Automatic evaluation method and system for network security level protection compliance

Abstract

The invention relates to the technical field of network security level evaluation, discloses an automatic evaluation method and system for network security level protection compliance, and aims to improve the efficiency and result accuracy of compliance automatic evaluation. The method comprises the following steps: acquiring an original configuration strategy of a tested object, and segmenting the original configuration strategy into atomic configuration entries corresponding to single access authorization behaviors according to access control evaluation indexes; a semantic mark triple is separated out from the atomic configuration entry, and a strategy node hierarchy graph of the mandatory access control strategy is constructed; mapping the triple elements into a graph to generate an initial path mapping table, extracting a strategy effective action range and a coverage relation to complete redundancy elimination, and obtaining an effective path mapping chain; and comparing the strategy path with a standard strategy path node by node to generate a compliance evaluation result. According to the method, standardization and automation of the evaluation process are realized, the evaluation generation efficiency is greatly improved, the accuracy and objectivity of the evaluation result are guaranteed, and the method can adapt to large-scale and cross-environment grade protection compliance evaluation requirements.

Description

Technical Field

[0001] This invention relates to the field of network security level assessment technology, and in particular to an automated assessment method and system for network security level protection compliance. Background Technology

[0002] Cybersecurity compliance assessment is a crucial foundational task in the cybersecurity field, and compliance assessment of mandatory access control policies is a core component. With the heterogeneity and scaling up of network environments, the industry's demand for automated assessment of this component is becoming increasingly urgent. Existing technologies have attempted to automate the assessment process by collecting the original configuration policies of the tested objects and comparing the policy information with the mandatory access control policies in the cybersecurity standards.

[0003] However, existing technologies have core technical problems in this automated assessment process. They cannot adapt to the configuration policy processing requirements of heterogeneous operating systems, nor can they perform structured transformation of the mandatory access control policies in the graded protection standards. At the same time, they lack an effective redundancy optimization mechanism for policy matching results. Ultimately, this leads to low efficiency in the automated assessment of mandatory access control policies, and the accuracy and objectivity of the assessment results are difficult to guarantee. Therefore, they cannot meet the actual application needs of large-scale, cross-environmental automated assessment of network security graded protection compliance. Summary of the Invention

[0004] This invention provides an automated assessment method and system for network security level protection compliance to address the problems mentioned in the background section.

[0005] To achieve the above objectives, the present invention provides an automated assessment method for network security level protection compliance, comprising: S1. Obtain the original configuration policy of the object under test, and divide the original configuration policy into configuration entries according to the access control evaluation indicators to obtain the atomic configuration entries corresponding to a single access authorization behavior; S2. Based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, extract the subject security tag, object security tag, and access permission from the atomic configuration entry to form a semantic tag triple that is independent of the operating system; S3. Construct a policy node hierarchy diagram for the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject labeling nodes, object labeling nodes, access permission nodes and their hierarchical relationships. S4. Perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and map each element to the node path in the policy node hierarchy graph according to the comparison results to generate an initial path mapping table. S5. Extract the policy effective scope and policy coverage relationship of atomic configuration entries, and use this information to eliminate redundancy in the initial path mapping table to obtain an effective path mapping chain. S6. Compare the valid path mapping chain with the mandatory access control policy path node by node, and generate compliance assessment results based on the comparison results.

[0006] Preferably, the step of segmenting the original configuration policy into configuration entries based on access control evaluation metrics to obtain atomic configuration entries corresponding to individual access authorization behaviors includes: Analyze access control evaluation indicators, extract subject type identifiers, object category identifiers, and permitted operation types, and construct an item segmentation rule set; Traverse the original configuration strategy and use the subject type identifier and object category identifier to locate the start and end character positions of each authorized behavior description; Extract policy text fragments from the original configuration policy based on character position ranges, verify the integrity of operation permissions in the fragment according to the permitted operation type, and mark the policy text fragments that pass the verification as atomic configuration entries.

[0007] Preferably, the step of extracting the subject security tag, object security tag, and access permission from the atomic configuration entry to form an operating system-independent semantic tag triple includes: Identify the operating system environment type of the atomic configuration entry, retrieve the corresponding configuration syntax parsing rules, deconstruct the atomic configuration entry into a structured form, and obtain a parse tree containing configuration elements. Traverse the parse tree nodes and extract the original text of the subject security tag, the original text of the object security tag, and the original text of the access permission based on the preset subject tag feature words; The original text of the subject security mark, object security mark, and access permission is converted into a unified semantic format defined by the graded protection standard and combined into a semantic mark triple.

[0008] Preferably, the policy node hierarchy diagram for constructing the mandatory access control policy in the graded protection standard includes: Analyze the mandatory access control policy section in the graded protection standard text, and extract the subject tag type set, object tag type set, and access permission type set; Based on the hierarchical relationship between the subject tag types, connect each subject tag type into a subject tag node tree; based on the hierarchical relationship between the object tag types, connect each object tag type into an object tag node tree. Each access permission type is created as an access permission node. According to the permission and tag correspondence constraints specified in the policy, an association edge is established between each access permission node and the corresponding node in the subject tag node tree and the corresponding node in the object tag node tree. The system combines the subject-labeled node tree, the object-labeled node tree, and access permission nodes with associated edges to form a policy node hierarchy graph.

