KR101876685B1 - SYSTEM FOR MANAGING vulnerability OF SOFTWARE USING SPDX TECHNOLOGY AND METHOD THEREOF - Google Patents

Abstract

Disclosed are a system and a method for managing vulnerability of a software by using software package data exchange (SPDX) technology. According to an embodiment of the present invention, the system for managing vulnerability of a software by using SPDX technology comprises a sending system matching vulnerability information on an open-source software to SPDX information to manage matching information based on a matched result; a detection system comparing the matching information provided by the sending system with previously registered reference SPDX information to detect a vulnerable software; and a management system controlling operation of the vulnerable software according to a vulnerability degree of the vulnerable software detected by the detection system.

Description

TECHNICAL FIELD [0001] The present invention relates to a system and a method for managing software vulnerabilities using SPDX technology,

The present invention relates to software management techniques, and more particularly, to a system and method for managing software vulnerabilities using SPDX technology.

Existing countermeasures against post-detection vulnerabilities can be dealt with only after the developers / developers recognize the vulnerabilities directly. It is difficult to expect to respond correctly and quickly to providing warnings of vulnerability information unless it is a very large developer, or a developer who is very busy and very interested in security. In some cases, it can be expected that many users will not be notified of the vulnerability even though they are aware of the vulnerability so that there is no room for amendment or motivation or acknowledgment of responsibility.

If this problem occurs in the part developed by the developer / developer himself or herself, he / she can expect some response. However, when the open source software or the purchased software library is used in the development software, This is because the same applies to the user. In the case of a software library used indirectly, it is impossible to recognize the vulnerability. Therefore, even if the vulnerability is directly recognized, it may happen that the user does not even know whether there is a necessity of countermeasure.

Firstly, the most rapid and simple method, the defect problem, is hardly noticed and the effect is weak. It is pointless that there is almost no case where the user confirms the announcement of the manufacturer's web site when the developer / developer notifies itself of the defect problem. In the case of user registration, we may contact you by e-mail or distribute the press release to the media. However, since all of these processes must be released by the developer in the situation that the developer can not respond yet, No effect and I doubt it.

In the case of providing updates and patches, there is a problem in that the developer can not preemptively respond to security problems because it is too late to respond to the premise that the developer has recognized and solved the problem.

The Security Content Automation Protocol (SCAP) is a better approach in that it offers a means of responding slightly faster than providing updates and patches. However, it is still vulnerable in that it has the potential to be unrecognizable by developers when using external development software libraries such as open source software.

Patent Registration No. 10-1645019, date of publication August 02, 2016 Patent Registration No. 10-0916329, Publication Date September 11, 2009 Patent Registration No. 10-1640479, Date of Publication: July 18, 2016

SUMMARY OF THE INVENTION The present invention has been made in an effort to solve the problems of the prior art, and it is an object of the present invention to detect weak software by comparing vulnerability information of open source software with SPDX information and matching information with previously registered reference SPDX information, The present invention provides a system and method for managing software vulnerabilities using SPDX technology, in which the software is controlled according to the degree of vulnerability of the software.

It should be understood, however, that the present invention is not limited to the above-described embodiments, and may be variously modified without departing from the spirit and scope of the present invention.

According to an aspect of the present invention, there is provided a system for managing a vulnerability of software using SPDX technology according to an aspect of the present invention, the vulnerability information of open source software being matched with software package data exchange (SPDX) An originating system for managing matching information as a result of matching; A detection system for detecting vulnerable software by comparing the matching information provided from the originating system with previously registered reference SPDX information; And a management system for controlling the operation of the vulnerable software according to the degree of vulnerability of the vulnerable software detected from the detection system.

In addition, when a new vulnerability is found, the originating system may generate matching information as a result of matching weak information and SPDX information, and may provide the generated matching information to the detection system.

Also, the origination system may include a vulnerability information DB storing vulnerability information of the open source software; An SPDX information DB for storing SPDX information including at least one SPDX element of the open source software; A matching unit for searching the SPDX element corresponding to a source file affected by the vulnerability of the vulnerability information in real time when a new vulnerability is found and for generating matching information as a result of matching the SPDX element with the vulnerability information; And a communication unit for providing the generated matching information to the detection system.

