基于GB/T 20274的信息系统安全技术保障评估及计算机实现

GB/T 20274-Based Information System Security Technical Assurance Evaluation and Computer Realization

国家标准GB/T 20274定义了信息系统的安全技术保障要素集,并建议以能力成熟度等级的形式度量信息系统的安全技术保障性。本文首先对安全技术保障度量的能力成熟度等级进行量化处理;其次将信息系统组件的安全技术保障性表示成向量的形式,在向量和向量∞-范数的基础上重新阐述了信息系统的安全技术保障模型;最后,给出了信息系统的安全技术保障的计算机实现算法。仿真实验结果验证了本文算法能有效地实现信息系统的安全技术保障的评估。

National criteria GB/T 20274 defines the set of security technical assurance elements for the evaluation of information system security technical assurance, and provides security technical assurance metrics with different levels of capability maturity model. This paper firstly quantifies the security technical assurance metric levels, and then restates information system security technical assurance with the use of mathematical concepts, such as vector and vector infinity norm, and finally develops an effective algorithm for evaluating capability maturity levels of information systems in security technical assurance. The simulation shows that the proposed algorithm can effectively realize the security technical assurance evaluation of information systems.