JP2004220459A - Security design support device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problems of making it more efficient to prepare a case database and making more efficient overall editing operations including addition, deletion and modification, in the preparation of specifications utilizing case data. <P>SOLUTION: A security design support system including the security design support device 11 comprises a specification case database 13 which has specification cases stored therein, a means of acquiring various definition information case data from the specification case database 13, a means of preparing a definition information case database 12 from the acquired various definition information case data, and a means of editing a target specification to be designed utilizing the acquired various definition information case data. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention extracts the case data of the various definition information described in the specification based on the standard from the existing specification case based on the predetermined standard, and reuses the merged case data group. The present invention relates to a technology that supports editing work of a specification based on (addition, deletion, and modification of definition information), and particularly to a technology that supports editing work of an existing security specification based on international security evaluation standards.
[0002]
[Prior art]
There is an international security evaluation standard ISO / IEC 15408 (CC: Common Criteria) as a standard for designing and evaluating security functions of information-related products and information systems. In order to develop products and systems compliant with this ISO 15408 and obtain evaluation and certification, a security requirement specification (PP: Protection Profile) specific to ISO 15408 and a security design specification (ST: Security Target) It is mandatory to create However, in order to create these security specifications, it is necessary to have advanced expertise in general security and ISO15408, and specialized techniques and know-how related to analysis work such as risk analysis. That is the problem.
[0003]
"CC Toolbox" by NIAP (The National Information Assurance Partnership), a US security certification organization, is a tool to support the creation of this ISO15408 compliant security specification (PP, ST). ^(TM) (Trademark holder National Security Agency) "and Non-Patent Document 1. These tools are examples of various definition information such as threats and security objectives that should be described in the specifications. By selecting necessary definition information from the database and appending it to the specification, it supports efficient creation of security specifications.
[0004]
By the way, ISO15408 defines a framework for using the security requirement specification PP as a template in order to efficiently create a security design specification ST unique to a product / system. An international standard (ISO15292) on the registration procedure of certified PPs was established in 2001 as a standard for centrally managing PPs that were certified separately in each country so that certified PPs could be used efficiently from all over the world in accordance with this framework. Has been established.
[0005]
Patent Document 1 discloses a specification creation support method that focuses on the reuse of an existing PP group managed by such a registration organization or an existing PP group created and stored in the past. In this document, in the work of creating a specification based on a predetermined standard, especially a security specification based on ISO15408, it should be described in a group of published specifications, a group of specification cases created in the past, and the specifications. By preparing case data groups of various types of definition information such as threats and security objectives in advance, and reusing them, it is possible to achieve a certain level of quality even for general designers who do not have specialized knowledge, know-how or expertise. This is to support the efficient creation of the secured specifications.
[0006]
[Non-patent document 1]
"Security Design Evaluation Support Tool (V3.0) User Manual", Information Processing Promotion Agency Security Center, May 2002, p. 2-69
[Patent Document 1]
JP 2001-222420 A
[0007]
[Problems to be solved by the invention]
As described above, the creation of security specifications (PP, ST), which are essential for development, evaluation, and certification in accordance with ISO15408, requires a wealth of knowledge on threats specific to the target product / system and examples of countermeasures. It requires security know-how such as which measures are effective, and advanced technical skills such as risk analysis. Furthermore, in the actual work of creating specifications, it is necessary to identify threats and countermeasures without omission, to select appropriate security requirements for countermeasures, and to perform analysis work such as risk analysis. What is needed is a problem.
[0008]
Therefore, as a common approach to efficiently create a security specification, a method of reusing security specification examples and case data of various types of definition information described in the security specifications has been adopted. And Patent Document 1 exist. These publicly known examples can be used by general security designers, by utilizing existing security specifications and case databases of various types of definition information created by experts, etc. By simply selecting various definition information cases from the case database, it is possible to create a security specification draft and add necessary definition information.
[0009]
By the way, in the methods of these known examples, it is necessary to prepare a database of specification examples and various definition information examples in advance. Regarding specifications, it is possible to use a group of authenticated security specifications managed by a registration organization or a group of specifications created and stored in the past as a database. For the definition information of, it is necessary to create a new case database separately.
[0010]
In addition, these known examples allow the addition of missing definition information using the case data of the definition information. However, other work that occurs when the specification is edited, for example, due to duplication or inconsistency. It does not support the work of deleting unnecessary definition information or the work of correcting unified terms.
[0011]
[Means for Solving the Problems]
The present invention provides a technology for efficiently creating a definition information example data group to be used for editing work such as addition of definition information in the creation of a specification based on a predetermined standard, particularly in the creation of a security specification conforming to ISO15408. The present invention provides a technology for efficiently supporting various editing operations on a specification using the above-described definition information example data group.
[0012]
The present invention uses a definition information case data creation part that provides a function and an interface for creating various types of definition information case data groups for each type, and uses the created various definition information case data groups to efficiently execute specification documents. It consists of a specification editing support part that provides a function for supporting a simple editing and an interface.
[0013]
In order to create a group of definition information case data for each type, the definition information case data creation part stores a specification case database that stores existing specification case examples based on predetermined criteria, and a security environment (threats, preconditions, Organizational security policy), security objectives, security requirements, and realization method definition information, and the corresponding relationship between security environment and security objectives, security objectives and security requirements, and security requirement and realization method definition information example data A security specification case database that stores existing security specification cases that describe information, a means for extracting various definition information case data described in specifications from specification case data, and a specification document from specification case data Means for extracting the described various correspondence information case data, Means for merging various definition information case data extracted from one or more specification cases by type, means for merging various correspondence information case data extracted from one or more specification cases by type, and merging by type There is provided a means for storing the definition information case data group as a database, and a means for storing the correspondence information case data group merged for each type as a database.
[0014]
Further, in order to support efficient editing of the specification using the definition information case data group, a database of the definition information case created in the definition information case data creation portion and a security A database in which each definition information example data is hierarchically structured based on the inheritance relationship between the information related products and information system feature information types targeted by the specification, and the correspondence information created in the definition information example data creation part A database in which each security environment case data is hierarchically structured based on the case database and the inclusive relation of the meanings of terms indicating threat attribute information (attackers, assets to be protected, attack methods) that identify threats, and threat attributes Based on the inclusive relation of the information, the term case data is hierarchically structured based on the database and the specified feature information A means for retrieving definition information case data, a means for retrieving relevant security environment case data based on specified threat attribute information, and a design that has an inclusive relationship (including coincidence) between the specified security environment and threat attribute information A means for searching the security environment described in the target security specification, a means for displaying a list of definition information case data by type, a means for displaying a list of various search results, and a case for correspondence information from the specified security environment Means for deriving the corresponding security objectives, security requirements, and implementation methods by referring to the database; means for arranging the specified definition information example data at predetermined positions in the specification for the design; and specification for the design Means for extracting various definition information from the specification and deleting the specified definition information data from the specification Means for arranging the security objectives, security requirements, and implementation methods derived by referring to the means, the specified security environment, and the correspondence information case database at predetermined positions in the specification document to be designed; Means for deleting security objectives, security requirements, and implementation methods derived from the security environment and correspondence information case database from the specification of the design target, and the attribute information described in the specification of the design target Means for batch-converting one or more types of term instances having the same class using designated term instances belonging to the attribute information class.
