一种基于UML的网络安全体系建模分析方法  

UML-Based Modeling Method of Network Security Infrastructure

作　　者：布宁 刘玉岭[2] 连一峰[2] 黄亮[2] 

机构地区：[1]中国信息安全认证中心,北京100020 [2]中国科学院软件研究所可信计算与信息保障实验室,北京100190

出　　处：《计算机研究与发展》2014年第7期1578-1593,共16页Journal of Computer Research and Development

基　　金：北京市自然科学基金项目(4122085);国家"十二五"科技支撑计划基金项目(2012BAK26B01)

摘　　要：在现有法律法规和标准体系的指导下,提出了一种通用的网络安全体系框架,阐述了安全目标、安全边界、安全体系要素与安全服务和安全风险评估之间的关系.在网络安全体系框架的基础上,利用统一建模语言(Unified Modeling Language,UML)在建模表述上的强大性和通用性给出了安全目标、安全边界和安全体系要素的建模方法,以规范化安全体系的表示形式并消除沟通中的歧义性.利用建立的模型,安全管理员使用提出的网络安全建模分析方法,可以验证业务流程的目标满足性并得出可能的安全风险.最后通过一个典型网上银行网络的建模分析,验证了提出的安全体系框架和建模分析方法的有效性和合理性.相比于传统的方法,该方法建模分析要素更为全面,且推导得出的结果指导性更强.Under the guidance of existing laws, regulations and standards, a general framework of network security infrastructure is proposed. The proposed infrastructure discusseds the relations between security objectives, security boundary, security infrastructure elements and security risk assessment. Based on this infrastructure, we present our modeling approaches of security objectives, security boundary and security infrastructure elements using UML＇s standard and powerful modeling ability. Our modeling methods can eliminate the ambiguity in communication and make the representation of security system be standardized. Using our analysis methods, security administrators can validate how the business processes meet to the business goals and get the security risk of the system. By modeling an online banking, the proposed security framework and modeling methods＇ validity and rationality are verified. The proposed approach can help security administrators model the network security system in a visualization method. Based on modal logic, security administrators can deduce the logical relationships between each element and the results can guide security administrators to deploy proper security measures. Compared with the existing methods, the method of this paper is more comprehensive and has stronger guiding significance.

关 键 词：网络安全体系 UML建模 安全目标 安全边界 安全措施 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]