Data processing apparatus, data processing method, and data processing program

Abstract

To provide a data processing apparatus, a data processing method, and a data processing program configured to conduct model inspection of a security protocol without the need to learn a programming language dedicated to model inspection.SOLUTION: In a security inspection apparatus 101, which serves as a data processing apparatus, a graph conversion unit 109 analyzes security protocol data for which the security protocol is represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data for which the security protocol is represented by a graph structure. A verification unit 111 verifies the safety of the security protocol by applying a verification rule for verifying the security of a security protocol, to the graph security protocol data.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to security protocols. [Background technology]

[0002] A security protocol is a set of rules for realizing secure communication through encryption, authentication, etc. A security protocol describes the sequence of sending and receiving messages between a sender and a receiver.

[0003] To ensure the security of a security protocol, a mechanism is needed to ensure that the security protocol satisfies the security requirements at the design stage. One of the mechanisms to ensure that the security protocol satisfies the security requirements is formal verification using model checking. In security verification using model checking, security protocols and attacker behavior (attack model) are specified as the target system. Also, desirable security events are formalized as verification items. This makes it possible to semi-automatically guarantee that security protocols are desirable security events.

[0004] However, existing model checkers require the mastery of specialized programming languages ​​and specialized knowledge, making it difficult to introduce security verification using model checking. Therefore, we consider applying widely used graph database software to model checking.

[0005] Non-Patent Document 1 proposes a method for applying graph database software to model checking. In Non-Patent Document 1, a verification equivalent to that used in the existing model checker SPIN is performed on a model representing a target system. The verification used in the existing model checker SPIN uses linear temporal logic formulas. In Non-Patent Document 1, the verification is performed by checking whether the model representing the target system satisfies the verification items. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Kuno, Ueda, and Kogai: “Proposal of a Model Checking Method Using Graph Databases,” IPSJ Technical Report, Vol. 2018-SE-198, No. 9, September 2018. Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the conventional technology, models to be input into a graph database required for model checking must be generated using a conventional model checker, which poses a problem in that users must learn a programming language to operate the conventional model checker. Furthermore, there are no algorithms for automatically verifying security protocols and attack models. Therefore, the conventional techniques have the problem that they cannot verify security protocols.

[0008] The main objective of the present disclosure is to solve such problems. More specifically, the main objective of the present disclosure is to enable model checking of security protocols without the need to learn a programming language dedicated to model checking. [Means for solving the problem]

[0009] The data processing device according to the present disclosure includes: a security protocol conversion unit that analyzes security protocol data in which a security protocol is data represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data in which the security protocol is data represented by the graph structure; and a verification unit that verifies the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data. [Effects of the Invention]

[0010] According to the present disclosure, model checking of security protocols can be performed without the need to learn a programming language dedicated to model checking. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a diagram showing an example of a hardware configuration of the security verification device according to the first embodiment. [Figure 2] FIG. 2 shows an example of the functional configuration of the security verification device according to the first embodiment. [Figure 3] 4 is a flowchart showing an example of the operation of a graph conversion unit according to the first embodiment. [Figure 4] 4 is a flowchart showing an example of the operation of a graph conversion unit according to the first embodiment. [Figure 5] 4 is a flowchart showing an example of the operation of a graph conversion unit according to the first embodiment. [Figure 6] 4 is a flowchart showing an example of the operation of a graph conversion unit according to the first embodiment. [Figure 7] 4 is a flowchart showing an example of the operation of a graph conversion unit according to the first embodiment. [Figure 8] 10 is a flowchart showing an example of the operation of the attack model adding unit according to the first embodiment. [Figure 9] FIG. 3 is a diagram showing examples of verification items according to the first embodiment. [Figure 10] 6 is a flowchart showing an example of the operation of a verification unit according to the first embodiment. [Figure 11] FIG. 2 is a diagram showing an example of a GUI according to the first embodiment. [Figure 12] 10 is a flowchart showing an example of the operation of an attack model adding unit according to the second embodiment. [Figure 13] FIG. 2 is a diagram showing an example of a security protocol according to the first embodiment. [Figure 14] FIG. 2 is a diagram showing an example of an attack model according to the first embodiment. [Figure 15] FIG. 2 is a diagram showing an example of graph security protocol data according to the first embodiment. [Figure 16] FIG. 10 is a diagram showing an example of graph security protocol data to which graph attack model data according to the first embodiment has been added. [Figure 17] FIG. 10 is a diagram showing an example of a verification result according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the embodiments and the drawings, the same reference numerals denote the same or corresponding parts.

[0013] Embodiment 1 ***Configuration Description*** FIG. 1 shows an example of the hardware configuration of security verification device 101 according to this embodiment and peripheral devices.

[0014] Security verification device 101 is a computer. Security verification device 101 corresponds to a data processing device. The operating procedure of security verification device 101 corresponds to a data processing method. The program that realizes the operation of security verification device 101 corresponds to a data processing program.

[0015] As shown in FIG. 1, security verification device 101 has, as its hardware configuration, an input / output control unit 104, a processor 105, a memory 106, a disk 107, and a bus 114. An input / output control unit 104 , a processor 105 , a memory 106 and a disk 107 are connected to one another via a bus 114 .

