An Effective Security Requirements Engineering Framework for Cyber-Physical Systems
Context and motivation: Cyber-Physical Systems (CPSs) are gaining priority over other systems. The heterogeneity of these systems increases the importance of security. Both the developer and the requirement analyst must consider details of not only the software, but also the hardware perspective, in...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2018-07-01
|
| Series: | Technologies |
| Subjects: | |
| Online Access: | http://www.mdpi.com/2227-7080/6/3/65 |
| _version_ | 1818930010539425792 |
|---|---|
| author | Shafiq ur Rehman Volker Gruhn |
| author_facet | Shafiq ur Rehman Volker Gruhn |
| author_sort | Shafiq ur Rehman |
| collection | DOAJ |
| description | Context and motivation: Cyber-Physical Systems (CPSs) are gaining priority over other systems. The heterogeneity of these systems increases the importance of security. Both the developer and the requirement analyst must consider details of not only the software, but also the hardware perspective, including sensor and network security. Several models for secure software engineering processes have been proposed, but they are limited to software; therefore, to support the processes of security requirements, we need a security requirements framework for CPSs. Question/Problem: Do existing security requirements frameworks fulfil the needs of CPS security requirements? The answer is no; existing security requirements frameworks fail to accommodate security concerns outside of software boundaries. Little or even no attention has been given to sensor, hardware, network, and third party elements during security requirements engineering in different existing frameworks. Principal Ideas/results: We have proposed, applied, and assessed an incremental security requirements evolution approach, which configures the heterogeneous nature of components and their threats in order to generate a secure system. Contribution: The most significant contribution of this paper is to propose a security requirements engineering framework for CPSs that overcomes the issue of security requirements elicitation for heterogeneous CPS components. The proposed framework supports the elicitation of security requirements while considering sensor, receiver protocol, network channel issues, along with software aspects. Furthermore, the proposed CPS framework has been evaluated through a case study, and the results are shown in this paper. The results would provide great support in this research direction. |
| first_indexed | 2024-12-20T03:53:54Z |
| format | Article |
| id | doaj.art-dd751bed132947c0b38d8d4d60eddf76 |
| institution | Directory Open Access Journal |
| issn | 2227-7080 |
| language | English |
| last_indexed | 2024-12-20T03:53:54Z |
| publishDate | 2018-07-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Technologies |
| spelling | doaj.art-dd751bed132947c0b38d8d4d60eddf762022-12-21T19:54:23ZengMDPI AGTechnologies2227-70802018-07-01636510.3390/technologies6030065technologies6030065An Effective Security Requirements Engineering Framework for Cyber-Physical SystemsShafiq ur Rehman0Volker Gruhn1Institute of Software Technology, University of Duisburg-Essen, 45127 Essen, GermanyInstitute of Software Technology, University of Duisburg-Essen, 45127 Essen, GermanyContext and motivation: Cyber-Physical Systems (CPSs) are gaining priority over other systems. The heterogeneity of these systems increases the importance of security. Both the developer and the requirement analyst must consider details of not only the software, but also the hardware perspective, including sensor and network security. Several models for secure software engineering processes have been proposed, but they are limited to software; therefore, to support the processes of security requirements, we need a security requirements framework for CPSs. Question/Problem: Do existing security requirements frameworks fulfil the needs of CPS security requirements? The answer is no; existing security requirements frameworks fail to accommodate security concerns outside of software boundaries. Little or even no attention has been given to sensor, hardware, network, and third party elements during security requirements engineering in different existing frameworks. Principal Ideas/results: We have proposed, applied, and assessed an incremental security requirements evolution approach, which configures the heterogeneous nature of components and their threats in order to generate a secure system. Contribution: The most significant contribution of this paper is to propose a security requirements engineering framework for CPSs that overcomes the issue of security requirements elicitation for heterogeneous CPS components. The proposed framework supports the elicitation of security requirements while considering sensor, receiver protocol, network channel issues, along with software aspects. Furthermore, the proposed CPS framework has been evaluated through a case study, and the results are shown in this paper. The results would provide great support in this research direction.http://www.mdpi.com/2227-7080/6/3/65security requirementssecurity requirements engineeringframeworksecurity goalthreatcyber-physical systems |
| spellingShingle | Shafiq ur Rehman Volker Gruhn An Effective Security Requirements Engineering Framework for Cyber-Physical Systems Technologies security requirements security requirements engineering framework security goal threat cyber-physical systems |
| title | An Effective Security Requirements Engineering Framework for Cyber-Physical Systems |
| title_full | An Effective Security Requirements Engineering Framework for Cyber-Physical Systems |
| title_fullStr | An Effective Security Requirements Engineering Framework for Cyber-Physical Systems |
| title_full_unstemmed | An Effective Security Requirements Engineering Framework for Cyber-Physical Systems |
| title_short | An Effective Security Requirements Engineering Framework for Cyber-Physical Systems |
| title_sort | effective security requirements engineering framework for cyber physical systems |
| topic | security requirements security requirements engineering framework security goal threat cyber-physical systems |
| url | http://www.mdpi.com/2227-7080/6/3/65 |
| work_keys_str_mv | AT shafiqurrehman aneffectivesecurityrequirementsengineeringframeworkforcyberphysicalsystems AT volkergruhn aneffectivesecurityrequirementsengineeringframeworkforcyberphysicalsystems AT shafiqurrehman effectivesecurityrequirementsengineeringframeworkforcyberphysicalsystems AT volkergruhn effectivesecurityrequirementsengineeringframeworkforcyberphysicalsystems |