CN113434866B - Unified risk quantitative evaluation method for instrument function safety and information safety strategies - Google Patents

Abstract

The invention discloses a unified risk quantitative evaluation method for instrument function safety and information safety strategies, which specifically comprises the steps of establishing an instrument integrated cause-and-effect failure model by combining an attack tree and a fault tree; calculating the failure probability of each functional module of the instrument by analyzing the possibility of the occurrence of the attack, the possibility of the utilization of the loophole and the like; analyzing instrument security holes which can be relieved by instrument function security and information security policies and corresponding policy implementation effects according to the attributes of the security policies; adding a protection node in the integrated cause-and-effect failure model of the instrument, and establishing an instrument safety strategy evaluation model; and quantitatively evaluating the functional safety and information safety strategies of the instrument according to the change of the risk values before and after the safety strategy is implemented by performing expert scoring on each functional module of the instrument. The invention can provide a certain theoretical basis for the deployment of the safety strategy in the instrument design process, and improves the accuracy compared with the qualitative evaluation in each current safety standard.

Description

Unified risk quantitative assessment method for instrument functional safety and information security strategy

technical field

The invention belongs to the field of instrument safety protection, and more particularly relates to a unified risk quantitative assessment method for instrument function safety and information safety strategy.

Background technique

With the rapid development of microcomputer technology and network communication technology, intelligent instruments with functions such as measurement, calculation, control, execution, communication, and diagnosis have been widely used in field devices of industrial control systems. However, compared with traditional instruments, smart instruments bring great convenience to production and operation, but also face threats such as increasing functional failure factors and accelerated penetration of information attacks. Therefore, there is an urgent need for functional safety and information security protection of smart meters. How to carry out an effective and unified quantitative assessment of instrument security protection strategies under the requirements of functional safety and information security protection, so as to provide theoretical guidance for the later deployment of instrument functional safety and information security protection strategies is a major problem to be solved at present.

At present, there are independent effectiveness evaluation methods for instrument functional safety and information security policies, while different safety standards lack unified evaluation methods and indicators for safety policies. In the prior art, the objectives and functions of the functional security strategy are qualitatively described, and the vulnerabilities mitigated by the information security strategy and the existing problems are also qualitatively evaluated. The above methods all use qualitative methods to evaluate and describe the safety protection strategy, which lacks accuracy. At present, there is no evaluation method that can quantitatively evaluate the safety risk of the instrument.

SUMMARY OF THE INVENTION

In view of the above defects or improvement requirements of the prior art, the present invention provides a unified risk quantitative assessment method for instrument function safety and information security strategy, the purpose of which is to carry out quantitative method for instrument function safety and information security strategy based on the perspective of risk. Unified assessment, which improves accuracy compared to current qualitative methods.

In order to achieve the above object, the present invention provides a unified risk quantitative assessment method for instrument functional safety and information security strategy, and the method specifically includes the following steps:

(1) Query instrument information security vulnerabilities, analyze the attack paths that attackers will take, and establish attack trees;

(2) Analyze the vulnerability of instrument function modules, deduce the function failure process, and establish a fault tree;

(3) According to the correlation between information security events and functional failure events, establish a causal failure model of instrument integration based on attack tree and fault tree;

(4) Quantify the failure probability of the instrument function module from the probability of the attack and the probability of the vulnerability being exploited;

(5) Analyze the security attributes of instrument function security and information security policy from the perspective of security functions, policy associations, security levels and security objectives;

(6) Add protection nodes associated with safety attributes in the causal failure model of instrument integration to establish an evaluation model for safety strategies;

(7) Combined with the assets of each functional module of the instrument, according to the risk quantification formula, quantitatively evaluate the instrument functional safety and information security strategy.

Further, the step (4) specifically includes:

(41) The probability of implementing an attack is:

表示发起攻击事件的难易程度；det_Ai表示攻击事件可能被发现的等级；W_cost表示攻击成本参数的权重；W_diff表示攻击难度参数的权重；W_det表示被发现的可能性参数的权重，且W_cost+W_diff+W_det＝1；

表示攻击成本参数的效用值；

表示攻击难度参数的效用值；

表示攻击被发现可能性参数的效用值；Among them, A _i represents any attack node, that is, the attack event initiated by the attacker; P(Ai) represents the probability of the attack node occurring; cost _Ai represents the cost required to initiate the attack event;

Indicates the difficulty of initiating an attack event; det _Ai represents the level at which the attack event may be discovered; W _cost represents the weight of the attack cost parameter; W _diff represents the weight of the attack difficulty parameter; W _det represents the weight of the possibility of being discovered, and W _cost + W _diff + W _det =1;

represents the utility value of the attack cost parameter;

