Back to results
US 2006/0242711 A1Published application
Tool, method, and program for supporting system security design/evaluation
AssigneeHitachi, Ltd.
InventorsKousuke Anzai, Masato Arai, Yasuhiko Nagai, Hidaka Matsumoto
Life of this patent
Estimating the term…
Abstract
A design/evaluation support tool 100 is constructed from a table link use unit 110 identifying linkages between a threat-to-component correspondence table 125, a risk-value table 126, a component contribution rate table 127, and a risk-to-assurance level correspondence table 128, based on their respective duplicate items; and a component assurance level deriving unit 111 deriving an assurance level of each of components that conforms to a risk value of a threat that a security function of each of the components counters by weighting the risk value of the threat by a component rate of contribution based on linkages of the tables.
Claims22
A system security design/evaluation support tool deriving an assurance level of security for each of components of a subject system operating on an information processing apparatus and made up of one or more components, comprising:
- a threat-to-component correspondence table storing therein correspondence between a threat that the subject system assumes and a security function that the component has;
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of the threat;
- a component contribution rate table storing therein information on the magnitude of effect of the security function that the component has and that counters the threat;
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level required corresponding to the risk value;
- a table link use unit identifying linkages between the threat-to-component correspondence table, the risk-value table, the component contribution rate table, and the risk-to-assurance level correspondence table, based on their respective overlapping items;
- and
- a component assurance level deriving unit deriving an assurance level of each of the components that conforms to a risk value of a threat that a security function of each of the components counters, by weighting the risk value of the threat with a component contribution rate based on linkages of the tables.
4 more elements
A system security design support tool which derives an optimum product combination out of one or more candidate products and which product is to be in charge of a security function requisite to be satisfied by the system, for a subject system operating on an information processing apparatus and made up of one or more components, the tool comprising:
- a threat-to-function requisite correspondence table storing therein correspondence between expected threats to the subject system and security function requisites to be satisfied by the system;
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of each of the threats;
- a function requisite-to-product correspondence table storing therein correspondence between each of the candidate products and a security function requisite that the candidate product has;
- a product assurance level table storing therein an assurance level of each of the candidate products;
- a function requisite contribution rate table storing therein information on the magnitudes of respective effects of security function requisites that counters the threats;
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level that is required in response to the risk value;
- a table link use unit that identifies linkages between the threat-to-function requisite correspondence table, the risk-value table, the function requisite-to-product correspondence table, the product assurance level table, the function requisite contribution rate table, and the risk-to-assurance level correspondence table on the basis of their respective duplicate items;
- a component assurance level deriving unit that creates product combination candidates each formed of one or more candidate products which satisfy security function requisites to be satisfied by the subject system based on the linkages between the tables and, for each of the created product combination candidates, creates one or more in-charge patterns in each of which each product of the product combination candidate is in charge of a security function requisite to be satisfied by the subject system and, for each of all the created in-charge patterns of the product combination candidates, calculates a component contribution rate of each product of the product combination candidate which relates to the degree of an effect of the respective security function requisite to counter one of the threats based on the linkages between the tables, and weights the risk value of the respective threat with the component contribution rate, thereby deriving an assurance level to be required of each of the products that matches the risk value of the respective threat that the respective security function counters;
- a degree-of-assurance adaptability deriving unit that, for each of all the created in-charge patterns of the product combination candidates, compares in value an assurance level to be required of each of the products and an assurance level of each product of the product combination candidate identified by referencing the product assurance level table, thereby deriving a degree of assurance adaptability;
- and
- an optimum product combination deciding unit that identifies as an optimum product combination one of the in-charge patterns of the product combination candidates whose degree of assurance adaptability is optimal and decides which products are to be in charge of the security function requisites to be satisfied by the subject system.
8 more elements
A method of deriving an assurance level of security for each of components of a subject system operating on an information processing apparatus and made up of one or more components, the method comprising:
- by use of
- a threat-to-component correspondence table storing therein correspondence between a threat that the subject system assumes and a security function that the component has,
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of the threat,
- a component contribution rate table storing therein information on the magnitude of effect of the security function that the component has and that counters the threat, and
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level required corresponding to the risk value,
- identifying linkages between the tables based on their respective duplicate items;
- and
- weighting the risk value of the threat with a component contribution rate based on linkages of the tables, to derive an assurance level of each of the components that conforms to a risk value of a threat that a security function of each of the components counters.
