JP2015130152A - Information processing device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To present a combination of security measures to be mounted on a development object system by taking into consideration influence in the case of being mounted on the development object system.SOLUTION: A risk analysis part 202 specifies a plurality of threats that should be handled by a development object data system as object threats. A countermeasure analysis part 203 extracts security countermeasures in each object threat. An optimization execution part 204 combines the security countermeasures extracted by the countermeasure analysis part 203 to generate a combination pattern of security countermeasures against the plurality of object threats, analyzes an effect that is generated by the combination of security countermeasures included in the combination pattern in each combination pattern to calculate a packaging influence value representing influence on the development object data system in the case that the combination of security countermeasures is packaged, and selects specific combination pattern on the basis of the calculated packaging influence value.

Description

The present invention relates to a technique for supporting the implementation of security measures in a development target data system to be developed.
Hereinafter, an embedded system will be described as an example of a development target data system.

  In embedded systems, as a result of product analysis by a third party, counterfeit products are manufactured, business is hindered, and damage is caused by external attacks during the operation of embedded systems. There are security measures to prevent them.

  In the conventional security evaluation support tool, the target system runs on the information processing device and is composed of multiple components, not specifically for embedded systems with limited resources. (For example, Patent Documents 1 and 2).

JP 2006-331383 A JP 2009-110177 A

  In recent years, the recognition that security measures are necessary in embedded systems is increasing, but security measures are often not as important as the original functions of embedded systems in the development budget, and security measures are taken with limited resources. There is a problem that must be.

Security risk analysis for embedded systems is not systematic even if it is considered based on experience on a desk before development, and many are performed after development is completed.
As a result, if security measures need to be reviewed due to a fatal defect, the development will be delayed significantly, or if for some reason it is not corrected, it will be a potential issue for the next product. In many cases, it is postponed while including various problems.
In order to efficiently perform the entire development against such a current situation, there is a problem as to when security measures should be taken.

As a result of risk analysis, when some countermeasures against vulnerability are required, the embedded system has restrictions on memory capacity (ROM (Read Only Memory) size, RAM (Random Access Memory) size), processing time, etc. Usually, not all measures can be taken.
Therefore, it is necessary to consider how effective security measures can be implemented under the constraints.

Adding security measures after implementing the original functions of an embedded system means that memory is used by a program for security measures, and the amount of processing increases due to security measures, resulting in an overhead in processing time.
The program size of the program for security measures must be within the total ROM size, and even if the overhead for security measures is included, predetermined processing must be performed within the allowable time for function requests.

When implementing security measures, there is a problem that TAT (Turn Around Time) is long to actually try all methods.
Also, if security measures are implemented without considering priority and effects, there is a possibility that the important measures may be postponed or biased, leading to poor development efficiency. .

  The present invention has been made in view of the circumstances as described above, and it is possible to present a combination of security measures to be implemented in a development target data system in consideration of the effects when implemented in the development target data system. Is the main purpose.

An information processing apparatus according to the present invention includes:
An information processing apparatus that supports the implementation of security measures in a development target data system,
A security countermeasure information storage unit that stores a plurality of security threats and stores security countermeasure information in which one or more security countermeasures are defined for each threat;
Among the plurality of threats defined in the security countermeasure information, a target threat identifying unit that identifies a plurality of threats to be dealt with by the development target data system as target threats;
A security measure extraction unit that extracts security measures defined in the security measure information for each target threat;
A security countermeasure combination pattern for a plurality of target threats is generated by combining the security countermeasures extracted by the security countermeasure extraction unit, and the effect generated by the combination of security countermeasures included in the combination pattern is analyzed for each combination pattern. A combination pattern selection unit that calculates an implementation influence value that represents an influence on the development target data system when a combination of security measures is implemented, and selects a specific combination pattern based on the calculated implementation influence value; It is characterized by.

The present invention calculates, for each combination pattern, an implementation impact value that represents the impact on the development target data system when the combination of security measures is implemented by analyzing the effects caused by the combination of security measures included in the combination pattern. A specific combination pattern is selected based on the calculated mounting influence value.
For this reason, it is possible to present a combination of security measures to be implemented in the development target data system in consideration of the effects when implemented in the development target data system.

