基于等级保护的信息安全评估算法研究

doi:10.16180/j.cnki.issn1007-7820.2019.11.016

Abstract

Abstract:

The key issue for evaluating information security systems is the establishment and analysis of risk assessment indicators. Aiming at this problem, this paper proposed an information security risk assessment method based on hierarchical protection and establishes an information system security assessment model. Based on GBT 20984-2007, a hierarchical structure was established for host security and network security, and the calculation and analysis of the model were completed by using the weight calculation method RISK-Weight algorithm. The example's results showed that the evaluation method reduced the influence of human subjective factors and achieved a quantitative assessment of the security science of information systems.

Key words: information security, security assessment, AHP method, classified protection

CLC Number:

TN918

ZHA Hongze. Research on Information Security Evaluation Algorithm Based on Hierarchical Protection[J].Electronic Science and Technology, 2019, 32(11): 78-82.

Figures/Tables 7

Figure 1.

Table 1

Figure 2.

Figure 3.

Table 2

Table 3

Figure 4.

References 13

[1]	中国国家标准化管理委员会. GB/T20984-2007信息安全技术信息系统的风险评估规范[S]. 北京:中华人民共和国国家质量监督检验检疫总局, 2007.
	China National Standardization Management Committee. GB/T 20984-2007 information security technology information system risk assessment specification[S]. Beijing:General Administration of Quality Supervision, Inspection and Quarantine of the People’s Republic of China, 2007.
[2]	顾文强 . 信息系统安全风险评估方法的应用研究[D]. 无锡:江南大学, 2013.
	Gu Wenqiang . Applied research on information system security risk assessment method[D]. Wuxi:Jiangnan University, 2013.
[3]	付国庆, 张菊玲, 袁勤 . 改进的FAHP信息安全风险评估方法[J].电子设计工程, 2014(12):45-49.
	Fu Guoqing, Zhang Juling, Yuan Qin . Improved FAHP information security risk assessment method[J]. Electronic Design Engineering, 2014 ( 12):45-49.
[4]	徐丽娟 . 基于攻击图的工业控制网络安全隐患分析[D]. 北京:北京邮电大学, 2015.
	Xu Lijuan . Hidden danger analysis of industrial control network security based on attack graph[D]. Beijing: Beijing University of Posts and Telecommunications, 2015.
[5]	高青, 刘贵喜, 杨涨辉 , 等. 基于层次分析法与模糊运算的威胁评估算法[J]. 电子科技, 2008,21(5):61-64.
	Gao Qing, Liu Guixi, Yang Zhanghui , et al. Threat assessment algorithm based on analytic hierarchy process and fuzzy operation[J]. Electronic Science and Technology, 2008,21(5):61-64.
[6]	刘刚 . 网络安全风险评估、控制和预测技术研究[D]. 南京:南京理工大学, 2014.
	Liu Gang . Research on network security risk assessment,control and prediction technology[D]. Nanjing:Nanjing University of Technology, 2014.
[7]	张友鹏, 王亚惠, 杨妮 . 基于ANP和模糊证据理论的应答器系统风险评估方法研究[J].安全与环境学报, 2018(2):434-440.
	Zhang Youpeng, Wang Yahui, Yang Ni . Research on the risk assessment method of transponder system based on ANP and fuzzy evidence theory[J].Journal of Safety and Environment, 2018(2):434-440.
[8]	姜茸, 杨明 . 云计算安全风险研究[J].计算机技术与发展, 2014(3):126-129.
	Jiang Rong, Yang Ming . Cloud computing security risk research[J].Computer Technology and Development, 2014(3):126-129.
[9]	靳英伯 . 信息安全等级保护模型评测平台的设计与实现[D]. 济南:山东大学, 2015.
	Jin Yingbo . Design and implementation of information security grade protection model evaluation platform[D]. Jinan:Shandong University, 2015.
[10]	周健 . 云计算背景下的信息安全问题研究[J]. 现代电子技术, 2017,40(11):84-87.
	Zhou Jian . Research on information security in the context of cloud computing[J]. Modern Electronic Technology, 2017,40(11):84-87.
[11]	张元天, 刘福强, 陈泱 . 基于等级保护体系的信息安全风险评估方法研究[J].信息安全与通信保密, 2016(8):78-81,86.
	Zhang Yuantan, Liu Fuqiang, Chen Yang . Research on information security risk assessment method based on hierarchical protection system[J].InformationSecurity and Communication Confidentiality, 2016(8):78-81,86.
[12]	万雪莲, 张京河 . 基于攻、防的信息系统安全综合评估方法的研究[J]. 计算机科学, 2016,43(S1):322-327.
	Wan Xuelian, Zhang Jinghe . Research on comprehensive evaluation method of information system security based on attack and defense[J]. Computer Science, 2016,43(S1):322-327.
[13]	朱诚 . 基于层次分析法和模糊数学对桥梁运营风险评估[D]. 昆明:昆明理工大学, 2014.
	Zhu Cheng . Risk assessment of bridge operation based on analytic hierarchy process and fuzzy mathematics[D]. Kunming: Kunming University of Technology, 2014.

