Embedded software security analysis method and system based on SysML

Abstract

The invention provides a SysML-based embedded software security analysis method, which comprises the following steps of: expanding semantics of a SysML language, creating a software model based on the extended SysML language, completely and accurately describing a static structure and a dynamic behavior of software, and establishing a security analysis rule library to analyze the security of the software. Software function model analysis, functional hierarchy model analysis, software state model analysis, SysML multi-model diagram association analysis and system and software association influence analysis are carried out on a software model, whether the software model meets a security rule or not is verified, and the embedded software security analysis system is provided based on the verification result. According to the method, the problems of system analysis and software analysis are solved, repeated modeling is avoided, the workload of software modeling is reduced, and the method is good in universality, easy to popularize and high in expandability.

Description

technical field [0001] The invention belongs to the technical field of embedded software security analysis, in particular to a SysML-based embedded software security analysis method and an analysis system thereof. Background technique [0002] With the development of intelligence, systematization and networking of modern weapons and equipment, the technical process and management process of equipment development are becoming more and more complex, and the use of system engineering and model-based systems engineering theory to ensure the successful development of complex equipment has become a weapon at home and abroad. A consensus generally reached in the field of equipment development. SysML is a standard modeling language for systems engineering. During the development of weapons and equipment, more and more researchers use SysML to formally model the system and carry out forward design of the system. In the field of embedded software security analysis, there are already ...

AI Technical Summary

Problems solved by technology

In the field of embedded software security analysis, there are already a series of relatively mature tools for model-based formal verification, including SMV, Spin, UPPAL, CBMC, BLAST and SLAM, etc. These tools use different modeling methods and languages, although The current software verification technology has been partially applied in the industry, but the complexity of the formal method and modeling language itself also puts forward high requirements for engineers, which is very difficult for the popularization and use of the current software verification technology

[0003] At present, when developing weapons and equipment, system developers and embedded software security analysts use different modeling tools and modeling methods. It is difficult to integrate the models of the system and software, which ultimately leads to the development of systems and embedded software security. Analyze the phenomenon of "two skins"

Due to different models, when carrying out security analysis of embedded software, it is impossible to reuse model elements such as system cross-link design, function list, and system hazards that have been completed in the system design process, and can only perform repeated modeling, which greatly reduces the overall development efficiency

In addition, the results of embedded software security analysis cannot be effectively fed back to the system. System designers cannot accurately understand the feedback of design decisions in the software in real time, and cannot obtain the security requirements delivered to the system by the embedded software security analysis in real time. Effectively carry out integrated analysis of software and hardware

Images