WO2023209899A1

WO2023209899A1 - Security determination system, security determination device, method, and program

Info

Publication number: WO2023209899A1
Application number: PCT/JP2022/019173
Authority: WO
Inventors: 美郷中林; 乾太郎大野
Original assignee: 日本電信電話株式会社
Priority date: 2022-04-27
Filing date: 2022-04-27
Publication date: 2023-11-02
Also published as: JPWO2023209899A1

Abstract

A security determination system according to one aspect of the present disclosure comprises: a conversion unit configured so as to convert an encryption protocol configured by one or more messages into series data of data in which the messages are expressed in a tree structure; a security verification unit configured so as to use the series data as input, and output a security verification value representing a verification result regarding a prescribed security requirement of the encryption protocol by using a machine learning model having trained model parameters; and a determination unit configured so as to determine, on the basis of the security verification value, whether the encryption protocol satisfies the security requirement.

Description

Safety determination system, safety determination device, method, and program

The present disclosure relates to a safety determination system, a safety determination device, a method, and a program.

In recent years, as cryptographic protocols have become more complex, automatic verification tools have been used to verify their security. Major automatic verification tools use an automatic verification technology called formal verification, but formal verification has the problem of not being guaranteed to stop, and even when verification stops, it takes a huge amount of verification time. be. In response, research is also being conducted on the security verification of cryptographic protocols using machine learning (for example, Non-Patent Documents 1 and 2). Although methods using machine learning require shorter verification time than formal verification and guarantee stopping performance, they have the problem that accuracy is not always 100%.

In the existing methods described in the above-mentioned non-patent documents 1 and 2, a machine learning model is constructed by converting a cryptographic protocol into data with a sequence structure.

However, in existing methods, the structure of the message is lost because an independent conversion process is performed for each message element of the cryptographic protocol, resulting in low accuracy in security verification.

The present disclosure has been made in view of the above points, and provides a technology that verifies the security of cryptographic protocols with high accuracy using machine learning.

A security determination system according to an aspect of the present disclosure includes a conversion unit configured to convert a cryptographic protocol composed of one or more messages into series data of data expressing the message in a tree structure; a security verification unit configured to input series data and output a security verification value representing a verification result regarding predetermined security requirements of the cryptographic protocol using a machine learning model having learned model parameters; , a determining unit configured to determine whether the cryptographic protocol satisfies the security requirements based on the security verification value.

Machine learning provides technology to verify the security of cryptographic protocols with high accuracy.

It is a figure showing an example of the constituent elements of a message. FIG. 3 is a diagram illustrating an example of a method of configuring a message. FIG. 3 is a diagram showing an example of party behavior. FIG. 2 is a diagram showing an example of a tree structure representing a cryptographic protocol. FIG. 3 is a diagram showing an example of a safety verification model. 1 is a diagram illustrating an example of a hardware configuration of a safety determination device according to an embodiment. FIG. FIG. 2 is a diagram illustrating an example of a functional configuration of a safety determination device at the time of inference. FIG. 3 is a diagram illustrating an example of a functional configuration of a safety determination device during learning. 7 is a flowchart illustrating an example of safety determination processing according to the present embodiment. 7 is a flowchart illustrating an example of learning processing according to the present embodiment.

An embodiment of the present invention will be described below. The following describes a security determination device that constructs a machine learning model that can highly accurately verify the security requirements of a cryptographic protocol, and then uses that machine learning model to determine whether a desired cryptographic protocol satisfies the security requirements. 10 will be explained.

Here, in the following, a key exchange protocol or an authentication protocol is assumed as the cryptographic protocol, and in the case of the key exchange protocol, confidentiality is assumed as its security requirement, and in the case of the authentication protocol, authentication is assumed as its security requirement. However, the cryptographic protocols and their security requirements are not limited to these, and the present embodiment is similarly applicable to other cryptographic protocols and their safety requirements.

<Preparation>
Below, terms, concepts, definitions, etc. necessary for explaining this embodiment will be prepared.