时间	评估对象	特点	性质
第1阶段 (1960~1970)	计算机	认识较简单,对风险评估仅限于保密性	保密性阶段
第2阶段 (1980~1990)	计算机、网络	认识渐深,风险评估增加可用性、完整性等更多属性	保护性阶段
第3阶段 (1990~今)	计算机、网络、信息系统	认识继续发展,风险评估增加可控性、不可否认性等更多安全属性	保障性阶段

标度	含义
1	具有同样的重要性
3	后者比前者重要性稍高
5	后者重要性明显高于前者
7	后者重要性大大高于前者
9	前者重要性可忽略,后者重要性显著
2,4,6,8	重要性处于上述相邻数值中间值

Research on Information Security Evaluation Algorithm Based on Hierarchical Protection

RichHTML

PDF (PC)

Like

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 13

Related Articles 11

Metrics

Comments

Recommended 0

[1]	JIN Xin,FENG Yi,YOU Xuexi,WANG Jiaxin. Research on Information Security Equipment Deployment Guarantee Technology [J]. Electronic Science and Technology, 2020, 33(8): 80-86.
[2]	LIU Chen,MA Sijun,NI Xueli. Attribute-Based Access Control for the Perception Layer of The Internet of Things [J]. Electronic Science and Technology, 2019, 32(9): 55-59.
[3]	XU Zhi. A Spectrum Feature Based Algorithm for Hiding Information in Digital Audio [J]. , 2015, 28(8): 84-.
[4]	ZHOU Sheng,ZHAO Junyi,GE Yuanpeng. Construction of a Combination of Active and Passive Defense of Smart Grid Information Security System [J]. , 2015, 28(6): 213-.
[5]	YAO Shu-Guang. A Trusted Network Information Security Technology for the E-commerce Platform [J]. , 2014, 27(1): 153-.
[6]	PENG Yang,MENG Lilin,LI Nian,LI Li. Design and Implementation of the High-speed Encryption Card Based on FPGA [J]. , 2013, 26(6): 42-.
[7]	SHEN Lei. Operating System Security Assessment Method for the Mobile Intelligent Terminal [J]. , 2012, 25(3): 38-.
[8]	LIU Liu, GAO Hui-Sheng, LI Cheng. Security Assessment Model of Power SCADA System Networks [J]. , 2012, 25(12): 116-.
[9]	HAN Jinsen,ZOU Tao,ZHANG Longjun. Research on Traitor Tracing Technology [J]. , 2012, 25(11): 105-.
[10]	ZHAO Yuan, WANG Huai-Jun, FANG Ding-Yi, TANG Zhan-Yong. Research on Security Access Control Based on SDT [J]. , 2011, 24(11): 96-.
[11]	PAN Xiao-Yong, ZHANG Lei, FAN Xue-Hui. Enhancing RFID-System Communication's Security by Digital Certificates [J]. , 2010, 23(11): 123-124.