An embedded software security automatic verification system and verification method thereof

Abstract

The invention discloses an embedded software security automation verification system and a verification method thereof. According to the technical scheme, double verification of software security is realized in combination with a model checking-based formal verification technology and a model-based software test technology. The automation verification system disclosed by the invention comprises four parts, which are a software demand modeling module, a security verification rule database, a formal verification module, and a security test module respectively. The software demand modeling module comprises two sub-modules, wherein the ICD modeling module describes a software external cross-linking environment, and the formal modeling module describes a software internal behavior. The security verification rule database is constructed and used for storing security verification rules. The formal verification module is constructed and used for performing model verification on a software demand based on the security verification rules and a model detection algorithm. The software detection module comprises two modules, wherein the test case generation module is used for generating an executable security case, and a test case translation module performs format conversion on the generated case.

Description

technical field [0001] The invention relates to an embedded software safety automatic verification system and a verification method thereof, belonging to the field of software safety analysis. Background technique [0002] Embedded software is widely used in aerospace and other fields, and more and more functions are realized by software. In recent years, with the increase of software complexity, failures caused by software failures occur frequently, so ensuring the security of embedded software has become a research hotspot in the field of software engineering in recent years. The mature experience in Europe and the United States shows that carrying out software security analysis is an effective way to improve software quality. The main work includes the extraction and specification of embedded software security requirements, standard-oriented embedded software development, and embedded software security requirements verification. [0003] Embedded software requirements ve...

AI Technical Summary

Problems solved by technology

However, due to the limited coverage of test cases in the process of software testing, it is difficult to exhaustively test the entire system, and the operation of a safety-critical system is usually related to the external environment, its execution is often uncertain, and testing is extremely difficult. Therefore, software testing methods cannot Fundamentally guarantee the security of the system

[0004] At present, due to its strong theoretical nature, formal verification methods are rarely used in the development of embedded software.

As for software testing, although some testing platforms have appeared, their popularity is relatively low.

Most of them use manual testing. For complex software systems, the testing efficiency is low, and software problems caused by multi-state concurrency and multi-functional conflicts cannot be found.

Images