One of the key tasks during the state examination is the identification of the functional security profile. During the examination, the types of information that is processed and the risks of its loss, modification or disclosure are evaluated. For this, the functional security profile is being built. To solve the problem of identifying the functional security profile, it is necessary to: determine the levels of functional security services, implemented comprehensive information security systems of the object of examination; determination of the completeness and consistency of the profile; identification of the description of the functional security services in the source documents. The paper proposes a model of parameters for identifying the functional security profile in computer systems. A definition is given for the sets of criteria, their elements and levels. All this made it possible in a formal form to form the necessary set of quantities for the implementation of the identification of functional security profile in the computer systems. The development of these works is the development of a method for identifying functional security profile. This will automate the determination of the requirements of the regulatory document regarding the protection functions (security services) and guarantees, which will be done in subsequent articles.
One of the key tasks during the state examination is to identify the functional security profile. During examination evaluated the types of information [1-8], which is processed in the system and the risk of its loss, modification or disclosure. For this purpose, a functional security profile (FSP) is built which contains the lists of functional security service (FSS) and levels that are needed to ensure an acceptable level of information security.
Exactly FSP is the key element of public examinations and its analysis on accordance to the normative document is one of major tasks.
For the decision of task of FSP authentication, it is necessary to carry out: determination of FSS levels, implemented FSP examination object; determine completeness and consistency profile; FSS describe the identification in the original documents. To determine the completeness and consistency of rules to consider construction of FSP (see [9]), and automation of this process contacts with corresponding rules.
For the decision of task proposed model parameters for identifying the FSP in computer system (CS) and FSP identification method.
As it’s known [9], the criteria reflect methodological framework for determining requirements of information security in of computer systems against unauthorized access, the creation of protected CS and protection against unauthorized access, evaluation of information security in the CS and its suitability for the treatment of critical information (information that requires defense).
Given the above, let’s form the set of all
criteria for information security
МК = w МКq = МК1, МК2 ,.., МКw ,
q=1
(
Next, on the basis of (
wq
МКq =
e=1
МКq,e = МКq,1, МКq,2 ,.., МКq,wq ,
(
МКq,e МКq ( e = 1,wq ) – e -th element МКq - th set of criteria, and wq its count.
Thus, (
w МК = q=1
w wq МКq = q=1 e=1
МКq,e =
= МК1,1, МК1,2 ,..., МК1,w1 ,
МК2,1, МК2,2 ,..., МК2,w2 ,...,
МКw,1, МКw,2 ,..., МКw,ww .
(
Next, on the basis of (
wq,e МКq,e = y=1 МКq,e,y = МКq,e,1, МКq,e,2 ,.., МКq,e,wq,e ,
(
Thus, (
w w wq МК = МКq = МКq,e =
q=1 q=1 e=1 = w wq wq,e = q=1 e=1 y=1 МКq,e,y w wq = МКq,e,1,МКq,e,2 ,...,МКq,e,wq,e =
q=1 e=1
w
МКq,1,1 ,МКq,1,2 ,. .,МКq,1,wq,1 МКq,2,1 ,МКq,2,2 ,. .,МКq,2,wq,2 , (
Step 1. Formation of the primary set of functional security services.
As previously described, the levels of the elements of the sets of criteria are determined by МКq,e,y
where y = 1,wq,e – y -th level of МКq,e -th element of МК q - th set criteria аnd wq,e its maximum level. Thus, we define the primary set (PS) of functional security services (FSS) as the union of elements of sets of criteria defined by the expert:
k
ПМp = ПМp,f = ПМp,1,ПМp,2...,ПМp,k , (
Step 2. Formation of secondary sets of functional security services.
Next, we form an FSSSS, which consists elements of a set of criteria МК , that have levels that characterize the FSS according to [9]. In turn, the FFP function is intended to display from a set of PS into one or more elements of the set МК by means of which can form a set of all possible functions from the elements, ПМf , f = 1,k . We define the number of SS of the FSS:
k k
ВМp = ВМp,f = ФВП(ПМp,f ) =
f =1 f =1
= ВМp,1, ВМp,2 ,..., ВМp,k =
= ФВП(ПМp,1), ФВП(ПМp,2 ),..., ФВП(ПМp,k ),
(
Step 3. Formation of a basic FSP.
