JP5082555B2 - Security inspection model generation device, security inspection model inspection device, and security inspection model generation program - Google Patents

Description

  The present invention relates to a technique for checking the security of a web application by model checking.

  Model checking is a kind of simulation, in which the target system is expressed by a model, and the behavior of the model is reproduced by a model checking device, thereby checking the property to be examined and the response to a predetermined condition. Model checking is very useful for checking parallel / distributed systems that are difficult for humans to examine comprehensively.

  In recent years, client-server applications (web applications) based on World-Wide web (web) technology have been widely used. The web application is an application that performs communication on a network using an HTTP (Hypertext Transfer Protocol) protocol, and screen contents (pages) presented to the user are mainly described in an HTML (Hypertext Markup Language) format. The server is also called a web site, and a web browser is mainly used as a client.

  In the past, the web was mainly obtained from the point of view of the client. However, recently, many applications such as processing to post information such as bulletin boards and weblogs (blogs), management of devices connected to the network, and commercial transactions such as purchase of products and services have been realized with web technology. It has also penetrated. Typical web browsers include Microsoft Internet Explorer and Mozilla Foundation Firefox.

  Many of such advanced web applications are required to provide information or allow an operation only to a specific user. For this reason, a security function such as an HTTPS (Hypertext Transfer Protocol over SSL) protocol for performing protection by SSL (Secure Sockets Layer) or TLS (Transport Layer Security), and HTTP authentication is provided.

  However, since the HTTP protocol is stateless and the protocol itself does not have a function for associating a plurality of sets of requests and responses, a mechanism called a cookie is provided. Cookie is a technology in which data specified by the server is implicitly held by the browser and sent with each request. As a result, the server can identify a pair of requests and responses exchanged with the same browser. Such a series of requests and responses is often called a session.

  On the other hand, in order to realize complicated processing and provide a user with an advanced appearance and functions, the web browser is provided with a function capable of controlling the behavior of the browser itself by designation on the server side.

  A client-side script, which is one of such functions, is a simple programming language that can be described in an HTML page or a file referenced from the page, and can control the behavior of a web browser to some extent. A typical client-side script is JavaScript, and other variants and similar ones are ECMAScript, JScript, VBSscript, and the like. Here, all of them are simply called scripts.

  In addition, HTTP and HTML that do not use a script have functions such as embedding images and other objects in an HTML page, redirection by HTTP, and automatic updating by HTML META tags. These functions can also control the behavior of the web browser to some extent.

  Such a web browser control function is convenient for the web application provider. On the other hand, it is convenient for an attacker who tries to cause a security breach through the security function of the web application. That is, an attacker can perform an attack by operating a web browser by preparing an HTML page convenient for the user at an arbitrary site and allowing the user to open the page.

  Furthermore, by further utilizing such browser guidance, script data is mixed in the request, and the original server returns it to the client as part of the response, so that the original on the web browser. There is also known an attack technique called cross-site scripting (hereinafter abbreviated as XSS) in which a script created by an attacker operates in the same area as a server page.

  By the way, as a method for confirming security and other properties for an arbitrary system, methods such as design and implementation review, operation test, and simulation are generally used. Recently, a technique called model checking has attracted attention.

  Model checking is a kind of simulation, and is generally expressed by an abstract model that focuses only on the property of interest in the target system, and this model is executed in a special model called a model checker. Reproduce with software. At this time, the model checker exhaustively searches for multiple execution paths caused by input values and conditional branches, checks whether the target system reaches a state that violates the desired property, and if a violation occurs, Report the route. Alternatively, if no violation is found until the end, the target system reports that it satisfies the desired property.

  Model checking is very useful for checking parallel / distributed systems that are difficult for humans to examine comprehensively. However, there is a problem of so-called state explosion, where the number of states to be searched increases exponentially as the system becomes complex. In model checking, in order to improve search efficiency and avoid infinite loops, it is necessary to record the searched state and refer to it efficiently. Therefore, not only does the search time increase as the number of states increases, but also the amount of physical memory There is often a problem that there is not enough to search in a realistic time.

  In the model checking method, the specific model representation method depends on the model checker, but the model represents the system and can be said to be a kind of software program. In many cases, it can be expressed as a finite state automaton specification, that is, a state transition diagram, a control flow diagram, or a kind of imperative program. In addition, characteristic elements (for example, communication channel definition, non-deterministic branching, etc.) for realizing the expression of a system composed of a plurality of processes and the efficiency of model checking are included.

  When checking the web security by the model checking method, it is necessary to prepare a model that properly incorporates the premise specific to the web application and the special characteristics of the web browser. Also, security checks need to include “attackers” in the model that try anything they can. Based on these, a model that can be efficiently inspected must be prepared.