≪Target cryptographic protocol≫
This embodiment targets cryptographic protocols that satisfy the following (1) to (3). Note that the person who executes the cryptographic protocol is called a party. Further, one execution of a cryptographic protocol by parties (that is, from the start of message exchange until authentication, session key exchange, etc. are performed) is called a session.

(1) The process is executed between s parties P ₁ , . . . , P _s (where s is an integer of 2 or more).

(2) Each party has an ID, a private key that will be used for a long time (long-term private key), a public key for the long-term private key, and a private key that will be used for a short period only within the session (temporary private key). Allocated.

(3) Exchange messages between parties and provide functions such as authentication and key exchange.

≪How to write the cryptographic protocol≫
Define messages and party behaviors as follows, and define a cryptographic protocol as a sequence of party behaviors. Note that the message is sometimes called a protocol message.

- Message constituent elements Figure 1 shows an example of the message constituent elements and their notation method. In FIG. 1, P represents any party. That is, P∈{P ₁ , . . . , P _s }. In the following, a set of elements constituting a message is expressed as AN={a ₁ , . . . , a _N } (where N is the total number of elements constituting the message). Note that the elements constituting the AN (elements constituting the message) are defined according to the target cryptographic protocol. For example, when the target cryptographic protocol is an authentication protocol, an AN that does not include the session key SK _P shared by the party P may be defined.

- Message composition method Figure 2 shows an example of the party's operations when composing a message and its notation method. In Figure 2,

represents a sequence of arbitrary messages (generated based on the composition method from the elements composing the message). Hereinafter, in the text of the specification, an arbitrary message sequence will be expressed as " ^→ m". Note that the message sequence ^→ m includes the case where there is only one message (that is, the case where the message is expressed as ^→ m=m ₁ , where m ₁ is the message). In the following, a set of operations of a party when composing a message is expressed as FN={f ₁ , . . . , f _M } (where M is the total number of operations). Note that the operations for configuring the FN are defined according to the target cryptographic protocol. For example, if the target cryptographic protocol is a key exchange protocol, an FN that does not include sign( ^→ m, lsk) may be defined.

-Party behavior Figure 3 shows an example of party behavior within the protocol and its notation method. In FIG. 3, ^→ m represents an arbitrary message sequence. In the following, the set of party behaviors in the protocol is expressed as BN={b ₁ , . . . , b _L } (where L is the total number of party behaviors in the protocol). Note that the behavior constituting the BN is defined according to the target cryptographic protocol. For example, if the target cryptographic protocol is an authentication protocol, a BN that does not include acceptI( ^→ m) or acceptR( ^→ m) may be defined.

<Cryptographic protocol modeling>
With the above preparation, a cryptographic protocol is represented by a sequence of messages exchanged between parties. Each message is configured by applying element a included in AN and operation f included in FN to a message or a sequence of messages after determining the behavior of a party regarding the message. For example, both (a) and (b) below are messages.

(a) sendItoR(esk _I )
(b) sendRtoI(ID _I , esk _I , esk _R , aenc _I (ID _R , SK), sign _R (ID _I , esk _I , esk _R , aenc _I (ID _R , SK)))
Here, aenc _I (.) represents aenc (.; pk _I ) (where pk _I is the public key of the initiator I). Further, sign _R (·) represents sign (·; lsk _R ) (where lsk _R is the long-term secret key of responder R).

Note that (a) and (b) above are messages of the authentication protocol (ISO/IEC 11770-3 key distribution mechanism 4) described in Reference 1.

Therefore, each message of a cryptographic protocol can be expressed as a tree structure (syntax tree) in which the behavior of the party is the root node, the operation is the internal node, and the message elements are the leaf nodes. For example, the message shown in (a) above can be expressed in a tree structure as shown in the left diagram of FIG. 4, and the message shown in (b) above can be expressed in a tree structure as shown in the right diagram of FIG. 4.

Therefore, a cryptographic protocol is expressed as a message sequence structure expressed in a tree structure. That is, if each message expressed in a tree structure is m _t and the number of message exchanges in the cryptographic protocol is T, then the cryptographic protocol has a series structure and a tree of {m _t |t=1,...,T}. It can be expressed using structured data.

