Skip to content

Add safety integrity level schema support #1041

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devashridatta-dotcom wants to merge 1 commit into
base: 2.0-dev
Choose a base branch
from
Open

Add safety integrity level schema support #1041

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
219 changes: 219 additions & 0 deletions schema/2.0/model/cyclonedx-behavior-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,225 @@
}
}
},
"safetyIntegrityLevel": {
"type": "object",
"title": "Safety Integrity Level",
"description": "A safety integrity classification drawn from a functional safety scheme. The scheme determines the permitted level values. The level expresses the degree of rigour the scheme requires, such as an Automotive Safety Integrity Level, a Safety Integrity Level, a Design Assurance Level, or a software safety class.",
"additionalProperties": false,
"required": [
"scheme",
"level"
],
"properties": {
"scheme": {
"title": "Scheme",
"description": "The functional safety scheme that the level is drawn from. Use the custom option for schemes not covered by the enumeration.",
"oneOf": [
{
"type": "string",
"title": "Predefined Scheme",
"enum": [
"ISO-26262",
"IEC-61508",
"DO-178C",
"IEC-62304",
"EN-50128"
],
"meta:enum": {
"ISO-26262": "Road vehicles functional safety. Levels are Automotive Safety Integrity Levels, from QM to ASIL D.",
"IEC-61508": "Functional safety of electrical, electronic, and programmable electronic safety-related systems. Levels are Safety Integrity Levels 1 to 4.",
"DO-178C": "Software considerations in airborne systems and equipment certification. Levels are Design Assurance Levels A to E.",
"IEC-62304": "Medical device software life cycle processes. Levels are software safety classes A to C.",
"EN-50128": "Railway applications software for railway control and protection systems. Levels are Software Safety Integrity Levels 0 to 4."
}
},
{
"type": "object",
"title": "Custom Scheme",
"required": [
"name"
],
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"minLength": 1,
"title": "Name",
"description": "The name of the custom scheme."
},
"description": {
"type": "string",
"title": "Description",
"description": "A description of the custom scheme."
}
}
}
]
},
"level": {
"type": "string",
"minLength": 1,
"title": "Level",
"description": "The level within the scheme. The permitted values are determined by the scheme."
}
},
"allOf": [
{
"if": {
"required": [
"scheme"
],
"properties": {
"scheme": {
"const": "ISO-26262"
}
}
},
"then": {
"properties": {
"level": {
"enum": [
"qm",
"asil-a",
"asil-b",
"asil-c",
"asil-d"
],
"meta:enum": {
"qm": "Quality management. The hazard analysis and risk assessment determined that no ASIL is required.",
"asil-a": "Automotive Safety Integrity Level A, the lowest ASIL.",
"asil-b": "Automotive Safety Integrity Level B.",
"asil-c": "Automotive Safety Integrity Level C.",
"asil-d": "Automotive Safety Integrity Level D, the highest ASIL, for hazards that may cause life-threatening or fatal injury."
}
}
}
}
},
{
"if": {
"required": [
"scheme"
],
"properties": {
"scheme": {
"const": "IEC-61508"
}
}
},
"then": {
"properties": {
"level": {
"enum": [
"sil-1",
"sil-2",
"sil-3",
"sil-4"
],
"meta:enum": {
"sil-1": "Safety Integrity Level 1, the lowest level of risk reduction.",
"sil-2": "Safety Integrity Level 2.",
"sil-3": "Safety Integrity Level 3.",
"sil-4": "Safety Integrity Level 4, the highest level of risk reduction."
}
}
}
}
},
{
"if": {
"required": [
"scheme"
],
"properties": {
"scheme": {
"const": "DO-178C"
}
}
},
"then": {
"properties": {
"level": {
"enum": [
"dal-a",
"dal-b",
"dal-c",
"dal-d",
"dal-e"
],
"meta:enum": {
"dal-a": "Design Assurance Level A, for software whose anomalous behaviour may cause or contribute to a catastrophic failure condition.",
"dal-b": "Design Assurance Level B, corresponding to a hazardous failure condition.",
"dal-c": "Design Assurance Level C, corresponding to a major failure condition.",
"dal-d": "Design Assurance Level D, corresponding to a minor failure condition.",
"dal-e": "Design Assurance Level E, for software with no effect on safety."
}
}
}
}
},
{
"if": {
"required": [
"scheme"
],
"properties": {
"scheme": {
"const": "IEC-62304"
}
}
},
"then": {
"properties": {
"level": {
"enum": [
"class-a",
"class-b",
"class-c"
],
"meta:enum": {
"class-a": "Software safety class A. No injury or damage to health is possible.",
"class-b": "Software safety class B. Non-serious injury is possible.",
"class-c": "Software safety class C. Death or serious injury is possible."
}
}
}
}
},
{
"if": {
"required": [
"scheme"
],
"properties": {
"scheme": {
"const": "EN-50128"
}
}
},
"then": {
"properties": {
"level": {
"enum": [
"sil-0",
"sil-1",
"sil-2",
"sil-3",
"sil-4"
],
"meta:enum": {