[0015]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 is a schematic diagram showing the features of the security design creation support method of the present invention. In this method, threats, prerequisites, organizational security policies and security measures are obtained from a case group 13 of a security specification based on a predetermined standard (in the case of the international security evaluation standard ISO15408, a protection profile (PP) and a security target (ST)). Each definition information example data of the policy, the security requirement, and the realization method is extracted and displayed in a list on the display 26 of the security design support device 11 or stored as the database 12 in the external storage device. Using this list information or the database 12, a security specification completed version is created by supporting the correction work (correction, addition, deletion) of the security specification draft version that is being created, with the existing specification as the other part. It is to support.
[0016]
Hereinafter, a first embodiment of the present invention will be described in which the predetermined standard is the international security evaluation standard ISO15408 as an example. In the present embodiment, the security specification creator uses the security design support device 11 to extract definition information example data from the security specification example database 13 of a plurality of organizations that register and publish security specifications. A case of executing a correction editing (addition, deletion, modification) work of the security specification draft version 16 using the definition information case data, and a case where the definition information case data extracted so as to be reused in the correction editing work is defined. This relates to the case where the information case database 12 is created.
[0017]
FIG. 21 is a diagram showing an outline of the system configuration of the present embodiment. The system comprises a security design support device 11 for supporting the creation of security specifications, a case database 13 for security specifications (PP and ST) that have been created, and a specification case DB management device 15 for managing the database. The security design support device 11 and the specification case DB management device 15 are connected via a network. Further, the security design support device 11 is connected to an external storage device 12 that stores a definition information case database created using the security specification case database 13.
[0018]
FIG. 2 is a diagram showing a configuration example of a security design support device 11 used in the security design support method and device of the present method. Reference numeral 21 denotes a CPU that controls each hardware in the apparatus and executes a program, 22 denotes a terminal input / output control unit, 23 denotes a bus, 24 denotes an external storage device, 25 denotes a main storage device (memory), and 26 denotes a terminal input / output control. A display connected to the unit, 27 is a keyboard connected to the terminal input / output control unit, and 28 is a network control unit for controlling a network line with another device.
[0019]
Further, 241 to 243 are electronic information stored in the external storage device 24, 251 to 2514 are electronic information loaded on the memory 25, 241 is a communication module for performing communication via a network line, and 242 is a communication module. A security design support program, 243 is a definition information case database created by the security design support program, 251 is a communication processing unit for performing communication via a network line, 252 is a security specification case database 13 from the security specification case database 13 for each definition information type. A definition information case data extraction processing unit 253 for extracting definition information case data, a definition information case DB creation processing unit 254 that merges the definition information case data 2513 extracted by the case data extraction processing unit 252 and saves the database as a database; Is extracted by the case data extraction processing unit 252. A definition information case data display processing unit that displays the defined definition case data 2512 on the display 26 in a list. A definition 255 narrows down the case data from the definition information case data 2512 extracted from the security specification 13 and the definition information case database 243. The information case data search processing unit 256 duplicates or contradicts the definition information to be newly added and the definition information data in the security specification data 2513 being created, or the definition in the security specification data 2513 being created. A definition information case data comparison processing unit 257 for supporting detection of duplication or inconsistency between information data, and a definition information case data 257 for adding case data selected from the listed definition information case data 2512 to the security specification data 2513 Additional processing unit, 258 is security The definition information data deletion processing unit 259 for deleting the definition information data selected from the definition information data in the total specification data 2513, and 259 generates all the related definition information example data based on the correspondence between the definition information example data. Derived correspondence data derivation processing unit 2510 is a term selection / conversion processing unit that unifies terms in security specification data 2513 using a term case database that collects term cases used in definition information case data; An area 2511 temporarily stores security specification data when executing the case data extraction processing 252, a storage area 2512 for definition information case data extracted from the security specification by the case data extraction processing 252, and a security design 2513. The data of the security specification being created using the support program 242 Indicates the data storage area.
[0020]
FIG. 4 is a diagram showing a configuration example of a specification case DB management device 15 that manages a security specification (PP / ST) case database 13 used by the security design support method and device of this method. 41 is a CPU for controlling each hardware in the device and executing a program, 42 is a terminal input / output control unit, 43 is a bus, 44 is an external storage device, 45 is a main storage device (memory), and 46 is a terminal input / output control. A display connected to the section, a keyboard 47 connected to the terminal input / output control section, and a network control section 48 for controlling a network line with another device are shown.
[0021]
441 to 443 are electronic information stored in the external storage device 24; 451 to 454 are electronic information loaded on the memory 45; 441 is a communication module for performing communication via a network line; A case data providing program, 443 is a security specification case database storing security specification case data provided by the specification case data providing program, 451 is a communication processing unit for performing communication via a network line, and 452 is via a network A specification case data extraction processing unit 453 for providing security specification case data based on the request of the user, and a specification case data search processing unit 454 for narrowing down the security specification case data provided based on the request via the network, 454 Is from security specification case data 455 is an area for temporarily storing security specification case data output by the specification case data extraction processing unit 452 and the specification case data search processing unit 453; 4 shows an area for storing definition information case data output by a definition information case data extraction processing unit. However, the specification case data search processing unit 453 and the definition information case data extraction processing unit 454 are not essential.
[0022]
FIG. 5 shows a format example of each security specification case data stored in the security specification case database 443. The security specification in the present invention is a document described in a format based on a predetermined standard. For example, in the case of a security specification (PP, ST) based on the international security evaluation standard ISO15408, it is described according to a predetermined table of contents configuration 51. Note that the underlined portion is a table of contents unique to ST, and the portion without underlined is a table of contents common to PP and ST. In addition, each section of the security environment, security objectives, security requirements, and TOE specification outline contains security environment definition information (threats, assumptions, organizational security policies), security objective definition information, security requirement definition information, and realization. Each definition information 52 of the method definition information is described.
[0023]
The description of these definition information is a set of labels (A. ADMIN, T. ABUSE, P. MAC, O. I & A, FAU_GEN.1, ADV_CAP.1, etc.) for identifying each definition information and the definition contents. It consists of. Further, the correspondence 53 between the definition information is described in the section describing the basis. The table of contents and the definition information description format can be described in a mark format as shown in the examples of 54, 55, and 56.
[0024]
Hereinafter, an embodiment will be described in which the security specification draft version 16 is corrected and the creation of the security specification completed version 17 is supported in the system configuration shown in FIG.
