JP5269722B2 - Security design support apparatus and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To confirm a security target related to a security countermeasure policy obtained from a threat analysis, and support the threat analysis, and also a design of the security countermeasure policy and a security function requirement obtained from a request specification of a system. <P>SOLUTION: A security design support device 100 includes a goal model DB 101 storing goal model information including a counter measure policy kind, a security countermeasure policy identifier, a plurality of security countermeasure policies (O), and one or more security function requirement identifiers in each security target, rewrites a security countermeasure policy (UO) inside a threat analysis results by the security countermeasure policy (O) extracted from the goal model information read based on the security target, and integrates both sides to compose the read goal model information and the threat analysis results. <P>COPYRIGHT: (C)2011,JPO&amp;INPIT

Description

  The present invention relates to a security design support apparatus and program for supporting the design of security scenario data in an information system or IT (Information Technology) product (hereinafter also referred to as an information system) to be developed.

  In the security design of information systems and the like, it is necessary to formulate security function requirements that the information system and the like should have in the upstream process and design security scenario data.

  First, threat analysis is performed using a list of possible threats and countermeasures. A security objective policy is determined based on the threat analysis result, and security functional requirements are formulated from the security objective policy. Subsequently, the security scenario data is designed by organizing the threat analysis results, the security countermeasure policies, the identifiers in the security functional requirements, the definitions, the correspondences, and the like.

  The designed security scenario data is used to create a security target ST (security target) that is a security design document and a security requirement definition document.

  The security target ST is a document that serves as a basic security specification for information systems, etc., and is used for evaluation and certification of international standards for security (ISO / IEC15408: International Organization for Standardization / International Electrotechnical Commission 15408) that guarantee security functions. It is done. The security requirement definition document is a document that summarizes security-related requirements in the requirement definition document created in the upstream process of security design.

JP 2008-287496 A

  However, according to the study of the present inventor, the above security design technique has room for improvement in the following points.

  In other words, the conventional security design method is difficult to understand the relationship between the security objectives obtained from threat analysis and the security objectives that should be satisfied by the information system. It is thought that there is room for improvement in that the drop is likely to be insufficient.

  The present invention has been made in consideration of the above circumstances, can confirm the security objectives related to the security objectives obtained from the threat analysis, and can design the security objectives and security functional requirements obtained from the system requirement specifications. It is an object of the present invention to provide a security design support apparatus and program that can be supported.

  One aspect of the present invention includes “related party list data including a related party definition for each related party identifier corresponding to a related party type” and “a protected asset definition for each protected asset identifier corresponding to a protected asset type”. Protected asset list data ”,“ Threat-counter correspondence table data including threat definition, security countermeasure policy identifier and security countermeasure policy sufficiency document information for each threat identifier corresponding to threat type ”, and“ Countermeasure policy ” For each security objective policy identifier corresponding to the type, the security objective policy (O, UO), the related security function requirement identifier and countermeasure-function correspondence table data including security function requirement sufficiency document information ", and Premise-operation countermeasure correspondence table data including precondition definition, related operation countermeasure policy identifier and operation countermeasure policy for each corresponding precondition identifier And the security scenario data including “Organizational countermeasure policy, organizational countermeasure policy including related security countermeasure policy identifier and security countermeasure policy-countermeasure policy correspondence table data for each organizational countermeasure policy identifier corresponding to the organizational countermeasure policy type”. A security design support apparatus for supporting a design, wherein “for each security objective policy identifier, a countermeasure-function correspondence table including a security objective policy (O), a related security functional requirement identifier, and security functional requirement sufficiency document information Sufficient document template storage means storing “data”, “for each security target as a goal, a countermeasure policy type, a security countermeasure policy identifier, a plurality of security countermeasure policies (O) as a soft goal, and each security countermeasure policy One or more requests as related to (O) Goal model information including a security function requirement identifier ", and the security function requirement identifier in the goal model information matches one of the security function requirement identifiers in the sufficiency document template storage means. Model information storage means, “related party information including related party type, related party identifier and related party definition”, “protected asset information including protected asset type, protected asset identifier and protected asset definition”, “threat type, Misuse case information including threat identifier, threat definition, and party identifier related to the threat identifier ”, and“ precondition type, precondition identifier, precondition definition, and protected asset identifier related to the precondition identifier ” Prerequisite information ”,“ Countermeasure policy type, security policy identifier, security policy (UO), and security policy Security objective policy information including threat identifiers related to security objective policy identifiers "and" reason information including rationale type, rationale identifier, security objectives policy sufficiency document information, and security objectives policy identifiers related to the rationale identifiers "and , “Operation countermeasure policy information including operation countermeasure policy type, operation countermeasure policy identifier, operation countermeasure policy, and precondition identifier related to the operation countermeasure policy identifier” and “Organization countermeasure policy type, organization countermeasure policy identifier, organization countermeasure” A threat analysis result input receiving means for receiving an input of a threat analysis result including a policy and an organizational countermeasure policy information including an operation countermeasure policy identifier related to the organizational countermeasure policy identifier, and a threat analysis result of receiving the input Based on the related party information, “the related party identifier including the related party type and related party definition "Table data" based on the related party list data creation means and the protected asset information in the threat analysis result that received the input, "protection including the protected asset identifier and protected asset definition corresponding to the protected asset type" Based on the protected asset list data creation means for creating the “asset list data” and the misuse case information, the security objectives policy information and the rationale information in the threat analysis result that has received the input, “for each threat identifier, Threat-countermeasure correspondence table data creating means for creating "threat-countermeasure correspondence table data including threat definition, related security objective policy identifier and security countermeasure policy sufficiency document information", and each security target in the goal model information storage means Security target selection accepting means for accepting selection of one of the security objectives, and the selection Based on the received security goal, goal model information reading means for reading the goal model information in the goal model information storage means, each security countermeasure policy (O) in the read goal model information, and the input The countermeasure policy comparison means for comparing the security countermeasure policy (UO) in the received threat analysis result, and the security countermeasure policy (O) including the security countermeasure policy (UO) in the threat analysis result as a result of the comparison An extraction means for extracting from the goal model information, and rewriting the security objective policy (UO) in the threat analysis result with the extracted security objective policy (O) to integrate the two, thereby reading the read goal Generate goal model-threat analysis synthesis information by combining model information and threat analysis results Based on the security countermeasure policy (O) included in the goal model information among the security objective policies (O, UO) in the generated goal model-threat analysis composite information, the sufficiency The security function requirement sufficiency document information is read from the document model storage means, and the security function requirement sufficiency document information is received in association with a security objective (UO) not included in the goal model information. Measures for creating “security countermeasure policy (UO), related security function requirement identifier and security function requirement sufficiency document information—function correspondence table data” for each security countermeasure policy identifier; , The goal model-threat analysis synthesis information, the created relationship Security scenario data creation for creating the security scenario data based on the list data, the created protected asset list data, the created threat-countermeasure correspondence table data and the created countermeasure-function correspondence table data And a security design support apparatus.

