WO2020136793A1 - Information processing device, information processing method, and information processing program - Google Patents

Abstract

According to the present invention, a variable discerning unit (22) discerns the respective types of a plurality of variables included in a program executed by an apparatus. A candidate generation unit (23) compares the respective types of the plurality of variables discerned by the variable discerning unit (22) with the respective types of a plurality of information assets used by the apparatus, and generates one or more candidates for the correspondence relationship between each of the plurality of information assets and each of the plurality of variables.

Description

Information processing apparatus, information processing method, and information processing program

The present invention relates to vulnerability analysis.

In the development process that considers security, in order to prevent the creation of vulnerabilities, which are security problems, analyze and consider security from the upstream stage of development. First, in the upstream development phase of system design, etc., a threat analysis is performed to identify threats that should not occur in the development target system (for example, threats such as eavesdropping on confidential information flowing through communication channels are identified. ). Then, based on the result of the threat analysis, the policy of measures for preventing the threat is examined (for example, it is necessary to encrypt the communication path). When the development phase further progresses to the stage of design and implementation, the security function and operation method suitable for the concrete implementation method of the processing content for realizing the development target system and the program for realizing the processing content are examined. Then, incorporate the examination results into the design and implementation. At the final stage of design and implementation, analysis is performed to confirm whether the designed and implemented program is vulnerable.

As one of the methods for realizing a vulnerability analysis device that confirms whether or not there is a vulnerability, there is a technique for statically analyzing the specifications of the designed and implemented program or the program itself.
A conventional vulnerability analysis device analyzes a source code of a program using an analysis technique such as pollution analysis according to a predetermined rule (for example, Patent Document 1).
In addition, a method has been proposed in which the specifications of a program are formally described by a model, and a mathematical method is used to mathematically prove whether the behavior of the program satisfies the property of generating a vulnerability (eg, model checking). , Patent Document 2).

Japanese Patent No. 5740702 Japanese Patent Laid-Open No. 2008-262311

In the method of Patent Document 1, the source code of the program is analyzed according to a predetermined rule. For this reason, it is not possible to confirm vulnerabilities due to omissions or errors in the design and implementation of security measures that were examined after the threat analysis performed in the upstream process.
In addition, with the method of Patent Document 2, verification is possible by defining or selecting the property of the object to be proved. To correctly define or select the nature of the object to be proved, it is necessary to understand the details of what the design and implementation specifications should be correct. However, the threat analysis is conducted in the upstream development phase where the design and implementation specifications are undecided. Therefore, it is extremely troublesome to associate the threat analysis result with the specifications for designing and implementing the program to define or select the nature of the object to be proved. Further, in the method of statically analyzing the specifications of the program, if the entire program is analyzed, a large amount of computer resources such as memory are required and the calculation time becomes long.

In order to efficiently perform vulnerability analysis, the relationship between the part in the program (the program executed by the device) containing the security measures after the threat analysis in the upstream process and the information assets used by the device, It is useful to clarify the relationship between device information assets and vulnerabilities.
From such a point of view, the present invention mainly aims to contribute to the clarification of the correspondence relationship between the part in the program, the information asset, and the vulnerability.

The information processing apparatus according to the present invention is
A variable discrimination unit that discriminates each type of a plurality of variables included in the program executed by the device,
Each type of the plurality of variables discriminated by the variable discriminating unit is compared with each type of the plurality of information assets used by the device, and each of the plurality of information assets and each of the plurality of variables are compared. And a candidate generation unit that generates one or more candidates for the correspondence relationship.

According to the present invention, a candidate for a correspondence relationship between a variable included in a program executed by a device and an information asset used by the device is generated. Can contribute to.

The figure which shows the structural example of the vulnerability analysis apparatus which concerns on Embodiment 1. 3 is a flowchart showing an operation example of the vulnerability analysis device according to the first embodiment. The figure which shows the example of the information asset flow regarding the controller which concerns on Embodiment 1. FIG. 3 is a diagram showing an example of program specifications according to the first embodiment. FIG. 3 is a diagram showing an example of a correspondence relationship between the constituent elements and the program specifications according to the first embodiment. FIG. 5 is a diagram showing an example of a threat analysis result according to the first embodiment. 5 is a flowchart showing an operation example of the variable discrimination unit according to the first embodiment. The figure which shows the example of process classification DB which concerns on Embodiment 1. FIG. 5 is a diagram showing an example of a program variable processing relationship according to the first embodiment. The figure which shows the example of the information asset-variable correspondence relationship candidate which concerns on Embodiment 1. FIG. 6 is a diagram showing an example of an operation of extracting a related threat list according to the first embodiment. The figure which shows the example of the related threat list which concerns on Embodiment 1. FIG. 3 is a diagram showing an example of a threat-vulnerability type correspondence DB according to the first embodiment. The figure which shows the example of the vulnerability classification candidate which concerns on Embodiment 1. The figure which shows the example of the vulnerability detection result which concerns on Embodiment 1. The figure which shows the structural example of the vulnerability analysis apparatus which concerns on Embodiment 2.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the following description of the embodiments and the drawings, the same reference numerals denote the same or corresponding parts.

Embodiment 1.
***Composition explanation***
The configuration of the vulnerability analysis device 10 according to the first embodiment will be described with reference to FIG.
The vulnerability analysis device 10 corresponds to an information processing device.

The vulnerability analysis device 10 is a computer. The vulnerability analysis device 10 includes hardware such as a processor 11, a memory 12, a storage 13, and a communication interface 14. The pro processor 11 and other hardware are connected via a signal line, and the processor 11 controls these other hardware.

The processor 11 is an IC (Integrated Circuit) that performs processing. As a specific example, the processor 11 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit). In FIG. 1, only one processor 11 is shown. However, a plurality of processors 11 may be provided, and the plurality of processors 11 may execute programs that implement respective functions in cooperation with each other.

The memory 12 is a storage device that temporarily stores data for the processing of the processor 11. The memory 12 is, for example, an SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory).

The storage 13 is a storage device that stores data. The storage 13 is, as a specific example, a HDD (Hard Disk Drive). Further, the storage 13 may be SSD (Solid State Drive). The storage 13 is an SD (registered trademark, Secure Digital) memory card, CF (CompactFlash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital Versatile Disk). It may be a portable recording medium.

The communication interface 14 is an interface for communicating with an external device. The communication interface 14 is, as a specific example, an Ethernet (registered trademark), a USB (Universal Serial Bus), or an HDMI (registered trademark, High-Definition Multimedia Interface) port.

