JP6599053B1 - Information processing apparatus, information processing method, and information processing program - Google Patents

Abstract

The variable determination unit (22) determines the type of each of the plurality of variables included in the program executed on the device. The candidate generation unit (23) compares each type of the plurality of variables determined by the variable determination unit (22) with each type of the plurality of information assets used by the device, and compares each of the plurality of information assets. One or more candidates for correspondence with each of a plurality of variables are generated.

Description

  The present invention relates to vulnerability analysis.

  In the development process that considers security, security is analyzed and examined from the upstream development stage in order not to create vulnerabilities that are security problems. First, in the upstream development phase of system design, etc., threat analysis is performed to identify threats that should not occur in the development target system (for example, threats such as eavesdropping on confidential information flowing through the communication path are identified) ). Then, based on the result of the threat analysis, a countermeasure policy for preventing the threat is reached (for example, it is necessary to encrypt the communication path). When the development phase further advances and the design and implementation stage is reached, the processing contents for realizing the development target system and the security function and operation method suitable for the specific method for realizing the program for realizing the processing contents are examined. Then, incorporate the study results into design and implementation. At the final stage of design and implementation, analysis is performed to confirm whether the designed and implemented program is vulnerable.

As one of methods for realizing a vulnerability analysis apparatus for confirming whether there is a vulnerability, there is a technique for statically analyzing the specifications of a designed and implemented program or the program itself.
A conventional vulnerability analysis device analyzes a source code of a program using an analysis technique such as contamination analysis according to a predetermined rule (for example, Patent Document 1).
In addition, a method has been proposed in which a program specification is formally described in a model, and a formal method called model checking is used to mathematically prove whether the program operation satisfies the property of generating a vulnerability (for example, Patent Document 2).

Japanese Patent No. 5740702 JP 2008-262111 A

In the method of Patent Document 1, the source code of a program is analyzed according to a predetermined rule. For this reason, it is impossible to confirm vulnerabilities due to omissions or errors in the design and implementation of security measures studied after the threat analysis performed in the upstream process.
In the method of Patent Document 2, verification is possible by defining or selecting a property to be proved. To correctly define or select the nature of the object to be proved, it is necessary to know the details of what the design and implementation specifications should be. However, threat analysis is performed in the upstream development phase, where design and implementation specifications are uncertain. For this reason, it is very troublesome to define or select the property of the object to be proved by associating the result of the threat analysis with the specification designed and implemented by the program. Further, in the method of statically analyzing the specification of a program, if the entire program is to be analyzed, a large amount of computer resources such as a memory are required, and the calculation time becomes long.

In order to perform vulnerability analysis efficiently, the relationship between the part in the program (program executed on the device) that incorporates security measures after threat analysis in the upstream process and the information assets used by the device, It is useful to clarify the relationship between device information assets and vulnerabilities.
From such a viewpoint, the main object of the present invention is to contribute to the clarification of the correspondence between parts in a program, information assets, and vulnerabilities.

An information processing apparatus according to the present invention includes:
A variable discriminating unit for discriminating each type of a plurality of variables included in a program executed on the device;
Comparing each type of the plurality of variables determined by the variable determination unit with each type of the plurality of information assets used by the device, and each of the plurality of information assets and each of the plurality of variables A candidate generation unit that generates one or more candidates of the correspondence relationship.

  According to the present invention, in order to generate a candidate for a correspondence relationship between a variable included in a program executed on a device and an information asset used by the device, clarification of a correspondence relationship between the part in the program, the information asset, and the vulnerability Can help.

FIG. 3 is a diagram illustrating a configuration example of a vulnerability analysis apparatus according to the first embodiment. 5 is a flowchart illustrating an operation example of the vulnerability analysis apparatus according to the first embodiment. The figure which shows the example of the information asset flow regarding the controller which concerns on Embodiment 1. FIG. FIG. 4 shows an example of program specifications according to the first embodiment. The figure which shows the example of the correspondence of the component which concerns on Embodiment 1, and a program specification. FIG. 4 is a diagram illustrating an example of a threat analysis result according to the first embodiment. 5 is a flowchart illustrating an operation example of a variable determination unit according to the first embodiment. FIG. 3 is a diagram illustrating an example of a process type DB according to the first embodiment. FIG. 4 is a diagram showing an example of program variable processing relation according to the first embodiment. The figure which shows the example of the information asset-variable correspondence candidate based on Embodiment 1. FIG. The figure which shows the example of extraction operation | movement of the related threat list | wrist which concerns on Embodiment 1. FIG. FIG. 5 is a diagram showing an example of a related threat list according to the first embodiment. The figure which shows the example of threat-vulnerability classification corresponding | compatible DB which concerns on Embodiment 1. FIG. The figure which shows the example of the vulnerability classification candidate which concerns on Embodiment 1. FIG. The figure which shows the example of the vulnerability detection result which concerns on Embodiment 1. FIG. FIG. 4 is a diagram illustrating a configuration example of a vulnerability analysis apparatus according to a second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following description of the embodiments and drawings, the same reference numerals denote the same or corresponding parts.

Embodiment 1 FIG.
*** Explanation of configuration ***
With reference to FIG. 1, the structure of the vulnerability analysis apparatus 10 which concerns on Embodiment 1 is demonstrated.
The vulnerability analysis device 10 corresponds to an information processing device.

  The vulnerability analysis apparatus 10 is a computer. The vulnerability analysis apparatus 10 includes hardware such as a processor 11, a memory 12, a storage 13, and a communication interface 14. The proprocessor 11 and other hardware are connected via a signal line, and the processor 11 controls these other hardware.

  The processor 11 is an IC (Integrated Circuit) that performs processing. The processor 11 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit) as specific examples. In FIG. 1, only one processor 11 is shown. However, a plurality of processors 11 may be provided, and a plurality of processors 11 may execute programs that realize each function in cooperation with each other.

  The memory 12 is a storage device that temporarily stores data for processing of the processor 11. As a specific example, the memory 12 is an SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory).

  The storage 13 is a storage device that stores data. The storage 13 is an HDD (Hard Disk Drive) as a specific example. Further, the storage 13 may be an SSD (Solid State Drive). The storage 13 includes an SD (registered trademark, Secure Digital) memory card, CF (CompactFlash, registered trademark), NAND flash, flexible disk, optical disk, compact disk, Blu-ray (registered trademark) disk, DVD (Digital Versatile Disk), and the like. It may be a portable recording medium.

  The communication interface 14 is an interface for communicating with an external device. As a specific example, the communication interface 14 is a port of Ethernet (registered trademark), USB (Universal Serial Bus), or HDMI (registered trademark, High-Definition Multimedia Interface).

