JP2022048593A - Audit device, audit method, audit program. and audit system - Google Patents

Abstract

To provide an audit device, an audit method and an audit program for preventing the execution of an unauthorized program altered by an attack using a software vulnerability.SOLUTION: An audit device 1 executes a second process of an audit target program that can be connected to a first process included in an audit program. A monitoring device inserts an instruction statement into the audit target program to acquire common identification information that the first process and the second process can acquire, respectively. Further, the monitoring device inserts a statement to be connected to the first process at the beginning and the end of a predetermined function of the audit target program. The first process of the monitoring device acquires address information at the beginning and the end of the function when determining that identification information acquired in the first process and the second process match. When it is determining that the address information at the beginning of the function and the address information at the end of the function do not match, the processing of the second process is stopped.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for preventing the execution of a malicious program tampered with by an attack using a software vulnerability.

A buffer overflow attack is known as a representative of attacks that utilize software vulnerabilities. When calling a function in the operation of a program, the return address is stored in the memory area in order to return to the original operation. By tampering with this return address, there is a problem that the program behaves illegally.

Patent Document 1 discloses a technique relating to a conversion device that converts a program in order to prevent the occurrence of a buffer overflow.

Patent Document 2 discloses a technique for preventing the execution of an illegal program due to a buffer overflow without performing program modification work by a program developer and without depending on a high-level language used for the program.

Japanese Unexamined Patent Publication No. 2013-196512 Japanese Patent No. 5777843

However, it is disclosed that the techniques described in Patent Document 1 and Patent Document 2 both stop the execution of the program as if the program was illegally rewritten by determining whether the address information is within the range of the memory area. There is. On the other hand, although such a method can detect and prevent rewriting of a program in a predetermined memory area, there is room for improvement in its accuracy.

In addition, the technology for preventing buffer overflow by program processing is not guaranteed to be sufficiently safe in that there is a risk of being directly attacked by the program, and there is room for improvement.

In view of the above-mentioned circumstances, the present invention provides an audit device, an audit method, an audit system, and an audit program for preventing the execution of an unauthorized program tampered with by an attack utilizing a software vulnerability. It is an issue to be solved.

In order to solve the above-mentioned problems, the present invention has a first process for executing a process for detecting tampering in the audited program and a second process for executing the audited program and being able to connect to the first process. Identification information acquisition, which is an audit device that executes the process, and inserts a command statement into the audit target program to acquire common identification information that can be acquired in the first process and the second process, respectively. The instruction insertion unit, the connection instruction insertion unit that inserts the instruction statement to be connected to the first process, and the connection instruction insertion unit that inserts the instruction statement to be connected to the first process are connected to the beginning and end of the predetermined function included in the audit target program from the second process. In the first process, when it is determined that the identification information acquired in the first process and the identification information in the second process match, at least the address information at the beginning and the end of the function is acquired. When it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, a determination unit for stopping the processing of the second process is provided.

With such a configuration, the audited program is connected to the first process different from the second process in the audited program, thereby interrupting the second process and programming in the first process. Since the tampering can be detected, it is possible to prevent an unauthorized program from being executed in the audited program. Since the connected first process is a process executed by a program independent of the audited program, the risk of being directly attacked can be reduced. In addition, by using a judgment method that compares the addresses at the beginning and end of the function, it is possible to detect falsification with high accuracy.

In a preferred embodiment of the present invention, the identification information acquisition command insertion unit maps a specific file path specified in advance to the process space assigned to the second process, and identifies the start address corresponding to the file path. Insert a statement to be acquired as information.
With such a configuration, identification information that can be acquired in common in the first process and the second process and has randomness can be acquired.

In a preferred embodiment of the present invention, when it is determined in the first process connected from the second process that the identification information acquired in the first process and the second process match. It is provided with an update unit that updates the address information acquired at the end of the function with the address information acquired at the beginning of the function.
With such a configuration, the address information at the end of the function is updated to the address information at the beginning of the function, so that it is possible to prevent the execution of program processing using the address information that has been tampered with illegally.

