Information processing apparatus, information processing method, and information processing system

Abstract

To provide an information processor, an information processing method and an information processing system for narrowing down software which may be affected by new vulnerability when the new vulnerability is found, and for reducing man-hours.SOLUTION: An information processing device 10 includes a vulnerability registration unit 14 that registers identification means for identifying software and vulnerability information which is information for classifying vulnerability of the software in association with each other, and a vulnerability information collation unit 16 that collates, when vulnerability is newly found, the vulnerability information on the newly found vulnerability with the vulnerability information registered in the vulnerability registration unit 14, and narrows down a range in which an influence on the newly found vulnerability is investigated in the registered software based on a collation result.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, an information processing system, etc. In particular, the present invention relates to an information processing device, an information processing method, an information processing system, etc. that can be suitably used when a new vulnerability in software is discovered and the impact of the newly discovered vulnerability is investigated. [Background technology]

[0002] In software development, for example, static analysis tools are used to check for vulnerabilities. This is a method of analyzing software source code to detect vulnerabilities that are susceptible to attack.

[0003] Patent Document 1 discloses an attack analysis device including an analysis priority change unit that changes the analysis priority of a target device according to the nature of the target attack when the target device is subjected to a cyberattack. When a plurality of devices included in a target system are treated as a group of target devices, this attack analysis device analyzes the cyberattacks against each device in order according to the analysis priority assigned to each device. The analysis priority is set according to the impact of the cyberattack on each device on the target system when the target device is subjected to a cyberattack. When the target device is subjected to a cyberattack, the analysis priority change unit changes the analysis priority assigned to each device included in the group of target devices, except for the target device that may be subjected to the cyberattack due to the leakage of information held by the target device. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 7427146 Summary of the Invention [Problem to be solved by the invention]

[0005] Not all discovered vulnerabilities are necessarily fixed. For example, there are cases where the risk of exploitation is deemed low under certain conditions and the software is released without being fixed, for the following reasons: the software containing the vulnerability is not exposed to externally accessible parts, or the vulnerable function is not currently being used. It is desirable to continue managing these vulnerabilities even after the software is released and to review their impact whenever a new vulnerability is discovered. However, reviewing the impact of every vulnerability every time one is discovered would require an enormous amount of man-hours. The present invention aims to provide an information processing device, an information processing method, and an information processing system that, when a new vulnerability is discovered, can narrow down the software that may be affected by the new vulnerability and reduce the amount of work required. [Means for solving the problem]

[0006] In order to solve the above problems, the present invention provides an information processing device including: an identification means for identifying software; a registration unit that associates and registers vulnerability information, which is information for classifying vulnerabilities in the software; a comparison unit that, when a new vulnerability is discovered, compares the vulnerability information about the newly discovered vulnerability with the vulnerability information registered in the registration unit; and a narrowing unit that, based on the comparison result by the comparison unit, narrows down the scope of investigation of the impact of the newly discovered vulnerability among the registered software. In this case, it is possible to provide an information processing device that, when a new vulnerability is discovered, can narrow down the software that the new vulnerability may affect, thereby reducing the number of processes.

[0007] Here, for example, the vulnerability information registered in the registration unit is given to parts of the software that are thought to have little impact from vulnerabilities. In this case, when a new vulnerability is discovered, the impact can be verified without modifying parts of the software that are thought to have little impact from vulnerabilities. Furthermore, for example, a part of software that is considered to have a small impact on the system due to vulnerabilities is at least one of a part that is not accessible from the outside and a part that corresponds to an unused function. In this case, it is possible to select a more appropriate part of software that is considered to have a small impact on the system due to vulnerabilities. Furthermore, for example, the registration unit may further associate and register information indicating parts of the software that are considered to have little impact from vulnerabilities, making it possible to identify parts to verify the impact when a new vulnerability is discovered. The registration unit then further associates and registers information on whether the vulnerability has already been fixed, for example. In this case, it is possible to know whether the vulnerability has been fixed. Furthermore, for example, the registration unit may leave the vulnerability even if it has been fixed, rather than deleting it, so that a history of the vulnerability being addressed can be recorded. Furthermore, for example, when the vulnerability information has a hierarchical structure, the matching unit performs matching according to the hierarchical structure, which makes the matching result more accurate. Furthermore, for example, the matching unit may perform matching on vulnerability information in the upper layer of the hierarchical structure, as well as matching on vulnerability information in the lower layer. In this case, matching can be performed more appropriately.