By representing each message in a tree structure, it is possible to take into account the grammatical structure between messages (in other words, the structural information of the cryptographic protocol), making it possible to construct a more accurate machine learning model. For example, consider the following two messages (c) and (d).

(c) sendItoR(sign _I (aenc _R (ID _I , SK)))
(d) sendItoR(sign _R (aenc _I (ID _I , SK)))
In this case, existing methods (for example, Non-Patent Documents 1 and 2) convert the vectors into the same vector, and the structural information of the cryptographic protocol is lost. On the other hand, by representing it in a tree structure, the above two messages (c) and (d) can be distinguished, and the structural information of the cryptographic protocol can be taken into account. For this reason, a machine learning model that reflects the structural information of the cryptographic protocol is constructed, making it possible to perform more accurate security verification.

<Safety verification model>
Below, a security verification value representing the verification result of the security requirements of the cryptographic protocol is given as an input cryptographic protocol expressed as data {m _t |t=1,...,T} having a series structure and a tree structure. We will explain the configuration of a machine learning model that outputs . Hereinafter, this machine learning model will be referred to as a "safety verification model."

An example of the configuration of the safety verification model 1000 is shown in FIG. As shown in FIG. 5, the safety verification model 1000 includes a TreeLSTM 1100, an LSTM 1200, and a linear classifier 1300.

The TreeLSTM 1100 is a neural network model configured based on the Child-Sum Tree-LSTM (Reference 2), which is a model that extends LSTM (Long Short-Term Memory) to a tree structure. In the TreeLSTM 1100, the latent vector of each node in the tree structure is calculated based on the latent vectors of child nodes. Specifically, if the set of child nodes of node j of message m _t is C(j), the latent vector h _j ∈R ⁿ of node j and the storage cell c _j ∈R ⁿ (where n is the latent vector h _j and the number of dimensions of the storage cell c _j ) are calculated and updated using the following formula.

here,

represents the element-wise product of vectors. Furthermore, W _c ∈R ^n×d and U _c ∈R ^n×n (where d is the number of dimensions of the vector representing the label of node j as described later) are weight matrices, and b∈R ⁿ is a bias. Furthermore, x _j εR ^d is a vectorization of the label of node j (ie, party behavior, message element, or operation). i _j , f _jk , o _j ∈[0,1] ⁿ are input, forget, and output gates calculated from (vectorized) latent vectors and labels of child nodes, respectively, and Control transmission. For details of Child-Sum Tree-LSTM including these, please refer to Reference 2, for example.

Each message m _t (t=1 _, ..., T) is obtained as a sequence of latent vectors h _{m_1} , ..., h _{m_T} of the action nodes. The columns h _{m_1} , . . . , h _{m_T} of these latent vectors are input to the LSTM 1200. Note that “m_1”, . . . , “m_T” represent “m ₁ ”, . . . , “m _T ”, respectively.

LSTM1200 is LSTM (Reference document 3), which is one of the improved models of RNN (Recurrent Neural Network). The LSTM 1200 inputs the latent vector sequence h _{m_1} , ..., h _{m_T} obtained by the Tree LSTM 1100 and outputs a latent vector h'=h' _{m_T} εR ⁿ . Here, h' _j represents a latent vector of LSTM. Note that in LSTM, past latent vectors are required when calculating h' _j , but if the past latent vectors are uncalculated, for example, if the uncalculated latent vectors are defined as 0 vectors, etc. good. Since the LSTM 1200 is similar to existing LSTMs, a detailed explanation thereof will be omitted, but please refer to Reference Document 3 and the like as necessary.

The linear classifier 1300 receives the latent vector h' obtained by the LSTM 1200 as input and outputs a safety verification value. That is, the linear classifier 1300 linearly transforms the latent vector h' into a vector with dimensions equal to the number of labels related to safety requirements, and then sets the softmax function value for the corresponding element of the vector as the safety verification value. Therefore, the safety verification value is expressed as a probability.