The figure which shows the example of the development procedure using the security risk analysis apparatus which concerns on Embodiment 1. FIG. The figure which shows the hardware structural example of the security risk analysis apparatus which concerns on Embodiment 1, and a development object data system. FIG. 3 is a diagram illustrating a functional module configuration example of the security risk analysis apparatus according to the first embodiment. FIG. 6 is a diagram showing an example of a restriction condition list according to the first embodiment. FIG. 3 is a diagram showing an example of a target threat list according to the first embodiment. FIG. 5 is a diagram showing an example of a countermeasure candidate list according to the first embodiment. FIG. 6 is a diagram showing an example of an optimization countermeasure list according to the first embodiment. FIG. 5 shows a combination pattern of countermeasures according to the first embodiment. FIG. 5 shows a combination pattern of countermeasures according to the first embodiment. The figure which shows the data input / output relationship in the security risk analysis apparatus which concerns on Embodiment 1. FIG. FIG. 3 is a flowchart showing an operation example of the security risk analysis apparatus according to the first embodiment. FIG. 5 is a diagram illustrating an operation example of an optimization execution unit according to the first embodiment. The figure which shows the structural example of the security risk analyzer which concerns on Embodiment 2, a development object data system, and a software development environment. The figure which shows the structural example of the development object data system which concerns on Embodiment 3, and software development environment. FIG. 10 is a flowchart showing an operation example of the security risk analysis apparatus according to the fourth embodiment. FIG. 10 is a diagram illustrating an example of a composite optimization countermeasure list according to the fourth embodiment.

Embodiment 1 FIG.
In the present embodiment, a security risk analysis apparatus that enables efficient implementation of security measures while performing security risk analysis in the development process of an embedded system will be described.
The security risk analysis apparatus according to the present embodiment enables selection and implementation of security risk countermeasures, and estimation / evaluation associated therewith within the limits of the embedded system.
In addition, the security risk analysis apparatus according to the present embodiment extracts and implements threats that exist in an embedded environment with limited resources (low memory capacity, low CPU (Central Processing Unit) performance, etc.). It is possible to select and implement the best security measures that should be implemented.
In addition, the security risk analysis apparatus according to the present embodiment, after estimating each security measure, analyzes the dependency relationship of each security measure and considers the combination of security measures to minimize the risk value. By finding, it is possible to examine which security measures are optimally selected and implemented under the constraints.

FIG. 1 shows a development procedure using the security risk analysis apparatus 1 according to the present embodiment.
The security risk analysis device 1 corresponds to an example of an information processing device.

The security risk analysis apparatus 1 includes configuration data 2 of a development target data system (consisting of hardware and software components), for example, information defining a software program configuration of the development target data system, and a hardware configuration Information including simulation information, simulation information, and attribute information is received.
The development target data system is, for example, an embedded system.
The security risk analysis apparatus 1 analyzes the configuration data 2 to extract risks, and selects a combination of security measures according to the constraint condition and presents it as an optimization measure list 3.
The user (or developer) implements security measures in the development target data system according to the combination of security measures shown in the optimization measure list 3.

The configuration data 2 includes information that the user (or developer) needs to input in advance in addition to information automatically and mechanically obtained from the hardware and software configuration of the development target data system.
The former is various data necessary for simulating the operation of software on an actual machine.
The latter is a numerical value for weighting evaluation from the viewpoint of asset value for data (information assets) handled on the development target data system.
Each information asset in the development target data system corresponds to what is described as a unique parameter (name) in the program. Therefore, by defining the value of the information asset as a numerical value, It is possible to automatically analyze the location and flow of information assets.
The development environment for developing the development target data system can show the user a list of parameters inside the program of the development target data system in an identifiable format, and the user determines and inputs the asset value of each parameter. Can be prompted through the user interface.
In that way, the value of information assets can be determined and defined.

  FIG. 2 shows a hardware configuration example of the security risk analysis apparatus 1 and the development target data system 112 according to the present embodiment.

In FIG. 2, the security risk analysis apparatus 1 includes a CPU 101, a RAM 102, a ROM 103, a hard disk 104, a display display 105, a keyboard 106, a mouse 107, and a communication board 108, which are connected to an internal bus 109.
The security risk analysis apparatus 1 is connected to the development target data system 112 via the communication board 108 and the external bus 119.
The development target data system 112 includes a CPU 113, a coprocessor 114, a RAM 115, a ROM 116, and a communication board 117, which are connected to an internal bus 118.
Further, it is connected to the external bus 119 via the communication board 117.

  FIG. 3 shows a functional module configuration example of the security risk analysis apparatus 1 according to the present embodiment.

  In FIG. 3, the threat database 209 stores threat information defining a plurality of threats to be considered in the development of the development target data system.

The implementation database 210 stores security countermeasure information in which a plurality of threats defined in the threat database 209 are defined and one or more security countermeasures are defined for each threat.
The mounting database 210 is referred to when calculating necessary steps according to the target CPU at the instruction level when a functional module such as a cryptographic algorithm is mounted.
The mounting database 210 corresponds to an example of a security countermeasure information storage unit.

