Information security protection level evaluation method for ship-based complex information system

Abstract

The invention discloses an information security protection level evaluation method for a ship-borne complex information system. The method comprises the following steps: 1) constructing an information security level evaluation index set of the ship-borne information system; 2) determining an index weight; 3) performing evaluation grade division and evaluation grade assignment on the four dimensions of the second layer of indexes; 4) performing quantitative analysis on each index of the second-layer index set to obtain a corresponding evaluation grade and score, and calculating a final evaluation result value by combining the weight of the second-layer index and the weight of the first-layer index; and 5) determining the system information security protection level according to the final evaluation result value and a set value interval. An evaluation index system for evaluating the information safety protection level of the target system is provided, the information safety protection level of the protection object is determined through quantitative evaluation, and the information safety protection level can be used as a basis for safety protection design and construction implementation work.

Description

Technical Field

[0001] The invention relates to information security protection design technology, and in particular to an information security protection level assessment method for a shipborne complex information system. Background Art

[0002] With the widespread application of computer networks, cloud computing and other technologies on ships, the information level of ship equipment has been rapidly improved. Many shipborne equipment have formed a complex information system with increasing scale and closer connections. With the increasing complexity of shipborne information systems, information security threats have increased, and the information security risks of information systems have become increasingly greater. The existing standards and specifications stipulate technical requirements for information security protection at different levels, but lack specific implementation methods for determining the protection level of complex information systems. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide an information security protection level assessment method for a shipborne complex information system in view of the defects in the prior art.

[0004] The technical solution adopted by the present invention to solve the technical problem is: a method for evaluating the information security protection level of a shipborne complex information system, comprising the following steps:

[0005] 1) Constructing the information security level evaluation index set of shipborne information system

[0006] Taking the overall evaluation index of shipborne information system information security level as A, two levels of evaluation indicators are designed downwards;

[0007] The first-level indicators include:

[0008] Ship-wide network equipment B1, application system internal network equipment B2, public computing equipment B3, command and control business-specific information processing and recording equipment B4, electromechanical business-specific information processing and recording equipment B5, driving control business-specific information processing and recording equipment B6, other business-specific information processing and recording equipment B7, display and control console equipment B8, wall-mounted / portable computer terminal B9, embedded terminal B 10 , password security device B 11 , Accusation business display and control software B 12 ,Electromechanical business display and control software B 13 ,Driving control business display software B 14 ,Other business display and control software B 15 , accusation business information processing software B 16 ,Mechatronics business information processing software B 17 , Driving control business information processing software B 18 ,Other business information processing software B 19 ;Recorded as index set B;

[0009] The second level indicator is for each B in the first level indicator i , i = 0, 1, 2, ..., 19; decompose according to the four dimensions of information confidentiality, hazard, exposure, and controllability; recorded as indicator set C;

[0010] Among them, the confidentiality level of the information processed is B i The confidentiality level of information processed or stored; the hazard level is B when a risk event occurs. i The degree to which the main function is impaired; exposure level is B i The probability of affecting other devices in the system when a failure occurs; the controllability is B i The possibility of avoiding or eliminating harm through treatment and maintenance when damaged;

[0011] 2) Determine the indicator weights;

[0012] 3) Classify and assign evaluation grades to the four dimensions of the second-tier indicators;

[0013] 4) Conduct quantitative analysis on each indicator of the second-tier indicator set to obtain the corresponding evaluation level and score, and calculate the final evaluation result value by combining the weight of the second-tier indicator and the weight of the first-tier indicator;

[0014] 5) Determine the system information security protection level based on the final evaluation result and the set value range;

[0015] Among them, the information security protection level E is divided into five levels: level one, level two, level three, level four, and level five, and the corresponding scores are: level one: 0≤E≤2; level two: 2<E≤4; level three: 4<E≤6; level four: 6<E≤8; level five: 8<E≤10.

[0016] According to the above scheme, in step 2), the weight is determined by the following method: compare the indicators at the same level in pairs, obtain the ratio of relative weights, and establish a judgment matrix;

[0017] The weights of the C-layer indicators and the B-layer indicators are obtained through the judgment matrix of the corresponding level.