The vulnerability analysis apparatus 10 includes, as functional components, a first reception unit 21, a variable determination unit 22, a candidate generation unit 23, a second reception unit 24, a related threat extraction unit 25, a vulnerability candidate extraction unit 26, a vulnerability A sex analysis unit 27 is provided. The second reception unit 24 corresponds to an output unit.
The function of each functional component of the vulnerability analysis apparatus 10 is realized by a program.

  A program that realizes the function of each functional component of the vulnerability analysis apparatus 10 is stored in the storage 13. This program is read into the memory 12 by the processor 11 and executed by the processor 11. Thereby, the function of each function component of the vulnerability analysis apparatus 10 is implement | achieved.

  The function of each function component of the vulnerability analysis apparatus 10 may read information for determining an analysis operation performed by the program and information for determining a determination condition from a database or a setting file stored in the storage 13. Further, information for determining the analysis operation and information for determining the determination conditions may be part of the program. For example, in the present embodiment, the variable determination unit 22 reads the processing type DB 31 and changes the analysis operation. The vulnerability candidate extraction unit 26 reads the threat-vulnerability correspondence DB 32 and changes the analysis operation.

In FIG. 1, the configuration with only one vulnerability analysis apparatus 10 is illustrated. Instead, a plurality of computers may be connected via a network, and the plurality of computers may cooperate to constitute a vulnerability analysis system.
Further, in FIG. 1, it is assumed that an input / output device for a user to input to and output from the vulnerability analysis device 10 is connected via the communication interface 14. Instead of this, an interface for performing input and output may be provided in the vulnerability analysis apparatus 10 so that the user directly operates the vulnerability analysis apparatus 10.

*** Explanation of operation ***
The operation of the vulnerability analysis apparatus 10 according to the first embodiment will be described with reference to FIGS. The following operations of the vulnerability analysis apparatus 10 correspond to an information processing method and an information processing program.

  FIG. 2 is a flowchart showing the overall operation of the vulnerability analysis apparatus 10 according to the first embodiment.

First, the 1st reception part 21 receives the input of various information required for an analysis (step S1).
In step S1, the first accepting unit 21 performs an information asset flow 41 (FIG. 3), a program specification 42 (FIG. 4), a correspondence relationship 43 between the components and the program specification (FIG. 5), and a threat analysis result 44 (FIG. 5). 6) is accepted.

Moreover, the variable determination part 22 extracts the variable contained in the program represented by the program specification 42, and determines the type of the extracted variable (step S2).
As will be described later, the program specification 42 is a program (source code) executed on the device to be developed or information describing the characteristics of the program (flow chart, UML (Unified Modeling Language) or SysML activity diagram or sequence diagram). ).
The variable determining unit 22 determines whether the extracted variable is an input variable, an output variable, or an internal use variable as the type of the extracted variable.

Next, the candidate generation unit 23 generates a candidate for the correspondence relationship between the information asset and the variable (step S3).
The candidate generation unit 23 compares the variable type determined by the variable determination unit 22 with the type of information asset used by the device, and generates one or more candidates for the correspondence relationship between the information asset and the variable.
In this specification, an information asset is information determined to be used by a component (device) by threat analysis. Specifically, the information asset of the component (device) is described in the information asset flow 41 (FIG. 3).
The types of information assets include input information assets that are information assets that are input to the device, output information assets that are information assets that are output from the device to the outside of the device, and internal use that is information assets that are used inside the device. There are information assets.
The candidate generation unit 23 associates input information assets and input variables, output information assets and output variables, internal use information assets and internal use variables, and generates correspondence candidates.

When there are a plurality of correspondence candidates, the second reception unit 24 outputs a plurality of correspondence candidates. And the 2nd reception part 24 receives selection of the correspondence by the user of the vulnerability analysis apparatus 10 (step S4).
That is, the second receiving unit 24 displays a plurality of correspondence candidates, for example, on the input / output device, and the corresponding correspondence among the plurality of correspondence candidates displayed by the user of the vulnerability analysis apparatus 10. Select. And the 2nd reception part 24 receives the selection from a user.

Next, the related threat extraction unit 25 extracts related threats based on the correspondence relationship between the information assets and the variables (step S5).
That is, when only one correspondence relationship candidate is generated in step S3, the related threat extraction unit 25 extracts a related threat based on only one corresponding relationship candidate generated. On the other hand, when a plurality of correspondence relationship candidates are generated in step S3 and the selection of the correspondence relationship in step S4 is accepted, related threats are extracted based on the correspondence relationship selected in step S4.
Specifically, the related threat extraction unit 25 extracts a related threat from the threat analysis result 44 (FIG. 6) received in step S1.

  Next, the vulnerability candidate extraction unit 26 extracts vulnerability type candidates that may be used in an attack leading to a related threat (step S6).

  Finally, the vulnerability analysis unit 27 performs a vulnerability analysis for examining whether a candidate for a vulnerability type can occur in the description of the program specification 42, and outputs an analysis result (step S7).

  Next, the operation of each step in FIG. 2 will be described sequentially.

(Step S1: first accepting process in FIG. 2)
The first reception unit 21 includes an information asset flow 41 (FIG. 3), a program specification 42 (FIG. 4), a correspondence relationship 43 between components and program specifications (FIG. 5), and a threat analysis result 44 (FIG. 6). And accept.

Specifically, the input / output device connected via the communication interface 14 is operated by the user. By the user's operation, an information asset flow 41, a program specification 42, a correspondence relationship 43 between a component and a program specification, and a threat analysis result 44 are input. Then, the first receiving unit 21 receives the information asset flow 41, the program specification 42, the correspondence relationship 43 between the constituent elements and the program specification, and the threat analysis result 44 that are input via the communication interface 14.
Furthermore, the first receiving unit 21 writes the information asset flow 41, the program specification 42, the correspondence relationship 43 between the component and the program specification, and the threat analysis result 44 in the memory 12, respectively.

  An example of the information asset flow 41 will be described with reference to FIG.

The information asset flow 41 is obtained by organizing the flow (flow) of information assets after the threat analysis is performed. The information asset flow 41 is generated for each device included in the development target system.
The information asset flow 41 includes a component 411 that is a component (equipment) constituting the development target system, a related element 412 that is a component (device) related to the component 411, a component 411, and a related element 412. Connection information 413, information asset name 414, and information asset type 415.
As described above, the types of information assets are input information assets, output information assets, and internal use information assets. There may be information asset types other than input information assets, output information assets, and internal use information assets.
“Input” is a flow of information assets input to the component 411 from outside the component 411. “Output” is a flow of information assets output from the component 411 to the outside of the component 411. “Internal use” is a flow of information assets used only within the component 411.

