5G网络风险评估方法与实践  

Assessment Method and Practice of 5G Network Risk

作　　者：汤凯 王继刚[1,2] 翟亚红 Tang Kai;Wang Jigang;Zhai Yahong(State Key Laboratory of Mobile Network and Mobile Multimedia Technology,Shenzhen,Guangdong 518057;ZTE Corporation,Shenzhen,Guangdong 518057;China Cybersecurity Review Technology and Certification Center,Beijing 100020)

机构地区：[1]移动网络和移动多媒体技术国家重点实验室,广东深圳518057 [2]中兴通讯股份有限公司,广东深圳518057 [3]中国网络安全审查技术与认证中心,北京100020

出　　处：《信息安全研究》2021年第5期466-475,共10页Journal of Information Security Research

基　　金：国家重大专项课题(2017ZX03001018)。

摘　　要：针对5G网络高级别风险的离散型特征,基于ISO 27005的一般性风险管理框架,提出了一种5G网络风险的评估模型.通过对5G生态的特征分析衍生出4个生态平面的概念,作为风险分析的外部环境.通过对5G技术的特征分析,提出了基于ICO融合的一种结构化风险分析思路,并据此分析出5G网络主要的高级别风险.最后,将5G安全矩阵作为5G网络风险的对策模型,分别从信任体系、测评体系、去信任化体系、5G安全全景以及持续的风险度量与管理等角度给出了实践性的建议,并对关键的5G组件进行了安全定级建议.Aimed at the discrete characteristics of the high-level risks in 5G networks,this article provides a 5G network risk assessment model based on the general risk management framework of ISO 27005.Through the analysis of the characteristics of 5G ecology,four ecological plane are proposed as the external context for risk analysis.Through the analysis of the characteristics of 5G technology,a structured risk analysis idea which based on ICO integration is proposed,and the main high-level risks of 5G networks are analyzed based on this.Finally,the 5G security matrix is taken as the countermeasure model for 5G network risks,and practical suggestions are given from the perspectives of trust system,assessment system,de-trust system,5G security map,and continuous risk measurement and management.Recommendations for security rating of key 5G components are made.

关 键 词：5G网络风险 安全矩阵 信任体系 测评体系 去信任化 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]