JP2007259171A - Incorrect information generating apparatus, incorrect information generating method, incorrect information generating program, vulnerability inspecting apparatus, vulnerability inspecting method, and vulnerability inspecting program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent an incorrect access according to an incorrect certificate by inspecting effect when an incorrect certificate in which incorrect information being embedded into an attribute is given to a PKI system. <P>SOLUTION: A vulnerability information searching unit 130 is designed to acquire inspection information by searching vulnerability information based on product information and setting information about an object 200 to be inspected. A setting attribute determining unit 140 is designed to determine an attribute for setting the inspection information based on operation information and attribute information. An incorrect information producing unit 150 is designed to produce incorrect certificate information by setting the inspection information to the above described attribute. An inspection processing unit 160 is designed to perform the inspection relating to the object 200 to be inspected based on the incorrect certificate information produced by the incorrect information producing unit 150 by a processing device 980. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention, for example, an apparatus for generating a certificate including an attack code for investigating a vulnerability or the like in a function of referring to attribute information such as a certificate of a public key infrastructure (PKI) system (public key infrastructure system) And an apparatus for inspecting the same.

Conventionally, an inspection system that inspects defects and vulnerabilities transmits special data (exploit) that attacks known vulnerabilities to an inspection target that is a system to be inspected. For example, if the inspection target is a website using cgi and a vulnerability of command injection is found in the cgi, the data that causes the command injection corresponds to the exploit (inspection information, illegal information). In this example, the inspection system sends an exploit to cgi with a POST request of HTTP (Hyper Text Transfer Protocol) for cgi, for example.
For example, the inspection target returns a response when it receives the exploit. At this time, an error should be returned when abnormal data such as exploit is received. However, when there is a vulnerability, data other than the error that should be returned may be returned as a response as a result of the operation of the exploit on the inspection target. The conventional inspection system confirms the presence or absence of the vulnerability by confirming this response. Alternatively, check the inspection target log and check whether the command injection is successful.
JP 2005-130450 A JP 2005-286443 A Adil Alsaid and Chris J. et al. Mitchell. Installed Fake Root Keys on a PC. In D. Chadwick and G. Zhao, editors, EuroPKI 2005, volume 3545 of Lecture Notes in Computer Science, pages 227-239. Springer-Verlag, Berlin, July 2005.

Conventionally, certificates in a PKI system are treated as reliable. For this reason, the conventional inspection system does not check whether the attribute included in the certificate contains attacking information, so there may be a vulnerability remaining in the processing of the attribute included in the certificate. is there.
In addition, since the certificate is issued by a trusted organization, if the verification is successful, it is treated as reliable information. However, Non-Patent Document 1 describes an attack that installs an unauthorized certificate in a trust store. In other words, there are attacks that circumvent certificate validation. Therefore, there are untrusted certificates.
Therefore, there is a problem that unauthorized access is performed using an unauthorized certificate in which unauthorized information is embedded in an attribute. That is, there is a problem that the inspection of the influence when a certificate in which illegal information is embedded in an attribute is given to the PKI system is insufficient.

  For example, an object of the present invention is to generate a certificate in which unauthorized information is embedded in an attribute. Another object of the present invention is to examine the influence when a certificate in which illegal information is embedded in an attribute is given to a PKI system.

  The unauthorized information generation apparatus according to the present invention includes, for example, product information of an inspection target in a public key cryptosystem, setting information of security of the inspection target, operation information that is a method of using certification information by the inspection target, A product operation storage unit for storing the information in the storage device, a vulnerability information storage unit for storing the vulnerability information of the inspection object and the inspection information for the vulnerability information in the storage device, and the attribute information of the certification information The vulnerability information stored in the vulnerability information storage unit is searched based on the attribute information storage unit stored in the product information, the product information stored in the product operation storage unit, and the setting information, and inspection information for the vulnerability information is obtained. Based on the vulnerability information search unit acquired by the processing device, the operation information stored in the product operation storage unit, and the attribute information stored in the attribute information storage unit, the vulnerability information search unit takes The setting attribute determination unit that determines the attribute for setting the inspection information by the processing device and the inspection information acquired by the vulnerability information search unit are set to the attribute determined by the setting attribute determination unit to generate fraud certification information And a fraudulent information generation unit stored in the storage device.

  According to the fraudulent information generation apparatus according to the present invention, for example, a vulnerability information search unit that searches for vulnerability information based on product information and setting information of an inspection target and acquires inspection information, operation information, and attribute information And a fraudulent information generation unit that sets the inspection information as the attribute and generates fraud proof information. It is possible to generate a certificate with embedded in the attribute.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  First, an example of the hardware configuration of the vulnerability check system (illegal information generation system) 1000 according to the present invention will be described with reference to FIGS.

FIG. 1 is a diagram illustrating an example of an appearance of a vulnerability inspection system 1000 according to the embodiment.
In FIG. 1, a vulnerability inspection system 1000 includes a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disk device (CDD) 905, a database 908, a system unit 909, and a server 910. These are connected by cables.
Further, the vulnerability inspection system 1000 is connected to the Internet 940 via a local area network (LAN) 942 and a gateway 941. The vulnerability inspection system 1000 is connected to an external server 916 and the like via the Internet 940.
Here, the CRT display device 901, the K / B 902, the mouse 903, the CDD 905, the system unit 909, and the like are examples of a vulnerability check device (unauthorized information generation device) 100 described later. In addition, the server 910, the external server 916, and the like, and the software (S / W) stored therein are examples of the inspection target 200 that is a target for performing a vulnerability check. The CRT display device 901 is an example of the display device 986.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the vulnerability testing apparatus 100 according to the embodiment.
In FIG. 2, the vulnerability testing apparatus 100 is a computer and includes a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 includes a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, an FDD (Flexible Disk) 904, a CDD 905, and a magnetic disk. A disk device 920 is connected.
The RAM 914 is an example of a volatile memory. The ROM 913 and the magnetic disk device 920 are examples of a nonvolatile memory. These are examples of the storage device 984.
The communication board 915 is connected to the LAN 942 or the like.
K / B 902, mouse 903, and the like are examples of the input device 982.
The CPU 911 is an example of a processing device 980.
The communication board 915 is an example of the communication device 988.

Here, the communication board 915 is not limited to the LAN 942 but may be directly connected to the Internet 940 or a WAN (Wide Area Network) such as ISDN. When directly connected to a WAN such as the Internet 940 or ISDN, the vulnerability testing apparatus 100 is connected to a WAN such as the Internet 940 or ISDN, and the gateway 941 is unnecessary.
The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores a program that executes a function described as, for example, the “vulnerability inspection unit (illegal information generation unit) 110” in the description of the embodiment described below. The program is read and executed by the CPU 911.
In the file group 924, what is described as “to determination” in the description of the embodiment described below is stored as “to file”.
Also, the arrows in the flowcharts described in the following description of the embodiments mainly indicate data input / output, and the data for the data input / output is the magnetic disk device 920, FD, optical disk, CD, MD. (Mini disc), DVD (Digital Versatile Disk) and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as the “vulnerability inspection unit (illegal information generation unit) 110” in the description of the embodiment described below may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  In addition, a program that implements the embodiment described below may be stored using a recording device using another recording medium such as the magnetic disk device 920, FD, optical disk, CD, MD, DVD, or the like.

Next, the outline | summary of the vulnerability test | inspection apparatus 100 concerning embodiment is demonstrated based on FIG. FIG. 3 is a diagram illustrating an overview of the vulnerability testing apparatus 100 according to the embodiment.
The vulnerability inspection apparatus 100 includes a vulnerability information DB (DataBase) 192 and an inspection processing unit 160. Moreover, the vulnerability test | inspection apparatus 100 is connected with the test object 200 via N / W (network). The inspection object 200 is a system for inspecting for the presence or absence of vulnerability, for example, a Web site or a DB system. The inspection processing unit 160 is an inspection tool that inspects for the presence of vulnerability or the like. The vulnerability information DB 192 is an inspection plug-in DB in which inspection plug-ins described later are stored.
The inspection processing unit 160 fetches, for example, an inspection plug-in corresponding to the latest vulnerability periodically from the vulnerability information DB 192. The inspection plug-in is created each time various vulnerabilities are disclosed and discovered, and stored in the vulnerability information DB 192.
The inspection processing unit 160 transmits the inspection information in which the inspection plug-in is set to the inspection object 200. The inspection object 200 processes the inspection information and returns a response. For example, the vulnerability testing apparatus 100 determines the presence or absence of vulnerability by confirming this response.

Next, the inspection concept of the PKI system will be described with reference to FIG. FIG. 4 is a diagram showing the vulnerability of the PKI system using HTTPS (Hyper Text Transfer Protocol over Secure Sockets Layer, HTTP Over SSL) as an example of the inspection concept of the PKI system.
FIG. 4 is a functional block diagram of a system that protects HTTP communication with SSL (Secure Sockets Layer). The system is divided into an HTML (HyperText Markup Language) layer 401, an HTTP layer 402, an SSL layer 405, a TCP / IP (Transmission Control Protocol / Internet Protocol) layer 406, and a PKC (HTTP) layer between the SSL layer and the HTTP layer. Public Key Certificate) layer 403, ASN. 1 (Abstract Syntax Notation One) layer 404 is positioned.
As vulnerability of the PKI system, for example, SSL layer 405, ASN. Vulnerabilities specific to the first layer 404 and the PKC layer 403 are pointed out. Taking the SSL layer 405 as an example, DoS (Denial of Service) occurs due to an abnormality in handshake data. In addition, ASN. For example, in the first layer 404, an illegal ASN. Buffer overflow occurs due to a certificate of one encoding. For example, in the PKC layer 403, a certificate security check is avoided due to an invalid certificate path.
So far, the inspection plug-in inspects the vulnerability of the implementation directly related to the PKI of the PKI system. That is, until now, the inspection plug-in has not inspected the vulnerability of the PKI system for the certificate in which the illegal information is embedded in the attribute.

Next, the risk and problem of not inspecting the vulnerability of the PKI system for a certificate in which unauthorized information is embedded in an attribute will be described. The description will be divided into the following three steps.
First, as the first stage, the existence of an untrusted certificate will be described. Since the certificate is issued by a trusted organization, it is treated as credible information if it is successfully verified. However, there are attacks that circumvent certificate validation. Therefore, there are untrusted certificates.
Next, as a second stage, unauthorized access using a certificate in which an exploit is embedded in an attribute will be described. If an attack that circumvents the verification of the certificate is performed, there is a possibility that unauthorized access is performed using the certificate in which the exploit is embedded in the attribute.
As a third stage, a shortage in the inspection of the PKI system will be described. In other words, in order to prevent unauthorized access by a certificate in which an exploit is embedded in an attribute, there is a lack of examination of the effect when a certificate in which unauthorized information is embedded in an attribute is given to the PKI system. Yes.

First, the existence of an untrusted certificate, which is the first stage, will be described.
Originally, a certificate in PKI is issued by a trusted organization, so if the validity of the certificate can be confirmed, the attribute of the certificate is treated as reliable. On the side of receiving the certificate, whether or not the certificate is invalid is confirmed by verifying the certificate. Certificate verification is usually performed as follows.
First, the device that has received the certificate checks the signature of the received certificate with the public key of the CA (Certificate Authority) that issued the certificate. Next, the device that has received the certificate checks the expiration date and revocation status. Some operations do not check the revocation status. Thereafter, the device that has received the certificate treats the certificate as trustworthy and refers to the attribute.
Here, it is necessary to guarantee that the public key of the CA that issued the certificate is authentic. Explain how the public key is guaranteed to be authentic.
First, the CA issues a self-signed certificate for signing its own public key with its own private key.
Next, the self-signed certificate is embedded in advance in the trust store of the PKI application that receives the certificate issued by the CA. Here, the trust store is a storage location of a trusted certificate. For example, when using a browser as a PKI application, the CA requests the browser vendor to store a self-signed certificate in the trust store. At this time, the vendor of the browser separately checks whether the CA is valid, stores it in the trust store, and ships it. That is, when the user uses the browser, the CA self-signed certificate is already stored in the trust store as a trusted CA certificate.
Then, the CA issues a server certificate to the SSL-compatible Web server. When a browser user connects to this Web site, an SSL handshake is executed, and a server certificate is transmitted from the Web server in the process. The browser can verify the server certificate using the CA certificate of the trust store.
For example, a malicious third party installs an unauthorized SSL-compliant Web server, the malicious third party installs a CA to generate a CA certificate, and the malicious third party itself creates a server. Assume that a certificate is issued and set in the Web server. In this case, since the malicious third party's own CA certificate is not stored in the browser's trust store, the browser normally connects to the site of the unauthorized SSL-compliant Web server installed by the malicious third party. Can not. In other words, a server certificate issued under the CA certificate stored in the browser's trust store can be connected correctly. This means that the browser does not trust other than the CA certificate authenticated by the browser vendor and stored in the trust store.
Thus, trust store management is very important in the operation of PKI applications. Further, as long as the trust store of the PKI application in the initial state is not operated, there is no change to the CA's reliable self-signed certificate.

