) framework — Part 1: Overview and concepts
  • ISO/IEC 19086-2 — Cloud computing — Service level agreement (SLA) framework — Part 2: Metric model
  • ISO/IEC 19086-3 — Cloud computing — Service level agreement (SLA) framework — Part 3: Core conformance requirements
  • ISO/IEC 19086-4 — Cloud computing — Service level agreement (SLA) framework — Part 4: Components of security and of protection of PII
  • ISO/IEC 19941 Cloud Computing — Interoperability and portability
  • ISO/IEC 19944 Cloud Computing — Cloud services and devices: data flow, data categories and data use
  • ISO/IEC TR 22678 -- Cloud Computing -- Guidance for Policy Development
  • ISO/IEC TR 23186 -- Cloud computing -- Framework of trust for processing of multi-sourced data
  • ISO/IEC NP TR 23187 -- Cloud computing — Interacting with cloud service partners (CSNs) (work in progress)
  • ISO/IEC PDTR 23613 -- Cloud service metering and billing elements (work in progress)
  • ISO/IEC AWI 23751 -- Cloud computing and distributed platforms — Data sharing agreement (DSA) framework (work in progress)
  • ISO/IEC TR 23951 -- Cloud computing — Best practices for cloud SLA metrics (work in progress)
  • ISO/IEC 22624 -- Cloud Computing -- Taxonomy based data handling for cloud services (final stages of approval)
  • ISO/IEC CD 22123 -- Cloud Computing -- CONCEPTS AND TERMINOLOGY (work in progress)
  • ISO/IEC TS 23167 -- Cloud Computing -- Common Technologies and Techniques (work in progress)
  • ISO/IEC TR 23188 -- Cloud computing -- Edge computing landscape (work in progress)
  • ISO/IEC 17788 — Cloud computing — Overview and vocabulary
  • ISO/IEC 17789 Cloud computing — Reference architecture
  • ISO/IEC TR 3445 — Cloud computing — Audit of cloud services (Work in progess)
  • ISO/IEC 5140 — Cloud computing — Concepts for multi-cloud and other interoperation of multiple cloud services (Work in progress)
ITU

ITU-T SG13 leads ITU’s work on standards for future networks and 5G and is the primary SG working on cloud computing. It approved 28 Recommendations and 2 Supplements and has 20 ongoing work items covering different aspects of cloud computing (e.g. terminology, overview, reference architecture, functional requirements for technologies supporting XaaS and inter-cloud computing, distributed cloud, and storage federation). Relevant URLs:

Y.Sup49 to ITU-T Y.3500-series (11/2018) - Cloud computing standardisation roadmap, including deliverables of various SDOs:  https://www.itu.int/rec/T-REC-Y.Sup49/en .

Flipbook “Cloud computing: From paradigm to operation” with a collection of many ITU-T outputs on cloud computing: https://www.itu.int/en/publications/Documents/tsb/2020-Cloud-computing-From-paradigm-to-operation/index.html

In the domain of Big Data for Cloud, ITU-T related work is listed in the Big Data chapter of this Rolling Plan.

More info: https://www.itu.int/en/ITU-T/studygroups/2017-2020/13

ITU-T SG11 work on cloud computing signalling, monitoring and conformance and interoperability testing

SG11 approved/agreed:

  • Supplement 65 “Cloud computing interoperability activities”,
  • Recommendation ITU-T Q.3914 “Set of parameters of cloud computing for monitoring”,
  • Recommendation ITU-T Q.5001 “Signalling requirements and architecture of intelligent edge computing”,
  • Recommendation ITU-T Q.4040 “The framework and overview of Cloud Computing interoperability testing”,
  • Recommendation ITU-T Q.4041.1 “Cloud computing infrastructure capabilities interoperability testing - part 1: Interoperability testing between the CSC and CSP”,
  • Recommendation ITU-T Q.4042.1 “Cloud interoperability testing for web applications - part 1: Interoperability testing between the CSC and CSP”
  • Recommendation ITU-T Q.4043 “Interoperability testing requirements for virtual switches”)

More info: https://itu.int/go/tsg11

ITU-T SG17 works on cloud computing security. It has approved three Recommendations ITU-T X.1603  “Data security requirements for the monitoring service of cloud computing”, ITU-T X.1605 “Security requirements of public infrastructure as a service (IaaS) in cloud computing” and Recommendation ITU-T X.1604 on “Security requirements of network as a service (NaaS) in cloud computing”. SG17 has is working on “Security guidelines for container in cloud computing environment” (X.sgcc), “Security guidelines for distributed cloud” (X.sgdc), “Security guidelines for multi-cloud (X.sgmc), Security requirements of cloud-based platform under low latency and high reliability application scenarios” (X.sr-cphr) and “Requirements of network security situational awareness platform for cloud computing” (X.nssa-cc) and Technical Report on “Framework for Security Standardisation for Virtualized Services”(TR.fssvs).