[0018] According to the above scheme, in step 3), the four dimensions of the C-level indicators are divided into evaluation levels and assigned evaluation levels as follows:

[0019] Among them, the evaluation levels of information processing confidentiality include non-confidential, secret, confidential, and top secret; the corresponding scores are: 2, 4, 6, and 8;

[0020] The hazard level assessment levels include: no hazard, mild to moderate hazard, severe hazard, and extremely severe; the corresponding scores are: 2, 4, 6, and 8;

[0021] The exposure assessment value dimension assessment levels include: very low probability, low probability, medium probability, high probability; the corresponding scores are: 2, 4, 6, 8;

[0022] The controllability evaluation value dimension evaluation levels include: completely controllable, simply controllable, generally controllable, and very difficult to control; the corresponding scores are: 2, 4, 6, and 8;

[0023] According to the above scheme, in step 4), the final evaluation result value is calculated as follows:

[0024] 4.1) Quantitatively analyze the indicators of the C-level indicator instance set, and then fuzzify the comments of different levels to obtain the evaluation matrix R of each subset of the C-level indicator Ci ;

[0025] 4.2) The weight coefficient vector W of each subset of C-level indicators Ci With the evaluation matrix R Ci Perform a synthetic operation to obtain the evaluation matrix of the single indicator of layer B: R Bi =W Ci ·R Ci ;

[0026] 4.3) Based on the previous step, we get the comprehensive index evaluation matrix of layer B: R B =(R B1 ,R B2 ,R B3 ,…R Bn ) T ;

[0027] 4.4) Weight vector W combined with B-level indicators B , and get the overall comprehensive evaluation matrix of layer A: R A =W B R A ;

[0028] 4.5) Calculate the final evaluation result value: Z = EV.

[0029] The beneficial effects produced by the present invention are:

[0030] The present invention proposes an evaluation index system for evaluating the information security protection level of a target system, which can be used to evaluate and determine the information security protection level of an information system with complex functions / large scale, and is also suitable for evaluating and determining the information security protection level of an information system (equipment) with single functions / small scale.

[0031] After determining the information security protection level of the protection object through quantitative assessment, it can be used as a basis for security protection design and construction implementation to achieve appropriate and effective information security protection goals. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0033] Figure 1 It is a method flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0035] like Figure 1 As shown, a method for evaluating the information security protection level of a shipborne complex information system includes the following steps:

[0036] 1) Constructing the information security level evaluation index set of shipborne information system

[0037] Taking the overall evaluation index of shipborne information system information security level as A, two levels of evaluation indicators are designed downwards;

[0038] The first-level indicators include:

[0039] Ship-wide network equipment B1, application system internal network equipment B2, public computing equipment B3, command and control business-specific information processing and recording equipment B4, electromechanical business-specific information processing and recording equipment B5, driving control business-specific information processing and recording equipment B6, other business-specific information processing and recording equipment B7, display and control console equipment B8, wall-mounted / portable computer terminal B9, embedded terminal B 10 , password security device B 11 , Accusation business display and control software B 12 ,Electromechanical business display and control software B 13 ,Driving control business display software B 14 ,Other business display and control software B 15 , accusation business information processing software B 16 ,Mechatronics business information processing software B 17 , Driving control business information processing software B 18 ,Other business information processing software B 19 ;Recorded as index set B;

[0040] The second level indicator is for each B i , i = 0, 1, 2, ..., 19; decompose according to the four dimensions of information confidentiality, hazard, exposure, and controllability; recorded as indicator set C;

[0041] Among them, the confidentiality level of the information processed is B i The classification level of information processed or stored;

[0042] When the risk event occurs, B i the extent to which major functions are impaired;

[0043] Exposure level is B i The probability of other devices in the system being affected when a failure occurs;

[0044] Controllability is B i The possibility of avoiding or eliminating harm through treatment and maintenance when damaged;

[0045] 2) Determine the indicator weights;

[0046] Compare the indicators at the same level in pairs, obtain the ratio of relative weights, and establish a judgment matrix;

[0047] Through the judgment matrix of the corresponding level, the weights of the indicators at the C level and the weights of the indicators at the B level are obtained;

[0048] 2.1) Method of establishing judgment matrix

[0049] Table 1 9-level scoring system

[0050]

[0051] Refer to Table 1 to compare the indicators at the same level in pairs, obtain the ratio of relative weights, and establish the judgment matrix E:

[0052]

[0053] Calculate the weight of single-layer indicators;

[0054] Normalize E by column:

[0055] Add the processed data row by row: Create the weight vector:

[0056] right Normalize the process: The weight vector of the layer indicator to the previous level indicator is obtained: W = (ω1 ω2 ω3 … ω n ).

[0057] 2.2) Method for consistency check of judgment matrix;

[0058] Find an approximate value of the largest eigenvalue: Among them, (AW) i is the i-th element of the product vector of matrix A and W;

[0059] Find the consistency test index: Among them, n represents the order of the judgment matrix E. The smaller the CI value is, the more satisfactory the consistency of A is.

[0060] Find the consistency ratio: When CR<0.1, the consistency requirement is met, otherwise, adjust the judgment matrix E and repeat step 2.2). The RI value table is shown in Table 2.

[0061] Table 2 RI value table

[0062]

[0063] Random Consistency Ratio: When CR<0.1, the obtained weight meets the credibility requirement, otherwise the judgment matrix A needs to be adjusted and the consistency check is performed again.