The constraint condition extraction unit 201 analyzes the configuration data and generates a constraint condition list.
In the constraint condition list, the constraint conditions for the influence on the resource and the processing time of the development target data system by the security measures are defined.
The constraint condition in the constraint condition list corresponds to an example of an implementation influence value condition, and the constraint condition extraction unit 201 corresponds to an example of an implementation influence value condition derivation unit.

The risk analysis unit 202 generates a target threat list.
More specifically, the risk analysis unit 202 selects a threat to be dealt with in the development target data system among a plurality of threats defined in the threat information (that is, a plurality of threats defined in the security countermeasure information). A plurality of target threats are specified, and a target threat list in which the target threats are described is generated.
The risk analysis unit 202 corresponds to an example of a target threat identification unit.

The countermeasure analysis unit 203 extracts the security measures defined in the security countermeasure information for each target threat described in the target threat list, and moves to the development target data system when the extracted security measures are independently implemented. An implementation impact value that represents the impact of
And the countermeasure analysis part 203 produces | generates the countermeasure candidate list in which an implementation influence value is shown for every security countermeasure.
Implementation impact values include, for example, values that represent memory usage when security measures are independently implemented in the development target data system, values that represent processing time overhead, values that represent the vulnerability of the development target data system to threats, etc. It is.
The countermeasure analysis unit 203 corresponds to an example of a security countermeasure extraction unit.

The optimization execution unit 204 combines the security measures extracted by the measure analysis unit 203 to generate a combination pattern of security measures for a plurality of target threats.
In addition, the optimization execution unit 204 analyzes the effect caused by the combination of security measures included in the combination pattern for each combination pattern, the single implementation influence value of the security measure calculated by the measure analysis unit 203, and the security measure Based on the analysis result of the effect produced by the combination, the implementation influence value representing the influence on the development target data system when the combination of the security measures is implemented is calculated.
Then, the optimization execution unit 204 selects a combination pattern of security measures to be implemented in the development target data system based on the calculated implementation influence value and the constraint conditions in the constraint condition list.
Further, the optimization execution unit 204 generates an optimization countermeasure list 3 (FIG. 1) in which the selected combination pattern is shown.
The optimization execution unit 204 corresponds to an example of a combination pattern selection unit.

  The constraint condition list storage unit 205 stores the constraint condition list generated by the constraint condition extraction unit 201.

  The target threat list storage unit 206 stores the target threat list generated by the risk analysis unit 202.

The countermeasure candidate list storage unit 207 stores the countermeasure candidate list generated by the countermeasure analysis unit 203.
The optimization countermeasure list storage unit 208 stores the optimization countermeasure list 3 generated by the optimization execution unit 204.

The constraint condition list storage unit 205, the target threat list storage unit 206, the countermeasure candidate list storage unit 207, the optimization countermeasure list storage unit 208, the threat database 209, and the implementation database 210 are configured in the hard disk 104 of FIG.
The constraint condition extraction unit 201, the risk analysis unit 202, the countermeasure analysis unit 203, and the optimization execution unit 204 are programs, and these programs are normally stored in the hard disk 104 in FIG. In this state, the data is sequentially read into the CPU 101 and executed.
Further, an operating system (OS) not shown in FIG. 3 is also stored in the hard disk 104. At least a part of the OS is loaded into the RAM 102, and the CPU 101 executes the OS while extracting the constraint conditions shown in FIG. The program which implement | achieves the function of the part 201, the risk analysis part 202, the countermeasure analysis part 203, and the optimization execution part 204 is executed.
In the description of the first to fourth embodiments, “determination of”, “determination of”, “extraction of”, “calculation of”, “setting of”, “analysis of”, “ Information, data, signal values, and variable values indicating processing results described as “selection of”, “generation of”, “input of”, “output of”, and the like are stored in the RAM 102 as a file.

  FIG. 4 is an example showing details of the constraint condition list.

The constraint condition list includes information about the CPU such as the type represented by the model name, instruction configuration, operating frequency, usable memory capacity, and the like.
In addition, the value of the processing time required for each function realized in the development target data system is included.
In the column of allowable range time, a value of allowable range time including overhead is set in view of functional requirements for the development target data system.
This is set before referring to and using this restriction condition list in a later process by the user's judgment.
Since the value of the allowable range time is determined by the required specifications for the system, the security risk analysis apparatus 1 includes a mechanism for setting from the outside through a user interface.
As shown in FIG. 4, the constraint condition list describes the number of usable bytes of ROM, the number of usable bytes of RAM, and the allowable time range of each processing time.
That is, the constraint condition list defines the ROM bytes consumed by the security measures and the allowable values (upper limit) of the RAM bytes, and the allowable overhead (upper limit) of the processing time generated by the security measures. ) Is defined.

  FIG. 5 is an example showing details of the target threat list.