  Although one aspect of the present invention is expressed as an apparatus, the present invention is not limited thereto, and can be expressed as a method, a program, a computer-readable storage medium storing the program, and the like.

(Function)
In one aspect of the present invention, a goal model storing goal model information including a countermeasure policy type, a security countermeasure policy identifier, a plurality of security countermeasure policies (O), and one or more security function requirement identifiers for each security goal. An information storage means is provided, and each security objective policy (O) in the goal model information read based on the security objective is compared with the security objective policy (UO) in the threat analysis result, and extracted from the goal model information The read goal model information and the threat analysis result are synthesized by rewriting the security countermeasure policy (UO) in the threat analysis result with the read security countermeasure policy (O) and integrating the two.

  At this time, the security objective (UO) in the threat analysis result is related to the security objective in the goal model information via the integrated security objective (O). For this reason, the security objective related to the security objective (UO) obtained from the threat analysis can be confirmed.

  In addition, other security objectives and security functional requirement identifiers that were not used for integration in the goal model information were obtained not only from the threat analysis results but also from the goal-oriented analysis results of the system requirement specifications. It is related to the threat analysis result through the security objectives used for the goal and integration. For this reason, it is possible to support not only threat analysis but also design of security objectives and security functional requirements obtained from system requirement specifications.

  As described above, according to the present invention, the security objectives related to the security objectives obtained from the threat analysis can be confirmed, and not only the threat analysis but also the security objectives and security functional requirements obtained from the system requirement specifications. Can also support the design of

It is a mimetic diagram for explaining the outline of the present invention. It is a schematic diagram which shows the structure of the security design assistance apparatus which concerns on the 1st Embodiment of this invention. It is a schematic diagram for demonstrating the goal model in the embodiment. It is a schematic diagram which shows an example of the goal model in the embodiment. It is a schematic diagram which shows an example of the goal model information in the embodiment. It is a schematic diagram which shows an example of the related person list data in the embodiment. It is a schematic diagram which shows an example of the protected asset list data in the embodiment. It is a schematic diagram which shows an example of the threat-countermeasure correspondence table data in the same embodiment. It is a schematic diagram which shows an example of the countermeasure-function correspondence table data in the embodiment. It is a schematic diagram which shows an example of the security scenario in the embodiment. It is a schematic diagram which shows an example of the miss use case figure in the same embodiment. It is a schematic diagram which shows an example of the miss use case figure in the same embodiment. It is a schematic diagram which shows an example of the threat analysis result in the same embodiment. It is a flowchart for demonstrating the whole operation | movement in the embodiment. It is a flowchart for demonstrating the synthetic | combination operation | movement in the embodiment. It is a schematic diagram for demonstrating the operation | movement which prompts the input in the same embodiment. It is a schematic diagram for demonstrating the verification operation | movement in the embodiment. It is a schematic diagram for demonstrating the production | generation operation | movement of the security requirement definition document in the embodiment. It is a schematic diagram for demonstrating the production | generation operation | movement of the security target in the embodiment. It is a schematic diagram which shows the structure of the security design assistance apparatus which concerns on the 2nd Embodiment of this invention. It is a schematic diagram which shows the structure of the security design assistance apparatus which concerns on the 3rd Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings, but before that, an outline of the present invention will be described. As shown in FIG. 1, the outline of the present invention redefines three stages of security objectives (goals), security objectives (soft goals), and security requirements (requests) for the input range of threat analysis by the user. By supplementary application of the goal model, the security objectives (CIAA +) related to the security objectives (UO） O) obtained from the threat analysis can be confirmed and obtained not only from the results of the threat analysis but also from the system requirement specifications. It can also support the design of security objectives (O) and security requirements.

  The security design support apparatus having such an outline can be implemented with either a hardware configuration or a combination configuration of hardware resources and software. As the software of the combined configuration, a program that is installed in advance on a security design support apparatus (computer) from a network or a storage medium and causes the security design support apparatus to realize each function is used.

(First embodiment)
FIG. 2 is a schematic diagram showing the configuration of the security design support apparatus according to the first embodiment of the present invention. The security design support apparatus 100 includes a goal model DB (Database) 101, a sufficiency document template DB 102, an ST template DB 103, a storage unit 104, a scenario data storage unit 105, a security data storage unit 106, an input / output unit 107, and use case processing. Unit 108, goal-oriented analysis processing unit 109, and processing engine 110.

  The goal model DB 101 is generally a database of goal models from security goals in goal-oriented analysis to security requirements based on countermeasure policies and security function requirements of ISO / IEC15408 Part2.

  Goal-oriented analysis is a technique for analyzing various goals to be achieved by an information system to be developed from various levels of abstraction. As shown in FIG. Goals), soft goals that satisfy the goals (measure policies), requirements (requirements) to achieve the goals, expectations (prerequisites), domain properties (OSP: organizational security policy), etc. To do.

  If this method is used, for example, why the specification or countermeasure policy for the security of the system “to perform access control” is necessary is indicated by the goal that is the security goal by the Why analysis, and how it is realized. There is an effect that it can be extracted as a requirement by the How analysis.

  The goal model of the KAOS method, which is one of goal-oriented requirement analysis methods, defines three stages: goal, soft goal, and requirement. In this embodiment, the goal is a security goal and the soft goal is a security objective policy. , The request is a security requirement, the expectation is a prerequisite, and the domain property is redefined as an organizational security objective (OSP).

  Security objectives are, for example, security characteristics of GMITS (Guidelines for the Management of IT Security) such as Confidentiality, Integrity, Availability, Accountability, etc. (CIAA +). Security objectives may be divided into data and services. Security objectives and security requirements are classified according to ISO / IEC15408 Part2 Security Functional Requirements (SFR), security objectives are classified by class and family elements, and security requirements are classified by component elements. . Define the connection between the determined security objectives, countermeasure policies, and requirements according to the goal model format.

  The goal model information representing the goal model is formulated in advance and written in the goal model DB 101. FIG. 4 shows an example of a part of the goal model regarding “data confidentiality”. In this example, with respect to the goal of “data confidentiality is met” (security goal), “only users who have succeeded in identification and authentication are allowed to operate (identifier: O. identification and authentication)” and “operation The log of history is acquired and stored as an audit trail (identifier: O. Audit trail) ”, which has two soft goals (Countermeasure (O)), and security function components (FIA_UID.2, FIA_UAU.2, FIA_AFL.1, FIA_SOS.1, and FAU_GEN.1, FAU.SAR.1, FAU.STG.1) are modeled as requirements (security requirements).

