KR20040024929A - Test and Evaluation Methods and Systems for Security Solutions - Google Patents

Abstract

PURPOSE: A method and a system for testing/evaluating a security solution are provided to make business engineering for software development and maintenance efficient by testing or evaluating the security solution, and to enhance a chance of success by performing the related managements through project management. CONSTITUTION: An object/environmental variable input part(A01) automatically tests/evaluates the security solution. A security solution design analysis engine(A02) analyzes a design of the security solution and extracts the information for testing/evaluating the security solution. A virtual user operation engine(A03) operates/analyzes a virtual user of the security solution. A test/evaluation standard matrix database(A06) manages a standard for the security solution. A test/evaluation model-base(A08) manages a test/evaluation model used for testing/evaluating the security solution. A test/evaluation knowledge-base(A09) manages a rule, a procedure, and knowledge needed to test/evaluate the security solution. A test/evaluation engine(A10) tests/evaluates the security solution by the standard, the predicting model, and the extracted information.

Description

Test and Evaluation Methods and Systems for Security Solutions

The present invention relates to the test evaluation of the security solution of the test evaluation method of the software system (system including the software), and includes the software metrics field and software development process field of software engineering, in particular more consistent test evaluation of security solutions And how to measure with accuracy. The conventional approach suffers from a lack of accuracy in subjective and irrational testing and evaluation of security solutions. Test evaluation metrics, procedures, guidelines, and systems of the conventional security solutions have many problems in their usefulness due to the emergence of new object technologies and component technologies, and the accuracy and consistency of test evaluation of security solutions using them are insufficient. This is happening. Therefore, the prior art is difficult to apply to the testing and comparison of the singular and plural security solutions. The test evaluation method of the conventional general security solution is not standardized and there are insufficient standards, procedures, guidelines, and automation systems. Therefore, the conventional method cannot secure the objectivity, reliability and accuracy of the test evaluation of the security solution.

The technical problem to be achieved by the present invention is first, by improving the conventional subjective and unreasonable test evaluation of the security solution, it is possible to accurately test the security solution based on more objective and reasonable standards, procedures, guidelines, and automated systems. To provide a method and system that can be. Second, the object of the present invention is to provide a method and system for testing and comparing and evaluating single and multiple security solutions. Third, an object of the present invention is to provide a method and system for testing and comparing and evaluating single and multiple security solutions developed by a procedure-oriented development method, an object-oriented development method, a component-based development method, and a reverse engineering method. Fourth, the problem to be achieved by the present invention is C or object-oriented programming languages C ++, JAVA, IDL, Ada, C #, which are frequently used in object-oriented Unified Modeling Language or security programs adopted as international industry standards It provides a way to test and compare security solutions based on SQL, VB.NET, Python, and SmallTalk. Finally, the problem to be achieved by the present invention is to conveniently and accurately test or evaluate the evaluation of the security solution by providing a convenient or accurate test, to streamline the engineering of the business for software development and maintenance, project management, scope management, contract management, Cost management, human resources management, schedule management, quality management, configuration management, risk management. It is to improve business success by carrying out communication management and integrated management more systematically and scientifically.

1 is a block diagram showing a test evaluation method and system of a security solution according to an embodiment of the present invention, Figure 2 is a flow chart showing the operation of the test evaluation method and system of a security solution according to an embodiment of the present invention.

The test evaluation method and system of the security solution of the present invention is a virtual user operation engine and design of a security solution for operating a test subject and an environment variable input unit and a virtual user for test evaluation to automatically test and evaluate a security solution. Test of security solution that analyzes specification, operation status, source code design analysis engine, security solution operation engine, source code analysis engine, security solution test evaluation criteria database Evaluation criteria setting engine, test evaluation model base of security solution used for trial evaluation of security solution, test evaluation knowledge base of security solution which is a set of rules and guidelines required for testing or evaluation, and test of security solution by the above selection And evaluation engines for security solutions Characterized by a comparative assessment engine test evaluation result by an output unit configured to output the results of the evaluation of the test solution.