In the present invention, the computer executes a first process for executing a process for detecting tampering in the audit target program and a second process for executing the audit target program and being able to connect to the first process. The audit method includes an identification information acquisition command insertion step for inserting a command statement for acquiring common identification information that can be acquired in the first process and the second process into the audit target program, and the audit. A connection command insertion step for inserting a connection command statement to be connected to the first process at the beginning and end of a predetermined function included in the target program, and the first process connected from the second process. When it is determined that the identification information acquired in the first process and the identification information in the second process match, at least the address information at the beginning and the end of the function is acquired, and the beginning of the function. When it is determined that the address information in the above and the address information at the end of the function do not match, the computer executes a determination step of stopping the processing of the second process.

An audit program that operates a first process that executes a process for detecting tampering in an audit target program that operates a second process, and is a computer, the audit target program, the first process, and the second process. The first process is at the beginning and end of the identification information acquisition instruction insertion unit that inserts the instruction statement to acquire the common identification information that can be acquired in each of the processes, and the predetermined function included in the audit target program. In the connection command insertion unit that inserts the connection command statement to be connected to the second process, and the identification information acquired in the first process and the second process in the first process connected from the second process. When it is determined that they match, at least the address information at the beginning and the end of the function is acquired, and when it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, the above It functions as a determination unit for stopping the processing of the second process.

An audit device that operates a first process that executes a process for detecting tampering in the audit target program, and a second process that executes the audit target program and can be connected to the first process by inter-process communication. An audit system including an audit target device to be operated, wherein the audit device causes the audit target program to acquire common identification information that can be acquired in the first process and the second process, respectively. The identification information acquisition command insertion section for inserting the above, the connection command insertion section for inserting the instruction statement to be connected to the first process at the beginning and the end of the predetermined function included in the audit target program, and the first. In the first process connected from the second process, when it is determined that the identification information acquired in the first process and the second process match, at the beginning and the end of the function. When at least the address information is acquired and it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, a determination unit for stopping the processing of the second process is provided.

INDUSTRIAL APPLICABILITY According to the present invention, it is possible to provide an audit device, an audit method, an audit program, and an audit system that prevent the execution of an unauthorized program tampered with by an attack utilizing a software vulnerability.

An example of the hardware configuration of the audit device according to the embodiment of the present invention is shown. The processing flowchart of the identification information acquisition command insertion part in embodiment of this invention is shown. The processing flowchart of the connection command insertion part in the Embodiment of this invention is shown. In the embodiment of the present invention, the processing of the connection command insertion portion at the beginning of the function is shown. In the embodiment of the present invention, the processing of the connection command insertion portion at the end of the function is shown. The processing flowchart of the 1st process in embodiment of this invention is shown. An example of the stack in the embodiment of the present invention is shown.

Hereinafter, the auditing apparatus according to the embodiment of the present invention will be described with reference to the drawings. The embodiments shown below are examples of the present invention, and the present invention is not limited to the following embodiments, and various configurations can be adopted.

In the present embodiment, the configuration, operation, and the like of the audit device will be described, but an audit method, an audit program, an audit program recording medium, an audit system, and the like having the same configuration can also exert the same effects. By using this audit program recording medium, for example, the above-mentioned audit program can be installed on a computer. The series of processes according to the present embodiment described below are provided as a program that can be executed by a computer, and can be provided via a non-temporary computer-readable recording medium such as a CD-ROM or a flexible disk, and further via a communication line. ..

A buffer overflow is data outside the adjacent buffer area when data is written in excess of the upper limit of the buffer area reserved for storing data, for example, when copying a character string to a variable in a program. Is overwritten.

A buffer overflow attack that intentionally causes this buffer overflow causes a malicious program to be executed by rewriting the return address stored outside the buffer area. For example, if a buffer overflow occurs due to the data input as the operand of the function in the program, the return address is rewritten before and after the execution of the function.

