Trust Domains - A framework for modelling and designing e-service infrastructures for controlled sharing of information

对于企业和政府来说，确保信息在多个合作组织中流向正确的人正变得越来越重要。然而，一方面是共享信息带来的生产力和功能收益，另一方面是泄露和开放IT系统的风险，两者之间存在权衡。可信计算和虚拟化的最新发展可以灵活地解决这些权衡问题，因为它们允许创建具有可配置安全属性的策略控制IT系统。协作的、安全的共享解决方案可以通过创建动态的“信任域”来实现——我们建议在所有级别的策略-服务-基础设施堆栈之间探索这一概念——来执行信息流和配置策略。我们提出了一个以客户为导向的项目，该项目从警察部队及其合作机构内部的信息共享示例开始。基于对所需流和策略的实际理解，我们将开发一个抽象框架，用于限定信息流的类型和相关风险的相应模型。这允许过程所有者描述他们的需求和关注点。我们将研究如何限定信息流并将其映射到信任域配置，在构建IT服务时导出支持解决方案架构师的指南和模板，并扩展我们的分析和建模工具集，以帮助利益相关者了解与信息流和执行机制相关的风险。基于新方法和工具集创建和操作具有增强信任和安全属性的新电子服务是有商业机会的。我们建议的框架采用业务驱动的方法来处理风险、信任和安全性，并涵盖流程和系统分析、设计、配置、安全策略、人工角色和操作管理的各个方面。我们通过拥有模型、工具和方法来创建价值主张，这些模型、工具和方法允许我们弥合业务级别风险与系统配置和策略设计之间的当前差距。因此，将服务需求映射到可信的平台、领域和基础设施上。该项目补充并扩展了正在进行的由tsb资助的信任经济学工作，以及由HP的英国企业服务部门开创和利用的复杂性、风险和弹性管理工作。HP Enterprise Services和HP Labs， Bristol都认为，将高层激励模型和信任领域的系统设计连接起来，将是一个独特的全球差异化因素，不仅与US-NITRD的“改变游戏规则”主题一致，而且在提出综合方法方面领先于他们。本项目的学术部分将促进下列发展，以支持本方案：-在社会技术系统堆栈（政策-服务-基础结构）的各级和各级之间的信任领域概念；-数学系统建模技术，以支持对信任域概念的属性、动态和应用进行推理的工具和方法；-对技术、设计和架构属性进行彻底的分类，这些属性会在部署的服务中产生不同的信任特征；-对组件之间的信任和期望的质量进行建模，以便能够在给定的上下文中对基于不同架构范例的解决方案进行有意义的比较。目标市场：企业内部和政府内部的数据中心和“云”，其严格的信息流控制要求目前的提供商无法满足。

Ensuring flows of information to the right people over multiple collaborating organisations is becoming increasingly important for both business and government. There are, however, trade-offs between the productivity and functional gains from sharing information, on the one hand, and the risks of leakage and opening up IT systems, on the other. Recent developments in trusted computing and virtualization can address these trade offs in a flexible manner, as they allow for the creation of policy controlled IT systems with configurable security properties. Collaborative, secure sharing solutions can be realized through the creation of dynamic 'Trust Domains' --- a notion that we propose to explore at and between all levels of the policy-service-infrastructure stack --- that enforce information flow and configuration policies. We propose a customer-driven project that starts out from examples of information sharing within police forces and agencies they work with. Based on a practical understanding of the required flows and policies, we will develop an abstract framework for qualifying types of and flows of information and a corresponding model of the associated risks. This allows process owners to describe their requirements and concerns. We will research how to qualify and map information flows to Trust Domain configurations, derive guidelines and templates for supporting solution architects in building IT services, and extend our set of analytics and modelling tools to help stakeholders gain an understanding of the risks associated with information flows and enforcement mechanisms.There are business opportunities for creating and operating new e-services with enhanced trust and security properties based on new methodologies and toolsets. The framework we suggest takes a business driven approach to risk, trust and security and covers aspects of process and system analysis, design, configuration, security policy, human roles, and operational management. We create a value proposition by having the models, tools and methodologies that allows us to bridge the current gap between business level risk and system configuration and policy design. Hence mapping service needs onto trusted platforms, domains, and infrastructureThe project complements and expands ongoing, TSB-funded work on trust economics as well as on complexity, risk, and resilience management pioneered and exploited by HP's UK Enterprise Services. Both HP Enterprise Services and HP Labs, Bristol believe that bridging high-level incentive models and systems design for trust domains would be a unique global differentiator, not only aligned with US-NITRD 'game-changing' themes, but ahead of them in suggesting an integrated approach. The academic components of this project will contribute the following developments in support of this programme: - The concept of Trust Domain, at and between the various levels of the socio-technical system stack (policy-service-infrastructure); - Mathematical systems modelling technologies to support tools and methodologies for reasoning about the properties, dynamics, and applications of the Trust Domain concept; - A thorough taxonomy of technical, design, and architectural properties which give rise to different trust characteristics in deployed services; - Modelling the quality of trust and expectations among components, to the extent of being able to make a meaningful comparison of solutions based on different architectural paradigms, within a given context.Targeted market: intra-corporate and intra-governmental data centres and 'clouds' whose stringent information flow control requirements cannot be met by today's providers.