When described in detail with reference to the accompanying drawings a preferred embodiment of the test evaluation method and system of the security solution according to the present invention as follows.

1 is a block diagram showing a test evaluation method and system of a security solution according to an embodiment of the present invention, Figure 2 is a flow chart showing the operation of the test evaluation method and system of a security solution according to an embodiment of the present invention.

Test evaluation method and system of the security solution according to an embodiment of the present invention, as shown in Figure 1, the test evaluation target and environment variable input unit (A01), the design analysis engine (A02) of the security solution for analyzing the test evaluation target according to the level ), Virtual user operation engine of security solution (A03), operation state analysis engine of security solution (A04), source code analysis engine (A05), test evaluation criteria database of security solution (A06), test evaluation criteria of security solution Engine (A07), security evaluation test evaluation model base (A08), security solution test evaluation knowledge base (A09), security solution test evaluation engine (A10), security solution comparative evaluation engine (A11), test evaluation results It consists of a test evaluation result output unit (A12) for outputting to the outside.

Here, the design analysis engine A02 of the security solution extracts information for test evaluation of the security solution by analyzing the security solution design expressed by the procedure-oriented and object-oriented development methods.

The virtual user operation engine (A03) of the security solution operates a number of scenarios that a user can perform to extract information for test evaluation of the security solution, and the operation of the test evaluation engine (A10) of the security solution is required. It works by getting information.

The operational state analysis engine A04 of the security solution analyzes the operational state of the security solution made by the procedure-oriented and object-oriented development methods, and extracts information for test evaluation of the security solution.

The source code analysis engine (A05) extracts information for security solution test evaluation by analyzing the source code.

The test evaluation criteria database (A06) of the security solution is related to software metrics for testing and evaluating the security solution, and is divided into direct evaluation criteria and indirect evaluation criteria, and stores and stores the test evaluation criteria of the security solution as a database. The test evaluation standard setting engine (A07) of the security solution provides this when required.

The test evaluation standard setting engine A07 of the security solution sets the test evaluation criteria of the security solution automatically or by a user's selection.

The test evaluation model base (A08) of the security solution is composed of various test evaluation models composed by a test evaluation technique based on advanced statistical probability, and according to the test evaluation criteria selected by the test evaluation standard setting engine (A07) of the security solution. The test evaluation model of the optimal security solution is selected and provided to the test evaluation engine (A10) of the security solution.

The test evaluation knowledge base (A09) of the security solution is a knowledge base expressing the rules, procedures, guidelines, etc. required by the test evaluation engine (A10) of the security solution using the knowledge expression technique of the knowledge base system.

The test evaluation engine A10 of the security solution performs a test evaluation operation of the security solution based on the test evaluation knowledge base A09 of the security solution by using the selected test evaluation criteria, the selected test evaluation model, analysis and extracted information. .

The comparison evaluation engine A11 of the security solution compares the security solution based on the test evaluation information of each security solution tested and evaluated by the test evaluation engine A10 of the security solution when a comparison evaluation of a plurality of security solutions is required. Perform evaluation work.

The test evaluation result output unit A12 outputs a test evaluation result of the test evaluation engine A10 of the security solution in a screen and a printing method. Here, the test evaluation process of the security solution can be repeated.

Operation of the test evaluation method and system of the security solution according to an embodiment of the present invention configured as described above is as follows.

First, as shown in FIG. 2, the design analysis engine A02 of the security solution analyzes and extracts the design of the security solution while the test evaluation target and the environment variable input unit A01 are input (B01). B02).

Next, the virtual user operation engine (A03) of the security solution has the contents inputted to the test evaluation target and the environment variable input unit (A01) and the contents analyzed in the analysis and extraction of the design of the security solution (B02). Operation B03 is performed.

At this time, the operating state analysis engine A04 of the security solution analyzes and extracts the operating state information of the security solution required for the test evaluation (B04).