The Basic Functional Security Profile (FSP), given the expertise and facility requirements to ensure the safe flow of information, consists of a set of primary (PS) and secondary (SS) FSS. Let us define the FSP:
k БЗp = f =1
k ФВП(ПМp,f ), f =1
ВМp,f = = ФВП (ПМp,1), ФВП (ПМp,2 ),.., ФВП (ПМp,k ), ВМp,1 , ВМp,2 ,.., ВМp,k , where БЗp − basic functional profile of protection of the project.
Step 4. Forming a set of order by element indices МКq,e,y
Using (
Step 5. Minimizing the basic FSP
Using (
w wq wq,e БЗpmin = VМКq,e,y =
q=1 e=1 y=1 w wq = q=1 e=1 w = q=1 МКq,1,1 ,МКq,1,2 ,..., МКq,1,wq,1 МКq,e,1 ,МКq,e,2 ,..., МКq,e,wq,e = МКq,2,1 ,МКq,2,2 ,..., МКq,2,wq,2 ,..., МКq,wq ,1 ,МКq,wq ,2 ,..., МКq,wq ,wq,wq = = МК1,1,1 ,МК1,1,2 ,..., МК1,1,w1,1 , МК1,2,1 ,МК1,2,2 ,..., МК1,2,w1,2 ,..., МК1,w1,1 ,МК1,w1,2 ,..., МК1,w1,w1,w1 , МК2,1,1 ,МК2,1,2 ,..., МК2,1,w2,1 , МК2,2,1 ,МК2,2,2 ,..., МК2,2,w2,2 ,..., МК2,w2,1 ,МК2,w2,2 , ..., МК2,w2,w2,w2 ,..., МКw,1,1 ,МКw,1,2 ,..., МКw,1,ww,1 , МКw,2,1 ,МКw,2,2 ,..., МКw,2,ww,2 ,..., МКw,ww ,1 ,МКw,ww ,2 ,..., МКw,ww ,ww,ww ,
As a result, I have developed a system that analyzes the input documents for the presence of a FSP and its identification by the formal characteristics of the [9].
In case of errors, corrects FSP. The system is implemented on the .NET platform in C# programming language using the Microsoft Visual Studio development environment.
The implementation of a software module for identifying a functional security profile is intended to assist the expert in identifying the FSP in a Microsoft Word document, and to assist the expert in the analysis of the FSP. The main purpose of this software module is to assist the expert in the creation of the FSP and to control compliance with the conditions set out in the regulatory document [9], namely: determination of integrity control; takeovers by the highest FSS of lower ones; checking the correlation of the FSS.
The software module is written in C#
programming language in VisualStudio 2005. In
the written code technology used
MSOffice'sCOMInterop, namely
Microsoft.Office.Interop.Word library and basic
libraries of programming language C#.
(
The interface of the program module (Fig. 1) is a window application, which is implemented in the form of a GUI program, in which there are the following controls: a window box type "Listbox" search for a functional security profile; buttons: "Find", "Stop", "Clear"; the right part of the screen has a window of type "ListView", which displays the paragraph number where the FPP was found and the security profile found; three buttons to search for compliance of the FPP with the terms of the regulatory document [9]; two textboxes of type "TextBox" in one of which the total number of paragraphs of the document is displayed, and in the other field the current paragraph when processing the document; a «statusStrip» type window with three positions: "Pending", "Search started", "Search is complete"; two window boxes of the type "СheckedBox" in one of which there is a possibility to deselect or select the search of the FSP, and in the other field there is an opportunity to go to the specified part of the FSP search text; window menu type "menuStrip", which contains two tabs: "File", "Help".
Microsoft Word is a specialized hierarchical, COM-oriented data warehouse - Structured Storage. A document can contain different types of data: structured text, graphics, mathematical expressions, organizational charts, etc. The concept of structured repository is an integral part of the modern programming paradigm based on the Component Object Model (COM). In fact, structured storage is the technology of combining objects (files) of objects with different nature and properties into one logical unit of storage. COM technology offers the standard implementation of the concept of structured storage in the form of a compound file (Compound File): a file system inside the file. The COM repository is a hierarchical structure of collections of objects of two types: Storage and Stream, to which directories and files correspond in the traditional file system. This approach can significantly reduce the storage costs in a single file of objects of different nature.
The implementation of the program includes methods of regular expressions: comparison of strings; suffix tree; approximating patterns; patterns with which multiple choices can be made, partial patterns. It is shown that technologies that combine the properties of approximating patterns and patterns by which multiple choice can be made, solve the problems of FSP analysis and can be used to build a system.