For example, if there are two labels related to security requirements: "confidentiality is met" and "confidentiality is not met", the latent vector h' is linearly transformed into a two-dimensional vector by the linear classifier 1300. Therefore, for example, the softmax function value for the element corresponding to the label indicating "satisfying confidentiality" may be used as the security verification value. As a result, for example, if the security verification value exceeds a predetermined threshold value, it is determined that the corresponding cryptographic protocol satisfies the confidentiality, and otherwise, it is determined that the cryptographic protocol does not satisfy the confidentiality. The following description will be made assuming that there are two labels related to safety requirements, ``satisfies the applicable safety requirements'' and ``does not satisfy the applicable safety requirements''. However, this is just an example and is not limited to this. For example, "confidentiality is met" and "authentication is met" may be labels related to security requirements, or "confidentiality is met", "confidentiality is not met", "authentication is met" and "authentication is met". "does not meet safety requirements" may be used as a label regarding safety requirements.

<Learning the safety verification model>
The learning target parameters of the safety verification model 1000 described above are the weight matrices W _c , U _c and bias b of the TreeLSTM 1100, the weight matrix and bias of the LSTM 1200, and the weight matrix and bias used for linear transformation of the linear classifier 1300. It is. Hereinafter, these parameters will be referred to as model parameters.

When learning the security verification model 1000, a learning data set represented by a pair of a cryptographic protocol and a security evaluation label representing the result of evaluating its security requirements is given. Hereinafter, this learning data set is assumed to be D={(Prt _i , y _i )|i=1, . . . , |D|}. Prt _i is the i-th cryptographic protocol, and y _i is its security evaluation label. The safety evaluation label y _i takes, for example, 1 when the corresponding safety requirement is satisfied, and 0 otherwise.

At this time, if Prt _i is converted into data with a series structure and a tree structure, and the probability distribution of the safety verification value is input to the safety verification model 1000 as p=p(y|Prt _i ), then , the cross-entropy function for the safety evaluation label y _i can be defined as l(p, y _i )=−logp(y _i |Prt _i ). Since 0<p(y _i |Prt _i )<1, l(p,y _i )>0. Therefore, the smaller p(y _i | Prt _i ), the larger l(p, y _i ) takes, and l(p, y _i ) is the error between the prediction by the safety verification model 1000 and the true label. represents size. Therefore, the average error for the learning data set D, that is, (l(p,y ₁ )+...+l(p,y _|D| ))/|D| can be used as the loss function.

The model parameters are learned to minimize the loss function described above. A known method such as a gradient method may be used to minimize the loss function. Note that in the following, the case of learning model parameters will be referred to as "learning time", and the case of obtaining a security verification value for a desired cryptographic protocol by a security verification model using learned model parameters will be referred to as "inference time". Make it.

<Example of hardware configuration of safety determination device 10>
FIG. 6 shows an example of the hardware configuration of the safety determination device 10 according to this embodiment. As shown in FIG. 6, the safety determination device 10 according to the present embodiment includes an input device 101, a display device 102, an external I/F 103, a communication I/F 104, and a RAM (Random Access Memory) 105. It has a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is communicably connected via a bus 109.

The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, or the like. The display device 102 is, for example, a display, a display panel, or the like. Note that the safety determination device 10 may not include at least one of the input device 101 and the display device 102, for example.

The external I/F 103 is an interface with an external device such as the recording medium 103a. The safety determination device 10 can read, write, etc. to the recording medium 103a via the external I/F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

The communication I/F 104 is an interface for connecting the safety determination device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily holds programs and data. The ROM 106 is a nonvolatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The auxiliary storage device 107 is, for example, a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 108 is, for example, an arithmetic device such as a CPU (Central Processing Unit).

The safety determination device 10 according to this embodiment has the hardware configuration shown in FIG. 6, so that it can implement various processes described below. Note that the hardware configuration shown in FIG. 6 is an example, and the hardware configuration of the safety determination device 10 is not limited to this. For example, the safety determination device 10 may include a plurality of auxiliary storage devices 107 and a plurality of processors 108, may not include a part of the illustrated hardware, or may include the illustrated hardware. It may also include various other hardware.