Specifically, as shown in FIG. 3, the information asset flow 41 can be represented by a diagram obtained by extending the UML communication diagram. In FIG. 3, the rectangle represents the component 411 or the related element 412. The component 411 is a “controller” in the example of FIG. The related elements 412 are “HMI” and “device” in the example of FIG.
The connection relationship 413 is represented by a solid line connecting the component element 411 and the related element 412.
Further, in FIG. 3, an arrow is shown near the connection relationship 413. These arrows represent the flow of information assets. The direction of the arrow indicates the direction of information asset flow.
Further, a line having a round starting point extends from the controller regardless of the connection relation 413. This line also represents the flow of information assets. This line indicates that there is no flow between the component 411 and the related element 412, that is, the internal use information asset.
A character string arranged near the flow line of the information asset is the name 414 of the information asset handled in the flow. A character string surrounded by <<>> is an information asset type 415. For example, the arrow from the HMI to the controller in FIG. 3 means that the information asset “command” flows from “HMI” to “controller”. The arrow indicates that, from the standpoint of “controller”, the information asset type 415 is “input” (input information asset). In addition, a circle with a starting point extending from “controller” indicates that the type 415 of the information asset “MAC key” is “internal use” (internal use information asset), that is, the information asset “MAC key” is inside the controller. It is used in.
The information asset flow 41 corresponds to information asset information.

  Next, an example of the program specification 42 will be described with reference to FIG.

The program specification 42 includes a name 421 of a program to be analyzed for vulnerability, and a program processing content 422 representing a variable flow (data flow) and a processing flow (control flow).
Specifically, in the program specification 42, the entire program executed by the device (corresponding to the component 411 in FIG. 3) included in the development target system after the threat analysis is performed or a logic that is a part of the program is executed. Described. A program specification 42 is described for each device included in the development target system.
In addition, the program specification 42 may not be input to the vulnerability analysis apparatus 10 for a part of devices and programs that are not subject to vulnerability analysis.

The program specification 42 is specifically a source code or a program model.
The program model is information that can describe the structure and operation of a program such as a flowchart, UML, and SysML in a chart. The program model is, for example, a source code described in a program language and a flowchart in which processing / determination is described in a program language format such as C language (m = n + 1, m = add (n, 1), etc.). The program model also corresponds to a UML or SysML activity diagram or sequence diagram, a block diagram used in DFD, control engineering, or the like. The program model is described and stored in a data format that can represent a hierarchical structure so that the processor 11 (variable determination unit 22) can process its contents. The program model is described in a data format such as XML (Extensible Markup Language) and JSON (JavaScript (registered trademark) Object Notification). For example, FIG. 4 shows an example of a program specification 42 regarding communication processing with the HMI of the component “controller”. In FIG. 4, the operation content of a part of a program that operates on the controller is described in a general C source code format.
The program name 421 is “PROGRAM_C.C”, and the program processing content 422 is C language description content. In the example of FIG. 4, the program name 421 is indicated by the file name of the C language source code. However, any format can be used as long as the vulnerability analysis apparatus 10 can uniquely identify each program specification 42. good. The program name 421 is used in a correspondence 43 between a component and a program specification described later.

  Next, an example of the correspondence 43 between the component elements and the program specifications will be described with reference to FIG.

A correspondence relationship 43 between the component elements and the program specifications indicates a correspondence relationship between the component elements 431 targeted for vulnerability analysis and the program specifications 432.
The correspondence 43 between the component elements and the program specifications can be expressed as a table as shown in FIG. 5, for example. In FIG. 5, there are two program specifications 42 to be inspected by the component “controller”, which are “PROGRAM_CC” and “PROGRAM_DC”, respectively.

  Next, an example of the threat analysis result 44 will be described with reference to FIG.

The threat analysis result 44 shows the result of threat analysis for the development target system.
The threat analysis result 44 includes a threat 441, a component 442, related information assets 443, and a threat type 444.
The threat 441 shows the content of the threat.
The component 442 indicates a component or connection relationship in which a threat occurs.
In the related information asset 443, an information asset related to the threat is shown.
The threat type 444 indicates the type of impact on information assets when a threat occurs. The threat type 444 indicates, for example, one of C, I, and A that are generally used to indicate information security attributes. Note that C means confidentiality, I means integrity, and A means availability.
The threat analysis result 44 can be expressed in the form of a table as shown in FIG. 6, for example. In the example of FIG. 6, the record in the first row indicates “leakage by speculation” as the threat 441, and “remote terminal” that is a constituent element in which the threat occurs as the constituent element 442, and related information assets “Password” related to the leakage of guess is indicated as 443, and “C” is indicated as the threat type 444.

(Step S2 of FIG. 2: Program variable process relation analysis process)
The variable discriminating unit 22 discriminates the type of the variable based on the process using the variable included in the program specification 42 accepted in step S1, and analyzes the propagation relationship between the variables and the order of the process.
More specifically, the variable determination unit 22 determines whether the process using the variable is an input process, an output process, or an internal use process. The input process is a process for inputting a value from the outside of the device. The output process is a process for outputting a value to the outside of the device. The internal use process is a process of using a value inside the device. The variable determination unit 22 determines the type of variable based on the type of processing.
The propagation relationship between variables is a propagation relationship of values within a program between variables.

  FIG. 7 is a flowchart for explaining an operation example of the variable determination unit 22.

  First, the variable determination unit 22 reads various information necessary for analysis from the memory 12 (step S21).

  Next, the variable determination unit 22 extracts a variable included in the program specification 42 (step S22).

  Next, the variable determination unit 22 determines the type of the extracted variable (step S23).

  Next, the variable determination unit 22 analyzes the propagation relationship and processing order of each variable whose type has been determined (step S24).

  Finally, the variable determination unit 22 writes the analysis result in the memory 12 (step S25).

  Next, details of steps S21 to S26 in FIG. 7 will be described.

<Details of Step S21 in FIG. 7>
In step S <b> 21, the variable determination unit 22 reads the process type DB 31 from the storage 13 and writes the process type DB 31 in the memory 12.
Next, the variable determination unit 22 reads the program specification 42 and the processing type DB 31 information from the memory 12.
Here, the program specification 42 is the program specification 42 accepted in step S1.

  An example of the process type DB 31 will be described with reference to FIG.

The process type DB 31 includes a process name 311 and a process type 312.
The process name 311 indicates the name of the process included in the program specification 42.
The process type 312 indicates whether the process indicated by the process name 311 corresponds to an input process, an output process, or an internal use process (security process). In FIG. 8, the input process is described as Input. The output process is described as Output. The internal use process (security process) is described as Security.
The process indicated by the process name 311 is a function, a method, or the like.
In the example of FIG. 8, for example, the process type of the process name receiveMessage is input process (Input).