[0009] Preferably, the step of performing feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph includes: Based on the type of nodes in the strategy node hierarchy diagram, extract the subject node set, object node set, and permission node set; Completely match the subject security tag in the semantic tag triple with the tag identifier of each node in the subject node set, and record the successfully matched subject node as the subject mapping node; completely match the object security tag with the tag identifier of each node in the object node set, and record the successfully matched object node as the object mapping node. The access permissions in the semantic tag triple are converted into standard semantic representations of permission nodes. These representations are then matched against the permission identifiers of each permission node in the permission node set. Permission nodes that match successfully are recorded as permission mapping nodes.

[0010] Preferably, the step of mapping each element to a node path in the strategy node hierarchy graph based on the comparison results to generate an initial path mapping table includes: Obtain the subject mapping node, object mapping node, and permission mapping node, and trace the complete path from the root node to each mapping node in the policy node hierarchy diagram to obtain the subject node path, object node path, and permission node path. Associate the subject node path with the subject security tag in the semantic tag triple, associate the object node path with the object security tag, and associate the permission node path with the access permission. Aggregate all relationships to generate an initial path mapping table containing each semantic tag element and its corresponding node path.

[0011] Preferably, the policy scope and policy coverage relationship for extracting atomic configuration entries include: The subject scope conditions, object scope conditions, and access permissions defined in the atomic configuration entry are parsed, and the policy effective scope corresponding to the atomic configuration entry is constructed based on the parsing results. The effective scope of the policy is compared one by one with the effective scope of each existing policy in the preset graded protection mandatory access control policy library. Based on the comparison results, the coverage relationship between the atomic configuration entry and each existing policy is determined, and a policy coverage relationship set is obtained.

[0012] Preferably, the step of eliminating redundancy in the initial path mapping table to obtain an effective path mapping chain includes: Based on the policy coverage relationship set, identify redundant mapping entries in the initial path mapping table that are completely contained in the policy effective scope of other atomic configuration entries; Remove redundant mapping entries from the initial path mapping table and retain the core mapping entries that are not overwritten and are independently valid. The core mapping entries are integrated according to the correspondence between the subject node path, object node path, and permission node path to form an effective path mapping chain.

[0013] Preferably, the step of comparing the effective path mapping chain with the mandatory access control policy path node by node, and generating a compliance assessment result based on the comparison result, includes: By concatenating the subject, object, and permission node paths in the valid path mapping chain, the combined path string to be tested is obtained. By concatenating the corresponding node paths in the mandatory access control policy path, the standard combined path string is obtained. Compare the node identifiers of the combined path string to be tested with the standard combined path string bit by bit, record the consistency status of each bit, and collect them into a comparison mark string; Based on the distribution of consistent markers in the comparison marker strings, the combined path strings to be tested are marked as fully compliant, contain non-compliant items, or are non-compliant. After being associated with the corresponding standard path strings, they are aggregated to obtain the compliance assessment results.

[0014] To address the aforementioned issues, this invention also provides an automated assessment system for network security level protection compliance, the system comprising: The entry segmentation module is used to obtain the original configuration policy of the object under test, and to segment the original configuration policy into configuration entries based on the access control evaluation indicators to obtain atomic configuration entries corresponding to a single access authorization behavior. The semantic tag extraction module is used to extract the subject security tag, object security tag, and access permission from the atomic configuration entry based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, and form a semantic tag triple that is independent of the operating system. The policy hierarchy construction module is used to construct the policy node hierarchy diagram of the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject marker nodes, object marker nodes, access permission nodes and their hierarchical relationship. The path mapping generation module is used to perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and to map each element to the node path in the policy node hierarchy graph based on the comparison results, thereby generating an initial path mapping table. The redundancy elimination module is used to extract the policy effective scope and policy coverage relationship of atomic configuration entries, and based on this, redundancy elimination is performed on the initial path mapping table to obtain an effective path mapping chain. The compliance assessment module is used to compare the valid path mapping chain with the mandatory access control policy path node by node, and generate a compliance assessment result based on the comparison result.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention constructs a structured evaluation system covering the entire process from configuration policy processing to compliance determination. It achieves standardized parsing of heterogeneous configuration policies, structured modeling of mandatory access control policies for cybersecurity level protection, and precise redundancy optimization and node-based compliance comparison of policy matching results. This fundamentally improves the overall execution efficiency of automated evaluation of cybersecurity level protection compliance, while ensuring the accuracy and objectivity of the evaluation results. It can adapt to the practical application needs of large-scale, cross-environmental automated evaluation of cybersecurity level protection compliance.

