Risk assessment report checking method and system and storage medium

Abstract

The invention provides a risk assessment report inspection method and system and a storage medium. A risk assessment report detection server obtains an asset definition file, a TARA file, a risk value calculation model and an STRIDE model; according to the method, the asset category detection, the security attribute detection, the risk value detection and the threat scene description detection are automatically executed in parallel, an automatic tool can be developed in the business field, the operability is high, and the efficiency of checking the risk assessment report by auditing personnel and the accuracy of marking the risk assessment report problem can be improved.

Description

Technical Field

[0001] The present invention relates to the field of text detection, and in particular to a method, system and storage medium for checking a risk assessment report. Background Art

[0002] In the automotive cybersecurity vehicle model certification scenario, TARA analysis is an important task, and there are corresponding regulations in ISO 21434 and GB. As the work output of TARA analysis, TARA report is a key inspection item in compliance review. At present, in order to implement the inspection of TARA report, the audit agency adopts the method of collecting a large amount of vehicle model information and manually checking and verifying it to ensure the comprehensiveness and consistency of TARA report.

[0003] The existing TARA report inspection method relies on manual operation, which has high requirements in terms of time consumption, operability, and personnel quality. It is unable to automatically inspect the text and has low operability.

[0004] This patent designs a risk assessment report inspection method and system, which solves two existing problems: 1. It has strong logic and can form a set of standardized inspection paths; 2. It has strong operability and can develop automated inspection tools based on this method and system. Summary of the invention

[0005] In view of the above problems, the present invention proposes a risk assessment report inspection method, system and storage medium to form a set of standardized inspection paths to improve operability.

[0006] In a first aspect, the present invention provides a method for checking a risk assessment report, comprising: S1. The risk assessment report detection server obtains the asset definition file, TARA file, risk value calculation model, and STRIDE model; S2. Execute asset category detection to determine whether the asset category detection is completed; S3. If the asset category detection has been completed, a security attribute detection is performed and it is determined whether the security attribute detection is completed; S4. If the security attribute detection is completed, a risk value detection is performed, and it is determined whether the risk value detection is completed; S5. If the risk value detection is completed, the threat scenario description detection is performed, and it is determined whether the scenario description detection is completed; S6. If the scene description detection is completed, all detection documents are output and a prompt indicating that the detection is completed is displayed.

[0007] Further, in the asset category detection process; The asset categories extracted in TARA include: components, data streams, and external storage.

[0008] Furthermore, the asset categories specified in the asset definition only include: components and data flows; The asset definition specifies the range of security attributes contained in each asset category.

[0009] Furthermore, external storage falls into the illegal asset class.

[0010] Furthermore, in the asset category detection process and the security attribute detection process, the TARA and the asset definition are used as input files.

[0011] Furthermore, in the security attribute detection process, if there is a security attribute A corresponding to an asset category in the TARA file that is not within the scope of security attributes included in the asset category recorded in the asset definition, then the security attribute A corresponding to the asset category is marked in the security attribute detection file; A is a set.

[0012] Furthermore, in the risk value detection process, the TARA and the risk value calculation model are input files.

[0013] Furthermore, in the scene description detection process, the TARA and the STRIDE models are input files.

[0014] In a second aspect, the present invention provides a risk assessment report inspection system, the system comprising: an asset category detection component, a security attribute detection component, a risk value detection component, and a scenario description detection component, for executing any risk assessment report inspection method.

[0015] In a third aspect, the present invention further proposes a readable storage medium, in which instruction codes are stored for being called by a processor to execute any method for checking a risk assessment report.

[0016] The beneficial effects of the present invention are as follows: 1. A method for checking risk assessment reports is provided, which is highly operational. This method can be used to develop automated tools in this business field, improve the efficiency of auditors in checking risk assessment reports, and improve the accuracy of auditors' marking of risk assessment report issues.

[0017] 2. After obtaining the asset definition file, TARA file, risk value calculation model, and STRIDE model, set up automated file reading, extract the corresponding parameters and re-verify based on the corresponding parameters. For example, recalculate the risk value based on the impact rating and attack feasibility rating through the risk calculation model, and use the STRIDE model to compare the threat type corresponding to the extracted risk item with the content identified in TARA. The problem items in TARA can be identified by machine, effectively improving the efficiency of checking risk assessment reports.

[0018] 3. When checking TARA through the server, not only can the problem list be marked, but the four types of tests can also be identified and marked in a unified manner. There is no need to split different tests for processing, nor is there a need to manually check them separately after splitting, which improves efficiency. Since the asset definition file, TARA file, risk value calculation model, and STRIDE model are first obtained from the server, the inspection efficiency is effectively improved.

