标题： 功能安全特性的分类及其定位方法 显示英文标题

标题： A Taxonomy of Functional Security Features and How They Can Be Located

摘要： 在几乎每个软件系统中都必须考虑安全性。 不幸的是，由于安全威胁的多样性和可能的对策，选择和实现安全功能仍然具有挑战性。 虽然安全标准旨在帮助开发人员，但它们通常过于抽象和模糊，无法帮助实现安全功能，或者仅仅有助于配置这些功能。 一种在高层次（即，过于一般）和低层次（即，过于具体）安全标准之间描述安全功能的资源，可以促进安全系统的开发。 为了实现安全功能，开发人员通常使用外部安全框架，以减少实现错误。 即使如此，开发人员仍然会犯错误，这常常导致安全漏洞。 当发生安全事件或系统需要审计或维护时，了解已实现的安全功能至关重要，更重要的是，知道它们的位置。 这项任务，通常称为功能定位，通常是繁琐且容易出错的。 因此，我们必须支持对已实现安全功能的长期跟踪。 我们研究了文献中的安全功能及其在流行安全框架中的覆盖情况。 我们贡献了（1）一个包含68个功能实现级安全功能的分类法，包括与广泛使用的安全标准的映射，（2）对21个流行安全框架的检查，以确定它们提供了哪些安全功能，以及（3）对源代码中安全功能表示的讨论。 我们的分类法旨在帮助开发人员在需要为软件系统选择和实现安全功能时，选择适当的安全功能和框架，并将它们与安全标准相关联。 显示英文摘要

摘要： Security must be considered in almost every software system. Unfortunately, selecting and implementing security features remains challenging due to the variety of security threats and possible countermeasures. While security standards are intended to help developers, they are usually too abstract and vague to help implement security features, or they merely help configure such. A resource that describes security features at an abstraction level between high-level (i.e., rather too general) and low-level (i.e., rather too specific) security standards could facilitate secure systems development. To realize security features, developers typically use external security frameworks, to minimize implementation mistakes. Even then, developers still make mistakes, often resulting in security vulnerabilities. When security incidents occur or the system needs to be audited or maintained, it is essential to know the implemented security features and, more importantly, where they are located. This task, commonly referred to as feature location, is often tedious and error-prone. Therefore, we have to support long-term tracking of implemented security features. We present a study of security features in the literature and their coverage in popular security frameworks. We contribute (1) a taxonomy of 68 functional implementation-level security features including a mapping to widely used security standards, (2) an examination of 21 popular security frameworks concerning which of these security features they provide, and (3) a discussion on the representation of security features in source code. Our taxonomy aims to aid developers in selecting appropriate security features and frameworks and relating them to security standards when they need to choose and implement security features for a software system.