Security Requirements Elicitation via Weaving Scenarios Based on Security Evaluation Criteria

摘要

Software is required to comply with the laws and standards of software security. However, stakeholders with less concern regarding security can neither de- scribe the behaviour of the system with regard to secu- rity nor validate the system''s behaviour when the secu- rity function conflicts with usability. Scenarios or use- case specifications are common in requirements elici- tation and are useful to analyse the usability of the system from a behavioural point of view. In this paper, the authors propose a method to weave scenario frag- ments based on security evaluation criteria into sce- narios. The experiments showed that the weaving method led to a better scenario than the method in- volving writing or modifying the scenario with refer- ence to security evaluation criteria. Keywords: requirements elicitation, security require- ments, scenario analysis, aspect-oriented software de- velopment