[0016] 2. This invention, through the refined and standardized design of each core link of automated assessment, achieves precise extraction and effective screening of configuration strategies, completes unified semantic conversion and precise node mapping of security tags and access permissions, and establishes quantitative compliance comparison and judgment standards. This further enhances the standardization and operability of the entire automated assessment process, making the assessment results quantitative and traceable. At the same time, it can accurately locate non-compliant nodes in the assessment process, further strengthening the practical application value of automated assessment work and providing a clear direction for optimization in subsequent network security rectification work. Attached Figure Description

[0017] Figure 1 A flowchart of the automated assessment method for network security level protection compliance provided by the present invention; Figure 2 The module structure diagram of the automated assessment system for network security level protection compliance provided by the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1, referring to Figure 1 The diagram shown is a flowchart illustrating an automated assessment method for network security level protection compliance provided in an embodiment of the present invention. In this embodiment, the automated assessment method for network security level protection compliance includes: S1. Obtain the original configuration policy of the object under test, and divide the original configuration policy into configuration entries according to the access control evaluation indicators to obtain the atomic configuration entries corresponding to a single access authorization behavior; S2. Based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, extract the subject security tag, object security tag, and access permission from the atomic configuration entry to form a semantic tag triple that is independent of the operating system; S3. Construct a policy node hierarchy diagram for the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject labeling nodes, object labeling nodes, access permission nodes and their hierarchical relationships. S4. Perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and map each element to the node path in the policy node hierarchy graph according to the comparison results to generate an initial path mapping table. S5. Extract the policy effective scope and policy coverage relationship of atomic configuration entries, and use this information to eliminate redundancy in the initial path mapping table to obtain an effective path mapping chain. S6. Compare the valid path mapping chain with the mandatory access control policy path node by node, and generate compliance assessment results based on the comparison results.

[0020] In embodiments of the present invention, the original configuration policy is segmented into configuration entries based on access control evaluation metrics to obtain atomic configuration entries corresponding to a single access authorization behavior, including: Analyze access control evaluation indicators, extract subject type identifiers, object category identifiers, and permitted operation types, and construct an item segmentation rule set; Traverse the original configuration strategy and use the subject type identifier and object category identifier to locate the start and end character positions of each authorized behavior description; Extract policy text fragments from the original configuration policy based on character position ranges, verify the integrity of operation permissions in the fragment according to the permitted operation type, and mark the policy text fragments that pass the verification as atomic configuration entries.

[0021] Specifically, the access control evaluation indicators for graded protection are analyzed, and the subject type identifiers are extracted from the indicator text as operation and maintenance personnel accounts and management personnel roles, the object category identifiers as server configuration files and business database tables, and the permitted operation types as query, write, and delete. The above identifiers and operation types are combined to form an item segmentation rule set.

[0022] Furthermore, taking the original configuration policy of the local security policy of the tested Windows server as the processing object, the policy content is traversed line by line. When the operation and maintenance personnel account or administrator role is identified, it is determined as the starting character position of a single authorization behavior description. When the next subject type identifier or object category identifier is identified, it is determined as the ending character position of the authorization behavior description.

[0023] Finally, the text between the start and end characters in the original configuration policy is extracted to obtain the policy text fragment "the operations and maintenance personnel account performs a query operation on the server_config.ini configuration file". The fragment is then verified according to the query permission in the permitted operation type. If the fragment completely contains the subject, object and query permission content, the policy text fragment is marked as an atomic configuration entry.

[0024] In summary, this solution achieves precise segmentation of the original configuration policy through a standardized rule set, accurately locates the policy content corresponding to a single access authorization behavior, and ensures that the segmented atomic configuration entries correspond one-to-one with a single authorization behavior, avoiding the problems of multiple behaviors being mixed or behaviors being missing.

[0025] Meanwhile, by verifying the integrity of permissions, incomplete or invalid policy fragments were filtered out, ensuring the validity and standardization of atomic configuration entries. This laid a standardized and high-quality data source foundation for subsequent extraction of semantic tag triples, policy mapping, and compliance comparison, significantly reducing invalid processing work in subsequent processes and improving the accuracy and efficiency of the entire graded protection compliance automated assessment.

[0026] In embodiments of the present invention, a subject security tag, an object security tag, and access permission are extracted from atomic configuration entries to form an operating system-independent semantic tag triple, including: Identify the operating system environment type of the atomic configuration entry, retrieve the corresponding configuration syntax parsing rules, deconstruct the atomic configuration entry into a structured form, and obtain a parse tree containing configuration elements. Traverse the parse tree nodes and extract the original text of the subject security tag, the original text of the object security tag, and the original text of the access permission based on the preset subject tag feature words; The original text of the subject security mark, object security mark, and access permission is converted into a unified semantic format defined by the graded protection standard and combined into a semantic mark triple.

[0027] Specifically, the atomic configuration entry is identified as belonging to the Linux operating system environment. The Linux security configuration syntax parsing rules are retrieved, and the atomic configuration entry is split according to the key fields. The text is split into three branch nodes: subject field, object field, and permission field, forming a parse tree containing configuration elements.