[0016] The input / output control unit 104 is connected to the input device 102 and the output device 103 . Input / output control unit 104 controls input and output in security verification device 101 .

[0017] Processor 105 controls each piece of hardware within security verification device 101 and executes programs. Specifically, the processor 105 executes programs that realize the functions of a user interface unit 108, a graph conversion unit 109, an attack model addition unit 110, and a verification unit 111 (hereinafter, these are also collectively referred to as functional components), which will be described later.

[0018] The memory 106 is loaded with programs that implement the functions of the functional components. 1 shows a state in which the programs that realize the functions of the functional components are loaded into the memory 106. In other words, Fig. 1 shows that the user interface unit 108, graph conversion unit 109, attack model addition unit 110, and verification unit 111 are in an operable state.

[0019] The disk 107 is a non-volatile storage device, such as a hard disk drive. The disk 107 stores a verification item database 113 . The verification item database 113 stores graph database queries corresponding to verification items. A verification item is a verification rule for verifying the security of a security protocol. The security of a security protocol is guaranteed, for example, by authentication. In this specification, the "security of a security protocol" is also simply referred to as the "security of the security protocol." Although not shown in FIG. 1, the disk 107 stores programs that realize the functions of the functional components. These programs are loaded from a disk 107 into a memory 106 in response to an instruction from a processor 105 .

[0020] FIG. 2 shows an example of the functional configuration of security verification device 101 according to this embodiment.

[0021] Security verification device 101 has, as functional components, a user interface unit 108, a graph conversion unit 109, an attack model addition unit 110, and a verification unit 111 shown in Fig. 1. Security verification device 101 also has a verification item database 113 shown in Fig. 1.

[0022] The user interface unit 108 acquires data from the input / output control unit 104. The user interface unit 108 also outputs data to the input / output control unit 104. The user interface unit 108 has an internal configuration including a system data input unit 201, a verification item input unit 202, and a verification result output unit 203.

[0023] The system data input unit 201 acquires system data. The system data is data that represents the target system to be verified. The target system consists of a security protocol and an attack model for the security protocol. The attack model describes the procedure for attacking the security protocol. The system data includes security protocol data indicating a security protocol and attack model data indicating an attack model. In the security protocol data, a security protocol is represented by a structure other than a graph structure, and in the attack model data, an attack model against a security protocol is represented by a structure other than a graph structure. The system data input unit 201 outputs the security protocol data to the graph conversion unit 109. The system data input unit 201 also outputs the attack model data to the attack model addition unit 110.

[0024] The verification item input unit 202 acquires the identifier of the verification item selected by the analyst. A plurality of queries corresponding to a plurality of verification items are stored in the verification item database 113. The analyst selects a verification item to be used for verification from the plurality of verification items. The verification item input unit 202 notifies the verification item database 113 of the identifier of the verification item selected by the analyst.

[0025] The verification result output unit 203 outputs the verification result. More specifically, the verification result output unit 203 outputs the verification result of the safety of the security protocol.

[0026] The graph conversion unit 109 converts the security protocol data into a graph structure. More specifically, graph conversion unit 109 analyzes the security protocol data and converts the security protocol data into graph security protocol data, which is data in which the security protocol is represented in a graph structure. The graph conversion unit 109 corresponds to a security protocol conversion unit, and the processing performed by the graph conversion unit 109 corresponds to a security protocol conversion process.

[0027] The attack model adding unit 110 adds graph attack model data to the graph security protocol data obtained by the graph converting unit 109. More specifically, the attack model adding unit 110 analyzes the attack model data and converts the attack model data into graph attack model data, which is data in which an attack model is represented in a graph structure. The attack model adding unit 110 adds graph attack model data to the graph security protocol data.

[0028] The verification unit 111 verifies the security of the security protocol by applying verification items to the graph security protocol data to which the graph attack model data has been added. The verification unit 111 internally holds graph database software 112. The verification unit 111 uses the graph database software 112 to verify the safety of the security protocol. The graph database software 112 is software that processes the input query representing the graph and the query representing the verification items, and outputs the results. The process performed by the verification unit 111 corresponds to a verification process.

[0029] ***Explanation of Operation*** Next, an operation for verifying the safety of a security protocol using security verification device 101 according to this embodiment will be described. In the following description, it is assumed that a plurality of verification items are stored in the verification item database 113 in advance.

[0030] First, an analyst, who is a user of security verification device 101, inputs system data into system data input unit 201. That is, the analyst inputs security protocol data and attack model data into system data input unit 201. The security protocol data and attack model data are, for example, sequence diagrams. Alternatively, the security protocol data and attack model data may be state chart diagrams in UML (Unified Modeling Language). The system data input unit 201 outputs the security protocol data acquired from the analyst to the graph conversion unit 109. In addition, the system data input unit 201 outputs the attack model data acquired from the analyst to the attack model adding unit 110.