  Several model checks for web applications are dealt with in research presentations. However, there are few that take into account the characteristics of web browsers and the behavior of attackers.

  Gross et al. In Non-Patent Document 1 propose a general-purpose browser model. This model has features such as communication path protection and redirection using HTTPS, and also takes into consideration the possibility of attacks in which attackers wiretap and tamper with messages on the network and look into browser caches.

In addition, Haydar et al. In Non-Patent Document 2 propose a simple web system model than that of Gross et al. For the purpose of model checking.
T. Gross, B. Pfitzmann, and AR Sadeghi, "Browser Model for Security Analysis of Browser-Based Protocols", Proc. ESORICS 2005, LNCS 3679, pp. 489-508. Springer, 2005 (http: // eprint. iacr.org/2005/127) Haydar, A. Petrenko, H. Sahraoui, "Formal Verification of web Applications Modeled by Communicating Automata", Proc. Of FORTE 2004, LNCS 3235, pp. 115-132. Springer, 2004 (http: //www.crim. ca / files / documents / services / rd / publications / ASD_HayMals_Forte04.pdf)

  In Non-Patent Document 1, a cookie often used for holding a session ID is not included in the model, but it is considered that it is not so difficult to create a model including a cookie. However, the model of Gross et al. Is for analyzing security by inference, and is not necessarily suitable for efficient model checking. Further, it is possible to apply a model check to the security of the web system by applying the model of Non-Patent Document 2.

  However, if the models based on the techniques of Non-Patent Document 1 and Non-Patent Document 2 are applied to model checking specialized for security breaches in the web system, the model checking easily causes a state explosion, Expected to require memory.

  Specifically, attacks against web applications, in particular attacks that have weaknesses in sessions and cookies, are often realized by a combination of partial attack techniques. Even with each attack technique alone, several requests and responses are required. Therefore, the overall attack procedure is further increased. Moreover, in model checking, procedures that do not succeed in the attack must be searched, and various combinations of event occurrence orders such as message exchange called interleaving must be considered. Therefore, the number of attack technique procedures has an exponential effect on the number of states.

  To give a specific example, it is difficult to assume that a user accesses only a secure site in a general usage environment of a web application. The phenomenon that “the browser accesses the attacker's website and is manipulated by the redirect or script specified there” is considered to occur at any time.

  Therefore, in the model, the browser should be able to access the attacker's site at any time and access any site by its response. This attack technique requires at least three steps: the first request and response, followed by the derived response, and in fact the contents of the latter two responses are diverse. Therefore, there are many more possible combinations of the three procedures. Actually, the number of combinations depends on the type of message effective for the web application to be inspected.

  As another specific example, an attacker can use the browser guidance technique described above to force or overwrite a browser with a cookie for an arbitrary site. By this method, a request (not protected by HTTPS) can be sent to the target web site, and the attacker can catch it on the communication path and forge a response including the Set-Cookie header. . This attack requires four steps, including browser navigation.

  Conventionally, two types of countermeasures have been taken for the problem of the increase in the number of states. One is a technique related to the details of the model checking process, which devise how efficiently the state space is searched, and generally when the search can be omitted. This measure can be used regardless of the nature of the target system and is often implemented as a model checker function. For example, the improvement of the algorithm by BDD (Binary Decision Diagram), Partial Order Reduction, etc. are famous.

  The other is a technology related to the level of abstraction when modeling the target system. The efficiency depends on the characteristics of the target system and the properties to be inspected. Reduce the scale or omit the search route. This countermeasure must be taken according to each target system.

  The present invention belongs to the latter approach, and a model specialized in web application security inspection that can avoid an explosive increase in the number of states is created and inspected using this model. It is intended.

  In order to reduce the number of states executed in a model representing a web system including a target web application in order to create a model specialized for security inspection of the web application, the present invention reduces an attack procedure shortened to the model. Is provided. Since the operation procedures in the model are generally represented by instructions or state transitions, assuming that they are collectively referred to as steps, the present invention sets a specific attack technique against a web application as a shortened attack procedure. To do. Examples of such attack techniques include forcing or guiding requests, forcing cookies, stealing in-page data and cookies by XSS, and the like.

  A shortened attack procedure is not a step-by-step implementation of an attack technique step by step, but an event that occurs as a result of an attack in one or a few steps. At this time, the shortened attack procedure is set so as not to differ from the inspection result using the original attack procedure.

  Specifically, the behavior of the model in which the user's browser accesses the attacker's site at an arbitrary timing and is then manipulated by the attacker's response to send a request is omitted, and only occurs as a result. Is incorporated into the model. For this reason, on the model, the function of accessing the attacker site, which is a part of the communication function of the browser using HTTP or HTTPS, is deleted. Instead, a function is added in which an attacker requests to send a request and the browser executes it, and a function that an attacker requests to force a cookie and the browser accepts it. The specific expression method of these functions on the model depends on the expression form (language) of the model.