  Specifically, the goal model DB 101 having such an outline is a storage unit readable / writable by the processing engine 110. As shown in FIG. 5, “for each security goal (not shown) as a goal”. , Countermeasure policy type, security countermeasure policy identifier, multiple security objective policies (O) as software goals (definitions related to the countermeasure policy type), and one of the requests related to each security objective policy (O) “Goal model information including the above security functional requirement identifier (related identifier related to the security objective policy identifier)” is stored. Here, the security function requirement identifier in the goal model information matches one of the security function requirement identifiers in the sufficiency document template DB 102. That is, the security function requirement sufficiency document information in the sufficiency document template DB 102 can be searched based on the security function requirement identifier included in the goal model information. The goal model information shown in FIG. 5 is illustrated in addition to the above-described “measure policy type, security measure policy identifier, security measure policy (O) and security function requirement identifier related to security measure policy (O)”. For each security objective not to be executed, “function-measure identifier-related information consisting of function type, security function requirement identifier and security countermeasure policy identifier related to the security function requirement identifier”, “reason type, rational identifier, rational definition and relevant rationale The basis of the security function requirement identifier related to the identifier—function related information ”is included. However, these function-measure identifier-related information and ground-function-related information are arbitrary additional items and can be omitted from the goal model information.

  Supplementally, in the goal model diagram shown in FIG. 4, based on the goal model information shown in FIG. 5, the type, definition, and related identifier can be displayed for each in-type identifier in FIG. Specifically, for example, when the in-type identifier in the goal model diagram is clicked, the goal-oriented analysis processing unit 109 performs goal model information in the goal model DB 101 by the processing engine 110 based on the clicked in-type identifier. And the type, definition, and related identifier obtained by the search are displayed on the window screen. This supplement is the same as in the goal model diagram shown in FIG.

  The sufficiency document template DB 102 is a storage unit that can be read / written by the processing engine 110. For each security countermeasure policy identifier, a security countermeasure policy (O), a related security function requirement identifier, and a security function requirement sufficiency document "Countermeasure-function correspondence table data including information" is stored.

  Note that the sufficiency document information is document information of a location representing the “reason” of the security target ST, and may be read as evidence document information.

  The ST model DB 103 is a storage unit that can be read / written by the processing engine 110, and stores model data of the security target ST.

  The storage unit 104 can be read / written by the processing engine 110, and data in the middle of processing by the processing engine 110 is temporarily written therein.

  The scenario data storage unit 105 is readable / writable by the processing engine 110, and as shown in FIGS. 6 to 9, “a participant list including a participant definition for each participant identifier corresponding to a participant type”. Data ”,“ Protected asset list data including protected asset definition for each protected asset identifier corresponding to the protected asset type ”,“ Threat definition for each threat identifier corresponding to the threat type, related security objectives policy identifier and Threat countermeasure countermeasure table data including security countermeasure policy sufficiency document information "and" Security countermeasure policy (O, UO), related security function requirement identifier and security function for each security countermeasure policy identifier corresponding to the countermeasure policy type " Measures including requirement sufficiency document information-function correspondence table data "and" preconditions for each precondition identifier corresponding to the precondition type " , Premise including operation countermeasure policy identifier and related operation countermeasure policy-operation countermeasure correspondence table data "and" organization countermeasure policy, associated security countermeasure policy identifier and It is used for storing security scenario data including “an organization countermeasure policy including a security countermeasure policy—a countermeasure policy correspondence table data”.

  Supplementally, the security scenario data is the data that is the basis of the security scenario and security design document. (1) Related parties and protected assets specific to the information system to be developed, (2) Threats (security issues) and security objectives (3) Data obtained by organizing information such as security objectives and security requirements with respect to type, identifier, definition, correspondence, and grounds for sufficiency. Although the related party list data shown in FIG. 6 includes a related party type, the related party type is an arbitrary additional item and may be omitted from the related party list data. Similarly, the protected asset list data shown in FIG. 7 includes a protected asset type, but the protected asset type is an arbitrary additional item and may be omitted from the protected asset list data.

  The security data storage unit 106 is readable / writable by the processing engine 110 and is used for storing a security scenario and a security design document created by the processing engine 110.

  As shown in FIG. 10, the security scenario is to enable tracing of the security issues (threats, preconditions, OSP (Organizational Security Policy)), security objectives, and security requirements shown in ISO / IEC15408 Part1. It is illustrated.

  The security design document is a product of a security design product, and is, for example, a security requirement definition document or a security target ST.

  The input / output unit 107 includes, for example, an input device such as a keyboard and a mouse and a display device such as a liquid crystal display, and functions as an input / output interface between the security design support device 100 and the user.

  The use case processing unit 108 is generally a processing unit that accepts an input of an asset (protected asset) -based mistake (ab) use case. As shown in FIG. In addition, a mistake (ab) use case diagram and description information (not shown) relating to protected asset data to be protected are input.

  Miss (ab) use case diagrams and description information are the misactors that cause threats to use cases, the misuse cases that become threats, and the misuse cases against the protected assets of the development target system and normal use case diagrams and description information. It is a misuse case diagram and description information to which a security objective policy for preventing the problem is added. Although not shown, since there are actually various threats, a plurality of misactors, misuse cases, and security countermeasure policies are described. Further, the miss use case shown in the present embodiment includes an abuse case.

  Specifically, the use case processing unit 108 having such an outline, for example, as shown in FIG. 13 corresponding to the miss use case diagram shown in FIG. 12, “the related party type, the related party identifier and the related party definition. Including stakeholder information ”,“ Protected asset information including protected asset type, protected asset identifier and protected asset definition ”, and“ Description of related party identifier related to threat type, threat identifier, threat definition, and threat identifier ” Misuse Case Information ”,“ Precondition Information including Prerequisite Type, Precondition Identifier, Precondition Definition, and Protected Asset Identifier Related to Precondition Identifier ”,“ Countermeasure Policy Type, Security Countermeasure Identifier, Security Countermeasure Policy ” (UO: Use case Objectives) and the security objective policy information including the threat identifier related to the security objective policy identifier, Rationale identifier, security objectives sufficiency document information, and rationale information including security objectives policy identifier related to the rationale identifier "and" operational objective policy type, operational objectives policy identifier, operational objectives policy, and relevant operational objectives policy identifier `` Operational countermeasure policy information including precondition identifier related to `` and `` Organizational countermeasure policy information including organizational countermeasure policy type, organizational countermeasure policy identifier, organizational countermeasure policy, and operational countermeasure policy identifier related to the organizational countermeasure policy identifier '' It has a function to accept input of threat analysis results including

  Supplementally, in the misuse case diagram shown in FIG. 12, the type, definition, and related identifier as shown in FIG. 13 can be input for each in-type identifier in the diagram. Specifically, for example, the use case processing unit 108 displays an input screen based on the input screen data by using a structure in which the misuse case diagram has input screen data that can be click-called for each identifier within the type, and the input screen It is only necessary to accept the input of the type, definition, and related identifier described in.