[0008] The present invention also provides an information processing method in which, by having a processor execute a program recorded in memory, an identification means for identifying software and vulnerability information, which is information for classifying vulnerabilities in the software, are associated and registered, and when a new vulnerability is discovered, the vulnerability information for the newly discovered vulnerability is compared with the registered vulnerability information, and the comparison result is used to narrow down the scope of investigation into the impact of the newly discovered vulnerability among the registered software.In this case, when a new vulnerability is discovered, it is possible to provide an information processing method that narrows down the software that the new vulnerability may affect, thereby reducing the amount of work required.

[0009] Furthermore, the present invention provides an information processing system including an information processing device that analyzes software vulnerabilities and a terminal device that provides software to the information processing device, wherein the information processing device includes an identification means for identifying software and a registration unit that associates and registers vulnerability information that is information for classifying vulnerabilities in the software, a comparison unit that, when a new vulnerability is discovered, compares the vulnerability information for the newly discovered vulnerability with the vulnerability information registered in the registration unit, and a narrowing unit that, based on the comparison result by the comparison unit, narrows down the scope of investigation of the impact of the newly discovered vulnerability among the registered software. In this case, it is possible to provide an information processing system that, when a new vulnerability is discovered, narrows down the software that the new vulnerability may affect, thereby reducing labor costs. [Effects of the Invention]

[0010] According to the present invention, it is possible to provide an information processing device, an information processing method, and an information processing system that, when a new vulnerability is discovered, can narrow down the software that may be affected by the new vulnerability and reduce labor costs. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of the overall configuration of an information processing system. [Figure 2] FIG. 1 is a block diagram showing a functional configuration of an information processing apparatus according to an embodiment. [Figure 3] FIG. 1 is a diagram illustrating the operation of an information processing device. [Figure 4] 10 is a flowchart showing a first operation example of the information processing device. [Figure 5] 10 is a flowchart showing a second operation example of the information processing device. [Figure 6] FIG. 2 is a diagram illustrating a data structure of a vulnerability management DB. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0013] <Explanation of the overall information processing system> FIG. 1 is a diagram showing an example of the overall configuration of an information processing system 1. As shown in FIG. As shown in the figure, the information processing system 1 of this embodiment is connected via a network 40 to an information processing device 10 for analyzing software vulnerabilities and terminal devices 30a to 30c that are operated by users and provide software to the information processing device 10.

[0014] The information processing device 10 is a server computer that manages the entire information processing system 1. The information processing device 10 can be, for example, a cloud server that provides a service for analyzing software vulnerabilities on the cloud. As will be described in detail later, the information processing device 10 analyzes the source code of the software and detects vulnerabilities that are susceptible to attack. Although the information processing device 10 shown in the figure is one, its functions may be realized by a plurality of server computers.

[0015] The terminal devices 30a to 30c are computer devices owned by users. The terminal devices 30a to 30c are, for example, computer devices such as general-purpose personal computers (PCs), mobile computers, mobile phones, smartphones, and tablets. The terminal devices 30a to 30c run various application software under the management of an OS (Operating System). In this case, the users are, for example, software developers. The terminal devices 30a to 30c upload software from the users to the information processing device 10, and the information processing device 10 analyzes vulnerabilities in this software. Note that, hereinafter, when there is no need to distinguish between the terminal devices 30a to 30c, they may be simply referred to as "terminal devices 30." Also, although three terminal devices 30 are shown in FIG. 1, the number may be any number greater than or equal to one.

[0016] The information processing device 10 and the terminal device 30 include a processor such as a CPU (Central Processing Unit) as a computing means, a main memory as a storage means, and a storage. The processor executes various software such as an OS (operating system) and an application program (application software). The main memory is a storage area for storing various software and data used for executing the software. The storage is a storage area for storing input data for the various software and output data from the various software.

[0017] The network 40 is a communication means used for information communication between the information processing device 10 and the terminal device 30, and is, for example, the Internet, a local area network (LAN), or a wide area network (WAN). The communication line used for information communication may be wired or wireless, or a combination of these may be used. Furthermore, the information processing device 10 and the terminal device 30 may be connected via multiple networks or communication lines using a relay device such as a gateway device or a router.

