Secure System Configuration Prioritization for Threat Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure system automated design techniques introduce excessive security measures and incur high calculation costs due to comprehensive consideration of all threats and attack paths, without adequately aligning with user security requirements.
Innovation Solution
A secure system automated design device and method that derives a security evaluation value by generating system configuration plans, identifying threats and attack paths, and setting priority considerations based on user-defined security requirements, thereby avoiding unnecessary countermeasures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive consideration of all threats and attack paths is performed, then security evaluation completeness is improved, but calculation cost increases
Solution Approach 1:
The patent segments the set of all threats and attack paths into multiple subsets, evaluating each subset separately rather than performing comprehensive evaluation of all threats simultaneously. This division reduces the computational burden while maintaining security evaluation effectiveness through prioritized processing of critical threats.
Solution Approach 2:
The patent extracts and prioritizes critical threats and attack paths from the complete set, separating high-priority security concerns from lower-priority ones. By focusing evaluation resources on extracted critical threats first, the system achieves effective security assessment with reduced calculation costs compared to evaluating all threats equally.
2Reliability
If all countermeasures are introduced to address all threats, then security coverage is improved, but system complexity increases
Solution Approach 1:
The patent applies local quality by assigning different priority levels to different threats and attack paths based on their criticality. Instead of uniformly applying all countermeasures across all threats, the system selectively introduces countermeasures focused on high-priority threats, thereby achieving effective security coverage while avoiding unnecessary complexity from addressing low-priority threats.
Solution Approach 2:
The patent implements partial action by introducing countermeasures for only the most critical threats and attack paths rather than all possible threats. This selective approach provides sufficient security coverage for high-priority risks while avoiding the excessive complexity that would result from implementing countermeasures for every conceivable threat.
3Measurement precision
If security evaluation is based on concrete system configurations, then evaluation accuracy is improved, but adaptability to different configurations decreases
Solution Approach 1:
The patent employs dynamics by making the threat prioritization and subset selection adaptable to different system configurations. The system dynamically identifies and prioritizes critical threats based on the specific concrete configuration being evaluated, allowing accurate security assessment tailored to each configuration's unique characteristics while maintaining the ability to handle diverse system designs.
Data Source
AI summary
A secure system automated design device accepts a design requirement of a system; generates a system configuration plan that satisfies the design requirement; derives threats that are present in the system configuration plan, attack paths that are constituted by a chain of the threats, and countermeasures that are implemented with respect to the threats; and derives a threat consideration priority that represents a priority with which the threats are to be considered, and an attack path consideration priority that represents a priority with which the attack paths are to be considered.