投保抑或认证下云平台的安全信息披露策略研究

Research on Security Disclosure Strategies for Cloud Platforms under Insurance or Certification

针对一个由云应用开发商和云平台运营商构成的云服务供应链,构建信号博弈和信息共享模型,对比分析云平台运营商在仅投保、仅认证和既投保又认证3种情境下的最优安全信息披露策略,并讨论云认证对消费者剩余和社会福利的影响。研究发现:基于投保水平的信号传递可以实现分离均衡,但当运营成本小于其阈值时,云平台运营商需承担信号成本;当云认证带给用户的效用足够高时,云平台运营商进行云认证是有利可图的;无论云认证效用水平如何,云平台运营商会选择既投保又认证的双策略;政府对云认证的补贴能有效提升消费者剩余和社会总福利。

Aiming at a cloud service supply chain composed of one cloud application developer and one cloud platform operator,a signal game model and an information sharing model are constructed to compare and analyze the optimal security information disclosure strategies of the cloud platform operator under three scenarios:only insured,only certified,and both insured and certified,and the effects of cloud authentication on consumer surplus and social welfare are discussed.The research shows that signaling by the level of insurance can realize the separating equilibrium,but the cloud platform operator must bear the signaling cost when operating cost is less than its threshold.The cloud platform operator is profitable when cloud authentication brings users a high utility.Regardless of utility levels of cloud certification,the cloud platform operator prefers the dual strategy of both insurance and certification;and governmental subsidies for cloud certification can effectively enhance consumer surplus and total social welfare.