支持中国墙策略的云组合服务信息流控制模型

摘要

由于所属服务提供商在商业上的竞争关系,云组合服务的组件服务之间可能存在利益冲突,必须对云组合服务的信息流进行控制以避免敏感信息在冲突组件服务间流动.针对云组合服务中的利益冲突问题,在构建云组合服务加权有向图模型的基础上,形式地描述了复杂组合结构下的信息流,定义了云服务的联盟关系与数据的依赖关系的概念,并将中国墙策略中的冲突关系扩展为组合冲突关系.在此基础上,提出了一种支持中国墙策略的云组合服务信息流控制模型(CW-CCSIFC),给出了模型的形式化描述及相关定理的证明.分析表明,CW-CCSIFC模型可以防止有利益冲突的云服务间的非法信息流动,保护云组合服务的信息流安全.%Due to the conflict of interest between the component services of the cloud composite service from different service providers,it is necessary to control the information flow of the cloud services to avoid the flow of sensitive information between the conflicting component services.For the conflict of interest in cloud composite service,it was formally described that the information flow of complex composite structure with the weighted directed graph model of cloud composite service,and defined that the concept of the dependency relation of data and the alliance relation of cloud services.Moreover,the conflict of interest relation was extended to the composite service-conflict of interest relation in Chinese Wall policy.Based on this,the Chinese Wall-based Cloud Composite Service Information Flow Control (CW-CCSIFC) model was proposed and the formal description as well as the proof of the relevant theorems was given.The analysis shows that the CW-CCSIFC model can block the illegal information flow between cloud services with conflicting interests and protect the information flow security of cloud composite service.