Indicates the utility value of the attack difficulty parameter;

The utility value of the parameter representing the probability of an attack being discovered;

The probability of vulnerability being exploited = attack route score × attack complexity score × authentication score × ((confidentiality impact score × confidentiality weight) + (integrity × integrity weight) + (availability × availability weight));

(42) Combine the probability of attacking and the probability of exploiting vulnerabilities with the integrated causal failure model of the instrument to quantify the failure probability of each functional module of the instrument:

P(F _i )=P(F _i |V _i =T,A _i =T)×P(V _i =T)×P(A _i =T)+P(Fi |V _{i =} T,A _i =F)×P(V _i =T)×P(A _i =F)+P(Fi |V _i =F,A _i =T)×P(V _i =F)×P(A _{i =} T )+P(F _i |V _i =F, A _i =F)×P(V _i =F)×P(A _i =F)

Among them, P(F _i ) is the failure probability of the smart meter function module F _i , P(F _i |V _i ,A _i ) represents the failure condition probability of the smart meter function module, and P(V _i =T) represents the exploited probability of the vulnerable node , P(V _i =F) represents the probability that the vulnerability node is not exploited, P(A _i =T) represents the probability that the attack node occurs, and P(A _i =F) represents the probability that the attack node does not occur.

Further, the step (5) specifically includes:

(51) Based on the instrument information security vulnerabilities and instrument functional module vulnerabilities in steps (1) and (2), query the security standards, and select functional security policies and information security policies applicable to the instrument;

(52) According to the qualitative description of the instrument's functional security strategy and information security strategy in the security standard, combined with the security function, strategy association and security target attributes of the security strategy, analyze the information security vulnerabilities and functional module vulnerabilities that the security strategy can alleviate;

According to the security level attribute of the security policy, the security policy is graded to determine the effect of the policy implementation.

Further, the step (6) specifically includes:

(61) Implement the security vulnerability of the instrument function module that can be mitigated according to the instrument security policy, and add a protection node after connecting the logic gate of the attack node and the vulnerability node in the instrument integrated causal failure model, and after the function failure node;

(62) According to the level of the instrument security strategy, set different protection coefficients for the associated protection nodes, and establish the instrument security strategy evaluation model.

Further, the step (7) specifically includes:

(71) The importance of security-related functional module assets is interactively scored. Security-related functional module assets include instrument sensing and detection, data processing and control, electrical output and drive, and network communication;

(72) Combined with the failure probability of each safety-related functional module of the instrument obtained through the instrument security strategy evaluation model after the implementation of the security strategy, the quantitative formula is used to quantitatively evaluate the functional safety strategy and information security strategy of the instrument;

The quantification formula is:

Among them, ΔR is the change value of the instrument risk before and after the implementation of the security policy, and _Wi is the value score of each functional module of the instrument based on the interactive scoring;

计算公式为：Failure probability of functional modules after implementing functional safety policy

The calculation formula is:

计算公式为：Failure probability of functional modules after implementing information security policy

The calculation formula is:

Among them, d _j is the protection coefficient of the associated protection node that can alleviate the security policy corresponding to the instrument security vulnerability.

On the other hand, the present application also implements a unified risk quantitative assessment system for instrument functional safety and information security strategy, the system includes the following parts:

The first module is used to query instrument information security vulnerabilities, analyze the attack paths that attackers will take, and establish an attack tree;

The second module is used to analyze the vulnerability of the instrument function module, deduce the function failure process, and establish a fault tree;

The third module is used to establish an instrument-integrated causal failure model based on the attack tree and fault tree according to the correlation between information security events and functional failure events;

The fourth module is used to quantify the failure probability of the instrument function module from the probability of the attack and the probability of the vulnerability being exploited;

The fifth module is used to analyze the security attributes of instrument functional security and information security policies from the perspective of security functions, policy associations, security levels and security objectives;

The sixth module is used to add protection nodes associated with safety attributes in the instrument integrated causal failure model to establish an evaluation model of safety policies;

The seventh module is used to quantitatively evaluate the functional safety of the instrument and the information security strategy according to the risk quantification formula in combination with the assets of each functional module of the instrument.