In the present embodiment, the audit device 1 acquires the return address before and after the execution of the function by inserting an instruction for acquiring the respective return addresses at the beginning and the end of the function included in the audit target program. Further, by determining whether or not the acquired return addresses match, it is possible to detect unauthorized rewriting of the program. As will be described in detail later, in the first process, the determination of the beginning and the end of the function of the second process is performed by the combination of the specific system call number and the identification information. As a result, even if the same system call number is used in the logic of the function body, it can be determined that it is not the beginning and end of the function unless the identification information matches, and false positives are detected. Can be significantly reduced.

As shown in FIG. 1, the audit device 1 in the present embodiment has, as hardware components, an arithmetic unit (CPU) 101, a main storage device (RAM) 102, an input device 103, a display device 104, a communication device 105, and the like. Auxiliary storage device 110 and the like are provided. Further, the auxiliary storage device 110 stores an operating system (OS) 111, an audit program 112 that cooperates with the OS 111 to exert its function, an audit target program 113, various data, and the like. The audit target program 113 may be stored in an auxiliary storage device of an audit target device (not shown) configured to enable data communication with the audit device 1. Further, the CPU 101 includes a plurality of registers 106 as a temporary storage circuit. In this embodiment, an example will be described in which the CPU 101 is an ARM processor and the registers 106 are 16 32-bit registers r0 to r15. Although the OS 111 is an example of Linux (registered trademark) in the present embodiment, it may be another OS capable of acquiring a memory map.

In the present embodiment, the audit program 112 causes the CPU 101 to execute a first process including an insertion process of each instruction statement and a falsification determination process. The audit target program 113 is a program that is a target for determining whether or not the program has been tampered with, and causes the CPU 101 to execute a second process including a series of processes described by the source code. The second process is generated as a child process of the first process. Further, in the present embodiment, the interprocess communication performed between the first process and the second process will be described as an example of local communication performed in the same audit device 1, but the first process and the same. The second process may be executed on different computers and configured as a system for data communication via a network. Further, in the following description, the intervention of the CPU 101 will be omitted unless it is unclear.

In the present embodiment, the audit target program 113 will be described in an example described in C language, but may be described in another language capable of memory operation. Further, in the present embodiment, the audit program 112 is described in assembly language. In the present embodiment, the process in the audit program 112 is executed as the first process, and the process space is secured on the memory of the RAM 102. In the process of the audit target program 113, a different process space is allocated. The process space refers to a virtual address space assigned to each process by the processing of the OS 111 by the CPU 101 in the address space. The address space is a memory space that can be accessed by a memory address. Each process has its own process ID as a unique identifier.

The audit device 1 includes an identification information acquisition command insertion unit 201, a connection command insertion unit 202, a determination unit 203, and an update unit 204 as functional components. In the present embodiment, the identification information acquisition command insertion unit 201 and the connection command insertion unit 202 execute preprocessing before the execution file of the application program in the audit target program 113 is executed. In the present embodiment, the instruction statement inserted by the identification information acquisition instruction insertion unit 201 and the connection instruction insertion unit 202 is composed of one or more codes.

First, the pretreatment in the present embodiment will be described. The preprocessing is executed for the audit target program 113. FIG. 2 is a flowchart showing a flow of a process in which the identification information acquisition command insertion unit 201 inserts an instruction statement for acquiring identification information into the audit target program 113 in the audit device 1.

The audit device 1 reads the source program of the audit target program 113 in order from the beginning to the end (step S101). The identification information acquisition command insertion unit 201 determines the beginning of the function of the read source program (step S102). In the present embodiment, the determination function is a main function. When the beginning of the function is determined (Y in step S102), the identification information acquisition command insertion unit 201 inserts a static variable declaration statement for storing the identification information at the beginning of the function (step). S103). As a result, a memory area for storing the identification information acquired later is secured. The identification information acquisition command insertion unit 201 inserts a command statement for mapping a specific file path specified in advance to the process space assigned to the second process (step S104). For example, the mmap function can be used as the mapping statement. The memory map mapped to the process space by executing the above-mentioned statement refers to a file that maps the information of the data structure indicating the process state in the OS kernel, and exists for each process identified by the process ID. The memory map shows the start address and end address of each area of the process space, the file path, and the like. The identification information acquisition command insertion unit 201 acquires a corresponding start address (start address) as identification information based on a specific mapped file path, and stores an instruction statement to be stored in a static variable declared in step S103. Insert (step S105). For example, assuming that the process ID of the second process is PID2, the file executed in the second process has a file path of /var/bin/PID2.bin. The identification information acquisition command insertion unit 201 inserts a command statement for acquiring the start address corresponding to the file path including the PID 2 specified in advance. The identification information acquisition command insertion unit 201 may insert a command statement to acquire the end address as identification information instead of the start address. When the audit device 1 executes the process up to step S105, it reads the next code (step S106) and repeats the process from step S102 to step S105 until the end of the source program.

