具主動式安全管理之空軍資訊資產管理系統

Design of Active Security Management Mechanism for Air Force Information Asset Management System

蘇品長(Pin-Chang Su) ； 沈家正(Chia-Chen Shen) ； 謝定芳(Ting-Fang Hsieh)

《國防管理學報》 38卷2期 (2017/11) Pp. 1-16

摘要

國軍現階段各類機密資料紙本文件皆依法存管，數位文件已利用網路實體隔離方式，可避免從網際網路外流資料的可能性，且利用資安管控軟體限制數位文件任意讀取及資料輸出，惟內存機密檔案之實體設備除利用人工方式清點外並無其他監控機制；新聞曾報導軍中遺失內存武器研發系統測試專用電腦等重要裝備，可見資訊安全防護不可只探討數位文件，必須將設備實體管理一併考量，本研究利用物聯網的概念，使設備間主動構連確認設備存在，並將資訊回傳空軍資訊資產管理系統，管理人員利用資訊系統即可以完成清點及監控，另外透過物聯網主動管理，若資訊資產移動或遺失，主動回傳相關資訊。本研究的具體貢獻為：（1）透過主動式管理機制確保資訊設備實體安全；（2）利用身分認證及串流式加密機制強化資訊交換過程中之安全性設計，達機密性，完整性，鑑別性，不可否認性，所有權，隱私權，防止偽造及防止阻斷攻擊等安全要求。

關鍵字

物聯網 ； 空軍資訊資產管理 ； 主動式安全管理

並列摘要

Nowadays all the paper documents in the R.O.C. armed forces are preserved and controlled by law, while all the digital documents are isolated from external internet to avoid the possibility of data leak from the Internet. Also, the digital documents are limited by the Information Security Control Software to be either read out and write in. But the physical devices that have classified files stored inside can only be checked by man and there is no other supervisory control mechanism. The news reported that important equipment such as weapon development testing computers were lost from the armed forces. This incident proved that information security protection should not only relate to digital documents but also the physical devices management. This research uses the concept of Internet of Things to actively confirm the existence of each other, and then feedback the information back to Air Force Information Assets Management System. Management personnel then can use this system to complete the operation of checking and monitoring. Besides, through active management of IOT can actively feedback relative information if any information asset is moved or lost. The specific contribution of this paper is����A. ensuring the information devices is physically safe with the active management mechanism. B. using self-certified and stream encryption mechanism to strengthen the safety design during the process of information exchange to meet the safety requirement of IOT such as classification, integrity, identification, non-denial, ownership, privacy, falsification prevention and DDOS prevention.

並列關鍵字

Internet of Things (IOT) ； Air Force Information Assets Management ； Active Safety Management