Design support device, design support method, and design support program

Abstract

The record structure generation unit (22) generates a record structure (34) for recording design information about security measures for a target product, the record structure (34) structuring the content to be considered when implementing security measures. The design acquisition unit (23) sequentially acquires design information (33) about security for the target product during the development process of the target product. The record management unit (24) records the design information (33) in the record structure (34) generated by the record structure generation unit (22) every time the design acquisition unit (23) acquires the design information (33).

Description

[Technical field]

[0001] The present disclosure relates to a technology for supporting security design. [Background technology]

[0002] When developing a product, it is necessary to implement security measures for the product without any omissions. In order to implement security measures without any omissions, a technology has been proposed to format and visualize design information about security measures and to support review or evaluation during development.

[0003] Patent Document 1 describes a method of inputting a design document conforming to the ISO / IEC 15408 certification standard and visualizing the relationships of information described in the design document in a structure called a relevance map. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2009-271789 A Summary of the Invention [Problem to be solved by the invention]

[0005] When evaluating whether security measures have been implemented without omissions, it is desirable to also evaluate from the perspective of whether the design process for the security measures is appropriate. The technology described in Patent Document 1 makes it possible to grasp the relationship between information described in design documents. However, the technology described in Patent Document 1 does not record information obtained during the design process for security measures, and therefore cannot be traced later. Therefore, the technology described in Patent Document 1 does not allow evaluation from the perspective of whether the design process for security measures is appropriate. The present disclosure aims to make it possible to evaluate the design process for security measures from the perspective of whether it is appropriate. [Means for solving the problem]

[0006] The design support device according to the present disclosure includes: a record structure generating unit that generates a record structure for recording design information about security measures for a target product, the record structure being a structure of contents to be considered when implementing the security measures; a design acquisition unit that sequentially acquires design information regarding security of the target product during a development process of the target product; a record management unit that records the design information in the record structure generated by the record structure generation unit every time the design information is acquired by the design acquisition unit; Equipped with. Effect of the Invention

[0007] In the present disclosure, design information is recorded each time it is acquired during the development process of a target product in a recording structure that structures the contents to be considered when implementing security measures. This makes it possible to later trace information obtained during the design process of security measures. As a result, it becomes possible to evaluate the process of designing security measures from the viewpoint of whether it is appropriate. [Brief description of the drawings]

[0008] [Figure 1] 1 is a hardware configuration diagram of a design support device 10 according to a first embodiment. [Diagram 2] 1 is a functional configuration diagram of a design support device 10 according to a first embodiment. [Diagram 3] 3 is a flowchart showing a process flow of the design support device 10 according to the first embodiment. [Figure 4] FIG. 3 is a diagram showing an example of an analysis result 31 according to the first embodiment. [Diagram 5] FIG. 4 shows an example of a template 32 according to the first embodiment. [Figure 6] FIG. 3 is a diagram showing an example of a recording structure 34 according to the first embodiment. [Figure 7]FIG. 3 is a diagram showing an example of a recording structure 34 according to the first embodiment. [Figure 8] FIG. 3 is a diagram showing an example of a recording structure 34 according to the first embodiment. [Figure 9] FIG. 3 is a diagram showing an example of output information 35 according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Embodiment 1 ***Configuration Description*** The hardware configuration of a design support device 10 according to the first embodiment will be described with reference to FIG. The design support device 10 is a computer. The design support device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, an input interface 14, a display interface 15, and a network interface 16. The processor 11 is connected to other hardware components via signal lines and controls the other hardware components.

[0010] The processor 11 is an IC that performs processing. IC is an abbreviation for Integrated Circuit. Specific examples of the processor 11 include a CPU, a DSP, and a GPU. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0011] The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 include SRAM and DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0012] The storage 13 is a storage device that stores data. A specific example of the storage 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. The storage 13 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0013] The input interface 14 is an interface for connecting an input device. A specific example of the input interface 14 is a USB port. USB is an abbreviation for Universal Serial Bus. Specific examples of the input device are a keyboard and a mouse.