[0028] Furthermore, the process traverses each branch node of the parse tree. When a branch node matches the preset subject tag feature word "operation and maintenance administrator", the text of that node is extracted as the original text of the subject security tag. When a branch node corresponds to a system audit policy file, the text of that node is extracted as the original text of the object security tag. When a branch node corresponds to a read-only operation, the text of that node is extracted as the original text of the access permission.

[0029] Finally, the operation and maintenance administrator is converted into the unified format of subject security label defined by the graded protection standard, the system audit policy file is converted into the unified format of object security label, and the read-only operation is converted into the unified format of access permission. The three types of content after conversion are combined to form a semantic tag triplet that is independent of the operating system.

[0030] Overall, this solution adapts specific parsing rules to the grammatical differences of different operating systems, enabling accurate extraction of configuration elements across environments and avoiding information extraction bias caused by grammatical heterogeneity.

[0031] Meanwhile, by unifying semantic format conversion, the differences in expression between different operating systems are eliminated, forming standardized semantic tag triples. This breaks down the technical barriers between operating systems, eliminating the need for subsequent policy node mapping, compliance comparison, and other processes to adapt to the syntax rules of different systems. This achieves standardization and universality of the assessment process, significantly improving the adaptability and efficiency of cross-environmental grade protection compliance assessment. It also provides a unified and standardized data source for subsequent steps, ensuring the accuracy and consistency of the assessment results.

[0032] In embodiments of the present invention, constructing a policy node hierarchy diagram of the mandatory access control policy in the graded protection standard includes: Analyze the mandatory access control policy section in the graded protection standard text, and extract the subject tag type set, object tag type set, and access permission type set; Based on the hierarchical relationship between the subject tag types, connect each subject tag type into a subject tag node tree; based on the hierarchical relationship between the object tag types, connect each object tag type into an object tag node tree. Each access permission type is created as an access permission node. According to the permission and tag correspondence constraints specified in the policy, an association edge is established between each access permission node and the corresponding node in the subject tag node tree and the corresponding node in the object tag node tree. The system combines the subject-labeled node tree, the object-labeled node tree, and access permission nodes with associated edges to form a policy node hierarchy graph.

[0033] It should be noted that the policy node hierarchy diagram of the mandatory access control policy in this invention is constructed based on the access control evaluation indicators specified in the graded protection standard. The evaluation indicators in the standard text are expressed in this invention through a node-based and hierarchical policy diagram structure, and there is a clear mapping relationship between the two.

[0034] The mapping relationship is as follows: the subject label requirements in the standard correspond to the subject label nodes in the graph, the object label requirements correspond to the object label nodes in the graph, the permission requirements correspond to the access permission nodes in the graph, and the hierarchical subordinate relationships and permission constraints specified in the standard correspond to the node hierarchy structure and associated edges in the graph.

[0035] Through the above transformation, standard text evaluation indicators are converted into structured data that can be recognized by automated processes.

[0036] Specifically, the section on mandatory access control policies in the graded protection standard text is analyzed, and the subject tag type set (including system administrator, security administrator, and ordinary user), the object tag type set (including business core database, system configuration file, and ordinary business file), and the access permission type set (including read, modify, and execute) are extracted. The extracted types are summarized to form the subject tag type set, the object tag type set, and the access permission type set.

[0037] Furthermore, based on the hierarchical relationship between the main tag types, the system administrator is taken as the root node, the security administrator as the direct child node of the system administrator, and the ordinary user as the direct child node of the security administrator, forming a main tag node tree. The root node is directly associated with first-level child nodes, and the first-level child nodes are further associated with second-level child nodes.

[0038] Then, based on the hierarchical relationship between object tag types, the core business database is taken as the root node, the system configuration file is taken as the direct child node of the core business database, and the ordinary business files are taken as the direct child nodes of the system configuration file, forming an object tag node tree. The hierarchical relationship of the nodes is consistent with the hierarchical structure logic of the subject tag node tree.

[0039] Furthermore, the read, modify, and execute permissions in the access permission type set are created as independent access permission nodes. According to the permission and tag correspondence constraints specified in the graded protection mandatory access control policy, association edges are established between the read access permission node and the system administrator node and security administrator node in the subject tag node tree, and the business core database node and system configuration file node in the object tag node tree. Association edges are established between the modify access permission node and the system administrator node in the subject tag node tree and the system configuration file node in the object tag node tree. Association edges are established between the execute access permission node and the system administrator node in the subject tag node tree and the business core database node in the object tag node tree.

[0040] Finally, the completed subject tag node tree, object tag node tree, and access permission nodes with associated edges are aggregated. All nodes and associated edges together form a policy node hierarchy graph, which fully presents the subject tag nodes, object tag nodes, access permission nodes, and their hierarchical relationships.

[0041] Overall, this solution transforms the abstract graded protection mandatory access control policy into a structured and visualized hierarchical diagram, clearly presenting the hierarchical affiliation and association constraints of various nodes. This transforms the standard policy from text into structured data that can be recognized by automated processes, solving the problem that plain text policies are difficult for machines to directly match and compare.

