机密稳健复杂系统安全性评估方法

左金鑫; 郭子裕; 李瑾; 张洁; 陆月明

doi:10.11959/j.issn.2096-109x.2019017

您当前的位置：

首页 >

文章列表页 >

机密稳健复杂系统安全性评估方法

学术论文 | 更新时间：2024-06-03

- 机密稳健复杂系统安全性评估方法
- Security evaluation method for confidential and stable complex systems
- 网络与信息安全学报 2019年5卷第2期页码：58-65
- 作者机构：
  
  1. 北京邮电大学，北京 100876
  2. 可信分布计算与服务教育部重点实验室，北京 100876
  3. 军事科学研究院系统工程院，北京 100091
- 作者简介：
  
  [ "左金鑫（1992- ），女，山东德州人，北京邮电大学博士生，主要研究方向为网络空间安全。" ]
  [ "郭子裕（1994- ），男，河北石家庄人，北京邮电大学博士生，主要研究方向为网络空间安全。" ]
  [ "李瑾（1996- ），女，黑龙江齐齐哈尔人，北京邮电大学硕士生，主要研究方向为网络空间安全。" ]
  [ "张洁（1981- ），女，军事科学研究院系统工程院教授，主要研究方向为信息安全。" ]
  [ "陆月明（1969- ），男，江苏苏州人，北京邮电大学教授、博士生导师，主要研究方向为分布式计算、网络空间安全。" ]
- 基金信息：
  
  The Research of Key Technology and Application of Information Security Certification Project(2016YFF0204001)
- DOI：10.11959/j.issn.2096-109x.2019017
  中图分类号： TP309
- 网络首发：2019-04，
  
  纸质出版：2019-04-15
- 稿件说明：
移动端阅览
左金鑫, 郭子裕, 李瑾, 等. 机密稳健复杂系统安全性评估方法[J]. 网络与信息安全学报, 2019,5(2):58-65.

Jinxin ZUO, Ziyu GUO, Jin LI, et al. Security evaluation method for confidential and stable complex systems[J]. Chinese Journal of Network and Information Security, 2019, 5(2): 58-65.
左金鑫, 郭子裕, 李瑾, 等. 机密稳健复杂系统安全性评估方法[J]. 网络与信息安全学报, 2019,5(2):58-65. DOI： 10.11959/j.issn.2096-109x.2019017.

Jinxin ZUO, Ziyu GUO, Jin LI, et al. Security evaluation method for confidential and stable complex systems[J]. Chinese Journal of Network and Information Security, 2019, 5(2): 58-65. DOI： 10.11959/j.issn.2096-109x.2019017.

摘要

机密稳健复杂系统具有高机密性要求、持续稳定运行需求、网络结构复杂等特点，但现有评估模型安全目标维度单一，缺乏指标间关联性分析。鉴于此，提出了基于指标关联性分析的综合安全评估模型，确立涵盖产品、系统和服务3个层面的机密性、可用性、可控性、可鉴别性、人员组织、风险管理、企业定级、可持续性8个安全目标。以智慧医疗物联网机密性为例，构建了基于指标关联性的排序确权算法，采用模糊综合评价法，对所选系统进行评估。

Abstract

Confidential and stable complex systems are characterized by high confidentiality requirements

continuous and stable operation requirements

and complex network structure

but existing evaluation models has a single dimension of security objectives and lack the correlation analysis among indicators.In view of this

a comprehensive security evaluation model based on the correlation analysis of indicators is proposed and eight security objectives covering confidentiality

availability

controllability

identifiability

personnel organization

risk management

enterprise grading and sustainability at three levels of product

system and service have been established.Taking the confidentiality of the smart medical IoT as an example

a sorting and weight confirmation algorithm based on index correlation is constructed

and the fuzzy comprehensive evaluation method is used to evaluate the selected system.

关键词

Keywords

references

GRÜNBAUER J , HOLLMANN H , JÜRJENS J , et al . Modelling and verification of layered security protocols:a bank application [C ] // International Conference on Computer Safety . 2003 .

CIGRE Task Force 38.03.12.Power system security assessment:a position paper [J ] . Electra , 1997 ,( 175 ): 49 - 77 .