The target threat list includes a list of threats to be dealt with in the development target data system and respective risk values.
The threat ID is an identifier of each threat and is common to the threat ID shown in the threat information of the threat database 209 and the security countermeasure information of the implementation database 210.
The risk value is a value that is automatically calculated based on the value and possibility of occurrence of information assets.
As described above, the value of the information asset is defined by a predetermined operation in the previous process.
On the other hand, the possibility of occurrence can be obtained by referring to the threat database 209.
The risk value is set to take a larger value as the value of the asset is higher and the possibility of occurrence is higher.
Since the result of the list is displayed in the target threat list, it is possible to check whether there is any flaw in the user's recognition.

  FIG. 6 shows details of the countermeasure candidate list.

The countermeasure candidate list includes methods for dealing with threats, candidates for implementation methods (security measures) for realizing each method, and implementation impact values when each implementation method is implemented.
The implementation impact value includes the amount of memory used (ROM and RAM) required for implementation of each implementation method, the processing time overhead that occurs when each implementation method is implemented, and the risk value expected after each implementation method is implemented ( Vulnerability) estimate is included.
Each value shown in the countermeasure candidate list is a numerical value when each security countermeasure implementation is independently evaluated.

  FIG. 7 is an example showing details of the optimization countermeasure list.

The optimization countermeasure list includes countermeasure combination, threat ID, mounting method (security countermeasure), and mounting influence value (ROM, RAM, time, risk).
In the countermeasure combination column, IDs of combination patterns of security countermeasures are shown.
The threat ID and the implementation method (security countermeasure) are the same as those shown in the countermeasure candidate list.
The estimated amount of memory usage (ROM and RAM), processing time overhead, and risk value (vulnerability) expected after implementation, including implementation-related impact values, were comprehensively calculated including offsets due to combinations of security measures. Value.
In FIG. 7, the underlined numerical value is a numerical value that is decreased from the numerical value in the countermeasure candidate list (FIG. 6) due to cancellation.
For example, in the combination of countermeasures: 7, since the common module can be used at U001: AES high speed and U009: AES high speed, the increase in ROM can be reduced (U009: AES high-speed ROM usage is U001: AES high-speed ROM usage) The amount is absorbed).
Also, in the countermeasure combination 1, it is determined that U007: stream cipher 1 processing and U013: verification processing are parallelized, and that U007: stream cipher 1 processing time is absorbed in U013: verification processing time. Is shown.
In FIG. 7, the optimization countermeasure list output method is a table. However, the optimization countermeasure list output method is not limited to a table. As a comprehensive profiler for risk analysis, threat location, resource increase / decrease and risk increase / decrease It is also possible to graphically output the relationship.

  In addition, the security risk analysis device 1 allows the user to reset the numerical values such as the implementation impact value, the constraint condition, and the risk value so that the user can review the numerical values designated as the implementation impact value, the constraint condition, and the risk value. It has an interface that enables evaluation of optimization measures based on set implementation influence values, constraint conditions, risk values, etc.

Next, the operation will be described.
FIG. 10 shows the input / output relationship of the function blocks (programs) and data inside the security risk analysis apparatus 1.
FIG. 11 is a flowchart showing processing in the security risk analysis apparatus 1.
Below, operation | movement of the security risk analysis apparatus 1 is demonstrated using FIG.

In step S2101, the constraint condition extraction unit 201 inputs the configuration data 2 of the development target data system and generates a constraint condition list.
As shown in FIG. 4, the remaining amount of memory that can be used for implementing future security measures can be grasped from the restriction condition list.
In addition, since the processing time of each current processing unit is displayed in the constraint condition list, the user refers to the constraint condition list, and the allowable range value of the processing time determined by the required specifications for the development target data system Can be set via a predetermined interface.

In step S2102, the risk analysis unit 202 inputs the configuration data 2 of the development target data system and the threat information of the threat database 209, executes security risk analysis, and generates a target threat list.
The risk analysis unit 202 analyzes the operation and processing procedure of the program at the instruction execution level and refers to the threat information in the threat database 209 to identify the location of the threat and the type of threat in the development target data system. Can do.
Further, the risk analysis unit 202 automatically calculates a risk value based on the value of the information asset and the possibility of occurrence.
Here, since the target threat list as shown in FIG. 5 is displayed, the user can visually confirm whether or not the threat extracted by the risk analysis unit 202 is inconsistent with his / her own recognition.
If there is a defect, the user can customize the threat database 209 and review and adjust the setting values as necessary through the interface.

