针对影响民用飞机机载系统安全的信息安保威胁问题，通过研究ISO27005和航空工业标准，提出了一种适用于机载系统的安保风险评估方法。该方法基于威胁条件和威胁场景进行系统脆弱性分析，并结合传统的飞机安全性分析方法与安保风险评估方法，提出一套可量化的风险值计算方法。通过关系矩阵在安全性与安保等级间建立了相关性，为系统需求和架构设计提供了依据。实例验证结果表明，该方法能提供正确与可信的机载系统安保风险评估数据。%Aimed at the issues of information security threat which impact on safety of commercial aircraft airborne system, this paper proposes a security risk assessment methodology for airborne system by studying ISO/IEC27005 which is a standard for information security management and some relational aviation industry standards. It is advanced to use threat condition and threat scenario for system vulnerability assessment. Through combining traditional aircraft safety assessment methods and secu-rity risk evaluation methods, a set of quantitative risk estimation algorithms is proposed. Through relational matrix the relativity between safety and security level is built, and the basis for system’s requirement and architecture design is provided. According to the case results, the methodology can provide veracity and reliability airborne system security assessment data.
展开▼
