CC verification description template automatic generation method and system for software security assessment

Abstract

The invention provides a CC verification description template automatic generation method and system for software security assessment, and belongs to the technical field of Internet security, and themethod comprises the steps: building a standard document according to a software security function demand, and importing the standard document into a CC modeler; determining, by the CC modeler, whether the format of the standard document meets a requirement or not; if so, checking a CC component name in the standard document, and generating a corresponding initialized CC verification description template; reading the software security function demand in the standard document, and perfecting the initialized CC verification description template; and reading the standarddocument, selecting a template specification according to the security function demand, performing mathematical modeling, and obtaining and outputting a final CC verification description template. The beneficial effects of themethod are that the modeler achieves the automatic modeling of 251 security function demands proposed by the CC criterion, and the generated model follows the Isabel / HOL use grammar specification; byautomatically establishing the CC verification description template, the verification efficiency can be improved, and the error rate of manual writing is reduced to a great extent.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a method and system for automatically generating a CC verification description template for software security assessment. Background technique [0002] With the rapid development of the Internet, software has become more and more closely related to the lives of ordinary people. In the Internet age, people pay more and more attention to software security. The level of security of a software will directly affect the leakage of the user's personal privacy data, the loss of the user's property, etc., and even more seriously, it will affect the safety of human life. Therefore, software that involves life safety must achieve a high level of safety. [0003] CC (Common Criteria) is the "Common Evaluation Criteria for Information Technology Security" jointly developed by the United States, the European Union and Canada. It is an evaluation standard for computer product securi...

AI Technical Summary

Problems solved by technology

[0007] In view of the above problems, the present invention provides a method and system for automatically generating a CC verification description template for software security assessment, which solves the problems of difficulty in writing CC verification description templates for non-professionals, low writing efficiency, and prone to errors

Images