SEKE 2012 Proceedings - Knowledge Systems Institute

Eliciting Security Requirements in the Commanded Behavior Frame: An Ontology
based Approach
Xiaohong Chen ∗† ,Jing Liu ∗
∗ Shanghai Key Laboratory of Trustworthy Computing, East China Normal University, CHINA
† Key Laboratory of High Confidence Software Technologies (Peking University), Ministry of Education, CHINA
Abstract—The Problem Frames(PF) approach is well known
for analysing and structuring requirement problems in requirements
engineering. However, currently it lacks of a practical
and effective way to obtain security requirements. To solve this
problem, this paper proposes to elicit security requirements by
constructing an act-effect model which is used to model the
environment effects that react to the users’ commands. The
generation of the act-effect model can be guided by a software
environment ontology which models the software environment.
Finally, a case study is given for illustrating the security
requirements elicitation.
Keywords-requirements engineering; security requirements;
software environment ontology; Problem Frames approach;
I. INTRODUCTION
With the increasing demands for secure softwares, how
to get security requirements becomes an important issue.
Generally speaking, security requirements are included in a
system to ensure [1]:
• unauthorized access to the system and its data is not
allowed (the authority problem);
• the integrity of the system from accidental or malicious
attack (the integrity problem).
Much work has been done in security requirements aiming
at these two problems such as [2][3][4][5][6]. This paper
focuses on the integrity problem. There is a famous approach
for analysing security requirements called abuse frames[1]
which is developed on the basis of the Problem Frames(PF)
approach[7]. Security requirements are viewed in terms
of “Assets” and “Attackers” where attackers behave like
operators to cause state changes in the assets. The security
behavior is quantified as an “anti-requirement” which is a
behavior of an asset under some inputs from an attacker.
However, at present the abuse frames approach still lacks
of a practical and effective way to obtain such security
requirements. In this paper, we propose to use the software
environment ontology for helping elicit security requirements
from the basic problem frames. There are five basic
problem frames in the PF approach. They are the required
behavior frame, the commanded behavior frame, the information
display frame, the simple workpieces frame and the
transformation frame, and some variants to them. Aiming
at the commanded behavior frame, this paper first presents
the act-effect model which tries to describe the environment
effects that react to the user commands according to environment
properties. The environment properties are provided
by a software environment ontology built for modeling the
environment of software [8]. Then the undesirable behaviors
of “Assets”, i.e., security requirements, can be obtained.
The rest of this paper is organized as follows. Section
II introduces the commanded behavior frame in the PF
approach and the software environment ontology. Section III
presents security requirements in the commanded behavior
frame. Section IV gives a small example-secure sluice gate
control problem to show how to capture security requirements
in the commanded behavior problem. At last, section
VI concludes this paper and indicates the future work.
II. BACKGROUND
A. The Commanded Behavior Frame
In the PF approach, the commanded behavior frame
characterizes problems in which the machine is required
to accept the operator’s commands and impose the control
accordingly. The problem frame diagram is shown in Fig. 1.
Figure 1. The commanded behavior: problem frame diagram [7]
In the figure, the software problem is to specify a control
machine (the solution) to control a controlled domain (the
problem context) in accordance with commands issued by
the operator so that the commanded behavior (the requirement)
is satisfied. In this frame the general form of a
software development problem has been elaborated only
by more specialised names for the principal parts and by
markings on the connecting lines which indicate:
• The requirement ‘commanded behavior’ is a condition
over phenomena of C3 and E4.
• The control machine CM is the machine to be built.
• The controlled domain CD is its problem domain. CD is
a kind of environment entity, or an asset to be protected.
61