More details here: https://www.itu.int/en/ITU-T/studygroups/2017-2020/17

IEEE

Cloud computing:

IEEE recently published the IEEE 2301-2020 IEEE Guide for Cloud Portability and Interoperability Profiles (CPIP). It provides standards-based choices in areas such as application interfaces, portability interfaces, management interfaces, interoperability interfaces, file formats, and operation conventions for cloud computing ecosystem participants (cloud vendors, service providers, and users).

Fog/Edge Computing:

Work is going on in IEEE P1934.1 “Nomenclature and Taxonomy for Distributing Computing, Communications and Networking along the Things-to-Cloud Continuum” and IEEE P1935 “Standard for Edge/Fog Manageability and Orchestration”.

More information is available at https://ieeesa.io/rp-cloudcomputing

IETF

The IETF has multiple groups working on standards for virtualization techniques, including techniques used in cloud computing and datacenters.

The Layer 2 Virtual Private Networks (L2VPN) Working Group produced specifications defining and specifying solutions for supporting provider-provisioned Layer-2 Virtual Private Networks (L2VPNs). They also addressed requirements driven by cloud computing services and data centers as they apply to Layer-2 VPN services. The L2VPN Service Model (L2SM) Working Group is tasked to created a data model that describes an L2VPN service.

The Layer 3 Virtual Private Networks (L3VPN) Working Group was responsible for defining, specifying and extending solutions for supporting provider-provisioned Layer-3 (routed) Virtual Private Networks (L3VPNs). These solutions provide IPv4, IPv6, and MPLS services including multicast.

The Layer Three Virtual Private Network Service Model (L3SM) Working Group was tasked to create a YANG data model that describes an L3VPN service (an L3VPN service model) that can be used for communication between customers and network operators, and to provide input to automated control and configuration applications.

The Network Virtualization Overlays (NVO3) Working Group develops a set of protocols and extensions that enable network virtualization within a datacenter environment that assumes an IP-based underlay. An NVO3 solution provides layer 2 and/or layer 3 services for virtual networks enabling multi-tenancy and workload mobility, addressing management and security issues.

The System for Cross-domain Identity Management (SCIM) Working Group worked on standardising methods for creating, reading, searching, modifying, and deleting user identities and identity-related objects across administrative domains, with the goal of simplifying common tasks related to user identity management in services and applications.

The Computing in the Network Research Group (coinrg) of the IRTF explores existing research and fosters investigation of “Compute In the Network” and resultant impacts to the data plane. The goal is to investigate how to harness and to benefit from this emerging disruption to the Internet architecture to improve network and application performance as well as user experience. https://trac.ietf.org/trac/iab/wiki/Multi-Stake-Holder-Platform#Cloud

OGF

Open Grid Forum (OGF) is a leading standards development organisation operating in the areas of grid, cloud and related forms of advanced distributed computing. The OGF community pursues these topics through an open process for development, creation and promotion of relevant specifications and use-cases. http://www.ogf.org/

OMG

Object Management Group (OMG): the OMG’s focus is always on modelling, and the   first specific cloud-related specification efforts have only just begun, focusing on modelling deployment of applications & services on the clouds for portability, interoperability & reuse. http://www.omg.org/

Hosted by the OMG is the Cloud Standards Customer Council, which has produced a series of customer-oriented white papers on diverse topics related to cloud computing, all of which are publicly accessible at: http://www.cloud-council.org/resource-hub.htm 

OneM2M

The oneM2M specifications foresee distributed computing capabilities and data management and storage. The oneM2M system itself acts as a cloud when the data are centralized. At the same time, cloud services may be used to support the storage capabilities of oneM2M as an alternative to the direct integration of a dedicated data bases. Guidelines for this case are provided in ETSI TR 103 527 V1.1.1 (2018-07) SmartM2M; Virtualized IoT Architectures with Cloud Back-ends.

OASIS

The Topology and Orchestration Specification for Cloud Applications (TOSCA) TC works to enhance the portability of cloud applications and services across their entire lifecycle. TOSCA enables the interoperable description of application and infrastructure cloud services, independent of the supplier creating the service, and any particular cloud provider or hosting technology. TOSCA is at the top of the list of “most used standards projects” in the Cloudwatch2 study. The OASIS TOSCA TC and ETSI NFV ISG cooperate to align their Network Functions Virtualisation (NFV) service models and specifications.