"sil-0": "Software Safety Integrity Level 0, for software with no safety impact.",
"sil-1": "Software Safety Integrity Level 1.",
"sil-2": "Software Safety Integrity Level 2.",
"sil-3": "Software Safety Integrity Level 3.",
"sil-4": "Software Safety Integrity Level 4, the highest software safety integrity level."
}
}
}
}
}
]
},
"behaviorGraph": {
"type": "object",
"title": "Behavior Graph",
Expand Down
9 changes: 9 additions & 0 deletions schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1921,6 +1921,15 @@
"criticality": {
"$ref": "cyclonedx-risk-2.0.schema.json#/$defs/criticality"
},
"safetyIntegrityLevels": {
"type": "array",
"title": "Safety Integrity Levels",
"uniqueItems": true,
"items": {
"$ref": "cyclonedx-behavior-2.0.schema.json#/$defs/safetyIntegrityLevel"
},
"description": "The safety integrity levels allocated to this asset in the context of the blueprint. An asset may carry classifications from more than one scheme, for example where an IEC 61508 certified element is also mapped to an automotive ASIL."
},
"classification": {
"$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataClassification"
},
Expand Down
6 changes: 5 additions & 1 deletion schema/2.0/model/cyclonedx-common-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,8 @@
"threat-model",
"adversary-model",
"risk-assessment",
"safety-case",
"hazard-analysis",
"vulnerability-assertion",
"exploitability-statement",
"pentest-report",
Expand Down Expand Up @@ -259,6 +261,8 @@
"threat-model": "An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format.",
"adversary-model": "The defined assumptions, goals, and capabilities of an adversary.",
"risk-assessment": "Identifies and analyzes the potential of future events that may negatively impact individuals, assets, and/or the environment. Risk assessments may also include judgments on the tolerability of each risk.",
"safety-case": "A structured argument, supported by a body of evidence, that a system is acceptably safe for a given application in a given environment.",
"hazard-analysis": "Hazard analysis, such as a hazard analysis and risk assessment (HARA), a failure mode and effects analysis (FMEA), or a fault tree analysis (FTA).",
"vulnerability-assertion": "A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product.",
"exploitability-statement": "A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization.",
"pentest-report": "Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test.",
Expand Down Expand Up @@ -952,4 +956,4 @@
"description": "Enveloped signatures in [JSON Signature Scheme (JSS/ITU-T X.590)](https://www.itu.int/epublications/publication/itu-t-x-590-2023-10-json-signature-scheme-jss)."
}
}
}
}
11 changes: 11 additions & 0 deletions schema/2.0/model/cyclonedx-requirement-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,15 @@
},
"uniqueItems": true
},
"safetyIntegrityLevels": {
"type": "array",
"title": "Safety Integrity Levels",
"uniqueItems": true,
"items": {
"$ref": "cyclonedx-behavior-2.0.schema.json#/$defs/safetyIntegrityLevel"
},
"description": "The safety integrity levels allocated to this requirement, such as the ASIL of an automotive safety requirement or the software safety class of a medical device software requirement."
},
"priority": {
"type": "string",
"title": "Priority",
Expand Down Expand Up @@ -167,6 +176,7 @@
"privacy",
"regulatory",
"reliability",
"safety",
"scalability",
"security",
"system",
Expand All @@ -193,6 +203,7 @@
"privacy": "Requirements specifically addressing the handling and protection of personal and sensitive data.",
"regulatory": "Requirements necessary for legal compliance, dictated by laws, regulations, or standards.",
"reliability": "Requirements ensuring the system consistently performs under specified conditions and duration.",
"safety": "Safety requirement, such as a functional safety requirement allocated a safety integrity level.",
"scalability": "Requirements focused on the ability of the system to grow and manage increased demand effectively.",
"security": "Requirements intended to protect systems, data, and users from malicious actions or threats.",
"system": "Technical requirements defining infrastructure, architecture, or underlying technologies.",
Expand Down
2 changes: 2 additions & 0 deletions schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,7 @@
"CVSSv3",
"CVSSv31",
"CVSSv4",
"EPSS",
"OWASP",
"SSVC",
"other"
Expand All @@ -392,6 +393,7 @@
"CVSSv3": "Common Vulnerability Scoring System v3.0",
"CVSSv31": "Common Vulnerability Scoring System v3.1",
"CVSSv4": "Common Vulnerability Scoring System v4.0",
"EPSS": "Exploit Prediction Scoring System",
"OWASP": "OWASP Risk Rating Methodology",
"SSVC": "Stakeholder Specific Vulnerability Categorization",
"other": "Another severity or risk scoring methodology"
Expand Down