【作者】 高常波；

【导师】 罗万伯；

【作者基本信息】 四川大学 ， 计算机应用技术， 2004， 硕士

【摘要】 早在20世纪90年代初,国际标准化组织(ISO)就开始着手研制评估信息技术产品和系统安全特性的基础性通用准则,以作为全球统一的信息技术安全性量度,并于1999年底正式颁布国际标准ISO/IEC15408 《信息技术 安全技术 信息技术安全性评估准则》[1][2][3](通常简称CC,Common Criteria)。国际上都把CC作为评估信息技术安全性的通用尺度和方法,都纷纷开始依据CC这一基础性框架性标准指导信息安全标准化建设和合格评定体系建设。但由于其涉及面广,对于一般的用户和开发者难懂。基于当前的这种状况,我们开发了CC工具箱系统。在该系统作者利用Java作为开发工具完成了CC工具箱的开发。CC工具箱的总体设计和功能设计,CC工具箱模块的开发和设计。其具体包括:CC工具箱开发模块的设计;CC工具箱的功能要求和总体设计;CC工具箱界面的开发;PP报告和ST报告的研究与开发;评估保证级(EAL)的研究与开发等内容。CC工具箱的出现,使得PP报告和ST报告的开发效率大大提高,缩短了PP报告和ST报告的开发周期;从而实现了CC工具箱自动生成PP报告和ST报告的目的,大大地降低了报告生成的难度;为用户更好地描述信息安全产品的功能要求提供了保障。更为重要的是:CC工具箱系统的开发,将会推动我国信息安全产品的国际认证,为我国的信息安全产品迈向国际市场奠定坚实的基础。CC工具箱的开发,基本上满足了中国国家信息安全测评认证中心的要求(即操作界面友好的、能自动生成PP报告和ST报告的要求),但也提出了新的要求,如要求智能化程度更高、引入管理方面的内容。因此,以后我们在完<WP=3>善CC工具箱时,除了其他方面的要求外,还应考虑从智能化和管理这两方面着手。更多还原

【Abstract】 With the rapid development of global economy, information technology (IT) has been one of the most applicable and most widely used fields. The issue of developing reliable products has been brought to the forefront. In order to suit the need for mutual recognition of standardized security evaluation results in a global IT market, International Organisation for Standardisation (ISO) has been initiating developing international standard evaluation criteria for general use since 1990. The criteria was called Information technology------Security techniques-----Evaluation criteria for IT Security, commonly abbreviated to Common Criteria (also named after CC), and ISO issued CC as an international standard (ISO/IEC 15408) in 1999.This multipart standard ISO/IEC 15408 defined the criteria used as the basis for evaluation of security properties of IT products and systems. By establishing such a common criteria base, the results of an IT security evaluation should be pretty meaningful to wider audience. Since it covers a wide range of fields, it is tough for users to understand. We have developed CC Toolbox System in order to resolve the tough conundrum. And I was responsible for accomplishing the CC Toolbox. The things I have done include following aspects: the design of module in the CC Toolbox, the functional requirement and overall design of CC Toolbox, the development of user interface on CC Toolbox, study and development of PP report and ST report, and development of Evaluation Assurance Level (EAL).Development of CC Toolbox Sytem can speed the procedure of implementation <WP=5>about ST report and PP report, which shortened the development cycle and suited the aim that CC Toolbox System can automatically generate PP report and ST report to be achieved. Moreover, It reduces the complexity of generating PP report and ST report. And users can explicitly depict the functional requirement of information security products with the aid of CC Toolbox. What’s more, it will accelerate the development of information security industry and it also will stimulate information security products to charge toward international market.Of course, there are some incomplete things in the sytem due to the complexity of CC and my limited energy. Some difficulties may exist to common users (though some trouble fell to some extent). And the measures of administration were scarcely addressed, which may cause asssets to be lost. Therefore, improving the performance of CC Toolbox, we should pay more attention to the intelligentisaton and simplification of CC Toolbox and the administration of it. If doing so, we can avoid the unnecessary loss resulting from carelessness.更多还原