<Details of Step S22 in FIG. 7>
In step S22, the variable determination unit 22 extracts a variable from the program specification 42 read in step S21. The variable extraction process differs depending on the description method of the program specification 42.
In the program specification 42 (source code) used in the description of the present embodiment, variables can be extracted by using the lexical analysis and syntax analysis techniques used by the compiler. Even in the case of descriptions other than the source code, the variable determination unit 22 extracts variables according to the respective description rules.

<Details of Step S23 in FIG. 7>
In step S23, the variable determination unit 22 determines the type of each variable extracted in step S22.
The variable determination unit 22 checks whether or not each extracted variable is used for processing of a function, a method, and the like indicated by the process name 311 of the process type DB 31. “Used for processing” means that a variable is used as an argument of a function or method, or a variable is used as a return value of a function or method.
If the extracted variable is used in the process indicated by the process name 311, the variable determination unit 22 determines the type of the variable based on the process type 312 of the target process. As described above, the variable determination unit 22 determines the type of variable based on the type of processing.
More specifically, for example, when the program specification 42 is written in C language, if the processing type is “Input”, the variable determination unit 22 returns a return value or an address passing argument (reference passing argument). Are used as input variables. On the other hand, if the process type is “Output”, the variable determination unit 22 determines that the variable used in the value passing argument is “output variable”. In addition, the variable discriminating unit 22 discriminates both “input variable” and “output variable” from the variables used in the address passing argument. The variable determination unit 22 determines that the variable used for the return value is an “input variable”. Furthermore, as a result of performing the above-described determination for all variables, the variable determination unit 22 is a variable that is not determined by any type, and the variable used in the conditional statement and the processing type is “Security”. A variable used as an argument or return value of the function is determined as an “internal use variable”.

  For example, when the program specification 42 shown in FIG. 4 is analyzed by the above-described determination rule using the processing type DB 31 shown in FIG. 8, msg and len become “input variables”. Further, dev, val, and ret are “output variables”. In addition, key and state are “internal use variables”. Moreover, cmd is not classified into any.

  Although not present in the example of FIG. 4, when two or more of the same variables can be identified as different types, each variable is handled separately. For example, if the same variable msg can be determined as a different variable type at a location different from the location where the variable msg is determined as an input variable, the variable determination unit 22 handles each as a different variable. Further, the variable determination unit 22 makes it possible to distinguish even the same variable name. The variable determining unit 22 uniquely identifies each variable in a format such as variable name: line number, for example, msg: 12.

  In the above description, the example in which the variable determination unit 22 determines the process type of the variable using the information in the process type DB 31 in step S23 has been described. In this way, the processing type may be determined based on the rules generated in advance, or may be performed by the logic set in the variable determination unit 22.

In the above-described process for determining the type of variable, the “input variable” or “output variable” is determined according to how the variable is handled in the function or the processing type assigned in advance to the function. Furthermore, in the above description, a variable that satisfies a certain condition is determined as an “internal use variable”. However, another rule may be used as a variable type determination rule.
In the present embodiment, it is assumed that the above-described determination rule is held in the variable determination unit 22, but the determination rule may be held in a file or a database. Further, the determination rule may be changed.

<Details of Step S24 in FIG. 7>
In step S24, the variable determination unit 22 analyzes the propagation relationship and processing order of each variable whose type has been determined in step S23. The propagation relationship is a data flow in which the value of a variable determined as “input variable” is propagated to another variable. The variable discriminating unit 22 can analyze the propagation relationship from the variable substitution relationship and the like, similarly to the existing static code analysis.
For example, when the processing type DB 31 shown in FIG. 8 is used for the program specification 42 shown in FIG. 4, the variable determination unit 22 obtains the propagation relationship 453 in FIG.

<Details of Step S25 in FIG. 7>
In step S25, the variable determination unit 22 writes the results analyzed in steps S21 to S24 in the memory 12 as the program variable processing relationship 45 (FIG. 9).

  An example of the program variable processing relationship 45 will be described with reference to FIG.

The program variable processing relationship 45 represents the analysis result of the variable determination unit 22 for the variables in the program specification 42.
The program variable processing relationship 45 includes a variable type 451, a variable name 452, and a propagation relationship 453.
The variable type 451 indicates the type of variable obtained by the analysis of the variable determination unit 22.
The variable name 452 indicates the name of the variable.
As described above, the propagation relationship 453 indicates a data flow (propagation relationship) in which the value of the variable determined as the “input variable” is propagated to another variable.
In the example illustrated in FIG. 9, the variable type of the variable name msg is “input variable”. Furthermore, from the propagation relationship 453, the variable name msg propagates to the output variables dev and val.

(Step S3 in FIG. 2: Information asset-variable correspondence estimation process)
The candidate generating unit 23 generates a candidate for the correspondence relationship between the information asset and the variable based on the information asset flow 41 input in step S1 and the program variable processing relationship 45 obtained in step S2.

Specifically, the candidate generation unit 23 reads the information asset flow 41 and the program variable processing relationship 45 from the memory 12.
Next, the candidate generation unit 23 maps “input” of the information asset flow 41 and “input variable” of the program variable processing relationship 45. Similarly, the candidate generation unit 23 maps “output” of the information asset flow 41 and “output variable” of the program variable processing relationship 45. Further, the candidate generation unit 23 maps “internal use” of the information asset flow 41 and “internal use variable” of the program variable processing relationship 45. In this way, the candidate generation unit 23 generates all combinations of information assets and program specification 42 variables.
Then, the candidate generation unit 23 writes the generated correspondence relationship candidate in the memory 12 as the information asset-variable correspondence candidate 46.

  An example of the information asset-variable correspondence candidate 46 will be described with reference to FIG.

The information asset-variable correspondence candidate 46 includes a candidate name 461, an information asset 462 for input or internal use, a variable name 463, a propagation relationship 464, and an output information asset 465.
In the example of FIG. 10, in candidate 1, the command that is the input information asset is associated with the variables len and msg. A value that is an input information asset is associated with a variable ans. A MAC key that is an information asset for internal use is associated with a variable key. Also, the instruction that is the output information asset is associated with the variables dev and val. The response that is the output information asset is associated with the variable ret.
The plurality of candidates shown in the information asset-variable correspondence candidate 46 are different from each other.

(Step S4 in FIG. 2: second reception process)
When there are a plurality of correspondence relationship candidates in the information asset-variable correspondence candidate 46 (FIG. 10) generated in step S3, the second reception unit 24 outputs the information asset-variable correspondence candidate 46.
Then, the second reception unit 24 receives selection of the correspondence relationship between the information asset and the variable selected by the user.