The present invention is a device for generating a security check model for a web application, and obtains important data arrangement information for security including screen transition specification information of the web application and responses to be protected and prior knowledge of an attacker. An input setting information receiving unit, an identifier creating unit that creates an attack message identifier corresponding to an attack result based on the screen transition specification information and the important data arrangement information, a browser, a server of the web application, and Among the procedures composed of multiple requests and responses executed between attackers, the attack procedure that causes forcible or directed request transmission by the attacker page created by the attacker is described below. Set to occur with fewer steps A security attack model including a shortened attack procedure creating unit for creating a defined shortened attack procedure, a channel definition creating unit for setting a channel definition for the shortened attack procedure, a message identifier for attack, and a channel definition for the shortened attack procedure A model output unit for outputting .

The present invention provides a computer to send a request by an attacker page created by the attacker in a procedure composed of a plurality of requests and responses executed between a browser of a web application, a server, and an attacker. This is a program for executing an abbreviated attack procedure creating process for creating an abbreviated attack procedure that is defined so as to produce the effect of the attack with a smaller number of procedures.

In the present invention, the attack procedure that is the target of the shortened attack procedure may be an attack procedure related to cookie forcing that causes forgery or falsification of a response after one attack procedure. Alternatively, even if the attack procedure targeted by the shortened attack procedure is an attack procedure that causes the steal of predetermined information by mixing the script created by the attacker into the web page of the original server. Good.

  Furthermore, the present invention provides environment information in which the web application including the specification information of the web application to be inspected, the security specification information, and the definition of the attack executed by the attacker is input to the computer. A program for executing the input setting information receiving process to be acquired and the process for changing the shortened attack procedure based on the specification information, the security specification information, and the environment information in the shortened attack procedure creating process It may be.

  According to the present invention, it is possible to generate a model (security inspection model) that realizes a shortened attack procedure that realizes an event that occurs as a result of an attack in one or a small number of steps. In the search process by the device, it is possible to reach a state where the security has been breached in a short procedure, and the possibility that the security problem can be detected early is increased.

  In addition, since the browser can access the attacker's site from the model to be created and the steps that are guided by the response and the request / response exchange operations related to XSS can be removed, the number of states of the model as a whole is further reduced. It is more effective for early detection of problems.

  The program according to the present invention can be stored in an appropriate recording medium such as a portable medium memory, a semiconductor memory, or a hard disk that can be read by a computer. It is provided by transmission and reception using various communication networks via the interface.

  According to the present invention, it is possible to create a model that realizes a shortened attack procedure when checking the security of a web application. In this model, many of the transitions that existed in the prior art are omitted without affecting the inspection results that we originally want to investigate, such as the presence or absence of security flaws. Is added.

  Transitions omitted by the present invention include, for example, a transition in which a browser sends a request to an attacker's site, reception / response transmission by the attacker in response to this request, and a browser that receives this transmission is guided to send a request. The transition includes a transition in which the original server returns a response including a script by XSS, a transition in the behavior of the browser that has received the response, and the like, and the number thereof is very large.

  Therefore, when model checking is performed on a model created according to the present invention, the procedure until a successful attack is shortened, the types of transitions generated from each state are reduced, and the number of states of the entire model is reduced. The Therefore, the possibility that a defect can be found earlier increases, and the processing time until all the states are searched can be shortened.

  In model checking, when the number of states increases, the physical memory amount is often violated. Therefore, if the number of states increases, the search may fail before the end of the search, but this can be avoided.

  In this way, the total number of states in the model has a generally exponential positive correlation with the number of steps (depth) and the number of types of steps (the width of transitions that can be selected in each state). The effect of reducing is very large.

  FIG. 1 shows a configuration example in the best mode of the present invention. The model generation device 1 is generally implemented as software that operates on a computer system.

  The model generation device 1 generates and outputs a model (model data) 2 based on the specification of the target web application in accordance with an instruction from a model inspector (hereinafter referred to as an inspector). Furthermore, the model generation apparatus 1 can also generate a model 2 including only a necessary short attack procedure according to the environment and premise of the target web application and the property to be examined according to the inspector's instruction.

  The model generation device 1 includes an information input reception unit 11, a model construction unit 13, and a model output unit 15.

  The information input receiving unit 11 is processing means for receiving instruction information 10 input by the inspector.

  The instruction information 10 includes a set of service identifiers (information abstracted URLs) that the web server accepts requests, a set of response identifiers that the web server returns to the browser, a description of the behavior of the web server for each service identifier, and a response identifier Web application specification information such as a description of the behavior of each web browser, response identifiers to be protected, security specification information such as prior knowledge of attackers, environment information where the target web application is located, and the like.