In step S2103, the countermeasure analysis unit 203 inputs the constraint condition list generated in S2101, the target threat list generated in S2102 and the security countermeasure information of the implementation database 210, and executes interpretation.
Here, first, the countermeasure analysis unit 203 lists all possible methods (CMxxx) for each threat (Txxx) indicated in the target threat list.
Next, the countermeasure analysis unit 203 lists all mounting methods (security countermeasures) (Uxxx) for realizing the method for each method.
Further, the countermeasure analysis unit 203 implements the resources used (ROM, RAM size), processing overhead (time), and countermeasures for mounting the mounting method (security countermeasure) for each mounting method (security countermeasure). An estimated value such as an expected risk value is calculated, and a countermeasure candidate list is generated.
The implementation impact value shown in the countermeasure candidate list is a numerical value when each security countermeasure is evaluated independently, and does not include the effect of the combination of security countermeasures.
In the security countermeasure information, for each mounting method (security countermeasure), a parameter for calculating an implementation influence value when the mounting method (security countermeasure) is independently implemented is described. Use the parameters described in the security countermeasure information to calculate the implementation impact value.

In step S2104, the optimization execution unit 204 inputs the constraint condition list generated in S2101 and the countermeasure candidate list generated in S2103, outputs the optimization countermeasure list 3, and ends the process.
FIG. 12 shows a processing procedure of the optimization execution unit 204.
The optimization execution unit 204 refers to the constraint conditions such as the memory usable amount and the allowable processing time in the development target data system, so as to perform the security measures for each target threat indicated in the countermeasure candidate list as the optimization processing 1. All combinations are combined to generate a list of all combination countermeasures.
Next, as optimization execution processing 2, security measures for implementation candidates are narrowed down from the all combination countermeasure list to generate an optimization countermeasure list 3.
As shown in FIG. 8 and FIG. 9, the all combination countermeasure list comprehensively examines all possible combinations for the security countermeasures for each target threat and generates a combination pattern of all combinations. The implementation impact value (memory usage, processing time overhead, risk value) is calculated.
The implementation influence value at this stage is a value reflecting an effect (offset, synergistic effect, etc.) by a combination of security measures, as shown in FIG.
The optimization execution unit 204 simulates the memory usage and the processing time overhead when the security measures included in the combination pattern are combined and implemented for each combination pattern in the optimization execution process 2, and the security measures A value reflecting the effect of the combination is calculated.
As the risk value, the maximum value of the security countermeasure risk values included in the combination pattern is used.
The optimization execution unit 204 selects a combination pattern that matches the constraint condition indicated in the constraint condition list from the combination patterns in the all combination countermeasure list, and generates the optimization countermeasure list 3 in which the selected combination pattern is indicated. .
For example, the optimization execution unit 204 selects a combination pattern of mounting influence values that matches the memory usage condition and the processing time condition shown in the constraint condition list.
When there are many combination patterns that match the constraints, the top n (n is arbitrary) in the order of increasing implementation impact values (in order of decreasing memory usage, in order of decreasing processing time overhead, in order of decreasing risk value) Select a few combination patterns.
Then, the optimization execution unit 204 displays the generated optimization countermeasure list 3 on the display device.
In this way, the optimization execution unit 204 analyzes the dependency relationship of each security measure, and implements the security measure on the scale of memory use efficiency, processing time, and risk value by combining the security measures within the range of the constraint conditions. Since the influence (result) of the case can be shown on the optimization countermeasure list, the user can find an optimal solution that minimizes the risk, for example.

As described above, the security risk analysis apparatus 1 according to the present embodiment estimates the results and effects of individual security measures, and after further narrowing down, reflects the effects of combining the security measures. The estimated impact level is implemented.
For this reason, the user can examine which security measures are optimally selected and implemented under the constraint conditions.
Then, the user can select security measures based on the examination results, and can actually perform the implementation work.

Embodiment 2. FIG.
In the first embodiment described above, the security risk analysis apparatus 1 operates alone for the purpose of obtaining an optimization countermeasure list by referring to the configuration data of the development target data system.
Instead of this, software modification of the development target data system may be efficiently performed by linking a conventional software development environment (development apparatus) and a security risk analysis apparatus.
FIG. 13 shows a configuration in which the software development environment 120 and the security risk analysis apparatus 1 are linked.
In FIG. 13, the development target data system 112 and the software development environment 120 are connected by an external bus 128, and the software development environment 120 and the security risk analysis device 1 are connected by an external bus 129.
In the configuration shown in FIG. 13, since the target of the development target data system is shared between the implementation side and the evaluation side, it is not necessary to physically move to another environment, and the software reflecting the correction contents can be immediately evaluated. .