Specifically, the second receiving unit 24 reads the information asset-variable correspondence relationship candidate 46 from the memory 12. When there are a plurality of correspondence candidates in the information asset-variable correspondence candidate 46, the second receiving unit 24 inputs the information asset-variable correspondence candidate 46 into the input connected via the communication interface 14. Send to output device.
Then, the information asset-variable correspondence candidate 46 is displayed on the input / output device. The user operates the input / output device to select the information asset-variable correspondence 47 from the information asset-variable correspondence candidate 46. The selected information asset-variable correspondence 47 is input to the second receiving unit 24 via the communication interface 14. The second receiving unit 24 receives the information asset-variable correspondence 47 input via the communication interface 14. Further, the second receiving unit 24 writes the received information asset-variable correspondence 47 into the memory 12. The information asset-variable correspondence 47 is one of the correspondence candidates included in the information asset-variable correspondence candidate 46 in which the actual information asset-variable correspondence is shown.
As shown in FIG. 10, the information asset-variable correspondence candidate 46 includes a propagation relationship and a processing order. Therefore, the user can select the information asset-variable correspondence 47 in consideration of the propagation relationship and the processing order.
Here, it is assumed that candidate 1 in FIG. 10 is selected as the information asset-variable correspondence 47.
If the information asset-variable correspondence candidate 46 has only one correspondence candidate, step S4 is not performed, but the correspondence candidate included in the information asset-variable correspondence candidate 46 is also the following. The information asset-variable correspondence 47 is referred to.

(Step S5 in FIG. 2: related threat extraction processing)
The related threat extraction unit 25 extracts a list of threats related to the program specification 42 as a related threat list 48 based on the information asset-variable correspondence 47. The related threat list 48 is extracted for each program specification 42.

Specifically, the related threat extraction unit 25 reads the threat analysis result 44 (FIG. 6) and the correspondence relationship 43 (FIG. 5) between the constituent elements and the program specifications from the memory 12.
Then, the related threat extraction unit 25 sequentially processes each entry of the correspondence 43 between the component and the program specification, and converts the information asset flow 41 (FIG. 3) corresponding to the content of the component 431 and the content of the program specification 432. The corresponding information asset-variable correspondence 47 is read from the memory.
Then, the related threat extraction unit 25 uses the information asset flow 41 and the information asset-variable correspondence 47 to extract a threat related to the program specification 42 from the threat analysis result 44 (FIG. 6) (details are shown in FIG. 6). 11 will be described later).
Then, the related threat extraction unit 25 writes the extracted result as a related threat list 48 in association with the processed program specification 42 in the memory 12. The related threat extraction unit 25 performs these operations for all the entries in the correspondence relationship 43 (FIG. 5) between the constituent elements and the program specifications.

  For example, the related threat extraction unit 25 extracts related threats by the operation shown in FIG.

First, the related threat extraction unit 25 searches the threat analysis result 44 (FIG. 6) for an entry in which the description content of the component 431 of the correspondence relationship 43 (FIG. 5) between the component and the program specification is included in the component 442. . Then, the related threat extraction unit 25 temporarily extracts the description content of the threat 441 of the entry obtained by the search.
For example, PROGRAM_C. When threat extraction is performed on C, according to the correspondence 43 between the constituent elements and the program specifications (FIG. 5), PROGRAM_C. The component on which C operates is a controller. For this reason, the related threat extraction unit 25 searches the threat analysis result 44 (FIG. 6) for an entry whose component 442 includes “controller”. In the threat analysis result 44 (FIG. 6), entries “HMI-controller”, “controller”, and “controller-device” are obtained (procedure (1) in FIG. 11). The related threat extraction unit 25 temporarily extracts “unencrypted communication tampering”, “leakage by guess”, “tampering by retransmission”, and “DoS by retransmission” described in the threat 441 of these entries (FIG. 11). Procedure (2)).

Next, when the description content of the information asset 443 related to the entry obtained by the search is associated with a variable in the information asset-variable correspondence 47, the related threat extraction unit 25 detects the threat 441 of the corresponding entry. Formally extract the description of
The related threat extraction unit 25 performs “command”, “response”, “MAC key”, “instruction” of the information asset 443 related to the entry (line numbers 4 to 13) obtained in the procedure (1) of FIG. It is determined whether each of “value” and “status” is associated with a variable in the information asset-variable correspondence 47 (FIG. 10).
In the information asset-variable correspondence 47 in FIG. 10, information assets other than “status” are associated with variables.
Therefore, the related threat extraction unit 25 formally extracts the description content of the threat 441 in the fourth to eleventh lines in FIG. 11 (procedure (3) in FIG. 11).
Then, the related threat extraction unit 25 writes the description content of the extracted threat 441 in the memory 12 as the related threat list 48.

  An example of the related threat list 48 will be described with reference to FIG.

  The related threat list 48 is a part of the threat analysis result 44 extracted by the extraction process illustrated in FIG. The related threat list 48 is stored in association with the related program specification 42 (FIG. 4). Further, the related threat list 48 may be associated with an entry of the correspondence relationship 43 (FIG. 5) between the component elements and the program specifications.

(Step S6 in FIG. 2: related vulnerability candidate extraction process)
The vulnerability candidate extraction unit 26 creates a program specification 42 (FIG. 4) according to the related threat list 48 (FIG. 12) extracted in step S5 and the information in the threat-vulnerability type correspondence DB 32 (FIG. 13). Vulnerability type candidates 49 to be inspected that may be used for attacks of related threats are extracted for each related threat.

Specifically, the vulnerability candidate extraction unit 26 reads the threat-vulnerability type correspondence DB 32 from the storage 13 and writes the threat-vulnerability type correspondence DB 32 in the memory 12.
Next, the vulnerability candidate extraction unit 26 reads the correspondence 43 (FIG. 5) between the constituent elements and the program specifications from the memory 12.
Then, the vulnerability candidate extraction unit 26 sequentially processes each entry of the correspondence relationship 43 (FIG. 5) between the constituent elements and the program specifications, and reads the related threat list 48 (FIG. 12) corresponding to the program specifications 432 from the memory 12. .
Next, the vulnerability candidate extraction unit 26 refers to the entry of the threat-vulnerability type correspondence DB 32 for each threat described in the related threat list 48, and selects a vulnerability type candidate related to the threat as a vulnerability type list. From 322. Then, the vulnerability candidate extraction unit 26 writes the acquired vulnerability type candidates in the memory 12 in association with individual threats as vulnerability type candidates 49 (FIG. 14). The vulnerability candidate extraction unit 26 performs this for all threats.
Then, the vulnerability candidate extraction unit 26 continues the same process for the next entry in the correspondence relationship 43 (FIG. 5) between the constituent elements and the program specifications, and extracts the vulnerability type candidates 49 for all the entries. .

  An example of the threat-vulnerability type correspondence DB 32 will be described with reference to FIG.