[0031] Figure 13 shows an example of a security protocol. Figure 14 shows an example of an attack model. The security protocol is represented by a sequence diagram in Figure 13. In the security protocol in Figure 13, messages are sent and received between sender A and receiver B to authenticate each other. The attack model is also expressed as a sequence diagram in Figure 14. The attack model in Figure 14 shows the attack procedure of a man-in-the-middle attack in which attacker I exchanges keys with sender A and receiver B. In the following, it is assumed that the system data input unit 201 acquires, from the analyst, security protocol data in which the security protocol shown in Fig. 13 is described. It is also assumed that the system data input unit 201 acquires, from the analyst, attack model data in which the attack model shown in Fig. 14 is described.

[0032] The analyst also selects the verification item to be verified from the list of verification items. Specifically, a list of verification items whose queries are stored in the verification item database 113 is displayed on the output device 103. The analyst selects any verification item from the list of verification items displayed on the output device 103. The identifier of the verification item selected by the analyst is notified to the verification item input unit 202 via the input device 102. The verification item input unit 202 notifies the verification item database 113 of the identifiers of the verification items selected by the analyst. The verification item database 113 outputs a query for the verification item corresponding to the identifier notified by the verification item input unit 202 to the verification unit 111 .

[0033] Next, graph conversion unit 109 operates in accordance with the procedures shown in the flowcharts of FIGS. 3 to 7 to convert the security protocol data into graph security protocol data. The graph conversion unit 109 analyzes the security protocol data and distinguishes between message transmission from a sender to a receiver and message transmission from a receiver to a sender. Then, the graph conversion unit 109 converts the security protocol data into graph security protocol data in which message transmission from a sender to a receiver and message transmission from a receiver to a sender are indicated by a graph structure. The graph conversion unit 109 outputs the graph security protocol data to the attack model addition unit 110 .

[0034] The attack model adding unit 110 obtains graph security protocol data from the graph conversion unit 109. The attack model adding unit 110 also obtains attack model data from the system data input unit 201. The attack model adding unit 110 operates according to the procedure shown in the flowchart of FIG. 8, and converts the attack model data into graph attack model data. The attack model adding unit 110 analyzes the attack model data and distinguishes between message transmission from the attacker to the sender and message transmission from the sender to the attacker. Furthermore, the attack model adding unit 110 distinguishes between message transmission from the attacker to the receiver and message transmission from the receiver to the attacker. Then, the attack model adding unit 110 converts the attack model data into graph attack model data in which message transmission from the attacker to the sender, message transmission from the sender to the attacker, message transmission from the attacker to the receiver, and message transmission from the receiver to the attacker are represented in a graph structure. Furthermore, the attack model adding unit 110 adds the graph attack model data to the graph security protocol data. The attack model adding unit 110 outputs the graph security protocol data to which the graph attack model data has been added to the verifying unit 111.

[0035] Next, the verification unit 111 starts the graph database software 112 by inputting a query corresponding to the graph security protocol data to which the graph attack model data has been added and a query corresponding to the verification item. The verification unit 111 outputs the verification result from the graph database software 112 to the verification result output unit 203 .

[0036] The verification result output unit 203 outputs the verification result to the output device 103 .

[0037] Fig. 3 shows an example of the operation of graph conversion unit 109. More specifically, Fig. 3 shows an example of the operation from when graph conversion unit 109 acquires security protocol data to when it outputs graph security protocol data. The graph conversion unit 109 can read each step described in the security protocol data by any method, and can also read the contents of messages transmitted and received between a sender and a receiver described in the security protocol data by any method.

[0038] First, in step S301, the graph conversion unit 109 adds an initial state to the graph security protocol data. For example, in step S301, the graph conversion unit 109 adds an initial state to the graph security protocol data illustrated in FIG. At the time of step S301, only the initial state is described in the graph security protocol data.

[0039] Next, in step S302, the graph conversion unit 109 adds the end state to the graph security protocol data. For example, in step S302, the graph conversion unit 109 adds an end state to the graph security protocol data illustrated in FIG. At the time of step S302, only the initial state and the final state are described in the graph security protocol data.

[0040] Finally, in step 303, the graph transformation unit 109 adds the sender / receiver states and directed edges to the graph security protocol data. For example, in step S303, the graph conversion unit 109 adds the sender / receiver states and directed edges to the graph security protocol data illustrated in FIG. When step S303 is completed, the graph security protocol data shown in FIG. 15 is obtained. When the graph conversion unit 109 performs the process of FIG. 3 on the security protocol data of FIG. 13, the graph security protocol data of FIG. 15 is generated. Step S303 is configured from the flows shown in FIGS. Next, the details of each of FIGS. 4 to 7 will be described.

[0041] Figure 4 shows an overview of step 303. That is, Figure 4 shows an overview of the operation of adding sender / receiver states and directed edges.

[0042] In step S401, the graph conversion unit 109 advances the state by one based on the sequence diagram of the security protocol data.