Testing of the program module was carried out in the process of the state examination of the CISS Grid site. The work of the software module resulted in the fulfillment of the tasks for the search of the FSP and analysis of the FSP for compliance with the three conditions. Performance analysis using the software module showed a multiple increase in the speed of document processing in the absence of errors, namely - the software module eliminated the repetition of the FSS, performed a check of integrity and completeness. The analysis of execution with the help of the program showed many increase of speed of processing of the document at 100% absence of errors, namely, the program excluded inclusion in the FPP of the same type of services, performed the check of integrity and completeness. Approximate time of processing of documents was: Technical task - 17 sec; Explanatory note to the technical project - 43 seconds; Act of inspection - 7 sec .; Information Security Policy - 12 sec. The program was run on a workstation with the following specifications: Intel Core i5-4670 CPU with 3.4 GHz; RAM - 8 GB.
The volume of the document is 8635 words. The average speed of reading in Ukrainian in an adult is within 150-200 words per minute [10], according to experimental studies, the average speed is 201 words per minute (with scatter of values from 60 to 378) with an average percentage of mastering 52 words per minute. Table 1 summarizes the time required for the expert to process the standard inputs of the CISS examination. It is only 43 minutes to read the “Terms of Reference”. Analysis time depends on the experience of the expert and can not be less than reading time. Therefore, the acceleration of processing will be at about fifteen thousand percent.
Let’s consider software features. Software Components: 1. Knowledge base; 2. User interface; 3. Software module "Meaning constants"; 4. Software module "FSP Identification"; 5. Software module “Determination of FSP"; Meaning Constants module. The module should ensure that semantic constants are extracted from the input documents by forming a set of defined constants in the knowledge base and inserting these constants into the output document templates by a defined algorithm.
The Subsystem of Meaning Constants module performs the following functions: • selection of semantic constants from input documents;
• formation of knowledge base of semantic constants; • Completing source document templates.
Module « FSP Determination» ensures that the FSP complies with the three criteria of RD STPI 2.5.004-99 [9]. The subsystem "Determination of FSP" ensures the following functions:
The FSP is obliged to include the control of the integrity of the STPI:
• the connection of the FSP to each other according to the RD STPI 2.5.004-99;
• if the service has any too FSS or more, then FSP can include only one functional security service.
FSP Identification Module
The module should ensure the formal compliance of the PSP with the format of the FSS description, as well as give the expert, in an interactive mode, the possibility to analyze the FSP in accordance with the normative document of the RD STPI 2.5.004-99.
The subsystem "Determination of FSP" must ensure the following functions: • check the description of the FSP; • provide the expert with the opportunity to receive extended information about the service in an interactive mode at events of type mouse focus.
According to testing methods, one can classify, for example, as black box testing or behavioral testing - a strategy (method) for testing the functional behavior of an object (program, system) from the point of view of the outside world, in which knowledge about the internal structure of the tested object is not used. Strategy refers to systematic methods for selecting and creating tests for a test suite. The behavioral test strategy is based on technical requirements and their specifications [2,11,12]. The "black box" refers to the object of study, the internal structure of which is unknown. The concept of a “black box” was proposed by Ashby, William Ross. In cybernetics, it allows you to study the behavior of systems, that is, their reactions to a variety of external influences and at the same time abstract from their internal structure. Manipulating only with inputs and outputs, it is possible to conduct certain studies. In practice, the question always arises of how the black box homomorphism reflects the adequacy of its studied model, that is, how fully the basic properties of the original are reflected in the model. The description of any control system in time is characterized by a picture of the sequence of its states in the process of moving toward its goal. The transformation in the control system can be either one-to-one and then it is called isomorphic, or only unambiguous, in one direction. In this case, the transformation is called homomorphic. The “black” box is a complex homomorphic model of a cybernetic system in which diversity is respected. It is only then a satisfactory system model when it contains such an amount of information that reflects the diversity of the system. It can be assumed that the greater the number of perturbations acting on the inputs of the system model, the greater the variety the regulator should have. Currently, two types of "black" boxes are known. The first type includes any “black” box, which can be considered as an automaton, called finite or infinite. The