SEKE 2012 Proceedings - Knowledge Systems Institute

Chung [4] treats security requirements as softgoals, that are
identified and refined based on a knowledge catalogue of
decomposition methods, security techniques for satisfying
softgoals, and correlation rules. This approach focuses on the
elicitation process of high level security goals. The i* framework
[5] takes an organizational view by modeling trustworthiness
as softgoals to be satisfied. Attacks by malicious
users are modeled as negative contributions that obstruct
these softgoals. Above all, i* focuses on analysis of security
threats imposed by internal actors at the organizational level.
Attack trees [10] adopt a goal-oriented approach to refining
a root goal into a goal tree to derive scenarios. But this
approach is best suited to design.
Compared with the above work, our approach is at the
analysis phase which treats the solution domain as a black
box and focus on the domain. It complements the softgoal
view by analysing external threats in software systems
problem domains.
The most relevant works are two supplementary approaches
based on the PF. The first one is defined by Lin
et al. [1]. They define so-called “anti-requirements” and the
corresponding “abuse frames” to use the ideas underlying
problem frames in security. An anti-requirement expresses
the intentions of a malicious user, and an abuse frame
represents a security threat. For a threat to be realised, its
abuse frame must be composed with the base problem frame
in the sense that the asset attacked in the abuse frame must
overlap, or be identified with, a domain of the base problem
frame. The purpose of anti-requirements and abuse frames is
to analyze security threats and derive security requirements.
Hatebur et al. [11][6] take a different approach using
problem frames. Security requirements are expressed using a
threat model. Security problem frames are used to consider
security requirements. The goal is to construct a machine
that fulfills the security requirements. Security problem
frames strictly refer to the problems concerning security.
In our work, the undesirable under-attack behaviors are
actually captured as “anti-requirements”. Following Lin et
al. ’s work, we provide a practicable way to obtain these
anti-requirements.
VI. CONCLUSION
Based on the commanded behavior frame and the abuse
frames, this paper proposes to elicit security requirements by
constructing an act-effect model. This model is generated by
referring to the properties of the environment in software
environment ontology. The security requirements can be
easily obtained from these act-effect models. The case study
shows that our approach is feasible.
An important benefit of our approach is the systematic and
repeatable of the security requirements elicitation. The software
environment ontology is used to guide the elicitation
process, which greatly reduces the analysts’workload. Our
approach is not a substitute for abuse frames or the other
traditional security engineering techniques. We have found
them to be useful in complementing such techniques when
deployed during requirements analysis. We are currently
examining ways of eliciting security requirements for the
other basic problem frames.
ACKNOWLEDGMENTS
This work was supported by the National Basic Research
and Development 973 Program of China (Grant
No.2009CB320702), the National Natural Science Foundation
of China (Grant No.61170084,No.90818026), and
Creative Team of NSFC (Grant No.61021004), the Opening
Fund of Top Key Discipline of Computer Software and
Theory in Zhejiang Provincial Colleges at Zhejiang Normal
University, as well as the National 863 High-tech Project of
China (Grant No.2011AA010101).
REFERENCES
[1] L.Lin, B.Nuseibeh, D.Ince, M.Jackson, and J.Moffett, “Introducing
abuse frames for analyzing security requirements,”
in the 11th IEEE International Requirements Engineering
Conference (RE’03), 2003, pp. 371–372.
[2] I. Alexander, “Misuse cases: use cases with hostile intent,”
IEEE Software, vol. 20, no. 1, pp. 58–66, 2003.
[3] J. McDermott and C. Fox, “Using abuse case models for
security requirements analysis,” in Annual Computer Security
Applications Conference, 1999, pp. 6–10.
[4] L. Chung, B. Nixon, E. Yu, and J. Mylopoulos, “Nonfunctional
requirements in software engineering,” in Kluwer,
2000.
[5] L. Liu, E. Yu, and J. Mylopoulos, “Security and privacy
requirements analysis within a social setting,” in International
Conference on Requirements Engineering (RE03), 2003, pp.
8–12.
[6] H. Schmidt, D. Hatebur, and M. Heisel, A Pattern-Based
Method to Develop Secure Software. IGI Global, 2011, ch. 3,
pp. 32–74.
[7] M.Jackson, Problem Frames: Analyzing and Structuring software
development problems. Harlow, England:Addison-
Wesley, 2001.
[8] X.Chen, B. Yin, and Z. Jin, “An approach for capturing
software requirements from interactive scenarios,” Chinese
Jounal of Computer, vol. 34, no. 2, pp. 329–341, 2011, in
Chinese.
[9] G. Sindre and A. Opdahl, “Eliciting security requirements
by misuse cases,” in 37th International Conference on Technology
of Object-Oriented Languages and Systems (TOOLS-
PACIFIC 2000), 2000.
[10] B. Schneier, Attack Trees. Dr. Dobb’s Journal, 1999.
[11] D. Hatebur, M. Heisel, and H. Schmidt, “Using problem
frames for security engineeing,” Tech. Rep., 2006.
65