However, there is an attack method in which an unauthorized CA certificate is installed in the trust store. As an attack method for installing an unauthorized CA certificate in the trust store, for example, there is a program for writing an unauthorized CA certificate in the trust store using an OS encryption / PKI library or the like. When this program is executed, an invalid CA certificate is written in the trust store without being noticed by the user.
For example, when a malicious third party in the previous example wants to install an unauthorized SSL-compatible Web server, a program for writing an unauthorized CA certificate in a trust store is attached to an email and transmitted to an end user. In addition, a malicious third party instructs, for example, to execute a program attached for maintenance in the mail text. Such an attack method is effective as an attack because of the spread of email-attached viruses and the large number of users who execute unauthorized programs.
When the program is executed, it writes an invalid CA certificate in the trust store. However, no further malicious acts are performed. That is, it has no effect on the PC of the end user thereafter. Therefore, even if an unauthorized CA is written in the trust store, the user does not notice. Virus detection software usually does not scan the trust store, so it is not detected.
Therefore, in a PKI application that uses the trust store, a certificate issued under an unauthorized CA certificate is treated as a reliable certificate. For this reason, in the above example, when the browser is connected to an unauthorized SSL-compatible website, the unauthorized server certificate is normally verified. In other words, the browser trusts an invalid server certificate. A normal connection to an unauthorized SSL-compatible Web server site is possible, and the browser user is unaware that the site is unauthorized.
It should be noted that the issue of a certificate under an unauthorized CA certificate itself is performed at a location completely different from the end user's PC. Since the malicious user holds the private key paired with the public key included in the unauthorized CA certificate, the malicious user can generate an arbitrary unauthorized certificate using the private key.

In the operation of PKI, with regard to the security of the certificate, attention is paid to the CA impersonation due to the leakage or decryption of the legitimate CA private key and the certainty of the certificate revocation. This is to prevent malicious third parties from generating their own forged certificates or forging revoked certificates as if they were valid.
However, one method for impersonating a valid CA is to install an unauthorized CA certificate into a trust store by a malicious third party. If the unauthorized CA certificate is successfully installed in the trust store, then the malicious user can allow the end user to accept any unauthorized certificate as valid.

  In the above description, as an example, the installation of an unauthorized CA certificate for the end user in the trust store has been described. However, falsification of a trust store of a server that accepts a certificate (for example, an SSL-compatible Web server) is generally difficult because it is more strictly managed than an end user. However, since many vulnerabilities of software and OS that can execute an arbitrary program have been reported, there is a possibility that unauthorized access such as executing the above program on a server may occur. That is, it is necessary to consider the possibility of installing an unauthorized CA certificate in the trust store, not limited to the client side and the server side.

  Next, unauthorized access using a certificate in which an exploit, which is the second stage, is embedded in an attribute will be described. When an attack that avoids certificate verification is performed as described above, there is a possibility that unauthorized access is performed using a certificate in which an exploit is embedded in an attribute.

Here, the attribute of the certificate is often specified as a parameter of another application. For example, SubjectDN of the end user certificate indicates the owner of the certificate. On the server side, there is an operation of searching the database by the owner of the presented certificate, and it is conceivable that SubjectDN is used. Alternatively, when displaying the image information included in the certificate, the attribute of the image is passed as a parameter to the program for displaying the image.
Certificate attributes are considered reliable information if verification is successful. Therefore, in the attribute information as described above, the correctness of the value is not strictly checked, and it may be passed as a parameter to another program as it is. Further, even on the program side to which the attribute information is passed, there is a possibility that the attribute is not strictly checked as credible information.
Here, for example, it is conceivable that an illegal access code is described in the attribute. It has been described above that a malicious third party may allow a recipient to accept an unauthorized certificate as legitimate by installing an unauthorized CA certificate in the trust store. Therefore, a certificate in which an unauthorized access code is written may be accepted as a valid certificate. In this case, if there is a vulnerability on the passed application side, unauthorized access may be successful if an unauthorized access code is described as attribute information.
Further, as described above, the method for inspecting the vulnerability of the PKI application by the inspection plug-in so far only inspects the remaining of the known vulnerability discovered for each functional layer of each PKI. That is, when operating as a single PKI system, a vulnerability check is not performed when a certificate holding an unauthorized access code is received.

  Next, an example of unauthorized access using specific certificate attributes is shown. First, an example of unauthorized access using a PKC (Public Key Certificate) attribute will be described with reference to FIG. FIG. 5 is a diagram illustrating an example of unauthorized access using a PKC attribute.

When checking the revocation of the certificate of the communication partner, the CRL may be obtained using a CRL-DP (CRL Distribution Point: RFC3280) which is an extension of the certificate. In the CRL-DP, a distribution destination URL can be designated as a CRL acquisition destination. Here, if there is a vulnerability such as an implementation error in the handling of URL in the implementation other than the implementation of PKI, there is a possibility that a malfunction such as abnormal termination may occur due to CRL-DP including an illegal URL. . If this abnormal termination is caused by a buffer overflow, there is a possibility of attack. That is, if a CRL-DP including an illegal URL is set in the certificate, there is a possibility of an attack.
In FIG. 5, the URL is further extracted from the CRL-DP extracted from the PKC by the PKC layer 413 and passed to the HTTP layer 412. The HTTP layer 412 attempts communication based on the received URL. However, since the passed URL is an illegal URL, there is a possibility that abnormal processing may be performed if there is a vulnerability in URL processing or HTTP processing.
In this example, for example, when there is a vulnerability in the implementation of the connection IF 417 between the HTTP layer 412 and the PKC layer 413, or when there is a vulnerability in the HTTP layer 412, abnormal processing occurs. However, these vulnerabilities cannot be detected only by checking the vulnerabilities of the PKI's own implementation (inspection of the PKC layer 413). That is, until now, the above vulnerability cannot be found by examining the vulnerability of the implementation of PKI itself by the inspection plug-in.

Here, when there is a URL processing error in the HTTP layer 412 and it is known as a known vulnerability, a plug-in for inspection may be stored in the vulnerability information DB 192 shown in FIG. is there. Therefore, if a vulnerability is found by inspection, it is possible to take measures such as applying a patch.
However, in that case, only the inspection for the HTTP layer 412 was performed. That is, no inspection is performed from the viewpoint of whether or not vulnerability occurs in cooperation with the PKI system. For example, in an operation mode not linked to the PKI system, an illegal parameter check is performed, but in a mode linked to the PKI system, the parameter check may not be performed. This is because the parameters are trusted because the certificate is verified.
In addition, when the connection IF 417 is created by itself, it is necessary to check the vulnerability of the connection IF 417. This is because there is no inspection plug-in for the part that you make yourself, so you cannot expect inspection using the inspection plug-in.
In other words, in an environment that actually cooperates with the PKI system, there is a possibility that the remaining of the vulnerability may be overlooked unless an inspection using an invalid certificate is performed.

  Next, an example of unauthorized access using an attribute of AC (Attribute Certificate) will be described with reference to FIG. FIG. 6 is a diagram illustrating an example of unauthorized access using an AC attribute.

AC is used for confirming the attribute of the communication partner. The AC is used for an application that provides a service based on an attribute of the AC. For example, it is assumed that the attribute in the AC is passed to the access management DB and access rights to specific information are collated. If there is a problem in the process of passing the attribute as an argument to the DB, there is a possibility that the SQL is executed on the DB by the attribute in which an invalid SQL statement is inserted.
In FIG. 6, the AC layer 423 extracts AccessIdentity from the AC and passes it to the DB access layer 426. Here, it is assumed that AccessIdentity is used for access control. The DB access layer 426 tries to access the DB 427 using AccessIdentity as a search key. However, if an invalid SQL sentence is inserted in AccessIdentity and if there is a vulnerability in the DB access layer 426, there is a possibility of sending an invalid SQL sentence to the DB 427.
In this example, if there is a vulnerability in the implementation of the DB access layer 426 responsible for the connection between the AC layer 423 and the DB 427, or if there is a vulnerability in the DB 427, an invalid SQL statement inserted in the AccessIdentity is executed. It is thought that it will be done. However, these vulnerabilities cannot be detected only by the PKI vulnerability inspection (AC layer 423 inspection). That is, until now, the above vulnerability cannot be found by examining the vulnerability of the implementation of PKI itself by the inspection plug-in.

Here, when there is a processing error in the DB layer 427 and it is known as a known vulnerability, a plug-in for inspection may be stored in the vulnerability information DB 192 shown in FIG. Therefore, if a vulnerability is found by inspection, it is possible to take measures such as applying a patch.
However, in that case, only the DB layer 427 is inspected. That is, no inspection is performed from the viewpoint of whether or not vulnerability occurs in cooperation with the PKI system. For example, in an operation mode not linked to the PKI system, an illegal parameter check is performed, but in a mode linked to the PKI system, the parameter check may not be performed. This is because the parameters are trusted because the certificate is verified.
In addition, when the DB access layer 426 is created by itself, it is necessary to check the vulnerability of the DB access layer 426. This is because there is no inspection plug-in for the part that you make yourself, so you cannot expect inspection using the inspection plug-in.

  Next, an example of unauthorized access using a CC (Content Certificate) attribute will be described with reference to FIG. RFC3709 Internet X. 509 Public Key Infrastructure: Logotypes in X. In 509 Certificates, an extension for including content information such as image data in a certificate is defined. This extension does not include the image data itself in the certificate, but defines the size and address information of the image data to be associated with the certificate, and includes only this definition information in the certificate. Prevents hypertrophy. However, since we want to show the connection between the certificate and the image data in the first place, even if the image data itself is included in the certificate, the same purpose can be achieved simply by increasing the certificate. Here, for simplicity of explanation, a certificate including the image data itself in the certificate is referred to as CC (Content Certificate). FIG. 7 is a diagram illustrating an example of unauthorized access using CC attributes.

The CC is, for example, a certificate including image data of a company logo for indicating the authenticity of a website. When browsing a site to which CC is applied with a browser in which a CC plug-in is installed, a company logo guaranteed by CC is displayed. Thereby, it can be seen that the Web site is not a spoofing site. Since the certificate includes an image, if there is a mounting error in the image display in the browser, abnormal processing such as freezing may occur due to CC including an illegal image.
In FIG. 7, the CC layer 432 extracts image data from the CC and passes it to the content display layer 431. However, if the image is invalid, abnormal processing such as freezing may occur in the content display layer 431.
In this example, when there is a vulnerability in the content display layer 431 or the IF 437 between the content display layer 431 and the CC layer 432, it is considered that abnormal processing such as freezing occurs. However, these vulnerability inspections cannot be found only by the PKI vulnerability inspection (the inspection of the CC layer 432). That is, until now, the above vulnerability cannot be found by examining the vulnerability of the implementation of PKI itself by the inspection plug-in.

Here, if there is a processing implementation mistake in the content display layer 431 and it is known as a known vulnerability, a plug-in for inspection may be stored in the vulnerability information DB 192 shown in FIG. . Therefore, if a vulnerability is found by inspection, it is possible to take measures such as applying a patch.
However, in that case, only the content display layer 431 is inspected. In other words, in the operation mode not linked with the PKI system, an illegal parameter check is performed, but in the mode linked with the PKI system, the parameter check may not be performed. This is because the parameters are trusted because the certificate is verified.
In addition, when IF437 is made by itself, it is necessary to check the vulnerability of IF437. This is because there is no inspection plug-in for the part that you make yourself, so you cannot expect inspection using the inspection plug-in.
Note that even in a certificate using the extension shown in RFC 3709 as it is, the image data acquired according to the extension is passed to the content display layer 431. If the acquired image data is an illegal image, there is a possibility that abnormal processing such as freezing may occur, and there is a concern of overlooking the same vulnerability as in the above CC example.

  In other words, in the above three examples, there is a possibility that the remaining vulnerability is overlooked unless an inspection using an invalid certificate is performed in an environment that actually cooperates with the PKI system.