[0043] In step S402, the graph transformation unit 109 determines whether the end point of the directed edge of the sequence corresponding to the current state is the sender. If the end point is the sender, the graph conversion unit 109 performs a sender state addition process in step S403. On the other hand, if the end point is not the sender, the graph conversion unit 109 performs a receiver state addition process in step S404. Details of step S403 are shown in Fig. 5. Details of step S404 are shown in Fig. 6. For example, in the security protocol of FIG. 13, the end point of the directed edge of the first sequence is receiver B, so the graph transformation unit 109 performs receiver state addition processing (step S404) for the state next to the initial state.

[0044] In step S405, the graph conversion unit 109 performs a directed edge addition process. Details of step S405 are shown in FIG.

[0045] In step S406, the graph conversion unit 109 determines whether the state has reached the end state of the security protocol data. If the state has reached the end state, the graph conversion unit 109 performs a directed edge addition process in step S405 and ends the process. Details of step S405 are shown in FIG. 7. On the other hand, if the state has not reached the end state, the process returns to step S401. For example, if the state has reached "protocol normal termination" in the security protocol data of FIG. 13, the graph conversion unit 109 performs the directed edge addition process in step S405 after step S406.

[0046] FIG. 5 shows the details of step S403.

[0047] In step S501, the graph transformation unit 109 determines whether the current state is a start state, that is, whether the sequence corresponding to the current state is the first sequence of the security protocol data. If the current state is the start state, the process proceeds to step S502, whereas if the current state is not the start state, the process proceeds to step S503.

[0048] In step S502, the graph transformation unit 109 adds the sender start state to the graph security protocol data. Specifically, the graph conversion unit 109 sets IniRunning(A, The graph conversion unit 109 adds the destination (recipient B) to the graph security protocol data. If the destination is not specified, the graph conversion unit 109 sets the destination to recipient B. When step S502 is completed, the entire process of FIG. 5 ends.

[0049] In step S503, the graph conversion unit 109 checks whether the sender's processing will be completed in the sequence corresponding to the current state. The graph conversion unit 109 may check this in any manner. If the sender's processing is complete, the process proceeds to step S504, whereas if the sender's processing is not complete, the process proceeds to step S505.

[0050] In step S504, the graph transformation unit 109 adds the sender completion state to the graph security protocol data. Specifically, the graph conversion unit 109 adds IniCommit(A, destination) as a state label to the graph security protocol data. If a destination is not specified, the graph conversion unit 109 sets the destination to receiver B. If the process is to be completed without sending a message, the graph conversion unit 109 sets the completion state to the destination. When step S504 is completed, the entire process of FIG. 5 ends.

[0051] In step S505, the graph transformation unit 109 adds the sender intermediate state to the graph security protocol data. Specifically, the graph transformation unit 109 adds State=Ai to the graph security protocol data as a state label, where "i" is a positive integer. Furthermore, the graph transformation unit 109 increments the value of "i" (i++). The graph conversion unit 109 holds the value of "i" until the flow of FIG. 4 ends. When step S505 is completed, the entire process of FIG. 5 ends.

[0052] FIG. 6 shows the details of step S404.

[0053] In step S601, the graph transformation unit 109 determines whether the current state is the start state, that is, whether the sequence corresponding to the current state is the first sequence of the security protocol data. If the current state is the start state, the process proceeds to step S602, whereas if the current state is not the start state, the process proceeds to step S603.

[0054] In step S602, the graph conversion unit 109 adds the receiver start state to the graph security protocol data. Specifically, the graph conversion unit 109 adds ResRunning(sender, B) as a state label to the graph security protocol data. Furthermore, if the sender is not specified, the graph conversion unit 109 sets sender A as the sender. When step S602 is completed, the entire processing in FIG. 6 ends.

[0055] In step S603, the graph conversion unit 109 checks whether the receiver's processing will be completed in the sequence corresponding to the current state. The graph conversion unit 109 may check this in any manner. If the recipient's processing is complete, the process proceeds to step S604, whereas if the recipient's processing is not complete, the process proceeds to step S605.

[0056] In step S604, the graph conversion unit 109 adds the receiver completion state to the graph security protocol data. Specifically, the graph conversion unit 109 adds ResCommit(sender, B) as a state label to the graph security protocol data. If the sender is not specified, the graph conversion unit 109 sets sender A as the sender. If the process is to be completed without sending a message, the graph conversion unit 109 sets the completion state to the destination. When step S604 is completed, the entire process of FIG. 6 ends.

[0057] In step S605, the graph transformation unit 109 adds the receiver intermediate state to the graph security protocol data. Specifically, the graph transformation unit 109 adds State=Bi to the graph security protocol data as a state label, where "i" is a positive integer. Furthermore, the graph transformation unit 109 increments the value of "i" (i++). The graph conversion unit 109 holds the value of "i" until the flow of FIG. 4 ends. When step S605 is completed, the entire process of FIG. 6 ends.

[0058] FIG. 7 shows the details of step S405.

[0059] In step S701, the graph conversion unit 109 determines whether the start point of the directed edge to be added is the initial state or not, and whether the end point of the directed edge to be added is the end state or not. If the start point of the directed edge to be added is in the initial state or the end point of the directed edge to be added is in the end state, the process proceeds to step S702. On the other hand, if the start point of the directed edge to be added is not in the initial state, and the end point of the directed edge to be added is not in the end state, the process proceeds to step S703.