[0014] The display interface 15 is an interface for connecting a display device. A specific example of the display interface is an HDMI (registered trademark) port. HDMI is an abbreviation for High-Definition Multimedia Interface. A specific example of the display device is an LCD. LCD is an abbreviation for Liquid Crystal Display.

[0015] The network interface 16 is an interface for communicating with external devices, and is, for example, an Ethernet (registered trademark) port.

[0016] The functional configuration of the design support device 10 according to the first embodiment will be described with reference to FIG. The design support device 10 includes, as functional components, a result acquisition unit 21, a record structure generation unit 22, a design acquisition unit 23, a record management unit 24, and an output unit 25. The functions of the functional components of the design support device 10 are realized by software. The storage 13 stores programs that realize the functions of the functional components of the design support device 10. The programs are loaded into the memory 12 by the processor 11 and executed by the processor 11. In this way, the functions of the functional components of the design support device 10 are realized.

[0017] The memory 12 stores analysis results 31, templates 32, design information 33, a recording structure 34, and output information 35. The storage 13 also realizes a template DB 41 that accumulates a plurality of templates 32. DB is an abbreviation for Database.

[0018] 1 shows only one processor 11. However, there may be a plurality of processors 11, and the plurality of processors 11 may cooperate to execute programs that realize the respective functions.

[0019] ***Explanation of Operation*** The operation of the design support device 10 according to the first embodiment will be described with reference to FIGS. An operation procedure of the design support device 10 according to the embodiment 1 corresponds to a design support method according to the embodiment 1. Moreover, a program for realizing the operation of the design support device 10 according to the embodiment 1 corresponds to a design support program according to the embodiment 1.

[0020] The flow of processing performed by the design support device 10 according to the first embodiment will be described with reference to FIG. (Step S1: Result Acquisition Unit) The result acquisition unit 21 acquires the analysis result 31 indicating the security measures required for the target product. The analysis result 31 is information identified by executing a security risk analysis on the target product. The analysis result 31 indicates a configuration diagram of the target product, security measures, information assets, threats, risk values, security requirements, etc. For example, the analysis result 31 is information as shown in FIG. 4. In FIG. 4, security measures, information assets, threats, risk values, and notes are shown for at least some of the components shown in the configuration diagram of the target product. The notes record setting information and the like regarding the security measures. The analysis result 31 may further include the value of the information assets, the possibility of threats occurring, etc.

[0021] (Step S2: Generation determination process) The record structure generation unit 22 judges whether or not it has generated record structures 34 for the number of security measures indicated by the analysis result 31 acquired in step S1. When the analysis result 31 of Fig. 4 is obtained, the record structure generation unit 22 extracts the name set in the security measure column of each row. Then, the record structure generation unit 22 can identify the number of security measures by counting the number of different names. If the recording structure generation unit 22 has not generated the same number of recording structures 34 as the number of security measures, the processing proceeds to step S3. At this time, the recording structure generation unit 22 selects, as a processing target, a security measure that has not yet been selected as a processing target. On the other hand, if the recording structure generation unit 22 has generated the same number of recording structures 34 as the number of security measures, the processing proceeds to step S5.

[0022] As a result, the process from step S3 to step S4 is repeated for the number of security measures, and a record structure 34 is generated for each security measure indicated by the analysis result 31.

[0023] (Step S3: Template acquisition process) The record structure generating unit 22 acquires the template 32 corresponding to the security countermeasure to be processed from the template DB 41.

[0024] The template DB 41 is a database that stores a plurality of templates 32. The templates 32 are registered in advance in the template DB 41 by an administrator of the design support device 10, a security expert, or the like. The template 32 is data that serves as a model for generating the record structure 34. The template 32 is data that organizes the contents to be considered when implementing security measures into a tree structure by classifying them into hierarchical groups according to at least one of the steps in the design and development process and the level of specificity of the contents. For example, as shown in Fig. 5, the template 32 is data that has the names of security measures as the root node, the names of objective policies as child nodes, and the names of components for each policy as grandchild nodes.