Then, the deficiencies in the third stage PKI system inspection will be described. In view of the above contents, the inspection from the following points is insufficient in the inspection of the PKI system.
First, as described above, there is an attack in which a trust store is modified by an unauthorized program. For this reason, the received certificate is not always reliable even if the verification is successful. Therefore, it is necessary to perform inspection in consideration of the possibility that unauthorized access may be made when an attribute of an unauthorized certificate is handed over from a PKI processing part to a linked application.
Even if there is no illegal certificate, it is possible that there is a problem in the processing when transferring the certificate information to another application as a parameter. Therefore, since the said malfunction may lead to a vulnerability, such a malfunction should be discovered and corrected beforehand.
Also, not only certificates but also revocation information such as CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) are provided with a signature, and if the signature verification is successful, the attribute is treated as reliable. It is. That is, since the processing using the attribute of the revocation information is performed without checking, the exploitation of the information in which the exploit is embedded can be considered.

  Here, an example of a certificate in a system using PKI and certificate revocation information indicating certificate revocation will be described. Certificates include, for example, PKC (Public Key Certificate, RFC3280), AC (Attribute Certificate, RFC3181), QC (Qualified Certificate, RFC3739), PC (Proxy Certificate, RFC3820), CSC (Code Signing Certificate), DC. (Device Certificate), CC, and the like. The revocation information includes, for example, CRL (RFC3280), OCSP (revocation inquiry service protocol, RFC2560), and the like.

Embodiment 1 FIG.
First, the first embodiment will be described. Embodiment 1 demonstrates the example of the vulnerability test | inspection apparatus (illegal information generation apparatus) 100 at the time of making the test target object 200 into a Web server.

  In the first embodiment, similarly to the outline of the vulnerability inspection apparatus 100 described with reference to FIG. 3, the vulnerability inspection apparatus 100 generates inspection information based on known vulnerability information and inspects the inspection object 200. Send information. And the vulnerability test | inspection apparatus 100 determines the presence or absence of a vulnerability by confirming the response etc. of the test target object 200. FIG. Here, in particular, based on known vulnerability information such as software used in the PKI application system, an illegal certificate that is estimated to be able to attack the PKI application system is generated. Then, inspection information is generated based on an unauthorized certificate.

Based on FIG. 8, the function of the vulnerability testing apparatus 100 according to the first embodiment will be described. FIG. 8 is a functional block diagram illustrating functions of the vulnerability check apparatus 100 according to the first embodiment.
The vulnerability testing apparatus 100 includes a vulnerability testing unit (unauthorized information generation unit) 110, a processing device 980, an input device 982, a storage device 984, and a display device 986.
The vulnerability inspection unit 110 may be software, a program, or the like, for example. Even when the vulnerability checking unit 110 is software, a program, etc., the vulnerability checking unit 110 uses hardware such as a processing device 980, an input device 982, a storage device 984, a display device 986, as shown below. Information is processed in collaboration. The vulnerability inspection unit 110 includes a product operation storage unit 120, a vulnerability information storage unit 122, an attribute information storage unit 124, a vulnerability information search unit 130, a setting attribute determination unit 140, an unauthorized information generation unit 150, an inspection processing unit 160, An inspection information setting unit 162, an inspection execution unit 164, and an inspection result determination unit 166 are provided.
The product operation storage unit 120 includes product information such as product name and version of software used by the inspection target 200 in the PKI system, setting information such as security parameters of the inspection target 200, and the inspection target 200. Operation information including certification information used by the inspection object is stored as a product operation DB 190 in the storage device 984.
The vulnerability information storage unit 122 stores the vulnerability information of the inspection target 200 and the inspection information for the vulnerability information in the storage device 984 as the vulnerability information DB 192. For example, the vulnerability information storage unit 122 stores vulnerability information related to PKI published on the Internet 940 or the like and the corresponding exploit and vulnerability information other than PKI and the corresponding exploit in the storage device 984 as the vulnerability information DB 192. Store.
The attribute information storage unit 124 stores each attribute of the certificate (certification information) and attribute information that is information on the structure of the extension in the storage device 984 as the attribute information DB 194.
The vulnerability information search unit 130 searches the vulnerability information stored in the vulnerability information storage unit 122 based on the product information and setting information stored in the product operation DB 190 by the product operation storage unit 120 and inspects the vulnerability information. Information is acquired by the processing device 980.
The setting attribute determination unit 140 uses the inspection acquired by the vulnerability information search unit 130 based on the operation information stored in the product operation DB 190 by the product operation storage unit 120 and the attribute information stored in the attribute information DB 194 by the attribute information storage unit 124. An attribute for setting information is determined by the processing device 980. That is, in cooperation with the vulnerability information DB 192, the product operation DB 190, and the attribute information DB 194, the vulnerability information obtained from the vulnerability information DB 192 is used to determine which attribute of the certificate is set to the exploit. The setting attribute determination unit 140 includes a proof information search unit 142, a proof information attribute search unit 144, and a setting attribute search unit 146. The certification information search unit 142 searches for certification information to be used from the operation information stored in the product operation DB 190 by the product operation storage unit 120. The certification information attribute search unit 144 searches the attribute information of the certification information searched by the certification information search unit 142 from the attribute information stored in the attribute information DB 194 by the attribute information storage unit 124. The setting attribute search unit 146 searches the attribute information searched by the certification information attribute search unit 144 for an attribute that can set the inspection (attack) location of the inspection information searched by the vulnerability information search unit 130.
The fraud information generation unit 150 sets the inspection information acquired by the vulnerability information search unit 130 to the attribute determined by the setting attribute determination unit 140 to generate fraud certification information and stores it in the storage device 984. That is, the fraud information generation unit 150 generates fraud proof information (exploit certificate) in which the exploit obtained from the vulnerability information DB 192 is set in the attribute information of the proof information specified by the setting attribute determination unit 140.
The inspection processing unit 160 uses the processing device 980 to inspect the inspection object 200 based on the fraud certification information generated by the fraud information generation unit 150. That is, the inspection processing unit 160 is, for example, inspection software. The inspection processing unit 160 has a function of performing secure communication with the inspection object 200, for example. The inspection processing unit 160 corresponds to, for example, HTTPS client or server software. The inspection processing unit 160 sends protocol data and fraud certification information to the inspection object 200.
The inspection information setting unit 162 sets the fraud proof information generated by the fraud information generation unit 150 to the inspection processing unit 160 that performs inspection by connecting to the inspection target 200 by the processing device 980. The inspection information setting unit 162 sets the fraud certification information in the inspection processing unit 160 that is inspection software.
The inspection execution unit 164 instructs the inspection processing unit 160 to which the inspection information setting unit 162 has set the fraud certification information to execute the inspection using the processing device 980. That is, the inspection execution unit 164 issues a command to start communication with the inspection target object 200 using fraud certification information to the inspection software.
The inspection result determination unit 166 determines, based on an instruction given by the inspection execution unit 164, whether or not the vulnerability has been reproduced based on the operation of the inspection target 200 with respect to the inspection performed by the inspection processing unit 160. For example, the inspection result determination unit 166 confirms whether or not a response from the inspection object 200 is assumed.
The inspection object 200 is an object to be inspected for the presence of vulnerability, and is, for example, a Web application, database, browser, or the like to which PKI is applied.

  Next, operation | movement of the vulnerability test apparatus 100 concerning Embodiment 1 is demonstrated based on FIG. 9, FIG. FIG. 9 is a diagram illustrating a process and a data flow of the vulnerability testing apparatus 100 according to the first embodiment. FIG. 10 is a flowchart showing a vulnerability inspection process (a vulnerability inspection method, a vulnerability inspection program) that is an operation of the vulnerability inspection apparatus 100 according to the first embodiment. Here, the vulnerability inspection apparatus 100 inspects defects and vulnerabilities related to certificate processing in a Web server to which SSL is applied.

  The vulnerability information storage unit 122 stores the vulnerability information and the corresponding exploit from the Internet 940 or the like in advance in the storage device 984 as the vulnerability information DB 192 (vulnerability information storage step). Further, the attribute information storage unit 124 stores each attribute of the specified proof information and attribute information that is information on the structure of the extension in the storage device 984 as the attribute information DB 194 (attribute information storage step).

  In the product operation storage step (S101), the product operation storage unit 120 stores the product information, the setting information, and the operation information in the storage device 984 as the product operation DB 190. Here, for example, the product operation storage unit 120 stores the product information, setting information, and operation information shown in FIG. That is, the product operation storage unit 120 stores WebserverX2.0. x, HTTPS is set as setting information, client authentication, CRL is used for checking PKC as operation information, information that CRL-DP is possible, OCSP is not possible is stored. FIG. 11 is an example of information stored in the product operation storage unit 120 as the product operation DB 190.

Next, in the vulnerability information search step (S102), the vulnerability information search unit 130 searches the vulnerability information DB 192 based on the product information and the setting information stored in the product operation DB 190. For example, the vulnerability information search unit 130 extracts the information shown in FIG. 12 as product information and setting information from the product operation DB 190. FIG. 12 is an example of information used by the vulnerability information search unit 130 as an inspection key. That is, the vulnerability information search unit 130 uses the product name WebserverX2.0. x, as the setting information, the secure protocol is SSL, the communication protocol is HTTP, and the security is client authentication. And the vulnerability information search part 130 searches vulnerability information DB192 using such information as a search key.
Here, it is assumed that the vulnerability information storage unit 122 stores the information illustrated in FIG. 13 in the vulnerability information DB 192, for example. FIG. 13 is an example of information stored in the vulnerability information DB 192. In other words, the vulnerability information DB 192 includes software name, attack type, processing for generating the vulnerability, location where the vulnerability occurs (library, OS, application itself, etc.), protocol, security, existence of exploit, exploit attack location, exploit Manage the console. In the security item, for example, when SSL is used, the security technology to be used such as SSL and client authentication is described. However, for simplicity of explanation, security vulnerabilities are not described here because they are not subject to inspection. However, an example in which security is described is an entry number. 4 shows. Entry No. 4, an example of vulnerability of SSH (Secure Shell) tool X is stored. Since this is vulnerable to the implementation of a security protocol called SSH, SSH is recorded in the security item.
For example, when searching the vulnerability information DB 192 with the search key, the vulnerability information search unit 130 requires a product name and an entry that matches one or more of a secure protocol, a communication protocol, and an authentication method. Search for. In this case, entry 1 is searched. Entry 1 is vulnerability information that a request of the HTTP engine of WebserverX is vulnerable and abnormal termination occurs due to an illegal URL. In this example, it is assumed that the search is not performed by SSL or client authentication but only by the keyword of WebserverX or HTTP. Here, it can be determined from the information of entry 1 that the location of the vulnerability is the URL processing. That is, a URL is specified for the attack location of Exploit (inspection information).

  Next, in a certification information search step (S103), the certification information search unit 142 searches for certification information to be used from the operation information stored in the product operation DB 190. The certification information search unit 142 determines that the CRL-DP is a candidate for setting the exploit from the operation information of the product operation DB 190. This determination is because the operation information describes that the CRL is used for the certificate revocation check as the certificate operation method. Moreover, since the use of OCSP which is a protocol for confirming revocation information is impossible, it is specified by CRL as a revocation confirmation means. Furthermore, it is because CRL can be acquired by using CRL-DP.

  Next, in the certification information attribute retrieval step (S104), the certification information attribute retrieval unit 144 retrieves the attribute information of the certification information retrieved by the certification information retrieval unit 142 from the attribute information stored in the attribute information DB 194. That is, the certification information attribute search unit 144 acquires CRL-DP structure information from the attribute information DB 194.

Next, in the setting attribute search step (S105), the setting attribute search unit 146 determines that a URL can be set in the CRL-DP. The setting attribute search unit 146 can already determine from the search result in the vulnerability information DB 192 that the type of exploit is URL. Therefore, the setting attribute search unit 146 searches for an attribute for which a URL can be set from the CRL-DP structure information shown in FIG. FIG. 14 is a diagram illustrating CRL-DP structure information as an example of attribute information stored in the attribute information DB 194. The setting attribute search unit 146 searches for a URL that can be set in the uniformResourceIdentifier as a result of the search. In other words, the setting attribute search unit 146 searches “CRL Distribution Point”, “Distribution Point”, “distribution Point”, “General Names”, “General Name”, “uniform Resource ID” in the order of “first”. As a result, the setting attribute search unit 146 determines to set “exploit” in the uniform ResourceIdentifier of the CRL-DP.
The setting attribute determination unit 140 then passes the CRL-DP uniform ResourceIdentifier to the unauthorized information generation unit 150 as attribute information for which “exploit” is set.
Here, (S103) to (S105) are setting attribute determination steps.

