机密稳健复杂系统安全性评估方法

doi:10.11959/j.issn.2096-109x.2019017

Abstract

Abstract:

Confidential and stable complex systems are characterized by high confidentiality requirements,continuous and stable operation requirements,and complex network structure,but existing evaluation models has a single dimension of security objectives and lack the correlation analysis among indicators.In view of this,a comprehensive security evaluation model based on the correlation analysis of indicators is proposed and eight security objectives covering confidentiality,availability,controllability,identifiability,personnel organization,risk management,enterprise grading and sustainability at three levels of product,system and service have been established.Taking the confidentiality of the smart medical IoT as an example,a sorting and weight confirmation algorithm based on index correlation is constructed,and the fuzzy comprehensive evaluation method is used to evaluate the selected system.

Key words: confidential and stable complex system, information security evaluation, sort algorithm, fuzzy comprehensive evaluation method

CLC Number:

TP309

Jinxin ZUO,Ziyu GUO,Jin LI,Jie ZHANG,Yueming LU. Security evaluation method for confidential and stable complex systems[J]. Chinese Journal of Network and Information Security, 2019, 5(2): 58-65.

Figures/Tables 5

References 16

[1]	GRüNBAUER J , HOLLMANN H , JüRJENS J ,et al. Modelling and verification of layered security protocols:a bank application[C]// International Conference on Computer Safety. 2003.
[2]	CIGRE Task Force 38.03.12.Power system security assessment:a position paper[J]. Electra, 1997,(175): 49-77.
[3]	XIAO F , MCCALLEY J D . Risk-based security and economy tradeoff analysis for real-time operation[J]. IEEE Transactions on Power Systems, 2007,22(4): 2287-2288.
[4]	YANG Y , WU L , YIN G ,et al. A Survey on security and privacy issues in Internet of things[J]. IEEE Internet of Things Journal, 2017,4(5): 1250-1258.
[5]	ASPINALL D , WOLTERS M . POSTER:weighing in eHealth security[C]// Sigsac Conference on Computer and Communications Security. 2016: 1832-1834.
[6]	YANG LEI , HUMAYED A , LI FENGJUN . A multi-cloud based privacy-preserving data publishing scheme for the Internet of things[C]// Conference on Computer Security Applications. 2016: 30-39.
[7]	赵庆兰 . 一种基于 CC 的网络安全评估模型[J]. 计算机安全, 2008(3): 42-43.
	ZHAO Q L . A network security evaluation model based on CC[J]. Computer Security, 2008(3): 42-43.
[8]	陈勇, 莫玮, 王勇 ,等. 一种基于 CC 的智能电视应用软件安全评估方法[J]. 电视技术, 2014,38(8): 72-74+82.
	CHEN Y , MO W , WANG Y ,et al. Security assessment method of smart TV’s application based on CC[J]. Video Engineering, 2014,38(8): 72-74.
[9]	YANG Y H , SHEN Y J , ZHANG G D ,et al. The grading scheme based on fuzzy comprehensive evaluation and analytic hierarchy process for classified protection of information system[C]// 5th IEEE International Conference on Software Engineering and Service Science (ICSESS). 2014.
[10]	赵艳玲 . 浅谈美国《提升关键基础设施网络安全框架》[J]. 信息安全与通信保密, 2015(5): 16-21.
	ZHAO Y L . Brief probe into “Framework for improving critical infrastructure cybersecurity”[J]. Information Security and Communications Privacy, 2015(5): 16-21.
[11]	逄淑宁, 封莎 . 信息技术安全评估通用准则CC综述[J]. 电信网技术, 2011(8): 59-63.
	FENG S N , FENG S . Review on information technology security assessment common criteria CC[J]. Information and Communications Technology and Policy, 2011(8): 59-63.
[12]	张秋瑾 . 云计算隐私安全风险评估[D]. 昆明:云南大学, 2015.
	ZHANG Q J . Cloud computing privacy security risk assessment[D]. Kunming:Yunnan University, 2015.
[13]	PANG H M , LIU H Z . Research on information engineering security surveillance risk assessment based on page rank algorithm[J]. Computer Security, 2014(8): 17-20.
[14]	郑改成 . 基于物联网下的智慧医疗体系架构及其应用[J]. 山西电子技术, 2016(5): 66-68.
	ZHENG G C . Architecture and application of the smart healthcare based on Internet of things[J]. Shanxi Electronic Technology, 2016(5): 66-68.
[15]	张玉清, 周威, 彭安妮 . 物联网安全综述[J]. 计算机研究与发展, 2017,54(10): 2130-2143.
	ZHANG Y Q , ZHOU W , PENG A N . Survey of Internet of things security[J]. Journal of Computer Research and Development, 2017,54(10): 2130-2143.
[16]	杨颖, 朱君茹, 袁媛 ,等. 医疗物联网的发展现状、问题与对策[J]. 中国卫生信息管理杂志, 2015(3): 298-303.
	YANG Y , ZHU J R , YUAN Y ,et al. Development status,problems and countermeasures of medical Internet of things[J]. Chinese Journal of Health Informatics and Management, 2015(3): 298-303.

Metrics

Recommended 0

No Suggested Reading articles found!

安全目标M_ST_i	一级指标u_j	二级指标u_jp
		密钥管理（u₁₁）
		用户名、密码的存储、操作（u₁₂）
		证书管理机构CA（u₁₃）
	基础安全设施和安全服务（u₁）	证书发布（u₁₄）
		安全设备管理（u₁₅）
		安全算法API（u₁₆）
机密性（M_ST₁）		增强的安全代理（u₁₇）
机密性（M_ST₁）		数据传输加密处理，保证数据完整性（u₂₁）访问控制（u₂₂）
	用户数据保护（u₂）	数据鉴别-签名（u₂₃）
		数据源认证（u₂₄）
		数据存储加密（u₂₅）
		导入数据的控制（u₂₆）
		隐私数据分布存放（u₃₁）
	统一隐秘管理（u₃）	密文搜索（u₃₂）
		提供隐私处理服务（u₃₃）

	u₁₁	u₁₂	"	u₃₃
u₁₁	0	10	"	5
u₁₂	8	0	"	8
#	#	#	%	#
u₃₃	8	4	"	0

评价项目	很低	低	中	高	很高
u₁₁	0.1	0.15	0.1	0.5	0.25
u₁₂	0.05	0.05	0.075	0.375	0.45
#	#	#	#	#	#
u₃₃	0.125	0.175	0.225	0.25	0.225

Security evaluation method for confidential and stable complex systems

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 5

References 16

Related Articles 1

Metrics

Recommended 0