[0025]
FIG. 12 is a diagram showing the specification editing screen 110 of the security design support program 242 in the security specification support device 11. At the time of correction work, the definition contents of various definition information are corrected by text-editing the security specification draft version data 16 displayed on this screen. Further, various functions for supporting editing can be executed from the command menu of the specification editing screen 110. At the time of draft version correction work, various definition information example data is added / deleted by selecting a definition information addition menu 1101 or a definition information deletion menu 1102 from this screen. Also, when unifying various terms that are not unified in the draft version, a plurality of different terms desired to be used with the same meaning are converted using the term conversion menu 1103. Also, a definition information case DB creation menu 1104 is provided as an interface for creating a definition information case database in advance for reuse in addition / deletion of various definition information case data during correction work.
[0026]
FIG. 13 shows an outline of the operation when definition information is added to the security specification draft version 16 using the security design support apparatus 11 or when a definition information example database to be used for adding definition information is created. FIG. Hereinafter, an operation outline (flow 131) in a case where definition information is added to the security specification draft version 16 and a case where a definition information case database to be repeatedly used for adding definition information will be described.
[0027]
When the user starts the security design support program 242 and selects the definition information addition menu 1101 or the definition information case DB creation menu 1104 on the specification editing screen 110, an address for specifying the specification case database 13 is selected. An input screen 150 including an input field 1501 and feature information input fields 1502 to 1505 for inputting keywords representing characteristics of the target security specification case data is displayed (FIG. 14). On the input screen 150, the user specifies the address of the specification case database from which the definition information case data is to be collected and the feature information of the security specification case for which the definition information case data is to be used, and presses the input button 1511. (Step 1311).
[0028]
The input results are displayed at 1506 to 1510, respectively. At this time, if the case data has already been acquired, by pressing the skip button 1514 (step 22), the process jumps to step 1316 to perform the process of reusing the acquired case data. On the other hand, when the OK button 1513 is pressed, the definition information case data extraction processing unit 252 of the security design support program 242 cooperates with the communication processing unit 251 at the specified address regardless of whether the case data has been acquired. A request is made to the specification case database to acquire definition information case data from security specification case data that matches the specified characteristic information (step 1312). The case data providing program 442 on the specification case database management device 15 that manages the specified specification case database receives the request from the security design support device 11 and causes the specification case data search processing unit 453 to execute the security design support device. The security specification case is searched based on the feature information list requested from the security specification case 11, and the specification case data extraction processing unit extracts the corresponding security specification case data and stores it in the specification case data area 455 (step 1321). ).
[0029]
If there is no specification case data search processing unit 453, or if no feature information is specified, all security specification case data is extracted and stored in the specification case data area 455. Further, if there is a definition information case data extraction processing unit 454, various types of definition information are extracted from the data stored in the specification case data area 455 by using a predetermined table of contents configuration and a definition information description format (51 to 56). The case data is extracted and stored in the definition information case data area 456 (step 1322). If there is data stored in the definition information case data area 456, the communication processing unit 451 sends the definition information case data stored in the specification case data area 455 to the specification case data. (Step 1323).
[0030]
The security design support apparatus 11 receives the case data transmitted from the specification case DB management apparatus, and stores the specification case data in the specification case data area 2511 and the definition information case data in the definition information case data area 2512. Classify and store (step 1313). If there is a specification case database 13 which has not been accessed yet among the specification case databases 13 at the address 1506 specified on the input screen 150 (step 1314), the steps 1312 and 1313 are repeated, and the received case data is similarly processed. Classify and store. After receiving the case data from all the specification case databases specified, if there is specification case data in the received case data, the definition information case data extraction processing unit 252 causes the specification case data area 2511 to store the specification case data. Various definition information example data is extracted from the data by using a predetermined table of contents configuration and a definition information description format (51 to 56), and additionally stored in the definition information example data area 2512 (step 1315).
[0031]
The process branches depending on whether the command menu selected on the specification editing screen 110 is either the definition information case DB creation 1104 or the definition information addition 1101 (step 1316).
[0032]
First, when the definition information case DB creation 1104 is selected on the specification editing screen 110, the definition information case data processing unit 252 saves the data of the definition information case data area 2512 as the definition information case database 243 in the external storage device 24. (Step 1317). The stored definition information case database is read into the definition information case data area 2512 on the memory at any time during execution of the security design support program 242 (step 1321), and is used for editing processing.
[0033]
Now, a configuration example of the definition information case data stored in the definition information case data area 2512 and the definition information case database 243 will be described with reference to FIGS.
[0034]
6 and 7 are diagrams showing examples of the minimum data configuration of the definition information case data area 2512 and the definition information case database 243. FIG. Reference numerals 61 to 68 indicate data structures of various definition information of threats, preconditions, organization security policies, TOE security objectives, environment security objectives, security function requirements, security assurance requirements, and realization methods, respectively. Each definition information case data is a unique number in the definition information case data area 2512 or the definition information case database 243, a label for identifying the definition information case, the definition contents thereof, and the security specification from which the definition information case data is derived. Book identifier.
[0035]
For example, the threat case data 61 includes a threat ID 611, a threat label 612, a threat case description 613, and a derivation source specification ID 614. The same applies to prerequisites, organizational security policies, TOE security objectives, environmental security objectives, security functional requirements, security assurance requirements, and other definition information example data for realization methods.
[0036]
FIG. 8 shows a class hierarchy structure image (71 to 73) of threat attribute information of an attacker, an asset to be protected, a threat type and an attack method, which are information necessary for identifying a threat (hereinafter referred to as threat attribute information). ), A data configuration example of a class hierarchical structure (74: case of an attacker), and a data configuration example of a hierarchical structure of threat attribute information case examples (75: case of an attacker). FIG. 9 illustrates the definition information example data of the threat case data, the prerequisite condition case data, and the organizational security policy case data based on the definition contents of each definition information case data. FIG. 7 is a diagram showing an example of a data configuration associated with each hierarchical structure of threat types and attack methods.
[0037]
Each definition information case data has a unique number in the definition information case data area 2512 or the definition information case database 243, a label for identifying the definition information case, its definition content, an attacker class name, a protected asset class name, and a threat. It consists of the type and attack method class name. For example, the threat case 81 includes a threat ID 811, a threat label 812, a threat case description 813, an attacker class name 814, a protected asset class name 815, and a threat type / attack method class name 816. The same applies to preconditions and organizational security policies.
[0038]
FIG. 10 is a diagram showing a class hierarchical structure image (91) of characteristic information for classifying products and systems, and definition information example data of threat case data, prerequisite case data, and organizational security policy case data. FIG. 9 is a diagram showing an example of a data configuration in which each hierarchical class of the feature information hierarchical structure 91 is associated with each other based on feature information of a security specification in which is described. Each definition information case data includes a unique number in the definition information case data area 2512 or the definition information case database 243, a label for identifying the definition information case, its definition content, and a feature information class name. For example, the threat case 92 includes a threat ID 921, a threat label 922, a threat case description 923, and a feature information class name 924. The same applies to preconditions and organizational security policies.
