使用CC标准开发的高保证安全信息系统  

Developing High-assurance Secure Information System According to Common Criteria

作　　者：袁春阳[1] 贺也平[1] 潘学俭[1] 梁洪亮[1] 

机构地区：[1]中国科学院软件研究所,北京100080

出　　处：《计算机科学》2007年第2期17-21,47,共6页Computer Science

基　　金：国家自然科学基金项目(No.60373054);中国科学院研究生院创新资金的资助

摘　　要：通用标准(Common Criteria)提供了衡量系统安全性的流行准则。本文主要提出通过各类保证措施,如何构建符合CC标准的高保证安全信息系统。文中首先给出了CC的评估模型、评估过程和安全保证的具体要求。然后以开发安全审计系统为例,分析了系统安全功能和保证要求的产生、审计系统的实现框架以及为达到标准要求而在系统开发过程中使用的各种保证证据和保证措施。最后,又分析了审计系统对整个系统的性能影响因素,并提出了改进办法。本文通过深入剖析通用标准中各个保证要求的内涵,为开发具有高保证要求的信息系统提供了理论指导和实现方法。Common Criteria provides a popular criteria to measure the security of system. This paper mainly poses how to build a high-assurance secure information system according with Common Criteria by kindes of assurance measures. Firstly, the evalution model, evalution procedure of Common Criteria and concrete security assurance requirements are provided. Then taking example of developing secure audit system, this paper discusses the production of security function and assurance requirements of system, the implementation framework of audit system, the asurranee evidences and measures during the development process of system. At last, the perfomance effect elements of audit system are analysed and some improvement measures are provided. According to analyse the meanings of assurance requiremens deeply, the instruction in theory and implement method to develop high-assurance information system are provided.

关 键 词：通用标准CC 审计 安全保证 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]