  The model construction unit 13 is a processing unit that creates the model 2 based on the instruction information 10. Detailed processing of the model building unit 13 will be described later.

  The model output unit 15 is a processing unit that outputs model data to be the model 2 created by the model construction unit 13.

  Model 2 expresses the behavior of a web system that consists of a web browser that implements a target web application that communicates with each other over a network, an original web server, and an attacker, and the procedure of a certain attack technique is used as it is. It includes a function (shortened attack procedure realization function) that can realize a shortened attack procedure that realizes an event that occurs as a result of an attack in one or a few steps.

  The model 2 output from the model generation device 1 is input to the model checking device 3 and executed. The model checking device 3 performs a predetermined check on the behavior of the model 2 and outputs the check result 4.

  In the present embodiment, the model generation apparatus 1 is implemented as a general-purpose computer and an application program that operates on an operating system (OS), as shown in FIG.

  The computer 101 includes an arithmetic device, a volatile physical memory 102, a storage device such as a nonvolatile disk 103, an input / output device 104 such as a keyboard, a mouse, and a video display, a network communication device 105 with a network N, and the like. .

  An operating system (OS) and various application programs operate on the computer 101. The OS performs the functions of the various devices described above, such as process execution control (scheduling), short-term storage such as a heap, long-term storage such as a file or registry, text It is provided to an application program as a system call or communication API such as a base or graphic-based user interface (UI).

  However, the embodiment of the present invention is not limited to the above-described configuration, and can be implemented by dedicated hardware or the like.

  FIG. 3 is a diagram showing a flow of processing of the model construction unit 13.

  Step S1: The model construction unit 13 extracts a trivial identifier from the specification information of the instruction information 10, and creates an identifier list. At this time, based on the security specification information, each identifier is given a code indicating who the browser, server, and attacker know the identifier in the initial state.

  Step S2: Next, session identifiers are added by a predetermined number.

  Step S3: Further, a necessary message identifier for an attacker is added according to the attack technique permitted by the environment information.

  In the case of the identifier list as shown in FIG. 4, there are the following eight message identifiers for attackers. It consists of seven leakage message identifiers starting with “leak_” prepared for “force_cookie” for forcing cookie setting and unknown information for the attacker.

  In either case of the present invention or the conventional method, the message identifier for leakage is required as well. However, in the case of the conventional method, more message identifiers are required instead of using “force_cookie”. That is, at least one message identifier representing a request to a page prepared by the attacker, a plurality of message identifiers representing responses to each page of the original server and a response for “Set-Cookie”, and XSS In order to do so, a plurality of message identifiers each representing a request including script data and a response to the request were required. In the present invention, “force_cookie” is used, but many such message identifiers required in the conventional method are unnecessary.

  Step S4: Next, a channel definition shared between different types of processes is defined so that a necessary message identifier can be transmitted and received in the identifier list for each of the shared channel and the short attack procedure channel. Here, if necessary, an HTTPS protection flag can be transmitted and received.

  The short attack procedure channel definition is unnecessary for the conventional model without the shortening procedure, and is added to achieve the object of the present invention.

  Step S10: A server shared variable list is created. As shown in FIG. 5, the server shared variable list requires a variable for storing session data and a variable for session management.

  Step S11: Information (for example, a state transition graph) defining the operation of the process S is created from the description of the server operation in the specification information. Web server operation is determined to receive a request via a shared channel and perform session management and response return as given in the specification information according to the service identifier and other conditions specified there. . In the prior art, particularly when XSS is considered, it is necessary to add an operation that means reception of a request including script data and transmission of a response to the request, but these are unnecessary in the present invention.

  Step S12: A definition of the process S is created from the state transition graph and the variable list.

  Step S20: Create a shared variable list for the browser. As shown in FIG. 6, a variable for storing the current cookie value is prepared in the browser shared variable list.

  Steps S21 and S22: For each of the processes B1 and B2, a state transition graph that defines the operation is created.

  The browser's behavior is to send a legitimate request to the server and receive a response, to be sent by the attacker to send a request and receive a response, to leak information unknown to the attacker to the shortened attacker channel, One that does one, and one that receives a cookie from the attacker through a shortened attacker channel.

  In the prior art, in addition to the above, an operation for requesting an attacker's site, an operation for receiving a response from the attacker's site, an operation guided to the original site by a link or script included in the response, and XSS In the present invention, it is necessary to add many operations such as an operation of receiving a response including an attacker script from the original site.

  Step S22: Create definitions of processes B1 and B2 from the state transition graph and the variable list.