In addition, the detection system may compare the matching information provided from the originating system with pre-registered reference SPDX information, detect vulnerable software including vulnerable open-source software and vulnerable open-source software as a result of the comparison, A vulnerability detection report for the detected vulnerable software may be generated and provided to the management system.

The detection system may further include: a reference SPDX information DB storing reference SPDX information including at least one reference SPDX element of the managed software; A first communication unit receiving matching information from the calling system; A detecting unit for comparing the provided matching information with the reference SPDX information and detecting the managed software including the same reference SPDX element as the SPDX element in the matching information as a result of the comparison by the vulnerable software; And a second communication unit for providing a vulnerability detection report for the detected vulnerable software to the management system.

Also, the management system may search for control information using vulnerability information in the vulnerability detection report provided from the detection system, and control the operation of the vulnerable software or system according to the retrieved control information.

Also, the management system may include a control plan information DB storing control information including a control right and a control plan for the software or the system to be managed; A communication unit for receiving a vulnerability detection report on the vulnerable software detected by the detection system; And a control unit for searching the control information using the vulnerability information in the vulnerability detection report and controlling the operation of the vulnerable software or system according to the retrieved control information.

A method for managing vulnerabilities of software using SPDX technology according to another aspect of the present invention includes matching vulnerability information of open source software with software package data exchange (SPDX) information in a source system, Managing information; Detecting, in the detection system, the vulnerable software by comparing the matching information provided from the originating system with previously registered reference SPDX information; And controlling the operation of the vulnerable software in accordance with the vulnerability of the vulnerable software detected from the detection system in the management system.

Also, in the managing step, when a new vulnerability is found, the vulnerability information and the SPDX information are matched to generate matching information, and the generated matching information may be provided to the detection system.

In the detecting step, the matching information provided from the originating system is compared with previously registered reference SPDX information, and as a result of the comparison, the vulnerable software including the vulnerable open source software and the vulnerable open source software is detected, A vulnerability detection report for the detected vulnerable software may be generated and provided to the management system.

Also, in the controlling step, the control information may be retrieved using the vulnerability information in the vulnerability detection report provided from the detection system, and the operation of the vulnerable software or the system may be controlled according to the retrieved control information.

As described above, according to the present invention, vulnerable software is detected by comparing vulnerability information of the open source software with SPDX information and matching pre-registered reference SPDX information, and by controlling the corresponding software according to the vulnerability of the detected vulnerable software, Delay or inability to provide intentional and unintentional vulnerability information can be prevented.

Further, since the present invention can control the corresponding software according to the weak information, it is possible to preemptively respond to the security problem.

However, the effects of the present invention are not limited to the above effects, and may be variously extended without departing from the spirit and scope of the present invention.

FIG. 1 illustrates a system for managing vulnerabilities of open source software according to an embodiment of the present invention. Referring to FIG.
Fig. 2 is a diagram showing a detailed configuration of the origination system shown in Fig. 1. Fig.
Fig. 3 is a diagram showing a detailed configuration of the detection system shown in Fig. 1. Fig.
FIG. 4 is a diagram showing a detailed configuration of the management system shown in FIG. 1. FIG.
5 is a diagram illustrating a method for managing vulnerabilities of open source software according to an exemplary embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, a system and method for managing vulnerabilities of open source software using SPDX (Software Package Data Exchange) technology according to an exemplary embodiment of the present invention will be described with reference to the accompanying drawings. In particular, according to the present invention, vulnerable software is detected by comparing vulnerability information of the open source software with SPDX information and comparing the information with the previously registered reference SPDX information, and controlling the software according to the vulnerability of the detected vulnerable software We propose a new software management plan.