5 more elements
A program operable to drive a computer to execute a method of deriving an assurance level of security for each of components of a subject system operating on an information processing apparatus and made up of one or more components, the computer forced to execute the steps of:
- by use of
- a threat-to-component correspondence table 125 storing therein correspondence between a threat that the subject system assumes and a security function that the component has,
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of the threat,
- a component contribution rate table storing therein information on the magnitude of effect of the security function that the component has and that counters the threat, and
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level required corresponding to the risk value,
- identifying linkages between the tables based on their respective duplicate items;
- and
- weighting the risk value of the threat with a component contribution rate based on linkages of the tables, to derive an assurance level of each of the components that conforms to a risk value of a threat that a security function of each of the components counters.
5 more elements
A method of deriving an optimum product combination out of one or more candidate products and which product is to be in charge of a security function requisite to be satisfied by the system, for a subject system operating on an information processing apparatus and made up of one or more components, the method comprising:
- by use of
- a threat-to-function requisite correspondence table storing therein correspondence between expected threats to the subject system and security function requisites to be satisfied by the system,
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of each of the threats,
- a function requisite-to-product correspondence table storing therein correspondence between each of the candidate products and a security function requisite that the candidate product has,
- a product assurance level table storing therein an assurance level of each of the candidate products,
- a function requisite contribution rate table storing therein information on the magnitudes of respective effects of security function requisites that counters the threats, and
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level that is required in response to the risk value,
- identifying linkages between the threat-to-function requisite correspondence table, the risk-value table, the function requisite-to-product correspondence table, the product assurance level table, the function requisite contribution rate table, and the risk-to-assurance level correspondence table on the basis of their respective duplicate items;
- creating product combination candidates which each satisfy security function requisites to be satisfied by the subject system based on the linkages between the tables;
- for each of the created product combination candidates, creating one or more in-charge patterns in each of which each product of the product combination candidate is in charge of a security function requisite to be satisfied by the subject system;
- for each of all the created in-charge patterns of the product combination candidates, calculating a component contribution rate of each product of the product combination candidate which relates to the degree of an effect of the respective security function requisite to counter one of the threats based on the linkages between the tables, and weighting the risk value of the respective threat with the component contribution rate, thereby deriving an assurance level to be required of each of the products that matches the risk value of the respective threat that the respective security function counters;
- for each of all the created in-charge patterns of the product combination candidates, comparing in value an assurance level to be required of each of the products and an assurance level of each product of the product combination candidate identified by referencing the product assurance level table, thereby deriving a degree of assurance adaptability;
- and
- identifying as an optimum product combination one of the in-charge patterns of the product combination candidates whose degree of assurance adaptability is optimal and deciding which products are to be in charge of the security function requisites to be satisfied by the subject system.
11 more elements
A program operable to drive a computer to execute a method of deriving an optimum product combination out of one or more candidate products and which product is to be in charge of a security function requisite to be satisfied by the system, for a subject system operating on an information processing apparatus and made up of one or more components, the computer forced to execute the steps of:
- by use of
- a threat-to-function requisite correspondence table storing therein correspondence between expected threats to the subject system and security function requisites to be satisfied by the system,
- a risk-value table storing therein information of a risk value indicative of the magnitude of a risk of each of the threats,
- a function requisite-to-product correspondence table storing therein correspondence between each of the candidate products and a security function requisite that the candidate product has,
- a product assurance level table storing therein an assurance level of each of the candidate products,
- a function requisite contribution rate table storing therein information on the magnitudes of respective effects of security function requisites that counters the threats, and
- a risk-to-assurance level correspondence table storing therein correspondence between a risk value and an assurance level that is required in response to the risk value,
- identifying linkages between the threat-to-function requisite correspondence table, the risk-value table, the function requisite-to-product correspondence table, the product assurance level table, the function requisite contribution rate table, and the risk-to-assurance level correspondence table on the basis of their respective duplicate items;
- creating product combination candidates which each satisfy security function requisites to be satisfied by the subject system based on the linkages between the tables;
- for each of the created product combination candidates, creating one or more in-charge patterns in each of which each product of the product combination candidate is in charge of a security function requisite to be satisfied by the subject system;
- for each of all the created in-charge patterns of the product combination candidates, calculating a component contribution rate of each product of the product combination candidate which relates to the degree of an effect of the respective security function requisite to counter one of the threats based on the linkages between the tables, and weighting the risk value of the respective threat with the component contribution rate, thereby deriving an assurance level to be required of each of the products that matches the risk value of the respective threat that the respective security function counters;
- for each of all the created in-charge patterns of the product combination candidates, comparing in value an assurance level to be required of each of the products and an assurance level of each product of the product combination candidate identified by referencing the product assurance level table, thereby deriving a degree of assurance adaptability;
- and
- identifying as an optimum product combination one of the in-charge patterns of the product combination candidates whose degree of assurance adaptability is optimal and deciding which products are to be in charge of the security function requisites to be satisfied by the subject system.
11 more elements
Dependencies are inferred from the claim text.