Further, the fourth module specifically includes:

The first unit is used to analyze the probability of implementing an attack, specifically:

表示发起攻击事件的难易程度；det_Ai表示攻击事件可能被发现的等级；W_cost表示攻击成本参数的权重；W_diff表示攻击难度参数的权重；W_det表示被发现的可能性参数的权重，且W_cost+W_diff+W_det＝1；

表示攻击成本参数的效用值；

表示攻击难度参数的效用值；

表示攻击被发现可能性参数的效用值；Among them, A _i represents any attack node, that is, the attack event initiated by the attacker; P(Ai) represents the probability of the attack node occurring; cost _Ai represents the cost required to initiate the attack event;

Indicates the difficulty of launching an attack event; det _Ai represents the level at which the attack event may be discovered; W _cost represents the weight of the attack cost parameter; W _diff represents the weight of the attack difficulty parameter; W _det represents the weight of the possibility of being discovered, and W _cost + W _diff + W _det =1;

represents the utility value of the attack cost parameter;

Indicates the utility value of the attack difficulty parameter;

The utility value of the parameter representing the probability of an attack being discovered;

The probability of vulnerability being exploited = attack route score × attack complexity score × authentication score × ((confidentiality impact score × confidentiality weight) + (integrity × integrity weight) + (availability × availability weight));

The second unit is used to quantify the failure probability of each functional module of the instrument by combining the probability of the attack and the probability of the vulnerability being exploited with the integrated causal failure model of the instrument:

P(F _i )=P(F _i |V _i =T,A _i =T)×P(V _i =T)×P(A _i =T)+P(Fi |V _{i =} T,A _i =F)×P(V _i =T)×P(A _i =F)+P(Fi |V _i =F,A _i =T)×P(V _i =F)×P(A _{i =} T )+P(F _i |V _i =F, A _i =F)×P(V _i =F)×P(A _i =F)

Among them, P(F _i ) is the failure probability of the smart meter function module F _i , P(F _i |V _i ,A _i ) represents the failure condition probability of the smart meter function module, and P(V _i =T) represents the exploited probability of the vulnerable node , P(V _i =F) represents the probability that the vulnerability node is not exploited, P(A _i =T) represents the probability that the attack node occurs, and P(A _i =F) represents the probability that the attack node does not occur.

Further, the fifth module specifically includes:

The query module is used for querying the security standard based on the instrument information security vulnerability and the vulnerability of the instrument function module in the first module and the second module, and selecting the functional security policy and information security policy applicable to the instrument;

The analysis unit is used to analyze the information security vulnerabilities and functional module vulnerabilities that can be mitigated by the security strategy according to the qualitative description of the functional security strategy and information security strategy of the instrument in the security standard, combined with the security function, strategy association and security target attributes of the security strategy. sex;

According to the security level attribute of the security policy, the security policy is graded to determine the effect of the policy implementation.

Further, the sixth module specifically includes:

The protection adding unit is used to implement the security vulnerability of the instrument function module that can be mitigated according to the instrument security policy, and add a protection node after the logic gate connecting the attack node and the vulnerability node in the instrument integrated causal failure model, and after the function failure node;

The evaluation model establishment unit is used to set different protection coefficients for the associated protection nodes according to the level of the instrument security strategy, and establish an instrument security strategy evaluation model.

Further, the seventh module specifically includes:

The importance scoring unit is used to interactively score the importance of security-related functional module assets. The security-related functional module assets include instrument sensing and detection, data processing and control, electrical output and drive, and network communication;

The quantitative evaluation unit is used to quantitatively evaluate the functional safety strategy and information security strategy of the instrument by using the quantitative formula in combination with the failure probability of each safety-related functional module of the instrument obtained through the instrument security strategy evaluation model after the implementation of the security strategy;

The quantification formula is:

Among them, ΔR is the change value of the instrument risk before and after the implementation of the security policy, and _Wi is the value score of each functional module of the instrument based on the interactive scoring;

计算公式为：Failure probability of functional modules after implementing functional safety policy

The calculation formula is:

计算公式为：Failure probability of functional modules after implementing information security policy

The calculation formula is:

Among them, d _j is the protection coefficient of the associated protection node that can alleviate the security policy corresponding to the instrument security vulnerability.

In general, compared with the prior art, the above technical solutions conceived by the present invention have the following beneficial effects:

(1) The above-mentioned unified risk quantitative assessment method for instrument functional safety and information security strategy proposed by the present invention overcomes the limitation of qualitative description of functional safety and information security strategy in traditional security standards, and can effectively analyze instrument functional safety and information security strategy implementation effect;

(2) The present invention first analyzes the instrument function module loopholes that can be alleviated by the instrument security strategy according to the security objectives, security functions and policy associated attributes of the instrument function security and information security strategy, and then analyzes the security strategy implementation effect according to the security level attribute of the instrument security strategy. Finally, the security attributes are associated with the protection nodes in the security policy evaluation model, which provides the possibility for the analysis of the instrument function security policy and the information security policy based on a unified scale;

(3) The present invention performs a unified quantitative assessment on instrument function safety and information security strategy from the perspective of risk. Compared with qualitative methods, the accuracy is improved and a certain theoretical basis is provided for the deployment of security strategies.