Next, in the fraud information generation step (S106), the fraud information generation unit 150 generates fraud certification information by setting the exploit acquired by the vulnerability information search unit 130 to the attribute determined by the setting attribute determination unit 140. And stored in the storage device 984. For example, the unauthorized information generation unit 150 first generates a pair of public key and secret key. Next, the fraudulent information generation unit 150 sets the URL of the exploit in the URL of the CRL-DP. For example, “http://www.abc.com/” is set as the URL of the exploit in the URL of the CRL-DP. Next, the fraud information generation unit 150 sets the public key generated above as the public key proved in the fraud certification information. Then, the fraudulent information generation unit 150 issues an issuer (issuer) so that the generated fraud certification information becomes a certificate under a fraudulent CA certificate that certifies a fraudulent CA that is a fraudulent authentication period separately generated for inspection. ) To set the subject of the unauthorized CA certificate. Further, the unauthorized information generation unit 150 gives a signature using an unauthorized CA private key paired with the unauthorized CA public key of the unauthorized CA certificate.
Here, for example, the vulnerability inspection apparatus 100 passes the unauthorized CA public key to the inspection object 200 in advance. That is, the unauthorized CA public key is stored in the trust store of the inspection object 200. Therefore, when the inspection object 200 receives and verifies the fraud certification information, the fraud certification information can be authenticated by the fraud CA public key in the trust store. Accordingly, the inspection object 200 trusts the fraud certification information. As a result, there is a possibility that the inspection target 200 may be vulnerable due to the exploit embedded in the attribute information of the fraud proof information.

  Next, in the inspection information setting step (S107), the inspection information setting unit 162 connects the fraud certification information generated by the fraud information generation unit 150 to the inspection object 200 and performs processing on the processing unit 160. Set by 980. Here, in order to inspect the Web server, the inspection information setting unit 162 uses the HTTPS client software as the inspection processing unit 160, and uses (S106) the fraud certification information generated by the fraud information generation unit 150 and the secret key. Set. As a test tool corresponding to the inspection processing unit 160, for example, a publicly available HTTPS library can be used. Some of the above libraries have publicly disclosed a mechanism for setting a secret key and a certificate. By using these, the operation of the inspection information setting unit 162 can be realized.

  Next, in the inspection execution step (S108), the inspection execution unit 164 instructs the inspection processing unit 160 to which the inspection information setting unit 162 has set the fraud certification information by the processing device 980 to execute the inspection. That is, the inspection execution unit 164 issues a command for connecting to the inspection target 200 to the inspection processing unit 160. For example, the inspection execution unit 164 can be realized as a script that executes an OS command. That is, it can be realized by writing a script for executing the above-described start command of the inspection processing unit 160.

Next, in the inspection processing step (S109), the inspection processing unit 160 performs an inspection on the inspection object 200 by the processing device 980 based on the fraud certification information generated by the fraud information generation unit 150. That is, the inspection processing unit 160 starts communication using HTTPS, and transmits fraud certification information as a certificate for client authentication in a handshake.
Here, the inspection object 200 corresponds to an SSL application Web server or the like. The inspection object 200 receives fraud certificate information sent as a certificate for client authentication according to the operation information in the handshake. Then, the inspection object 200 extracts the CRL-DP and further extracts the URL. “Exploit” is set in the URL. As described above, the inspection object 200 authenticates the fraud certification information with the fraud CA public key in the trust store and trusts the fraud certification information. Therefore, here, it is assumed that the inspection object 200 is passed to the HTTP processing layer as a parameter including the portion of the exploit. That is, it is assumed that the inspection object 200 has passed the attribute information in which the exploit is inserted (linked) as it is. As shown in FIG. 13, the HTTP processing layer has a vulnerability in which DoS occurs when exploit is passed. Accordingly, DoS is generated as a result of passing attribute information with the expand inserted to the HTTP processing layer as it is.

In the inspection result determination step (S110), the inspection result determination unit 166 determines, based on the operation of the inspection object 200 with respect to the inspection performed by the inspection processing unit 160, whether or not the vulnerability has been reproduced by the processing device 980. To do. The inspection result determination unit 166 waits for a reply from the inspection object 200, for example. If the vulnerability of the inspection target 200 is not reproduced, an error response may be returned. However, for example, if there is no reply and no TCP disconnection signal, the inspection result determination unit 166 can determine that the vulnerability has been reproduced due to the fraud certification information or that a defect has occurred. The inspection result determination unit 166 may determine that the vulnerability has been reproduced due to the fraud certification information or that a defect has occurred by checking the log output by the inspection object 200.
Here, (S107) to (S110) are inspection steps.

  As shown in FIG. 5, this example corresponds to confirming whether or not the HTTP defect or vulnerability of the PKI system can be reproduced by the fraud proof information. As described above, according to the vulnerability testing apparatus 100 according to the first embodiment, it is possible to generate fraud certification information by linking the vulnerability information DB 192, the product operation DB 190, and the attribute information DB 194. Then, it is possible to send fraud certification information to the inspection object 200 and check whether a defect or vulnerability occurs. If defects or vulnerabilities are confirmed, there is a high possibility that there is an error in the implementation. Therefore, it is possible to prepare for an attack with a certificate in advance by making corrections.

  That is, the vulnerability check apparatus 100 according to the first embodiment is an unauthorized PKI information generation apparatus having the following functions. The fraudulent PKI information generation device is a product operation DB 190 that stores software information, PKC usage information, communication means information, security setting information, and vulnerability information and exploit information stored in the PKI system to be inspected. Information DB192, PKI information DB (attribute information DB194) storing the PKC data format is used to search software vulnerability information and exploit in the PKI system to be inspected, and public key certificate (PKC) that stores the exploit , And generate an exploit certificate (incorrect proof information).

Embodiment 2. FIG.
Next, a second embodiment will be described. In the second embodiment, an example of a vulnerability inspection apparatus (unauthorized information generation apparatus) 100 when the inspection target 200 is an access control server will be described.

The function and operation flow of the vulnerability check apparatus 100 according to the second embodiment are the same as the function and operation flow of the vulnerability check apparatus 100 according to the first embodiment. Therefore, the operation of the vulnerability check apparatus 100 according to the second embodiment will be described with reference to FIGS. 15 and 10. FIG. 15 is a diagram illustrating a process and a data flow of the vulnerability check apparatus 100 according to the second embodiment.
Here, AC is used as fraud proof information, and a defect and vulnerability related to SQL processing in an access control server to which AC is applied are inspected.

  Like the first embodiment, the vulnerability information storage unit 122 stores the vulnerability information and the corresponding exploit from the Internet 940 or the like in advance in the storage device 984 as the vulnerability information DB 192 (vulnerability information storage step). Further, the attribute information storage unit 124 stores each attribute of the specified proof information and attribute information that is information on the structure of the extension in the storage device 984 as the attribute information DB 194 (attribute information storage step).

  In the product operation storage step (S101), the product operation storage unit 120 stores the product information, setting information, and operation information shown in FIG. That is, the product operation storage unit 120 stores information such as SQL-DBX1x as product information, SQL protocol as setting information, AC as operation information for access control, and AccessIdentity usage. FIG. 16 is an example of information stored in the product operation storage unit 120 as the product operation DB 190.

Next, in the vulnerability information search step (S102), the vulnerability information search unit 130 extracts the information shown in FIG. 17 as product information and setting information from the product operation DB 190, for example. FIG. 17 is an example of information used by the vulnerability information search unit 130 as an inspection key. That is, the vulnerability information search unit 130 extracts product name SQL-DBX1x as product information, secure protocol is not specified as setting information, communication protocol is SQL protocol, and security is not specified. And the vulnerability information search part 130 searches vulnerability information DB192 using such information as a search key.
Here, it is assumed that the vulnerability information storage unit 122 stores the information illustrated in FIG. 13 in the vulnerability information DB 192, for example, as in the first embodiment.
For example, when the vulnerability information search unit 130 searches the vulnerability information DB 192 using the search key, the vulnerability information search unit 130 includes an entry that requires a product name and matches any one or more of a secure protocol, a communication protocol, and security. Search for. In this case, entry 2 is searched. The entry 2 is vulnerability information indicating that the SQL-DBX access IF (interface) is vulnerable to SQL Injection. From entry 2, it can be determined that the location where the vulnerability occurs is the process of the access IF. That is, an SQL command is specified for the attack location of Exploit (inspection information).

  Next, in the certification information search step (S103), the certification information search unit 142 determines that AccessIdentity is a candidate for setting the exploit from the operation information of the product operation DB 190.

  Next, in the proof information attribute search step (S104), the proof information attribute search unit 144 acquires the structure information of AccessIdentity from the attribute information DB 194.

  Next, in the setting attribute search step (S105), the setting attribute search unit 146 determines that an SQL command can be set in AccessIdentity. The setting attribute search unit 146 can already determine from the search result in the vulnerability information DB 192 that the type of exploit is an SQL command. Therefore, the setting attribute search unit 146 searches for attributes that can set the SQL command from the structure information of AccessIdentity shown in FIG. FIG. 18 is a diagram illustrating the structure information of AccessIdentity as an example of attribute information stored in the attribute information DB 194. The setting attribute search unit 146 searches for a SQL command that can be set in the dNSName as a result of the search. That is, the setting attribute search unit 146 searches for dNSName by following the order of “AccessIdentity”, “SvceAuthInfo”, “ident”, “GeneralName”, and “dNSName”. Since SQL is a character string, an attribute that can store the character string is searched. As a result, the setting attribute search unit 146 determines to set “exploit” in the dNSName of AccessIdentity. Here, the attribute of dNSName is “IA5String: Any 7-bit US ASCII character”, and an SQL command can be set. That is, since the SQL command can be similarly set even in the case of rfc822Name and uniformResourceIdentifier, it is possible to set “exploit” in rfc822Name and uniformResourceIdentifier.

Next, in the fraud information generation step (S106), the fraud information generation unit 150 first sets an exploit SQL command as dNSName in the identity of AccessIdentity. For example, if the dNSName is “abc.com” and the SQL command is “SELECT * FROM ABC_T”, the unauthorized information generation unit 150 sets “abc.com: SELECT * FROM ABC_T”. Then, the fraud information generation unit 150 is configured so that the generated fraud certification information becomes a certificate under the fraud AA certificate that certifies the public key of the fraud AA that is a fraud attribute authentication authority that is separately generated for inspection. The Subject of the unauthorized AA certificate is set in Issuer. Furthermore, the unauthorized information generation unit 150 gives a signature using an unauthorized AA private key that is paired with the public key for the unauthorized AA.
As in the first embodiment, the vulnerability testing apparatus 100 passes the public key for unauthorized AA to the inspection target 200 in advance, for example. Therefore, when the inspection object 200 receives and verifies the fraud certification information, the fraud certification information can be authenticated by the public key for fraud AA. Accordingly, the inspection object 200 trusts the fraud certification information. As a result, there is a possibility that the inspection target 200 may be vulnerable due to the exploit embedded in the attribute information of the fraud proof information.

  Next, in the inspection information setting step (S107), the inspection information setting unit 162 uses the AC presentation client to be a pair as the inspection processing unit 160 to inspect the AC use access control server, and in (S106), generates illegal information. The fraud certification information generated by the unit 150 is set.

  Next, in the inspection execution step (S108), the inspection execution unit 164 issues a command to connect to the inspection object 200 to the inspection processing unit 160.

Next, in the inspection processing step (S109), the inspection processing unit 160 starts communication with the inspection object 200, and the fraud certification information is transmitted as AC.
Here, the inspection object 200 corresponds to an AC use access control server or the like. The inspection object 200 receives the sent fraud certification information. Then, the inspection object 200 extracts AccessIdentity, and further extracts an ident. The expand is inserted as dNSName in the ident. As described above, the inspection object 200 authenticates the fraud certification information with the public key for fraud AA and trusts the fraud certification information. For this reason, here, it is assumed that the inspection object 200 is passed as a parameter to the DB access processing layer including the portion of the exploit. In other words, it is assumed that the SQL command with the expand inserted (linked) is passed as it is. As shown in FIG. 13, the DB access processing layer has a vulnerability that causes SQL Injection when an exploit is passed. Therefore, SQL is executed as a result of passing the attribute information in which the exploit is inserted to the DB access processing layer as it is.

