Security repository-based security requirement acquisition method

Abstract

The invention belongs to the field of dependable computing, and relates to a security repository-based security requirement acquisition method. The method comprises two parts: 1, classifying assets and threats respectively, establishing correspondence, and constructing an asset-threat repository comprising the assets, the threats and a security functional component; and 2, performing a specific security requirement acquisition process which comprises the steps of analyzing a case, determining the asset, analyzing the threat, detailing the security requirement and iterating the security requirement. The method is mainly used for security requirement analysis and information acquisition of software at a requirement analysis stage by using CC (Common Criteria) standard, so that the security flaw at the early stage of software development is reduced.

Description

technical field [0001] The invention proposes a safety requirement acquisition method in the software development requirement stage, aims at improving the safety and credibility of software, and belongs to the field of software safety. Background technique [0002] With the wide application of computer software, software security issues have become the focus of attention of users in various industries. Efficient design and development of trusted software is an important goal of today's software developers. As a rule of thumb: in the software development process, the earlier a problem is found, the less expensive it will be to fix it. Research data also shows that when security analysis and security engineering are introduced in the early stages of software development, the return rate of software development is as high as 10% to 20%. From the perspective of procedural software engineering, requirements analysis is the first step in software development. Then, high-quality...

AI Technical Summary

Problems solved by technology

[0005] To sum up, the research on security requirements engineering methods in the early stage is flourishing, but there is no unified security requirements analysis and acquisition method

Moreover, these methods generally rely on the subjective experience of security experts. The implementation of the security requirements engineering process consumes a lot of time and energy, and the efficiency is very low.

The CC security evaluation standard has a wide influence internationally and can guide the development of security requirements very well, but it is only used as a guiding principle and has not been formed into the systematic security requirements method

Images