私有云的数据安全风险评估体系的构建与应用  

Construction and Application of Data Security Risk Assessment Index System of Private Cloud

作　　者：徐湖鹏[1] 吴宗大[2] 卢成浪 殷文俊[1] Xu Hupeng;Wu Zongda;Lu Chenglang;Yin Wenjun(Oujiang College,Wenzhou University,Wenzhou 325035,China;Wenzhou University;Zhejiang Institute of Mechanical&Electrical Engineering)

机构地区：[1]温州大学瓯江学院,温州325035 [2]温州大学 [3]浙江机电职业技术学院

出　　处：《单片机与嵌入式系统应用》2019年第12期23-25,28,共4页Microcontrollers & Embedded Systems

基　　金：浙江省自然科学基金重点项目“个性化文本检索服务用户隐私保护方法研究”(项目编号：LZ18F020001);国家自然科学基金地区项目“面向个性化推荐服务用户隐私保护的若干关键问题研究”(项目编号：61762055)

摘　　要：基于云计算安全特性,从机密性、完整性、可信性、可用性和可审性(CIA)出发,对云计算系统安全风险进行风险分析,构建了资产、威胁和脆弱识别的安全评估基本流程。同时根据静态博弈理论研究了云计算系统攻击-防御过程,从参与者间的动态相互交互性和利益冲突方向分析了双方最佳防御/攻击概率,利用Matlab获得防御/攻击概率影响因子以及变化趋势。研究结果表明,防御最优概率随着系统损害函数增加而不断增大,随着恢复函数的增加而减小,攻击最佳概率随着防御正确率增加而减小,随着防御失策率的增加而上升。Based on the security characteristics of cloud computing,confidentiality,integrity,trustworthiness,availability and verifiability(CIA),the security risk of cloud computing system is analyzed,and the basic process of security assessment of assets,threats and vulnerability identification are constructed.At the same time,based on the static game theory,the attack defense process of cloud computing system is studied,and the best defence/attack probability of both sides is analyzed from the dynamic interaction between participants and the direction of interest conflict.With the increase of recovery function,the optimal probability of attack decreases with the increase of defense accuracy and increases with the increase of defense error rate.

关 键 词：云计算 数据安全 静态博弈 攻击/防御 

分 类 号：TP31[自动化与计算机技术—计算机软件与理论]