## 5 Common Criteria IT Security Development Process--Intelligent Sensor Specific Issues
### Defining Common Criteria related security design patterns--general rules  
Enhanced generics can be used as predefined Common Criteria related security design patterns which allow one to compose IT security specifications for varied intelligent sensors. This subsection gives a short introduction to the assumed enhanced generics notation, which is similar to the notation commonly used by IT security developers (dot separated fields) but more precise. In the author's previously mentioned works the enhanced generics were defined on a different level of abstraction, like formal grammar, UML objects, ontology classes individuals, sets of literals, _etc_. For this work it is enough to assume that, similarly to the SFR/SAR components, an enhanced generic consists of textual fields separated by dots:  
\[\textit{Family.Mnemonic.Description.Refinement}\]  
The _Family_ field groups similar items. Each security model issue, like: assets, subjects, threats, _etc._, has its own possible values - mnemonic prefixes representing families. According to the CC-defined functional paradigm [1]/Part 2, an asset represents a passive entity within the considered system. The _Family_ field for assets (data, services, software, IT infrastructure, documents, _etc._) begins with -D\", and the following values are allowed (the symbol \(\rightarrowsuit\)\" means -er\"): _Family_\(::=\) DTO\(|\)DIT\(|\)DAP, where:  
\begin{tabular}{l l} -DTO\" &  
For threats, the following prefixes are defined: _Family_\(::=\) TDA\(|\)TIT\(|\)TPH, where: \begin{tabular}{l l} \(\
eg\)FDA\" & - \(\
eg\)direct attacks against the TOE\", \\ \(\
eg\)TIT\" & - \(\
eg\)attacks against the TOE IT environment\", \\ \(\
eg\)PH\" & - \(\
eg\)attacks against the TOE physical environment\". \\ \end{tabular}   
Assumptions, addressed to the TOE environment, have prefixes: _Family_\(::=\) ACN\(|\)APR\(|\)APH, where: \begin{tabular}{l l} \(\
eg\)ACN\" & - \(\
eg\)connectivity aspects\", \\ \(\
eg\)APR\" & - \(\
eg\)personnel/organizational aspects\", \\ \(\
eg\)APH\" & - \(\
eg\)physical aspects\". \\ \end{tabular}   
Similar prefixes are defined for security objectives: \begin{tabular}{l l} _Family_\(::=\) OACC\(|\)OIDA\(|\)OADT\(|\)OINT\(|\)OAVB\(|\)OPRV\(|\)ODEX\(|\)OCON\(|\)OeIT\(|\)OEPH\(|\)OSMN \\ \end{tabular}   
and for organizational security policies (OSPs): \begin{tabular}{l l} _Family_\(::=\) PACC\(|\)PIDA\(|\)PADT\(|\)PINT\(|\)PAVB\(|\)PPRV\(|\)PDEX\(|\)PCON\(|\)PEIT\(|\)PEPH\(|\)PSMN, where: \\ \(\
eg\)OACC/PACC\" & - \(\
eg\)access control and information flow control\", \\ \(\
eg\)OIDA/PIDA\" & - \(\
eg\)identification and authentication\", \\ \(\
eg\)OADT/PADT\" & - \(\
eg\)accountability and security audit\", \\ \(\
eg\)OINT/PINT\" & - \(\
eg\)integrity\", \\ \(\
eg\)OAVB/PAVB\" & - \(\
eg\)availability\", \\ \(\
eg\)PRV/PRV\" & - \(\
eg\)privacy\", \\ \(\
eg\)ODEX/PDEX\" & - \(\
eg\)data exchange\", \\ \(\
eg\)CON/PCON\" & - \(\
eg\)confidentiality\", \\ \(\
eg\)EIT/PEIT\" & - \(\
eg\)TOE IT environment\", \\ \(\
eg\)EPH/PEPH\" & - \(\
eg\)technical or infrastructure\", \\ \(\
eg\)OSMN/PSMN\" & - \(\
eg\)security maintenance\". \\ \end{tabular}   
It should be mentioned that enhanced generics may express security functions as well (not discussed in the paper). Prefixes of the security functions begin with the letter \(\
eg\)S\", and further include a CC functional class name which the given function deals with, e.g., for the \(\
eg\)FAU\" class (audit), the security functions have the \(\
eg\)SFAU\" prefix. The second enhanced generics field, developers-defined _Mnemonic_, expresses as briefly as possible (a few letters) security features, behaviour or actions (see examples below). The _Description_ field presents concisely the generic meaning, using one or few sentences. This field may have parameters in square brackets representing any asset [_Dparam_] or any subject [_Sparam_]. Parameters may be left empty (meaning: \(\
eg\)any possible\") or substituted (symbol: \(\
eg\)\(\
eg\)\") by an appropriate asset or subject generic.