[0060] In step S702, the graph transformation unit 109 adds the following directed edges to the graph security protocol data. 1) The type of the directed edge is Function. 2) There is no description for the attributes of the directed edge. 3) The end point of the directed edge is the destination. In principle, the graph conversion unit 109 sets the destination described in the sequence diagram as the "destination." However, if the "destination" is specified, the graph conversion unit 109 sets the specified destination as the "destination." It is assumed that the "attacker" or the "end state" is specified as the "destination."

[0061] In step S703, the graph transformation unit 109 adds the following directed edges to the graph security protocol data. 1) The type of the directed edge is CIPHER. 2) The attribute of the directed edge contains the message of the security protocol data. 3) The end point of the directed edge is the destination. For example, the first sequence of the security protocol data in Fig. 13 states that "sender A encrypts message Na with public key PK_B and sends it." For this sequence, graph conversion unit 109 writes "Msg:'A,Na',Key:"PK_B"" in the attribute of the directed edge. Furthermore, the graph conversion unit 109 sets the destination described in the sequence diagram as the "destination" in principle. However, if the "destination" is specified, the graph conversion unit 109 sets the specified destination as the "destination". It is assumed that the "attacker" or the "end state" is specified as the "destination".

[0062] Fig. 8 shows an example of the operation of the attack model adding unit 110. More specifically, Fig. 8 shows the operation of the attack model adding unit 110 to generate graph attack model data from attack model data and add the graph attack model data to the graph security protocol data. It is assumed that the attack model adding unit 110 has acquired graph security protocol data from the graph conversion unit 109 at the start of the flow in Fig. 8. It is also assumed that the attack model adding unit 110 has acquired attack model data from the system data input unit 201 at the start of the flow in Fig. 8.

[0063] In step S801, the attack model adding unit 110 determines whether the end point of the directed edge of the currently focused sequence in the attack model data is the sender. If the end point is the sender, the process proceeds to step S403. On the other hand, if the end point is not the sender, the process proceeds to step S803.

[0064] In step S803, the attack model adding unit 110 determines whether the end point of the directed edge of the currently focused sequence in the attack model data is the receiver. If the end point is the receiver, the process proceeds to step S404, whereas if the end point is not the sender, the process proceeds to step S804.

[0065] In step S403, the attack model adding unit 110 performs a sender state adding process with the destination as an attacker. That is, the attack model adding unit 110 performs the process of FIG. 5 by replacing "destination" with "attacker."

[0066] In step S404, the attack model adding unit 110 performs a receiver state adding process with the sender as the attacker. That is, the attack model adding unit 110 performs the process of FIG. 6 by replacing "source" with "attacker."

[0067] In step S804, the attack model adding unit 110 performs an attacker state adding process. Specifically, the attack model adding unit 110 adds State=Ik to the graph security protocol data as a state label, where "k" is a positive integer. Furthermore, the attack model adding unit 110 increments the value of "k" (k++). The attack model adding unit 110 holds the value of "k" until the flow of FIG. 8 ends.

[0068] After completing any one of the processes in step S403, step S404, and step S804, the attack model adding unit 110 performs a directed edge adding process in step S405. That is, the attack model adding unit 110 performs the process of FIG.

[0069] By executing step S403 and step S405, the attack model adding unit 110 converts, for example, the sequence ({Na, Nb}Pk{A}) from attacker I to sender A as illustrated in FIG. 14 into graph attack model data, and the graph attack model data is added to the security protocol data. In addition, by executing step S404 and step S405, the attack model adding unit 110 converts, for example, the first sequence ({Na,A}Pk{B}) and the second sequence ({Nb}Pk{B}) from the attacker I to the receiver B as illustrated in FIG. 14 into graph attack model data, and the graph attack model data is added to the security protocol data. In addition, by the attack model adding unit 110 executing step S804 and step S405, for example, the first sequence ({Na,A}Pk{I}) and the second sequence ({Nb}Pk{I}) from sender A to attacker I as exemplified in Fig. 14 are converted into graph attack model data, and the graph attack model data is added to the graph security protocol data. Furthermore, by the attack model adding unit 110 executing step S804 and step S405, for example, the sequence ({Na,Nb}Pk{A}) from receiver B to attacker I as exemplified in Fig. 14 is converted into graph attack model data, and the graph attack model data is added to the security protocol data.

[0070] In step S805, the attack model adding unit 110 advances the state to the end point.

[0071] In step S806, the attack model adding unit 110 determines whether the current state is the end state. If the current state is the end state, the process in Fig. 8 ends. On the other hand, if the current state is not the end state, the process returns to step S801.

[0072] FIG. 16 shows an example of graph security protocol data to which graph attack model data has been added. That is, FIG. 16 shows a state in which graph attack model data corresponding to the attack model data shown in FIG. 14 is added to the graph security protocol data shown in FIG.

