Towards Automated Certification Framework of Composite Systems: A SWRL-Based Approach

This paper presents an ontological approach to the cyber-security certification of composite systems, leveraging the Common Criteria (CC) framework. We introduce an ontology that models key elements of the common criteria, such as Target of Evaluation (TOE), Security Assurance Requirements (SARs), Security Functional Requirements (SFRs), Evaluation Assurance Level (EAL), etc. and components like IoT Devices, Edge Gateways, AI Engine, etc. Some specific components, which were used in project pilots, are also presented. The ontology facilitates automated reasoning through Semantic Web Rule Language (SWRL) rules to assess certification status. This methodology enhances explainability, efficiency, transparency, consistency, and automation in certification processes, especially for systems integrating complex components like IoTs, AIs, etc.