The vulnerability analysis device 10 has, as functional components, a first acceptance unit 21, a variable determination unit 22, a candidate generation unit 23, a second acceptance unit 24, a related threat extraction unit 25, a vulnerability candidate extraction unit 26, and a vulnerability. The sex analysis unit 27 is provided. The second reception unit 24 corresponds to the output unit.
The function of each functional component of the vulnerability analysis device 10 is realized by a program.

A program that realizes the function of each functional component of the vulnerability analysis device 10 is stored in the storage 13. This program is read into the memory 12 by the processor 11 and executed by the processor 11. As a result, the function of each functional component of the vulnerability analysis device 10 is realized.

The function of each functional component of the vulnerability analysis apparatus 10 may read information that determines the operation of analysis performed by the program and information that determines the determination condition from a database or setting file stored in the storage 13. Further, the information that determines the analysis operation and the information that determines the determination condition may be part of the program. For example, in the present embodiment, the variable discrimination unit 22 reads the processing type DB 31 and changes the analysis operation. Further, the vulnerability candidate extraction unit 26 reads the threat-vulnerability correspondence DB 32 and changes the analysis operation.

In addition, in FIG. 1, the structure with only one vulnerability analysis apparatus 10 was illustrated. Alternatively, a plurality of computers may be connected via a network, and the plurality of computers may cooperate to form a vulnerability analysis system.
Further, in FIG. 1, it is assumed that an input/output device for the user to input and output to the vulnerability analysis device 10 is connected via the communication interface 14. Instead of this, the vulnerability analysis apparatus 10 may be provided with an interface for inputting and outputting, and the vulnerability analysis apparatus 10 may be directly operated by the user.

***Description of operation***
The operation of the vulnerability analysis device 10 according to the first embodiment will be described with reference to FIGS. 2 to 15. The operation of the vulnerability analysis device 10 described below corresponds to an information processing method and an information processing program.

FIG. 2 is a flowchart showing the overall operation of the vulnerability analysis device 10 according to the first embodiment.

First, the 1st reception part 21 receives the input of various information required for analysis (step S1).
In step S1, the first reception unit 21 causes the information asset flow 41 (FIG. 3), the program specification 42 (FIG. 4), the correspondence relationship 43 between constituent elements and program specifications 43 (FIG. 5), and the threat analysis result 44 (described below). 6) is accepted.

Further, the variable discriminating unit 22 extracts a variable included in the program represented by the program specification 42 and discriminates the type of the extracted variable (step S2).
As will be described later, the program specification 42 is information (flow chart, UML (Unified Modeling Language)) or SysML activity diagram or sequence diagram in which a program (source code) to be executed by the development target device or characteristics of the program is described. ).
The variable determination unit 22 determines, as the type of the extracted variable, whether the extracted variable is an input variable, an output variable, or an internally used variable.

Next, the candidate generation unit 23 generates a candidate for the correspondence relationship between the information asset and the variable (step S3).
The candidate generation unit 23 compares the type of the variable determined by the variable determination unit 22 with the type of the information asset used by the device, and generates one or more candidates for the correspondence relationship between the information asset and the variable.
In the present specification, the information asset is information determined to be used by a component (device) by threat analysis. Specifically, the information assets of the constituent elements (devices) are described in the information asset flow 41 (FIG. 3).
The types of information assets include input information assets that are information assets that are input to the device, output information assets that are information assets that are output from the device to the outside of the device, and internal use that is information assets that are used inside the device. We have information assets.
The candidate generation unit 23 associates the input information assets with the input variables, the output information assets with the output variables, and the internal usage information assets with the internal usage variables to generate candidates for the correspondence relationship.

When there are a plurality of correspondence relationship candidates, the second reception unit 24 outputs a plurality of correspondence relationship candidates. Then, the second reception unit 24 receives the selection of the correspondence relationship by the user of the vulnerability analysis device 10 (step S4).
That is, the second accepting unit 24 displays a plurality of correspondence relationship candidates on, for example, the input/output device, and the user of the vulnerability analysis apparatus 10 applies the corresponding correspondence relationship from among the displayed plurality of correspondence relationship candidates. Select. Then, the second reception unit 24 receives the selection from the user.

Next, the related threat extracting unit 25 extracts the related threat based on the correspondence between the information asset and the variable (step S5).
That is, when only one candidate for the correspondence relationship is generated in step S3, the related threat extraction unit 25 extracts the related threat based on the candidate for the correspondence relationship generated for only one. On the other hand, when a plurality of correspondence relationship candidates are generated in step S3 and the selection of the correspondence relationship in step S4 is accepted, the related threat is extracted based on the correspondence relationship selected in step S4.
Specifically, the related threat extraction unit 25 extracts a related threat from the threat analysis result 44 (FIG. 6) received in step S1.

Next, the vulnerability candidate extraction unit 26 extracts candidates for the types of vulnerabilities that may be used in attacks leading to related threats (step S6).

Finally, the vulnerability analysis unit 27 performs a vulnerability analysis to check whether a candidate for the type of vulnerability may occur in the description of the program specification 42, and outputs the analysis result (step S7).

Next, the operation of each step in FIG. 2 will be sequentially explained.

(Step S1 of FIG. 2: first reception process)
The first reception unit 21 has an information asset flow 41 (FIG. 3), a program specification 42 (FIG. 4), a correspondence relationship 43 between constituent elements and program specifications 43 (FIG. 5), and a threat analysis result 44 (FIG. 6). And accept.

Specifically, the user operates the input/output device connected via the communication interface 14. By the operation of the user, the information asset flow 41, the program specification 42, the correspondence 43 between the constituent elements and the program specification, and the threat analysis result 44 are input. Then, the first reception unit 21 receives the information asset flow 41 input via the communication interface 14, the program specification 42, the correspondence relationship 43 between the component and the program specification, and the threat analysis result 44.
Further, the first reception unit 21 writes the information asset flow 41, the program specification 42, the correspondence relationship 43 between the component and the program specification, and the threat analysis result 44 in the memory 12, respectively.

An example of the information asset flow 41 will be described with reference to FIG.

The information asset flow 41 is obtained by organizing the flow (flow) of information assets after the threat analysis is performed. The information asset flow 41 is generated for each device included in the development target system.
In the information asset flow 41, a component 411 that is a component (device) that constitutes the development target system, a related element 412 that is a component (device) related to the component 411, and a component 411 and a related element 412. A connection relation 413 between the information asset, the information asset name 414, and the information asset type 415 are included.
As described above, the types of information assets are the input information assets, the output information assets, and the internal usage information assets. There may be types of information assets other than input information assets, output information assets, and internal use information assets.
The “input” is a flow of information assets input to the constituent element 411 from outside the constituent element 411. The “output” is a flow of information assets output from the component 411 to the outside of the component 411. “Internal use” is a flow of information assets used only inside the component 411.