Description of drawings

Fig. 1 is the schematic flow sheet of the method of the present invention;

2 is a schematic diagram of an instrument attack tree in an embodiment of the present invention;

3 is a schematic diagram of an instrument fault tree in an embodiment of the present invention;

4 is a schematic diagram of a causal failure model of instrument integration in an embodiment of the present invention;

FIG. 5 is a schematic diagram of the extraction and analysis process flow of instrument function safety and information safety policy attributes in the present invention;

FIG. 6 is a schematic diagram of the evaluation model of instrument function safety and information safety policy in the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

The present invention provides a unified risk quantification assessment method for instrument function safety and information security strategy, the process of which is shown in FIG. 1 and includes the following steps:

Step 1: Query instrument information security vulnerabilities, analyze possible attack paths taken by attackers, and establish attack trees.

Step 1.1: Obtain the list of instrument security vulnerabilities by performing vulnerability scanning or querying the information security vulnerability database, and then analyze all possible attack scenarios based on the list of instrument security vulnerabilities and combined with known attack strategies.

Query the information security vulnerability database and find the common information security vulnerabilities CNVD-2021-07490, CNVD-2021-17406, CNVD-2020-10538 of the instrument. Attackers can use these vulnerabilities to launch denial of service attacks, resulting in the failure of the network communication interface function module; With the help of the configuration, verification management, debugging and other functions of the general portable handheld terminal or the instrument management communication software, the firmware or operating system of the smart instrument is tampered with through the debugging interface, etc., and even malicious code is injected, resulting in the data processing of the smart instrument. The function of the control module is invalid; when an attacker can also access the smart meter through unauthorized external devices or communication configuration software, he can maliciously tamper with the range of the smart meter, zero drift, and stop working.

Step 1.2: Take the attack event node and the vulnerability node as leaf nodes, analyze the function failure event that may be caused by launching an information attack by exploiting the vulnerability, and use the function failure event as the root node to build an attack tree from bottom to top. The attack tree is shown in Figure 2.

Step 2: Analyze the vulnerability of instrument function modules, deduce the function failure process, and establish a fault tree.

Step 2.1: Combine the process potential failure mode and consequence analysis table or consult on-site engineering personnel, analyze the vulnerability of each safety-related functional module of the instrument, and determine the common failure function modules of the instrument. The process potential failure mode and consequence analysis table is shown in Table 1. .

Table 1

Step 2.2: Take the failure event of a certain functional module of the instrument as the top-level event node. Combined with the working principle of the instrument, the functional module failure event that caused the top-level event is taken as the basic event node, and the top-level event node and the basic event node are connected by logic gates and directed edges Event nodes are connected to build a fault tree from top to bottom.

The input signal of the smart instrument should be transformed, amplified, shaped, compensated, etc. through the switch input channel circuit or the analog input channel circuit. For the analog signal, it needs to be converted into a digital signal by the A/D converter, and then sent to the microcontroller through the interface. The input data is processed, calculated and analyzed by the microcontroller, and sent to the display or printer through the interface. It can also output the switch signal or convert it into an analog signal through the D/A converter of the analog channel. Data communication can be achieved through serial interfaces (such as RS-232, etc.) to complete more complex measurement and control tasks. Therefore, once the function of the sensing detection module or the data processing and control module fails, the output driving module and the network communication module will also fail. Based on the above failure scenarios, a fault tree is established from top to bottom, as shown in Figure 3.

Step 3: Analyze whether the same node exists between the basic event node of the fault tree and the attack target node of the attack tree. Once the same node exists, take the same basic node of the fault tree as the attack target, add the attack path, and obtain the causal failure of instrument integration Model. The causal failure model of instrument integration is shown in Figure 4.

Step 4: Analyze the possibility of instrument function module failure events from the perspectives of the possibility of implementing attacks and the possibility of exploiting vulnerabilities.

Step 4.1: Analyze the possibility of launching an attack from the attack cost, attack difficulty, and possibility of being discovered, and analyze the possibility of exploiting the vulnerability through the CVSS vulnerability scoring standard.