<Example of functional configuration of safety determination device 10>
An example of the functional configuration of the safety determination device 10 according to the present embodiment will be described below. It is assumed that the cryptographic protocol Prt to be determined whether or not it satisfies the security requirements is given to the security determination device 10 at the time of inference, and the learning data set D is provided to the security determination device 10 at the time of learning.

≪At the time of inference≫
FIG. 7 shows an example of the functional configuration of the safety determination device 10 at the time of inference. As shown in FIG. 7, the safety determination device 10 at the time of inference includes a structure conversion section 201, a safety verification processing section 202, and a safety determination section 203. Each of these units is realized, for example, by one or more programs installed in the safety determination device 10 causing the processor 108 to execute the process.

The structure conversion unit 201 converts the given cryptographic protocol Prt into data {m _t |t=1, . . . , T} having a sequence structure and a tree structure. Here, each m _t represents the t-th message constituting the cryptographic protocol Prt in a tree structure. Hereinafter, the cryptographic protocol expressed as data having a series structure and a tree structure will be expressed as Prt={m _t |t=1,...,T}.

The security verification processing unit 202 is realized by the security verification model 1000 having learned model parameters, and receives the cryptographic protocol Prt={m _t |t=1,...,T} as input and calculates the cryptographic protocol. Output the safety verification value. Here, the safety verification processing section 202 includes a tree structure feature extraction section 211, a series structure feature extraction section 212, and a classification section 213.

The tree structure feature extraction unit 211 is realized by TreeLSTM1100 having learned model parameters, and inputs Prt={m _t |t=1,...,T} and extracts latent vector columns h _{m_1} ,... , h _{m_T} .

The sequence structure feature extraction unit 212 is realized by the LSTM 1200 having learned model parameters, and receives the latent vector sequence h _{m_1} , . . . , h _{m_T} as input and outputs the latent vector h'=h' _{m_T} .

The classification unit 213 is realized by a linear classifier 1300 having learned model parameters, and receives the latent vector h' as an input and outputs a safety verification value.

The security determination unit 203 compares the security verification value with a predetermined threshold, and, for example, if the security verification value exceeds the predetermined threshold, it determines that the cryptographic protocol Prt satisfies the security requirements, and If not, it is determined that the cryptographic protocol Prt does not satisfy the security requirements. This determination result (safety determination result) is output to a predetermined output destination (for example, the auxiliary storage device 107, another device connected via the communication network, etc.).

≪When learning≫
FIG. 8 shows an example of the functional configuration of the safety determination device 10 during learning. As shown in FIG. 8, the safety determination device 10 during learning includes a structure conversion section 201, a safety verification processing section 202, and a learning section 204. Each of these units is realized, for example, by one or more programs installed in the safety determination device 10 causing the processor 108 to execute the process.

The structure conversion unit 201 converts the cryptographic protocol Prt _i included in the given learning data set D into data {m _t ⁽ⁱ⁾ | t=1,...,T ⁽ⁱ⁾ } having a sequence structure and a tree structure. Convert. Here, each m _t ⁽ⁱ⁾ represents the t-th message constituting the cryptographic protocol Prt _i in a tree structure. Hereinafter, the cryptographic protocol expressed as data having a sequence structure and a tree structure will be expressed as Prt _i ={m _t ⁽ⁱ⁾ | t=1, . . . , T ⁽ⁱ⁾ }.

The security verification processing unit 202 is realized by the security verification model 1000 having model parameters that have not been learned, and uses the cryptographic protocol Prt _i ={m _t ⁽ⁱ⁾ | t=1,...,T ⁽ⁱ⁾ }. As an input, a probability distribution p=p(y|Prt _i ) of safety evaluation values is output. Here, the safety verification processing section 202 includes a tree structure feature extraction section 211, a series structure feature extraction section 212, and a classification section 213.

