MULTIGRAPH MODEL OF INFORMATION FLOWS FOR INFORMATION SECURITY ANALYSIS IN COMPUTER SYSTEMS

Abstract

The paper considers an approach to the formalized description of information transfer processes in information systems based on a model of elementary information flows. The relevance of the study is determined by the growing complexity of modern information systems, the increasing number of communication channels, and the need to improve formal methods for security analysis. In existing approaches, information flows are often treated only as auxiliary elements of architectural descriptions, while communication channels are not sufficiently formalized as independent security objects.

The study reviews existing solutions related to the application of information flow models in cybersecurity, threat modeling, and access control policy formation. It is shown that although information flow theory is applied to a wide range of systems, including cyber-physical systems, telemedicine platforms, SCADA systems, cloud services, IoT infrastructures, and general-purpose software systems, many existing approaches remain limited in their ability to represent heterogeneous communication channels and their role in threat realization.

To address this issue, the paper proposes a multigraph model of elementary information flows in an information system. In the proposed model, an elementary information flow consists of three components: two vertices representing information carriers and one interaction channel connecting them. Using graph theory notation, sets of users, software components, storage devices, and communication channels are defined. The communication channels are classified according to the environment and mode of interaction, including local and remote channels, as well as electromagnetic and virtual environments. This makes it possible to construct a finite set of elementary information flows for describing heterogeneous computer systems.

The practical applicability of the proposed model is demonstrated through the example of e-mail transmission and reception. The communication process is decomposed into a sequence of elementary information flows that together form a complete flow scheme. The example shows that any information transfer process in the system can be reduced to a finite set of elementary flows, while the completeness and precision of the resulting scheme depend on the accuracy of the system element description.

The results indicate that the proposed approach provides a formal basis for further security analysis by enabling communication channels to be treated as independent objects of protection. The model can be used for threat modeling, structured system description, and access control policy development. In addition, its application reduces the level of subjectivity in system analysis by replacing intuitive threat identification with a formalized description of information flows. Future research may focus on using the proposed model as a basis for classifying threats to confidentiality, integrity, and availability of information.