Considering that the possibility of an attacker launching an attack is related to the cost of the attack, the difficulty of the attack, and the possibility of the attack being discovered, when calculating the possibility of attacking a node, assign these three attribute values to each attacking node. Using the multi-attribute utility theory, the above attributes are converted into their utility values for achieving their goals. The formula for calculating the probability of an attacker launching an attack is as follows:

表示发起攻击事件所需的成本；

表示发起攻击事件的难易程度；det_Ai表示攻击事件可能被发现的等级。W_cost表示攻击成本参数的权重；W_diff表示攻击难度参数的权重；W_det表示估计被发现的可能性参数的权重，且这三个权重系数之和为1。

表示攻击成本参数的效用值；

表示攻击难度参数的效用值；

表示攻击被发现可能性参数的效用值。Among them: A _i represents any attack node, that is, the attack event initiated by the attacker; P(A _i ) represents the probability of the attack node occurring;

Indicates the cost of launching an attack event;

Indicates the difficulty of launching an attack event; det _Ai indicates the level at which an attack event may be discovered. W _cost represents the weight of the attack cost parameter; W _diff represents the weight of the attack difficulty parameter; W _det represents the weight of the estimated probability of being discovered, and the sum of these three weight coefficients is 1.

represents the utility value of the attack cost parameter;

Indicates the utility value of the attack difficulty parameter;

Indicates the utility value of the attack detection probability parameter.

Finding the probability P(A _i ) of an attack event by formula (1) involves three attributes, so it is necessary to formulate corresponding scoring standards to evaluate them. See Table 2 for the grading criteria used in the present invention.

Table 2

通过分析可知，

diff_Ai、

与

成反比例关系。为了计算，三组之间的对应关系均取为U(x)＝1/x。运用式(1)即可求出攻击事件发生的概率P(A_i)。In order to calculate the probability of an attacker launching an attack event, the utility value needs to be calculated

From the analysis, it can be seen that

diff _Ai ,

and

inversely proportional. For calculation, the correspondence between the three groups is taken as U(x)=1/x. Using formula (1), the probability P(A _i ) of the attack event can be obtained.

Common Vulnerability Scoring System (CVSS), the "Common Vulnerability Scoring System", is an "industry open standard, which is designed to evaluate the severity of vulnerabilities. The main purpose is to help people establish a standard for measuring the severity of vulnerabilities and facilitate the analysis of vulnerabilities. The present invention calculates the possibility of exploiting instrument information security loopholes through CVSS. CVSS includes three elements: basic score, temporary score and environmental score. Only the basic score is considered here, and the basic score evaluation index is shown in Table 3.

table 3

Basic Score = Attack Path Score * Attack Complexity Score * Authentication Score * ((Confidentiality Impact Score * Confidentiality Weight) + (Integrity * Integrity Weight) + (Availability * Availability Weight))

Step 4.2: Analyze historical data or consult on-site engineers to analyze the conditional probability of failure of each functional module of the instrument, and obtain the failure probability of each functional module of the instrument by combining the probability of attackers launching attacks and the probability of exploiting vulnerabilities in formula (1).

Step 5: From the perspectives of security functions, policy associations, security levels, security objectives, etc., perform quantitative analysis of security attributes and characteristics on instrument functional security and information security policies. See Figure 5 for a schematic diagram of the attribute analysis and quantification process of the security policy.

Step 5.1: According to the common information security vulnerabilities of the instrument and the failure mechanism of functional modules obtained in Step 1 and Step 2, by querying the relevant security standards, select the function failure control strategy and information security protection strategy applicable to the instrument.

As an on-site physical layer device, the information security threats faced by smart meters mainly include DOS attacks, access to unknown devices, tampering, etc. The present invention selects access control, intrusion detection, log management, authority control, and identity The verification strategy considers that the instrument mainly realizes the acquisition, calculation, output and communication functions of the instrument through the function modules of sensing and detection, data processing and control, electrical output and drive, and network communication interface. Once a functional module fails, it will greatly affect the instrument. effect value. According to IEC61508, the present invention selects microprocessor unit diagnosis, acquisition diagnosis, output diagnosis, timing and logic monitoring, and multiple technical strategies.

Step 5.2: According to the qualitative description of the functional safety and information security policies of the instrument in the relevant security standards, and according to the security functions, policy associations, and security target attributes of the instrument security policy, analyze the instrument function module security vulnerabilities and security policies that can be mitigated by the security policy Implementation Effect.

Taking access control as an example, access control is the first step in protecting industrial control systems and their critical assets from accidental damage. Permission control determines the process by which relevant roles should be allowed to enter or leave a system. Once this information is identified, defense-in-depth access controls can be implemented to verify that only authorized personnel and equipment can actually access the industrial control system. Therefore, permission control can mitigate unknown device access vulnerabilities. Compared with traditional permission control, role-based permission control overcomes the difficulty of timely updating role permissions in dynamic environments through access based on user roles or job responsibilities, and has better vulnerability protection effects.

Step 6: Add protection nodes associated with security attributes in the causal failure model to establish an evaluation model of security policies.

Step 6.1: Implement the security vulnerabilities of the instrument function module that can be mitigated according to the instrument security policy, and add a protection node after the logic gate connecting the attack node and the vulnerability node and after the function failure node in the instrument integrated causal failure model.

