Formal Modeling Based Software Security Requirements Acquisition Method

Abstract

The invention discloses a formalized modeling based software security requirement acquisition method. The method includes functional requirement acquisition, security environment analysis, security objective analysis, security requirement elicitation and final generation of a system security requirement file, wherein the file at least includes information of system asset, behavioral sequence, defects, threats, security strategies, security assumptions, security objectives, security requirement levels, security guarantee levels, security functional modules and security guarantee modules. Compared with the prior art, the formalized modeling based software security requirement acquisition method has the advantages that automation in acquisition of software security requirements is realized while precision in acquisition of the security requirements is greatly improved; the problems of failure in realization of computer processing, ambiguity and fuzziness of security knowledge bases in natural language description are solved to lay the foundation for automatic elicitation of the software security requirements; the method which is a typical software security requirement acquisition method is applicable to different types of software systems and high in universality.

Description

technical field [0001] The invention relates to the technical field of software safety, in particular to a technology for acquiring software safety requirements. Background technique [0002] With the widespread application of computers, software and information systems have penetrated into all walks of life and play an important role in the information society. However, software security issues come with high maintenance costs throughout the software life cycle, and these continuously increasing operating costs require organizations to carefully consider how they address software security issues. [0003] Software security requirements engineering can greatly improve the quality of developed software and reduce the cost of development and maintenance, but it has not attracted enough attention from the industry, and it also lacks comprehensive consideration of software assets, software defects, security goals, threat analysis and risk assessment, etc. Engineering framework ...

AI Technical Summary

Problems solved by technology

The emergence of the international security standard ISO / IEC15408 (CC standard) has guided the development and evaluation of information security products around the world. However, its standardization and ease of use are not satisfactory. Very broad, it is quite difficult for ordinary users to fully understand its connotation, only suitable for security experts

Images