[0019] 4. The solution of executing four tests in parallel not only improves the efficiency of report inspection, but also can automatically troubleshoot problems in the report inspection process through the interaction between the report server and the detection server, whether it is due to insufficient resources of a certain detection system that cannot be effectively detected or component failure, saving manpower and improving inspection efficiency.

[0020] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings: Figure 1 An asset category detection flow chart provided for an embodiment of the present invention; Figure 2 A flow chart of security attribute detection provided by an embodiment of the present invention; Figure 3 A risk value detection flow chart provided by an embodiment of the present invention; Figure 4 A flow chart of scene description detection provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0023] In the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] The present invention proposes a method for checking a risk assessment report, such as Figure 1 As shown, the method specifically comprises the following steps: S1. The risk assessment report detection server obtains the asset definition file, TARA file, risk value calculation model, and STRIDE model; S2. Execute asset category detection to determine whether the asset category detection is completed; like Figure 1 As shown, the asset category detection method is: a1. The asset category detection component obtains the TARA file and the asset definition file; a2. Extract all risk items from the TARA file and extract the asset categories of all risk items; TARA means threat analysis and risk assessment.

[0025] a3. Based on the comparison between the asset definition file and the asset categories of all risk items, it is determined whether the asset categories of all risk items are consistent with the asset categories specified in the asset definition file; a4. If the asset categories of all risk items are consistent with the asset categories specified in the asset definition file, the asset category detection process is completed; a5. If there are items in all risk item asset categories that are inconsistent with the asset categories specified in the asset definition file, it is determined that there are illegal asset categories or some asset categories are missing in the TARA; And mark the items in all risk item asset categories that are inconsistent with the asset categories specified in the asset definition file and generate a problem list.

[0026] S3. If the asset category detection has been completed, a security attribute detection is performed and it is determined whether the security attribute detection is completed; like Figure 2 As shown, the security attribute detection method is: b1. The security attribute detection component obtains the TARA file and the asset definition file; b2. Traverse the risk items of the TARA file one by one; b3. Extract the security attributes of each risk item asset category; b4. Determine whether the security attribute of each risk item asset category exceeds the scope specified in the asset definition file; b41. If the scope specified in the asset definition file is not exceeded, confirm whether the traversal is completed; b411. If the traversal is completed, the security attribute detection process is completed; b412. If the traversal is not completed, return to step b2; b42. If there is a risk item asset category security attribute that exceeds the range specified in the asset definition file, it is determined that there is an illegal security attribute; Mark the risk item asset category security attributes beyond the scope of risk items specified in the asset definition file, and generate a problem list; b421. Confirm whether the traversal is completed; If the traversal is completed, the security attribute detection process is completed; If the traversal is not completed, return to step b2.

[0027] The security attributes corresponding to the asset categories in each risk item in the TARA should not exceed the scope specified in the asset definition. For example, a risk item in the TARA analyzes the non-repudiation of VCU (a vehicle controller). Non-repudiation is a security attribute, but the asset definition stipulates that VCU only contains three security attributes: confidentiality, authenticity, and integrity. Non-repudiation exceeds this scope. Therefore, the risk item analysis is unreasonable and should be marked as a problem.

[0028] The security attributes in the asset definition file can be modified by the management end.

[0029] S4. If the security attribute detection is completed, a risk value detection is performed, and it is determined whether the risk value detection is completed; like Figure 3 As shown, the risk value detection method is: c1. The risk value detection component obtains the TARA file and the risk value calculation model; c2. Traverse the risk items of the TARA file one by one; c3. Extract the actual risk level Mn, impact rating, and attack feasibility rating of the risk item; n is a natural number; c4. Based on the impact rating and the attack feasibility rating, the theoretical risk value Nn is calculated using the risk value calculation model, c5. Compare Mn and Nn to determine whether the actual risk level is consistent with the calculated theoretical risk value; c6. If Mn and Nn are consistent, confirm whether the traversal is completed; c61. If the traversal is completed, the risk value detection process is completed; c61. If the traversal is not completed, return to step c2; c7. If Mn and Nn are inconsistent, it is determined that there is an error in the risk value calculation. The risk items corresponding to the incorrectly calculated risk value are marked and a problem list is generated; c8. Confirm whether the traversal is completed; c81. If the traversal is completed, the risk value detection process is completed; c81. If the traversal is not completed, return to step c2.

[0030] The calculation of the risk value is based on the impact rating and attack feasibility rating in TARA. The risk value calculation model is a certain formula that calculates the accurate risk value based on the known impact rating and attack feasibility rating. The risk value calculation model can be modified by the management end.