[0025] The record structure generation unit 22 uses the name of the security measure to be processed as a keyword to search for the corresponding template 32 from the template DB 41. In this way, the record structure generation unit 22 obtains the template 32 that corresponds to the security measure to be processed. In some cases, there may be no hit for the template 32 corresponding to the keyword. In this case, the record structure generation unit 22 displays a list of the templates 32 stored in the template DB 41, and allows the user to select a template 32 related to the name of the security measure.

[0026] (Step S4: Recording structure generation process) The record structure generating unit 22 generates a record structure 34 from the analysis result 31 obtained in step S1 and the template 32 obtained in step S3.

[0027] The record structure 34 has a tree structure shown in the template 32, and is a data structure capable of recording information in association with each node. Each node is associated with information such as the rationale for the design and information raised in the design review process. Further, auxiliary information may be associated with each node by meta information such as a tag. The auxiliary information may be, for example, a threat targeted by the security countermeasure, an implementation location of the countermeasure, a logical relationship between each node, whether or not to adopt the design contents indicated by the node, and a degree of satisfaction of the design contents indicated by the node. The logical relationship between each node may be, for example, that the components indicated by all of the child nodes must be satisfied, that the components indicated by at least one of the child nodes must be satisfied, and so on.

[0028] For example, the record structure generation unit 22 generates an issue on Git for each node in the template 32 acquired in step S3. The record structure generation unit 22 generates meta information such as tags for the issues according to the tree structure indicated by the template 32. Then, the record structure generation unit 22 generates a record structure 34 by relating each issue with the tree structure. The record structure generation unit 22 further records information already designed at the time of security risk analysis, such as the risk value of the threat included in the analysis result 31 and the constraint conditions given as prerequisites, in the record structure 34. At this time, the record structure generation unit 22 displays, for example, the record structure 34 on a screen together with the recorded information. The record structure generation unit 22 may reflect the information already designed at the time of security risk analysis by having the user input the reason for selection into an issue corresponding to content that has already been decided not to be adopted in the product and further closing the issue. The record structure generation unit 22 may also prune the branches of the node according to the value of the information asset. Assume that the security measure to be processed is user authentication in the first row of Fig. 4. In this case, as shown in Fig. 6, the recording structure generation unit 22 records in the recording structure 34 that multi-factor authentication is required and that account locking is not implemented, which are conditions given at the time of security risk analysis.

[0029] (Step S5: Development end determination process) The design acquisition unit 23 determines whether the development of the target product has been completed. If the development of the target product is not completed, the design acquisition unit 23 advances the process to step S6. On the other hand, if the development of the target product is completed, the design acquisition unit 23 advances the process to step S9.

[0030] As a result, the processes from step S6 to step S8 are periodically executed until the development of the target product is completed. Then, as the target product is developed, information is recorded in the recording structure 34.

[0031] (Step S6: Output process) The output unit 25 generates output information 35 from the information recorded in the current recording structure 34. Then, the output unit 25 outputs the output information 35 to the display device via the display interface 15. As a result, the output information 35 is displayed on the display device. The output information 35 is information obtained by processing the information recorded in the recording structure 34. For example, the output unit 25 generates structured design information 33 of part or all of the information recorded in the recording structure 34, or design information 33 including the basis for selecting the content of a specific security measure, as the output information 35. The output unit 25 may generate the output information 35 by adapting the information recorded in the recording structure 34 to a specified format such as a specification, a design document, or evidential material in a security standard.

[0032] (Step S7: Design acquisition process) The design acquisition unit 23 acquires design information 33 regarding security for the target product. By the process of step S5, the process of step S7 is repeatedly executed until the development of the target product is completed. Therefore, the design acquisition unit 23 successively acquires the design information 33 during the development process of the target product.