The threat-vulnerability type correspondence DB 32 can be represented in the form of a table as shown in FIG.
The threat-vulnerability type correspondence DB 32 includes information on a threat 321 and a vulnerability type list 322 corresponding to the threat.
The vulnerability type list 322 lists vulnerability types corresponding to threats. When there is no threat entry in the threat-vulnerability type correspondence DB 32, or when there is a threat entry but no corresponding vulnerability type is described, the threat is described in the program specification 42. There are no vulnerability types that can be analyzed at the level. For example, “failure” in FIG. 13 does not have a vulnerability type because the failure is a malfunction of the device and not a vulnerability caused by the program. If there is no vulnerability, the vulnerability candidate extraction unit 26 includes a display indicating that there is no vulnerability candidate corresponding to the threat in the vulnerability analysis result output in step S7 described later. Also good.

  An example of the vulnerability type candidate 49 will be described with reference to FIG.

  The vulnerability type candidate 49 corresponds to the threat 441 in the related threat list 48, the component 442, the related information asset 443, the threat type 444, and the vulnerability type list 322 in the threat-vulnerability type correspondence DB 32. Information. Unlike FIG. 14, the vulnerability type candidate 49 may include only the threat 441, the related information asset 443, and the vulnerability type list 322. Further, the vulnerability type candidate 49 may include an element not shown in FIG.

(Step S7 in FIG. 2: vulnerability analysis processing)
The vulnerability analysis unit 27 analyzes whether the vulnerability type indicated in the vulnerability type list 322 of the vulnerability type candidate 49 extracted in step S6 exists in the program specification 42. And the vulnerability analysis part 27 outputs an analysis result.
Vulnerability analysis is performed using static code analysis or formal verification techniques as described in the background art. The vulnerability analysis unit 27 inspects the vulnerability related to each threat according to the information of the vulnerability type candidate 49.

Specifically, the vulnerability analysis unit 27 includes a program specification 42 (FIG. 4) for performing vulnerability analysis, a corresponding related threat list 48 (FIG. 12), and a vulnerability type candidate 49 ( 14) is read from the memory 12.
Next, the vulnerability analysis unit 27 performs vulnerability analysis. That is, the vulnerability analysis unit 27 extracts a vulnerability type and a variable related thereto based on the associated threat list 48 and the vulnerability type candidate 49, and performs vulnerability analysis.
When the vulnerability analysis unit 27 detects a vulnerability, the vulnerability analysis unit 27 writes the vulnerability detection result 410 (FIG. 15) in the memory 12 (if another vulnerability detection result 410 already exists, a new vulnerability is detected. The sex detection result 410 is added to the existing vulnerability detection result 410).
The vulnerability analysis unit 27 performs this for all program specifications 42 to be inspected.
When all the vulnerability analyzes are completed for all the program specifications 42 to be inspected, the vulnerability analysis unit 27 sends the vulnerability detection result 410 to the connected input / output device via the communication interface 14. Send.
The input / output device that has received the vulnerability detection result 410 displays the vulnerability detection result 410. Further, the vulnerability detection result 410 may be stored in a file.
Note that the vulnerability analysis unit 27 performs vulnerability analysis in consideration of variables associated with information assets.

  An example of the vulnerability detection result 410 will be described with reference to FIG.

The vulnerability detection result 410 includes a vulnerability type 411, a variable 412, a location 413, a threat 414, a component 415, and an information asset 416.
The vulnerability type 411 indicates the vulnerability type detected by the vulnerability analysis unit 27.
The variable 412 indicates a variable related to the vulnerability type detected by the vulnerability analysis unit 27.
The location 413 indicates a location in the program specification 42 related to the vulnerability type detected by the vulnerability analysis unit 27.
The threat 414 indicates a threat to the vulnerability type detected by the vulnerability analysis unit 27.
The component 415 indicates a component in which the vulnerability type detected by the vulnerability analysis unit 27 exists.
The information asset 416 indicates an information asset in which the vulnerability type detected by the vulnerability analysis unit 27 exists.
FIG. 15 shows PROGRAM_C. An example of the vulnerability detection result 410 related to the threat # 6 (threat by guess) of C is shown. In the example of FIG. 15, “Vulnerability 1” is shown as the vulnerability type 411. In addition, “key” is indicated as the variable 412, “first line of PROGRAM_C.C” is indicated as the location 413, and “leakage by speculation” is indicated as the threat 414. Further, “controller” is shown as the component 415, and “MAC key” is shown as the information asset 416.

*** Explanation of the effect of the embodiment ***
As described above, according to the present embodiment, in order to generate a candidate for the correspondence relationship between the variable included in the program executed on the device and the information asset used by the device, the portion in the program, the information asset, and the vulnerability The correspondence relationship with can be clarified.

  Further, in the present embodiment, the correspondence relationship between the threat analysis result and the program specification can be clarified based on the correspondence relationship between the information asset flow of the threat analysis and the input / output classification of the variable of the program specification. For this reason, according to the present embodiment, it is possible to narrow down the analysis target at the time of vulnerability analysis.

  Further, in the present embodiment, it is possible to analyze and estimate the correspondence relationship between the flow of information assets in threat analysis and the input / output relationship of variables in the program specification. For this reason, according to this Embodiment, the user of a vulnerability analysis can save the effort which performs them individually.

  Furthermore, in the present embodiment, the correspondence relationship of the vulnerabilities used for the attacks associated with each threat is stored. For this reason, at the time of vulnerability analysis, the vulnerability used for the attack can be derived by referring to the correspondence relationship from the result of the threat analysis.

Embodiment 2. FIG.
In the first embodiment, the vulnerability analysis apparatus 10 obtains the device configuration, the type of information asset, and the flow of information asset of the system subject to vulnerability analysis from the information asset flow 41 (FIG. 3) acquired from the outside.
In the present embodiment, an example will be described in which the vulnerability analysis apparatus 10 analyzes a device configuration, a type of information asset, and a flow of information asset of a system subject to vulnerability analysis.
In the present embodiment, differences from the first embodiment will be mainly described.
Note that matters not described below are the same as those in the first embodiment.

*** Explanation of configuration ***
With reference to FIG. 16, the structure of the vulnerability analysis apparatus 10 which concerns on Embodiment 1 is demonstrated.
In FIG. 16, an information asset discrimination unit 28 is added as compared with the configuration of FIG. The other elements shown in FIG. 16 are the same as those shown in FIG.

*** Explanation of operation ***
Hereinafter, an operation example of the vulnerability analysis apparatus 10 according to the present embodiment will be described with reference to FIG.

  In the present embodiment, in step S1 of FIG. 2, the first receiving unit 21 receives threat analysis input information 51 instead of the information asset flow 41.