The SPDX information includes metadata in the file or package unit for the source code and various components of the software, and this unit information is called an SPDX element. This includes a lot of information such as the name of the file, the date and time of creation, the creator, the applied license information, and the like, but the information necessary for the present invention requires only unique identification information for specifying the component. In SPDX, unique identification information called an external document reference (EDR) is introduced to identify each SPDX element. In the present invention, the components of software are distinguished based on this. However, it is also possible to identify the hash value of the file, the name of the package, and version information. However, creating EDR is a requirement in SPDX format, so creating unique identification information using information other than EDR will only be possible in very specific circumstances.

This SPDX information must be provided to the user when the software developer / developer provides the software or after providing it. When the software is updated or patched, new information must be provided back in accordance with the changes.

1 is a diagram illustrating a system for managing software vulnerabilities according to an embodiment of the present invention.

Referring to FIG. 1, a system for managing vulnerabilities of software according to an embodiment of the present invention may include an originating system 100, a detection system 200, and a management system 300.

The originating system 100 may manage the vulnerability information of the open source software by matching the SPDX information and provide the matching vulnerability information and the SPDX information to the detection system 200. At this time, the calling system 100 matches the vulnerable information with the SPDX information whenever a new vulnerability is found, and automatically transmits the matching vulnerability information and the SPDX information to the detection system 200 according to a request of the detection system 200 .

The detection system 200 can detect the vulnerable software by comparing the matching information provided from the originating system 100, that is, the vulnerability information, the SPDX information, and the previously registered reference SPDX information.

The management system 300 can control the operation of the vulnerable software according to the degree of vulnerability of the vulnerable software detected from the detection system 200.

Fig. 2 is a diagram showing a detailed configuration of the origination system shown in Fig. 1. Fig.

2, the calling system 100 according to an exemplary embodiment of the present invention includes a vulnerability information DB 110, an SPDX information DB 120, a matching unit 130, and a communication unit 140 .

The vulnerability information DB 110 may store vulnerability information of open source software. Here, the vulnerability information may include the vulnerability, information describing which part of the software the vulnerability is associated with, the type of vulnerability, and the importance of the vulnerability.

The SPDX information DB 120 may store SPDX information including at least one SPDX element of open source software. Here, the SPDX information may include EDR or a file hash value as unique identification information of the SPDX element. The SPDX information need not be in a complete form including all the information but may include only a list of SPDX element unique identification information of at least some elements included in each software.

When a new vulnerability is found, the matching unit 130 searches the SPDX element corresponding to the source file affected by the vulnerability of the vulnerability information in real time, matches the SPDX element with the vulnerability information, and matches the vulnerability information with the SPDX element. (Vulnerability information, SPDX element) indicating that the element is associated with the element. At this time, the matching unit 130 may write matching information in the SPDX information DB 120 indicating that the vulnerability information is related to the SPDX element.

The communication unit 140 can transmit or receive various kinds of information in cooperation with the detection system 200. For example, the communication unit 140 may provide matching information, i.e., {weak point information, SPDX element} to the detection system 200. The communication unit 140 may be a communication module that can transmit or receive various information by using wired communication or wireless communication, or a connection module that is connected to another external device to transmit or receive various information .

Fig. 3 is a diagram showing a detailed configuration of the detection system shown in Fig. 1. Fig.

3, the detection system 200 according to an exemplary embodiment of the present invention may include a reference SPDX information DB 210, a first communication unit 220, a detection unit 230, and a second communication unit 240 have.

The reference SPDX information DB 210 may store reference SPDX information including at least one reference SPDX element of the managed software.

The first communication unit 220 can transmit or receive various information in cooperation with the calling system 100. For example, the first communication unit 220 may receive matching information, i.e., {Vulnerability Information, SPDX Element} from the calling system 100. The communication unit 140 may be a communication module that can transmit or receive various information by using wired communication or wireless communication, or a connection module that is connected to another external device to transmit or receive various information .

The detection unit 230 may compare the provided matching information with the reference SPDX information and detect the managed software including the same reference SPDX element as the SPDX element in the matching information as a result of the comparison by using the vulnerable software.

