A System for Seamless Support from Security Requirements Analysis to Security Design using a Software Security Knowledge Base
A System for Seamless Support from Security Requirements Analysis to Security Design using a Software Security Knowledge Base
复制标题
使用软件安全知识库从安全需求分析到安全设计的无缝支持系统
DOI：
10.1109/rew.2019.00029
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Takao Okubo and Nobukazu Yoshioka
中科院分区：
文献类型：
--
作者：
Atsuo Hazeyama;Hikaru Miyahara;Takafumi Tanaka;Hironori Washizaki;Haruhiko Kaiya;Takao Okubo and Nobukazu Yoshioka
由于互联网的广泛使用，软件服务正在向数百万消费者提供，软件安全的重要性已大大增加。具体来说，基于安全需求分析的结果开发安全设计的困难是研究的重点。解决这些困难的一个有希望的方法是为安全软件开发创建一个知识库，并创建一个利用它的过程。可以在设计阶段考虑关于知识库的安全设计获得的信息，这些信息与安全需求分析中使用的知识相关联。本文描述了基于安全需求分析结果和知识库的无缝支持设计阶段的系统的开发。然后，我们给出一个示例来演示所建议系统的有用性。该知识库维护了知识类型之间的关联，并且是可跟踪的。因此，如果用于创建工件类型的知识得到了发展，那么就有可能检测与之相关的知识所使用的工件。
Owing to the widespread use of the internet, software services are being provided to millions of consumers and the importance of software security has increased considerably. Specifically, difficulties in developing a security design based on the results of a security requirements analysis are a focal point for investigation. One promising approach for addressing these difficulties is to create a knowledge base for secure software development and a process for utilizing it. The information obtained regarding the security design of the knowledge base, which is associated with the knowledge used in the security requirements analysis, can be considered during the design phase. This paper describes the development of a system that seamlessly supports the design phase based on the results of a security requirements analysis and the knowledge base. We then present an example to demonstrate the usefulness of the proposed system. This knowledge base maintains an association between knowledge types and is traceable. Therefore, if the knowledge used to create a type of artifact evolves, it is possible to detect artifacts used knowledge associated with it.