Modeling of the Information System for Critical Use Accessibility
Viacheslav V. Kovtun · Visnyk of Vinnytsia Politechnical Institute · 2019
Specification of the security of the information system for critical use (ISCU) within the CIA triad can’t be considered complete without an application model of such a system’s accessibility taking into account its topology, since it is expected that the ISCU will be deployed on a multi-server platform that includes a server-registration center and a set of connected with it data servers. In general, the ISCU’s accessibility involves the allocation of an authorized user in response to its input information resource environment, the finite amount of which is limited to the concept of a virtual machine. The topology of the ISCU assumes that virtual machines can be created either in the information environment of the server-registration center or in the information environment of the data servers or in both of these information environments at the same time in accordance with the location of the information resources to which the authorized user addresses, the rules of support for its actions, formulated in the system security policy, and the degree of the functioning capacity of the relevant information environments. Accessibility restriction will be linked to the lack of free resources in the ISCU to create new virtual machines at the request of authorized user, which will temporarily discard new incoming requests for service operations to release system resources. The article presents new mathematical models for managing the ISCU’s accessibility, which, unlike the existing ones, take into account the topological features of the ISCU, passing of its service operations in the management of the access of authorized users to the system’s information environment and formalize the connection of the set of service operations with a set of system responses on incoming requests of authorized users in the form of a managed semi-markov process with reserve of resources for self-security measures, which allows using the mathematical programming apparatus for optimal management of ISCU’s accessibility strategy for minimizing the cost of its operation and allows stochastically assess the system’s accessibility at any stage of its life cycle. On the basis of the created models, a simulation of the ISCU’s accessibility in the Matlab was conducted. The results of the research showed that the rules of response to incoming requests of authorized users received on the basis of the proposed models, depending on the system’s functioning capacity and the service operations with are performed in the system’s information environment, allow to maintain the probability of incoming requests rejection of authorized users within the specified threshold, minimizing the costs for the ISCU’s functioning. However, the analysis of the empirical results of the ISCU’s operation, the rules of the system security policy which were synthesized on the basis of the accessibility model with the resources reservation to the system’s self security, showed that with the rapid increase in the intensity of incoming requests from authorized users with high rates of insecure the number of access rejection begins to increase quadratically. Studies have shown that in order to avoid the above described drop in the ISCU’s accessibility it is necessary to foresee a system resource reserve of 20 % at the design stage. In general, the experimental results obtained confirmed the adequacy of the proposed ISCU’s accessibility models.