Module 02 · Cloud Computing Models云计算模型
Community Cloud社区云
In this reading, you will learn about community cloud and how it is implemented with reference to Google Cloud as an example.
在本阅读中，您将了解社区云及其如何以谷歌云为例进行实施。
What is a community cloud? 什么是社区云？
A community cloud is defined by NIST SP 800-145 as:
社区云被 NIST SP 800-145 定义为：
“Cloud infrastructure [that] is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.”
云基础设施[专门为具有共同关注点（例如，使命、安全要求、政策和合规性考虑）的组织消费者群体提供]。它可能由社区中的一个或多个组织、第三方或它们的某种组合拥有、管理和运营，并且可能存在于本地或异地。
Why community cloud? 为什么选择社区云？
Community cloud approach is used by organizations for the following reasons:
社区云方法被组织用于以下原因：
- The community cloud members work under the same set of security controls.
社区云成员在相同的安全控制下工作。 - The approach provides the members the same attributes like citizenship and authorization controls while giving limited physical and/or logical access to resources.
该方法为成员提供与公民身份和授权控制相同的属性，同时限制对资源的物理和/或逻辑访问。 - It also supports data localization and some data sovereignty requirements based on the location of the community cloud’s data centers.
它还支持基于社区云数据中心位置的数据本地化和一些数据主权要求。 - The approach defines a perimeter security model encompassing the community cloud.
该方法定义了一个包括社区云的周界安全模型。
Implementation of software-defined community cloud 软件定义社区云的实施
To establish a security perimeter, most legacy community clouds depend on physical separation from other clouds. However, this implementation could not meet the advanced security, manageability, or compliance requirements of the industry.
为了建立安全边界，大多数传统社区云依赖于与其他云的物理隔离。然而，这种实现无法满足行业对高级安全、可管理性或合规性的要求。
In the modern architecture, a software-defined community cloud is designed to deliver the required benefits. Google Cloud is a software-defined approach that provides security and compliance assurances without the strict physical infrastructure constraints of legacy approaches. The Google community clouds use a combination of technologies referred to as “assured clouds” that can:
在现代架构中，软件定义的社区云旨在提供所需的好处。谷歌云是一种软件定义的方法，它提供了安全和合规性保证，而不受传统方法严格的物理基础设施限制。谷歌社区云采用了一种称为“保证云”的技术组合，可以实现以下功能：
- Define communities around common projects, security and compliance requirements, and policy.
定义围绕共同项目、安全合规要求和政策的社区。 - Separate shared community projects from other projects.
将共享社区项目与其他项目区分开来。 - Modify capabilities of a community’s boundary based on policy-controlled and audited configuration changes.
根据政策控制和审计的配置更改修改社区边界的功能。
Comparison between traditional and software-defined community cloud 传统与软件定义社区云的比较
The software-defined community cloud provides many benefits to the users in comparison to the traditional community cloud implementation. The following table depicts the comparison between the two implementations based on the characteristics as stated in the definition given by NIST.