  The goal-oriented analysis processing unit 109 is a processing unit that receives an input of a system-specific request part by goal-oriented analysis, and any one of the security objectives in the goal model DB 101 by the operation of the input / output unit 107 by the user. It has a security goal selection acceptance function that accepts selection of security goals.

  The processing engine 110 generally includes “threat-security countermeasure policy” and “security countermeasure policy-security” based on input data from each processing unit and information in the goal model DB 101 and the sufficiency document template DB 102. The correspondence relationship of “requirements” is shown, and the security target ST and the security requirement definition document are retrieved from the text template database (sufficiency document template DB 102) of the rationale regarding the sufficiency of “threat-security objective policy” and “security objective policy-security requirement” The security scenario data that is the basis, and a security scenario and a security design document in which this security scenario data is schematized are generated.

  Specifically, the processing engine 110 having such an outline has the following functions (f110-1) to (f110-11).

  (f110-1) “For each security objective policy identifier,“ security countermeasure policy (O), corresponding security function requirement identifier and countermeasure-function correspondence table data including security function requirement sufficiency document information ”” in the sufficiency document template DB 102 Ability to write.

  (f110-2) “For each security objective as a goal, a security objective identifier, a plurality of security objectives (O) as soft goals, and one of the requirements related to each security objective (O) A function of writing “goal model information including the above security function requirement identifier” into the goal model DB 101. However, the security function requirement identifier in the goal model information matches one of the security function requirement identifiers in the sufficiency document template DB 102.

  (f110-3) “Related party list data including related party identifier and related party definition corresponding to related party type” based on the related party information in the threat analysis result received by the use case processing unit 108 A function to create a related party list data.

  (f110-4) “Protected asset list data including protected asset identifier and protected asset definition corresponding to protected asset type” based on the protected asset information in the threat analysis result received by the use case processing unit 108 Protected asset list data creation function.

  (f110-5) Based on the misuse case information, security countermeasure policy information, and rationale information in the threat analysis result received by the use case processing unit 108, “for each threat identifier, threat definition and related security measures” Threat-countermeasure correspondence table data creation function for creating a “threat-countermeasure correspondence table data including policy identifier and security countermeasure policy sufficiency document information”.

  (f110-6) A goal model information reading function for reading the goal model information in the goal model DB 101 based on the security goal accepted by the goal-oriented analysis processing unit 109.

  (f110-7) A countermeasure policy comparison function that compares each security objective policy (O) in the read goal model information with the security objective policy (UO) in the threat analysis result that has received the input.

  (f110-8) An extraction function for extracting the security objective policy (O) including the security objective policy (UO) in the threat analysis result as a result of the comparison from the goal model information.

  (f110-9) By rewriting the security objectives (UO) in the threat analysis results with the extracted security objectives (O) and integrating them, the read goal model information and the threat analysis results A composite information generation function for generating combined goal model-threat analysis composite information.

  (f110-10) From the sufficiency document template DB 102 based on the security objective policy (O) included in the goal model information of the security objective policies (O, UO) in the generated goal model-threat analysis synthesis information By reading the security functional requirement sufficiency document information and accepting the input of the security functional requirement sufficiency document information in association with the security objective policy (UO) not included in the goal model information, a new “security objective policy identifier” Measure-function correspondence table data creation function for creating a "security-function correspondence table data including security function policy identifier (UO), related security function requirement identifier and security function requirement sufficiency document information".

  (f110-11) Based on goal model-threat analysis synthesis information, created party list data, created protected asset list data, created threat-countermeasure data and created countermeasure-function-corresponding data Security scenario data creation function to create security scenario data.

  Here, the security scenario data creation function includes the following functions (f110-11-1) to (f110-11-3).

  (f110-11-1) Based on the goal model-threat analysis synthesis information, `` For each precondition identifier corresponding to the precondition type, a premise-operation that includes a precondition definition, a related operational countermeasure policy identifier, and an operational countermeasure policy Preconditions for Creating Countermeasure Correspondence Table Data—Operation Countermeasure Correspondence Table Data Creation Function.

  (f110-11-2) Based on the Goal Model-Threat Analysis Synthesis Information, `` Organization countermeasure policy, organization information including security countermeasure policy identifier and security countermeasure policy for each organizational countermeasure policy identifier corresponding to the organizational countermeasure policy type '' Organizational policy to create "Countermeasure policy-Countermeasure policy correspondence table data"-Countermeasure policy correspondence table data creation function.

  (f110-11-3) Created Premise-Operational Measures Correspondence Table Data, Created Organizational Measures Policy-Measures Policy Correspondence Table Data, Created Related Person List Data, Created Protected Asset List Data, Created A function to create security scenario data including created threat-countermeasure correspondence table data and created countermeasure-function correspondence table data.

  Supplementally, the identifier of each element (identifier within type) is displayed in the use case diagram and goal model diagram. In addition, the user can also input element definitions from the use case processing unit 108 and the goal-oriented analysis processing unit 109 which are input tools as attached information. The use case processing unit 108 can input protected asset information, actors (related parties), threats, preconditions, countermeasure policies, and grounds from the use case diagram. However, the goal-oriented analysis processing unit 109 may input the precondition, the OSP, and the operation countermeasure policy from the goal model diagram. The processing engine 110 generates a list using the identifiers and definitions input in these use case diagrams or goal model diagrams. Only the sufficiency document information may be input by the user as ancillary information of the figure, or may be added by searching and referring to the sufficiency document template DB 102 based on past ST data or a fixed form document. The processing engine 110 executes search, reference, and creation of a list of identifiers shown in the use case diagram passed from the use case processing unit 108, definition and attributes of the identifiers, adjunct information such as sufficiency document information.

  The processing engine 110 generates related party list data, protected asset list data, and threat-countermeasure correspondence table data based on the input information of the miss use case. The countermeasure-function correspondence table data includes a security countermeasure policy synthesized from the security countermeasure policy (O) selected from the goal model DB 101 and the security countermeasure policy (UO) of the use case, and security corresponding to each security countermeasure policy. The processing engine 110 uses the function (SFR) identifier and the sufficiency document stored in the sufficiency document template DB 102 for each SFR. When the security function is not included in the goal model information in the goal model DB 101, the user can input a new security function, and the processing engine 110 provides information such as an identifier, a definition, and a basis for countermeasures regarding the newly input security function. It adds to goal model DB101 and sufficiency document template DB102.