[0073] FIG. 9 shows an example of the check items stored in the check item database 113. As shown in FIG. "Authentication" is a verification item related to the verification of security protocols. The verification item "authentication" finds flows that should not occur, in which the security protocol is completed even though IniCommit(A,B) does not pass. A logical formula for finding such flows is stored as a verification item in the verification item database 113. For example, a logical formula written as a query of the graph database Neo4j is stored in the verification item database 113. The verification item database 113 outputs to the verification unit 111 a query corresponding to the verification item (for example, "authentication") selected by the analyst.

[0074] FIG. 10 shows an example of the operation of the verification unit 111. 10, the verification unit 111 is assumed to have acquired the graph security protocol data to which the graph attack model data has been added from the attack model adding unit 110. Also, the verification unit 111 is assumed to have acquired the logical formula corresponding to the verification item selected by the analyst from the verification item database 113 at the start of the flow in FIG.

[0075] In step S1001, the verification unit 111 inputs a query representing the graph security protocol data to which the graph attack model data has been added to the graph database software 112. Then, the verification unit 111 causes the graph database software 112 to execute the query.

[0076] In step S1002, the verification unit 111 inputs the logical formula acquired from the verification item database 113 to the graph database software 112. Then, the verification unit 111 causes the graph database software 112 to execute the logical formula for the query executed in step S1001.

[0077] In step S1003, the verification unit 111 outputs the execution result of step S1002 to the verification result output unit 203 of the user interface unit 108 as the verification result.

[0078] FIG. 11 shows an example of a GUI (Graphical User Interface) displayed by the user interface unit 108. As shown in FIG.

[0079] The GUI in Fig. 11 has a system data input area and a verification item input area as input areas, and a verification result output area as output area.

[0080] The analyst selects a file in which a sequence diagram of the target system is described in the system data input area. The system data input unit 201 acquires the file selected in the system data input area as system data. Then, the system data input unit 201 outputs the security protocol data of the system data to the graph conversion unit 109. In addition, the system data input unit 201 outputs the attack model data of the system data to the attack model addition unit 110.

[0081] In the verification item input area, the analyst specifies symbols indicating the sender and receiver described in the sequence diagram (the default is sender A and receiver B). Furthermore, the analyst selects a verification item to be used for verification from a list of verification item names whose queries are stored in advance in the verification item database 113 using a pull-down menu. The verification item input unit 202 acquires symbols indicating the sender and receiver specified in the verification item input area. The verification item input unit 202 also acquires an identifier of the verification item selected in the verification item input area. The system data input unit 201 then outputs the symbols indicating the sender and receiver to the graph conversion unit 109. The system data input unit 201 also outputs the identifier of the verification item to the verification item database 113.

[0082] In the verification result output area, the verification results performed on the target system using the verification items are displayed in graphs and text.

[0083] FIG. 17 shows an example of the verification result displayed in the verification result output area. FIG. 17 shows the verification results when the verification items in FIG. 9 are applied to the graph security protocol data in FIG. The graph area of ​​the verification result output area displays, for example, a graph as shown in Fig. 17. Also, the text area of ​​the verification result output area displays, for example, a message as shown in Fig. 17, stating "Despite the attack in which attacker I exchanges keys with sender A and receiver B, the protocol terminates." The verification results shown in FIG. 17 are correct results similar to those obtained by model checking using the model checker SPIN.

[0084] ***Explanation of the effect of the embodiment*** In this manner, in this embodiment, the results of the verification executed by applying the verification items selected by the analyst to the security protocol of the target system designated by the analyst are output. Therefore, according to this embodiment, model checking of a security protocol can be performed without the need to learn a programming language dedicated to model checking. Therefore, according to this embodiment, the security of a security protocol can be guaranteed without the need for an analyst to learn a programming language required only for model checking. Furthermore, in this embodiment, execution time can be reduced by using a graph database that is excellent for search. Furthermore, in this embodiment, execution time can be reduced by performing a process in which irrelevant graphs are not generated in the attack model addition unit.

[0085] In this embodiment, the security of the security protocol is verified by applying the verification items to the graph security protocol data to which the graph attack model data has been added. Alternatively, the security of the security protocol may be verified by applying the verification items only to the graph security protocol data without adding the graph attack model data.

[0086] Embodiment 2 In the first embodiment, the attack model is limited to one type. In this embodiment, a configuration that can handle attack models that involve case distinction will be described. In other words, when an attack model describes multiple attack paths depending on the progress of an attack on a security protocol, the attack model adding unit 110 according to this embodiment identifies each of the multiple attack paths and converts the attack model data into graph attack model data. With this configuration, the present embodiment allows for more detailed verification.

[0087] FIG. 12 shows an example of the operation of the attack model adding unit 110 according to this embodiment. FIG. 12 corresponds to FIG. 8 described in the first embodiment.

[0088] In this embodiment, it is assumed that a unique state ID is assigned to each state of the attack model. A positive integer is assigned to the state ID. Any method for assigning state IDs may be used. The flow in FIG. 12 starts from the first state ID=0 (initial state).

[0089] In step S1201, the attack model adding unit 110 determines whether the end point of the directed edge of the sequence corresponding to the current state of the attack model data is the sender. If the end point is the sender, the process proceeds to step S403, whereas if the end point is not the sender, the process proceeds to step S1202.

