安全配置策略自动生成与验证技术研究  

Automatic Generation and Verification of Security Configuration Policy

作　　者：周佳 邓永晖 贾悠 冯中华[1] ZHOU Jia;DENG Yong-hui;JIA You;Feng Zhong-hua(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2020年第9期2257-2263,共7页Communications Technology

摘　　要：针对网络信息系统安全设备体系需要快速响应、统一配置管理的需求,开展安全配置策略自动生成与验证技术研究,突破安全配置策略形式化描述、安全配置意图与策略映射模型构建及验证、安全配置策略自动转译、安全配置策略冲突检测及优化等关键技术,实现将网络安全配置意图准确快速转化为信息系统安全设备可识别执行的网络安全策略,提升大规模网络信息系统基础安全设施策略智能计算生成能力。In review of the need for rapid response and unified configuration management of network information security equipment system,research on automatic generation and verification of security configuration policy is carried out,and the key technologies such as formal description of security configuration policy,construction and verification of security configuration intention and policy mapping model,automatic translation of security configuration policy,conflict detection and optimization of security configuration policy,etc.,are broken through to realize the accurate and rapid conversion of network security configuration intentions into network security policy that can be identified and executed by information system security equipment,thereby improving the ability of intelligent calculation and generation of largescale network information system infrastructure security facilities strategy.

关 键 词：安全配置策略 形式化描述 策略映射模型 策略转译 策略冲突检测 

分 类 号：TP181[自动化与计算机技术—控制理论与控制工程]