  Step S30: An attacker knowledge flag variable list is created. As shown in FIG. 7, the attacker knowledge flag variable list has, as variables, knowledge flags relating to identifiers that the attacker does not know in the initial state. This includes identifiers that are secret or unknown in the security specification information, and session identifiers.

  Step S31: A state transition graph that defines the operation of the process I is created. The attacker's action is basically to create and send significant requests and responses freely as permitted by knowledge, or to receive arbitrary requests or responses and add new information contained in them to knowledge. Is. Furthermore, in order to enable a shortened attack procedure, a known session identifier is forced to the browser through the shortened attack procedure channel, or a message in which the browser leaks information is received and added to the knowledge.

  In the conventional technology, it is necessary to add an operation in which an attacker behaves as an original server and receives a request from a web browser, and a guidance request including a link request and a script data for causing XSS. However, they are not necessary in the present invention.

  Step S32: A process I definition is created from the state transition graph and the variable list.

  Step S40: The identifier list generated in steps S1 to S3, the channel definition generated in step S4, and the process definitions generated in steps S10 to S32 are integrated and output as model 2 (model data).

  In the processing flow of FIG. 3, the processes (steps S10 to S12, S20 to S23, and S30 to S32) for generating the process definitions of the server, browser, and attacker are described in a specific order. The processing is not necessarily performed in that order.

  Below, the specific example of the process of this invention is demonstrated.

  Here, as an input example, the inspector sets a web application having a screen transition specification as shown in FIG. In FIG. 8, a rectangle represents the type of page returned to the browser, and an ellipse represents the type of request sent from the browser to the server. Arrows indicate the order in which requests should be sent and page returns should occur, and thick arrows indicate the most normal process expected by the designer. Although not shown in FIG. 8, it is assumed that a session is realized by storing a session ID in a cookie, and session management and other server behavior are also determined.

  Note that the arrow to the ellipse means the behavior that the designer expects. In fact, the client (usually the user's browser or attacker) can send requests in any order when they want. Such an operation is not shown.

  The specification information input to the model generation apparatus 1 regarding the web application shown in FIG. 8 is, for example, the information shown in FIGS.

  Such specification information may be written in a document, or may be the specification of the web application as described above stored in the designer's memory for writing to the model generation device 1. 8 screen transition specifications may be input via a graphical user interface (GUI) and automatically or semi-automatically generated. However, details can be omitted because they are possible with existing technology.

  The specification information of the web application in FIG. 9 is information such as a service identifier, a response identifier, a user identifier, and a combination of a user identifier and a password.

  The specification information of the web application in FIG. 10 describes conditions, response identifiers, operation details, and the like as server behavior for each service identifier.

  The security specification information in FIG. 11 is information such as secret information, public information, user prior knowledge that the user and the server can know, and attacker prior knowledge that the attacker and the server can know.

  The specification information shown in FIGS. 9 to 11 is obtained from screen transition specifications and other information / knowledge.

  FIG. 12 is an example of environment information input to the model generation device 1. The maximum number of sessions is a session identifier prepared in the model and session data and knowledge variables corresponding to the session identifier, and is used to determine a branch condition for session processing in the model. The multiplicity of processes determines how many different processes are generated in the model. The request compulsory / directable flag and the script scriptable flag to the server specify the types of attack techniques allowed for the attacker. Procedures corresponding to attack techniques not allowed here are removed from the model.

  Examples of intermediate data in the process of being created by the model construction unit 13 from the specification information are as shown in FIGS.

  The identifier list in FIG. 4 includes identifiers that can be directly generated from the specification information, session identifiers that have been expanded as many times as necessary, and message identifiers for attackers that are used in shortened attack procedures. In the identifier list, the reference sign in parentheses means that the processes that know the identifier in the initial state are limited. (S) means only the server, and (B, S) means that only the browser and the server know the identifier. An identifier without a sign is public information.

  As described above, in the prior art, in place of the cookie forcing message identifier force_cookie, a number of message identifiers representing a request response with an attacker site and a request response for XSS induced by the attacker site are induced. Needed to be added. However, they are not necessary in the method of the present invention.

  The server shared variable list in FIG. 5 includes a session data variable for data stored corresponding to each session identifier and a session management variable for recording the number of the session identifier to be issued next. The browser shared variable list in FIG. 6 has a variable for recording the current cookie value. The attacker knowledge flag variable list of FIG. 7 is prepared corresponding to the identifiers marked as unknown by the attacker in the identifier list.

  The model 2 generated by the model construction unit 13 has a structure called a process group communicating with each other through a channel, and the behavior of each process is expressed by a state transition graph. However, to describe all states and transitions without omissions, it is not practical because it requires a very large number of characters and space, so the states and transitions are summarized to some extent so that the essence of the behavior can be understood. In this case, an appropriate variable group exists in the process, and the actual state differs depending on the value of the variable group even if the state transition graph represents one state.