The Cloud Application Management for Platforms (CAMP) TC advances an interoperable protocol that cloud implementers can use to package and deploy their applications. CAMP defines interfaces for self-service provisioning, monitoring, and control. Common CAMP use cases include: moving on-premise applications to the cloud (private or public) or redeploying applications across cloud platforms from multiple vendors.

The OASIS Open Data Protocol (Odata) TC works to simplify the querying and sharing of data across disparate applications and multiple stakeholders for re-use in the enterprise, Cloud, and mobile devices. A REST-based protocol, OData builds on HTTP and JSON using URIs to address and access data feed resources. OASIS OData standards have been approved as ISO/IEC 20802-1:2016 and ISO/IEC 20802-2:2016.

The goal of the OASIS Virtual I/O Device (VIRTIO) TC is to simplify virtual devices, making them more extensible and more recognizable. It ensures that virtual environments and guests have a straightforward, efficient, standard, and extensible mechanism for virtual devices. Guest can use similar standard PCI drivers and discovery mechanisms for PCI devices of the VIRTIO family as for physical PCI devices.

OFE

Recently Open Forum Europe (OFE) carried out a study on behalf of the European Commission, entitled “Standards and Open Source: bringing them together”. The aim of this study was to analyse and make practical progress on the collaboration models between SDOs and cloud open source software development initiatives, and to develop a roadmap of actions to improve the integration of open source communities in the standard setting process. https://ec.europa.eu/digital-single-market/en/news/standards-and-open-source-bringing-them-together 

Other activities related to standardisation

BSI

Cloud Computing Compliance Controls Catalogue (C5)

The C5 defines a baseline for cloud security, divided into thematic sections (e.g. organisation of information security, physical security), using mostly recognised security standards. C5 outlines prerequisites for a conformity assessment using international standards (ISAE 3000, ISAE 3402), adding cloud specific requirements, especially for transparency.

C-SIGs

The cloud select industry groups as a contribution from Europe to the global cloud standardisation community.

GICTF

Global Inter-Cloud Technology Forum (GICTF) is promoting standardisation of network protocols and the interfaces through which cloud systems inter-work with each other, to promote international interworking of cloud systems, to enable global provision of highly reliable, secure and high-quality cloud services, and to contribute to the development Japan’s ICT industry and to the strengthening of its international competitiveness.

http://www.gictf.jp/index_e.html.

GAIA-X

Gaia-X aims at developing common requirements for a European data infrastructure based on standards which ensure transparency and interoperability. GAIA-X addresses this requirement by aligning network and interconnection providers, Cloud Solution Providers (CSP), High Performance Computing (HPC) as well as sector specific clouds and edge systems. https://www.data-infrastructure.eu/ ”

OCC

The Open Cloud Consortium (OCC) supports the development of standards for cloud computing and frameworks for interoperating between clouds; develops benchmarks for cloud computing; and supports reference implementations for cloud computing, preferably open source reference implementations. The OCC has a particular focus in large data clouds. It has developed the MalStone Benchmark for large data clouds and is working on a reference model for large data clouds. https://www.occ-data.org/

TM Forum

TM Forum: The primary objective of TM Forum’s Cloud Services Initiative is to help the industry overcome these barriers and assist in the growth of a vibrant commercial marketplace for cloud-based services. The centrepiece of this initiative is an ecosystem of major buyers and sellers who will collaborate to define a range of common approaches, processes, metrics and other key service enablers. https://www.tmforum.org/ioe/

SNIA

Storage Networking Industry Association (SNIA): The Cloud Work Group exists to create a common understanding among buyers and suppliers of how enterprises of all sizes and scales of operation can include cloud computing technology in a safe and secure way in their architectures to realise its significant cost, scalability and agility benefits. It includes some of the industry’s leading cloud providers and end-user organisations, collaborating on standard models and frameworks aimed at eliminating vendor lock-in for enterprises looking to benefit from cloud products and services. http://www.snia.org/cloud

(C.2) additional information

Open source projects address particular aspects of cloud computing (e.g. OpenStack (IaaS), the Open Networking Foundation (ONF), Cloud Foundry (PaaS), Docker (Container technology) and kubernetes) and as such, open source communities should be encouraged to collaborate with standardisation and submit their APIs for standardisation.

Report abusive content Share