[0039]
FIG. 11 shows a correspondence image (101) between the definition information case data described in the security specification document and each case data of threats, preconditions, organizational security policies, the TOE security objectives, and the environmental security objectives. Data configuration examples showing correspondences (102-104), correspondences between TOE security objectives, security function requirements and security assurance requirements (105), and correspondences between security function requirements and implementation methods (106) FIG.
[0040]
Each definition information case data includes an ID number of a certain definition information case data and an ID number of the corresponding definition information case data. For example, in the case of the threat case 102, the security objectives case data corresponding to the threat ID “1” are the TOE security objectives case data of the ID “3” and the security objectives case data of the environment of the ID “8”. It is shown that. The same applies to prerequisites, organizational security policies, TOE security objectives, environmental security objectives, security functional requirements, security assurance requirements, and other definition information example data for realization methods.
[0041]
As described above, the definition information case data and database created in the flow 131 are stored in the definition information case data area 2512 or the definition information case database 243 based on the data configuration examples shown in FIGS. And It is also assumed that the definition information data of the specification document to be designed is also stored based on the data configuration examples shown in FIGS.
[0042]
On the other hand, when the definition information addition screen 1101 is selected on the specification editing screen 110, a definition information case addition screen 160 is displayed, and the process of adding the definition information case data to the specification to be designed (flow 141) is performed. The process is executed (step 1319).
[0043]
FIG. 16 is a diagram showing a configuration example of the definition information case addition screen 160. The case addition screen 160 provides an interface for adding a case for each type of definition information case data such as threats, preconditions, and organizational security policies (1601). A definition information case data list display field 1602, an additional case data display field 1603 selected from the definition information case data list, a registration button 1604 and an exclusion button 1605 for selecting and canceling the additional case. A definition content display column 1606 for displaying the definition contents of the definition information case data specified in the information case data list display column 1602 or the additional case data display column 1603, and the definition information case data list display column 1602 or the additional case data display column Duplication or contradiction is possible for the definition information example data specified in 1603 A related definition information case data display column 1607 that displays the definition information case data described in the security specification draft version 16 that is being edited, and the security objectives, security requirements, and realization methods that correspond when adding case data are added simultaneously. A corresponding definition information derivation check box 1608 for determining whether or not to execute, a refinement search button 1609 for narrowing down the definition information example data displayed in the definition information example data list display field 1602, and the specified additional definition information example data is being edited. And an OK button 1610 for adding to the security specification draft version. Note that the labels and definition contents displayed in the definition content display column 1606 and the related definition information case data display column 1607 are obtained from the definition information case data having each data configuration of FIGS. 6 to 11. In particular, the definition information example data that may be duplicated or inconsistent displayed in the related definition information example data display column 1607 is processed by the definition information example data comparison processing unit 256 as shown in the duplicate example 201 and the contradiction example 202 shown in FIG. It is derived by analogy using the inclusive relation of various attribute information.
[0044]
Further, when the refinement search button 1609 on the definition information case addition screen 160 is pressed, the case data search processing unit 255 displays a refinement condition input screen 170 for specifying threat attribute information as refinement conditions, and based on the designated refinement conditions. The definition information case data displayed in the definition information case data list display column 1602 is narrowed down (step 1320).
[0045]
FIG. 17 is a diagram showing a narrow-down condition input screen 170 for specifying threat attribute information for narrowing down the definition information example data. The narrowing-down condition input screen 170 includes attribute selection fields 1701 to 1704 for displaying options of an attacker / factor as threat attribute information, an asset to be protected, a threat type, and an attack method, and a designated attribute for displaying each specified attribute information. Based on the specified attribute information, the information display columns 1705 to 1708, the inclusive relation corresponding narrowing check box 1711 for performing narrowing in consideration of the inclusive relation of the threat attribute information by using the hierarchical structure 71 to 73 of the threat attribute information, and And an OK button 1712 for performing filtering.
[0046]
When an OK button 1712 on this screen is pressed, the definition information case data associated with the class that matches each attribute information class displayed in the designated attribute information display fields 1705 to 1708 is displayed. Browse and extract. When the inclusion relation narrowing check box 1711 is checked, the definition information example associated with the class below the attribute information class specified in the hierarchical structures 71 to 73 in consideration of the inclusion relation of each attribute information term. Also extract data.
[0047]
Now, an operation outline (flow 141) of a process of adding a definition information case to a specification to be designed using the definition information case addition screen 160 and the narrow-down condition input screen 170 will be described.
[0048]
In the flow 141, first, the definition information case data in the definition information case data area 2512 is displayed on the definition information case addition screen 160 (step 1412). Here, if the refine search button 1609 is pressed, refinement conditions are set from the refinement condition input screen 170, and the definition information example data is refined based on the conditions (step 1411). It is displayed above (step 1412). When the definition information case data in the definition information case data list display field 1602 or the additional case data display field 1603 on the definition information case addition screen 160 is selected, the contents of the selected definition information and the class hierarchy of the threat attribute information are selected. The contents of the definition information case belonging to the same or lower class in the structure are displayed (step 1414).
[0049]
If the registration button 1604 is pressed in a state where the definition information case data in the definition information case data list display column 1602 is selected (step 1415), it is registered as an additional candidate and added to the additional case data display column 1603. When the exclusion button 1605 is pressed while the definition information example data in the additional case data display field 1603 is selected (step 1415), it is excluded from the additional candidates and deleted from the additional case data display field 1603 (step 1416). . The above processing is repeated until the OK button 1610 or the cancel button is pressed on the definition information case addition screen 160 (step 1417). Then, when the OK button is pressed, the definition information case data registered as the addition candidate is added to the specification to be designed (step 1418). When the correspondence definition information derivation check box 1608 is checked, the correspondence data derivation processing unit 259 extracts the definition information case data in correspondence using the correspondence information data 102 to 106 between the definition information case data. Then, it is added collectively in cooperation with the definition information case data addition processing unit 257 (step 1418).
[0050]
The above is the description of the outline of the operation in the case where the definition information is added to the security specification draft version 16 and the case where the definition information case database for repeatedly using the definition information is created.
[0051]
Next, an operation outline (flow 142) when the definition information is deleted in the security specification draft version 16 will be described.
[0052]
When the user selects the definition information deletion menu 1102 on the specification editing screen 110, the definition information data deletion processing unit 258 deletes the specified definition information data from the definition information data already described in the security specification draft version 16. To delete the definition information from the specification to be designed (flow 142).
[0053]
FIG. 18 is a diagram showing a configuration example of the definition information deletion screen 180. The definition information deletion screen 180 provides an interface for deleting definition information for each type of definition information example data such as threats, preconditions, and organizational security policies (1801). , Described definition information list display column 1802, a display column 1803 of the deletion definition information data selected from the listed definition information list, an add button 1804 and a cancel button 1805 for performing the above-mentioned deletion data selection and the selection cancellation, and A definition content display column 1806 for displaying the definition content of the definition information data specified in the listed definition information list display column 1802 or the deletion definition information data display column 1803, and the listed definition information list display column 1802 or the deletion Duplication of the definition information data specified in the definition information data display column 1803 A related definition information example data display column 1807 that displays definition information data described in the security specification draft version 16 being edited that may be a shield, and security objectives, security requirements, and realizations that correspond when the definition information data is deleted It comprises a corresponding definition information derivation check box 1808 for determining whether to delete the method at the same time, and an OK button 1809 for deleting the specified deletion definition information data from the security specification draft version 16 being edited.
