Software safety function component management method based on CC (the Common Criteria for Information Technology Security Evaluation)

Abstract

The invention discloses a software safety function component management method based on CC (the Common Criteria for Information Technology Security Evaluation), which is used for implementing recommendation and adjustment of a safety function component based on the CC at the demand analysis stage of software engineering. The method comprises the following steps of: performing abstract analysis and induction on description of threatening information in estimation documents in various fields based on a CC system, thus establishing a threat knowledge base; recommending a corresponding safety function component set for each threat knowledge in the threat knowledge base, and establishing a corresponding relationship between each threat knowledge and safety function components based on standard semantics; and establishing a safety function component cost evaluation table according to each safety function component type, and adjusting the components according to the content of the table. Compared with the prior art, the software safety function component management method points out the safety function component recommending and adjusting method based on the CC at the software requirement analysis stage, so that the software safety problem is considered at the initial stage of the development of a software system, the possibility of a security hole is reduced, and the software safety is improved.

Description

technical field [0001] The invention relates to the technical field of software safety; in particular, it relates to a method for recommending and adjusting safety function components based on CC standards in the trusted computing field. Background technique [0002] With the rapid development of the Internet and the popularization of computer applications, people's demand for trustworthiness of IT products is getting higher and higher. At the same time, software security issues are becoming increasingly prominent and complicated. How to ensure the security of application software has become the focus of people's general attention. In the past, most of the research on software security focused on the process of software implementation, most of which were to repair the loopholes in the system or application software. However, software security issues have not been well resolved. According to statistics, a considerable proportion of software security issues appear in the softw...

AI Technical Summary

Problems solved by technology

[0005] However, there are such problems in the current process of using CC to analyze software security requirements: the whole process requires the participation of security experts. In the process of selecting security functions, it largely depends on the experience of experts. The degree of accuracy will affect the analysis of requirements, which makes it difficult for ordinary users to use, and the quality of component selection is determined by the level of experts, with a certain subjective bias

Images