[0064] 3) Evaluate and grade the four dimensions of the C-level indicators;

[0065] Among them, the evaluation levels of information processing confidentiality include non-confidential, secret, confidential, and top secret; the corresponding scores are: 2, 4, 6, and 8;

[0066] The hazard level assessment levels include: no hazard, mild to moderate hazard, severe hazard, and extremely severe; the corresponding scores are: 2, 4, 6, and 8;

[0067] The exposure assessment value dimension assessment levels include: very low probability, low probability, medium probability, high probability; the corresponding scores are: 2, 4, 6, 8;

[0068] The controllability evaluation value dimension evaluation levels include: completely controllable, simply controllable, generally controllable, and very difficult to control; the corresponding scores are: 2, 4, 6, and 8;

[0069] 4) Conduct quantitative analysis on each indicator of the C-level indicator set to obtain the corresponding evaluation level and score, and calculate the final evaluation result value by combining the weight of the C-level indicator and the weight of the B-level indicator;

[0070] 4.1) Quantitatively analyze the indicators of the C-level indicator instance set, and then fuzzify the comments of different levels to obtain the evaluation matrix R of each subset of the C-level indicator Ci ;

[0071] 4.2) The weight coefficient vector W of each subset of C-level indicators Ci With the evaluation matrix R Ci Perform a synthetic operation to obtain the evaluation matrix of the single indicator of layer B: R Bi =W Ci ·R Ci ;

[0072] 4.3) Based on the previous step, we get the comprehensive index evaluation matrix of layer B: R B =(R B1 ,R B2 ,R B3 ,…R Bn ) T ;

[0073] 4.4) Weight vector W combined with B-level indicators B , and get the overall comprehensive evaluation matrix of layer A: R A =W B R A ;

[0074] 4.5) Calculate the final evaluation result value: Z = EV.

[0075] 5) Determine the system information security protection level based on the final evaluation result and the set value range;

[0076] Among them, the information security protection level E is divided into five levels: level one, level two, level three, level four, and level five, and the corresponding scores are: level one: 0≤E≤2; level two: 2<E≤4; level three: 4<E≤6; level four: 6<E≤8; level five: 8<E≤10.

[0077] A specific example:

[0078] 1. For a certain shipborne small-scale command and control system, it is mainly composed of command and control business dedicated information processing, recording equipment, display and control console equipment, command and control business display and control software, and command and control business information processing software. The overall information security level evaluation index is AO;

[0079] 2. According to the specific software and hardware composition of the shipborne small command and control system, select n indicator items from the indicator set B to construct the B-level indicator instance set (n can be 1, 2, 3, ..., 19); according to the n indicator items selected in step c, select m indicator items from the indicator set C to construct the C-level indicator instance set (m = 4n).

[0080] Select B4 (information processing and recording equipment for command and control business), B8 (display and control console equipment), B 12 (Accusation business display and control software), B 16 (Command and control business information processing software) has 3 indicator items in total, and constructs a B-level indicator instance set:

[0081] BO=(B4B8 B 12 B 16 )

[0082] 3. Select the corresponding 16 indicator items from the indicator set C to construct the C-level indicator instance set:

[0083] CO1=(C 13 C 14 C 15 C 16 )

[0084] CO2=(C 29 C 30 C 31 C 32 )

[0085] CO3=(C 45 C 46 C 47 C 48 )

[0086] CO4=(C 61 C 62 C 63 C 64 )

[0087] 4. Evaluate the four indicators contained in BO. The judgment matrix of BO is:

[0088]

[0089] 5. Perform consistency check on BO's judgment matrix: CR = 0.09362, which meets the consistency check requirements;

[0090] 6. The calculated weight of BO index to AO index is:

[0091] W BO-AO =(0.52163 0.20192 0.11298 0.16346) T

[0092] 7. The four indicators contained in CO1, CO2, CO3 and CO4 are judged respectively. The judgment matrix of CO1, CO2, CO3 and CO4 is:

[0093]

[0094]

[0095]

[0096]

[0097] 8. The weights of CO1, CO2, CO3, and CO4 indicators to the BO layer indicators are calculated as follows:

[0098]

[0099]

[0100]

[0101]

[0102] 9. Perform consistency check on the judgment matrices of CO1, CO2, CO3, and CO4 respectively: CO1 (CR = 0.0071), meets the consistency check requirements; CO2 (CR = 0.02975), meets the consistency check requirements; CO3 (CR = 0.04433), meets the consistency check requirements; CO4 (CR = 0.05439), meets the consistency check requirements;

[0103] 10. The fuzzy evaluation results of CO1, CO2, CO3 and CO4 indicators on BO layer indicators are calculated respectively:

[0104]

[0105]

[0106]

[0107]

[0108] 11. The fuzzy evaluation results of BO index on AO index are calculated:

[0109]

[0110] 12. Calculate the AO index value:

[0111]

[0112] 13. Based on comprehensive assessment, the information security protection level of a certain shipborne small command and control system is level four.