[0054]
Note that the labels and definition contents displayed in the definition content display column 1806 and the related definition information case data display column 1807 are the definition information case data stored in the security specification data area 2513 in each data configuration shown in FIGS. To get from. In particular, the definition information case data that may be duplicated or inconsistent displayed in the related definition information case data display column 1807 is output by the definition information case data comparison processing unit 256 as shown in the overlap example 201 and the contradiction example 202 shown in FIG. It is derived by comparing attribute information classes using the inclusive relation of various attribute information.
[0055]
Now, an operation outline (flow 142) of the process of deleting the definition information case from the specification to be designed using the definition information deletion screen 180 will be described.
[0056]
In the flow 142, first, the definition information example data in the definition information example data area 2512 is displayed on the definition information deletion screen 180 (step 1422). When the definition information data in the listed definition information list display field or the deletion definition information display field 1803 on the definition information deletion screen 180 is selected, the content of the selected definition information and the class hierarchy structure of the threat attribute information are displayed. The contents of the written definition information belonging to the same or lower class are displayed (step 1424). If the registration button 1804 is pressed in a state where the definition information example data in the listed definition information list display column 1802 is selected (step 1425), it is registered as a deletion candidate and added to the deletion definition information display column 1803, If the exclusion button 1805 is pressed while the definition information example data in the deletion definition information display column 1803 is selected (step 1425), it is excluded from the deletion candidates and deleted from the deletion definition information data display column 1803 (step 1426). ).
[0057]
The above processing is repeated until the OK button 1809 or the cancel button is pressed on the definition information deletion screen 180 (step 1427). Then, when the OK button 1809 is pressed, the definition information data registered as the deletion candidate is deleted from the specification to be designed (step 1428). If the correspondence definition information derivation check box 1808 is checked, the correspondence data derivation processing unit 259 extracts definition information in correspondence using the correspondence information between the definition information case data 102 to 106, Batch deletion is performed in cooperation with the definition information case data addition processing unit 257 (step 1428).
[0058]
As described above, from the written definition information data list 1802 described in the security specification draft version 16, the deletion definition information data 1803 that the user has determined to be duplicated or inconsistent with reference to the related definition information example data display column 1807. When the delete button 1809 is pressed, the definition information data deletion processing unit 258 deletes this from the definition information data in the specification data stored in the security specification data area 2513. When the correspondence definition information derivation check box 1808 is checked, the correspondence data derivation processing unit 259 derives the corresponding definition information case data using the correspondence information data 102 to 106 between the definition information case data. Batch deletion is performed in cooperation with the definition data deletion processing unit 258.
[0059]
The above is the outline of the operation when deleting the definition information from the security specification draft version 16.
[0060]
Next, an outline of the operation in a case where the description in which different terms have the same meaning in the security specification draft version 16 are corrected to achieve term unification will be described.
[0061]
When the user selects the term conversion menu 1103 on the specification editing screen 110, the term selection / conversion processing unit 2510 displays a term designation screen 190 for unifying various attribute information terms.
[0062]
FIG. 19 is a diagram showing a configuration example of the term designation screen 190. The term specification screen 190 provides an interface for selecting and converting terms for each threat attribute information type such as attacker / factor, asset to be protected, threat type / attack method (1901), and terms for each type. On the designation screen, the terms used in a unified manner from the class tree diagram 1902 based on the attribute information hierarchical structures 71 to 73 and the term / expression case list for each class obtained by using the data structure 75 of each attribute term case A term selection column 1903 for selection, an inclusive relation corresponding narrowing check box 1904 for performing term conversion in consideration of the inclusive relation of threat attribute information using the hierarchical structure 71 to 73 of the threat attribute information, and a designated attribute And an OK button 1905 for performing term conversion based on the information.
[0063]
When an OK button 1905 on this screen is pressed, the term conversion processing unit 2510 selects a term for each attribute information class used in the security specification data from the term selection field 1903 for each class in the class tree 1902. Is replaced with the term example. At this time, on the replacement confirmation screen 191, the entire replacement is performed by pressing the replace all button 1913, and the user determines whether or not to perform replacement by referring to the replacement target portion 1901, thereby sequentially replacing 1912. Or 1914 without replacement is also possible.
[0064]
The above is the description of the embodiment in the case where the security specification draft version 16 is corrected and the creation of the security specification completed version 17 is supported in the system configuration shown in FIG.
[0065]
Next, a description will be given of a second embodiment of the present invention in which the predetermined standard is the international security evaluation standard ISO15408. In this embodiment, first, a security information / knowledge provider such as a public organization / industry group, a security information / know-how providing company, a security design support company, and a security management department in the organization is used by a definition information case DB generation / management apparatus. 14, security specification case database 13 of a plurality of organizations that register and publish security specifications, and security specification case data obtained from the organization and reconstructed specification case examples The definition information case data is extracted from the database 18 to create the definition information case database 12, and the definition information case data is provided in response to a request from the security design support device.
[0066]
Then, the creator of the security specification uses the security design support device 11 to acquire definition information case data from the published security specification case database 13 and the provided definition information case database 18, and obtain the definition. It executes the correction editing work of the security specification draft version 16 using the information case data, or creates the definition information case database 12 from the extracted definition information case data so that it can be reused in the correction editing work. is there.
[0067]
FIG. 22 is a diagram showing an outline of a system configuration of the present embodiment. The system includes a security design support device 11 for supporting the creation of security specifications, a case database 13 for security specifications (PP and ST) that have been created, a specification case DB management device 15 for managing the database, and the security specification. A definition information case DB generation / management device 14 for creating and providing definition information case data from a case database; a security design support device 11, a definition information case DB generation / management device 14, a specification case DB management device 15; Are connected via a network. Further, the security design support device 11 is connected to an external storage device 12 that stores a definition information case database created using the security specification case database 13.
[0068]
FIG. 3 is a diagram showing a configuration example of the definition information case DB generation / management device 14 used in the security design support method and device of this method. 31 is a CPU for controlling each hardware in the device and executing a program, 32 is a terminal input / output control unit, 33 is a bus, 34 is an external storage device, 35 is a main storage device (memory), and 36 is a terminal input / output control. And 37, a keyboard connected to the terminal input / output control unit, and 38, a network control unit for controlling a network line with another device.