软件定义的社区云相较于传统的社区云实现，为用户提供了许多好处。下表展示了基于 NIST 给出的定义中所述特性的两种实现之间的比较。
| Characteristic 特征 | NIST Definition SP 800-145 NIST 定义 SP 800-145 |
Traditional Cloud Community Implementation 传统云社区实现 |
Software-Defined Community Cloud 软件定义社区云 |
|---|---|---|---|
| Infrastructure Exclusivity 基础设施专有性 |
The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns 云基础设施是为具有共同担忧的组织中的特定消费者群体专用的 |
Separate data centers with separate infrastructure 独立的数据中心，配备独立的基础设施 |
Each project is effectively a private cloud with isolated infrastructure primitives 每个项目都是一个具有隔离基础设施原语的私有云 |
| All users subject to common security controls 所有用户均受通用安全控制措施约束 |
(implied) （暗示的） | Same security controls apply across exclusive infrastructure shared by the community 相同的网络安全控制适用于社区共享的专用基础设施 |
Assured Workloads controls are scoped to the community and enforced through terms of service 确保工作负载控制范围限于社区，并通过服务条款执行 |
| Personhood and citizenship of support staff 人格与支持人员公民权 |
It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, 它可能由社区中的一个或多个组织、第三方或它们的某种组合拥有、管理和运营 |
Personnel must be physically located at dedicated facilities 人员必须位于专用设施内 |
Access management service restricts support to personnel with required attributes (personhood, citizenship, work location, and more) 访问管理服务仅向具有所需属性（人格、国籍、工作地点等）的人员提供支持 |
| Data localization 数据本地化 | and it may exist on or off premises 并且可能存在于场所内或场所外 |
Community dedicated storage devices 社区专用存储设备 |
Enforced by software 强制执行软件 |
| Defined security parameter 定义的安全参数 |
(implied) （暗示的） | The community is the enclave 社区是飞地 |
Each project is its own enclave 每个项目都是自己的飞地 |
Software defined community cloud as a new type of “Government Cloud” 软件定义的社区云作为新型“政府云”
In Google Cloud Platform (GCP), a project is a unique, logical grouping of “infrastructure primitives.” In this context, an infrastructure primitive is any atomic unit of capacity in GCP – a virtual machine (VM), a persistent disk (PD), a storage bucket, and others. Projects are “global resources” that can be assigned infrastructure primitives from any region or zone.
在谷歌云平台（GCP）中，项目是一组独特的、逻辑上的“基础设施原语”。在这个语境下，基础设施原语是 GCP 中任何原子级别的容量单位——虚拟机（VM）、持久磁盘（PD）、存储桶等。项目是“全局资源”，可以从任何区域或区域分配基础设施原语。
Every project is an individual project separate from other customers’ projects. Low-level resources like hypervisors, blocks in our distributed blockstore that underlies Google Cloud Storage (GCS), and other components are isolated with resource abstractions that enforce the isolation both logically and cryptographically.
每个项目都是独立于其他客户项目的个体项目。像虚拟机管理程序、作为谷歌云存储（GCS）底层分布式块存储的块以及其他组件这样的低级资源，通过资源抽象进行隔离，这种隔离在逻辑上和加密上都是强制性的。
A Private Cloud deployment model is defined in NIST SP 800-145 as:
NIST SP 800-145 中将私有云部署模型定义为：
Cloud infrastructure [that] is provisioned for exclusive use by a single organization comprising multiple consumers (such as business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
云基础设施[专门]为单一组织（如业务单元）使用而配置。它可能由该组织、第三方或它们的组合拥有、管理和运营，并且可能存在于本地或异地。
When a project is created within GCP, the infrastructure primitives that are assigned to that project are scoped to only that project. This scoping of infrastructure primitives effectively creates an “enclave” per Project.
当在 GCP 中创建项目时，分配给该项目的基础设施原语仅限于该项目。这种基础设施原语的范围定义有效地为每个项目创建了一个“隔离区”。
When overlaid with Assured Workloads constraints for data residency, support personnel attributes, and security controls common to that community, these per-project private cloud enclaves become software-defined community clouds.
当叠加数据驻留、支持人员属性和该社区通用的安全控制等确保工作负载约束时，这些按项目划分的私有云区域便成为软件定义的社区云。
Benefits of a software-defined community cloud 软件定义社区云的优势
The approach Google Cloud has taken brings multiple benefits such as meeting security and compliance requirements. New hardware, new services, and improvements to existing services are accessed faster than in traditional community clouds. The process by which new cloud technology can be onboarded and made available is also faster. Overall efficiency is improved in this model due to the scale of infrastructure available to the community; this can translate to improved availability and performance. Security enhancements can be scaled and implemented more quickly.
谷歌云采取的方法带来了多重好处，如满足安全和合规要求。新硬件、新服务以及现有服务的改进都能比传统社区云更快地获得。新云技术上线和提供的流程也更快。由于社区可用的基础设施规模，整体效率得到提升；这可以转化为更高的可用性和性能。安全增强可以更快地扩展和实施。