  FIG. 13 shows an example of the model 2 process structure generated from the specification information shown in FIGS. In FIG. 13, a rectangle represents a process and an ellipse represents a channel. There are multiple browser and server processes, which means that multiple processes of the same or different types operate in parallel. However, some variables are shared between processes, and are used for storing cookies for browsers, session ID usage status and session data for servers.

  In the example of FIG. 13, there is one attacker process, but a plurality of attacker processes may be provided as in the case of the browser and the server. In this case, a shared variable for storing the attacker's knowledge is provided. Since the parallel number of these processes affects the result of model checking and the number of states, the model generation apparatus 1 may not only decide on its own, but may change according to the designation of the inspector, but the method is self-evident. Because there are, it is omitted here.

  In addition, a dedicated channel sh is used to realize a shortened attack procedure between the browser and the attacker. However, instead of the channel sh, the browser and the attacker can share, for example, using a global variable. May be.

  A line connecting a process and a channel means that communication can be performed using that channel, and in this example, all of them can be transmitted and received. However, at this time, each process transmits and receives according to basic restrictions. The restriction is that a normal process other than the attacker is addressed to him and can receive only legitimate messages when protected by HTTPS, and the attacker process can receive all messages not protected by HTTPS. It is something like that.

  14 to 17 show examples of state transition graphs of processes in the model 2 described above. In these state transition graphs, a black circle represents a start state, a white circle (rounded square) represents a state, and an arrow connecting them represents a transition between states. However, the white rhombus means a branching / merging point for writing a plurality of transitions together, and is not a process state itself.

  The character string in the rectangle attached to the transition has the format "[condition] event // action", but the parts of "[condition]", "event", and "// action" are applicable. If there is no, it is omitted. The event is the name, type, and condition of the event that causes the transition, the condition (other than the event) for performing the transition, and the action means the action performed by the process at the time of transition. If the condition is "[else]" This means that the transition can be made only when other conditions originating from the same branch are not met. The transition may be non-deterministic, and any one is arbitrarily selected in the case of a branch having a plurality of transitions that satisfy an event or a condition.

  In the event, the notation “Ch! Msg” means that the message msg is transmitted to the channel ch, and “ch? Msg” means that the message msg is received from the channel ch. Actually, cookies (corresponding to the Set-Cookie header and Cookie header) can also be sent and received, but for the sake of simplicity of explanation, the server process will store the newly issued session ID and the browser process will store the currently stored cookie. Assume that the attacker process is implicitly adding the cookie values selected in the state transition graph.

  In this example, the information that defines the operation of the process is described as a state transition graph because this is a general and fundamental expression format for models for model checking. The language and format actually used to represent the model vary depending on the type of the model checking device 3, but any language and format can be easily converted from the state transition graph.

  FIG. 14 is a state transition graph of the server process S.

  “New_s” of the operation associated with the transition means that if there is no valid session cookie in the received request, it means that a new session is prepared and the session ID is issued as a cookie, and “put (N)” is received If there is a valid session cookie in the request, it means that the value N is recorded as the corresponding session data.

  Session data is recorded for each session ID in a shared variable of the server. Further, the condition “get () = N” means that if the received request has a valid session cookie and the corresponding session data has the value N, the condition is satisfied. The state transition graph of FIG. 14 represents that a request is received and behaves as shown in FIGS. 9 to 11 in accordance with the service identifier and other conditions.

  In the prior art, particularly when XSS is possible, a plurality of transitions that accept a request including script data and return a response including a script must be added between the received state and the wait state. According to the present invention, since the effect caused by XSS is directly realized between the browser and the attacker process without going through the server process, the model building unit 13 adds these transitions to the server process when creating the model. do not do.

  FIG. 15 is a state transition graph of the browser process B1. The state transition graph in FIG. 15 shows a state in which the browser transmits a significant request to the server, but the order is arbitrary.

  Further, a transition for the shortened attack procedure is added to the state transition graph of FIG. Transitions for shortened attack procedures include transitions (nw! Login_pwx) that are forced / guided to send significant requests that only the attacker knows, and current cookie values and private pages by scripts mixed by the attacker The information is stolen (sh! Leak_ (cookie) and sh! Leak_private).

  In the prior art, many transitions had to be added instead of transitions for these shortened attack procedures. That is, a transition for sending a request to the attacker's site, a transition for receiving a response from the attacker's site, a transition for sending a request induced by the response, and the request causing XSS Transition for receiving a response including the above script, and transition for sending a request to the attacker site or the original server by the response. Of these, the transition to be requested is added as a transition between the wait_action state and the wait_response state from the wait_action state, and the response transition is from the wait_response state to the wait_action state. It is also necessary to provide a condition according to the response received immediately before. Depending on the type of response received, it may be branched in a more detailed way, but at least the transition described above is required.