[0069]
341 to 344 are electronic information stored in the external storage device 34; 351 to 356 are electronic information loaded on the memory 35; 341 is a communication module for performing communication via a network line; A case DB creation program for creating a definition information case database, 344 is a definition information case database created by the case DB creation program 342, and 343 is a case of providing definition information case data in response to a request from the security design support device 11. A data providing program, 351 is a communication processing unit for performing communication via a network line, and 352 is definition information case data extraction processing for extracting definition information case data for each definition information type from the case database 13 of the security specification. And 353 are extracted by the case data extraction processing unit 252. A definition information case DB creation processing unit for merging the created definition information case data 356 and storing the merged definition information case data 356 as a database 344. The definition information case DB 354 provides the created definition information case data of the definition information case DB 344 via a network in cooperation with the communication processing unit 351. 355 is an area for temporarily storing security specification data when executing the case data extraction processing 352, and 356 is a definition extracted from the security specification by the case data extraction processing 352. The storage area of the information case data and the storage area of the definition information case data provided by the definition information case data provision processing unit 354 are shown.
[0070]
In the present embodiment, on the input screen 150 for specifying the specification case database of the security design support apparatus 11 and narrowing down the target specification case, the definition information case database 12 is also possible as a connection destination of the specified address 1506. By setting the case data acquisition destination in the flow 131 to the definition information case DB generation / management device 14, the description of the first embodiment can be applied to the description of the present embodiment as it is. Further, the definition information case data extraction processing unit 252 in the first embodiment, the definition information case data extraction processing unit 352 in the present embodiment, the definition information case DB creation processing unit 253 in the first embodiment, and the definition in the present embodiment By regarding each of the information case data extraction processing units 353 as the same processing, the definition information case DB generation / management device 14 implements the definition information case database creation function of the security design support device 11 in the first embodiment, This embodiment can be described by the same processing contents and procedures as those of the first embodiment.
[0071]
As described above, in the security design support apparatus and method realized in the first and second embodiments, the external storage medium for storing the definition information case database 12 is not only a medium built into the apparatus such as a hard disk drive, but also a CD-R / A writable portable storage medium such as an RW drive or a DVD-R / RW drive may be used.
[0072]
According to the above embodiments, when creating a security specification, a product / system developer can improve the efficiency of security specification creation using published security specification examples and improve quality by using evaluated examples. Can be achieved. In addition, companies that provide security information and know-how and security design support service companies build their own definition information case databases based on the published security specification cases and provide value-added security case data. By using the definition information case database, an efficient and high-quality security design support service can be provided.
[0073]
According to the above embodiment, when a specification based on a predetermined standard, especially a security specification based on international security evaluation standards used in planning and designing an information-related product or information system, is registered with a registration agency. Extracts various definition information example data such as threats and security objectives from the authenticated security specification group and the security specification group created and accumulated in the past by type, and individually selects the definition information from among them to the specification Can be used to add
[0074]
In addition, the extracted definition information example data group contains the inheritance relationship of product and system feature information (target size, product category, product type, product use, etc.), and threat attribute information (attacker, protected assets, attack method) ), It is possible to efficiently support the entire editing work such as addition, deletion, and modification of definition information to the specification by adding information such as the inclusive relation of terms used in) and the correspondence relation between each definition information case. Become.
[0075]
This greatly reduces the case database creation work that has been manually performed by an expert or the like in the case data utilization type specification creation support tool. In addition, depending on the expertise and know-how of the operator, when the draft specification is revised in consideration of the uniqueness of the target, or when the completed version is created by eliminating duplication, inconsistency, and variation in terms of the description, Addition, deletion, and modification of definition information can be reduced, and a high-quality specification can be created.
[0076]
【The invention's effect】
According to the present invention, it is possible to efficiently create a security specification.
[Brief description of the drawings]
FIG. 1 is a feature outline of a security design support method based on the present invention.
FIG. 2 is a security design support device.
FIG. 3 is a definition information case DB generation / management device.
FIG. 4 is a specification case DB management device.
FIG. 5 is an example of a specification format based on a predetermined standard (ISO15408).
FIG. 6: Definition information example data format (security environment, security objectives)
FIG. 7: Definition information example data format (security requirements, implementation method)
FIG. 8 is a diagram illustrating a hierarchical structure image of threat attribute information, a hierarchical structure expression example, and an attribute information example data format.
FIG. 9 is a security environment example data format with threat attribute information.
FIG. 10 is an example of a hierarchical structure image of product / system feature information and a definition information example data format with feature information.
FIG. 11 shows an example of a correspondence image between definition information and a correspondence data format between definition information example data.
FIG. 12 is an example of a specification editing screen of a security design support tool and a list of editing support function menus.
FIG. 13 is a flow of collecting definition information example data and creating a DB.
FIG. 14 is a flow for adding definition information example data and deleting definition information.
FIG. 15 is an example of an input screen for collecting definition information example data
FIG. 16 is an example of an input screen for adding definition information example data
FIG. 17 shows an example of a refinement setting screen based on threat attribute information.
FIG. 18 is an example of an input screen for deleting definition information data
FIG. 19 is an example of an input screen for term replacement
FIG. 20 shows an example of overlap, inconsistency, and attribute information between definition information.
FIG. 21 is a configuration example of a security design support system (first embodiment)
FIG. 22 is a configuration example of a security design support system (second embodiment).
