System-asset-based software security requirement analysis method

Abstract

The invention discloses a system-asset-based software security requirement analysis method. The method comprises the following steps of: 1, establishing the corresponding relation between system asset categories and security functional components, and the corresponding relation between assets and threats which may appear among the security functional components, constructing a security knowledge library, classifying system assets, threats and attack modes, and establishing the corresponding relation so as to ensure that the corresponding security components can be determined from the system assets; and 2, acquiring the corresponding security functional components in the security knowledge library aiming at the concrete system development according to the system assets determined by requirement personnel, performing refined selection by security requirement analysts in consideration of concrete technologies and security policies, and describing the finally selected security functional components into a security profile specification. Compared with the prior art, the method has the advantages that requirement analysts who have inadequate security knowledge can quickly perform security requirement analysis, the difficulty of the analysis of security functional requirements is effectively reduced, and the development cost of security requirements is reduced.

Description

technical field [0001] The invention relates to the technical field of software safety engineering; in particular, it relates to a software safety requirement analysis method. Background technique [0002] With the continuous development of the Internet and computer applications, software has penetrated into various fields of modern society and plays a vital role in the information society. However, the threat caused by software quality problems is becoming more and more serious. When people enjoy convenient services such as online transfer, online shopping, and online office provided by the software, they are also facing account leakage, important file leakage, and property loss. and other serious security issues. Therefore, software security issues have become the focus of attention of users in various industries, and effective design and development of trusted software is an important goal of today's software developers. [0003] Years of best practice experience in the...

AI Technical Summary

Problems solved by technology

[0005] However, the current security requirements analysis using CC has the following problems: 1) The whole process requires the participation of security experts and relies on the subjective experience of security experts, especially in the process of security function selection, the quality of component selection directly affects software security The accuracy of the requirements makes its use threshold relatively high, and most civilian systems will not be available; 2) The user's participation is too frequent, the analysis process consumes a lot of time and energy, and the efficiency is very low

Images