A Method of Software System Security Verification and Evaluation Based on Extension of AADL Model

摘要

In the complex hardware and software hybrid system, the rapid increase of the software scale and the system complexity bring the important challenge to the software security modeling. There are still many functional or semantic problems for traditional modeling language and modeling method, when they are used into the security modeling. Therefore, based on the Architecture Analysis and Design Language (AADL), this paper proposes the AADL error model and extracted the timing fault tree. After comprehensive analysis by using the common factor failure analysis and the hardware and software failure analysis, we can obtain the generation mechanism of danger. By establishing the AADL multi-view security model of the software system, and converting it into the Timed Abstract State Machine (TASM) and the Markov model, this paper forms a method of the security verification and evaluation based on extended AADL model. Finally, we confirm the effectiveness of the proposed method by performing security analysis for an instance.