When the vulnerable software is detected, the detection unit 230 may generate a vulnerability detection report including information on the software, information on the vulnerability, importance and related information.

The second communication unit 240 can transmit or receive various kinds of information in cooperation with the management system 300. For example, the second communication unit 240 may provide the management system 300 with a vulnerability detection report for the vulnerable open source software detected. The second communication unit 240 may be a communication module capable of transmitting or receiving various information by using wired communication or wireless communication, or a connection module connected to other external devices to transmit or receive various information. .

At this time, when open source software or the like is used in any software, the user can know which open source software is used through the unique identification information of the SPDX element. Further, when the user has maliciousness, the type and version information of the open source software used as a component of the software can be grasped from the unique identification information of the SPDX element of the purchased and acquired software. In addition, based on the information thus obtained, there is a possibility that an attack can be made based on vulnerability information disclosed to an individual or an organization using and operating the same kind of software.

Accordingly, in the present invention, a system in which a software developer or an organization proxy a piece of information to prevent such an attack may be applied.

Specifically, 1) generating proxy unique identification information for the unique identification information of the SPDX information of the software, interpreting the SPDX unique identification information included in the vulnerability information provided by the originating system, matching the unique proxy identification information, The new vulnerability alert information created by matching proxy unique identification information can be redirected to the user of the corresponding software.

It is possible to make it difficult to estimate the original SPDX unique identification information by transmitting the EDR information that is not additionally present or unnecessary because it is expected to be newly updated to be included in the vulnerability.

FIG. 4 is a diagram showing a detailed configuration of the management system shown in FIG. 1. FIG.

Referring to FIG. 4, the management system 300 according to an embodiment of the present invention may include a control plan information DB 310, a communication unit 320, and a control unit 330.

The control plan information DB 310 may store control information including control authority and control plan for the software or system to be managed. Here, the control plan may be information that defines a plan of how to control the managed software or system according to the information, type, and importance of the detected vulnerability.

The communication unit 320 can transmit or receive various kinds of information in cooperation with the detection system 200. For example, the communication unit 320 may be provided with a vulnerability detection report for the vulnerable software detected by the detection system 200.

The control unit 330 searches the control information using the vulnerability information in the vulnerability detection report and controls the operation of the vulnerable software or system according to the retrieved control information. At this time, the control unit 330 notifies the manager of the information about the vulnerability, the software to be controlled, the content of the control to be performed and receives the permission to the manager before executing the control according to the searched control information, The administrator can be notified of the information about the vulnerability, the software to be controlled, and the contents of the control performed.

The administrator can also approve or change the control based on the informed information.

5 is a diagram illustrating a method for managing vulnerabilities of software according to an embodiment of the present invention.

Referring to FIG. 5, when the new vulnerability is found, the originating system 100 may match the vulnerable information with the SPDX information (S510) and generate matching information as a result of the matching (S520).

Next, the originating system 100 may provide the generated matching information to the detection system 200 (S530).

Next, the detection system 200 compares the matching information provided from the originating system 100 with previously registered reference SPDX information (S540), and as a result of the comparison, the vulnerable open source software and the vulnerable open source software The vulnerable software can be detected (S550).

Next, the detection system 200 may generate a vulnerability detection report for the detected vulnerable software (S560) and provide the vulnerability detection report to the management system 300 (S570).

Next, the management system 300 searches the control information using the vulnerability information in the vulnerability detection report provided from the detection system 200 (S580), and controls the operation of the corresponding vulnerable software or system according to the detected control information (S590).

The features, structures, effects and the like described in the embodiments are included in one embodiment of the present invention and are not necessarily limited to only one embodiment. Furthermore, the features, structures, effects and the like illustrated in the embodiments can be combined and modified by other persons skilled in the art to which the embodiments belong. Therefore, it should be understood that the present invention is not limited to these combinations and modifications.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of illustration, It can be seen that various modifications and applications are possible. For example, each component specifically shown in the embodiments can be modified and implemented. It is to be understood that all changes and modifications that come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.