Specifically, the information asset flow 41 can be represented by a diagram obtained by expanding the UML communication diagram as shown in FIG. In FIG. 3, a rectangle represents the constituent element 411 or the related element 412. The component 411 is a "controller" in the example of FIG. The related elements 412 are “HMI” and “device” in the example of FIG.
The connection relation 413 is represented by a solid line connecting the constituent element 411 and the related element 412.
Furthermore, in FIG. 3, an arrow is shown near the connection relation 413. These arrows represent the flow of information assets. The direction of the arrow represents the flow direction of information assets.
Also, a line whose starting point is a circle extends from the controller regardless of the connection relation 413. This line also represents the flow of information assets. This line indicates that there is no flow between the component 411 and the related element 412, that is, it is an internal use information asset.
The character string arranged near the flow line of the information asset is the name 414 of the information asset handled by the flow. The character string enclosed in <<>> is the information asset type 415. For example, the arrow from the HMI to the controller in FIG. 3 means that the information asset “command” flows from the “HMI” to the “controller”. Then, the arrow indicates that the type 415 of the information asset is “input” (input information asset) from the standpoint of “controller”. Also, a line with a round starting point extending from the "controller" indicates that the type 415 of the information asset "MAC key" is "internal use" (internal use information asset), that is, the information asset "MAC key" is inside the controller. It is used in.
The information asset flow 41 corresponds to information asset information.

Next, an example of the program specification 42 will be described with reference to FIG.

The program specification 42 includes a name 421 of a program to be subjected to vulnerability analysis, and a program processing content 422 that expresses a flow of data (data flow) and a flow of processing (control flow).
Specifically, the program specification 42 includes the logic that is the whole program or a part of the program executed by the device (corresponding to the component 411 of FIG. 3) included in the development target system after the threat analysis is performed. Described. The program specification 42 is described for each device included in the development target system.
In addition, the program specifications 42 may not be input to the vulnerability analysis device 10 for some devices and programs that are not subject to vulnerability analysis.

The program specification 42 is specifically a source code or a program model.
A program model is information that can describe the structure and operation of a program such as a flowchart, UML, and SysML in a diagram. The program model is, for example, a source code described in a programming language and a flowchart in which processing/judgment is described in a programming language format such as C language (m=n+1 or m=add(n,1)). The program model also corresponds to a UML or SysML activity diagram or sequence diagram, a DFD, a block diagram used in control engineering, and the like. The program model is described and stored in a data format capable of expressing a hierarchical structure so that the processor 11 (variable discriminating unit 22) can process its contents. The program model is described in a data format such as XML (Extensible Markup Language) and JSON (JavaScript (registered trademark) Object Notation). For example, FIG. 4 shows an example of the program specification 42 regarding the communication processing with the HMI of the component “controller”. In FIG. 4, a part of the operation content of the program operating in the controller is described in the form of a general C language source code.
The program name 421 is “PROGRAM_C.C”, and the program processing content 422 is C language description content. In the example of FIG. 4, the program name 421 is shown by the file name of the C language source code, but any format can be used as long as the vulnerability analysis device 10 can uniquely identify each program specification 42. good. The program name 421 is used in a correspondence relationship 43 between a constituent element and a program specification described later.

Next, with reference to FIG. 5, an example of the correspondence 43 between the constituent elements and the program specifications will be described.

The correspondence relationship 43 between the constituent element and the program specification shows the correspondence relationship between the constituent element 431 to be subjected to the vulnerability analysis and the program specification 432.
The correspondence 43 between the constituent elements and the program specifications can be expressed as a table as shown in FIG. 5, for example. In FIG. 5, there are two program specifications 42 to be inspected in the constituent element “controller”, which are “PROGRAM_CC” and “PROGRAM_DC”, respectively.

Next, an example of the threat analysis result 44 will be described with reference to FIG.

The threat analysis result 44 shows the result of the threat analysis on the development target system.
The threat analysis result 44 includes a threat 441, a component 442, related information assets 443, and a threat type 444.
The contents of the threat are shown in the threat 441.
The component element 442 indicates a component element or a connection relationship in which a threat occurs.
The related information assets 443 indicate information assets related to the threat.
The threat type 444 indicates the type of influence on the information asset when a threat occurs. The threat type 444 indicates, for example, one of C, I, and A that is generally used to indicate the attribute of information security. Note that C means confidentiality, I means integrity, and A means availability.
The threat analysis result 44 can be represented in a table format as shown in FIG. 6, for example. In the example of FIG. 6, in the record in the first row, “leakage by speculation” is shown as the threat 441, and “remote terminal”, which is the constituent element causing the threat, is shown as the constituent element 442, and related information assets A “password” related to leakage of guess is shown as 443, and “C” is shown as a threat type 444.

(Step S2 of FIG. 2: program variable processing relation analysis processing)
The variable discriminating unit 22 discriminates the type of the variable based on the process in which the variable included in the program specification 42 accepted in step S1 is used, and analyzes the propagation relation between the variables and the processing order.
More specifically, the variable determination unit 22 determines whether the process in which the variable is used is an input process, an output process, or an internal use process. The input process is a process of inputting a value from outside the device. The output process is a process of outputting a value to the outside of the device. The internal use process is a process of using a value inside the device. The variable determination unit 22 determines the type of variable based on the type of processing.
The propagation relationship between variables is a value propagation relationship within a program between variables.

FIG. 7 is a flowchart illustrating an operation example of the variable discrimination unit 22.

First, the variable discriminating unit 22 reads various information required for analysis from the memory 12 (step S21).

Next, the variable discriminating unit 22 extracts variables included in the program specification 42 (step S22).

Next, the variable determination unit 22 determines the type of the extracted variable (step S23).

Next, the variable discrimination unit 22 analyzes the propagation relation and processing order of each variable whose type has been discriminated (step S24).

Finally, the variable discrimination unit 22 writes the analysis result in the memory 12 (step S25).

Next, the details of steps S21 to S26 in FIG. 7 will be described.

<Details of Step S21 in FIG. 7>
In step S21, the variable determination unit 22 reads the process type DB 31 from the storage 13 and writes the process type DB 31 in the memory 12.
Next, the variable discrimination unit 22 reads out the information of the program specification 42 and the processing type DB 31 from the memory 12.
Here, the program specification 42 is the program specification 42 accepted in step S1.

An example of the processing type DB 31 will be described with reference to FIG.

The process type DB 31 includes a process name 311 and a process type 312.
The process name 311 indicates the name of the process included in the program specification 42.
The process type 312 indicates which of the input process, the output process, and the internal use process (security process) the process indicated by the process name 311 corresponds to. In FIG. 8, the input process is described as Input. The output process is described as Output. The internal use processing (security processing) is described as Security.
The process indicated by the process name 311 is a function, a method, or the like.
In the example of FIG. 8, for example, the processing type of the processing name receiveMessage is input processing (Input).