By executing the audit target program 113 into which each instruction statement is inserted by the processes from step S101 to step S106, the audit device 1 can acquire the identification information in the second process. Further, since the identification information acquired in the present embodiment is specified by the process ID of the second process, common identification information can be acquired by the same method in the first process, which is the parent process. Furthermore, it is characterized by having randomness. If the identification information has the above-mentioned characteristics, the identification information may be acquired by a method different from that of the present embodiment. For example, in the first process, the common identification information is received in advance by the second process. Various methods can be adopted, such as executing the process of passing. At this time, it is preferable that the identification information uses a fixed value of a predetermined odd number instead of an even number used as a memory address in the process space.

Examples of different embodiments of the process for acquiring the identification information will be described. In different embodiments, the identification information is a hash value of the process ID (PID2) of the second process. The identification information acquisition command insertion unit 201 inserts a command statement for acquiring PID 2 after inserting a static variable declaration statement in step S103. Further, the identification information acquisition command insertion unit 201 inserts an instruction statement for inputting the acquired PID 2 as an argument to the hash function. The identification information acquisition instruction insertion unit 201 acquires the hash value obtained as the return value of the above-mentioned hash function as identification information, and inserts an instruction statement to be stored in the static variable declared in step S103. By executing these inserted statements, the auditing apparatus 1 can acquire the identification information in the second process. The character string of the hash value may have an arbitrary length, but it is preferably about 8 characters (32 bits) from the viewpoint of the amount of data and the strength.

FIG. 3 shows a process of inserting a command statement indicating a process for connecting the connection command insertion unit 202 in the audit device 1 to the audit target program 113 to connect to the first process for detecting tampering in the audit target program 113. It is a flowchart which shows the flow.

The audit device 1 reads the source file storage directory of the audit target program 113 from the beginning (step S201), and reads the source file stored in the directory from the beginning of the directory (step S202). The audit device 1 converts the source code written in the high-level language into assembly code (step S203), and reads the converted assembly code from the beginning (step S204). The connection command insertion unit 202 determines the beginning of the function in the read assembly code (step S205). When the beginning of the function is determined (Y in step S205), the connection instruction insertion unit 202 inserts an instruction statement that executes a process of connecting to the first process in the audit program 112 (step S206). The connection instruction insertion unit 202 determines the end of the function in the assembly code (step S207). When the end of the function is determined (Y in step S207), the connection instruction insertion unit 202 inserts an instruction statement that executes a process for connecting to the first process of the audit program 112 (step S208).

In the present embodiment, a detailed process (step S206) for inserting a command statement at the beginning of the function will be described with reference to FIG. FIG. 4A shows a flowchart regarding the subsequent processing when the beginning of the function is determined in step S205. FIG. 4B shows an example of a statement to be inserted at the beginning and the beginning of a function. The connection command insertion unit 202 receives the designation of the predetermined code C1 indicating the beginning of the function in advance, and inserts the code C2 (command statement) in the next line where the code C1 is determined. The code C3 is a code including an instruction for storing the return address on the stack, and the code C1 may be any code as long as it is a code described in a line above the code C3. The code C2 in FIG. 4B shows only a part of the instruction statement.