Embodiment 3 FIG.
In the first embodiment described above, the optimization countermeasure list is obtained by referring to the configuration data of the development target data system. By linking the conventional software development environment (development apparatus) and the security risk analysis apparatus, You may make it the structure which performs software development and repair of a development object data system more efficiently.
As shown in FIG. 14, a security risk analysis device may be incorporated as a security risk analysis tool 137 in the software development environment 130.
Some programming language integrated development environments include a compiler and debugger, a function that performs data and code coverage analysis, and a profiler function that examines the bottleneck of the program. From the functional point of view, it can be said that the affinity is high.
In this case, user interfaces such as an input screen for prompting the user to input in risk analysis and an output screen for showing the result to the user can be shared and incorporated in the tool, which is more convenient than the second embodiment. Can be increased.

  With the configuration shown in FIG. 14, the user can easily select the optimal security measures, efficiently implement the selected measures, analyze the modified software again, and develop the modified target. The overall development can be carried out efficiently by finally confirming whether the data system meets the security requirements.

In the first to third embodiments, the security measures by software are flexibly performed on the embedded system in which the hardware is fixed. However, the security risk that can be considered for changing the hardware configuration such as the installed memory capacity and CPU specifications. It is also possible to adopt a configuration capable of performing the analysis.
A configuration for performing security risk analysis by changing the hardware configuration will be described in a fourth embodiment.

Embodiment 4 FIG.
In the first embodiment, the hardware configuration of the development target data system is flexibly examined by software on a fixed embedded system.
In the present embodiment, a configuration is shown in which a constraint can be changed by changing the hardware configuration, so that the possibility of selection can be further expanded and a mounting method incorporating a security measure can be examined from various perspectives.

A configuration example of the security risk analysis apparatus 1 according to the present embodiment is as shown in FIG.
However, in the present embodiment, the risk analysis unit 202 identifies the target threat in units of hardware configurations for a plurality of hardware configurations virtualized in the development target data system.
In addition, the countermeasure analysis unit 203 extracts a security countermeasure defined in the security countermeasure information for each target threat in units of hardware configuration.
Further, the optimization execution unit 204 generates a combination pattern of security measures for a plurality of target threats by combining the security measures extracted by the measure analysis unit 203 in units of hardware configuration, and for each combination pattern, a combination pattern Analyze the effects caused by the combination of security measures included in the product, calculate the impact value that represents the impact on the development target data system when that security measure combination is implemented, and identify the impact based on the calculated impact value Select a combination pattern.
In addition, the countermeasure analysis unit 203 extracts the security measures defined in the security countermeasure information for each target threat in units of hardware configuration, and development target data when the extracted security countermeasures are independently implemented. Calculate the implementation impact value that represents the impact on the system.
Then, the optimization execution unit 204 is a unit of hardware configuration, and for each combination pattern, the single implementation influence value of the security measure calculated by the measure analysis unit 203 and the analysis result of the effect caused by the combination of the security measures Based on the above, the implementation influence value representing the influence on the development target data system when the combination of the security measures is implemented is calculated.
That is, the security risk analysis apparatus 1 according to the present embodiment performs the same operation as in the first embodiment on each of a plurality of hardware configurations virtualized with respect to the development target data system. Get a list of unit optimization measures.
Further, in the present embodiment, the optimization execution unit 204 may display a list of optimization countermeasure lists for each hardware configuration unit.

In the following, differences from the first embodiment will be mainly described.
Matters not described below are the same as those in the first embodiment.

FIG. 15 is a flowchart showing processing according to the fourth embodiment.
Hereinafter, the operation of the security risk analysis apparatus according to the fourth embodiment will be described with reference to FIG.

Steps S2101 to S2104 are the same operations as those in the flowchart (FIG. 11) showing the processing in the first embodiment, and the details thereof are as described in the first embodiment.
In S2104, the optimization countermeasure list 3 generated by the optimization execution unit 204 is displayed on the display device as the final output result of the analysis.
If it is determined that an optimal solution that satisfies the risk value requirement set by the user in advance exists on the optimization countermeasure list, the process ends.
When the process ends here, the process is the same as in the first embodiment.

Since the risk value expected by the user is input from the input device, it is stored in the configuration data.
In order to perform extraction in S2106 and to make a determination in S2107, the expected risk value is read from the configuration data.
If the result of determination in S2107 is that an optimal solution that can reduce the risk to the desired value cannot be found, or if it is found that the optimal solution cannot be determined due to a constraint condition, etc. Since it is necessary to continue this examination, the process proceeds to S2109.

In addition to continuous evaluation only when there is no optimal solution, there are also cases where additional evaluation is performed by changing the constraint conditions in order to determine the possibility of an optimal mounting method.
Therefore, by determining whether or not to end the process in S2108 through the input device, it is possible to proceed to S2109 and perform additional evaluation without ending even if there is an optimal solution. is there.

In step S2109, input is performed from the input device in order to change the contents of the configuration data.
For example, the user can change the memory capacity increase / decrease, CPU selection, CPU operating frequency increase / decrease, coprocessor presence / absence, and the like.
In this way, the virtual hardware configuration of the development target data system is set.
At this time, the configuration data is not overwritten, but the configuration data partially changed is generated and saved as a separate file.