XIAO F , MCCALLEY J D . Risk-based security and economy tradeoff analysis for real-time operation [J ] . IEEE Transactions on Power Systems , 2007 , 22 ( 4 ): 2287 - 2288 .

YANG Y , WU L , YIN G , et al . A Survey on security and privacy issues in Internet of things [J ] . IEEE Internet of Things Journal , 2017 , 4 ( 5 ): 1250 - 1258 .

ASPINALL D , WOLTERS M . POSTER:weighing in eHealth security [C ] // Sigsac Conference on Computer and Communications Security . 2016 : 1832 - 1834 .

YANG LEI , HUMAYED A , LI FENGJUN . A multi-cloud based privacy-preserving data publishing scheme for the Internet of things [C ] // Conference on Computer Security Applications . 2016 : 30 - 39 .

赵庆兰 . 一种基于 CC 的网络安全评估模型 [J ] . 计算机安全 , 2008 ( 3 ): 42 - 43 .

ZHAO Q L . A network security evaluation model based on CC [J ] . Computer Security , 2008 ( 3 ): 42 - 43 .

陈勇 , 莫玮 , 王勇 , 等 . 一种基于 CC 的智能电视应用软件安全评估方法 [J ] . 电视技术 , 2014 , 38 ( 8 ): 72 - 74 +82.

CHEN Y , MO W , WANG Y , et al . Security assessment method of smart TV’s application based on CC [J ] . Video Engineering , 2014 , 38 ( 8 ): 72 - 74 .

YANG Y H , SHEN Y J , ZHANG G D , et al . The grading scheme based on fuzzy comprehensive evaluation and analytic hierarchy process for classified protection of information system [C ] // 5th IEEE International Conference on Software Engineering and Service Science (ICSESS) . 2014 .

赵艳玲 . 浅谈美国《提升关键基础设施网络安全框架》 [J ] . 信息安全与通信保密 , 2015 ( 5 ): 16 - 21 .

ZHAO Y L . Brief probe into “Framework for improving critical infrastructure cybersecurity” [J ] . Information Security and Communications Privacy , 2015 ( 5 ): 16 - 21 .

逄淑宁 , 封莎 . 信息技术安全评估通用准则CC综述 [J ] . 电信网技术 , 2011 ( 8 ): 59 - 63 .

FENG S N , FENG S . Review on information technology security assessment common criteria CC [J ] . Information and Communications Technology and Policy , 2011 ( 8 ): 59 - 63 .

张秋瑾 . 云计算隐私安全风险评估 [D ] . 昆明:云南大学 , 2015 .

ZHANG Q J . Cloud computing privacy security risk assessment [D ] . Kunming:Yunnan University , 2015 .

PANG H M , LIU H Z . Research on information engineering security surveillance risk assessment based on page rank algorithm [J ] . Computer Security , 2014 ( 8 ): 17 - 20 .

郑改成 . 基于物联网下的智慧医疗体系架构及其应用 [J ] . 山西电子技术 , 2016 ( 5 ): 66 - 68 .

ZHENG G C . Architecture and application of the smart healthcare based on Internet of things [J ] . Shanxi Electronic Technology , 2016 ( 5 ): 66 - 68 .

张玉清 , 周威 , 彭安妮 . 物联网安全综述 [J ] . 计算机研究与发展 , 2017 , 54 ( 10 ): 2130 - 2143 .

ZHANG Y Q , ZHOU W , PENG A N . Survey of Internet of things security [J ] . Journal of Computer Research and Development , 2017 , 54 ( 10 ): 2130 - 2143 .

杨颖 , 朱君茹 , 袁媛 , 等 . 医疗物联网的发展现状、问题与对策 [J ] . 中国卫生信息管理杂志 , 2015 ( 3 ): 298 - 303 .

YANG Y , ZHU J R , YUAN Y , et al . Development status,problems and countermeasures of medical Internet of things [J ] . Chinese Journal of Health Informatics and Management , 2015 ( 3 ): 298 - 303 .

浏览量

724

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

政府开放数据的国家安全风险评估模型研究