Analysis of Security Threats in the Supply Chain of ICT Products Based on Evolutionary Game Theory

The network information security regulation of information and communication technology (ICT) product supply chain is an important issue for governments globally. The whole life cycle of ICT supply chain is a complex process, comprising the design and development stage, outsourcing integration stage and service operation and maintenance stage. Each of these stages may be maliciously attacked, leading to network information security crisis. Therefore, a tripartite evolutionary game model comprising ICT product suppliers, demand customers (such as system integrators, operation and maintenance suppliers and service providers) and government regulatory authorities was constructed from the perspective of security threats and government regulation in the supply chain of ICT products based on bound rationality. The effects of each element on the tripartite strategy selection were evaluated by determining the evolutionary stability of upstream and downstream supply chains. The evolution path was simulated using Matlab2016a software and external variables were included for simulation analysis. The results showed that: (1) the costs of design development and production of high-quality ICT products directly affect the strategy choice of the producers, and determine the stable strategy time of the demanding customers, implying that excessive R&D costs negatively affect healthy development of the supply chain; (2) increase in incentives by the government within a reasonable range promotes the development of products with high security performance and ensures standardization of the implementation standards of information security acceptance of products by customers. However, the increase in incentives leads to a decrease in government supervision; (3) the initial probability of selection of product manufacturers plays an important role in the convergence rate of demand customers. The participating enterprises and government’s operational decision were explored using the tripartite evolutionary game of the ICT product supply chain to formulate recommendations to enhance the construction of information security.