  In the inspection result determination step (S110), the inspection result determination unit 166 waits for a reply from the inspection object 200, for example. If the vulnerability of the inspection target 200 is not reproduced, an error response may be returned. However, for example, if there is no reply and no TCP disconnection signal, the inspection result determination unit 166 can determine that the vulnerability has been reproduced due to the fraud certification information or that a defect has occurred.

  As shown in FIG. 6, this example is equivalent to confirming whether or not the DB access failure or vulnerability of the PKI system can be reproduced by the fraud proof information. As described above, according to the vulnerability testing apparatus 100 according to the second embodiment, it is possible to generate fraud certification information by linking the vulnerability information DB 192, the product operation DB 190, and the attribute information DB 194. Then, it is possible to send fraud certification information to the inspection object 200 and check whether a defect or vulnerability occurs. If defects or vulnerabilities are confirmed, there is a high possibility that there is an error in the implementation. Therefore, it is possible to prepare for an attack with a certificate in advance by making corrections.

Embodiment 3 FIG.
Next, Embodiment 3 will be described. In the third embodiment, an example of a vulnerability inspection apparatus (incorrect information generation apparatus) 100 that inspects defects and vulnerabilities related to browser image processing when a browser accesses a Web server will be described.

The function and operation flow of the vulnerability check apparatus 100 according to the third embodiment are the same as the function and operation flow of the vulnerability check apparatus 100 according to the first embodiment. The operation of the vulnerability check apparatus 100 according to the third embodiment will be described with reference to FIGS. 19 and 10. FIG. 19 is a diagram illustrating a process and a data flow of the vulnerability check apparatus 100 according to the third embodiment.
Here, CC is used as fraud proof information, and a defect or vulnerability relating to browser image processing when the browser accesses a Web server to which CC is applied is inspected.

  Like the first embodiment, the vulnerability information storage unit 122 stores the vulnerability information and the corresponding exploit from the Internet 940 or the like in advance in the storage device 984 as the vulnerability information DB 192 (vulnerability information storage step). Further, the attribute information storage unit 124 stores each attribute of the specified proof information and attribute information that is information on the structure of the extension in the storage device 984 as the attribute information DB 194 (attribute information storage step).

  In the product operation storage step (S101), the product operation storage unit 120 stores the product information, setting information, and operation information shown in FIG. That is, the product operation storage unit 120 stores information that confirms the authenticity of the site by referring to browserXSP1 as the product information, HTTP as the setting information, and CC as the operation information, and referring to the Verifiable Content. FIG. 20 is an example of information stored in the product operation storage unit 120 as the product operation DB 190.

Next, in the vulnerability information search step (S102), the vulnerability information search unit 130 extracts the information shown in FIG. 21 as product information and setting information from the product operation DB 190, for example. FIG. 21 is an example of information used by the vulnerability information search unit 130 as an inspection key. That is, the vulnerability information search unit 130 extracts the product name browserXSP1 as product information, the secure protocol not specified as setting information, the communication protocol HTTP, and the security unspecified information. And the vulnerability information search part 130 searches vulnerability information DB192 using such information as a search key.
Here, it is assumed that the vulnerability information storage unit 122 stores the information illustrated in FIG. 13 in the vulnerability information DB 192, for example, as in the first embodiment.
For example, when the vulnerability information search unit 130 searches the vulnerability information DB 192 using the search key, the vulnerability information search unit 130 includes an entry that requires a product name and matches any one or more of a secure protocol, a communication protocol, and security. Search for. In this case, entry 3 is searched. Entry 3 is vulnerability information indicating that browserXSP1 has an image processing vulnerability. From entry 3, it can be determined that the location where the vulnerability is generated is the image display process. That is, GIF and JPEG are designated for the attack location of the Exploit (inspection information).

  Next, in the certification information retrieval step (S103), the certification information retrieval unit 142 determines that the Verifiable Content is a candidate for setting the exploit from the operation information in the product operation DB 190.

  Next, in the proof information attribute search step (S104), the proof information attribute search unit 144 acquires the structure information of the Verifiable Content from the attribute information DB 194.

  Next, in the setting attribute search step (S105), the setting attribute search unit 146 recognizes that an image can be set in the Verifiable Content. The setting attribute search unit 146 can already determine from the search result in the vulnerability information DB 192 that the type of exploit is GIF or JPEG. Therefore, the setting attribute search unit 146 searches for an attribute capable of setting GIF and JPEG from the structure information of the Verifiable Content as shown in the first and second embodiments.

Next, in the fraud information generation step (S106), the fraud information generation unit 150 first sets the GIF and JPEG of the exploit in the attribute of the verifiable content searched by the setting attribute search unit 146. Then, the fraudulent information generation unit 150 sends the fraudulent certificate information to the issuer so that the generated fraud certification information becomes a certificate under a fraudulent CA certificate that proves a fraudulent CA that is a fraudulent authentication period separately generated for inspection. Set the Subject of the certificate. Further, the unauthorized information generation unit 150 gives a signature using an unauthorized CA private key paired with the unauthorized CA public key of the unauthorized CA certificate.
As in the first embodiment, the vulnerability testing apparatus 100 passes the unauthorized CA public key to the inspection target 200 in advance, for example. Therefore, when the inspection object 200 receives and verifies the fraud certification information, the fraud certification information can be authenticated by the fraud CA public key. Accordingly, the inspection object 200 trusts the fraud certification information. As a result, there is a possibility that the inspection target 200 may be vulnerable due to the exploit embedded in the attribute information of the fraud proof information.

  Next, in the inspection information setting step (S107), the inspection information setting unit 162 uses the CC application website as the inspection processing unit 160 to inspect the browser, and the fraud information generated by the unauthorized information generation unit 150 in (S106). Set certification information. The inspection information setting unit 162 is usually implemented by using a mechanism for designating content installation in Web software.

  Next, in the inspection execution step (S108), the inspection execution unit 164 issues a command to connect to the inspection object 200 to the inspection processing unit 160.

Next, in the inspection processing step (S109), the inspection processing unit 160 starts communication with the inspection object 200, and fraud certification information is transmitted as CC.
Here, the inspection object 200 corresponds to a browser or the like. That is, the browser that is the inspection object 200 may access the inspection processing unit 160 when there is a command from the inspection execution unit 164. Alternatively, the user who performs the inspection may manually access the inspection processing unit 160 using a browser. When acquiring Web content, fraud certification information is transmitted as CC from the inspection processing unit 160. The browser which is the inspection object 200 receives the transmitted fraud certification information. Then, the inspection object 200 extracts the CC, and further extracts the attribute in which the image that is an Exploit of the Verifiable Content is inserted. As described above, the inspection object 200 authenticates the fraud certification information with the fraud CA public key and trusts the fraud certification information. Therefore, here, it is assumed that the inspection object 200 is passed as a parameter to the content display layer including the portion of the exploit. In other words, it is assumed that the image with the exploit inserted (connected) is passed as it is. As shown in FIG. 13, the content display layer has a vulnerability that BoF (Buffer OverFlow) occurs when “exploit” is passed. Therefore, BoF occurs as a result of passing the attribute information in which the exploit is inserted as it is to the content display layer.

  In the inspection result determination step (S110), the inspection result determination unit 166 waits for a reply from the inspection object 200, for example. If the vulnerability of the inspection target 200 is not reproduced, an error response may be returned. However, for example, if there is no reply and no TCP disconnection signal, the inspection result determination unit 166 can determine that the vulnerability has been reproduced due to the fraud certification information or that a defect has occurred. Alternatively, it is confirmed that a malfunction occurs such that content is not normally displayed because BoF has occurred in the browser that is the inspection object 200. This confirms the vulnerability of BoF.

  As shown in FIG. 7, this example corresponds to confirming whether or not the content display defect or vulnerability of the PKI system can be reproduced by the fraud proof information. As described above, according to the vulnerability testing apparatus 100 according to the third embodiment, fraud certification information can be generated by linking the vulnerability information DB 192, the product operation DB 190, and the attribute information DB 194. Then, it is possible to send fraud certification information to the inspection object 200 and check whether a defect or vulnerability occurs. If defects or vulnerabilities are confirmed, there is a high possibility that there is an error in the implementation. Therefore, it is possible to prepare for an attack with a certificate in advance by making corrections.

  In other words, the vulnerability testing apparatus 100 according to the second and third embodiments stores not only PKC but also AC, CC, etc. by storing information on the structure of various certificates other than PKC in the attribute information DB 194. A function for generating an exploit certificate of the certificate information is added.

Embodiment 4 FIG.
Next, a fourth embodiment will be described. In the fourth embodiment, a vulnerability inspection apparatus (incorrect information generation apparatus) 100 that generates fraud certification information for each piece of vulnerability information when a plurality of pieces of vulnerability information is searched will be described.

In each of the embodiments described above, when the vulnerability information search unit 130 searches for a plurality of vulnerability information from the vulnerability information DB 192 in the vulnerability information search step (S102), an exploit corresponding to each vulnerability information is displayed. You may generate a set certificate.
That is, the vulnerability information search unit 130 acquires inspection information for each vulnerability information of the plurality of vulnerability information when searching for a plurality of vulnerability information. The setting attribute determination unit 140 determines an attribute for setting the inspection information acquired by the vulnerability information search unit 130 for each vulnerability information of the plurality of vulnerability information based on the operation information and the attribute information. The fraud information generation unit 150 sets the corresponding inspection information to the attribute determined by the setting attribute determination unit 140, and generates fraud certification information for each vulnerability information of the plurality of vulnerability information.

  For example, assume that three pieces of vulnerability information are searched in the vulnerability information search step (S102) of the first embodiment. In this case, in the setting attribute determination step (S103-S105), the setting attribute determination unit 140 first selects the first vulnerability information (1). Next, the setting attribute determination unit 140 determines the attribute of the certificate in which the exploit corresponding to the selected vulnerability information is embedded using information in the product operation DB 190 and the attribute information DB 194 as in the first embodiment (2 ). Then, the vulnerability inspection apparatus 100 performs the same processing from the generation of fraud certification information to the inspection thereafter (3). When the process ends, the setting attribute determination unit 140 performs the processes (1) to (3) for the second vulnerability information that has been searched. When the process is completed, the setting attribute determination unit 140 performs the processes (1) to (3) for the third vulnerability information that has been searched. That is, the subsequent processing is repeated by the number of retrieved vulnerability information (S103).

  That is, the vulnerability testing apparatus 100 according to the fourth embodiment has a function of generating, one by one, a certificate in which a corresponding exploit is set when a plurality of vulnerability information is searched from the vulnerability information DB 192. It is a thing.

  In the second and third embodiments, the same processing can be performed when a plurality of vulnerabilities are searched.

Embodiment 5 FIG.
Next, a fifth embodiment will be described. In the fifth embodiment, a vulnerability inspection apparatus (unauthorized information generating apparatus) 100 that generates fraud certification information having an arbitrary combination of exploits when a plurality of pieces of vulnerability information are searched will be described.

In each of the above-described embodiments, when the vulnerability information search unit 130 searches for a plurality of vulnerability information from the vulnerability information DB 192 in the vulnerability information search step (S102), the vulnerability information search unit 130 selects any combination of the searched vulnerability information. You may generate | occur | produce the certificate which set the exploit corresponding to each vulnerability information contained.
That is, when searching for a plurality of vulnerability information, the vulnerability information search unit 130 acquires inspection information for a plurality of vulnerability information arbitrarily selected from the plurality of vulnerability information. The setting attribute determination unit 140 determines for each vulnerability information of a plurality of vulnerability information arbitrarily selected attributes for setting the inspection information acquired by the vulnerability information search unit 130 based on the operation information and the attribute information. . The fraud information generation unit 150 sets corresponding inspection information to the attribute determined by the setting attribute determination unit 140 and generates one fraud certification information. Alternatively, the fraud information generation unit 150 sets the corresponding inspection information to the attribute determined by the setting attribute determination unit 140, and generates fraud certification information for each combination of all vulnerability information of a plurality of vulnerability information. It doesn't matter.