Then, the source code analysis engine A05 analyzes and extracts source code information of the security solution required for the test evaluation (B05).

Subsequently, the test evaluation criteria setting engine A07 of the security solution sets the test evaluation criteria of the security solution using the test evaluation criteria database A06 of the security solution, and provides this to the test evaluation engine A10 of the security solution. .

The test evaluation engine (A10) of the security solution selects the required model from the test evaluation model base (A08) of the security solution and uses the test evaluation knowledge base (A09) of the security solution to perform the test evaluation of the security solution (B08). The information is passed to the test evaluation result output unit A12.

Then check whether a comparative evaluation is necessary (B09).

If a comparative evaluation is required, the comparative evaluation engine (A11) of the security solution performs a comparative evaluation operation (B10) of the security solution, and passes the comparison evaluation information along with the test evaluation information to the test evaluation result output unit (A12).

If no comparative evaluation is required, only the information obtained from the test evaluation (B08) of the security solution is passed to the test evaluation result output unit (A12).

Finally, the test evaluation result output unit A12 outputs the test evaluation result of the security solution on a screen or printed paper, and if necessary, repeats the test evaluation process of the security solution.

The main effect of the present invention is to solve inaccuracies and difficult problems in the evaluation of security solutions. In addition, the application of various security solutions, development methods, and programming language environments have the effect of minimizing the time and economic loss by automatically and automatically evaluating the test evaluation of the security solution in the format desired by the user. In addition, the present invention is to provide a test evaluation results of a convenient and accurate security solution to enable a more systematic and scientific approach to business management and engineering. In addition, the use or application of the present invention is enterprise management, engineering and project management, and is effective in test evaluation or comparative evaluation of productivity, quality, cost, duration, risk, personnel and resources.

Claims (4)

A test and evaluation for automatically testing and evaluating a security solution in a method and system for testing and comparing and evaluating a security solution based on procedural orientation, object orientation, component-based development method of a security solution, or output by an advanced programming language. A target and environment variable input unit; Design analysis engine of security solution that analyzes security solution design and extracts test evaluation information; A virtual user operating engine of the security solution which extracts the virtual user of the security solution; Operation state analysis engine of security solution for analyzing the operation state of security solution and extracting test evaluation information; A source code analysis engine for analyzing the source code and extracting test evaluation information; A database of test evaluation criteria for security solutions that plan, create, manage, and provide security evaluation criteria; Security based on information extracted from the test evaluation criteria database of the security solution, the design analysis engine of the security solution, the virtual user operation engine of the security solution, the operation state analysis engine of the security solution, and the source code analysis engine A security evaluation standard setting engine for establishing a security evaluation standard of the solution; A test evaluation model base of the security solution for planning, generating, managing, and providing a test evaluation model of the security solution used to test the security solution; Trial knowledge base for security solutions that plans, creates, manages, and provides rules, procedures, and knowledge required for trial evaluation of security solutions; A test evaluation engine of the security solution for performing a test evaluation of the security solution based on the set criteria, the selected model, and the extracted test evaluation information; Test evaluation method and system of a security solution comprising a test evaluation result output unit for outputting a test evaluation result. The method of claim 1, The test evaluation criteria database of the security solution and the test evaluation model base of the security solution are functions of a reliability calculation method, a performance calculation method, a security calculation method, and an indirect test evaluation unit, which are direct test evaluation units. Methods and systems for testing and evaluating security solutions with function point calculations, complexity calculations, class and method calculations, and coupling and cohesion calculations . The method of claim 1, Test the security solution that simulates the same situation as the actual operation of thousands to hundreds of thousands of users through the interaction between the meteorological user operation engine of the security solution and the operation state analysis engine of the security solution. Method and system of assessment. The method of claim 1, A test evaluation engine of the security solution is a method and system for testing and comparing the security solution by statistical and probabilistic methods ranging from simple calculation to complex advanced test evaluation regression analysis.