behavior of such "black" boxes is known. The second type includes such "black" boxes, whose behavior can be observed only in the experiment. In this case, a hypothesis is expressed explicitly or implicitly about the predictability of the behavior of the black box in a probabilistic sense. Without a preliminary hypothesis, any generalization is impossible, or, as they say, it is impossible to draw an inductive conclusion based on experiments with the black box. To designate the model of the “black” box, N. Wiener proposed the concept of a “white” box. The “white” box consists of known components, that is, known X, Y, δ, λ. Its contents are specially selected to implement the same dependence of the output on the input as the corresponding "black" box. In the process of research and generalizations, hypotheses and establishing patterns, it becomes necessary to adjust the organization of the “white” box and change models. In this regard, when modeling, the researcher must necessarily repeatedly refer to the scheme of relations “black” - “white” box. Creating a mathematical description of a black box is a kind of art. In some cases, it is possible to form an algorithm in accordance with which the “black” box responds to an arbitrary input signal. The main methods of testing a black box are: − equivalent partition; − analysis of boundary values; − analysis of cause and effect relationships; − assumption of error. A tester with extensive experience seeks out errors without any methods, but at the same time, he unconsciously uses the method of assuming an error. This method is largely based on intuition. The main idea of the method is to make a list that lists possible errors and situations in which these errors could occur. Then, based on the list, tests are compiled.It’s possible that it’s more correct to talk about different degrees of transparency, and maybe even generally about different colors of the box, rather than testing using the black method and the white box method. The only important thing is what information we take into account when designing tests. Either we use information about the internal structure of the program, or we do not use it. The following CISS components were subject to testing: 1) OS protection and administration tools; 2) security features (security services) of middleware; 3) means of increasing accessibility; 4) organizational measures to protect information, software and hardware;
5) documentation on CISS according to the list defined by the requirements of TR.
The purpose of the CISS tests are: - verification of the implementation and sufficiency of organizational measures of protection given in the documentation;
- verification of compliance with the requirements of section 10 “Criteria of guarantees” RD STPI 2.5-004-99 for the level of guarantees of the correct implementation of the G2 security functions in relation to the CIS architecture, CIS development environment, CIS development sequence, CIS functioning environment, documentation and tests of CIS.
Verification of compliance with the conditions for the implementation of information security services is carried out in accordance with the FSP: 3.КЦД = {КА-2, КД-2, КВ-1, ЦА-1 , ЦД-1, ЦВ-1, ДС-1, ДЗ-2, ДВ-1, НР-2, НИ-2, НК-1, НО-1, НЦ-2, НТ-2, НВ-1}
The paper offers a model of parameters which due to the theoretical and multiple representation of certain sets of criteria for information security, their elements and corresponding levels, allowed to formally form the necessary set of values for the implementation of the identification of FSP in the CS. In addition, a method for identifying the FSP was developed which made it possible to automate the process of determining requirements [9] for security features (security services) and guarantees. As a result, a software module was created that eliminates the repetition of the FSS, performed integrity and completeness checks.
Lazarenko, Anna Korchenko, Іryna Manzhul. Modeling the protection of personal data from trust and the amount of information on social networks. Number 1 (2021), «EUREKA: Physics and Engineering» pp.24–31.
DOI:10.21303/2461-4262.2021.001615 [9] Korchenko, A., Breslavskyi, V., Yevseiev, S., ...Sievierinov, O., Tkachuk, S. Development of a Method for Constructing Linguistic Standards for Multi-Criteria Assessment of Honeypot Efficiency.EasternEuropean Journal of Enterprise Technologiesthis link is disabled, 2021, 1(2(109)), pp. 14–23 [10] Serhii Yevseiev, Roman Korolyov, Andrii Tkachov, Oleksandr Laptiev, Ivan Opirskyy, Olha Soloviova. Modification of the algorithm (OFM) S-box, which provides increasing crypto resistance in the postquantum period. International Journal of Advanced Trends in Computer Science and Engineering (IJATCSE) Volume 9. No. 5, September-Oktober 2020, pp 8725-8729.
DOI: 10.30534/ijatcse/2020/261952020. [11] RD STPI 2.5-004-99 Criteria for evaluation of information security in computer systems against unauthorized access, approved by the Order of the Department of Special Telecommunication Systems and Information Protection of the Security Service of Ukraine dated April 28, 1999, No. 22. (in Ukrainian). [12] Korchenko O.G., Davydenko A.M., Shaban M.R.: A decomposition model for the representation of semantic constants and variables for the implementation of expertise in the field of STPI. Information Security, vol. 21, No.2, pp. 88-96 (2019). (in Ukrainian). DOI: https://doi.org/ 10.18372/2410-7840.21.13766