信息系统安全度量与评估模型

信息技术安全评估标准GB17859定义了信息系统安全评估的安全要素集,并以等级的形式表示信息系统的安全度量.为区分各个安全要素在信息系统安全度量评估过程中表现出的不同特性,提出了组合独立性安全要素、组合互补性安全要素及组合关联性安全要素的概念,通过定义访问路径、规范路径及组件之间的相互关系,给出了信息系统安全度量的形式化评估模型及其实现.

Information System Security Metrics and Evaluation Model

Information technology security evaluation criteria GB 17859 represents the security metrics of information systems as different ratings and defines the security elements set for the security metrics evaluation.The concepts of composition independent security element,composition complementary security element and composition correlated security element are introduced to discriminate between the various characters of the security elements presented in the process of security metrics assessment.The formal evaluation model for information system security metrics and its implementation are also introduced based on the definitions of access path,regular path and the relationship between components.