[Explanation of symbols]
11: Security design support device, 12: Definition information case database, 13: Specification (PP / ST) case database, 14: Definition information case DB generation / management device, 15: Specification case DB management device, 16: Design target Security specification (PP / ST) draft version, 17 ... Security specification (PP / ST) completed version to be designed, 18 ... Specification (PP / ST) case database, 21 ... CPU, 22 ... Terminal input / output control Unit, 23 bus, 24 external storage device (disk), 25 main storage device (memory), 26 display, 27 keyboard, 28 network control unit, 241 communication module, 242 security design support program, 243: definition information case DB, 243: term case DB, 251: communication processing unit, 252: definition information case data Extraction processing unit, 253: Definition information case DB creation processing unit, 254: Definition information case data display processing unit, 255: Definition information case data search processing unit, 256: Definition information case data comparison processing unit, 257: Definition information case Data addition processing unit, 258 Definition data deletion processing unit, 259 Correspondence data derivation processing unit, 2510 Term selection / conversion processing unit, 2511 Specification case data area, 2512 Definition information case data area, 2513 Security specification data area, 31 CPU, 32 terminal I / O controller, 33 bus, 34 external storage device (disk), 35 main storage device (memory), 36 display, 37 keyboard, 38 Network controller, 341, communication module, 342, case DB generation program, 343, case data provision program Gram, 344: Definition information case DB, 351: Communication processing unit, 352: Definition information case data extraction processing unit, 353: Definition information case DB creation processing unit, 354: Definition information case data provision processing unit, 355: Specification case Data area, 356: Definition information case data area, 41: CPU, 42: Terminal input / output control unit, 43: Bus, 44: External storage device (disk), 45: Main storage device (memory), 46: Display, 47 ... keyboard, 48 ... network control unit, 441 ... communication module, 442 ... case data providing program, 443 ... security specification case database, 451 ... communication processing unit, 452 ... specification case data extraction processing unit, 453 ... specification case Data search processing unit, 454 ... Definition information case data extraction processing unit, 455 ... Specification case data area, 4 56: Definition information case data area, 51: Specification structure based on criteria (PP / ST), 52: Description of various definition information, 53: Description of correspondence between definition information, 54: Specification structure based on criteria ( 55) Description of various definition information (with mark), 56 ... Description of correspondence between definition information (with mark), 61 ... Threat case data part, 611 ... Threat ID, 612 ... Label, 613 ... Case Description, 614: Source specification ID, 62: Precondition data part, 621: Precondition ID, 622: Label, 623: Case description, 624: Derivation specification ID, 63: Security policy data part of organization, 631 ... Policy ID, 632 ... Label, 633 ... Case Description, 634 ... Derivation Source Specification ID, 64 ... TOE Security Objective Policy Data Section, 641 ... TOE Countermeasure ID, 642 Label, 643 ... Case description, 644 ... Derivation source specification ID, 65 ... Environmental security objectives data part, 651: Environment countermeasure ID, 652 ... Label, 653 ... Case description, 654 ... Derivation source specification ID, 66 ... Security Functional requirement data section, 661: Functional requirement ID, 662: Label, 663: Case description, 664: Derivation source specification ID, 67: Security assurance requirement data section, 671: Assurance requirement ID, 672: Label, 673: Case description , 674: Derivation source specification ID, 68: Realization method data part, 681: Realization method ID, 682: Label, 683: Case description, 684: Derivation source specification ID, 71: Class hierarchy of attacker, 72: Protection Target asset class hierarchy, 73: threat type / factor class hierarchy, 74: attacker class hierarchy structure part, 741: class ID, 742 Class name, 743: upper class ID, 75: attacker term case data section, 751: term / expression case, 752: attacker class name, 81: threat case data section, 811: threat ID, 812: label, 813 ... Case description, 814: attacker / factor, 815: protected asset, 816: threat type / attack method, 82: precondition data section, 821: precondition ID, 822: label, 823: case description, 824: attacker・ Factor, 825: Asset to be protected, 826: Threat type / attack method, 83: Organizational security policy data section, 831: Policy ID, 832: Label, 833: Case description, 834: Attacker / factor, 835: Protection Target asset, 836: Threat type / attack method, 91: Class hierarchical structure image of feature information, 92: Threat case data section, 921: Threat ID, 922 ... label, 923 ... case description, 924 ... feature information class, 101 ... correspondence image between definition information case data, 102 ... threat-security measure correspondence data part, 1021 ... threat ID, 1022 ... TOE measure ID, 1023 ... Environmental measure ID, 103 ... Prerequisite-security measure correspondence data part, 1031 ... Prerequisite ID, 1032 ... TOE measure ID, 1033 ... Environmental measure ID, 104 ... Organizational security policy-security measure correspondence data part , 1041... Policy ID, 1042... TOE countermeasure ID, 1043... Environmental countermeasure ID, 105... Security countermeasure-security requirement correspondence relationship data section, 1051... TOE countermeasure ID, 1052. … Correspondence between security requirements and implementation method Related data section, 1061 ... Function requirement ID, 1062 ... Realization method ID, 110 ... Security design support tool specification edit screen, 1101 ... Definition information addition menu, 1102 ... Definition information deletion menu, 1103 ... Term conversion menu, 1104: Definition information case DB menu, 131: Security design support device flow, 1311: Feature information designation step, 1312: Case data request step, 1313: Case data acquisition step, 1314 ... Target specification case DB remaining judgment step, 1315 ... Case data extraction step, 1316 ... DB creation processing determination step, 1317 ... Database creation step, 1318 ... DB reading step, 1319 ... Data list display step, 1320 ... Filtering step, 1321 ... Case data use step, 33: security design support device flow, 1331: feature information designation step, 1332: case data request step, 1333: case data acquisition step, 141: flow of adding definition information cases to the specification to be designed, 1411: definition information cases Data narrowing down step, 1412 ... definition information case data list display step, 1413 ... definition information case data selection judgment step, 1414 ... related definition information case data display step, 1415 ... addition candidate registration / exclusion judgment step, 1416 ... addition candidate Registration / exclusion step, 1417 ... Screen click determination step, 1418 ... Definition information case data addition step, 142 ... Deletion flow of definition information from design target specification document, 1422 ... Definition information data list display step, 1423 ... Definition information data Selection judgment Step: 1424: Related definition information data display step, 1425: Deletion candidate registration / exclusion determination step, 1426: Registration / exclusion step to deletion candidate, 1427: Screen click determination step, 1428: Definition information data deletion step, 150: Address Characteristic information input screen, 1501 ... Address input field, 1502 ... Scale input field, 1503 ... Category input field, 1504 ... Other feature information input fields, 1505 ... Keyword input field, 1506 ... Address determination field, 1507 ... Scale determination field , 1508: Category determination field, 1509: Other feature information determination field, 1510: Keyword determination field, 1511: Add button, 1512: Delete button, 1513: OK button, 1514: Skip button, 160: Definition information example data addition screen , 1601 ... definition information type , 1602 ... case data list display field, 1603 ... additional case data display field, 1604 ... addition button, 1605 ... deletion button, 1606 ... definition content display field, 1607 ... specification definition related already-defined information display field, 1608 ... correspondence Relationship check box, 1609: Refine search button, 1610: Add button, 170: Refinement condition input screen, 1701: Attacker / factor input field, 1702: Protected asset input field, 1703: Threat type input field, 1704 ... Attack method input field, 1705: attacker / factor determination field, 1706: protection target asset determination field, 1707: threat type determination field, 1708: attack method determination field, 1709: add button, 1710: delete button, 1711: threat attribute Information inclusion relation check box, 1712... OK button, 180... Term selection screen, 1801. Information type tab, 1802 ... Defined definition information display field, 1803 ... Deleted definition information data display field, 1804 ... Add button, 1805 ... Delete button, 1806 ... Definition contents display field, 1807 ... Specified specification written related definition information display field , 1808: Correspondence check box, 1809: Delete button, 190: Term selection screen, 1901: Threat attribute information tab, 1902: Threat attribute tree display field, 1903: Threat attribute term example display field, 1904: Threat attribute inclusion relation check Box, 1905 OK button, 191 replacement confirmation screen, 1911 replacement candidate display field, 1912 sequential replacement button, 1913 batch replacement button, 1914 next candidate search button, 201 duplicate example, 202 contradiction example.