[0033] The design information 33 is any information considered or created in order to implement security measures. For example, the design information 33 includes security objectives, components for each objective, implementation points of security functions, source code, test code and results, security measures implemented by operation, design rationale, and descriptions of the consideration process.

[0034] The design acquisition unit 23 provides an interface for inputting the design information 33 in association with the recording structure 34. Specifically, the design acquisition unit 23, in conjunction with the output unit 25, acquires the design information 33 interactively while displaying the current recording structure 34. That is, the design acquisition unit 23 acquires the design information 33 by having the design information 33 input in association with the output information 35 displayed by the output unit 25. The design acquisition unit 23 outputs the input design information 33 and the associated recording structure 34 to the record management unit 24. The design acquisition unit 23 may extract design information 33 regarding security for the target product from deliverables generated in the development process of the target product, such as specifications, design documents, or meeting notes, etc. For example, the design acquisition unit 23 may extract the design information 33 by using the deliverables as input and analyzing text using machine learning or the like.

[0035] (Step S8: Record management process) The record management unit 24 updates the record structure 34 with the design information 33 acquired in step S7. Specifically, the record management unit 24 records the design information 33 in the node of the record structure 34 with which the design information 33 is associated. For example, the record management unit 24 records the determined design content and its basis or consideration process for each node of the record structure 34, as shown by the node "password expiration date" in Fig. 7. Also, for example, the record management unit 24 adds nodes to the record structure 34 according to the determined design content, as shown by the nodes "password character type" and "error message notification" in Fig. 8. Also, the record management unit 24 may store deliverables created in the development process of the target product in association with the record structure 34, such as the source code, test code, and test results in Fig. 8.

[0036] (Step S9: Final output process) The output unit 25 generates output information 35 from the information recorded in the current recording structure 34 and the analysis result 31. Then, the output unit 25 outputs the output information 35 to the display device via the display interface 15. As a result, the output information 35 is displayed on the display device. When a user refers to the rationale for the implementation policy of a specific security measure, the output unit 25 acquires the record structure 34 corresponding to this security measure. Then, the output unit 25 displays the design rationale associated with the node corresponding to the implementation policy. Furthermore, the output unit 25 may obtain the information recorded in all the recording structures 34, and refer to the meta-information held by each node to compare it with the security measures in the analysis result 31. In this way, the output unit 25 may create evaluation values ​​such as the design completion rate, the implementation completion rate, or the test completion rate for each security measure of the product as shown in FIG.

[0037] In addition, there may be a case where no template 32 related to the name of the security measure exists in step S3. In this case, the record structure generation unit 22 has the user select a blank template 32, and has the user record the design information 33 using a tree structure in the processing from step S4 onward.

[0038] ***Advantages of the First Embodiment*** As described above, the design support device 10 according to the first embodiment records the design information 33 in the recording structure 34, which structures the contents to be considered when implementing security measures, every time the design information 33 is acquired during the development process of the target product. This allows the information obtained during the design process of security measures to be appropriately recorded and traced later. As a result, it becomes possible to evaluate the process of designing security measures from the viewpoint of whether it is appropriate.

[0039] In particular, since the design support device 10 according to the first embodiment records the design information 33 in the tree-structured recording structure 34, the design information 33 is structured and recorded. This makes it possible to appropriately evaluate whether security measures are being implemented without any omissions.

[0040] Furthermore, the design support device 10 according to the first embodiment can record the security countermeasure method and the deliverables such as source code in association with each other. This makes it possible to evaluate the correctness of a series of processes from design to implementation. In addition, it is possible to easily divert the security countermeasure method to similar products.

