信息安全評(píng)估研究

介紹了信息安全評(píng)估的定義、標(biāo)準(zhǔn)及其發(fā)展，重點(diǎn)討論了可信計(jì)算機(jī)系統(tǒng)評(píng)估準(zhǔn)則中機(jī)構(gòu)化保護(hù)級(jí)評(píng)估標(biāo)準(zhǔn)安全策略中的自主訪問(wèn)控制、客體重用、標(biāo)記(標(biāo)記完整性和標(biāo)記信息的輸出)和強(qiáng)制訪問(wèn)控制；責(zé)任中的身份鑒別和審計(jì)；保證中的操作保證(系統(tǒng)結(jié)構(gòu)、系統(tǒng)完整性、隱蔽信道分析和可信設(shè)施管理)和生命周期保障(安全測(cè)試、設(shè)計(jì)說(shuō)明書(shū)和檢驗(yàn)以及配置管理)；文檔中的安全特征用戶指南、可信設(shè)施指南、測(cè)試文檔和設(shè)計(jì)文檔。最后，將機(jī)構(gòu)化保護(hù)級(jí)與信息技術(shù)安全評(píng)估通用準(zhǔn)則中的測(cè)試級(jí)5進(jìn)行了比較分析.

This paper introduces the definition, standard and development on evaluation of information security; emphasis on Class of B2 in TCSEC, especially the security policy of B2, such as discretionary access control, object reuse, Labels (label integrity and exportation of labeled information) and mandatory access control. this paper also studies and analyses the other requirements for class B2, such as identification and authentication in the requirement of accountability; operational assurance (system architecture, system integrity, covert channel analysis and trusted facility management) and life-cycle assurance (security testing, design specification and verification and configuration management) in the requirement of assurance; security features user’s guide, trusted facility manual, test documentation and design documentation in the requirement of documentation. in the end of this paper, we study and comparatively analyses the class of B2 with the class of EAL5 in CC.