<Details of Step S22 in FIG. 7>
In step S22, the variable discrimination unit 22 extracts a variable from the program specifications 42 read in step S21. The variable extraction process differs depending on the description method of the program specification 42.
In the program specification 42 (source code) used in the description of this embodiment, the variables can be extracted by using the lexical analysis and syntax analysis techniques used by the compiler. In the case of descriptions other than the source code, the variable discrimination unit 22 also extracts variables according to the respective description rules.

<Details of Step S23 in FIG. 7>
In step S23, the variable determination unit 22 determines the type of each variable extracted in step S22.
The variable discriminating unit 22 checks whether or not each extracted variable is used in the processing of the function, method, etc. indicated by the processing name 311 of the processing type DB 31. “Used for processing” means that a variable is used as an argument of a function or method, or a variable is used as a return value of a function or method.
When the extracted variable is used in the process indicated by the process name 311, the variable determination unit 22 determines the variable type by the process type 312 of the target process. As described above, the variable discriminating unit 22 discriminates the type of variable based on the type of processing.
More specifically, for example, in the case where the program specification 42 is written in C language, if the processing type is “Input”, the variable determination unit 22 causes the return value or the argument of the address passing (reference passing argument). Variables used in (including) are determined as “input variables”. On the other hand, if the processing type is “Output”, the variable determination unit 22 determines that the variable used as the argument passed by value is the “output variable”. Further, the variable discriminator 22 discriminates the variable used as the argument passed by address into both the “input variable” and the “output variable”. Further, the variable discriminating unit 22 discriminates the variable used as the return value as the “input variable”. Furthermore, as a result of the above-described determinations for all variables, the variable determination unit 22 determines variables that are not determined to be of any type, and that are used in the conditional statement and the processing type is “Security”. The variable used as the argument or return value of the function is determined to be an "internal use variable".

For example, when the program specification 42 shown in FIG. 4 is analyzed by the above determination rule using the processing type DB 31 shown in FIG. 8, msg and len become “input variables”. Also, dev, val, and ret become “output variables”. Also, key and state become "internal use variables". Moreover, cmd is not classified into any.

Although not present in the example in Fig. 4, if two or more same variables can be distinguished as different types, each variable is treated separately. For example, when the same variable msg can be determined as a different variable type at a location different from the location where the variable msg is determined as an input variable, the variable determination unit 22 handles each as a different variable. Further, the variable discriminating unit 22 allows the same variable name to be distinguished. The variable discrimination unit 22 enables each variable to be uniquely identified in the format of variable name:line number, such as msg:12.

Further, in the above, the example in which the variable determination unit 22 determines the processing type of the variable using the information of the processing type DB 31 in step S23 has been described. The processing type may be determined based on the rule generated in advance as described above, or may be determined by the logic set in the variable determination unit 22.

Further, in the above, in the process of determining the variable type, the “input variable” or the “output variable” is determined according to how the variable is handled in the function or the process type assigned to the function in advance. Furthermore, in the above, a variable that satisfies a certain condition is determined to be an “internal use variable”. However, another rule may be used as the rule for determining the variable type.
Further, in the present embodiment, it is assumed that the above determination rule is stored inside the variable determination unit 22, but the determination rule may be stored in a file or a database. Also, the determination rule may be changed.

<Details of Step S24 in FIG. 7>
In step S24, the variable determination unit 22 analyzes the propagation relationship and processing order of each variable whose type can be determined in step S23. The propagation relationship is a data flow in which the value of a variable determined as an “input variable” propagates to another variable. The variable discriminating unit 22 can analyze the propagation relation from the substitution relation of variables as in the existing static code analysis.
For example, when the process type DB 31 shown in FIG. 8 is used for the program specification 42 shown in FIG. 4, the variable discrimination unit 22 obtains the propagation relation 453 shown in FIG.

<Details of Step S25 in FIG. 7>
In step S25, the variable discriminating unit 22 writes the results analyzed in steps S21 to S24 in the memory 12 as the program variable processing relation 45 (FIG. 9).

An example of the program variable processing relationship 45 will be described with reference to FIG.

The program variable processing relation 45 represents the analysis result of the variable discriminating unit 22 for the variable in the program specification 42.
The program variable processing relation 45 includes a variable type 451, a variable name 452, and a propagation relation 453.
The variable type 451 shows the variable type obtained by the analysis of the variable discriminating unit 22.
The variable name 452 shows the name of the variable.
As described above, the propagation relationship 453 shows the data flow (propagation relationship) in which the value of the variable determined as the “input variable” propagates to another variable.
In the example shown in FIG. 9, the variable type of the variable name msg is “input variable”. Further, from the propagation relation 453, the variable name msg is propagated to the output variables dev and val.

(Step S3 of FIG. 2: information property-variable correspondence estimation process)
The candidate generation unit 23 generates a candidate for the correspondence relationship between the information asset and the variable based on the information asset flow 41 input in step S1 and the program variable processing relationship 45 obtained in step S2.

Specifically, the candidate generator 23 reads the information asset flow 41 and the program variable processing relationship 45 from the memory 12.
Next, the candidate generation part 23 maps the “input” of the information asset flow 41 and the “input variable” of the program variable processing relation 45. Similarly, the candidate generation unit 23 maps the “output” of the information asset flow 41 and the “output variable” of the program variable processing relation 45. Further, the candidate generation unit 23 maps the “internal use” of the information asset flow 41 and the “internal use variable” of the program variable processing relation 45. In this way, the candidate generator 23 generates all combinations of information assets and variables of the program specifications 42.
Then, the candidate generation unit 23 writes the generated correspondence relationship candidates in the memory 12 as the information asset-variable correspondence relationship candidates 46.

An example of the information asset-variable correspondence relationship candidate 46 will be described with reference to FIG.

The information asset-variable correspondence relationship candidate 46 includes a candidate name 461, an input or internal use information asset 462, a variable name 463, a propagation relationship 464, and an output information asset 465.
In the example of FIG. 10, in the candidate 1, the command which is the input information asset is associated with the variables len and msg. Further, the value that is the input information asset is associated with the variable ans. The MAC key, which is an information asset for internal use, is associated with the variable key. Further, the instruction that is the output information asset is associated with the variables dev and val. The response, which is the output information asset, is associated with the variable ret.
The plurality of candidates shown in the information asset-variable correspondence candidate 46 are different from each other.

(Step S4 of FIG. 2: second reception process)
When the information asset-variable correspondence relationship candidates 46 (FIG. 10) generated in step S3 include a plurality of correspondence relationship candidates, the second reception unit 24 outputs the information asset-variable correspondence relationship candidates 46.
Then, the second reception unit 24 receives the selection of the correspondence relationship between the information asset and the variable selected by the user.