[0041] ***Application Examples*** The design support device 10 according to the first embodiment can be applied to a software quality evaluation system. For example, a security analysis device is provided in addition to the design support device 10. Then, the security analysis device performs analysis by utilizing security design information recorded and structured by the design support device 10. This makes it possible to sequentially evaluate software quality from the viewpoint of security. In the conventional technology, it was only possible to perform a single evaluation of the compliance status with a specific security standard. By using the design support device 10 according to the first embodiment, it is possible to perform evaluation from multiple perspectives, such as verification of security processes, satisfaction of security functions, and tracing of security requirements and security functions.

[0042] ***Other configurations*** <Variation 1> In the first embodiment, each functional component is realized by software. However, as a first modification, each functional component may be realized by hardware. The following describes the first modification in terms of differences from the first embodiment.

[0043] When each functional component is realized by hardware, the design support device 10 includes an electronic circuit instead of the processor 11, the memory 12, and the storage 13. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 12, and the storage 13.

[0044] The electronic circuits include single circuits, composite circuits, programmed processors, parallel programmed processors, logic ICs, GAs, ASICs, and FPGAs. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by distributing it among a plurality of electronic circuits.

[0045] <Variation 2> As a second modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0046] The processor 11, the memory 12, the storage 13, and the electronic circuitry are collectively referred to as a processing circuit. In other words, the functions of the functional components are realized by the processing circuit.

[0047] Furthermore, the term "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0048] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0049] 10 design support device, 11 processor, 12 memory, 13 storage, 14 input interface, 15 display interface, 16 network interface, 21 result acquisition unit, 22 record structure generation unit, 23 design acquisition unit, 24 record management unit, 25 output unit, 31 analysis result, 32 template, 33 design information, 34 record structure, 35 output information, 41 template DB.

Claims

A result acquisition unit that acquires an analysis result indicating security measures required for the target product, which is identified by performing a security risk analysis on the target product; A recording structure generation unit that generates a recording structure for recording design information regarding the security measures indicated by the analysis result acquired by the result acquisition unit, the recording structure being one that structures the content to be considered in implementing the security measures; A design acquisition unit that sequentially acquires design information regarding the security of the target product in the development process of the target product; A recording management unit that records the design information in the recording structure generated by the recording structure generation unit each time the design information is acquired by the design acquisition unit A design support apparatus comprising the above.

2. The recording structure generation unit generates the recording structure by hierarchically classifying the content to be considered in implementing the security measures according to at least one of the steps of the design and development process and the level of specificity of the content, and organizing it in a tree structure The design support apparatus according to claim 1.

3. The design information includes at least one of the basis of the design and the information mentioned in the design consideration process in addition to the design content. The design support apparatus according to claim 1.

4. The recording management unit stores deliverables other than the design content created in the development process of the target product in association with the recording structure. The design support apparatus according to claim 1.

5. The design support apparatus further includes An output unit that outputs the information recorded in the recording structure after conforming it to a specified format. The design support apparatus according to claim 1, comprising the above.

6. The design acquisition unit extracts design information regarding the security of the target product from the deliverables generated in the development process of the target product. The design support apparatus according to claim 1.

7. A computer acquires an analysis result indicating security measures required for the target product, which is identified by performing a security risk analysis on the target product, The computer generates a recording structure for recording design information regarding the security measures indicated by the analysis result, the recording structure being one that structures the content to be considered in implementing the security measures, The computer sequentially acquires design information regarding the security of the target product in the development process of the target product, A design support method in which a computer records the design information in the recording structure each time the design information is acquired.

8. A result acquisition process for acquiring an analysis result indicating security measures required for the target product, which is specified by performing a security risk analysis on the target product; A recording structure generation process for generating a recording structure for recording design information regarding the security measures indicated by the analysis result acquired by the result acquisition process, the recording structure being structured to include details to be considered in implementing the security measures; A design acquisition process for sequentially acquiring design information regarding the security of the target product in the development process of the target product; A recording management process for recording the design information in the recording structure generated by the recording structure generation process each time the design information is acquired by the design acquisition process A design support program that causes a computer to function as a design support device that performs the above processes.

Images