Specifically, an input device connected via the communication interface 14 is operated by a user, and threat analysis input information 51, a program specification 42, a correspondence relationship 43 between a component and a program specification, and a threat analysis result 44 Are entered.
Then, the first receiving unit 21 receives the threat analysis input information 51, the program specification 42, the correspondence relationship 43 between the constituent elements and the program specification, and the threat analysis result 44 via the communication interface 14.
Further, the first receiving unit 21 writes the threat analysis input information 51, the program specification 42, the correspondence relationship 43 between the constituent elements and the program specification, and the threat analysis result 44 in the memory 12.

The threat analysis input information 51 is information used for threat analysis.
The threat analysis input information 51 includes information indicating a plurality of components constituting a system to be subjected to vulnerability analysis, a connection relationship between the components, a list of information assets, and a flow of information assets.

Next, before performing step S3, the information asset discriminating unit 28 performs related information asset flow extraction processing.
In the related information asset flow extraction process, the information asset discriminating unit 28 uses the threat analysis input information 51 received in step S1 and the correspondence relationship 43 between the constituent elements and the program specifications to determine the program specifications subject to vulnerability analysis. The information asset flow related to 42 is extracted for each component. The information asset flow has the same format as the information asset flow 41 of FIG. 3 shown in the first embodiment.
That is, the information asset discriminating unit 28 discriminates whether each of the information assets used in the threat analysis target system is an input information asset, an output information asset, or an internal use information asset.

*** Explanation of the effect of the embodiment ***
As described above, according to the present embodiment, since the vulnerability analysis apparatus 10 can generate an information asset flow, it is not necessary to generate an information asset flow with an external apparatus.

Embodiment 3 FIG.
In the first and second embodiments, the candidate output order is not taken into account when the candidate for the correspondence relationship between the information asset and the variable is output.
In the present embodiment, the vulnerability analysis apparatus 10 controls the output order according to the certainty of each candidate when outputting the candidate of the correspondence relationship between the information asset and the variable. That is, in the present embodiment, when the second receiving unit 24 outputs a plurality of correspondence candidates, a priority is set between the plurality of correspondence candidates, and a correspondence candidate with a high priority is provided. Is given priority for output.
In the present embodiment, differences from the first embodiment will be mainly described.
Note that matters not described below are the same as those in the first embodiment.

Specifically, in step S3 in FIG. 2, when the candidate generation unit 23 analyzes the correspondence between the variables in the program specification 42 and the information assets, the candidate generation unit 23 estimates the certainty as a candidate. For example, the candidate generation unit 23 estimates the certainty of the candidate for the correspondence relationship between the variable and the information asset based on a combination of keywords set in advance.
For example, the candidate generation unit 23 estimates that the information asset “command”, the variable command, and the variable cmd are close to each other in terms of notation, so that the certainty as a candidate is high. Moreover, the candidate production | generation part 23 determines with the certainty that the candidate with many combinations of a corresponding variable is high. The candidate generation unit 23 designates the output order (priority order) of the plurality of correspondence candidates according to the certainty.
Then, the second reception unit 24 outputs a plurality of correspondence candidates according to the output order designated by the candidate generation unit 23.

  As described above, in this embodiment, the certainty of correspondence candidates is estimated, the output order of correspondence candidates is designated based on the certainty, and a plurality of correspondence candidates are selected in the designated output order. Output. Therefore, according to the present embodiment, the user can easily select the correct correspondence even when there are a plurality of correspondence candidates.

Embodiment 4 FIG.
In Embodiments 1 to 3, the vulnerability candidate extraction unit 26 uses the threat-vulnerability correspondence DB 32 to extract vulnerability type candidates corresponding to related threats.
In the present embodiment, the first reception unit 21 acquires an attack tree. Then, the vulnerability candidate extraction unit 26 extracts a vulnerability type candidate using the attack tree. The attack tree is information indicating a series of attack procedures for achieving each threat in the threat analysis result 44 (FIG. 6) and the type of vulnerability used in the attack procedure.
The vulnerability candidate extracting unit 26 is included in the attack tree instead of using the threat-vulnerability correspondence DB 32 when extracting the vulnerability type candidates corresponding to each threat in the related threat list 48 (FIG. 12). Extract vulnerability type information. The vulnerability candidate extraction unit 26 extracts the type of vulnerability from the attack tree after confirming that the attack destination is a corresponding component.
Note that matters not described in the present embodiment are the same as those in the first embodiment.

  As described above, in the present embodiment, it is possible to perform a flexible analysis by using the information of the vulnerability type included in the attack tree (when the threat-vulnerability type correspondence DB 32 is used, The correspondence between threats and vulnerability types is fixed). According to the present embodiment, for example, when the type of vulnerability used varies depending on the system configuration and the manner of attack, a flexible analysis can be performed.

Embodiment 5. FIG.
In the first to fourth embodiments, the program specification 42 is used as it is in the vulnerability analysis.
In the present embodiment, the vulnerability analysis unit 27 performs vulnerability analysis with reference to the association between information assets and variables and / or the type of threat. That is, in the present embodiment, the vulnerability analysis unit 27 adds a correspondence between a plurality of information assets and a plurality of variables obtained from the information asset-variable correspondence 47 (FIG. 10) to the program specification 42, Vulnerability analysis can be performed. Further, the vulnerability analysis unit 27 can perform vulnerability analysis by referring to the threat type 444 (C, I, A) described in the threat analysis result 44. That is, the vulnerability analysis unit 27 can perform vulnerability analysis by adding the threat type 444 (C, I, A) to the program specification 42.
Further, in the present embodiment, the vulnerability analysis unit 27 extracts a part in which processing related to the vulnerability type candidate extracted by the vulnerability candidate extraction unit 26 is described as a program fragment from the program specification 42. be able to. And the vulnerability analysis part 27 can perform a vulnerability analysis using the extracted program fragment. In this case, the vulnerability analysis unit 27 performs, for example, a process of referring to or changing a variable related to the threat from the program specification 42, a process using another variable that affects the variable related to the threat, and a branch process. A process that controls the execution of the above-described process such as a determination process can be extracted as a program fragment.
Note that matters not described in the present embodiment are the same as those in the first embodiment.

As described above, in this embodiment, vulnerability inspection is performed by adding association of information assets and variables, meta information such as information asset values (C, I, A), etc. to the program specifications to be inspected. Do. For this reason, in this Embodiment, the production | generation of an inspection formula or / and the production | generation of a model can be made efficient.
Further, in the present embodiment, by using the program fragment, vulnerability analysis can be made more efficient than when the entire program specification is used.

As mentioned above, although embodiment of this invention was described, you may implement in combination of 2 or more among these embodiment.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined.
In addition, this invention is not limited to these embodiment, A various change is possible as needed.