[0042] Meanwhile, the hierarchical node structure can accurately reflect the hierarchical relationship of permissions in the strategy, providing a standardized reference framework for subsequent node mapping and path matching of semantic tag triples. This ensures that the mapping and comparison process strictly follows the rules and requirements of the graded protection standard, improves the standardization and accuracy of automated evaluation, and makes subsequent path comparison more logical and operable.

[0043] In embodiments of the present invention, feature consistency comparison is performed between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, including: Based on the type of nodes in the strategy node hierarchy diagram, extract the subject node set, object node set, and permission node set; Completely match the subject security tag in the semantic tag triple with the tag identifier of each node in the subject node set, and record the successfully matched subject node as the subject mapping node; completely match the object security tag with the tag identifier of each node in the object node set, and record the successfully matched object node as the object mapping node. The access permissions in the semantic tag triple are converted into standard semantic representations of permission nodes. These representations are then matched against the permission identifiers of each permission node in the permission node set. Permission nodes that match successfully are recorded as permission mapping nodes.

[0044] Specifically, the strategy node hierarchy diagram is divided according to the node's category. Nodes belonging to the subject category are grouped into a subject node set, nodes belonging to the object category are grouped into an object node set, and nodes belonging to the permission category are grouped into a permission node set.

[0045] Furthermore, the security administrator tag in the semantic tag triple is matched one by one with the tag identifiers of system administrator, security administrator, and ordinary user in the set of subject nodes. When the security administrator tag matches the security administrator node identifier in the set, the node is recorded as the subject mapping node.

[0046] Then, the object security tag system configuration file in the semantic tag triple is matched one by one with the tag identifiers of the business core database, system configuration file and ordinary business file in the object node set. When the system configuration file is completely consistent with the system configuration file node identifier in the set, the node is recorded as the object mapping node.

[0047] Furthermore, the access permission reading in the semantic tag triple is converted into the standard semantic expression of the permission node under the graded protection standard, and then matched one by one with the read, modify, and execute permission identifiers in the permission node set. When the read expression is completely consistent with the read node identifier in the permission node, the node is recorded as the permission mapping node.

[0048] Finally, the identified subject mapping nodes, object mapping nodes, and permission mapping nodes are obtained. From the policy node hierarchy diagram, each mapping node is traced upwards to all the nodes along the path to the root node. The subject node path for the security administrator is from the root node system administrator to the child node security administrator. The object node path for the system configuration file is from the root node business core database to the child node system configuration file. The permission node path for reading is from the root permission node to the read permission node. Thus, the subject node path, object node path, and permission node path are obtained respectively.

[0049] In embodiments of the present invention, each element is mapped to a node path in the strategy node hierarchy graph based on the comparison results to generate an initial path mapping table, including: Obtain the subject mapping node, object mapping node, and permission mapping node, and trace the complete path from the root node to each mapping node in the policy node hierarchy diagram to obtain the subject node path, object node path, and permission node path. Associate the subject node path with the subject security tag in the semantic tag triple, associate the object node path with the object security tag, and associate the permission node path with the access permission. Aggregate all relationships to generate an initial path mapping table containing each semantic tag element and its corresponding node path.

[0050] Specifically, a one-to-one correspondence is established between the obtained subject node path and the subject security tag security administrator in the semantic tag triple, a one-to-one correspondence is established between the object node path and the object security tag system configuration file in the semantic tag triple, and a one-to-one correspondence is established between the permission node path and the access permission read in the semantic tag triple.

[0051] The associations between all the semantic tag elements and their corresponding node paths are organized and summarized. Each group of associations is recorded in order, and finally an initial path mapping table containing all semantic tag elements and their corresponding node paths is formed.

[0052] In summary, this solution achieves a one-to-one correspondence between semantic tag elements and standard policy nodes through precise feature matching, ensuring that the mapping relationship conforms to the requirements of the graded protection standard and avoiding matching deviations. At the same time, it maps elements to complete node paths, rather than single nodes, thus fully preserving the hierarchical information in the policy and ensuring that the authorized behavior of the tested object corresponds to the hierarchical constraints of the standard policy.

[0053] Furthermore, the generated initial path mapping table transforms scattered semantic tag elements into structured path association data, providing a standardized data foundation for subsequent redundancy elimination and compliance comparison. This allows subsequent processes to be automated based directly on the path, significantly improving the connectivity and automation of the evaluation process, and ensuring the logic and accuracy of subsequent evaluation and analysis.

[0054] In embodiments of the present invention, extracting the policy effective scope and policy coverage relationship of atomic configuration entries includes: The subject scope conditions, object scope conditions, and access permissions defined in the atomic configuration entry are parsed, and the policy effective scope corresponding to the atomic configuration entry is constructed based on the parsing results. The effective scope of the policy is compared one by one with the effective scope of each existing policy in the preset graded protection mandatory access control policy library. Based on the comparison results, the coverage relationship between the atomic configuration entry and each existing policy is determined, and a policy coverage relationship set is obtained.

[0055] Specifically, the atomic configuration entry is parsed to determine the security administrator's read operation on the system configuration file. The subject scope condition is defined as all security administrator accounts, the object scope condition is all system configuration files on the server, and the access permission is read. Based on these parsing results, the policy effective scope corresponding to the atomic configuration entry is formed.