  For example, in the first embodiment, it is assumed that three vulnerability information 852 are searched in the vulnerability information search step (S102). In this case, in the setting attribute determination step (S103-S105), the setting attribute determination unit 140 first selects a combination of vulnerability information. The three pieces of vulnerability information are referred to as vulnerability information 1, vulnerability information 2, and vulnerability information 3. For example, it is assumed that the vulnerability information 1 and the vulnerability information 3 are selected as a result of the setting attribute determination unit 140 selecting, for example, at random from the three pieces of vulnerability information (1). Next, the setting attribute determination unit 140 determines the attribute of the certificate in which the corresponding exploit is embedded for the vulnerability information 1 using the information in the product operation DB 190 and the attribute information DB 194 as in the first embodiment. This is attribute information 1 (2). Next, the setting attribute determination unit 140 determines the attribute of the certificate in which the corresponding exploit is embedded for the vulnerability information 3 using the information in the product operation DB 190 and the attribute information DB 194 as in the first embodiment. This is attribute information 3 (3). The setting attribute determination unit 140 passes the two pieces of attribute information determined in the processes (2) and (3) to the unauthorized information generation unit 150 (4). The unauthorized information generation unit 150 receives the exploit 1 corresponding to the attribute information 1 from the vulnerability information DB 192. Similarly, exploit3 corresponding to the attribute information 3 is received from the vulnerability information DB 192 (5). The fraud information generating unit 150 generates fraud certification information in which the attribute information 1 is set to “exploit 1” and the attribute information 3 is set to “exploit 3” (6). The vulnerability checking apparatus 100 thereafter performs the same processing from setting of the exploit certificate to checking (7).

  Arbitrary combinations of vulnerability information can be obtained by displaying the searched vulnerability information and allowing the operator to select the vulnerability to be adopted using GUI (Graphical User Interface), etc. You can choose. In addition, all searched vulnerability information may be included. Moreover, about the method of selecting a combination at random, the existing method can be used.

  Further, as shown in FIG. 22, the vulnerability testing apparatus 100 may be provided with a function that allows an operator to select a combination of vulnerability information using a GUI. FIG. 22 is a functional block diagram of the vulnerability check apparatus 100 according to the fifth embodiment having a function of allowing an operator to select a combination of vulnerability information using a GUI. The vulnerability check apparatus 100 according to the fifth embodiment includes a vulnerability information selection unit 132 in addition to the functions of the vulnerability check apparatus 100 according to the first embodiment. When the vulnerability information search unit 130 searches for a plurality of pieces of vulnerability information, the vulnerability information selection unit 132 selects predetermined vulnerability information from the searched pieces of vulnerability information using the input device 982. That is, the vulnerability information selection unit 132 selects, for example, the vulnerability in which the searched vulnerability information is displayed as a list. Therefore, for example, the vulnerability information search unit 130 acquires inspection information for the predetermined vulnerability information selected by the vulnerability information selection unit 132. Next, the setting attribute determination unit 140 sets the predetermined vulnerability information selected by the vulnerability information selection unit 132 based on the operation information and the attribute information. The vulnerability information selection unit 132 selects the attribute for setting the inspection information acquired by the vulnerability information search unit 130. Determine for each vulnerability information. Then, the fraud information generation unit 150 sets corresponding inspection information to the attribute determined by the setting attribute determination unit 140 and generates one fraud certification information.

  FIG. 23 is an example of a vulnerability information selection GUI. As shown in FIG. 23, the vulnerability information selection unit 132 can specify a combination from the three vulnerabilities of vulnerability information 1, vulnerability information 2, and vulnerability information 3. In FIG. 23, the vulnerability information selection unit 132 can select a combination by causing the operator to check the vulnerability information 1 and the vulnerability information 3, for example, and pressing an execution button.

  That is, the vulnerability testing apparatus 100 according to the fifth embodiment has a function of generating certification information having an arbitrary combination of corresponding exploits when a plurality of vulnerability information is searched from the vulnerability information DB 192. It is a thing. Here, the combination is determined by displaying the searched vulnerability information and allowing the operator to select the vulnerability to be adopted using the GUI, the method in which the device randomly selects a combination, and the method in which all combinations are generated. It is done.

  In the second and third embodiments, the same processing can be performed when a plurality of vulnerabilities are searched. Further, fraud certification information for every combination may be automatically generated.

Embodiment 6 FIG.
Next, a sixth embodiment will be described. In the sixth embodiment, a vulnerability checking device (illegal information generating device) 100 that generates a derived-type exploit in which a blank character or the like is mixed in an exploit to generate fraud certification information will be described.

  The vulnerability checking apparatus 100 may generate a derived exploit by designating parameters such as the type, number, and position of the mixed characters when a derived system such as mixing of blank characters is considered in the exploit. And the vulnerability test | inspection apparatus 100 may produce | generate the corresponding exploit certificate. In that case, the vulnerability testing apparatus 100 includes a GUI for setting parameters, for example.

  FIG. 24 is a functional block diagram illustrating functions of the vulnerability check apparatus 100 according to the sixth embodiment having a function of setting parameters. The vulnerability check apparatus 100 according to the sixth embodiment includes a change information input unit 152 in addition to the functions of the vulnerability check apparatus 100 according to the first embodiment. The change information input unit 152 inputs the change information of the inspection information with the input device 982. Then, the fraud information generation unit 150 sets the inspection information in which the change information input by the change information input unit 152 is reflected in the inspection information acquired by the vulnerability information search unit 130 in the attribute determined by the setting attribute determination unit 140 Then, fraud proof information is generated and stored in the storage device 984.

  FIG. 25 is an example of a vulnerability information editing GUI. As shown in FIG. 25, the change information input unit 152 can edit the exploit information of the displayed vulnerability information. The change information input unit 152 can generate fraud certification information in which a derived exploit is set, for example, by causing the operator to modify the exploit and pressing an edit completion button.

  FIG. 26 shows another example of the vulnerability information editing GUI. As shown in FIG. 26, the change information input unit 152 causes the operator to specify the insertion location for specifying the position of the insertion character in the exploit, the insertion character string for specifying the character string to be inserted, and the number of insertions for specifying the number of insertions. By pressing the completion button, it is possible to generate fraud certification information in which a derived exploit with a character string inserted is set.

  Further, the change information input unit 152 may automatically set a character string by designating a setting file instead of designating insertion of a character by using a GUI. For example, the change information input unit 152 can read the setting file designated as “insert three 'fff' at the beginning of the exploit” and generate an exploit with three 'fff' inserted at the beginning. is there.

  That is, the vulnerability testing apparatus 100 according to the sixth embodiment generates a derived exploit by designating parameters such as the type, number, and position of mixed characters when a derived system such as mixing of blank characters is considered in the exploit. A function for generating corresponding fraud proof information is added. In addition, as a parameter insertion method, a method of allowing an operator to select a parameter using a GUI, a method of automatically inserting a preset parameter, or the like can be considered.

Embodiment 7 FIG.
Next, a seventh embodiment will be described. In the seventh embodiment, a vulnerability inspection apparatus (incorrect information generation apparatus) 100 that adds an abnormal value setting of an attribute to an incorrect certification information in addition to an exploit setting will be described.

  Vulnerability inspection apparatus 100 may include a function of adding an abnormal value setting of an attribute in addition to an exploit setting managed by vulnerability information DB 192 as the content of fraud proof information. For example, the change information input unit 152 described above may perform this process. The change information input unit 152 adds, for example, expiration date, signature abnormality, format violation of a known extension, etc. to the fraud certification information. In that case, the vulnerability testing apparatus 100 includes a GUI for setting various parameters, for example.

FIG. 27 is an example of an attribute setting GUI for adding the abnormal value setting of the attribute to the fraud proof information. As shown in FIG. 27, the change information input unit 152 displays and inputs some of the required attributes such as version, expiration date, and subject, and PKC attributes such as key usage and certificate policy. Thus, the setting of the abnormal value of the attribute can be added to the fraud certification information. Here, the change information input unit 152 designates an abnormal value as the designated value. For example, if the expiration date is 1042, the change information input unit 152 reversely specifies the start and end dates, such as 071001 (YYMMDD) to 051031 (YYMMDD). For example, the change information input unit 152 designates a value that is not accepted by the system to be inspected in the certificate policy 1045. An attribute to be specified is performed by, for example, checking a selection column. In addition, when the edit completion button is pressed, fraud certification information having an abnormal attribute value and setting “exploit” is generated.
Examples of these attributes are only a part, and specifications such as PKC and AC are defined. By displaying the defined attributes on the GUI, the operator can specify an abnormal value. You may specify abnormal values for multiple attributes. In addition, an abnormal value may be automatically set by specifying an abnormal value in a setting file instead of specifying an abnormal value by using a GUI.

  That is, the vulnerability testing apparatus 100 according to the seventh embodiment has a function for setting an abnormal value of an attribute as fraud proof information in addition to the setting of the exploit managed in the vulnerability information DB 192. Here, the abnormal value of the attribute is, for example, an expiration date, an abnormal signature, a format violation of a known extension, or the like. Further, as a method for adding an abnormal value setting, a method for allowing an operator to specify an attribute and an abnormal value using a GUI, a method for automatically inserting a preset attribute and an abnormal value, and the like can be considered.

Embodiment 8 FIG.
Next, an eighth embodiment will be described. In the eighth embodiment, a vulnerability inspection apparatus (unauthorized information generation apparatus) 100 that automatically registers product information in the product operation DB 190 will be described.

In addition to manually setting the information of the inspection object 200 in advance by using a GUI or the like when registering information in the product operation DB 190, the vulnerability inspection apparatus 100 uses the OS or application fingerprinting technique. It is also possible to automatically collect this information via the network.
Here, fingerprinting means that, for example, when an HTTP request is transmitted to a Web server, the product name and version of the Web server being used are returned as a response. Also, it means that the OS name is returned by telnet connection. Using the fingerprint as the returned information, the OS of the host of the inspection object 200 and the version of the software used are acquired.

  FIG. 28 is a functional block diagram illustrating functions of the vulnerability check apparatus 100 according to the eighth embodiment that automatically registers product information in the product operation DB 190. The vulnerability check apparatus 100 according to the eighth embodiment includes a product information collection unit 172 in addition to the vulnerability check apparatus 100 according to the first embodiment. The product information collection unit 172 collects product information of the inspection target 200 by fingerprinting. The product operation storage unit 120 stores the product information collected by the product information collection unit 172.

  In the eighth embodiment, the product information is automatically registered without manually registering the product information in the product operation DB 190 by using the same method as that of the tool for acquiring the OS of the host and the version of the software being used. Is possible.

  That is, the vulnerability testing apparatus 100 according to the eighth embodiment does not manually set information to be tested in advance using a GUI or the like when registering information in the product operation DB 190, but by using an OS or application fingerprinting technique. A function for automatically collecting information on the OS / application being used via a network is added.

Embodiment 9 FIG.
Next, Embodiment 9 will be described. In the ninth embodiment, a vulnerability inspection apparatus (unauthorized information generation apparatus) 100 that automatically registers operation information in the product operation DB 190 will be described.

  When the inspection target 200 is a server or the like, the vulnerability inspection apparatus 100 automatically investigates what operation is being performed, rather than manually registering it in the product operation DB 190. For example, the vulnerability inspection apparatus 100 inspects an open port by a port scan. At this time, if the port 443 is operating, HTTPS is operating. That is, the vulnerability testing apparatus 100 can determine that an SSL-compatible Web server is operating. Next, if the Certificate Request is transmitted from the server by the SSL handshake, the vulnerability testing apparatus 100 can determine that the server requires client authentication. Even when the Certificate Request is not transmitted, there is a server that checks the transmitted client certificate when the Client Certificate is transmitted from the client side. The vulnerability inspection apparatus 100 provides a client certificate when the behavior is different between when a normal client certificate is sent and when the validity period has expired or when a certificate whose signature has been tampered is sent. However, if it is received, it can be determined that the operation is checking.

  FIG. 29 is a functional block diagram illustrating functions of the vulnerability check apparatus 100 according to the ninth embodiment that automatically registers operation information in the product operation DB 190. The vulnerability testing apparatus 100 according to the ninth embodiment includes an operation information specifying unit 174 in addition to the vulnerability testing apparatus 100 according to the first embodiment. The operation information specifying unit 174 performs a port scan on the inspection target 200 and specifies a service used in the PKI system operating on the inspection target 200. The product operation storage unit 120 stores the service collected by the operation information specifying unit 174 as product information.

  In the ninth embodiment, product information can be automatically registered without manually registering product operation information in the product operation DB 190 by port scanning or the like.

  That is, when the inspection target 200 is a server, the vulnerability inspection apparatus 100 according to the ninth embodiment inspects the operation that is being performed, the port that is opened by the port scan, and the attack target PKI. It adds a function that identifies system services.