[0090] In step S1202, the attack model adding unit 110 determines whether the end point of the directed edge of the sequence corresponding to the current state of the attack model data is the receiver. If the end point is the receiver, the process proceeds to step S404, whereas if the end point is not the receiver, the process proceeds to step S1203.

[0091] In step S403, the attack model adding unit 110 performs a sender state adding process with the destination as an attacker. That is, the attack model adding unit 110 performs the process of FIG. 5 by replacing "destination" with "attacker."

[0092] In step S405, the attack model adding unit 110 performs a directed edge adding process. That is, the attack model adding unit 110 performs the process of FIG.

[0093] In step S404, the attack model adding unit 110 performs a receiver state adding process with the sender as an attacker. That is, the attack model adding unit 110 performs the process of FIG. 6 by replacing "source" with "attacker."

[0094] After step S404, the attack model adding unit 110 also performs a directed edge adding process in step S405.

[0095] In step S1203, the attack model adding unit 110 performs an attacker state adding process. Specifically, the attack model adding unit 110 adds State=I(state ID, n) to the graph security protocol data as a state label. For example, when state ID=0 and n=1, the attack model adding unit 110 adds I(0,0) to the graph security protocol data. Furthermore, the attack model adding unit 110 increments the value of "n" (n++). The attack model adding unit 110 holds the value of "n" until it is determined in step S1204 that (n>total number of combinations).

[0096] After step S1203, the attack model adding unit 110 also performs the directed edge adding process in step S405.

[0097] In step S1204, the attack model adding unit 110 determines whether the value of "n" is greater than the total number of combinations. Here, the total number of combinations is the total number of combinations of the terms of the directed edges described in step S405. For example, if {message, nonce} is described on the directed edges and there are three types of messages and two types of nonce, the total number of combinations is 3 × 2 = 6. If the total number of combinations is greater than the value of "n", the process proceeds to step S1205. On the other hand, if the total number of combinations is equal to or less than the value of "n", the process returns to step S1203.

[0098] In step S1205, the attack model adding unit 110 increments the state ID.

[0099] In step S1206, the attack model adding unit 110 determines whether the state indicated by the state ID is an end state. If the state indicated by the state ID is an end state, the process ends. On the other hand, if the state indicated by the state ID is not an end state, the process returns to step S1201.

[0100] In the case where an attack model describes multiple attack paths according to the progress of an attack on a security protocol, in this embodiment, each of the multiple attack paths is identified and the attack model data is converted into graph attack model data. With this configuration, according to this embodiment, more detailed verification can be performed.

[0101] Although the first and second embodiments have been described above, these two embodiments may be combined and implemented. Alternatively, one of these two embodiments may be partially implemented. Alternatively, these two embodiments may be partially combined and implemented. Furthermore, the configurations and procedures described in these two embodiments may be modified as necessary.

[0102] ***Additional hardware configuration information*** Here, a supplementary explanation of the hardware configuration of security verification device 101 will be provided. The processor 105 shown in FIG. 1 is an integrated circuit (IC) that performs processing. The processor 105 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or the like. The memory 106 shown in FIG. 1 is a RAM (Random Access Memory). The disk 107 shown in FIG. 1 may be a hard disk drive, a ROM (Read Only Memory), or a flash memory.

[0103] The disk 107 also stores an OS (Operating System). At least a part of the OS is executed by the processor 105 . The processor 105 executes a program that implements the functions of the functional components shown in FIG. 2 while executing at least a part of the OS. The processor 105 executes the OS, which performs task management, memory management, file management, communication control, and the like. In addition, at least one of information, data, signal values, and variable values ​​indicating the results of processing by the functional components shown in FIG. 2 is stored in at least one of memory 106, disk 107, registers and cache memory in processor 105. 2 may be stored on a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, a DVD, etc. The portable recording medium on which the program for realizing the functions of the functional components shown in FIG. 2 is stored may be distributed.

[0104] Furthermore, at least one "unit" of the functional components shown in FIG. 2 may be read as a "circuit," a "step," a "procedure," a "process," or a "circuitry." Security verification device 101 may also be realized by a processing circuit, such as a logic integrated circuit (IC), a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA). In this case, the functional components shown in FIG. 2 are each implemented as part of a processing circuit. In this specification, the term "processing circuitry" refers to a generic concept that encompasses a processor and a processing circuit. That is, a processor and a processing circuit are each specific examples of "processing circuitry."