First, the connection instruction insertion unit 202 inserts an instruction statement for pushing data stored in a predetermined register 106 (r0, r1, r7, r9, r10) (step S301). Push refers to the process of temporarily stacking data in the stack area. By executing the statement inserted in step S301, the information stored in the register required for the main body processing of the function can be saved in the stack. The connection instruction insertion unit 202 inserts an instruction statement to be stored in the register r9 with the position of the link register (ll) in which the return address is stored as the stack storage order when the code C3 is executed (step S302). FIG. 7A shows an example of a stack that is stored by executing the code C3. The frame pointer (fp) is a register indicating a specific position in the frame, and in FIG. 7A, it indicates a position (0) that is a reference of the stack storage order. The connection instruction insertion unit 202 acquires an address of the static variable for storing the identification information declared in step S103 (step S303), and inserts an instruction statement to load the result of referring to the address acquired in step S303 into the register r10. (Step S304). The connection instruction insertion unit 202 inserts a connection instruction statement including a call number indicating the beginning of the function (# 199 in the example of FIG. 4B) (step S305). By executing the inserted connection instruction, the process is passed from the second process to the first process. The connection command insertion unit 202 inserts a command statement to pop the register 106 pushed in step S301 (step S306), and completes the process. Pop refers to the process of fetching stacked data in order. As a result, the register information required by the function body can be restored.

By executing the statement inserted in steps S301 to S306, the process of storing the return address at the beginning of the function executed in the second process in a predetermined register and connecting to the first process is performed. Will be executed. In the present embodiment, by executing these instruction statements, a series of data stored in the register 106 in the second process is defined as register information.

In the present embodiment, a detailed process (step S208) for inserting an instruction statement at the end of the function will be described with reference to FIG. FIG. 5A shows a flowchart regarding the subsequent processing when the end of the function is determined in step S207. FIG. 5B shows an example of a statement to be inserted at the end and the end of a function. The code (C4-C6) indicates the end code of the function corresponding to the code (C1-C3) in FIG. 4 (b).

The connection instruction insertion unit 202 inserts an instruction statement for saving the data stored in the register r0, which is the return value of the function, to the register r9 (step S401). The connection instruction insertion unit 202 acquires the address of the static variable for storing the identification information declared in step S103 (step S402), and inserts an instruction statement to load the result of referring to the address into the register r10 (step). S403). The connection instruction insertion unit 202 inserts a connection instruction statement including a call number indicating the end of the function (# 200 in the example of FIG. 5B) (step S404), and completes the process. By executing the statement inserted in steps S401 to S404, the return address at the end of the function executed in the second process can be passed to the first process.

In the present embodiment, the connection statement inserted in step S305 and step S404 described above is a statement including a system call function, and when executed, a system call is made from the second process to the first process. Defines a series of processes used to pass processes. As the system call function, any reference function such as "getuid", "getpid", "getgid", etc., which does not affect the logic of the function body can be adopted.

By the preprocessing shown above, the audit device 1 inserts various instructions into the audit target program 113, and the audit target program 113 executes the inserted instructions to form the beginning and end of the function. It was converted into a program that can pass the process to the first process at a given point. Subsequently, with reference to FIG. 6, the processing of the first process in the audit program 112 and the processing of the second process in the converted audit target program 113 will be described.

First, the audit device 1 acquires the identification information in the first process (step S501). Specifically, the audit device 1 acquires the start command of the audit target program 113 specified by the argument, and further acquires the process ID of the second process in the audit target program 113 by executing the ps command. .. Subsequently, the audit device 1 can acquire the start address corresponding to the specific file path having the process ID as the identification information by referring to the memory map of the acquired process ID. As a result, the identification information common to the identification information acquired in the second process is acquired in the first process. In the embodiment in which the hash value is used as the identification information, the audit device 1 is obtained as a return value by inputting the acquired process ID (PID2) of the second process as an argument of the common hash function. The hash value can be acquired as identification information.

After acquiring the identification information, the audit device 1 connects to the second process (audit target program 113) and hands over the process (step S502). In the second process, the audit device 1 executes the instruction statement inserted in the preprocessing, acquires the identification information, and stores the identification information in the static variable for storing the identification information. In the second process, the audit device 1 connects to the first process by the connection instruction inserted at the beginning of the function. As a result, the processing of the second process can be interrupted by the first process immediately before the second process makes a system call. That is, it is possible to perform an audit before an illegal process is executed.

