面向软件众包协同资源的信任管理和评估方法研究

Software crowdsourcing is a novel, open and collaborative software development model, which utilizes the cooperation between developer resources and software resources to realize the complex software projects. However, the lack of mutual trust foundation makes it difficult for software developers to build trustworthy collaborations, and brings about great challenges for multi-source components to realize secure software compositions. Focusing on the trust management and evaluation for the cooperative resources in the software crowdsourcing platforms, this project will provide some effective solutions to the trustworthy collaboration issue among unknown software developers and secure composition issue among multi-source software components, respectively. Firstly, to eliminate malicious trust information across different crowdsourcing platforms, this project will explore the trust migration and evaluation methods for individual developer based on the context information and text review information. Secondly, to establish trust management for the groups of collaborative developers, this project will study the modelling method for multidimensional trust attributes, and establish the dynamic authorization and update method in accordance with attribute-based encryption. Finally, this project will research on the trust aggregation principles at component level based on the lattice-trust model, and research on the trust evaluation principles for complex software structures at composite level based on covert channel analysis, which will guarantee the security of critical components in the trustworthy software composition. The efficiency and feasibility of our solutions will be validated through theoretical analysis and prototype system implementation. The research results of this project will improve the trustworthiness of the cooperative resources in the software crowdsourcing. Furthermore, these results will lay a solid foundation for the sustainable development of crowdsourcing environments.

软件众包是一种新型开放式协作软件开发模式，通过开发者资源与软件资源的有效协同快速实现复杂软件项目。然而，该模式下信任基础的缺失对开发者的可信协作造成困难，同样对软件组件的安全组合带来挑战。本项目针对资源协同过程中信任管理与评估问题，分别对未知开发者的可信协作和多源组件的安全组合提供解决方案。首先，研究基于上下文和文本评价信息的参与者信任评估方法，有效消除跨平台信任迁移的恶意信息，实现动态多维个体信任的快速建立。其次，基于多维信任对参与者授权属性进行建模，形成与属性加密的关联的动态授权与更新方法，实现群体资源的可信协作。最后，研究组件级多级信任聚合评估规则，以及基于隐通道分析的复杂结构软件可信性评估模型，在组件级和组合级形成联动实现关键组件保障的可信服务组合方法。本项目预期通过理论分析和原型系统检验方案的有效性和可行性。研究成果将提高软件众包平台协同的可信性，为众包环境可持续发展奠定基础。

本项目着重围绕软件众包环境资源协同过程中信任管理与评估问题，分别对未知开发者的可信协作和多源组件的安全组合提供解决方案，研究多维动态开发者信任评估方法、基于信任的动态授权与更新方法、基于隐通道分析的可组合信任评估方法、软件全流程数据的隐私保护与安全发布方法。近3年来，项目组取得了一系列的研究成果，共发表学术论文12篇，其中CCF推荐的B类期刊论文1篇、CCF推荐的C类期刊论文1篇以及中科院1区论文1篇，SCI检索论文7篇；申请国家发明专利1项。.项目组代表成果包括：（1）提出了一种面向多用户开发服务的信任评估模型与信息流聚合签名模型，解决复合服务的可信组合问题；（2）提出了一种可信的多用户权限动态分配方案，能够统计学习参与者信任度，保障多用户环境下的公平性和有效性；（3）提出了一种邻近用户的信任感知方法，解决团队协作信任快速建立问题；（4）设计并实现了一种物联网开放共享平台，实现多用户协作的软件开发与软件安全发布；（5）提出了一种复合服务信任分解方法，能够对黑盒服务信任分析，解决协作过程中多维度信任评估问题。.本项目的研究成果将为软件众包环境下的协同资源的信任管理和评估提供重要的理论基础和技术支持。