[0031] For example, a risk item in TARA has a risk value of 4. By extracting the impact rating and attack feasibility rating and inputting the risk value calculation model, the calculated risk value is 3. It can be determined that there is a calculation error in the risk value of this risk item and the problem should be marked.

[0032] S5. If the risk value detection is completed, the threat scenario description detection is performed, and it is determined whether the threat scenario description detection is completed; like Figure 4 As shown, the threat scenario description detection method is: d1. The scene description detection component obtains the TARA file and the STRIDE model; d2. Traverse the risk items of the TARA file one by one; d3. Extract the threat scenario and asset name Rk and security attribute Qk corresponding to the risk item; k is a natural number, Rk is the asset name extracted from the k-th risk item, and Qk is the security attribute extracted from the k-th risk item; d31. Based on the threat scenario, identify the target asset Xk, security attribute Yk and threat type Zk; Xk is the asset name identified in the k-th risk item, Yk is the security attribute identified in the k-th risk item, and Zk is the threat type identified in the k-th risk item; d32. Based on the asset name Rk and the security attribute Qk, the corresponding threat type Wk is obtained through the STRIDE model; Wk is the corresponding threat type obtained by the STRIDE model for the k-th risk item; d4. Compare the asset name Rk with the target asset Xk, the security attribute Qk with the security attribute Yk, and the threat type Wk with the threat type Zk; to determine whether the target asset and the asset name are consistent, whether the security attributes are consistent, and whether the threat type is consistent; d41. If the asset name Rk is consistent with the target asset Xk, the security attribute Qk is consistent with the security attribute Yk, and the threat type Wk is consistent with the threat type Zk, then confirm whether the traversal is complete; d411. If the traversal is completed, the scene description detection process is completed; d412. If the traversal is not completed, return to step d2; d42. If any of the three comparisons of the asset name Rk and the target asset Xk, the security attribute Qk and the security attribute Yk, and the threat type Wk and the threat type is inconsistent, it is confirmed that there is an error in the threat scenario, and the risk item with the error in the threat scenario is marked and a problem list is generated; d421. Confirm whether the traversal is completed; d411. If the traversal is completed, the scene description detection process is completed; d412. If the traversal is not completed, return to step d2.

[0033] The STRIDE model describes a one-to-one correspondence between security attributes and threat types and is adopted in TARA. The description of a threat scenario contains three elements: target assets, security attributes, and threat types. By extracting the above three elements of a risk item and comparing them with the threat scenario description, we can determine whether the description of the threat scenario is reasonable.

[0034] For example, the three elements of a risk item in TARA are: VCU (vehicle control unit), authenticity, and deception, where VCU is the target asset, authenticity is the security attribute, and deception is the threat type. According to the STRIDE model, deception is the threat type corresponding to authenticity.

[0035] The threat scenario description of this risk item has three elements: VCU, confidentiality, and deception. Here, the description of the security attribute is wrong and the problem should be marked.

[0036] S6. If the scene description detection is completed, all detection documents are output and a prompt indicating that the detection is completed is displayed.

[0037] If the detection time of any one of the steps S2-S5 exceeds a first threshold, the detection item exceeding the first threshold is skipped and the next detection is directly executed in sequence.

[0038] S2-S5 can also be executed in parallel. The specific parallel execution method is as follows: s1. The risk assessment report detection server obtains the asset definition file, TARA file, risk value calculation model, and STRIDE model; and executes the following steps s2-s5 in parallel s2. Perform asset category testing; a1. The asset category detection component obtains the TARA file and the asset definition file; a2. Extract all risk items from the TARA file and extract the asset categories of all risk items; a3. Based on the comparison between the asset definition file and the asset categories of all risk items, it is determined whether the asset categories of all risk items are consistent with the asset categories specified in the asset definition file; a4. If the asset categories of all risk items are consistent with the asset categories specified in the asset definition file, the asset category detection process is completed; a5. If there are items in all risk item asset categories that are inconsistent with the asset categories specified in the asset definition file, it is determined that there are illegal asset categories or some asset categories are missing in the TARA; s3. Perform security attribute detection; b1. The security attribute detection component obtains the TARA file and the asset definition file; b2. Traverse the risk items of the TARA file one by one; b3. Extract the security attributes of each risk item asset category; b4. Determine whether the security attribute of each risk item asset category exceeds the scope specified in the asset definition file; b41. If the scope specified in the asset definition file is not exceeded, confirm whether the traversal is completed; b411. If the traversal is completed, the security attribute detection process is completed; b412. If the traversal is not completed, return to step b2; b42. If there is a risk item asset category security attribute that exceeds the range specified in the asset definition file, it is determined that there is an illegal security attribute; Mark the risk item asset category security attributes beyond the scope of risk items specified in the asset definition file, and generate a problem list; b421. Confirm whether the traversal is completed; If the traversal is completed, the security attribute detection process is completed; If the traversal is not completed, return to step b2.

