【作者】 王婷； 郭燕慧；

【Author】 WANG Ting;GUO Yanhui;Information Security Centre,Beijing University of Posts and Telecommunications;

【机构】 北京邮电大学信息安全中心；

【摘要】 长期以来,对电子支付系统的风险评估需要了解系统的整体框架和具体的技术细节,评估过程往往要耗费大量的资源和评估时间。在此背景下,本文提出了一种快速、直观、基于业务风险流的电子支付风险评估方法。一个业务风险流是指攻击者利用存在的安全漏洞或者缺陷对业务完成一次攻击所对应的业务流。在进行风险评估的过程中,首先从电子支付业务逻辑的角度分析风险流,之后对每条风险流进行风险评估,最后将所有风险流的风险值综合起来计算出系统的整体风险指数。更多还原

【Abstract】 For a long time,the risk assessment of electronic payments system need to know the whole framework of the system and some technical details and often require a lot of resources and time.On this background,this paper designs a fast and intuitive method for electronic payments risk assessment which based on business risk flow.A business risk flow is a business flow which produced by attackers performing a complete attack using security vulnerabilities or flaws.During the process of risk assessment,Firstly it analyses risk flow from electronic payments business logic,then assesses risk value for each risk flow,finally colligates all values of risk flow to account the risk index of system.更多还原