  Further, although not shown, preconditions—operation countermeasure correspondence data, OSP—obtained from goal model-threat analysis synthesis information obtained by synthesizing the threat analysis result shown in FIG. 13 and the goal model information shown in FIG. Premise-operation countermeasure correspondence table data and organization countermeasure policy-measure policy correspondence table data are created by the processing engine 110 from the countermeasure correspondence data.

  Next, the operation of the security design support apparatus configured as described above will be described with reference to the flowchart of FIG.

[Use case input: w10]
In the security design support device, the use case processing unit 108 applies the UML (Unified Modeling Language) and diagrammatically by a user operation of the input / output unit 107 (hereinafter also referred to as user operation). Create a use case diagram and description information, and analyze the business. In addition, the use case processing unit 108 describes and evaluates protected asset information in accordance with user operations.

  As a result, use case diagrams and description information include related party information including related party types, related party identifiers and related party definitions, protected asset information including protected asset types, protected asset identifiers and protected asset definitions, And use case information including a description of a business including a protected asset identifier.

  The use case processing unit 108 adds a misactor and a miss use case to such a use case diagram and description information by a user operation, and describes misuse case information including a threat identifier for the use case.

  The use case processing unit 108 deletes miss use case information including threat identifiers that do not require countermeasures such as threats that cannot occur and preconditions from the misuse case information including the described threat identifiers by the user's operation. Select misuse case information including the necessary threat identifiers.

  The use case processing unit 108 describes the security objective policy (UO) and the security objective policy sufficiency document information in association with the miss use case information including the selected threat identifier by the user's operation, and also describes the described security objective policy ( Evaluate UO) and security objectives policy sufficiency document information. Further, the use case processing unit 108 describes the precondition information in association with the protected asset identifier by the operation of the user. Further, the use case processing unit 108 describes the basis information, the operation countermeasure policy information, and the organization countermeasure policy information by the operation of the user.

  The use case processing unit 108 operates by the user to describe / select the misuse case information from the description / evaluation of the protected asset information described above, and describe the security countermeasure policy (UO) and the security countermeasure policy sufficiency document information (UO).・ Repeat descriptions of evaluation, precondition information, rationale information, operational countermeasure policy information, and organizational countermeasure policy information.

  After that, the use case processing unit 108, by the user's operation, misuse use case information including premise information (actor, misactor), protected asset information, threat identifier (T: Threat) description, precondition information, Security countermeasure policy information including security countermeasure policy (UO) and security countermeasure policy sufficiency document information, rationale information, operational countermeasure policy information, organizational countermeasure policy information, etc. are determined, and a threat analysis result including these information is obtained.

  As described above, in the security design support apparatus 100, the use case processing unit 108 inputs the threat analysis result to the processing engine 110 by a user operation. When receiving the threat analysis result input, the processing engine 110 writes the threat analysis result in the storage unit 104 as shown in FIG.

[Scenario data generation: w20]
The processing engine 110 creates part of the security scenario data from the related party information, the protected asset information, the misuse case information, and the security countermeasure policy information included in the threat analysis result in the storage unit 104.

  Specifically, as shown in FIG. 6, the processing engine 110 selects “a party identifier and a party definition corresponding to a party type” based on the party information in the threat analysis result in the storage unit 104. Concerned party list data "is created.

  Further, as shown in FIG. 7, the processing engine 110 selects “a protected asset including a protected asset identifier and a protected asset definition corresponding to the protected asset type” based on the protected asset information in the threat analysis result in the storage unit 104. "Summary data" is created.

  Further, as shown in FIG. 8, the processing engine 110, based on the misuse case information, the security countermeasure policy information, and the basis information in the threat analysis result in the storage unit 104, “for each threat identifier, threat definition, “Threat-Countermeasure Correspondence Table Data Containing Related Security Objectives Identifier and Security Objectives Sufficiency Document Information”.

[Select security target: w30]
In the security design support apparatus, the goal-oriented analysis processing unit 109 sends each security target in the goal model DB 101 to the input / output unit 107 by the operation of the input / output unit 107 by the user.

  The input / output unit 107 displays and outputs each security target, selects any one of the security targets by a user's operation, and sends the selection result to the goal-oriented analysis processing unit 109.

  The goal-oriented analysis processing unit 109 receives the selection of the security target and sends the selection result to the processing engine 110.

[Synthesis of threat analysis result and goal model: w40]
The processing engine 110 reads out the security countermeasure policy (UO) and the precondition (A) from the threat analysis result in the storage unit 104 as shown in FIG. 15 by the user's operation (w41).

  Further, the processing engine 110 extracts an organizational security countermeasure policy (OSP) from the threat analysis result by a user operation.

  The processing engine 110 outputs the read precondition (A) and the organization's security countermeasure policy (OSP) to the input / output unit 107 to prompt the user to evaluate, and by the operation of the input / output unit 107 by the user, The countermeasure policy (OE) of the operational environment is appropriately corrected and determined (w42). Thereby, the countermeasure policy (OE) of the operational environment in the threat analysis result is determined.

  In addition, the processing engine 110 reads the goal model information in the goal model DB 101 based on the security goal accepted, and “communication is performed safely” from the security countermeasure policy (O) in the goal model information. And other keywords are extracted. The “keyword” here is a representative example of “part of the security objectives” and is not limited to a part of a word (keyword), but a part of a phrase (key phrase; two or more words are used to compose a sentence). Or a part of a clause (key close; part of a sentence having a subject and a predicate). Further, the processing engine 110 extracts a keyword such as “encrypt file” from the security countermeasure policy (UO) of the threat analysis result read in step w41 (w43), and compares the keywords.

  Here, since it is only necessary to compare each security objective policy (O) in the goal model information with the security objective policy (UO) in the threat analysis result, it is not always necessary to compare them by keyword extraction. For example, the entire security objectives may be compared.

  As a result of the comparison, if the keyword of the security objective policy (UO) in the threat analysis result is in the relationship (UO⊆O) included in the keyword of the security objective policy (O) in the goal model information, the processing engine 110 ( w44; YES), the security objective policy (O) including the security objective policy (UO) in the threat analysis result is extracted from the goal model information.

  Thereafter, the processing engine 110 synthesizes the goal model information and the threat analysis result by rewriting the security countermeasure policy (UO) in the threat analysis result with the extracted security countermeasure policy (O) and integrating the two. (W45). Steps w43 to w45 are repeatedly executed.