[0039] The security attributes corresponding to the asset categories in each risk item in the TARA should not exceed the scope specified in the asset definition. For example, a risk item in the TARA analyzes the non-repudiation of VCU (a vehicle controller). Non-repudiation is a security attribute, but the asset definition stipulates that VCU only contains three security attributes: confidentiality, authenticity, and integrity. Non-repudiation exceeds this scope. Therefore, the risk item analysis is unreasonable and should be marked as a problem.

[0040] The security attributes in the asset definition file can be modified by the management end.

[0041] s4. Perform risk value detection; c1. The risk value detection component obtains the TARA file and the risk value calculation model; c2. Traverse the risk items of the TARA file one by one; c3. Extract the actual risk level Mn, impact rating, and attack feasibility rating of the risk item; n is a natural number; c4. Based on the impact rating and the attack feasibility rating, the theoretical risk value Nn is calculated using the risk value calculation model, c5. Compare Mn and Nn to determine whether the actual risk level is consistent with the calculated theoretical risk value; c6. If Mn and Nn are consistent, confirm whether the traversal is completed; c61. If the traversal is completed, the risk value detection process is completed; c61. If the traversal is not completed, return to step c2; c7. If Mn and Nn are inconsistent, it is determined that there is an error in the risk value calculation. The risk items corresponding to the incorrectly calculated risk value are marked and a problem list is generated; c8. Confirm whether the traversal is completed; c81. If the traversal is completed, the risk value detection process is completed; c81. If the traversal is not completed, return to step c2.

[0042] s5. Perform threat scenario description detection; d1. The scene description detection component obtains the TARA file and the STRIDE model; d2. Traverse the risk items of the TARA file one by one; d3. Extract the threat scenario and asset name Rk and security attribute Qk corresponding to the risk item; k is a natural number, Rk is the asset name extracted from the k-th risk item, and Qk is the security attribute extracted from the k-th risk item; d31. Based on the threat scenario, identify the target asset Xk, security attribute Yk and threat type Zk; Xk is the asset name identified in the k-th risk item, Yk is the security attribute identified in the k-th risk item, and Zk is the threat type identified in the k-th risk item; d32. Based on the asset name Rk and the security attribute Qk, the corresponding threat type Wk is obtained through the STRIDE model; Wk is the corresponding threat type obtained by the STRIDE model for the k-th risk item; d4. Compare the asset name Rk with the target asset Xk, the security attribute Qk with the security attribute Yk, and the threat type Wk with the threat type Zk; to determine whether the target asset and the asset name are consistent, whether the security attributes are consistent, and whether the threat type is consistent; d41. If the asset name Rk is consistent with the target asset Xk, the security attribute Qk is consistent with the security attribute Yk, and the threat type Wk is consistent with the threat type Zk, then confirm whether the traversal is complete; d411. If the traversal is completed, the scene description detection process is completed; d412. If the traversal is not completed, return to step d2; d42. If any of the three comparisons of the asset name Rk and the target asset Xk, the security attribute Qk and the security attribute Yk, and the threat type Wk and the threat type is inconsistent, it is confirmed that there is an error in the threat scenario, and the risk item with the error in the threat scenario is marked and a problem list is generated; d421. Confirm whether the traversal is completed; d411. If the traversal is completed, the scene description detection process is completed; d412. If the traversal is not completed, return to step d2.

[0043] s6. Output all test documents and prompt that the test is completed.

[0044] Among them, in the scheme of executing steps s2-s5 in parallel, a test report is generated after any test is completed and sent to the report generation server. After receiving three test reports in one test task, the report generation server starts the timer. If the fourth test report is not received after the timer reaches the second time threshold, the three test reports that have been received are output, and the test items corresponding to the unsent reports are fed back to the test server. The test server separately reopens the test process only for the test items corresponding to the unsent reports, and continues for the third time threshold. If the test report is still not sent to the report generation server within the third time threshold, the detection server issues an alarm to the administrator, indicating that the detection component that has not sent the test report to the report generation server is faulty.

[0045] Further, in the asset category detection process; The asset categories extracted in TARA include: components, data streams, and external storage.

[0046] Further, the asset categories specified in the asset definition include only: components and data flows; The asset definition specifies the range of security attributes contained in each asset category.

[0047] Furthermore, the asset definition specifies that external storage belongs to the illegal asset category.