The audit device 1 confirms that the system call by the connection instruction inserted in the second process has been executed in the first process (step S503), and the call number included in the connection instruction is the beginning of the function. It is determined whether or not the call number indicates a unit (step S504). When the audit device 1 determines that the call number indicates the beginning of the function (Y in step S504), the audit device 1 acquires the register information stored in the register 106 in the second process (step S505). The auditing apparatus 1 determines whether or not the identification information acquired in the first process in step S501 and the identification information included in the register information acquired in the second process in step S505 match (. Step S506). When it is determined that the identification information matches (Y in step S506), the auditing apparatus 1 stores the data stored in the predetermined register 106 as an original stack (step S507). As shown in FIG. 7B, the data stacked at this time includes at least the stack storage order (r9), the frame pointer (fp), and the return address (ll). As a result, the first process can temporarily store the return address at the beginning of the function in the audit target program 113 as a link register (ll) in the first process. In the following step S508, the audit device 1 determines that the call number does not indicate the end of the function (N in step S508), and resumes the original processing of the second process interrupted by the system call (step S603). ..

The second process that has resumed processing suspends processing again by the first process by executing the connection statement inserted at the end of the function. The second connection instruction includes a call number indicating the end of the function, and the auditing apparatus 1 determines in step S508 that the call number indicates the end of the function (Y in step S508), and the second is Acquires the register information stored in the register 106 in the process up to the end of the function of the process (step S509). Similar to step S506, when the audit device 1 determines that the identification information matches (step S510), the audit device 1 acquires the data (stack storage order, frame pointer, return address) temporarily stored in the original stack in step S507. (Step S511). Here, the return address at the end of the function acquired as register information in step S509 is referred to as address information A1, and the return address at the beginning of the function acquired in step S511 is referred to as address information A2. The determination unit 203 acquires the address information A1 and the address information A2, respectively, determines whether or not the address information matches (step S512), continues the process if they match, and stops the process if they do not match. Let me.

Subsequently, the details of the determination process (step S512) by the determination unit 203 will be described. The determination unit 203 acquires a predetermined amount of data from the address stored in the stack pointer of the register 106 (step S601). The stack pointer indicates the top address of the stack area. The determination unit 203 calculates the offset from the stack pointer to the link register in which the return address is stored by integrating, for example, the data for one word and the stack storage order stored in the stack area (step). S602). As a result, the offset of the return address is calculated. The determination unit 203 acquires data of a predetermined amount of data (for example, one word) from the position of the offset based on the calculated offset (step S603). The retrieved data contains the return address at the end of the function. The determination unit 203 determines whether or not the return address (address information A2) at the beginning of the function acquired in step S511 and the return address (address information A1) at the end of the function acquired in step S603 match. Determination (step S604). If the return addresses do not match (N in step S604), the determination unit 203 determines that the return address has been tampered with, and stops the processing of the program by the second process (step S605). When the return addresses match (Y in step S604), the determination unit 203 determines that the return addresses have not been tampered with, and continues the processing of the program by the second process (step S606).

An embodiment of the determination process in step S512 will be described. When the audit device 1 acquires data from the original stack in step S511, the update unit 204 updates the data stored in the register 106 in the second process based on the data stored in the original stack. FIG. 7C shows an outline of data update of the register 106 in this embodiment. The update unit 204 updates the return address of the original stack to the program counter pc of the first process, and the frame pointer of the original stack to the register sp of the first process that stores the stack pointer. As a result, even if the return address is falsified in the processing from the beginning to the end of the function, the return address is updated to the return address before the falsification, so that it is possible to prevent an invalid program from being executed.

Further, different embodiments of the determination process in step S604 will be described. In a different embodiment, the update unit 204 updates the data stored in the stack at the end of the function with the data stored as its own stack at the beginning of the function, as shown in FIG. 7 (d). Specifically, the update unit 204 calculates a value obtained by integrating the value stored in the stack pointer (sp) of the first process and the offset calculated in step S602. The update unit 204 updates the address of the calculated value with the return address of the original stack, and updates the address of "calculated value-1 word" with the frame pointer of the original stack. As a result, even if the return address is tampered with between the beginning and the end of the function, it is updated to the return address before the tampering, so that it is possible to prevent an unauthorized program from being executed.