According to the analysis in step 5, the vulnerabilities that can be mitigated by the implementation of the information security policy are obtained, and protection nodes are added to the corresponding attack paths. Add a guard node. The protection nodes associated with the instrument functional safety and information security policies are shown in Table 4.

Table 4

Step 6.2: According to the implementation effect of the instrument security strategy, set different protection coefficients for the protection nodes, and establish the instrument security strategy evaluation model.

For functional safety and information security policy security level attributes, the present invention sets two different levels, and the security policy level attribute table is shown in Table 5.

table 5

Based on the above steps, an instrument security policy evaluation model is established. The meaning of each node in the instrument security policy evaluation model is shown in Table 6.

Table 6

Step 7: Combined with the assets of each functional module of the instrument, quantify the functional safety of the instrument and the information security strategy according to the risk quantification formula.

Step 7.1: Consider the security-related functional module assets such as instrument sensing and detection, data processing and control, electrical output and drive, network communication, etc., and score experts according to the importance of the functional modules;

Step 7.2: Combine the change value ΔP(F _i ) of the failure probability of each functional module of the instrument before and after the implementation of the security strategy, and use the quantitative formula to quantitatively evaluate the functional safety and information security strategy of the instrument.

Among them, ΔR is the change value of the instrument risk before and after the implementation of the security policy, _n is the number of instrument safety-related functional modules, and Wi is the value score of each functional module of the instrument based on expert scoring.

Obtain the conditional probabilities P(F ₁ |A ₁ ,V ₁ ), P(F ₂ |A ₂ ,V ₂ ), P(F ₃ of F ₁ , F ₂ , F ₃ nodes by analyzing historical data or consulting field engineers |F ₁ , F ₂ ), P(F ₄ |F ₁ , A ₃ , V ₃ ), combined with the probability of occurrence of attack event nodes A ₁ , A ₂ , A ₃ P(A ₁ ), P(A ₂ ), P(A ₃ ), and the probability of occurrence of vulnerable nodes P(V ₁ ), P(V ₂ ), and P(V ₃ ). Furthermore, the failure probabilities P(F ₁ ), P(F ₂ ), P(F ₃ ), and P(F ₄ ) of each functional module can be calculated.

新的漏洞节点的发生概率

进而得到各功能模块失效事故新的概率

结合功能模块的价值分数W_i，i＝1，2，3，4，最终得到风险变化值公式By implementing security policies, under the action of security protection nodes, the probability of occurrence of new attack event nodes is obtained

The probability of occurrence of new vulnerability nodes

Then, the new probability of failure accident of each functional module is obtained.

Combined with the value score W _i of the functional module, i=1, 2, 3, 4, the risk change value formula is finally obtained

According to the change of the risk value before and after the implementation of each security policy calculated by formula (3), the functional safety and information security policy of the instrument are quantitatively evaluated.

计算公式为：Failure probability of functional modules after implementing functional safety policy

The calculation formula is:

计算公式为：Failure probability of functional modules after implementing information security policy

The calculation formula is:

d _j is the protection coefficient of the associated protection node that can alleviate the security policy corresponding to the instrument security vulnerability.

Those skilled in the art can easily understand the above content, the above description is only a preferred embodiment of the present invention, and is not intended to limit the present invention, any modification, equivalent replacement and improvement made within the spirit and principle of the present invention etc., should be included within the protection scope of the present invention.

Claims (6)

1. A unified risk quantitative evaluation method for meter functional safety and information safety strategies is characterized by comprising the following steps:

(1) inquiring instrument information security loopholes, analyzing attack paths which can be taken by attackers, and establishing an attack tree;

(2) analyzing the vulnerability of the functional module of the instrument, deducing the failure process of the function and establishing a fault tree;

(3) establishing an instrument integrated causal failure model based on an attack tree and a fault tree according to the relevance between the information security event and the functional failure event; establishing an integrated causal failure model of the instrument based on the attack tree and the fault tree comprises the following steps: whether the same node exists between the basic event node of the fault tree and the attack target node of the attack tree is analyzed, once the same node exists, the same basic node of the fault tree is used as an attack target, an attack path is added, and an instrument integrated causal failure model is obtained;

(4) quantifying the failure probability of the instrument functional module from the probability of implementing the attack and the probability of the exploit;

(5) performing security attribute analysis on the instrument function security and the information security policy from the perspective of security function, policy association, security level and security target;

(6) adding a protection node associated with a safety attribute in the instrument integrated causal failure model, and establishing an evaluation model of a safety strategy;