By repeating steps S2102 to S2109 and performing analysis in the security risk analysis apparatus 1 while changing the hardware conditions, N optimization countermeasure lists (1, 2,...) Are output as the number of repetitions (N). ~ N).
That is, N optimization countermeasure lists can be obtained by repeating steps S2102 to S2109 for N virtual hardware configurations.

Each of the obtained N optimization countermeasure lists can be examined independently, but it is also possible to make a comprehensive judgment from all the results (N optimization countermeasure lists). Is possible.
That is, the optimization execution unit 204 may display a list of N optimization countermeasure lists.
An example of a list display of the optimization countermeasure list corresponding to the change contents of the configuration data is shown in FIG.

FIG. 16 shows a detailed example of a composite optimization countermeasure list that is a list obtained in S2105 of FIG. 15 and is a combination of a plurality of optimization countermeasure lists.
In the composite optimization countermeasure list, in addition to the countermeasure combination, threat ID, mounting method, and mounting influence value (ROM, RAM, time, risk) included in the optimization list of FIG. And a number indicating the cost.

In FIG. 16, since the configuration ID: 2 has been changed to a condition that the CPU frequency is twice that of ID: 1, it is determined that the processing performance is improved and the time required for the processing can be shortened. Show.
Furthermore, with the ID: 3, by installing the cryptographic coprocessor, the threat ID: T003 itself does not exist, and since the software program becomes unnecessary, the amount of ROM used is reduced, and the processing time is greatly increased. This shows that while it was possible to achieve a reduction, the cost was determined to be several times higher than others.

Regarding the composite optimization countermeasure list (FIG. 16) output in S2105, when analyzing a plurality of results simultaneously, if there are too many output results, conditions (for example, risk value, memory usage amount) are set. It is possible to perform operations such as narrowing the candidates to be displayed by excluding those that do not meet the conditions.
By such an operation, it is possible to easily determine an optimal solution in the target to be developed in consideration of the priority of which safety, cost, or performance is most important.
In addition, as in the output method of FIG. 7, the relationship between the increase / decrease in resources and the increase / decrease in risk can be graphically output for FIG.

  In this way, it is possible to virtually change the mounted memory capacity, CPU specifications, etc. of the development target data system and perform the analysis again or repeatedly with the security risk analysis device. Therefore, in this embodiment, when considering the method for realizing the development target data system with security measures implemented in more detail from both the hardware and software perspectives, the optimal implementation method while changing the constraints You can investigate a wide range.

As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined.
In addition, this invention is not limited to these embodiment, A various change is possible as needed.

  1 Security risk analysis device, 2 configuration data, 3 optimization countermeasure list, 4 implementation, 101 CPU, 102 RAM, 103 ROM, 104 hard disk, 105 display, 106 keyboard, 107 mouse, 108 communication board, 109 internal bus, 112 Development target data system, 113 CPU, 114 coprocessor, 115 RAM, 116 ROM, 117 communication board, 118 internal bus, 119 external bus, 120 software development environment, 121 emulator, 122 host machine, 123 integrated development environment, 124 development Tool, 125 Build tool, 126 Debug tool, 127 Internal bus, 128 External bus, 129 External bus, 130 Software development environment, 131 emulator , 132 Host machine, 133 Integrated development environment, 134 Development tool, 135 Build tool, 136 Debug tool, 137 Security risk analysis tool, 201 Restriction condition extraction unit, 202 Risk analysis unit, 203 Countermeasure analysis unit, 204 Optimization execution 205, restriction condition list storage unit, 206 target threat list storage unit, 207 countermeasure candidate list storage unit, 208 optimization countermeasure list storage unit, 209 threat database, 210 implementation database.

Claims (14)