Specifically, the second reception unit 24 reads out the information asset-variable correspondence candidate 46 from the memory 12. When the information asset-variable correspondence relationship candidate 46 has a plurality of correspondence relationship candidates, the second reception unit 24 inputs the information asset-variable correspondence relationship candidate 46 via the communication interface 14. Send to output device.
Then, the information asset-variable correspondence candidate 46 is displayed on the input/output device. The user operates the input/output device to select the information asset-variable correspondence 47 from the information asset-variable correspondence candidates 46. The selected information asset-variable correspondence 47 is input to the second reception unit 24 via the communication interface 14. Then, the second receiving unit 24 receives the information asset-variable correspondence 47 input via the communication interface 14. Further, the second accepting unit 24 writes the accepted information asset-variable correspondence 47 in the memory 12. The information asset-variable correspondence relationship 47 is one of the correspondence relationship candidates included in the information asset-variable correspondence relationship candidate 46 in which the actual correspondence relationship between information assets and variables is shown.
As shown in FIG. 10, the information asset-variable correspondence relationship candidate 46 also includes a propagation relationship and a processing order. Therefore, the user can select the information asset-variable correspondence 47 in consideration of the propagation relation and the processing order.
Here, it is assumed that the candidate 1 of FIG. 10 is selected as the information asset-variable correspondence 47.
If the information asset-variable correspondence relationship candidate 46 has only one correspondence relationship candidate, step S4 is not performed, but the corresponding correspondence candidates included in the information asset-variable correspondence relationship candidate 46 are also as follows. Is referred to as information asset-variable correspondence 47.

(Step S5 of FIG. 2: Related threat extraction processing)
The related threat extraction unit 25 extracts a list of threats related to the program specification 42 as a related threat list 48 based on the information asset-variable correspondence 47. Note that the related threat list 48 is extracted for each program specification 42.

Specifically, the related threat extraction unit 25 reads the threat analysis result 44 (FIG. 6) and the correspondence 43 (FIG. 5) between the component and the program specification from the memory 12.
Then, the related threat extraction unit 25 sequentially processes each entry of the correspondence relationship 43 between the constituent element and the program specification, and creates the information asset flow 41 (FIG. 3) corresponding to the content of the constituent element 431 and the content of the program specification 432. The corresponding information asset-variable correspondence 47 is read from the memory.
Then, the related threat extraction unit 25 uses the information asset flow 41 and the information asset-variable correspondence 47 to extract the threat related to the program specification 42 from the threat analysis result 44 (FIG. 6) (see details in FIG. 11 will be used later).
Then, the related threat extraction unit 25 writes the extracted result as the related threat list 48 in the memory 12 in association with the processed program specification 42. The related threat extracting unit 25 performs these operations for all the entries of the correspondence 43 (FIG. 5) between the constituent elements and the program specifications.

The related threat extraction unit 25 extracts a related threat by the operation shown in FIG. 11, for example.

First, the related threat extraction unit 25 searches the threat analysis result 44 (FIG. 6) for an entry in which the description content of the constituent element 431 of the correspondence relationship 43 (FIG. 5) between the constituent element and the program specification is included in the constituent element 442. .. Then, the related threat extraction unit 25 tentatively extracts the description content of the threat 441 of the entry obtained by the search.
For example, PROGRAM_C. In the case where the threat extraction is performed on C.C, PROGRAM_C.C. The component on which C operates is the controller. Therefore, the related threat extraction unit 25 searches the threat analysis result 44 (FIG. 6) for an entry including “controller” in the component 442. In the threat analysis result 44 (FIG. 6), entries “HMI-controller”, “controller”, and “controller-device” are obtained (procedure (1) in FIG. 11). Then, the related threat extracting unit 25 tentatively extracts “tampering of unencrypted communication”, “leakage by guess”, “tampering by resending” and “DoS by resending” described in the threat 441 of these entries (see FIG. 11). Procedure (2)).

Next, when the description content of the related information asset 443 of the entry obtained by the search is associated with the variable in the information asset-variable correspondence 47, the related threat extracting unit 25 determines the threat 441 of the corresponding entry. Formally extract the contents described in.
The related threat extraction unit 25 uses the “command”, “response”, “MAC key”, “instruction” of the related information assets 443 of the entry (line numbers 4 to 13) obtained in the procedure (1) of FIG. It is determined whether each of the “value” and the “status” is associated with a variable in the information asset-variable correspondence 47 (FIG. 10).
In the information asset-variable correspondence 47 of FIG. 10, information assets other than "status" are associated with variables.
Therefore, the related threat extracting unit 25 formally extracts the description contents of the threat 441 on the fourth to 11th lines in FIG. 11 (procedure (3) in FIG. 11).
Then, the related threat extraction unit 25 writes the description content of the extracted threat 441 in the memory 12 as the related threat list 48.

An example of the related threat list 48 will be described with reference to FIG.

The related threat list 48 is a part of the threat analysis result 44 extracted by the extraction processing illustrated in FIG. 11. The related threat list 48 is stored in association with the related program specifications 42 (FIG. 4). Further, the related threat list 48 may be associated with the entry of the correspondence relationship 43 (FIG. 5) between the component and the program specification.

(Step S6 of FIG. 2: Related vulnerability candidate extraction processing)
The vulnerability candidate extraction unit 26 sets the relevant program specification 42 (FIG. 4) based on the information of the related threat list 48 (FIG. 12) extracted in step S5 and the threat-vulnerability type correspondence DB 32 (FIG. 13). Vulnerability type candidates 49 to be inspected that may be used for attacking related threats are extracted for each related threat.

Specifically, the vulnerability candidate extraction unit 26 reads the threat-vulnerability type correspondence DB 32 from the storage 13 and writes the threat-vulnerability type correspondence DB 32 in the memory 12.
Next, the vulnerability candidate extraction unit 26 reads the correspondence 43 (FIG. 5) between the constituent elements and the program specifications from the memory 12.
Then, the vulnerability candidate extraction unit 26 sequentially processes each entry of the correspondence 43 (FIG. 5) between the component and the program specification, and reads the related threat list 48 (FIG. 12) corresponding to the program specification 432 from the memory 12. ..
Next, the vulnerability candidate extraction unit 26 refers to the entry of the threat-vulnerability type correspondence DB 32 for each threat described in the related threat list 48, and finds the candidate of the vulnerability type related to the threat in the vulnerability type list. 322. Then, the vulnerability candidate extraction unit 26 writes the acquired vulnerability type candidates as vulnerability type candidates 49 (FIG. 14) in the memory 12 in association with each threat. The vulnerability candidate extraction unit 26 does this for all threats.
Then, the vulnerability candidate extraction unit 26 continues the same process for the next entry of the correspondence 43 (FIG. 5) between the component and the program specification, and extracts the vulnerability type candidate 49 for all the entries. ..