(7) quantitatively evaluating the function safety and information safety strategies of the instrument according to a risk quantitative formula by combining assets of each function module of the instrument;

the step (4) specifically comprises:

(41) the probability of implementing an attack is:

wherein A is_iRepresenting an attack event initiated by any one attack node, namely an attacker; p (ai) represents the probability of an attack node occurring; cost_AiRepresents the cost required to launch an attack event;

representing the ease of initiating an attack event; det_AiIndicating a level at which an attack event may be discovered; w_costA weight representing an attack cost parameter; w_diffA weight representing an attack difficulty parameter; w_detRepresents the weight of the discovered likelihood parameter, and W_cost+W_diff+W_det＝1；

A utility value representing an attack cost parameter;

a utility value representing an attack difficulty parameter;

a utility value representing a parameter of likelihood of attack being discovered;

the probability of vulnerability being exploited ═ attack pathway score × attack complexity score × authentication score × ((confidentiality impact score × confidentiality weight) + (integrity × integrity weight) + (availability × availability weight));

(42) combining the probability of implementing the attack and the probability of utilizing the vulnerability with an integrated causal failure model of the instrument, quantifying the failure probability of each functional module of the instrument:

P(F_i)＝P(F_i|V_i＝T，A_i＝T)×P(V_i＝T)×P(A_i＝T)+P(F_i|V_i＝T，A_i＝F)×P(V_i＝T)×P(A_i＝F)+P(F_i|V_i＝F，A_i＝T)×P(V_i＝F)×P(A_i＝T)+P(F_i|V_i＝F，A_i＝F)×P(V_i＝F)×P(A_i＝F)

wherein, P (F)_i) For intelligent instrument function module F_iProbability of failure, P (F)_i|V_i,A_i) Indicating probability of failure condition of smart meter functional module, P (V)_iT) represents the probability of a vulnerability node being exploited, P (V)_iF) denotes the probability that a vulnerability node is not utilized, P (a)_iT) denotes the probability of occurrence of an attack node, P (a)_iF) represents the probability that an attacking node has not occurred;

the step (7) specifically comprises:

(71) carrying out important interaction scoring on the safety related function module assets, wherein the safety related function module assets comprise instrument sensing and detection, data processing and control, electric output and drive and network communication;

(72) quantitatively evaluating the functional safety strategy and the information safety strategy of the instrument by using a quantitative formula in combination with the failure probability of each safety-related functional module of the instrument obtained by the instrument safety strategy evaluation model after the safety strategy is implemented;

the quantization formula is:

wherein, Delta R is the risk change value of the instrument before and after the implementation of the safety strategy, W_iValue scores of all function modules of the instrument based on the interaction scoring; n is the number of the safety related function modules of the instrument;

functional module failure probability after enforcement of functional security policies

The calculation formula is as follows:

functional module failure probability after implementing information security policy

The calculation formula is as follows:

wherein d is_jThe protection coefficient of the associated protection node corresponding to the security policy of the security vulnerability of the instrument can be relieved.

2. The method for quantitatively evaluating the unified risk of the meter functional safety and the information safety policy according to claim 1, wherein the step (5) specifically comprises:

(51) inquiring a safety standard based on instrument information security holes and instrument function module fragility in the step (1) and the step (2), and selecting a function security strategy and an information security strategy suitable for the instrument;

(52) analyzing information security vulnerability and function module vulnerability which can be relieved by a security strategy according to qualitative description of a function security strategy and an information security strategy of an instrument in a security standard and by combining the security function, strategy association and security target attribute of the security strategy;

and grading the security policy according to the security level attribute of the security policy to determine the policy implementation effect.

3. The method for quantitatively evaluating the unified risk of the meter functional safety and the information safety policy according to claim 1, wherein the step (6) specifically comprises:

(61) implementing the safety loophole of the instrument functional module which can be relieved according to the instrument safety strategy, and adding a protection node after connecting a logic gate of an attack node and a loophole node and after a functional failure node in the integrated causal failure model of the instrument;

(62) and setting different protection coefficients for the associated protection nodes according to the grade of the instrument safety strategy, and establishing an instrument safety strategy evaluation model.