[0105] Finally, various aspects of the present disclosure are summarized in the appendix. (Appendix 1) a security protocol conversion unit that analyzes security protocol data in which a security protocol is data represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data in which the security protocol is data represented by the graph structure; a verification unit that verifies the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data. (Appendix 2) The data processing device further comprises: an attack model adding unit that analyzes attack model data in which an attack model against the security protocol is data represented by a structure other than the graph structure, converts the attack model data into graph attack model data in which the attack model is represented by the graph structure, and adds the graph attack model data to the graph security protocol data; The verification unit 2. The data processing device according to claim 1, wherein the graph attack model data is added to the graph security protocol data, and the security of the security protocol is verified by applying the verification rule to the graph security protocol data. (Appendix 3) The attack model adding unit 3. The data processing device according to claim 2, wherein, when the attack model describes a plurality of attack paths according to the progress of an attack on the security protocol, the data processing device identifies each of the plurality of attack paths and converts the attack model data into the graph attack model data. (Appendix 4) The security protocol data indicates, as the security protocol, transmission and reception of messages between a sender and a receiver in a structure other than the graph structure, The security protocol conversion unit 2. The data processing device of claim 1, wherein the security protocol data is analyzed to identify message transmissions from the sender to the recipient and message transmissions from the recipient to the sender, and the security protocol data is converted into graph security protocol data in which the message transmissions from the sender to the recipient and the message transmissions from the recipient to the sender are represented by the graph structure. (Appendix 5) The security protocol data indicates, as the security protocol, transmission and reception of messages between a sender and a receiver in a structure other than the graph structure, In the attack model data, the transmission and reception of messages between the attacker and the sender and the transmission and reception of messages between the attacker and the receiver are represented in a structure other than the graph structure as the attack model, The attack model adding unit 3. The data processing device of claim 2, wherein the attack model data is analyzed to identify message transmissions from the attacker to the sender, message transmissions from the sender to the attacker, message transmissions from the attacker to the receiver, and message transmissions from the receiver to the attacker, and the attack model data is converted into graph attack model data in which the message transmissions from the attacker to the sender, message transmissions from the sender to the attacker, message transmissions from the attacker to the receiver, and message transmissions from the receiver to the attacker are represented in the graph structure. (Appendix 6) a computer analyzes security protocol data in which a security protocol is represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data in which the security protocol is represented by the graph structure; A data processing method in which the computer verifies the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data. (Appendix 7) a security protocol conversion process for analyzing security protocol data in which a security protocol is data represented by a structure other than a graph structure, and converting the security protocol data into graph security protocol data in which the security protocol is data represented by the graph structure; a verification process for verifying the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data; [Explanation of symbols]

[0106] 101 security verification device, 102 input device, 103 output device, 104 input / output control unit, 105 processor, 106 memory, 107 disk, 108 user interface unit, 109 graph conversion unit, 110 attack model addition unit, 111 verification unit, 112 graph database software, 113 verification item database, 201 system data input unit, 202 verification item input unit, 203 verification result output unit.

Claims

1. a security protocol conversion unit that analyzes security protocol data in which a security protocol is data represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data in which the security protocol is data represented by the graph structure; a verification unit that verifies the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data.

2. The data processing device further comprises: an attack model adding unit that analyzes attack model data in which an attack model against the security protocol is data represented by a structure other than the graph structure, converts the attack model data into graph attack model data in which the attack model is represented by the graph structure, and adds the graph attack model data to the graph security protocol data; The verification unit The data processing device according to claim 1 , wherein the security of the security protocol is verified by applying the verification rule to the graph security protocol data to which the graph attack model data has been added.

3. The attack model adding unit 3. The data processing device according to claim 2, wherein, when the attack model describes a plurality of attack paths according to the progress of an attack on the security protocol, the data processing device identifies each of the plurality of attack paths and converts the attack model data into the graph attack model data.

4. The security protocol data indicates, as the security protocol, transmission and reception of messages between a sender and a receiver in a structure other than the graph structure, The security protocol conversion unit 2. The data processing device of claim 1, wherein the security protocol data is analyzed to identify message transmissions from the sender to the recipient and message transmissions from the recipient to the sender, and the security protocol data is converted into graph security protocol data in which the message transmissions from the sender to the recipient and the message transmissions from the recipient to the sender are represented by the graph structure.

5. The security protocol data indicates, as the security protocol, transmission and reception of messages between a sender and a receiver in a structure other than the graph structure, In the attack model data, the transmission and reception of messages between the attacker and the sender and the transmission and reception of messages between the attacker and the receiver are represented in a structure other than the graph structure as the attack model, The attack model adding unit 3. The data processing device according to claim 2, wherein the attack model data is analyzed to identify message transmissions from the attacker to the sender, message transmissions from the sender to the attacker, message transmissions from the attacker to the receiver, and message transmissions from the receiver to the attacker, and the attack model data is converted into graph attack model data in which the message transmissions from the attacker to the sender, message transmissions from the sender to the attacker, message transmissions from the attacker to the receiver, and message transmissions from the receiver to the attacker are represented in the graph structure.

6. a computer analyzes security protocol data in which a security protocol is represented by a structure other than a graph structure, and converts the security protocol data into graph security protocol data in which the security protocol is represented by the graph structure; A data processing method in which the computer verifies the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data.

7. a security protocol conversion process for analyzing security protocol data in which a security protocol is data represented by a structure other than a graph structure, and converting the security protocol data into graph security protocol data in which the security protocol is data represented by the graph structure; a verification process for verifying the security of the security protocol by applying a verification rule for verifying the security of the security protocol to the graph security protocol data;

Images