[0056] Furthermore, the effective scope of this policy is compared one by one with the effective scope of existing policies in the preset graded protection mandatory access control policy library. When a policy is found in the policy library that allows the system administrator to perform read operations on all system files, its subject scope includes the security administrator, the object scope includes the system configuration file, and the permission includes read. It is determined that the effective scope of the atomic configuration entry is completely included by the effective scope of the existing policy. This relationship is recorded, and all comparison results are summarized to obtain the policy coverage relationship set.

[0057] In embodiments of the present invention, redundancy elimination is performed on the initial path mapping table to obtain an effective path mapping chain, including: Based on the policy coverage relationship set, identify redundant mapping entries in the initial path mapping table that are completely contained in the policy effective scope of other atomic configuration entries; Remove redundant mapping entries from the initial path mapping table and retain the core mapping entries that are not overwritten and are independently valid. The core mapping entries are integrated according to the correspondence between the subject node path, object node path, and permission node path to form an effective path mapping chain.

[0058] Specifically, based on the policy coverage relationship set, the mapping entries in the initial path mapping table are checked one by one. When it is found that the policy effective scope of the atomic configuration entry corresponding to a certain mapping entry is completely contained by the policy effective scope of other atomic configuration entries, the mapping entry is determined to be a redundant mapping entry. Based on this, the mapping entry corresponding to Security Administrator-System Configuration File-Read in the initial path mapping table is identified as a redundant mapping entry.

[0059] Furthermore, redundant mapping entries identified in the initial path mapping table are completely removed from the table, while core mapping entries that are not covered by any other policy scope and can independently reflect the authorization relationship are retained, namely, the system administrator - business core database - read the corresponding mapping entry.

[0060] Finally, the retained core mapping entries are organized and integrated according to the correspondence between the subject node path, object node path, and permission node path, so that the subject, object, and permission paths of each core mapping entry are matched with each other to form a coherent and effective path mapping chain. This mapping chain completely preserves the effective authorization path associations that have not been redundantly covered.

[0061] Overall, this solution achieves automated identification and elimination of redundant mapping entries through precise analysis of the policy's effective scope and coverage relationships. It removes invalid path data that is completely covered, simplifies the data source for evaluation and analysis, avoids invalid processing of redundant data during subsequent comparisons, and significantly improves evaluation efficiency.

[0062] Meanwhile, the integrated and effective path mapping chain makes the path association between subjects, objects, and permissions more coherent, retains independent and valid authorization path information, provides a precise and concise standardized data foundation for subsequent compliance comparison, effectively ensures the accuracy and objectivity of subsequent evaluation results, and reduces evaluation bias caused by data redundancy.

[0063] In embodiments of the present invention, the effective path mapping chain is compared node by node with the mandatory access control policy path, and a compliance assessment result is generated based on the comparison result, including: By concatenating the subject, object, and permission node paths in the valid path mapping chain, the combined path string to be tested is obtained. By concatenating the corresponding node paths in the mandatory access control policy path, the standard combined path string is obtained. Compare the node identifiers of the combined path string to be tested with the standard combined path string bit by bit, record the consistency status of each bit, and collect them into a comparison mark string; Based on the distribution of consistent markers in the comparison marker strings, the combined path strings to be tested are marked as fully compliant, contain non-compliant items, or are non-compliant. After being associated with the corresponding standard path strings, they are aggregated to obtain the compliance assessment results.

[0064] The evaluation results are expressed using the path matching degree calculation formula, which is as follows:

[0065] In the formula: Indicates the first element in the combined path string to be tested. Bit-based node identifier; Indicates the first element in the standard combined path string Bit-based node identifier; Indicates the total length of the path string; This indicates a bit-by-bit matching indicator function; Indicates path matching degree, with a value range of .

[0066] The formula for determining the bit-by-bit matching indicator function is as follows:

[0067] Specifically, the subject node path, object node path, and permission node path in the effective path mapping chain are concatenated, and the system administrator, business core database, and read are sequentially connected to obtain the combined path string to be tested.

[0068] Furthermore, the subject node path, object node path, and permission node path in the mandatory access control policy path are concatenated to sequentially connect the system administrator, the core business database, and the read path to obtain a standard combined path string.

[0069] Then, the first node identifier of the combined path string to be tested is compared word by word with the first node identifier of the standard combined path string. If the contents of the two are exactly the same, the bit is recorded as consistent. If the contents of the two are different, the bit is recorded as inconsistent. Here, both are system administrators, so the bit is recorded as consistent.

[0070] The second node identifier of the combined path string to be tested is compared word by word with the second node identifier of the standard combined path string. If the contents of the two are exactly the same, the position is recorded as consistent. If the contents of the two are different, the position is recorded as inconsistent. Here, both are core business databases, so the position is recorded as consistent.

[0071] The third node identifier of the combined path string to be tested is compared word by word with the third node identifier of the standard combined path string. If the contents of the two are exactly the same, the bit is recorded as consistent. If the contents of the two are different, the bit is recorded as inconsistent. Here, both are read, so the bit is recorded as consistent.