  After repeatedly executing Steps w43 to w45, goal model-threat analysis synthesis information obtained by synthesizing the goal model information and the threat analysis result is generated. The processing engine 110 reads the security function requirement sufficiency document information from the sufficiency document template DB 102 based on the security countermeasure policy (O) included in the goal model information in the goal model-threat analysis synthesis information.

  Further, after the repeated execution of steps w43 to w45, as a result of the comparison in step w44, regarding the countermeasure policy (UO) in the case of no (UO ≠ O), the processing engine 110, for example, as shown in FIG. In step w45, the combined diagram data is sent to the input / output unit 107 to prompt the input of the security function requirement (SFR) for the security countermeasure policy (UO) of the use case (w46). That is, the processing engine 110 associates security function requirements with security objective policies (UO) not included in the goal model information among the security objective policies (O, UO) in the generated goal model-threat analysis synthesis information. Prompt for sufficient document information. The input / output unit 107 inputs the security function requirement (SFR) sufficiency document information of the use case countermeasure policy definition (UO) not included in the goal model information to the processing engine 110 by the user's operation prompted to input. .

  When the processing engine 110 accepts the input of the security function requirement sufficiency document information, as shown in FIG. 9, a new “security countermeasure policy (UO) and related security function requirement identifier for each security countermeasure policy identifier” is displayed. And a countermeasure-function correspondence table data including security function requirement sufficiency document information ”.

  Thereafter, the processing engine 110 writes the countermeasure-function correspondence table data and the goal model-threat analysis / synthesis information in the storage unit 104 (w47). Here, the goal model-threat analysis synthesis information includes the precondition (A) evaluated in step w42, the organizational security countermeasure policy (OSP), and the operational environment countermeasure policy (OE).

[Create scenario data: w50]
As shown in FIGS. 6 to 9, the processing engine 110 includes goal model-threat analysis / synthesis information, created party list data, created protected asset list data, created threat-countermeasure correspondence table data. And the prepared countermeasure-function correspondence table data is read from the storage unit 104.

  The processing engine 110, based on the goal model-threat analysis synthesis information, “premise-operation countermeasure correspondence including precondition definition, related operation countermeasure policy identifier and operation countermeasure policy for each precondition identifier corresponding to the precondition type”. Table data "is created.

  Further, the processing engine 110, based on the goal model-threat analysis synthesis information, “for each organizational countermeasure policy identifier corresponding to the organizational countermeasure policy type, an organization including an organizational countermeasure policy, an associated security countermeasure policy identifier, and a security countermeasure policy. “Countermeasure policy—Countermeasure policy correspondence table data”.

  Further, the processing engine 110 creates the created premise-operation countermeasure correspondence table data, the created organization countermeasure policy-measure policy correspondence table data, the created party list data, the created protected asset list data, the created Security scenario data including prepared threat-countermeasure correspondence table data and prepared countermeasure-function correspondence table data is created.

  Thereafter, the processing engine 110 writes the created security scenario data in the scenario data storage unit 105.

[Verification and storage of goal model: w60]
As shown in FIG. 17, the processing engine 110 verifies the goal model-threat analysis synthesis information obtained in step w40 and determines whether or not to save it in the goal model DB 101.

  The processing engine 110 confirms with the user whether or not to verify the goal model-threat analysis synthesis information (w61). If not (w61; NO), the process ends without registering the goal model-threat analysis synthesis information in the goal model DB 101.

  On the other hand, in the case of verification (w61; YES), the processing engine 110 determines whether or not the security function requirement sufficiency document information in the goal model-threat analysis synthesis information satisfies the security countermeasure policy, VDM (Vienna Development Method), Verification is performed using a model-based verification method such as Z or B.

  The processing engine 110 creates a format description of security function requirements (w62).

  The processing engine 110 prompts the user to input a security countermeasure policy or assumed function described in VDM or the like (w63).

  The processing engine 110 verifies with the model-based format verification tool (w64) and presents the verification result to the user.

  The processing engine 110 stores in the goal model DB 101 the security countermeasure policy and security function requirements that are determined to be valid as the goal model from the verification result (w65), and terminates without storing the invalid security policy and security function requirement. .

[Create security scenario: w70]
As illustrated in FIG. 10, the processing engine 110 creates a security scenario by diagramming the security scenario data in the scenario data storage unit 105 and writes the security scenario in the security data storage unit 106. Further, the processing engine 110 can also present the security scenario in the security data storage unit 106 to the user via the input / output unit 107 as shown in FIG.

[Creation of security design document: w80]
Next, creation of a security design document such as a security requirement definition document and a security target ST will be described.

  As shown in FIG. 18, the processing engine 110 can generate a security requirement definition document by rearranging the list of security scenario data in the scenario data storage unit 105 and the elements of each correspondence table.

  Further, as shown in FIG. 19, the processing engine 110 rearranges the elements of each table of the security scenario data in d105, and refers to the standard document in the ST template storage unit 104 for the missing items, thereby A target ST can be created.

  Note that examples of the “missing items” herein include items of “ST overview”, “TOE security assurance requirements”, and “conformance claim”. A technique for generating a security target ST from security scenario data is also disclosed in, for example, Patent Document 1.

  As described above, according to this embodiment, goal model information including a countermeasure policy type, a security countermeasure policy identifier, a plurality of security countermeasure policies (O), and one or more security function requirement identifiers is stored for each security goal. Comparing each security objective policy (O) in the goal model information read out based on the security objective with the security model (UO) in the threat analysis result, and extracting from the goal model information The read goal model information and the threat analysis result are synthesized by rewriting the security countermeasure policy (UO) in the threat analysis result with the read security countermeasure policy (O) and integrating the two.

  At this time, the security objective (UO) in the threat analysis result is related to the security objective in the goal model information via the integrated security objective (O). For this reason, the security objective related to the security objective (UO) obtained from the threat analysis can be confirmed.

  In addition, other security objectives and security functional requirement identifiers that were not used for integration in the goal model information were not obtained from the threat analysis results. Associated with the threat analysis results. Therefore, it is possible to support the design of security objectives and security functional requirements that were not obtained from threat analysis.

  Supplementally, according to the present embodiment, the accuracy of the security scenario data can be improved by visualizing the security requirement definition using the threat analysis using the use case and the goal-oriented analysis. In addition, security scenario data and goal models can be stored and reused.

(Second Embodiment)
FIG. 20 is a schematic diagram showing the configuration of the security design support apparatus according to the second embodiment of the present invention. The same parts as those in FIG. Is mainly described. In the following embodiments, the same description is omitted.