  On the other hand, the model construction unit 13 of the present invention creates a model that can realize the attack technique as a direct effect without request / response. Therefore, the model according to the present invention does not require many transitions as described above, and becomes a state transition graph having a simpler configuration.

  FIG. 16 is a state transition graph of the browser process B2. The state transition graph of FIG. 16 means an operation for accepting cookie forcing from an attacker, and accepts a cookie value given by a force_cookie message and records it in a corresponding variable. This process itself is to realize a shortened attack procedure.

  In the prior art, cookie enforcement is realized as an attacker intervening in communication with the original server. For this reason, the process B2 is unnecessary, but instead, the process B1 is required as many as the number of the process B2. The model construction unit 13 of the present invention creates a model in which some of the complicated processes B1 are replaced with simpler processes B2.

  FIG. 17 is a state transition graph of the attacker process I. The state transition graph of FIG. 17 is shortened in addition to the operation of sending an arbitrary request or response within the knowledge range known to the attacker, the operation of receiving an arbitrary request or response and adding the information contained in the request to the knowledge. It means the action that realizes the attack procedure.

  The shortened attack procedure is realized by an operation for forcing a cookie value known to the attacker to the web browser, and an operation for receiving a leak request from the web browser and adding it to the memory.

  In the prior art, the attacker process I needs to receive a request from the web browser process and return a response by itself as a server, and such a request / response includes many instructions to the original server. It was necessary to add quite a number of transitions from the wait state back to the wait state. The model construction unit 13 of the present invention creates a model that does not have those transitions.

  The logical structure of the model 2 output by the model output unit 15 can be represented by the state transition graph as described above.

  The model checking device 3 performs model checking using such a model 2, for example, a state in which the attacker X knows information private that should be known only to a specific user U (a state in which know_private becomes true). ) To check whether security is breached.

  If it is set in the environment information that each attack technique is not possible, the model building unit 13 does not satisfy the condition for the corresponding transition from being generated or does not create the corresponding transition from the generated model. Good. In the state transition graph described above, a transition having a condition such as “script can be mixed” or “request can be guided” corresponds to this.

  Although the present invention has been described above with reference to the embodiments, it is obvious that the present invention can be variously modified within the scope of the gist thereof.

  The features of the embodiments and examples of the present invention are listed as follows.

(Appendix 1)
Computer
Of the procedures consisting of multiple requests and responses executed between the web application browser, server, and attacker, an attack that causes forcing or guiding the request transmission by the attacker page created by the attacker A security inspection model generation program that executes a shortened attack procedure creation process that creates a shortened attack procedure that defines the effect of the attack in a smaller number of steps.

(Appendix 2)
The model for security inspection according to claim 1, wherein the attack procedure that is a target of the shortened attack procedure is an attack procedure related to cookie enforcement that causes forgery or falsification of a response after one attack procedure. Generation program.

(Appendix 3)
The attack procedure that is the target of the shortened attack procedure is an attack procedure that causes the steal of predetermined information by mixing a script created by the attacker into the web page of the server. The security inspection model generation program according to Appendix 1.

(Appendix 4)
In the computer,
Input setting information reception processing for acquiring specification information of the web application, security specification information, and environment information in which the web application is set and information including an attack definition executed by the attacker, which is input by a user; ,
In the shortened attack procedure creation process, a process for changing the shortened attack procedure based on the specification information, the security specification information, and the environment information,
The security inspection model generation program according to any one of Supplementary Note 1 to Supplementary Note 3 for execution.

(Appendix 5)
Of the procedures consisting of multiple requests and responses executed between the web application browser, server, and attacker, an attack that causes forcing or guiding the request transmission by the attacker page created by the attacker A model generation apparatus for security inspection comprising a shortened attack procedure creation unit for creating a shortened attack procedure that defines a procedure so that the effect of the attack is generated with a smaller number of procedures.

(Appendix 6)
A device for generating a web application security inspection model,
web application specification information, security specification information, environment information in which the web application is placed, and an input setting information receiving unit that acquires information including a definition of an attack executed by the attacker;
An identifier creating unit for creating a message identifier for an attacker corresponding to the result of the attack based on the specification information, the security specification information, and the environment information;
Out of the procedures composed of multiple requests and responses executed between the browser, server, and attacker of the web application, the attacker sends a request to be forced or guided by the attacker page created by the attacker. For the attack procedure, a shortened attack procedure creation unit that creates a shortened attack procedure that is defined so as to produce the effect of the attack with a smaller number of procedures;
A channel definition creation unit for setting a channel definition of the shortened attack procedure;
A model generator for security inspection, comprising: a model output unit for outputting a model for security inspection including the message identifier for attacker and a channel definition of the shortened attack procedure.

