设计类脆弱性研究  

Research on Design Vulnerabilities Class

作　　者：李艺[1] 李新明[1] 姜湘岗[2] 

机构地区：[1]装备指挥技术学院,北京101416 [2]北京电子科技学院,北京100036

出　　处：《计算机科学》2005年第4期216-218,共3页Computer Science

基　　金：863项目2003AA1Z2050

摘　　要：对目前的软件脆弱性分类方法进行了分析,针对Unix/Linux操作系统,提出了基于软件脆弱性所在部件和引入原因的二维度的脆弱性分类法,并简要说明了对引入原因的进一步分类的方法。设计类脆弱性是一类重要的软件脆弱性,但在已知的各种脆弱性分类中对设计脆弱性的分类几乎是空白。本文重点对其中的设计类脆弱性进行了研究,提出了将设计类脆弱性的划分方法,分成限制脆弱性、需求无法实现脆弱性、安全设计脆弱性、异常处理脆弱性、功能局限脆弱性和随机结果脆弱性等几类,并给出了每一类设计脆弱性的定义和典型的实例。This paper analyzes the existing taxonomies of software vulnerability. For Unix/Linux operation systerm, this paper proposes two-dimensional taxonomy of software vulnerability based on location and cause attributes,and describes the classification scheme of software vulnerabilities according to their cause. Design vulnerabilities class is an important class of vulnerabilites, but no existing classification identifies the types of design vulnerabilities in further detail yet. This paper elaborates on the aspect of research on design vulnerabilities and proposes the classification schema which divides design vulnerabilities into following subclasses: limit vulnerabilities, unsatisfied requirement vul- nerabilities, security design vulnerabilities, exception handling vulnerabilities, restricted function vulnerabilities and random result vulnerabilities. This paper gives the definition and typical examples of every subclass.

关 键 词：Unix/Linux操作系统 软件脆弱性 分类方法 划分方法 安全设计 异常处理 分类法 类设计 原因 部件 

分 类 号：TP392[自动化与计算机技术—计算机应用技术] TP311[自动化与计算机技术—计算机科学与技术]