  This embodiment is a modification of the first embodiment, and the existing use case input tool program such as open source and goal oriented analysis are used for the use case processing unit 108 and goal oriented analysis processing unit 109 shown in FIG. A use case input tool unit 111 and a goal-oriented analysis input tool unit 112 having a function of a CPU for executing an input tool program are added. As these input tool programs, for example, tools in the JUDE series can be used as appropriate. In addition, an input tool program may be appropriately acquired from an online software introduction site such as “Madomori” (www.forest.impress.co.jp/).

  Here, the use case input tool unit 111 has a normal use case input function, for example, a function of inputting a use case diagram and description information to the use case processing unit 108 by an operation of the input / output unit 107 by a user. Have

  The goal-oriented analysis input tool unit 112 has a normal goal-oriented analysis function. For example, the goal-oriented analysis input tool unit 112 has a function of inputting a security target to the goal-oriented analysis processing unit 109 by operating the input / output unit 107 by the user.

  According to the above configuration, use case input and goal-oriented analysis can be executed using an existing open tool, so that versatility can be improved in addition to the effects of the first embodiment.

(Third embodiment)
FIG. 21 is a schematic diagram showing a configuration of a security design support apparatus according to the third exemplary embodiment of the present invention.

  This embodiment is a modification of the first embodiment, and has a configuration in which the use case processing unit 108 and the goal-oriented analysis processing unit 109 illustrated in FIG. 1 are Web systems. Accordingly, a Web communication unit 113 is provided instead of the input / output unit 107. The communication unit 113 is a communication interface for communicating with the user terminal 200 via a network.

  The user terminal 200 is a computer having a Web browser function that can communicate with the security design support apparatus 100b via a network. Although only one is shown, a plurality of user terminals may be used.

  According to the above configuration, since communication with the user terminal 200 is possible via the network, in addition to the effects of the first embodiment, security design is supported for the user terminal 200 arranged at a remote location. can do.

  Note that the method described in the above embodiment includes a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk (MO) as programs that can be executed by a computer. ), And can be distributed in a storage medium such as a semiconductor memory.

  In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.

  In addition, an OS (operating system) running on a computer based on an instruction of a program installed in the computer from a storage medium, MW (middleware) such as database management software, network software, and the like realize the above-described embodiment. A part of each process may be executed.

  Further, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.

  Further, the number of storage media is not limited to one, and the case where the processing in the above embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.

  The computer according to the present invention executes each process in the above-described embodiment based on a program stored in a storage medium, and is a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.

  In addition, the computer in the present invention is not limited to a personal computer, but includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. .

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

  DESCRIPTION OF SYMBOLS 100, 100a, 100b ... Security design support apparatus, 101 ... Goal model DB, 102 ... Sufficiency document template DB, 103 ... ST template DB, 104 ... Storage part, 105 ... Scenario data storage part, 106 ... Security data storage part, DESCRIPTION OF SYMBOLS 107 ... Input / output part, 108 ... Use case processing part, 109 ... Goal-oriented analysis processing part, 110 ... Processing engine, 111 ... Use case input tool part, 112 ... Goal-oriented analysis input tool part

Claims (3)