Embodiment 10 FIG.
Next, Embodiment 10 will be described. The first to ninth embodiments described above can be applied not only to PKC, AC, and CC but also to other certification information. For example, other certificates specified by IETF (Internet Engineering Task Force) such as QC (Qualified Certificate, RFC3739), PC (Proxy Certificate, RFC3820), CSC (Code Signaling Certificate), CSC (Code Signaling Certificate), It can also be applied to unique certificates that are not specified in the IETF. By storing information on the structure of these certificates in the attribute information DB 194, each piece of fraud certification information can be created.

Embodiment 11 FIG.
Next, Embodiment 11 will be described. In the eleventh embodiment, an example of a vulnerability check apparatus (unauthorized information generation apparatus) 100 that sets an exploit for certificate revocation information will be described.

Vulnerability inspection apparatus 100 can generate not only certificates but also CRL and OCSP requests and responses in attribute information DB 194 to generate exploit CRL and exploit OCSP requests and responses as fraud proof information.
For example, according to RFC3280, it is possible to publish the difference information for the CRL as DeltaCRL in the CRL. In the CRL, the disclosure location of the DeltaCRL can be indicated by an extension of “FreshestCRL :: = CRLDtributionPoints”.

The function and operation flow of the vulnerability check apparatus 100 according to the eleventh embodiment are the same as the function and operation flow of the vulnerability check apparatus 100 according to the first embodiment. Therefore, the operation of the vulnerability check apparatus 100 according to the eleventh embodiment will be described based on FIG. 30 and FIG. FIG. 30 is a diagram illustrating a process and a data flow of the vulnerability testing apparatus 100 according to the eleventh embodiment.
Here, a defect or vulnerability related to the CRL processing of the S / MIME mailer is inspected.

  Like the first embodiment, the vulnerability information storage unit 122 stores the vulnerability information and the corresponding exploit from the Internet 940 or the like in advance in the storage device 984 as the vulnerability information DB 192 (vulnerability information storage step). Further, the attribute information storage unit 124 stores each attribute of the specified proof information and attribute information that is information on the structure of the extension in the storage device 984 as the attribute information DB 194 (attribute information storage step).

  Next, in the product operation storage step (S101), the product operation storage unit 120 stores the product information, setting information, and operation information shown in FIG. FIG. 31 is an example of information stored in the product operation storage unit 120 as the product operation DB 190. That is, the product operation storage unit 120 stores information that S / MIME mailerX is used as product information, HTTP is used as setting information, and CRL is used for checking PKC as operation information. FIG. 31 is an example of information stored in the product operation storage unit 120 as the product operation DB 190.

Next, in the vulnerability information search step (S102), the vulnerability information search unit 130 takes out the information shown in FIG. 32 as product information and setting information from the product operation DB 190, for example. FIG. 32 is an example of information used by the vulnerability information search unit 130 as an inspection key. That is, the vulnerability information search unit 130 extracts product name S / MIME mailer as product information, secure protocol S / MIME as setting information, HTTP as a communication protocol, and no designation of security. And the vulnerability information search part 130 searches vulnerability information DB192 using such information as a search key.
As a result, it is assumed that there is a vulnerability in an HTTP engine request, and vulnerability information that an abnormal termination occurs due to an illegal URL is retrieved.

  Next, in the certification information retrieval step (S103), the certification information retrieval unit 142 determines that the CRL is a candidate for setting the exploit from the operation information in the product operation DB 190. This is because it is described that the CRL is used for the certificate revocation check as the certificate operation method.

  Next, in the certification information attribute retrieval step (S104), the certification information attribute retrieval unit 144 obtains CRL structure information from the attribute information DB 194.

  Next, in the setting attribute search step (S105), the setting attribute search unit 146 determines that a URL can be set in the RefreshCRL. The setting attribute search unit 146 can already determine from the search result in the vulnerability information DB 192 that the type of exploit is URL. Therefore, the setting attribute search unit 146 searches for an attribute for which a URL can be set from the CRL structure information. The RefreshCRL, which is an extension of the CRL, is defined in the same type as the CRLDtributionPoints. However, as shown in the first embodiment, it can be seen that a URL can be set in the uniformResourceIdentifier of the CRLdistributionPoints. That is, the setting attribute search unit 146 searches “CRL Distribution Point”, “Distribution Point”, “distribution Point”, “GeneralNames”, “GeneralName”, and “UniformResourceIdentif” in the order of “RegularIdentifier”. That is, it is determined that the RefreshCRL is suitable for setting the exploit. As a result, the setting attribute search unit 146 determines to set the exploit to the URL of the RefreshCRL that is an extension of the CRL.

Next, in the fraudulent information generation step (S106), the fraudulent information generation unit 150 first sets fraud URL “http://www.abc.com/... An expireCRL that is certification information is generated. At this time, the fraudulent information generation unit 150 sends the fraudulent certification information to the issuer so that the generated fraud certification information becomes a CRL under a fraudulent CA certificate that certifies a fraudulent CA that is a fraudulent authentication period separately generated for inspection. Set the Subject of the certificate. Further, the unauthorized information generation unit 150 gives a signature using an unauthorized CA private key paired with the unauthorized CA public key of the unauthorized CA certificate.
As in the first embodiment, the vulnerability inspection apparatus 100 passes the unauthorized CA public key to the inspection object 200 in advance. Therefore, when the inspection object 200 receives and verifies the fraud certification information, the fraud certification information can be authenticated by the fraud CA public key. Accordingly, the inspection object 200 trusts the fraud certification information. As a result, there is a possibility that the inspection target 200 may be vulnerable due to the exploit embedded in the attribute information of the fraud proof information.

  Next, in the inspection information setting step (S107), the inspection information setting unit 162 sets the fraud certification information generated by the fraud information generation unit 150 in (S106) with the S / MIME mail client as the inspection processing unit 160. .

  Next, in the inspection execution step (S108), the inspection execution unit 164 issues a command to connect to the inspection object 200 to the inspection processing unit 160.

Next, in the inspection processing step (S109), the inspection processing unit 160 generates an S / MIME signature mail 1156 and attaches an exposeCRL that is fraud proof information. For the signature, an S / MIME signature certificate under an unauthorized CA certificate is issued in advance, a signature is added to the S / MIME mail, and the S / MIME signature certificate is attached to the mail. That is, the S / MIME signature mail is attached with the S / MIME certificate and the exploitCRL. Then, the inspection processing unit 160 transmits an S / MIME signature mail with fraud information attached to the inspection object 200.
The method for attaching (storing) the certificate and CRL to the S / MIME signature mail is performed based on, for example, RFC2311 (S / MIME Version 2 Message Specification).
Here, the inspection object 200 corresponds to an S / MIME mailer. In the inspection object 200, an operation for inspecting the signature of the S / MIME signature mail is performed. Since the inspection object 200 succeeds by checking the signature of the exploitCRL, which is the attached illegal certification information, it extracts the RefreshCRL and further extracts the URL. Although an exploit is inserted in the URL, it is assumed that even the portion of the exploit is included and passed to the HTTP processing layer as a parameter. In other words, it is assumed that the URL “http://www.abc.com/...” Into which the exploit has been inserted (linked) is directly passed to the HTTP processing layer. The HTTP processing layer has a vulnerability that causes an abnormal termination when exploit is passed. Therefore, abnormal termination occurs as a result of passing the URL into which the exploit is inserted (linked) as it is to the HTTP processing layer.

  Then, in the inspection result determination step (S110), the inspection result determination unit 166 confirms whether or not a phenomenon such as, for example, the processing is delayed more than a predetermined value occurs. If the vulnerability of the inspection target 200 is not reproduced, the process should be performed at a predetermined speed. However, for example, when the processing is slower than a predetermined value, the inspection result determination unit 166 can determine that the vulnerability has been reproduced due to the fraud proof information or that a defect has occurred.

  As described above, according to the vulnerability check apparatus 100 according to the eleventh embodiment, the vulnerability information DB 192, the product operation DB 190, and the attribute information DB 194 are linked to generate the exploit CRL as fraud proof information, and this is checked. Send to 1109 and check if any problems or vulnerabilities occur. If a defect or vulnerability can be confirmed, there is a high possibility that there is an error in the implementation. Therefore, it is possible to prepare for an attack by CRL in advance by correcting it.

Embodiment 12 FIG.
Next, an embodiment 12 will be described. In the twelfth embodiment, an example of a vulnerability check apparatus (unauthorized information generation apparatus) 100 that sets an exploit for an OCSP that receives an inquiry about a certificate revocation status and returns a response will be described.

First, the outline of OCSP will be described with reference to FIG. FIG. 33 is a diagram showing an outline of the OCSP.
The OCSP client 410 sets certificate information to be verified in the OCSP request 412 and transmits it to the OCSP server 420. The OCSP server 420 sets the revocation status of the certificate inquired by the OCSP request 412 in the OCSP response 422 and sends it back to the OCSP client 410.
The OCSP request 412 is accompanied by the signature and certificate of the OCSP client itself. However, attaching the signature and certificate of the OCSP client itself to the OCSP request is optional and not required. The OCSP response 422 is attached with the signature and certificate of the OCSP server 420 itself.

  In the twelfth embodiment, fraud certification information is transmitted to the OCSP client 410 / server 420 to check for the presence of vulnerability.

  First, the function and operation flow of the vulnerability check apparatus 100 according to the twelfth embodiment are the same as the function and operation flow of the vulnerability check apparatus 100 according to the first embodiment. Therefore, a part different from the first embodiment will be described for a method for inspecting whether or not there is a vulnerability by transmitting fraud certification information to the OCSP client 410 / server 420.

First, a case where the vulnerability of the OCSP client 410 is inspected will be described. When the vulnerability of the OCSP client 410 is inspected, the inspection object 200 is the OCSP client 410. The software of the OCSP server 420 is the inspection processing unit 160. The product operation storage unit 120 sets software information of the OCSP client 410 in the product operation DB 190. Further, the attribute information storage unit 124 sets information on the data structure of PKC and OCSP in the attribute information DB 194.
Here, the OCSP server 420 returns an OCSP response 422 to the OCSP client 410, and the fraud certification information is stored in the OCSP response 422. Since the signature and certificate of the OCSP server 420 are added to the OCSP response 422, the vulnerability check apparatus 100 generates fraud certification information and stores it in the OCSP response 422 as in the first embodiment.

Next, a case where the vulnerability of the OCSP server 420 is inspected will be described. When the vulnerability of the OCSP server 420 is inspected, the inspection target 200 is the OCSP server 420. The software of the OCSP client 410 is the inspection processing unit 160. The product operation storage unit 120 sets software information of the OCSP server 420 in the product operation DB 190. Further, the attribute information storage unit 124 sets information on the data structure of PKC and OCSP in the attribute information DB 194.
Here, the OCSP client 410 transmits an OCSP request 412 to the OCSP server 420, and stores the invalid certification information in the OCSP request 412. Since the signature and certificate of the OCSP client 410 are added to the OCSP request 412, the vulnerability check apparatus 100 generates fraud certification information and stores it in the OCSP request 412 as in the first embodiment. Note that attaching the signature and certificate of the OCSP client itself to the OCSP request is optional because it is optional, but here it is attached.

In the twelfth embodiment, the exploit is stored in the certificate of the sender in the OCSP request 412 / response 422. However, if the data structure of the appropriate OCSP request 412 / response 422 for storing the exploit information of the vulnerability information retrieved from the vulnerability information DB 192 is detected other than the certificate, the data is implemented for that data. As shown in the first to ninth forms, an exploit may be set for the data.
For example, it corresponds to both OCSP request 412 / response 422, corresponds to Nonce for setting binary data, corresponds to OCSP response 422, corresponds to CRLReferences for setting URL, Service Locator for setting URL, etc. The extension of the OCSP protocol data may be applicable.

  In other words, the vulnerability check apparatus 100 according to the eleventh and twelfth embodiments stores information on the structure of various revocation information such as CRL, OCSP, etc. in the attribute information DB 194, thereby allowing the expiry revocation information (illegal revocation information). ) Is added.