[0113] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A method for evaluating the information security protection level of a shipborne complex information system, characterized in that: The following steps are involved: 1) Construct an evaluation index set for information security level of shipborne information system; Taking the overall evaluation index of shipborne information system information security level as A, two levels of evaluation indicators are designed downwards; The first-level indicators include: Ship-wide network equipment B1, application system internal network equipment B2, public computing equipment B3, command and control business-specific information processing and recording equipment B4, electromechanical business-specific information processing and recording equipment B5, driving control business-specific information processing and recording equipment B6, other business-specific information processing and recording equipment B7, display and control console equipment B8, wall-mounted / portable computer terminal B9, embedded terminal B 10 , password security device B 11 , Accusation business display and control software B 12 ,Electromechanical business display and control software B 13 ,Driving control business display software B 14 ,Other business display and control software B 15 , accusation business information processing software B 16 ,Mechatronics business information processing software B 17 , Driving control business information processing software B 18 ,Other business information processing software B 19 ;Recorded as index set B; The second level indicator is for each B in the first level indicator i , i = 0, 1, 2, ..., 19; decompose according to the four dimensions of information confidentiality, hazard, exposure, and controllability; recorded as indicator set C; 2) Determine the indicator weights; 3) Classify and assign evaluation grades to the four dimensions of the second-tier indicators; 4) Conduct quantitative analysis on each indicator of the second-level hierarchical indicator set to obtain the corresponding evaluation level and score, and calculate the final evaluation result value by combining the weight of the second-level indicator and the weight of the first-level indicator; 5) Determine the system information security protection level based on the final evaluation result and the set numerical range.

2. The information security protection level assessment method for a shipborne complex information system according to claim 1 is characterized in that: The meanings of the four dimensions of information confidentiality, hazard level, exposure level, and controllability are as follows: The information level of the processing is B i The classification level of information processed or stored; When the risk event occurs, B i the extent to which major functions are impaired; Exposure level is B i The probability of other devices in the system being affected when a failure occurs; Controllability is B i When damaged, avoid or eliminate the possibility of harm through treatment and maintenance.

3. The information security protection level assessment method for a shipborne complex information system according to claim 1 is characterized in that: In the step 2), the weights are determined by comparing the indicators at the same level in pairs, obtaining the ratio of relative weights, and establishing a judgment matrix; The weights of the C-layer indicators and the B-layer indicators are obtained through the judgment matrix of the corresponding level.

4. The information security protection level assessment method for a shipborne complex information system according to claim 1 is characterized in that: In step 3), the four dimensions of the C-layer indicators are divided into evaluation levels and assigned evaluation levels as follows: Among them, the evaluation levels of information processing confidentiality include non-confidential, secret, confidential, and top secret; the corresponding scores are: 2, 4, 6, and 8; The hazard level assessment levels include: no hazard, mild to moderate hazard, severe hazard, and extremely severe; the corresponding scores are: 2, 4, 6, and 8; The exposure assessment value dimension assessment levels include: very low probability, low probability, medium probability, high probability; the corresponding scores are: 2, 4, 6, 8; The evaluation levels of the controllability assessment value dimension include: completely controllable, simply controllable, generally controllable, and very difficult to control; the corresponding scores are: 2, 4, 6, and 8.

5. The information security protection level assessment method for a shipborne complex information system according to claim 1 is characterized in that: In step 4), the final evaluation result value is calculated as follows: 4.1) Quantitatively analyze the indicators of the C-level indicator instance set, and then fuzzify the comments of different levels to obtain the evaluation matrix R of each subset of the C-level indicator Ci ; 4.2) The weight coefficient vector W of each subset of C-level indicators Ci With the evaluation matrix R Ci Perform a synthetic operation to obtain the evaluation matrix of the single indicator of layer B: R Bi =W Ci ·R Ci ; 4.3) Based on the previous step, we get the comprehensive index evaluation matrix of layer B: R B =(R B1 ,R B2 ,R B3 ,…R Bn ) T ; 4.4) Weight vector W combined with B-level indicators B , and get the overall comprehensive evaluation matrix of layer A: R A =W B R A ; 4.5) Calculate the final evaluation result value: Z = EV.

6. The information security protection level assessment method for a shipborne complex information system according to claim 1 is characterized in that: In the step 5), the information security protection level E is divided into 5 levels: level 1, level 2, level 3, level 4, and level 5, and the corresponding scores are: level 1: 0≤E≤2; Level 2: 2<E≤4; Level 3: 4<E≤6; Level 4: 6<E≤8; Level 5: 8<E≤10.

7. An electronic device, characterized in that: include: one or more processors; as well as a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images