臺灣博碩士論文加值系統

資訊安全共同準則（Common Criteria：簡稱CC）是一個國際性的標準，但由於內容過於龐大，儘管其內容本身已具有結構性，在審查上還是必須花費許多時間與人力。目前針對CC建構的電腦輔助審查工具並不多，故本研究建立了一個電腦輔助自動審查工具組(YZU_CC_Tools)，希望能提升審查的效率，本研究透過建立CC之知識本體(Ontology)將其繁雜的規範與內容以UML圖視覺化表達，並利用XML的標記方式加以實作，接著藉由知識本體的概念以及屬性之間的關係為CC訂定電腦輔助審查規則，本研究建構的工具組包含下列功能:
1.CC標註功能 2.CC自動審查功能 3.PP(保護剖繪)建構功能。

透過此一電腦輔助審查工具組，審查人員可以更快速的執行CC審查工作，進而提升CC審查的效率。

The Common Criteria for Information Technology Security Evaluation provides comprehensive guidelines for the evaluation and certification of IT security regarding data security and data privacy. However, Due to CC’s complexity and the CC-based certification process is a time-consuming. This thesis aims to develop CC Ontology and then construct ontology-based review tool as follow:1.CC Mark-up Tool 2.CC Review Tool 3.PP(Protection Profile) Create Tool. The techniques and tools developed in this research can improve CC’s understandability and enhance the efficiency and effectiveness of CC-certification team.

目錄
第一章 緒論 ………………………………………………………………………1
第二章 相關背景研究 ……………………………………………………………3
2.1 Ontology …………………………………………………………3
2.2 Common Criteria …………………………………………………3
2.3 Protection Profile ……………………………………………8
2.4 XML …………………………………………………………………9
2.5 UML…………………………………………………………………10
2.6 資訊安全評量方法論 ……………………………………………11
2.7 過去相關研究探討 ………………………………………………14
第三章 研究方法…………………………………………………………………16
3.1 研究目的 …………………………………………………………16
3.2 研究步驟 …………………………………………………………16
3.2.1 建立各EAL保證等級之知識本體結構………………………17
3.2.2 參照知識本體結構建立自動審查規則………………………23
3.2.2-1 形式規範類型 …………………………………………26
3.2.2-2 內容分析類型 …………………………………………31
3.2.3 建構審查工具…………………………………………………37
第四章 電腦輔助審查工具組……………………………………………………38
4.1 登入主畫面…………………………………………………………38
4.2 PP建構功能(PP Create Tool)……………………………………39
4.3 CC標註功能(CC Markup Tool)……………………………………42
4.4 CC自動審查功能(CC Review Tool)………………………………46
4.5 實際案例操作:個人門禁系統 ……………………………………49
第五章 自動審查工具評估………………………………………………………54
5.1 實驗進行方式 ………………………………………………………54
5.2 實驗流程 ……………………………………………………………54
5.3 實驗結果 ……………………………………………………………55
5.4 效益分析 ……………………………………………………………57
第六章 結論與未來展望…………………………………………………………58
第七章 參考文獻…………………………………………………………………59

[1] http://en.wikipedia.org/wiki/Ontology_%28information_science%29

[2] CC,”Common criteria for Information technology security evaluation. Part 1:Introduction and general model V2.3,” August, 2005, http://www.commoncriteriaportal.org

[3] CC,”Common criteria for Information technology security evaluation. Part 2: Security functional components V2.3,” August, 2005, http://www.commoncriteriaportal.org

[4] CC,”Common criteria for Information technology security evaluation. Part 3: Security assurance components V2.3,” August, 2005, http://www.commoncriteriaportal.org

[5] http://zh.wikipedia.org/zh-hant/XML

[6] http://dbmaker.syscom.com.tw/rd/c_sgml.html

[7]Martin Fowler, UML Distilled Third Edition, 2004.

[8] 孫惠民, Visual Paradigm for UML

[9] Sheng-Chieh Chang,“Ontology-based CC review tool”, Jun, 2010.

[10] Andres Ekclhart, Stefan Fenz, Gernot Goluch, and Edgar Weippl Secure Business Austria,1040 Vienna. “Ontological Mapping of Common Criteria’s Security Assurance Requirements,” New Approaches for Security, Privacy and Trust in Complex Environments (Proceedings of the IFIP TC-11 22nd International Conference, May 2007, South Africa)

[11] Common Criteria Design Toolbox, Informatics and Mathematical Modelling, Technical University of Denmark, DTU, 2007.

[12] Common Methodology for Information Technology Security Evaluation. Evaluation methodology V2.3,” August, 2005, http://www.commoncriteriaportal.org

[13] Guidance for smartcard evaluation v1-3, March. 2006
http://www.commoncriteriaportal.org

[14]C Plus Plus.com
http://www.cplusplus.com/reference/clibrary/

[15] IEEE/EIA 12207.0-1996
Industry Implementation of International Standard ISO/IEC 12207 : 1995
(ISO/IEC 12207) Standard for Information Technology—Software life cycle processes

[16] IEEE/EIA 12207.1-1997
Industry Implementation of International Standard ISO/IEC 12207 : 1995
(ISO/IEC 12207) Standard for Information Technology—Software life cycle processes—Life cycle data

[17] Chapter 25.ppt – Configuration Management

[18] 梁聖瑜，”以SSE-CMM產生保護剖繪的技術及應用”，元智大學資訊工程所，碩士論文，民國95年。