The tree structure feature extraction unit 211 is realized by TreeLSTM1100 having learned model parameters, and uses Prt _i ={m _t ⁽ⁱ⁾ | t=1,...,T ⁽ⁱ⁾ } as input to extract latent vectors. Output the columns h _{m_1} , . . . , h _{m_T} .

The classification unit 213 is realized by the linear classifier 1300 having learned model parameters, receives the latent vector h' as input, and outputs the probability distribution p=p(y|Prt _i ) of the safety verification value.

The learning unit 204 calculates the loss using the probability distribution p=p(y|Prt _i ) output from the safety verification processing unit 202 and the safety evaluation label y _i included in the given learning data set D. Learn model parameters to minimize a function.

<Processing details>
The details of the process executed by the safety determination device 10 according to this embodiment will be described below. Note that the safety determination process is executed by the safety determination apparatus 10 at the time of inference, and the learning process is executed by the safety determination apparatus 10 at the time of learning.

≪Safety judgment processing≫
The safety determination process according to this embodiment will be described with reference to FIG. 9.

The structure conversion unit 201 converts the given cryptographic protocol Prt into data {m _t |t=1, . . . , T} having a series structure and a tree structure (step S101).

Next, the security verification processing unit 202 inputs the cryptographic protocol Prt={m _t |t=1,...,T} using the security verification model 1000 having learned model parameters, and verifies the cryptographic protocol. The safety verification value of is output (step S102).

Then, the security determination unit 203 determines whether the cryptographic protocol Prt satisfies the security requirements using the security verification value output in step S102 and a predetermined threshold (step S103).

≪Learning process≫
The learning process according to this embodiment will be explained with reference to FIG. 10.

The learning unit 204 initializes model parameters (step S201). Note that the learning unit 204 may initialize the model parameters using a known method.

The following steps S202 and S203 are repeatedly executed for each i=1, . . . , |D|.

The structure conversion unit 201 converts the cryptographic protocol Prt _i included in the given learning data set D into data {m _t ⁽ⁱ⁾ | t=1,...,T ⁽ⁱ⁾ } having a sequence structure and a tree structure. Convert (step S202).

Next, the security verification processing unit 202 uses the security verification model 1000 with model parameters that have not been learned to perform cryptographic protocol Prt _i ={m _t ⁽ⁱ⁾ | t=1,...,T ⁽ⁱ⁾ } is input, and a probability distribution p=p(y|Prt _i ) of safety evaluation values is output (step S203).

Then, the learning unit 204 minimizes the loss function using the probability distribution p=p(y|Prt _i ) obtained in step S203 above and the security evaluation label y _i corresponding to the cryptographic protocol Prt _i . The model parameters are learned so that (step S204).

<Summary>
As described above, the security determination device 10 according to the present embodiment can verify the security requirements of a cryptographic protocol using a machine learning model. At this time, the security determination device 10 according to the present embodiment extracts not only the characteristics of the series structure of messages constituting the cryptographic protocol but also the characteristics of the tree structure of each message, and then determines the cryptographic protocol from these characteristics. Verify safety requirements. This makes it possible to verify the security requirements of cryptographic protocols with higher accuracy than with conventional methods.

In the above embodiment, a case has been described in which the safety determination device 10 is implemented by one device, but the invention is not limited to this, and for example, multiple devices connected to each other via a communication network are implemented. The safety determination device 10 may be realized by one device. In this case, the safety determination device 10 may be called a safety determination system or the like.

Further, in the above embodiment, the same device is used as the safety determination device 10 at the time of inference and at the time of learning, but the invention is not limited to this. For example, the safety determination device 10 at the time of inference and the safety determination device 10 at the time of learning The sex determination device 10 may be a different device.

The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications and changes, combinations with known techniques, etc. are possible without departing from the scope of the claims. .

[Reference 1]
Reference 1: International Standard. Iso: Information technology - security techniques - key management - part 3: Mechanisms using asymmetric techniques iso/iec 11770-3, 2015. 3rd edition.
Reference 2: Kai Sheng Tai, Richard Socher, and Christopher D. Manning. Improved semantic representations from tree-structured long short-term memory networks. In Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 1556-1566, Beijing, China, July 2015. Association for Computational Linguistics.
Reference 3: Sepp Hochreiter and J¨urgen Schmidhuber. Long Short-Term Memory. Neural Computation, Vol. 9, No. 8, pp.1735-1780, 11 1997.