[0048] Furthermore, in the asset category detection process and the security attribute detection process, the TARA and the asset definition are used as input files.

[0049] Furthermore, in the security attribute detection process, if there is a security attribute A corresponding to an asset category in the TARA file that is not within the scope of security attributes included in the asset category recorded in the asset definition, then the security attribute A corresponding to the asset category is marked in the security attribute detection file; A is a set.

[0050] Furthermore, in the risk value detection process, the TARA and the risk value calculation model are input files.

[0051] Furthermore, in the scene description detection process, the TARA and the STRIDE models are input files.

[0052] The present invention also proposes a risk assessment report inspection system, which includes: an asset category detection component, a security attribute detection component, a risk value detection component, and a scenario description detection component, which are used to execute any risk assessment report inspection method.

[0053] The present invention also proposes a readable storage medium, in which instruction codes are stored for being called by a processor to execute any of the above-mentioned risk assessment report inspection methods.

[0054] The beneficial effects of the present invention are as follows: 1. A method for checking risk assessment reports is provided, which is highly operational. This method can be used to develop automated tools in this business field, improve the efficiency of auditors in checking risk assessment reports, and improve the accuracy of auditors' marking of risk assessment report issues.

[0055] 2. After obtaining the asset definition file, TARA file, risk value calculation model, and STRIDE model, set up automated file reading, extract the corresponding parameters and re-verify based on the corresponding parameters. For example, recalculate the risk value based on the impact rating and attack feasibility rating through the risk calculation model, and use the STRIDE model to compare the threat type corresponding to the extracted risk item with the content identified in TARA. The problem items in TARA can be identified by machine, effectively improving the efficiency of checking risk assessment reports.

[0056] 3. When checking TARA through the server, not only can the problem list be marked, but the four types of tests can also be identified and marked in a unified manner. There is no need to split different tests for processing, nor is there a need to manually check them separately after splitting, which improves efficiency. Since the asset definition file, TARA file, risk value calculation model, and STRIDE model are first obtained from the server, the inspection efficiency is effectively improved.

[0057] 4. The solution of executing four tests in parallel not only improves the efficiency of report inspection, but also can automatically troubleshoot problems in the report inspection process through the interaction between the report server and the detection server, whether it is due to insufficient resources of a certain detection system that cannot be effectively detected or component failure, saving manpower and improving inspection efficiency.

[0058] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for checking a risk assessment report, characterized in that: The method comprises the following steps: S1. The risk assessment report detection server obtains the asset definition file, TARA file, risk value calculation model, and STRIDE model; S2. Execute asset category detection to determine whether the asset category detection is completed; S3. If the asset category detection has been completed, a security attribute detection is performed and it is determined whether the security attribute detection is completed; S4. If the security attribute detection is completed, a risk value detection is performed, and it is determined whether the risk value detection is completed; S5. If the risk value detection is completed, the threat scenario description detection is performed, and it is determined whether the scenario description detection is completed; S6. If the scene description detection is completed, all detection documents are output and a prompt indicating that the detection is completed is displayed.

2. A method for checking a risk assessment report according to claim 1, characterized in that: In the asset class detection process; The asset categories extracted in TARA include: components, data streams, and external storage.

3. A method for checking a risk assessment report according to claim 2, characterized in that: The asset categories specified in the asset definition include only: components and data flows; The asset definition specifies the range of security attributes contained in each asset category.

4. A method for checking a risk assessment report according to claim 3, characterized in that: External storage falls into the illegal asset class.

5. A method for checking a risk assessment report according to claim 4, characterized in that: In both the asset category detection process and the security attribute detection process, the TARA and the asset definition are used as input files.

6. A method for checking a risk assessment report according to claim 5, characterized in that: In the security attribute detection process, if the security attribute A corresponding to the asset category in the TARA file is not within the scope of the security attributes included in the asset category recorded in the asset definition, the security attribute A corresponding to the asset category is marked in the security attribute detection file; A is a set.

7. A method for checking a risk assessment report according to claim 6, characterized in that: In the risk value detection process, the TARA and the risk value calculation model are input files.

8. A method for checking a risk assessment report according to claim 7, characterized in that: In the scene description detection process, the TARA and STRIDE models are input files.

9. A risk assessment report inspection system, characterized in that: The system includes: an asset category detection component, a security attribute detection component, a risk value detection component, and a scenario description detection component, which are used to execute the inspection method of the risk assessment report described in any one of claims 1-8.

10. A readable storage medium, characterized in that: The readable storage medium stores instruction codes for being called by a processor to execute the risk assessment report inspection method described in any one of claims 1-8.

Images