An information processing apparatus that supports the implementation of security measures in a development target data system,
A security countermeasure information storage unit that stores a plurality of security threats and stores security countermeasure information in which one or more security countermeasures are defined for each threat;
Among the plurality of threats defined in the security countermeasure information, a target threat identifying unit that identifies a plurality of threats to be dealt with by the development target data system as target threats;
A security measure extraction unit that extracts security measures defined in the security measure information for each target threat;
A security countermeasure combination pattern for a plurality of target threats is generated by combining the security countermeasures extracted by the security countermeasure extraction unit, and the effect generated by the combination of security countermeasures included in the combination pattern is analyzed for each combination pattern. A combination pattern selection unit that calculates an implementation influence value that represents an influence on the development target data system when a combination of security measures is implemented, and selects a specific combination pattern based on the calculated implementation influence value; An information processing apparatus characterized by the above. The security countermeasure extraction unit
For each target threat, extract the security measures defined in the security countermeasure information, calculate the implementation impact value that represents the impact on the development target data system when the extracted security measures are implemented alone,
The combination pattern selection unit includes:
For each combination pattern, based on the single implementation impact value of the security measure calculated by the security measure extraction unit and the analysis result of the effect produced by the combination of the security measures, the combination of the security measures is implemented. The information processing apparatus according to claim 1, wherein a mounting influence value representing an influence on a development target data system is calculated. The information processing apparatus further includes:
Implementation impact value condition for analyzing the configuration data defining the hardware configuration and software configuration of the development target data system and deriving the implementation impact value condition allowed in the development target data system as the implementation impact value condition Having a derivation unit,
The combination pattern selection unit includes:
The information processing apparatus according to claim 1, wherein a combination pattern of mounting influence values that matches the mounting influence value condition is selected. The combination pattern selection unit includes:
As the implementation influence value, a value indicating the memory usage in the development target data system when the combination of security measures is implemented, and the processing time in the development target data system when the combination of security measures is implemented. The information processing apparatus according to claim 1, wherein at least one of a value representing overhead and a value representing vulnerability of the development target data system to a threat when a combination of security measures is implemented is calculated. The security countermeasure extraction unit
For each extracted security measure, as the implementation impact value, a value representing the memory usage in the development target data system when the security measure is implemented alone, the value when the security measure is implemented alone Calculating at least one of a value representing a processing time overhead in the development target data system and a value representing a vulnerability of the development target data system with respect to a threat when the security measure is implemented alone; The information processing apparatus according to claim 2. The security countermeasure information storage unit
For each security measure, it stores the security measure information that defines the parameters for calculating the implementation impact value when the security measure is implemented alone.
The security countermeasure extraction unit
The information processing method according to claim 2, wherein, for each extracted security measure, an implementation influence value when the security measure is independently implemented is calculated using a parameter defined in the security measure information. apparatus. The target threat identification unit
The information processing apparatus according to claim 1, wherein the target threat is identified by analyzing configuration data defining a hardware configuration and a software configuration of the development target data system. The combination pattern selection unit includes:
The information processing apparatus according to claim 1, wherein the selected combination pattern is displayed on a display device. The information processing apparatus includes:
The information processing apparatus according to claim 1, wherein the information processing apparatus is connected to a development apparatus that develops the development target data system. The information processing apparatus includes:
The information processing apparatus according to claim 1, wherein the information processing apparatus is included in a development apparatus that develops the development target data system. A computer that supports the implementation of security measures in the development target data system,
A computer that stores security countermeasure information in which a plurality of threats related to security are defined and one or more security countermeasures are defined for each threat.
Target threat identification processing for identifying a plurality of threats to be dealt with by the development target data system as target threats among the plurality of threats defined in the security countermeasure information;
Security measure extraction processing for extracting security measures defined in the security measure information for each target threat,
A security countermeasure combination pattern for a plurality of target threats is generated by combining the security countermeasures extracted by the security countermeasure extraction process, and the effect generated by the combination of security countermeasures included in the combination pattern is analyzed for each combination pattern. An implementation impact value representing the impact on the development target data system when a combination of security measures is implemented is calculated, and a combination pattern selection process for selecting a specific combination pattern is executed based on the computed implementation impact value A program characterized by that. The target threat identification unit
For a plurality of hardware configurations virtualized in the development target data system, identify the target threat in units of hardware configuration,
The security countermeasure extraction unit
For each target threat, extract the security measures defined in the security measure information in units of hardware configuration,
The combination pattern selection unit includes:
A security countermeasure combination pattern for a plurality of target threats is generated by combining the security countermeasures extracted by the security countermeasure extraction unit in a unit of hardware configuration, and for each combination pattern, a combination of security countermeasures included in the combination pattern Analyzing the resulting effects, calculating the implementation impact value that represents the impact on the development target data system when the security countermeasure combination is implemented, and selecting a specific combination pattern based on the calculated implementation impact value The information processing apparatus according to claim 1, further comprising: The security countermeasure extraction unit
The security measures defined in the security countermeasure information are extracted for each target threat in units of hardware configuration, and the impact on the development target data system when the extracted security countermeasures are implemented alone is expressed. Calculate the implementation impact value,
The combination pattern selection unit includes:
A combination of security measures based on a single implementation impact value of the security measures calculated by the security measure extraction unit and an analysis result of the effects produced by the combination of security measures, for each combination pattern in hardware configuration units. The information processing apparatus according to claim 12, wherein a mounting influence value representing an influence on the development target data system when is mounted is calculated. The combination pattern selection unit includes:
The information processing apparatus according to claim 13, wherein a list of mounting value influence values of two or more hardware configurations is displayed.

Images