An example of the threat-vulnerability type correspondence DB 32 will be described with reference to FIG.

The threat-vulnerability type correspondence DB 32 can be represented in a table format as shown in FIG.
The threat-vulnerability type correspondence DB 32 includes information on a threat 321 and a vulnerability type list 322 corresponding to the threat.
In the vulnerability type list 322, vulnerability types corresponding to threats are listed. If there is no entry for the threat in the threat-vulnerability type correspondence DB 32, or if there is a threat entry but no corresponding vulnerability type is described, the threat is described in the program specification 42. There is no vulnerability type that can be analyzed at the level. For example, the “fault” in FIG. 13 does not have a vulnerability type because the fault is a device defect and not a program-induced vulnerability. When there is no such vulnerability, the vulnerability candidate extraction unit 26 includes a display indicating that there is no vulnerability candidate corresponding to the threat in the result output of the vulnerability analysis in step S7 described later. Good.

An example of the vulnerability type candidate 49 will be described with reference to FIG.

The vulnerability type candidate 49 corresponds to the threat 441 of the related threat list 48, the component 442, the related information assets 443, the threat type 444, and the vulnerability type list 322 of the threat-vulnerability type correspondence DB 32. It is the attached information. Unlike FIG. 14, the vulnerability type candidate 49 may include only the threat 441, the related information assets 443, and the vulnerability type list 322. Further, the vulnerability type candidate 49 may include an element not shown in FIG.

(Step S7 of FIG. 2: Vulnerability analysis processing)
The vulnerability analysis unit 27 analyzes whether the vulnerability types shown in the vulnerability type list 322 of the vulnerability type candidates 49 extracted in step S6 exist in the program specifications 42. Then, the vulnerability analysis section 27 outputs the analysis result.
Vulnerability analysis is performed using static code analysis or formal verification techniques as described in the background art. The vulnerability analysis unit 27 inspects the vulnerabilities associated with each threat according to the information of the vulnerability type candidates 49.

Specifically, the vulnerability analysis unit 27 includes a program specification 42 (FIG. 4) for performing the vulnerability analysis, a corresponding related threat list 48 (FIG. 12), and a vulnerability type candidate 49 (corresponding to each related threat. 14) and are read from the memory 12.
Next, the vulnerability analysis section 27 performs vulnerability analysis. That is, the vulnerability analysis unit 27 extracts the vulnerability type and the variables related thereto based on the corresponding threat list 48 and the vulnerability type candidate 49, and performs the vulnerability analysis.
When the vulnerability is detected, the vulnerability analysis unit 27 writes the vulnerability detection result 410 (FIG. 15) in the memory 12 (if another vulnerability detection result 410 already exists, a new vulnerability is detected). The vulnerability detection result 410 is added to the existing vulnerability detection result 410).
The vulnerability analysis unit 27 does this for all program specifications 42 to be inspected.
When all the vulnerability analyzes have been completed for all the program specifications 42 to be inspected, the vulnerability analysis unit 27 sends the vulnerability detection result 410 to the connected input/output device via the communication interface 14. Send.
The input/output device that has received the vulnerability detection result 410 displays the vulnerability detection result 410. Further, the vulnerability detection result 410 may be saved in a file.
The vulnerability analysis unit 27 also performs the vulnerability analysis in consideration of the variables associated with the information assets.

An example of the vulnerability detection result 410 will be described with reference to FIG.

The vulnerability detection result 410 includes a vulnerability type 411, a variable 412, a location 413, a threat 414, a component 415, and an information asset 416.
The vulnerability type 411 indicates the vulnerability type detected by the vulnerability analysis unit 27.
The variable 412 shows a variable related to the vulnerability type detected by the vulnerability analysis unit 27.
A place 413 shows a place in the program specification 42 related to the vulnerability type detected by the vulnerability analysis unit 27.
The threat 414 indicates a threat against the vulnerability type detected by the vulnerability analysis unit 27.
In the component 415, a component in which the vulnerability type detected by the vulnerability analyzer 27 is present is shown.
The information asset 416 shows the information asset in which the vulnerability type detected by the vulnerability analysis unit 27 exists.
FIG. 15 shows the PROGRAM_C. An example of the vulnerability detection result 410 related to C's threat #6 (presumed threat) is shown. In the example of FIG. 15, “vulnerability 1” is shown as the vulnerability type 411. Further, “key” is shown as the variable 412, “first line of PROGRAM_C.C” is shown as the location 413, and “leakage by guess” is shown as the threat 414. Also, a “controller” is shown as the component 415, and a “MAC key” is shown as the information asset 416.

***Explanation of the effect of the embodiment***
As described above, according to the present embodiment, since the candidate of the correspondence relationship between the variable included in the program executed by the device and the information asset used by the device is generated, the portion within the program, the information asset, and the vulnerability The correspondence relationship with can be clarified.

Further, in the present embodiment, the correspondence relationship between the result of the threat analysis and the program specification can be clarified based on the correspondence relationship between the flow of information assets of the threat analysis and the classification of input/output of the variable of the program specification. Therefore, according to the present embodiment, the analysis target can be narrowed down at the time of vulnerability analysis.

Further, in this embodiment, it is possible to analyze and infer the correspondence relationship between the flow of information assets in the threat analysis and the input/output relationship of the variables of the program specification. For this reason, according to the present embodiment, it is possible to save the user of vulnerability analysis from having to individually execute them.

Further, in the present embodiment, the correspondence relationship of the vulnerabilities used in the attacks linked to each threat is stored. Therefore, in the vulnerability analysis, it is possible to derive the vulnerability used for the attack by referring to the correspondence relationship from the result of the threat analysis.

Embodiment 2.
In the first embodiment, the vulnerability analysis apparatus 10 obtains the device configuration of the system of the vulnerability analysis, the type of information assets, and the flow of information assets from the information asset flow 41 (FIG. 3) acquired from the outside.
In the present embodiment, an example will be described in which the vulnerability analysis device 10 analyzes the device configuration of the system subject to vulnerability analysis, the type of information assets, and the flow of information assets.
In the present embodiment, differences from the first embodiment will be mainly described.
Note that items not described below are the same as those in the first embodiment.

***Composition explanation***
The configuration of the vulnerability analysis device 10 according to the first embodiment will be described with reference to FIG.
In FIG. 16, as compared with the configuration of FIG. 1, the information asset discriminating unit 28 is added. The other elements shown in FIG. 16 are the same as those shown in FIG.