The figure which showed an example of the external appearance of the vulnerability test | inspection system 1000 concerning embodiment. The figure which shows an example of the hardware constitutions of the vulnerability test | inspection apparatus 100 in embodiment. The figure which shows the outline | summary of the vulnerability test | inspection apparatus 100 concerning embodiment. The functional block diagram of the system which protects HTTP communication by SSL. The figure which shows the example of the unauthorized access using the attribute of PKC. The figure which shows the example of the unauthorized access using the attribute of AC. The figure which shows the example of the unauthorized access using the attribute of CC. FIG. 3 is a functional block diagram showing functions of the vulnerability check apparatus 100 according to the first embodiment. The figure which showed the process of the vulnerability test apparatus 100 concerning Embodiment 1, and the flow of data. 3 is a flowchart showing vulnerability inspection processing (a vulnerability inspection method, a vulnerability inspection program) that is an operation of the vulnerability inspection apparatus 100 according to the first embodiment; An example of information which product operation storage part 120 memorizes as product operation DB190. An example of information used by the vulnerability information search unit 130 as an inspection key. An example of the information memorize | stored in vulnerability information DB192. The figure which shows the structure information of CRL-DP as an example of the attribute information which attribute information DB194 memorize | stores. The figure which showed the process and data flow of the vulnerability test apparatus 100 concerning Embodiment 2. FIG. An example of information which product operation storage part 120 memorizes as product operation DB190. An example of information used by the vulnerability information search unit 130 as an inspection key. The figure which shows the structure information of AccessIdentity as an example of the attribute information which attribute information DB194 memorize | stores. The figure which showed the process of the vulnerability test apparatus 100 concerning Embodiment 3, and the flow of data. An example of information which product operation storage part 120 memorizes as product operation DB190. An example of information used by the vulnerability information search unit 130 as an inspection key. FIG. 10 is a functional block diagram of a vulnerability check apparatus 100 according to the fifth embodiment, which has a function of allowing an operator to select a combination of vulnerability information using a GUI. An example of a vulnerability information selection GUI. FIG. 9 is a functional block diagram showing functions of the vulnerability check apparatus 100 according to the sixth embodiment having a function of setting parameters. An example of a GUI for editing vulnerability information. Another example of GUI for editing vulnerability information. An example of an attribute setting GUI for adding an abnormal value setting of an attribute to fraud proof information. FIG. 10 is a functional block diagram showing functions of the vulnerability check apparatus 100 according to the eighth embodiment for automatically registering product information in the product operation DB 190; FIG. 10 is a functional block diagram showing functions of the vulnerability check apparatus 100 according to the ninth embodiment that automatically registers operation information in the product operation DB 190; The figure which showed the process of the vulnerability test apparatus 100 concerning Embodiment 11, and the flow of data. An example of information which product operation storage part 120 memorizes as product operation DB190. An example of information used by the vulnerability information search unit 130 as an inspection key. The figure which shows the outline | summary of OCSP.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 Vulnerability inspection apparatus, 110 Vulnerability inspection part, 120 Product operation storage part, 122 Vulnerability information storage part, 124 Attribute information storage part, 130 Vulnerability information search part, 132 Vulnerability information selection part, 140 Setting attribute determination part 142 Certification information search unit, 144 Certification information attribute search unit, 146 Setting attribute search unit, 150 Unauthorized information generation unit, 152 Change information input unit, 160 Inspection processing unit, 162 Inspection information setting unit, 164 Inspection execution unit, 166 Inspection Result determination unit, 172 Product information collection unit, 174 Operation information identification unit, 200 Inspection object, -901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 908 database, 909 system unit, 910 server 911 CPU, 912 bus, 913 ROM, 914 RA M, 915 communication board, 916 external server, 920 magnetic disk unit, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 FAX machine, 940 Internet, 941 gateway, 942 LAN, 980 processing unit 982 Input device, 984 Storage device, 986 Display device, 988 Communication device.

Claims (16)

A product operation storage unit for storing in the storage device product information of the inspection object in the public key infrastructure system, security setting information of the inspection object, and operation information including certification information used by the inspection object;
A vulnerability information storage unit for storing the vulnerability information of the inspection object and the inspection information for the vulnerability information in a storage device;
An attribute information storage unit for storing attribute information of the certification information in a storage device;
Vulnerability information search that searches for vulnerability information stored in the vulnerability information storage unit based on product information and setting information stored in the product operation storage unit, and obtains inspection information for the vulnerability information by a processing device And
A setting attribute determination unit that determines, by a processing device, an attribute for setting inspection information acquired by the vulnerability information search unit based on the operation information stored in the product operation storage unit and the attribute information stored in the attribute information storage unit When,
An illegal information generation unit configured to set the inspection information acquired by the vulnerability information search unit to the attribute determined by the setting attribute determination unit, generate fraud certification information, and store the fraud information in a storage device. Unauthorized information generator. The fraudulent information generation device further includes:
An inspection information setting unit that sets the fraud certification information generated by the fraud information generation unit to the inspection processing unit that performs inspection by connecting to the inspection object,
An inspection execution unit that instructs the execution of inspection by the processing device to the inspection processing unit in which the inspection information setting unit sets the fraud certification information;
An inspection result determination unit that determines whether or not the vulnerability has been reproduced based on the operation of the inspection object with respect to the inspection performed by the inspection processing unit according to the instruction given by the inspection execution unit. The unauthorized information generating apparatus according to claim 1. The setting attribute determination unit
A certification information retrieval unit for retrieving certification information to be used from the operational information stored in the product operational storage unit;
A proof information attribute search unit for searching attribute information of the proof information searched by the proof information search unit from the attribute information stored by the attribute information storage unit;
2. A setting attribute search unit for searching for an attribute capable of setting a test location of test information searched by the vulnerability information search unit from attribute information searched by the proof attribute information search unit. Incorrect information generator. The vulnerability information search unit, when searching for a plurality of vulnerability information, obtains inspection information for each vulnerability information of the plurality of vulnerability information,
The setting attribute determination unit determines an attribute for setting the inspection information acquired by the vulnerability information search unit for each vulnerability information of the plurality of vulnerability information based on the operation information and the attribute information,
The fraud information generation unit sets the corresponding inspection information to the attribute determined by the setting attribute determination unit, and generates fraud certification information for each vulnerability information of the plurality of vulnerability information. The unauthorized information generating apparatus according to claim 1. The vulnerability information search unit, when searching for a plurality of vulnerability information, obtains inspection information for a plurality of vulnerability information arbitrarily selected from the plurality of vulnerability information,
The set attribute determining unit determines, based on the operation information and attribute information, for each vulnerability information of the plurality of arbitrarily selected vulnerability information, the attribute for setting the inspection information acquired by the vulnerability information search unit And
2. The fraud information generating apparatus according to claim 1, wherein the fraud information generating unit sets corresponding inspection information to the attribute determined by the setting attribute determination unit and generates one fraud certification information. The fraudulent information generation device further includes:
When the vulnerability information search unit searches for a plurality of vulnerability information, the vulnerability information search unit includes a vulnerability information selection unit that selects predetermined vulnerability information from the plurality of searched vulnerability information using an input device,
The vulnerability information search unit acquires inspection information for the predetermined vulnerability information selected by the vulnerability information selection unit,
The setting attribute determining unit determines, based on the operation information and the attribute information, an attribute for setting the inspection information acquired by the vulnerability information searching unit with respect to the predetermined vulnerability information selected by the vulnerability information selecting unit. And
2. The fraud information generating apparatus according to claim 1, wherein the fraud information generating unit sets corresponding inspection information to the attribute determined by the setting attribute determination unit and generates one fraud certification information. The vulnerability information search unit, when searching for a plurality of vulnerability information, obtains inspection information for each vulnerability information of the plurality of vulnerability information,
The setting attribute determination unit determines an attribute for setting the inspection information acquired by the vulnerability information search unit for each vulnerability information of the plurality of vulnerability information based on the operation information and the attribute information,
The fraud information generation unit sets the corresponding inspection information to the attribute determined by the setting attribute determination unit, and generates fraud certification information for each combination of all the vulnerability information of the plurality of vulnerability information. The fraud information generating apparatus according to claim 1, wherein: The fraudulent information generation device further includes:
Provided with a change information input unit for inputting inspection information change information,
The fraudulent information generation unit sets inspection information in which the change information input by the change information input unit is reflected in the inspection information acquired by the vulnerability information search unit in the attribute determined by the setting attribute determination unit. 2. The fraud information generating apparatus according to claim 1, wherein fraud certification information is generated and stored in a storage device. The fraudulent information generation device further includes:
A product information collection unit that collects product information of inspection objects by fingerprinting,
2. The unauthorized information generation apparatus according to claim 1, wherein the product operation storage unit stores product information collected by the product information collection unit. The fraudulent information generation device further includes:
A port scan is performed on the inspection object, and an operation information specifying unit for specifying a service used in the public key infrastructure system operating on the inspection object is provided.
The fraud information generating apparatus according to claim 1, wherein the product operation storage unit stores the service specified by the operation information specifying unit as operation information. In a vulnerability inspection device that searches for vulnerabilities in inspection objects,
A fraud information generating unit that sets inspection information in the attribute of the certification information of the public key infrastructure system to generate fraud certification information and stores it in the storage device;
Based on the fraud certification information generated by the fraud information generation unit, an inspection processing unit that performs an inspection on the inspection object by a processing device;
A vulnerability inspection apparatus, comprising: an inspection result determination unit that determines whether or not vulnerability has been reproduced based on an operation of an inspection object with respect to an inspection performed by the inspection processing unit. The vulnerability according to claim 11, wherein the inspection result determination unit determines that the vulnerability has been reproduced when there is no predetermined reply from the inspection object with respect to the inspection performed by the inspection processing unit. Inspection device. The product operation storage unit stores in the storage device product information of the inspection object in the public key infrastructure system, security setting information of the inspection object, and operation information that is a method of using the certification information by the inspection object. A working memory step;
A vulnerability information storage step in which the vulnerability information storage unit stores the vulnerability information of the inspection object and the inspection information for the vulnerability information in a storage device;
An attribute information storage step in which the attribute information storage unit stores the attribute information of the certification information in a storage device;
Based on the product information stored in the product operation storage step and the setting information, the vulnerability information stored in the vulnerability information storage step is searched for, and the vulnerability information search unit uses the processing device to inspect the vulnerability information. A vulnerability information retrieval step to be acquired;
Based on the operation information stored in the product operation storage step and the attribute information stored in the attribute information storage step, the setting attribute determination unit determines the attribute for setting the inspection information acquired in the vulnerability information search step by the processing device. A setting attribute determination step to perform,
A fraud information generation step of setting the inspection information acquired in the vulnerability information search step to the attribute determined in the setting attribute determination step to generate fraud certification information and storing the fraud information in a storage device Incorrect information generation method. The product operation storage unit stores in the storage device product information of the inspection object in the public key infrastructure system, security setting information of the inspection object, and operation information that is a method of using the certification information by the inspection object. A working memory step;
A vulnerability information storage step in which the vulnerability information storage unit stores the vulnerability information of the inspection object and the inspection information for the vulnerability information in a storage device;
An attribute information storage step in which the attribute information storage unit stores the attribute information of the certification information in a storage device;
Based on the product information stored in the product operation storage step and the setting information, the vulnerability information stored in the vulnerability information storage step is searched for, and the vulnerability information search unit uses the processing device to inspect the vulnerability information. A vulnerability information retrieval step to be acquired;
Based on the operation information stored in the product operation storage step and the attribute information stored in the attribute information storage step, the setting attribute determination unit determines the attribute for setting the inspection information acquired in the vulnerability information search step by the processing device. A setting attribute determination step to perform,
Causing the computer to execute a fraud information generation step in which the inspection information acquired in the vulnerability information search step is set in the attribute determined in the setting attribute determination step to generate fraud certification information and store it in the storage device. Characteristic illegal information generation program. In the vulnerability inspection method of vulnerability inspection to search for vulnerabilities of inspection objects,
A fraud information generating step in which inspection information is set in the attribute of the certification information of the public key infrastructure system to generate fraud proof information and the fraud information generation unit stores in the storage device;
Based on the fraud certification information generated in the fraud information generation step, an inspection processing step in which an inspection processing unit performs an inspection on the inspection object by a processing device;
Vulnerability comprising: an inspection result determination step in which the inspection result determination unit determines whether or not the vulnerability has been reproduced based on the operation of the inspection object with respect to the inspection performed in the inspection processing step by the processing device. Inspection method. In the vulnerability inspection program of the vulnerability inspection device that searches for vulnerabilities of inspection objects,
A fraud information generating step in which inspection information is set in the attribute of the certification information of the public key infrastructure system to generate fraud proof information and the fraud information generation unit stores in the storage device;
Based on the fraud certification information generated in the fraud information generation step, an inspection processing step in which an inspection processing unit performs an inspection on the inspection object by a processing device;
Based on the operation of the inspection object with respect to the inspection performed in the inspection processing step, the inspection result determination unit causes the computer to execute an inspection result determination step in which the processing result determination unit determines whether or not the vulnerability has been reproduced. Vulnerability inspection program.

Images