100: Outgoing system
200: Detection system
300: Management System

Claims (11)

An originating system that manages matching information as a result of matching vulnerability information of open source software with software package data exchange (SPDX) information and matching the information;
A detection system for detecting vulnerable software by comparing the matching information provided from the originating system with previously registered reference SPDX information; And
A management system for controlling the operation of the vulnerable software according to the degree of vulnerability of the vulnerable software detected by the detection system;
A system for managing software vulnerabilities using SPDX technology. The method according to claim 1,
The originating system comprises:
When a new vulnerability is found, matches vulnerable information with SPDX information, generates matching information as a result of matching the vulnerability information and provides the generated matching information to the detection system, and uses the SPDX technology to manage the vulnerability of the software system. 3. The method of claim 2,
The originating system comprises:
A vulnerability information DB for storing vulnerability information of the open source software;
An SPDX information DB for storing SPDX information including at least one SPDX element of the open source software;
A matching unit for searching the SPDX element corresponding to a source file affected by the vulnerability of the vulnerability information in real time when a new vulnerability is found and for generating matching information as a result of matching the SPDX element with the vulnerability information; And
And a communication unit for providing the generated matching information to the detection system. The system for managing vulnerabilities of software using SPDX technology. The method according to claim 1,
The detection system comprising:
Comparing the matching information provided from the originating system with previously registered reference SPDX information, and detecting vulnerable software including vulnerable open source software and vulnerable open source software as a result of the comparison,
Generating a vulnerability detection report for the detected vulnerable software, and providing the vulnerability detection report to the management system; and managing the vulnerability of the software using the SPDX technology. 5. The method of claim 4,
The detection system comprising:
A reference SPDX information DB storing reference SPDX information including at least one reference SPDX element of the managed software;
A first communication unit receiving matching information from the calling system;
A detecting unit for comparing the provided matching information with the reference SPDX information and detecting the managed software including the same reference SPDX element as the SPDX element in the matching information as the comparison result by the vulnerable software; And
And a second communication unit for providing a vulnerability detection report for the detected vulnerable software to the management system. The system for managing vulnerabilities of software using the SPDX technology. The method according to claim 1,
The management system includes:
The control information is retrieved using the vulnerability information in the vulnerability detection report provided from the detection system
And controlling the operation of the corresponding vulnerable software or system according to the retrieved control information, using the SPDX technology. The method according to claim 6,
The management system includes:
A control plan information DB for storing control information including control authority and control plan for the software or system to be managed;
A communication unit for receiving a vulnerability detection report on the vulnerable software detected by the detection system; And
And a control unit for searching the control information using the vulnerability information in the vulnerability detection report and controlling the operation of the corresponding vulnerable software or system according to the retrieved control information. A system for managing a vulnerability of a software using SPDX technology . Managing vulnerability information of the open source software and software package data exchange (SPDX) information in the originating system and managing matching information as a result of the matching;
Detecting, in the detection system, the vulnerable software by comparing the matching information provided from the originating system with previously registered reference SPDX information; And
Controlling the operation of the vulnerable software in accordance with the degree of vulnerability of the vulnerable software detected by the detection system in the management system;
, The method comprising: using the SPDX technology to manage vulnerabilities of the software. 9. The method of claim 8,
In the managing step,
When a new vulnerability is found, matches vulnerable information with SPDX information, generates matching information as a result of matching the vulnerability information and provides the generated matching information to the detection system, and uses the SPDX technology to manage the vulnerability of the software Way. 9. The method of claim 8,
In the detecting step,
Comparing the matching information provided from the originating system with previously registered reference SPDX information, and detecting vulnerable software including vulnerable open source software and vulnerable open source software as a result of the comparison,
Generating a vulnerability detection report for the detected vulnerable software and providing the vulnerability detection report to the management system; and managing the vulnerability of the software using the SPDX technology. 9. The method of claim 8,
In the controlling step,
The control information is retrieved using the vulnerability information in the vulnerability detection report provided from the detection system
And controlling the operation of the corresponding vulnerable software or system according to the retrieved control information, using the SPDX technology.

Images