A software security requirement acquisition method based on formal modeling

Abstract

The invention discloses a software security requirement acquisition method based on formal modeling in the technical field of software security. The specific steps of the method are as follows: S1, identifying resources and information contained in a software system; S2: identifying potential threat behaviors caused by resources and information; S3: establishing security objectives and proposing security requirements, and verifying the security requirements; 4, establishing a formal model and verifying that model; 5, describing various attributes and system behavior in that system to obtain afinal state, to realize the interpretation, evaluation and verification of the software system. The invention firstly identifies information in a software system, acquire the description of information security threat, determines whether the phenomenon description of problem domain meets the condition of security threat, establishes formal model and verifying, which makes up for the shortcomings of traditional security requirements analysis methods, and enables the requirements analysts to further capture the security requirements of software systems.

Description

technical field [0001] The invention discloses a method for obtaining software safety requirements based on formal modeling, and specifically relates to the technical field of software safety. Background technique [0002] With the widespread use of computers, software and information systems have penetrated into all walks of life, and play an important role in information equipment. However, software security issues come with high maintenance costs throughout the software life cycle, and these continuously increasing operating costs require organizations to carefully consider how they address software security issues. [0003] Software security requirements engineering can greatly improve the quality of developed software and reduce the cost of development and maintenance, but it has not yet attracted enough attention from the industry, and it also lacks comprehensive consideration of software assets, software defects, security objectives, threat analysis and risk assessmen...

AI Technical Summary

Problems solved by technology

In the existing methods for obtaining security requirements, its degree of standardization and ease of use are not satisfactory. Because it is very large and involves a wide range of areas, it is quite difficult for ordinary users to fully understand its connotation. Yu security experts

Images