***Description of operation***
Hereinafter, an operation example of the vulnerability analysis device 10 according to the present exemplary embodiment will be described with reference to FIG.

In the present embodiment, in step S1 of FIG. 2, the first reception unit 21 receives the threat analysis input information 51 instead of the information asset flow 41.

Specifically, the input device connected via the communication interface 14 is operated by the user, and the threat analysis input information 51, the program specification 42, the correspondence 43 between the constituent elements and the program specification, and the threat analysis result 44. And are entered.
Then, the first accepting unit 21 accepts the threat analysis input information 51, the program specification 42, the correspondence 43 between the constituent elements and the program specification, and the threat analysis result 44 via the communication interface 14.
Further, the first reception unit 21 writes the threat analysis input information 51, the program specifications 42, the correspondence relationship 43 between the constituent elements and the program specifications, and the threat analysis result 44 in the memory 12.

The threat analysis input information 51 is information used for threat analysis.
The threat analysis input information 51 includes a plurality of constituent elements that configure the system that is the target of vulnerability analysis, a connection relationship between the constituent elements, a list of information assets, and information indicating the flow of information assets.

Next, before carrying out step S3, the information asset determination unit 28 performs a related information asset flow extraction process.
In the related information asset flow extraction processing, the information asset determination unit 28, based on the threat analysis input information 51 received in step S1 and the correspondence 43 between the constituent elements and the program specifications, the program specifications to be the target of the vulnerability analysis. The information asset flow associated with 42 is extracted for each component. The information asset flow has the same format as the information asset flow 41 of FIG. 3 shown in the first embodiment.
That is, the information asset discriminating unit 28 discriminates whether each of the information assets used in the system targeted for threat analysis is an input information asset, an output information asset, or an internally used information asset.

***Explanation of the effect of the embodiment***
As described above, according to the present embodiment, since the vulnerability analysis device 10 can generate the information asset flow, it is not necessary to generate the information asset flow by the external device.

Embodiment 3.
In the first and second embodiments, the output order of the candidates is not considered when outputting the candidates of the correspondence relationship between the information asset and the variable.
In the present embodiment, the vulnerability analysis device 10 controls the output order according to the certainty of each candidate when outputting the candidate of the correspondence relationship between the information asset and the variable. That is, in the present embodiment, when the second reception unit 24 outputs a plurality of correspondence relationship candidates, a priority order is set among the plurality of correspondence relationship candidates, and a correspondence relationship candidate having a high priority order is provided. Is output with priority.
In the present embodiment, differences from the first embodiment will be mainly described.
Note that items not described below are the same as those in the first embodiment.

Specifically, in step S3 of FIG. 2, when the candidate generation unit 23 analyzes the correspondence between the variable in the program specification 42 and the information asset, the candidate generation unit 23 estimates the certainty as a candidate. The candidate generation unit 23 estimates the certainty of the candidate of the correspondence relationship between the variable and the information asset, for example, by a combination of preset keywords or the like.
For example, the candidate generation unit 23 infers that the information asset “command” and the variable command and the variable cmd are similar to each other in the notation, and thus is highly likely to be a candidate. Further, the candidate generation unit 23 determines that the certainty is high for the candidate having many combinations of corresponding variables. The candidate generation unit 23 specifies the output order (priority order) of the candidates of the plurality of correspondence relationships according to the certainty.
Then, the second reception unit 24 outputs a plurality of candidates for the correspondence relationship in the output order designated by the candidate generation unit 23.

As described above, in the present embodiment, the certainty of the correspondence relationship candidate is estimated, the output order of the correspondence relationship candidate is specified based on the certainty, and the plurality of correspondence relationship candidates are specified in the specified output order. Output. Therefore, according to the present embodiment, the user can easily select the correct correspondence relationship even when there are a plurality of correspondence relationship candidates.

Fourth Embodiment
In the first to third embodiments, the vulnerability candidate extraction unit 26 uses the threat-vulnerability correspondence DB 32 to extract the vulnerability type candidates corresponding to the related threat.
In the present embodiment, the first accepting unit 21 acquires the attack tree. Then, the vulnerability candidate extraction unit 26 uses the attack tree to extract the vulnerability type candidates. The attack tree is information indicating a series of attack procedures for achieving each threat of the threat analysis result 44 (FIG. 6) and the types of vulnerabilities used in the attack procedures.
The vulnerability candidate extraction unit 26 is included in the attack tree instead of using the threat-vulnerability correspondence DB 32 when extracting candidates for the type of vulnerability corresponding to each threat in the related threat list 48 (FIG. 12). Extract information on the type of vulnerability. The vulnerability candidate extraction unit 26 extracts the type of vulnerability from the attack tree after confirming that the attack destination is the corresponding component.
Items not described in this embodiment are the same as those in the first embodiment.

As described above, in the present embodiment, flexible analysis can be performed by using the vulnerability type information included in the attack tree (when the threat-vulnerability type correspondence DB 32 is used, Correspondence between threat and vulnerability types is fixed). According to the present embodiment, for example, when the type of vulnerability used varies depending on the system configuration and the attack method, flexible analysis can be performed.

Embodiment 5.
In the first to fourth embodiments, the program specification 42 is used as it is in the vulnerability analysis.
In the present embodiment, the vulnerability analysis unit 27 performs vulnerability analysis by referring to the association between information assets and variables or/and the type of threat. That is, in the present embodiment, the vulnerability analysis unit 27 adds the association between the plurality of information assets and the plurality of variables obtained from the information asset-variable correspondence 47 (FIG. 10) to the program specification 42, Vulnerability analysis can be performed. Further, the vulnerability analysis unit 27 can perform the vulnerability analysis by referring to the threat type 444 (C, I, A) described in the threat analysis result 44. That is, the vulnerability analysis unit 27 can perform the vulnerability analysis by adding the threat type 444 (C, I, A) to the program specification 42.
In addition, in the present embodiment, the vulnerability analysis unit 27 extracts, as a program fragment, from the program specification 42, a portion in which processing related to the vulnerability type candidates extracted by the vulnerability candidate extraction unit 26 is described. be able to. Then, the vulnerability analysis unit 27 can perform vulnerability analysis using the extracted program fragment. In this case, the vulnerability analysis unit 27 refers to the program specification 42, for example, a process of referring to or changing a variable related to the threat, a process using another variable that affects the variable related to the threat, and a branch process. The process that controls the execution of the above process such as the determination process can be extracted as a program fragment.
Items not described in this embodiment are the same as those in the first embodiment.

As described above, in this embodiment, the vulnerability check is performed by adding the meta information such as the value (C, I, A) of the information asset to the inspection target program specification in association with the information asset and the variable. To do. Therefore, in the present embodiment, it is possible to efficiently generate the check formula and/or the model.
Further, in the present embodiment, by using the program fragment, it is possible to make the vulnerability analysis more efficient than when using the entire program specification.

