关键词: SSL/TLS, 安全评估, 层次分析法, 模糊综合分析法, 指标体系

Abstract: The SSLTLS protocol is a standard for encrypted network communication. However, due to the complexity of the SSLTLS protocol, Web sites are prone to various security vulnerabilities when implementing and deploying SSLTLS protocols. We feel that there is surprisingly little attention paid to how SSL is configured, given its widespread usage in the Web sites. Based on the detailed analysis of the characteristics and influencing factors of Web sites security assessment, this paper puts forward a new definition of Web sites security level, and combined the analytical hierarchy process (AHP) with fuzzy comprehensive analysis method to construct a Web site security assessment model based on AHPfuzzy comprehensive analysis. Then we apply the model to the actual sites evaluation. By contrast to the evaluation results of Qualys SSL Labs and HighTech, we found that this model can better solve the following issues in the existing evaluation system: security level is not clear, ignoring the 3DES insecure cipher suites and critical expansion OCSP Stapling and so on, so as to better illustrate the validity and accuracy of the model.

Key words: SSL/TLS, security assessment, analytical hierarchy process (AHP), fuzzy comprehensive analysis, index system