In the present embodiment, the audit program 112 is configured to be able to execute a pre-process for inserting an instruction statement into the audit target program 113 and a process for detecting alteration of the audit target program 113 (steps S501-step S512). However, the above-mentioned two processes may be configured to be installed in the audit device 1 as a pre-process program for executing the pre-process and a detection process program for executing the process for detecting tampering, respectively.

1 Audit device 101 Arithmetic logic unit (CPU)
102 Main memory (RAM)
103 Input device 104 Display device 105 Communication device 106 Register 110 Auxiliary storage device 111 Operating system (OS)
112 Audit program 113 Audit target program 201 Identification information acquisition command insertion section 202 Connection command insertion section 203 Judgment section 204 Update section

Claims (6)

An audit device that executes a first process that executes a process for detecting tampering in an audit target program, and a second process that executes the audit target program and can be connected to the first process.
An identification information acquisition command insertion unit that inserts an instruction statement for acquiring common identification information that can be acquired in each of the first process and the second process into the audit target program.
At the beginning and end of a predetermined function included in the audit target program, a connection instruction insertion unit that inserts an instruction statement to be connected to the first process, and a connection instruction insertion unit.
In the first process connected from the second process, when it is determined that the identification information acquired in the first process and the second process match, the beginning and the end of the function. When at least the address information in the unit is acquired and it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, a determination unit for stopping the processing of the second process is provided. Audit device. The identification information acquisition command insertion unit maps a specific file path specified in advance to the process space assigned to the second process, and obtains a command statement corresponding to the file path as the identification information. The audit device according to claim 1 to be inserted. When it is determined in the first process connected from the second process that the identification information acquired in the first process and the second process match, it is acquired at the end of the function. The audit device according to claim 1 or 2, further comprising an update unit that updates the address information to be updated with the address information acquired at the beginning of the function. It is an audit method in which a computer executes a first process that executes a process for detecting tampering in the audit target program and a second process that executes the audit target program and can be connected to the first process. hand,
An identification information acquisition command insertion step for inserting into the audit target program a statement for acquiring common identification information that can be acquired in the first process and the second process, respectively.
A connection instruction insertion step for inserting a connection instruction statement to be connected to the first process at the beginning and end of a predetermined function included in the audit target program.
When it is determined in the first process connected from the second process that the identification information acquired in the first process and the second process match, the beginning and the end of the function. When at least the address information in the unit is acquired and it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, a determination step of stopping the processing of the second process is performed by the computer. The audit method that is performed. It is an audit program that operates the first process that executes the process of detecting falsification in the audited program that operates the second process.
An identification information acquisition command insertion unit that inserts a statement into the audit target program to acquire common identification information that can be acquired in the first process and the second process, respectively.
A connection instruction insertion unit that inserts a connection instruction statement to be connected to the first process at the beginning and end of a predetermined function included in the audit target program.
When it is determined in the first process connected from the second process that the identification information acquired in the first process and the second process match, the beginning and the end of the function. When at least the address information in the unit is acquired and it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, the function as a determination unit for stopping the processing of the second process. An audit program to let you. An audit device that operates a first process that executes a process for detecting tampering in the audit target program, and a second process that executes the audit target program and can be connected to the first process by interprocess communication. It is an audit system equipped with an audit target device to be operated.
The audit device includes an identification information acquisition command insertion unit that inserts an instruction statement for acquiring common identification information that can be acquired in the first process and the second process into the audit target program.
At the beginning and end of a predetermined function included in the audit target program, a connection instruction insertion unit that inserts an instruction statement to be connected to the first process, and a connection instruction insertion unit.
In the first process connected from the second process, when it is determined that the identification information acquired in the first process and the second process match, the beginning and the end of the function. When at least the address information in the unit is acquired and it is determined that the address information at the beginning of the function and the address information at the end of the function do not match, a determination unit for stopping the processing of the second process is provided. Audit system.

Images