(Appendix 7)
Of the procedures consisting of multiple requests and responses executed between the web application browser, server, and attacker, an attack that causes forcing or guiding the request transmission by the attacker page created by the attacker An execution unit that executes a security inspection model including a shortened attack procedure that is defined so that the effect of the attack is generated with a smaller number of steps.
A security inspection model checking apparatus comprising: an inspection unit that determines whether a procedure at the time of executing the web application is a predetermined result.

It is a figure which shows the structural example in the best embodiment of this invention. It is a figure which shows the structural example of the system which implements this invention. It is a figure which shows the flow of a process of a model construction part. It is a figure which shows the example of an identifier list. It is a figure which shows the example of a server shared variable list. It is a figure which shows the example of a browser shared variable list. It is a figure which shows the example of an attacker knowledge flag variable list. It is a figure which shows the example of the screen transition specification of a web application. It is a figure which shows the example of the specification information of a web application. It is a figure which shows the example of the specification information (server operation | movement description) of a web application. It is a figure which shows the example of the specification information of security. It is a figure which shows the example of the example of environmental information. It is a figure which shows the example of the process structure of a model. It is a figure which shows the example of the state transition graph of the server process. It is a figure which shows the example of the state transition graph of browser process B1. It is a figure which shows the example of the state transition graph of browser process B2. 6 is a diagram illustrating an example of a state transition graph of an attacker process I. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Model generation apparatus 11 Information input reception part 13 Model construction part 15 Model output part 2 Model (model data)
3 Model inspection device 4 Inspection result 10 Instruction information

Claims (5)

A device for generating a web application security inspection model,
an input setting information receiving unit for acquiring security important data arrangement information including screen transition specification information of a web application, and responses to be protected and prior knowledge of an attacker;
An identifier creating unit that creates an attack message identifier corresponding to an attack result based on the screen transition specification information and the important data arrangement information;
Out of the procedures composed of multiple requests and responses executed between the browser, server, and attacker of the web application, the attacker sends a request to be forced or guided by the attacker page created by the attacker. For the attack procedure, a shortened attack procedure creation unit that creates a shortened attack procedure that is defined so as to produce the effect of the attack with a smaller number of procedures;
A channel definition creation unit for setting a channel definition of the shortened attack procedure;
A security check model generation device comprising: a model output unit that outputs a security check model including the attack message identifier and a channel definition of the short attack procedure. The security inspection model according to claim 1, wherein the attack procedure that is a target of the shortened attack procedure is an attack procedure related to cookie enforcement that causes forgery or falsification of a response after one attack procedure. Generator. The attack procedure that is the target of the shortened attack procedure is an attack procedure that causes the steal of predetermined information by mixing a script created by the attacker into the web page of the server. The model generation apparatus for security inspection according to claim 1. An input setting information receiving unit for acquiring important data arrangement information of security including screen transition specification information of a web application, responses to be protected and prior knowledge of an attacker, and the screen transition specification information and the important data arrangement information. A procedure consisting of an identifier creation unit that creates an attack message identifier corresponding to the result of an attack, and a plurality of requests and responses executed between the browser, server, and attacker of the web application Among these, a shortened attack that creates a shortened attack procedure that is defined to cause the attack effect to be generated with a smaller number of procedures for an attack procedure that causes forced or guided transmission of a request by the attacker page created by the attacker. The procedure creation unit and the channel definition of the shortened attack procedure Output from a security inspection model generation device comprising: a channel definition creation unit to be defined; and a model output unit that outputs a security inspection model including the attack message identifier and the channel definition of the shortened attack procedure. An execution unit that inputs and executes a security inspection model including a message identifier and a channel definition of the shortened attack procedure ;
A security inspection model checking apparatus comprising: an inspection unit that determines whether a procedure at the time of executing the security inspection model of the web application is a predetermined result. Computer
Acquire important data placement information of security including screen transition specification information of web application, response to be protected and prior knowledge of attacker,
Based on the screen transition specification information and the important data arrangement information, create an attack message identifier corresponding to the result of the attack,
Out of the procedures composed of multiple requests and responses executed between the browser, server, and attacker of the web application, the attacker sends a request to be forced or guided by the attacker page created by the attacker. For the attack procedure, create a shortened attack procedure that defines the effect of the attack with fewer steps,
Set the channel definition for the shortened attack procedure,
A security inspection model generation program for executing a process for outputting a security inspection model including the attack message identifier and a channel definition of the shortened attack procedure.

Images