内网软件系统安全功能的漏洞分析模型设计  

Design of Vulnerability Analysis Model for Security Function of Intranet Software System

作　　者：胡兆华[1] 冯亚玲 辜彬[1] 聂兰苏 HU Zhaohua;FENG Yaling;GU Bin;NIE Lansu(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2022年第5期73-80,共8页Information Security and Communications Privacy

摘　　要：由于相对特殊的研发和使用环境,内网软件系统在开发时,更多重视系统的功能实现,缺乏对功能安全性的关注,导致内网软件系统在安全性测试方面,缺乏统一的规范及流程,技术积累较少。对内网软件系统的各类安全功能进行模型构建,通过提取设计细节进行安全功能的威胁分析,对内网软件系统的安全功能漏洞和脆弱性进行评估,形成一套内网软件系统功能安全性分析思路及测试方法,完善当前内网软件系统安全性测试手段,从而提升内网软件系统应对风险和威胁的能力。Due to the special R&D and usage environment,the Intranet software system pays more attention to the function realization,and pays little attention to the security of the function.Correspondingly,the Intranet software system lacks a unified specification and process in terms of security testing,and has less technology accumulation.This paper constructs models of various security functions of the Intranet software system,analyzes the threat of security functions by extracting design details,and evaluates the security function vulnerabilities of Intranet software system.It forms a set of functional security analysis and testing methods,improves the current security testing methods,and enhances the ability of Intranet software system to deal with risks and threats.

关 键 词：内网软件系统 功能模型 漏洞分析 软件测试 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]