Denning's lattice model provided secure information flow analyses with an intuitive mathematical foundation: the lattice ordering determines permitted flows. We examine how this framework may be extended to support the flow of information between autonomous organisations, each employing possibly quite different security lattices and information flow policies. We propose a connection framework that permits different organisations to exchange information while maintaining both security of information flow as well as their autonomy in formulating and maintaining security policies. Our prescriptive framework is based on the rigorous mathematical framework of Lagois connections proposed by Melton, together with a simple operational model for transferring object data between domains. The merit of this formulation is that it is simple, minimal, adaptable and intuitive. We show that our framework is semantically sound, by proving that the connections proposed preserve standard correctness notions such as non-interference. We then illustrate how Lagois theory also provides a robust framework and methodology for negotiating and maintaining secure agreements on information flow between autonomous organisations, even when either or both organisations change their security lattices. Composition and decomposition properties indicate support for a modular approach to secure flow frameworks in complex organisations. We next show that this framework extends naturally and conservatively to the Decentralised Labels Model of Myers et al. - a Lagois connection between the hierarchies of principals in two organisations naturally induces a Lagois connection between the corresponding security label lattices, thus extending the security guarantees ensured by the decentralised model to encompass bidirectional inter-organisational flows.

中文翻译：

---

安全信息流连接

Denning 的格模型提供了具有直观数学基础的安全信息流分析：格排序决定了允许的流。我们研究了如何扩展该框架以支持自治组织之间的信息流，每个自治组织可能采用完全不同的安全格和信息流策略。我们提出了一个连接框架，允许不同组织交换信息，同时保持信息流的安全性以及它们在制定和维护安全策略方面的自主权。我们的规范框架基于 Melton 提出的严格的 Lagois 连接数学框架，以及用于在域之间传输对象数据的简单操作模型。这个公式的优点是它简单、最小、适应性强且直观。我们证明我们的框架在语义上是合理的，通过证明所提出的连接保留了标准的正确性概念，例如不干扰。然后，我们说明拉戈伊斯理论如何还提供了一个强大的框架和方法，用于协商和维护自治组织之间信息流的安全协议，即使其中一个或两个组织改变了它们的安全格。组合和分解属性表明支持模块化方法来保护复杂组织中的流框架。我们接下来表明，该框架自然而保守地扩展到 Myers 等人的去中心化标签模型。