Claims (9)

In a security design support device that supports the creation of specifications based on predetermined criteria,
A specification case database storing an existing specification case group in which one or more types of definition information are described based on the criteria,
Definition information case data extraction means for extracting definition information case data described based on the criteria from the specification case data stored in the specification case database;
Definition information case data merging means for merging definition information case data groups extracted by the definition information case data extraction means from one or more specification case data in the specification case database for each type of definition information;
Definition information case data display means for displaying a list of the merged definition information case data groups by type;
Definition information case data adding means for arranging the definition information case data designated from the list-displayed definition information case data group at a predetermined position in the specification document to be designed;
A security design support apparatus that supports the creation of a specification based on a criterion by individually reusing arbitrary definition information description examples used in a group of existing specifications based on a predetermined criterion. In a security design support device that supports the creation of specifications based on predetermined criteria,
A specification case database storing an existing specification case group in which one or more types of definition information are described based on the criteria,
Definition information case data extraction means for extracting definition information case data described based on the criteria from the specification case data stored in the specification case database;
Definition information case data merging means for merging definition information case data groups extracted by the definition information case data extraction means from one or more specification case data in the specification case database for each type of definition information;
Definition information case database creation means for creating a definition information case database for each definition information type from the merged definition information case data group;
Definition information case data display means for reading definition information case data from the definition information case database and displaying a list by type;
Definition information case data adding means for arranging the definition information case data designated from the list-displayed definition information case data group at a predetermined position in the specification document to be designed;
A security design support apparatus that supports the creation of a specification based on a criterion by individually reusing any definition information description example used in a group of existing specifications based on a predetermined criterion. In a security design support device that supports the creation of security specifications based on international security evaluation standards,
A specification case database that stores case groups of existing security specifications in which each definition information of threats, assumptions, organizational security policies, security objectives, security requirements, and realization methods is described based on the above criteria;
Definition information case data extraction means for extracting case data of each definition information from security specification case data stored in the specification case database;
Definition information case data merging means for merging definition information case data extracted by the definition information case data extraction means from one or more security specification case data in the specification case database for each of the definition information;
Definition information case data display means for displaying a list of the merged definition information case data groups by type;
Definition information case data adding means for arranging definition information case data designated from the list of definition information case data groups displayed in a predetermined position of a security specification to be designed based on the criterion,
A security design support apparatus that supports the creation of a security specification based on international security evaluation standards by individually reusing definition information description examples used in existing security specification cases based on international security evaluation standards. In a security design support device that supports the creation of security specifications based on international security evaluation standards,
A specification case database that stores case groups of existing security specifications in which each definition information of threats, assumptions, organizational security policies, security objectives, security requirements, and realization methods is described based on the above criteria;
Definition information case data extraction means for extracting case data of each definition information from security specification case data stored in the specification case database;
Definition information case data merging means for merging definition information case data extracted by the definition information case data extraction means from one or more security specification case data in the specification case database for each of the definition information;
Definition information case database creating means for creating a definition information case database for each definition information from the merged definition information case data group;
Definition information case data display means for displaying a list of definition information case data by reading type from the definition information case database;
Definition information case data adding means for arranging definition information case data designated from the list of definition information case data groups displayed in a predetermined position of a security specification to be designed based on the criterion,
A security design support apparatus that supports the creation of a security specification based on international security evaluation standards by individually reusing definition information description examples used in existing security specification cases based on international security evaluation standards. The security design support device according to claim 4,
Hierarchical structure of the definition information case database created by the definition information case database creation means, based on the inheritance relationship between the characteristic information types of information-related products or information systems targeted by the existing security specification case groups Definition information case database,
A definition information case data search means for searching for the corresponding definition information case data from the hierarchically structured definition information case database based on the designated feature information;
A security design support device that supports creation of a security specification in consideration of the uniqueness of a target by finding an example of definition information description suitable for creating a security specification of the target from the characteristic information unique to the target. In the security design support device according to claim 3 or 4,
Based on the above criteria, the definition information of threats, assumptions, organizational security policies, security objectives, security requirements, and realization methods, threats and security objectives, assumptions and security objectives, organizational security policies and security objectives A specification case database that stores case groups of existing security specifications that describe policies, security objectives and security requirements, and information on the correspondence between each definition information of security requirements and implementation methods;
Definition information case data extraction means for extracting case data of each of the definition information and case data of each of the correspondence relationships from security specification case data stored in the specification case database;
The definition information case data extracted by the definition information case data extracting means from one or more security specification case data in the specification case database is merged for each of the definition information, and the corresponding relationship case data also extracted is merged. Means for merging definition information example data with a correspondence relationship for each of the correspondence relationships;
A correspondence definition that derives the corresponding security objectives, security requirements, and realization methods in order from the specified threats, prerequisites, and organizational security policies by referring to the correspondence example data corresponding to the specified definition information. Information deriving means,
A set of definition information example data for threats, security objectives, security requirements, and realization methods derived by the correspondence definition information deriving means, or a set of definition information example data for preconditions, security objectives, security requirements, and realization methods, or A set of definition information example data for organizational security policies, security objectives, security requirements, and realization methods is placed together in each predetermined table of contents of the security specification, or is excluded from each predetermined table of contents. It has a means for adding and deleting relationship definition information all at once.
A security design support device that assists in editing security specifications by adding or deleting information while constantly maintaining the correspondence between definition information in the editing of security specifications to be designed. The security design support device according to claim 4,
Threats, preconditions, and organizational security policies in the definition information case database based on the attribute information class for each attribute information defined in a hierarchical structure based on the inclusive relation of the meaning of the term representing the attribute information that identifies the threat A hierarchically structured security environment case database in which case data of
Definition information that searches the hierarchically structured security environment case database for each case data of applicable threats, prerequisites, or organizational security policies based on the specified attacker, assets to be protected, or attacks to be dealt with With case data search means,
Support creation of security specifications in consideration of the assumed usage environment by searching for and using definition information description examples that match the attackers, assets to be protected, or attacks to be addressed during security design A security design support device characterized by the following. The security design support device according to claim 7,
A design object definition information extracting means for extracting various definition information from the security specification document to be designed;
A design object definition information list display means for displaying a list of the definition information extracted by the design object definition information extraction means by type;
The design object that belongs to the attribute information class that is the same as or a hierarchical relationship with the threat information, prerequisites, or attribute information class of the organization's security policy specified from the definition information of the design object listed by the design object definition information list display means Related security environment search means to search for threats, assumptions, and organizational security policies described in the security specifications of
Related security environment display means for displaying a list of threats, assumptions, and organizational security policies of the search results by the related security environment search means,
By searching for and extracting case data of security environment definition information in which the specified threats, preconditions, or security environment definition information of the organization's security policy and attribute information match or have an inclusive relationship, the data is already described in the security specification. Correction of duplication or inconsistency between definition information of each security environment, or duplication or inconsistency when correcting duplication or inconsistency between security environment definition information newly added to the security specification and each definition information already described A security design support device that discovers related case data that may have a possibility of creating a security specification without duplication or inconsistency. The security design support device according to claim 7,
An attribute information term case database in which term instances of each attribute information of an attacker, a protected asset, and an attack method are hierarchically structured based on the attribute information class;
Term conversion means for batch-converting one or more types of term instances belonging to the same attribute information class described in the security specification document to be designed by the designated term instances belonging to the attribute information class,
A security design support device that converts multiple types of terms collectively by simply specifying one term and supports the work of unifying terms in security specifications.

Images