Abstract:The rapid development of intelligent connected vehicles has increased the attack surface of vehicles and made the complexity of vehicle systems unprecedented. Original equipment manufacturers (OEMs) need to accurately represent and identify threats and match corresponding security requirements. Meanwhile, the fast iteration cycle of modern vehicles requires development engineers to quickly obtain cybersecurity requirements for new features in their developed systems in order to develop system code that meets cybersecurity requirements. However, existing threat identification and cybersecurity requirement methods in the automotive domain cannot accurately describe and identify threats for a new feature while also quickly matching appropriate cybersecurity requirements. This article proposes a cybersecurity requirements management system (CRMS) framework to assist OEM security experts in conducting comprehensive automated threat analysis and risk assessment and to help development engineers identify security requirements prior to software development. The proposed CRMS framework enables development engineers to quickly model their systems using the UML-based (i.e., capable of describing systems using UML) Eclipse Modeling Framework and security experts to integrate their security experience into a threat library and security requirement library expressed in Alloy formal language. In order to ensure accurate matching between the two, a middleware communication framework called the component channel messaging and interface (CCMI) framework, specifically designed for the automotive domain, is proposed. The CCMI communication framework enables the fast model of development engineers to match with the formal model of security experts for threat and security requirement matching, achieving accurate and automated threat and risk identification and security requirement matching. To validate our work, we conducted experiments on the proposed framework and compared the results with the HEAVENS approach. The results showed that the proposed framework is superior in terms of threat detection rates and coverage rates of security requirements. Moreover, it also saves analysis time for large and complex systems, and the cost-saving effect becomes more pronounced with increasing system complexity.

FESR: A Framework for Eliciting Security Requirements Based on Integration of Common Criteria and Weakness Detection Formal Model

Performance requirement elicitation for financial information system based on ontology

Eliciting security requirements and tracing them to design: an integration of Common Criteria, heuristics, and UMLsec

A QoS Ontology Cooperated with Feature Models for Non-Functional Requirements Elicitation.

Security Requirements Engineering in the Wild: A Survey of Common Practices

A Framework for Cybersecurity Requirements Management in the Automotive Domain

A Security Assurance Framework Combining Formal Verification and Security Functional Testing

Analysing security requirements patterns based on problems decomposition and composition.

An Information System Security Evaluation Method Based on FCME Model

A Formal Model to Facilitate Security Testing in Modern Automotive Systems

A security requirements modelling language for cloud computing environments

Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges

A Business Process-based Method on Security Requirement Analysis of Information Systems

A Formal Model of Security Controls' Capabilities and Its Applications to Policy Refinement and Incident Management

Towards Ontological Approach to Eliciting Risk-Based Security Requirements

A Survey of Modeling and Analysis Approaches for Architecting Secure Software Systems

RESEARCH AND IMPLEMENTATION OF MODEL OF INFORMATION SECURITY EVALUATION

A Model Based Framework for Testing Safety and Security in Operational Technology Environments

Elicitation of SME Requirements for Cybersecurity Solutions by Studying Adherence to Recommendations

Toward a taxonomy of communications security models

Adaptive and Proactive Security Assessment on Energy Delivery Systems