10 Safety Judgment Device 101 Input Device 102 Display Device 103 External I/F
103a Recording medium 104 Communication I/F
105 RAM
106 ROM
107 Auxiliary storage device 108 Processor 109 Bus 201 Structure conversion unit 202 Safety verification processing unit 203 Safety determination unit 204 Learning unit 211 Tree structure feature extraction unit 212 Sequence structure feature extraction unit 213 Classification unit

Claims

a conversion unit configured to convert a cryptographic protocol consisting of one or more messages into a series of data representing the messages in a tree structure;
A security verification unit configured to input the series data and output a security verification value representing a verification result regarding predetermined security requirements of the cryptographic protocol using a machine learning model having learned model parameters. and,
a determination unit configured to determine whether the cryptographic protocol satisfies the security requirements based on the security verification value;
A safety evaluation system with
The conversion unit is
If the cryptographic protocol is composed of T messages, for each t (t∈{1,...,T}), the t-th message is expressed as the root node, and the behavior of the party with respect to the message is expressed as converting the elements of the message into tree-structured data in which operations on either leaf nodes, the elements, or the results of operations on the elements are expressed as internal nodes, and the series of data after the conversion is used as the series data; The safety determination system according to claim 1.
The behavior includes at least one of sending a message from an initiator to a responder, and sending a message from a responder to an initiator,
The elements include an ID of the initiator or the responder, a temporary private key of the initiator or the responder, a long-term private key of the initiator or the responder, a public key of the initiator or the responder, and a timestamp of the initiator or the responder. , a secret key shared in advance by the initiator and the responder, and a session key shared by the initiator and the responder,
The operation includes a common key ciphertext creation operation using the private key for at least one column of the element, a public key ciphertext creation operation using the public key for at least one column of the element, and a public key ciphertext creation operation using the public key for at least one column of the element. An electronic signature creation operation using the long-term private key for at least one column, a hash value calculation operation for at least one column of the elements, a concatenation operation of two of the elements, and an operation of exponentiating one of the two elements by the other. , an addition operation of two said elements, and a multiplication operation of two said elements.
The machine learning model is
Using the series data as input, a model based on Child-Sum Tree-LSTM outputs a sequence of first latent vectors representing characteristics of a tree structure representing the message;
outputting a second latent vector representing a feature of the sequence structure of the sequence data by LSTM using the first latent vector sequence as input;
The safety determination according to any one of claims 1 to 3, wherein the safety verification value is output by a linear classifier configured with a linear transformation and a Softmax function using the second latent vector as an input. system.
a conversion unit configured to convert a cryptographic protocol consisting of one or more messages into a series of data representing the messages in a tree structure;
A security verification unit configured to input the series data and output a security verification value representing a verification result regarding predetermined security requirements of the cryptographic protocol using a machine learning model having learned model parameters. and,
a determination unit configured to determine whether the cryptographic protocol satisfies the security requirements based on the security verification value;
A safety determination device having:
a conversion procedure for converting a cryptographic protocol consisting of one or more messages into a series of data representing the messages in a tree structure;
a security verification step that uses the series data as input and uses a machine learning model with learned model parameters to output a security verification value representing a verification result regarding predetermined security requirements of the cryptographic protocol;
a determination procedure for determining whether the cryptographic protocol satisfies the security requirements based on the security verification value;
The way a computer performs.
a conversion procedure for converting a cryptographic protocol consisting of one or more messages into a series of data representing the messages in a tree structure;
a security verification step that uses the series data as input and uses a machine learning model with learned model parameters to output a security verification value representing a verification result regarding predetermined security requirements of the cryptographic protocol;
a determination procedure for determining whether the cryptographic protocol satisfies the security requirements based on the security verification value;
A program that causes a computer to execute.