4. A system for unified risk quantification assessment of meter functional safety and information security policies, the system comprising:

the first module is used for inquiring the security vulnerability of the instrument information, analyzing an attack path which can be taken by an attacker and establishing an attack tree;

the second module is used for analyzing the vulnerability of the instrument functional module, deducing the functional failure process and establishing a fault tree;

the third module is used for establishing an instrument integrated causal failure model based on an attack tree and a fault tree according to the relevance between the information security event and the functional failure event; establishing an integrated causal failure model of the instrument based on the attack tree and the fault tree comprises the following steps: whether the same node exists between the basic event node of the fault tree and the attack target node of the attack tree is analyzed, once the same node exists, the same basic node of the fault tree is used as an attack target, an attack path is added, and an instrument integrated causal failure model is obtained;

a fourth module for quantifying a failure probability of the meter functional module from a probability of implementing the attack and a probability of the exploit;

the fifth module is used for analyzing the safety attribute of the instrument function safety and the information safety strategy from the aspects of safety function, strategy association, safety level and safety target;

the sixth module is used for adding a protection node associated with the safety attribute in the integrated causal failure model of the instrument and establishing an evaluation model of the safety strategy;

the seventh module is used for quantitatively evaluating the functional safety and information safety strategies of the instrument according to a risk quantitative formula by combining assets of all functional modules of the instrument;

the fourth module specifically includes:

the first unit is used for analyzing the probability of implementing the attack, and specifically comprises the following steps:

wherein A is_iRepresenting an attack event initiated by any one attack node, namely an attacker; p (ai) represents the probability of an attack node occurring; cost_AiRepresents the cost required to launch an attack event;

representing the ease of initiating an attack event; det_AiIndicating a level at which an attack event may be discovered; w_costA weight representing an attack cost parameter; w_diffA weight representing an attack difficulty parameter; w is a group of_detRepresents the weight of the discovered likelihood parameter, and W_cost+W_diff+W_det＝1；

A utility value representing an attack cost parameter;

a utility value representing an attack difficulty parameter;

a utility value representing a parameter of likelihood of attack being discovered;

probability that the vulnerability is exploited ═ attack approach score × attack complexity score × authentication score × ((confidentiality impact score × confidentiality weight) + (integrity × integrity weight) + (availability × availability weight));

the second unit is used for combining the probability of implementing the attack and the probability of utilizing the vulnerability with an integrated causal failure model of the instrument, and quantifying the failure probability of each functional module of the instrument:

wherein, P (F)_i) For intelligent instrument function module F_iProbability of failure, P (F)_i|V_i,A_i) Indicating probability of failure condition of smart meter functional module, P (V)_iT) represents the probability of a vulnerability node being exploited, P (V)_iF) denotes the probability that a vulnerability node is not utilized, P (a)_iT) denotes the probability of occurrence of an attack node, P (a)_iF) represents the probability that an attacking node has not occurred;

the seventh module specifically includes:

the system comprises an importance scoring unit, a safety-related function module asset management unit and a safety-related function module asset management unit, wherein the importance scoring unit is used for performing importance interactive scoring on the safety-related function module asset, and the safety-related function module asset comprises instrument sensing and detection, data processing and control, electric output and drive and network communication;

the quantitative evaluation unit is used for quantitatively evaluating the functional safety strategy and the information safety strategy of the instrument by using a quantitative formula in combination with the failure probability of each safety-related functional module of the instrument obtained by the instrument safety strategy evaluation model after the safety strategy is implemented;

the quantization formula is:

wherein, Delta R is the risk variation value of the instrument before and after the implementation of the safety strategy, W_iValue scores of all function modules of the instrument based on the interaction scoring; n is the number of the safety related function modules of the instrument;

functional module failure probability after enforcement of functional security policies

The calculation formula is as follows:

functional module failure probability after implementing information security policy

The calculation formula is as follows:

wherein, d_jThe protection coefficient of the associated protection node of the security strategy corresponding to the security vulnerability of the instrument can be relieved.

5. The system for quantitatively evaluating the unified risk of the meter functional safety and the information safety policy according to claim 4, wherein the fifth module specifically comprises:

the query module is used for querying a safety standard based on instrument information security holes and the vulnerability of an instrument functional module in the first module and the second module, and selecting a functional security strategy and an information security strategy which are suitable for the instrument;

the analysis unit is used for analyzing information security vulnerabilities and function module vulnerabilities which can be relieved by the security strategy according to qualitative description of the function security strategy and the information security strategy of the instrument in the security standard and by combining the security function, strategy association and security target attribute of the security strategy;

and grading the security policy according to the security level attribute of the security policy, and determining the policy implementation effect.

6. The system for quantitatively evaluating the unified risk of the meter functional safety and the information safety policy according to claim 4, wherein the sixth module specifically comprises:

the protection adding unit is used for implementing the safety loophole of the instrument function module which can be relieved according to the instrument safety strategy, and adding protection nodes after connecting the attack nodes and the logic gates of the loophole nodes in the instrument integrated causal failure model and after the function failure nodes;

and the evaluation model establishing unit is used for setting different protection coefficients for the associated protection nodes according to the grade of the instrument safety strategy and establishing an instrument safety strategy evaluation model.

Images