"Related party list data including a party definition for each related party identifier corresponding to the related party type", "Protected asset list data including a protected asset definition for each protected asset identifier corresponding to the protected asset type", “For each threat identifier corresponding to the threat type, threat definition, related security objective policy identifier and security countermeasure policy sufficiency document information including security objective policy sufficiency document data” and “security objective policy identifier corresponding to the countermeasure policy type” For each security condition policy (O, UO), related security function requirement identifier and security function requirement sufficiency document information including security function requirement sufficiency document information, and "for each precondition identifier corresponding to the precondition type, Preconditions including precondition definitions, related operation policy identifiers and operation policy, and “operation countermeasure table data” and “organizational policy type” Security for supporting the design of security scenario data including the organizational countermeasure policy, the organizational countermeasure policy including the related security countermeasure policy identifier and the security countermeasure policy, and the countermeasure policy correspondence table data for each organizational countermeasure policy identifier corresponding to A design support device,
A sufficiency document template storage means storing “a countermeasure-function correspondence table data including a security objective policy (O), a related security functional requirement identifier and security functional requirement sufficiency document information for each security objective policy identifier”;
“For each security goal as a goal, one or more requests related to the security policy type, security policy identifier, multiple security policy (O) as a soft goal, and each security policy (O) And the security function requirement identifier in the goal model information matches one of the security function requirement identifiers in the sufficiency document template storage means. Goal model information storage means;
`` Related party information including related party type, related party identifier and related party definition '', `` Protected asset information including protected asset type, protected asset identifier and protected asset definition '', `` Threat type, threat identifier, threat definition, And misuse case information including a party identifier related to the threat identifier '', and `` precondition information including a precondition type, a precondition identifier, a precondition definition, and a protected asset identifier related to the precondition identifier '', “Security objective policy information including countermeasure policy type, security objective policy identifier, security objective policy (UO), and threat identifier related to the security objective policy identifier” and “reason type, rational identifier, security objective policy sufficiency document” Information and rationale information including security objectives policy identifiers related to the rationale identifiers "and" operational objectives policies Separately, an operation countermeasure policy information including an operation countermeasure policy identifier, an operation countermeasure policy, and a precondition identifier related to the operation countermeasure policy identifier, and an “organization countermeasure policy type, an organization countermeasure policy identifier, an organization countermeasure policy, and the organization A threat analysis result input receiving means for receiving an input of a threat analysis result including `` organizational countermeasure policy information including an operation countermeasure policy identifier related to the countermeasure policy identifier '';
Participant list data creation means for creating “participant list data including a party identifier and a party definition corresponding to a party type” based on the party information in the threat analysis result that has received the input When,
Protected asset list data creation means for creating “protected asset list data including a protected asset identifier and a protected asset definition corresponding to the protected asset type” based on the protected asset information in the threat analysis result that has received the input When,
Based on the misuse case information, the security objective policy information, and the rationale information in the threat analysis result that has received the input, “for each threat identifier, threat definition, related security objective policy identifier and security objective policy sufficiency document information Threat-countermeasure correspondence table data creating means for creating "threat-countermeasure correspondence table data including",
Security target selection accepting means for accepting selection of one of the security objectives among the security objectives in the goal model information storage means,
Goal model information reading means for reading out goal model information in the goal model information storage means based on the security goal that received the selection;
Countermeasure policy comparing means for comparing each security countermeasure policy (O) in the read goal model information with a security countermeasure policy (UO) in the threat analysis result that has received the input;
As a result of the comparison, extracting means for extracting a security objective policy (O) including a security objective policy (UO) in the threat analysis result from the goal model information;
By rewriting the security objective policy (UO) in the threat analysis result with the extracted security objective policy (O) and integrating the two, the read goal model information and the threat analysis result are synthesized. Synthetic information generating means for generating goal model-threat analysis synthetic information,
Based on the security objective policy (O) included in the goal model information among the security objective policies (O, UO) in the generated goal model-threat analysis synthesis information, security is stored from the sufficiency document template storage means. By reading the functional requirement sufficiency document information and accepting the input of the security functional requirement sufficiency document information in association with the security objective policy (UO) not included in the goal model information, a new “for each security objective policy identifier And a countermeasure correspondence function data creation means for creating a countermeasure countermeasure function data including a security countermeasure policy (UO), a related security function requirement identifier and security function requirement sufficiency document information,
The goal model-threat analysis synthesis information, the created party list data, the created protected asset list data, the created threat-measure correspondence table data, and the created countermeasure-function correspondence table data Security scenario data creating means for creating the security scenario data based on
A security design support device characterized by comprising: The security design support device according to claim 1,
The security scenario data creation means includes:
Based on the goal model-threat analysis synthesis information, “for each precondition identifier corresponding to the precondition type, a precondition-operation countermeasure correspondence table data including a precondition definition, a related operation countermeasure policy identifier and an operation countermeasure policy”. Premise to create-operation countermeasure correspondence table data creation means,
Based on the goal model-threat analysis / synthesis information, "for each organizational countermeasure policy identifier corresponding to the organizational countermeasure policy type, the organizational countermeasure policy-the countermeasure policy correspondence including the organizational countermeasure policy, the related security countermeasure policy identifier and the security countermeasure policy" Organizational countermeasure policy for creating "table data"-countermeasure policy correspondence table data creation means,
The created assumption-operation countermeasure correspondence table data, the created organizational countermeasure policy-measure policy correspondence table data, the created party list data, the created protected asset list data, and the created Means for creating security scenario data including threat-countermeasure correspondence table data and the prepared countermeasure-function correspondence table data;
A security design support device characterized by comprising: Sufficient document template storage means and goal model information storage means, and "related party list data including related party definition for each related party identifier corresponding to the related party type" and "protected asset identifier corresponding to the protected asset type" Protected asset list data including protected asset definition for each "and" Threat-Countermeasure correspondence table including threat definition, associated security objective policy identifier and security objective policy sufficiency document information for each threat identifier corresponding to threat type " Data ”and“ Measure-function correspondence table data including security measure policy (O, UO), related security function requirement identifier and security function requirement sufficiency document information for each security measure policy identifier corresponding to the measure policy type ” “For each precondition identifier corresponding to the precondition type, the precondition definition, the related operation policy identifier and “Assumptions including needles—Operational measures correspondence table data” and “Organizational measures policy-related policies for each organizational measure policy identifier corresponding to the organizational measure policy type” In a program used in a security design support device for supporting the design of security scenario data including `` correspondence table data '',
The security design support device,
Means for writing “security countermeasure policy (O), associated security function requirement identifier and security function requirement sufficiency document information including function function sufficiency document information” to the sufficiency document template storage means for each security objective policy identifier ,
“For each security goal as a goal, one or more requests related to the security policy type, security policy identifier, multiple security policy (O) as a soft goal, and each security policy (O) "The goal model information including the security function requirement identifier of" and "the goal function information whose security function requirement identifier matches one of the security function requirement identifiers in the sufficiency document template storage means" Means for writing to the goal model information storage means;
`` Related party information including related party type, related party identifier and related party definition '', `` Protected asset information including protected asset type, protected asset identifier and protected asset definition '', `` Threat type, threat identifier, threat definition, And misuse case information including a party identifier related to the threat identifier '', and `` precondition information including a precondition type, a precondition identifier, a precondition definition, and a protected asset identifier related to the precondition identifier '', “Security objective policy information including countermeasure policy type, security objective policy identifier, security objective policy (UO), and threat identifier related to the security objective policy identifier” and “reason type, rational identifier, security objective policy sufficiency document” Information and rationale information including security objectives policy identifiers related to the rationale identifiers "and" operational objectives policies Separately, an operation countermeasure policy information including an operation countermeasure policy identifier, an operation countermeasure policy, and a precondition identifier related to the operation countermeasure policy identifier, and an “organization countermeasure policy type, an organization countermeasure policy identifier, an organization countermeasure policy, and the organization A threat analysis result input receiving means for receiving an input of a threat analysis result including `` organizational countermeasure policy information including an operation countermeasure policy identifier related to the countermeasure policy identifier '';
Participant list data creation means for creating “participant list data including a party identifier and a party definition corresponding to a party type” based on the party information in the threat analysis result that has received the input ,
Protected asset list data creation means for creating “protected asset list data including a protected asset identifier and a protected asset definition corresponding to the protected asset type” based on the protected asset information in the threat analysis result that has received the input ,
Based on the misuse case information, the security objective policy information, and the rationale information in the threat analysis result that has received the input, “for each threat identifier, threat definition, related security objective policy identifier and security objective policy sufficiency document information Threat-countermeasure correspondence table data creating means for creating "threat-countermeasure correspondence table data including",
Security target selection accepting means for accepting selection of any one of the security objectives in the goal model information storage means,
Goal model information reading means for reading the goal model information in the goal model information storage means based on the security goal that has received the selection;
Countermeasure policy comparison means for comparing each security countermeasure policy (O) in the read goal model information with a security countermeasure policy (UO) in the threat analysis result that has received the input;
As a result of the comparison, extraction means for extracting a security objective policy (O) including a security objective policy (UO) in the threat analysis result from the goal model information;
By rewriting the security objective policy (UO) in the threat analysis result with the extracted security objective policy (O) and integrating the two, the read goal model information and the threat analysis result are synthesized. Synthetic information generating means for generating goal model-threat analysis synthetic information,
Based on the security objective policy (O) included in the goal model information among the security objective policies (O, UO) in the generated goal model-threat analysis synthesis information, security is stored from the sufficiency document template storage means. By reading the functional requirement sufficiency document information and accepting the input of the security functional requirement sufficiency document information in association with the security objective policy (UO) not included in the goal model information, a new “for each security objective policy identifier Measures for creating a security countermeasure policy (UO), related security function requirement identifier and security function requirement sufficiency document information-function correspondence table data ", function correspondence table data creation means,
The goal model-threat analysis synthesis information, the created party list data, the created protected asset list data, the created threat-measure correspondence table data, and the created countermeasure-function correspondence table data Security scenario data creating means for creating the security scenario data based on
Program to function as.

Images