*** Explanation of hardware configuration ***
Finally, a supplementary explanation of the hardware configuration of the vulnerability analysis apparatus 10 will be given.

The storage 13 stores an OS (Operating System).
At least a part of the OS is loaded into the memory 12 and executed by the processor 11.
While executing at least part of the OS, the processor 11 executes a first reception unit 21, a variable determination unit 22, a candidate generation unit 23, a second reception unit 24, a related threat extraction unit 25, a vulnerability candidate extraction unit 26, A program for realizing the functions of the vulnerability analysis unit 27 and the information asset discrimination unit 28 is executed.
When the processor 11 executes the OS, task management, memory management, file management, communication control, and the like are performed.
In addition, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28 At least one of information, data, signal value and variable value indicating the result of the above processing is stored in at least one of the memory 12, the storage 13, the register in the processor 11, and the cache memory.
In addition, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28 The program for realizing the above function may be stored in a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. And the 1st reception part 21, the variable discrimination | determination part 22, the candidate production | generation part 23, the 2nd reception part 24, the related threat extraction part 25, the vulnerability candidate extraction part 26, the vulnerability analysis part 27, and the information asset discrimination | determination part 28 A portable recording medium storing a program for realizing the above function may be distributed commercially.

In addition, the first reception unit 21, the variable determination unit 22, the candidate generation unit 23, the second reception unit 24, the related threat extraction unit 25, the vulnerability candidate extraction unit 26, the vulnerability analysis unit 27, and the information asset determination unit 28 May be read as “circuit” or “process” or “procedure” or “processing”.
The vulnerability analysis apparatus 10 may be realized by a processing circuit. The processing circuit is, for example, a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array).
In this specification, the superordinate concept of the processor and the processing circuit is referred to as “processing circuitry”.
That is, the processor and the processing circuit are specific examples of “processing circuitry”.

  DESCRIPTION OF SYMBOLS 10 Vulnerability analysis apparatus, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 21 1st reception part, 22 Variable determination part, 23 Candidate production | generation part, 24 2nd reception part, 25 Related threat extraction part, 26 Vulnerability candidate extraction unit, 27 Vulnerability analysis unit, 28 Information asset discrimination unit, 31 Process type DB, 32 Threat-vulnerability type correspondence DB, 41 Information asset flow, 42 Program specification, 43 Correspondence between component and program specification , 44 Threat analysis result, 45 Program variable processing relationship, 46 Information asset-variable correspondence candidate, 47 Information asset-variable correspondence relationship, 48 Related threat list, 49 Vulnerability type candidate, 410 Vulnerability detection result.

Claims (14)

A variable discriminating unit that discriminates whether each of a plurality of variables included in a program executed on the device is an input variable, an output variable, or an internal use variable ;
The input information asset and the input variable that are information assets input to the device from the outside of the device, the output information asset and the output variable that is the information asset output from the device to the outside of the device, the inside of the device in the association and internal use variables and internal use information assets is information assets that are available, the candidate that generates a candidate of correspondence between each of the plurality of variables with each of multiple information assets of one or more An information processing apparatus having a generation unit. The information processing apparatus further includes:
The information processing apparatus according to claim 1, further comprising: an output unit configured to output the plurality of correspondence relationship candidates when the candidate generation unit generates a plurality of correspondence relationship candidates. The candidate generation unit
Information asset information indicating whether each of the plurality of information assets is the input information asset, the output information asset, or the internal use information asset is acquired, and the input information asset indicated in the information asset information The information processing apparatus according to claim 1 , wherein the input variable is associated with the output information asset and the output variable indicated in the information asset information, and the internal use information asset and the internal use variable indicated in the information asset information. . The information processing apparatus further includes:
The information processing apparatus according to claim 1 , further comprising: an information asset determination unit configured to determine whether each of the plurality of information assets is the input information asset, the output information asset, or the internal use information asset. The variable discrimination unit
It is determined whether the process in which each of the plurality of variables is used is an input process, an output process, or an internal use process, and the type of each of the plurality of variables is determined based on the determined type of the process. The information processing apparatus according to claim 1 for determining. The variable discrimination unit
Analyzing the propagation relationship of variable values in the plurality of variables,
The output unit is
The information processing apparatus according to claim 2, wherein one or more correspondence relationship candidates generated by the candidate generation unit and a propagation relationship of variable values obtained by analysis of the variable determination unit are output. The candidate generation unit
When a plurality of correspondence candidates are generated, a priority is set between the plurality of correspondence candidates,
The output unit is
The information processing apparatus according to claim 2, wherein priority is given to correspondence candidates having a high priority. The candidate generation unit
The information processing according to claim 7 , wherein each of the plurality of correspondence candidates is estimated with certainty as a correspondence candidate, and a priority is set between the plurality of correspondence candidates based on the estimation result. apparatus. The information processing apparatus further includes:
A vulnerability candidate extraction unit that extracts a candidate for a type of vulnerability existing in the device based on the correspondence selected from the one or more correspondence candidates;
The information processing apparatus according to claim 1, further comprising: a vulnerability analysis unit that performs a vulnerability analysis of the device based on a vulnerability type candidate extracted by the vulnerability candidate extraction unit. The vulnerability candidate extraction unit
The information processing apparatus according to claim 9 , wherein a vulnerability type candidate existing in the device is extracted with reference to an attack tree. The vulnerability analysis unit
The information processing apparatus according to claim 9 , wherein vulnerability analysis of the device is performed with reference to at least one of correspondence between the plurality of information assets and the plurality of variables and a threat type. The vulnerability analysis unit
A part describing a process related to a vulnerability type candidate extracted by the vulnerability candidate extraction unit is extracted as a program fragment from the program, and the vulnerability analysis of the device is performed using the extracted program fragment. The information processing apparatus according to claim 9 to be performed. The computer determines whether each of a plurality of variables included in a program executed on the device is an input variable, an output variable, or an internal use variable ,
The computer is an input information asset that is an information asset input to the device from outside the device and the input variable, an output information asset that is an information asset output from the device to the outside of the device, and the output variable, wherein in association with the internal use variables and internal use information assets is information assets that are utilized inside of the apparatus, one candidate corresponding relationship between each of the plurality of variables with each of multiple information assets Information processing method to be generated as described above. Variable determination processing for determining whether each of a plurality of variables included in a program executed on the device is an input variable, an output variable, or an internal use variable ;
The input information asset and the input variable that are information assets input to the device from the outside of the device, the output information asset and the output variable that is the information asset output from the device to the outside of the device, the inside of the device in the association and internal use variables and internal use information assets is information assets that are available, the candidate that generates a candidate of correspondence between each of the plurality of variables with each of multiple information assets of one or more An information processing program for causing a computer to execute generation processing.

Images