Although the embodiments of the present invention have been described above, two or more of these embodiments may be combined and implemented.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined for implementation.
The present invention is not limited to these embodiments, and various modifications can be made if necessary.

*** Explanation of hardware configuration ***
Finally, a supplementary description of the hardware configuration of the vulnerability analysis device 10 will be given.

The storage 13 stores an OS (Operating System).
Then, at least part of the OS is loaded into the memory 12 and executed by the processor 11.
The processor 11 executes at least a part of the OS while the first acceptance unit 21, the variable determination unit 22, the candidate generation unit 23, the second acceptance unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, A program that implements the functions of the vulnerability analysis unit 27 and the information asset determination unit 28 is executed.
When the processor 11 executes the OS, task management, memory management, file management, communication control, etc. are performed.
Further, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28. At least one of the information, the data, the signal value, and the variable value indicating the result of the processing is stored in at least one of the memory 12, the storage 13, the register in the processor 11, and the cache memory.
Further, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28. The program that realizes the function of may be stored in a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Then, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28. A portable recording medium that stores a program that realizes the function of may be distributed commercially.

Further, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28. The "part" of may be read as "circuit" or "process" or "procedure" or "processing".
The vulnerability analysis device 10 may be realized by a processing circuit. The processing circuit is, for example, a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array).
In this specification, the superordinate concept of the processor and the processing circuit is referred to as “processing circuit”.
That is, each of the processor and the processing circuit is a specific example of “processing circuit”.

10 vulnerability analysis device, 11 processor, 12 memory, 13 storage, 14 communication interface, 21 first reception part, 22 variable discrimination part, 23 candidate generation part, 24 second reception part, 25 related threat extraction part, 26 Vulnerability candidate extraction part, 27 vulnerability analysis part, 28 information asset discrimination part, 31 processing type DB, 32 threat-vulnerability type correspondence DB, 41 information asset flow, 42 program specifications, 43 correspondence between constituent elements and program specifications , 44 threat analysis result, 45 program variable processing relation, 46 information asset-variable correspondence relation candidate, 47 information asset-variable correspondence relation, 48 related threat list, 49 vulnerability type candidate, 410 vulnerability detection result.

Claims (15)

1. A variable discrimination unit that discriminates each type of a plurality of variables included in the program executed by the device,
   Each type of the plurality of variables discriminated by the variable discriminating unit is compared with each type of the plurality of information assets used by the device, and each of the plurality of information assets and each of the plurality of variables are compared. An information processing apparatus having a candidate generation unit that generates one or more candidates for the correspondence relationship.
2. The information processing device further includes
   The information processing apparatus according to claim 1, further comprising an output unit configured to output the plurality of correspondence relationship candidates when the plurality of correspondence relationship candidates are generated by the candidate generation unit.
3. The variable discrimination unit,
   Each of the plurality of variables is determined as an input variable, an output variable, or an internal use variable,
   The candidate generation unit,
   An input information asset that is an information asset that is input to the device from outside the device and the input variable, an output information asset that is an information asset that is output from the device to the outside of the device and the output variable, and the inside of the device The information processing apparatus according to claim 1, wherein one or more candidates for a correspondence relationship are generated by associating an internal usage information asset, which is an information asset used in, with the internal usage variable.
4. The candidate generation unit,
   Each of the plurality of information assets acquires information asset information indicating which of the input information asset, the output information asset, and the internal use information asset, and the input information asset indicated in the information asset information. The information processing apparatus according to claim 3, wherein the input variable is associated with the output information asset and the output variable indicated by the information asset information, and the internal use information asset and the internal use variable indicated by the information asset information are associated with each other. ..
5. The information processing device further includes
   The information processing apparatus according to claim 3, further comprising an information asset determination unit that determines whether each of the plurality of information assets is the input information asset, the output information asset, or the internal use information asset.
6. The variable discrimination unit,
   It is determined whether the process in which each of the plurality of variables is used is an input process, an output process, or an internal use process, and the type of each of the plurality of variables is determined based on the determined process type. The information processing apparatus according to claim 3, wherein the information processing apparatus determines.
7. The variable discrimination unit,
   Analyzing the propagation relationship of variable values in the plurality of variables,
   The output unit is
   The information processing apparatus according to claim 2, which outputs one or more correspondence relationship candidates generated by the candidate generation unit and a propagation relationship of variable values obtained by the analysis of the variable determination unit.
8. The candidate generation unit,
   When a plurality of correspondence relationship candidates are generated, a priority order is set among the plurality of correspondence relationship candidates,
   The output unit is
   The information processing apparatus according to claim 2, wherein the candidate of the correspondence having a high priority is preferentially output.
9. The candidate generation unit,
   The information processing according to claim 8, wherein the certainty of each of the plurality of correspondence relationship candidates is estimated as a correspondence relationship candidate, and a priority order is set among the plurality of correspondence relationship candidates based on the estimation result. apparatus.
10. The information processing device further includes
    A vulnerability candidate extraction unit that extracts a candidate for the type of vulnerability existing in the device based on the correspondence relationship selected from the one or more correspondence relationship candidates;
    The information processing apparatus according to claim 1, further comprising: a vulnerability analysis unit that performs a vulnerability analysis of the device based on a vulnerability type candidate extracted by the vulnerability candidate extraction unit.
11. The vulnerability candidate extraction unit,
    The information processing apparatus according to claim 10, wherein a candidate for the type of vulnerability existing in the device is extracted by referring to an attack tree. Vulnerability type candidates
12. The vulnerability analysis unit is
    The information processing apparatus according to claim 10, wherein vulnerability analysis of the device is performed by referring to at least one of association between the plurality of information assets and the plurality of variables and a threat type.
13. The vulnerability analysis unit is
    A portion in which a process related to a vulnerability type candidate extracted by the vulnerability candidate extraction unit is described is extracted as a program fragment from the program, and a vulnerability analysis of the device is performed using the extracted program fragment. The information processing apparatus according to claim 10, which is performed.
14. The computer determines the type of each of the plurality of variables included in the program executed by the device,
    The computer compares the respective types of the determined plurality of variables with the respective types of the plurality of information assets used by the device, and compares each of the plurality of information assets with each of the plurality of variables. An information processing method for generating one or more correspondence candidates.
15. A variable determination process for determining the type of each of a plurality of variables included in the program executed by the device,
    Each type of the plurality of variables determined by the variable determination process is compared with each type of a plurality of information assets used by the device, and each of the plurality of information assets and each of the plurality of variables are compared. An information processing program that causes a computer to execute a candidate generation process for generating one or more candidates for the correspondence relationship.

Images