[0072] Furthermore, the states obtained from the three comparisons are sequentially aggregated according to the order of the first, second, and third positions to form a comparison marker string.

[0073] The bit-by-bit matching indicator function takes a value of 1 when the node identifiers at the corresponding positions are the same, and a value of 0 when the node identifiers at the corresponding positions are different. Since the node identifiers of each bit in the combined path string to be tested are the same as those in the standard combined path string, the bit-by-bit matching indicator function takes a value of 1 for each bit.

[0074] The path string to be tested consists of three node identifiers: subject, object, and permission. The total length of the path string is 3.

[0075] Then, the values ​​of the three bit-by-bit matching indicator functions are added together to obtain a sum, and then the sum is divided by the total length of the path string to obtain the path matching degree.

[0076] Finally, if all the comparison marker strings are in a consistent state and the path matching degree is 1, the combined path string to be tested is marked as fully compliant. The marking result is then associated with and aggregated with the corresponding standard combined path string to obtain the final compliance assessment result.

[0077] Overall, this solution provides a unified quantitative standard for compliance assessment by comparing nodes along a structured path, avoiding subjective biases in manual assessment and improving the objectivity and accuracy of the assessment results. The application of the path matching degree formula enables quantitative evaluation of compliance, making the assessment results more scientific and traceable.

[0078] Meanwhile, the standardized comparison process automates the compliance assessment, significantly improving the efficiency of the graded protection compliance assessment and accurately locating non-compliant nodes, providing a clear direction for subsequent security rectification.

[0079] Example 2, as Figure 2 The diagram shown is a module structure diagram of the automated assessment system for network security level protection compliance provided by the present invention, which includes: The entry segmentation module 101 is used to obtain the original configuration policy of the object under test, and to segment the original configuration policy into configuration entries according to the access control evaluation indicators to obtain atomic configuration entries corresponding to a single access authorization behavior. The semantic tag extraction module 102 is used to extract the subject security tag, object security tag, and access permission from the atomic configuration entry based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, and form a semantic tag triple that is independent of the operating system. The policy hierarchy construction module 103 is used to construct a policy node hierarchy diagram of the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject marker nodes, object marker nodes, access permission nodes and their hierarchical relationships. The path mapping generation module 104 is used to perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and to map each element to the node path in the policy node hierarchy graph according to the comparison result, thereby generating an initial path mapping table. The redundancy elimination module 105 is used to extract the policy effective scope and policy coverage relationship of atomic configuration entries, and to perform redundancy elimination on the initial path mapping table to obtain an effective path mapping chain. The compliance assessment module 106 is used to compare the valid path mapping chain with the mandatory access control policy path node by node, and generate a compliance assessment result based on the comparison result.

[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. An automated assessment method for compliance with cybersecurity level protection regulations, characterized in that: The method includes: S1. Obtain the original configuration policy of the object under test, and divide the original configuration policy into configuration entries according to the access control evaluation indicators to obtain the atomic configuration entries corresponding to a single access authorization behavior; S2. Based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, extract the subject security tag, object security tag, and access permission from the atomic configuration entry to form a semantic tag triple that is independent of the operating system; S3. Construct a policy node hierarchy diagram for the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject labeling nodes, object labeling nodes, access permission nodes and their hierarchical relationships. S4. Perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and map each element to the node path in the policy node hierarchy graph according to the comparison results to generate an initial path mapping table. S5. Extract the policy effective scope and policy coverage relationship of atomic configuration entries, and use this information to eliminate redundancy in the initial path mapping table to obtain an effective path mapping chain. S6. Compare the valid path mapping chain with the mandatory access control policy path node by node, and generate compliance assessment results based on the comparison results.

2. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The process of segmenting the original configuration policy based on access control evaluation metrics to obtain atomic configuration entries corresponding to individual access authorization behaviors includes: Analyze access control evaluation indicators, extract subject type identifiers, object category identifiers, and permitted operation types, and construct an item segmentation rule set; Traverse the original configuration strategy and use the subject type identifier and object category identifier to locate the start and end character positions of each authorized behavior description; Extract policy text fragments from the original configuration policy based on character position ranges, verify the integrity of operation permissions in the fragment according to the permitted operation type, and mark the policy text fragments that pass the verification as atomic configuration entries.

3. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The extraction of subject security tags, object security tags, and access permissions from atomic configuration entries to form operating system-independent semantic tag triples includes: Identify the operating system environment type of the atomic configuration entry, retrieve the corresponding configuration syntax parsing rules, deconstruct the atomic configuration entry into a structured form, and obtain a parse tree containing configuration elements. Traverse the parse tree nodes and extract the original text of the subject security tag, the original text of the object security tag, and the original text of the access permission based on the preset subject tag feature words; The original text of the subject security mark, object security mark, and access permission is converted into a unified semantic format defined by the graded protection standard and combined into a semantic mark triple.

4. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The policy node hierarchy diagram of the mandatory access control policy in the construction graded protection standard includes: Analyze the mandatory access control policy section in the graded protection standard text, and extract the subject tag type set, object tag type set, and access permission type set; Based on the hierarchical relationship between the subject tag types, connect each subject tag type into a subject tag node tree; based on the hierarchical relationship between the object tag types, connect each object tag type into an object tag node tree. Each access permission type is created as an access permission node. According to the permission and tag correspondence constraints specified in the policy, an association edge is established between each access permission node and the corresponding node in the subject tag node tree and the corresponding node in the object tag node tree. The system combines the subject-labeled node tree, the object-labeled node tree, and access permission nodes with associated edges to form a policy node hierarchy graph.

5. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The step of performing feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph includes: Based on the type of nodes in the strategy node hierarchy diagram, extract the subject node set, object node set, and permission node set; Completely match the subject security tag in the semantic tag triple with the tag identifier of each node in the subject node set, and record the successfully matched subject node as the subject mapping node; completely match the object security tag with the tag identifier of each node in the object node set, and record the successfully matched object node as the object mapping node. The access permissions in the semantic tag triple are converted into standard semantic representations of permission nodes. These representations are then matched against the permission identifiers of each permission node in the permission node set. Permission nodes that match successfully are recorded as permission mapping nodes.

6. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The step of mapping each element to a node path in the strategy node hierarchy graph based on the comparison results, generating an initial path mapping table, includes: Obtain the subject mapping node, object mapping node, and permission mapping node, and trace the complete path from the root node to each mapping node in the policy node hierarchy diagram to obtain the subject node path, object node path, and permission node path. Associate the subject node path with the subject security tag in the semantic tag triple, associate the object node path with the object security tag, and associate the permission node path with the access permission. Aggregate all relationships to generate an initial path mapping table containing each semantic tag element and its corresponding node path.

7. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The scope and coverage relationships of the strategy for extracting atomic configuration entries include: The subject scope conditions, object scope conditions, and access permissions defined in the atomic configuration entry are parsed, and the policy effective scope corresponding to the atomic configuration entry is constructed based on the parsing results. The effective scope of the policy is compared one by one with the effective scope of each existing policy in the preset graded protection mandatory access control policy library. Based on the comparison results, the coverage relationship between the atomic configuration entry and each existing policy is determined, and a policy coverage relationship set is obtained.

8. The automated assessment method for network security level protection compliance as described in claim 7, characterized in that, The process of eliminating redundancy in the initial path mapping table to obtain an effective path mapping chain includes: Based on the policy coverage relationship set, identify redundant mapping entries in the initial path mapping table that are completely contained in the policy effective scope of other atomic configuration entries; Remove redundant mapping entries from the initial path mapping table and retain the core mapping entries that are not overwritten and are independently valid. The core mapping entries are integrated according to the correspondence between the subject node path, object node path, and permission node path to form an effective path mapping chain.

9. The automated assessment method for network security level protection compliance as described in claim 1, characterized in that, The step of comparing the effective path mapping chain with the mandatory access control policy path node by node, and generating a compliance assessment result based on the comparison result, includes: By concatenating the subject, object, and permission node paths in the valid path mapping chain, the combined path string to be tested is obtained. By concatenating the corresponding node paths in the mandatory access control policy path, the standard combined path string is obtained. Compare the node identifiers of the combined path string to be tested with the standard combined path string bit by bit, record the consistency status of each bit, and collect them into a comparison mark string; Based on the distribution of consistent markers in the comparison marker strings, the combined path strings to be tested are marked as fully compliant, contain non-compliant items, or are non-compliant. After being associated with the corresponding standard path strings, they are aggregated to obtain the compliance assessment results.

10. An automated assessment system for network security level protection compliance, used to implement the automated assessment method for network security level protection compliance as described in any one of claims 1-9, characterized in that, The system includes: The entry segmentation module is used to obtain the original configuration policy of the object under test, and to segment the original configuration policy into configuration entries based on the access control evaluation indicators to obtain atomic configuration entries corresponding to a single access authorization behavior. The semantic tag extraction module is used to extract the subject security tag, object security tag, and access permission from the atomic configuration entry based on the configuration syntax structure of the operating system environment to which the atomic configuration entry belongs, and form a semantic tag triple that is independent of the operating system. The policy hierarchy construction module is used to construct the policy node hierarchy diagram of the mandatory access control policy in the graded protection standard. The policy node hierarchy diagram includes subject marker nodes, object marker nodes, access permission nodes and their hierarchical relationship. The path mapping generation module is used to perform feature consistency comparison between each element of the semantic tag triple and the nodes in the policy node hierarchy graph, and to map each element to the node path in the policy node hierarchy graph based on the comparison results, thereby generating an initial path mapping table. The redundancy elimination module is used to extract the policy effective scope and policy coverage relationship of atomic configuration entries, and based on this, redundancy elimination is performed on the initial path mapping table to obtain an effective path mapping chain. The compliance assessment module is used to compare the valid path mapping chain with the mandatory access control policy path node by node, and generate a compliance assessment result based on the comparison result.

Images