中文摘要：

该文提出了一种基于事件分解的威胁建模方法,并对该方法在网银盾USBKey的脆弱性分析中的应用进行了分析。从应用需要保护的资产出发,此建模方法先标识出资产可能面临的威胁,通过将威胁视为事件,对事件进行逐步分解直至原子事件,以此简化威胁分析过程。该方法以事件树的方式来组织分解过程,通过该树状结构,可获得产生威胁的所有可能的攻击路径,以便检查威胁分析的完备性。对选取的攻击路径,还提出了计算威胁成功概率的方法。结合事件分解模型和通用评估准则中攻击潜力的计算方法,以USBKey中的PIN码安全为例,对USBKey产品进行了脆弱性分析。分析表明：事件分解模型为脆弱性分析提供了一套合理可行的方法,可用于提升信息产品安全评估过程的完备性。

英文摘要：

A threat modeling approach based on event decomposition is given vulnerability analyses of USBKey tokens in Internet banking systems as an example. The system protects the assets in the application by identifying possible threats to the assets and treating the threats as events to simplify the threat analysis by decomposing the events into sub-events recursively until the atomic events. The event decomposition is organized as event trees, so all possible attack paths can be easily extracted to check the completeness of the vulnerability analysis. Then, the success probability of each threat is calculated for each attack path. This model with the attack potential calculation technique in Common Criteria is used for a vulnerability analysis of the PIN module in a USBKey token to show the applicability of the event decomposition approach. The approach is applicable to various kinds of vulnerability analyses and illustrates how to improve the completeness of security evaluations of information technology products.