[0018] <Description of the configuration of the information processing device 10> FIG. 2 is a block diagram showing the functional configuration of the information processing device 10 according to this embodiment. The illustrated information processing device 10 includes a communication unit 11, an analysis result acquisition unit 12, a software information acquisition unit 13, a vulnerability registration unit 14, a vulnerability information acquisition unit 15, a vulnerability information matching unit 16, a result output unit 17, a vulnerability information DB (Data Base) 18, a product information DB 19, and a vulnerability management DB 20.

[0019] The communication unit 11 communicates with the terminal device 30 via the network 40. Specifically, the communication unit 11 receives software data when uploading software from the terminal device 30 to the information processing device 10. The communication unit 11 also transmits vulnerability analysis results from the information processing device 10 to the terminal device 30. The communication unit 11 is, for example, a communication interface (I / F). A vulnerability is a security weakness in software. The analysis result acquisition unit 12 analyzes software vulnerabilities and acquires the analysis results 22 .

[0020] The software information acquisition unit 13 acquires the uploaded software. The uploaded software is then stored as software information 21 in the vulnerability management DB 20. The software information 21 also includes an ID assigned to the software.

[0021] The vulnerability registration unit 14 is an example of a registration unit, and registers an identification means for identifying software and vulnerability information, which is information for classifying vulnerabilities in the software, in association with each other. In this case, the identification means is information for distinguishing software, such as an ID assigned to the software or the name of the software. The vulnerability information is information about software vulnerabilities, including, for example, information about the type of vulnerability, verification methods, and attack techniques. The vulnerability information also includes, for example, CVE (Common Vulnerabilities and Exposures) and CWE (Common Weakness Enumeration). CVE is an ID assigned to each vulnerability. CWE is information indicating which category each vulnerability belongs to. In this example, the vulnerability registration unit 14 registers the software ID or name in association with a CWE number (CWE-ID) 23, which is classification type information.

[0022] The vulnerability information acquisition unit 15 acquires vulnerability information. The vulnerability information can be acquired from a vulnerability countermeasure information database that discloses the vulnerability information. This vulnerability countermeasure information database collects and stores vulnerability countermeasure information that is made public on a daily basis. The vulnerability information matching unit 16 is an example of a matching unit, and when a new vulnerability is discovered, it matches vulnerability information about the newly discovered vulnerability with vulnerability information registered in the registration unit. The vulnerability information matching unit 16 is also an example of a narrowing-down unit, and, as a preliminary step to analysis, narrows down the scope of investigation into the impact of the newly discovered vulnerability among registered software. The result output unit 17 outputs the analysis result 22 obtained by the analysis result acquisition unit 12 .

[0023] The vulnerability information DB 18 stores vulnerability information, i.e., information about the above-mentioned CWE, for example. The product information DB 19 stores information about uploaded software, such as the software's product name, version, upload time, user information, and file names that make up the software. The vulnerability management DB 20 stores information about vulnerabilities in uploaded software. The actual data structure will be described later, but the vulnerability management DB 20 stores software information 21 acquired by the software information acquisition unit 13, analysis results 22 acquired by the analysis result acquisition unit 12, CWE numbers 23, etc.

[0024] <Explanation of Operation of Information Processing Device 10> FIG. 3 is a diagram illustrating the operation of the information processing device 10. In FIG. Here, the first example of operation is illustrated when registering software during development, and the second example of operation is illustrated when investigating the impact of a newly discovered vulnerability while the software is in operation.

[0025] 4 is a flowchart showing a first operation example of the information processing device 10. In FIG. FIG. 4 shows the operation of the information processing device 10 when registering software developed and uploaded by a user. First, the software information acquisition unit 13 acquires the software information 21 (S101). This is performed by the user uploading the software from the terminal device 30 to the communication unit 11 of the information processing device 10. This process corresponds to the process shown in 1A of FIG. 3. However, in this embodiment, the software itself is not necessarily required, as the analysis result 22 for the software is sufficient. Therefore, in this case, the software information 21 is not required, and this step is also unnecessary.

[0026] Next, the analysis result acquisition unit 12 analyzes the vulnerabilities of the acquired software and acquires the analysis result 22 (S102). This process corresponds to the processes shown by 1B and 1C in Fig. 3. That is, the analysis result acquisition unit 12 analyzes the uploaded software using a static analysis tool and acquires the analysis result 22.

[0027] Furthermore, the vulnerability registration unit 14 assigns a CWE number 23 as classification type information to the acquired software based on the analysis result 22 (S103). Note that the vulnerability registration unit 14 may assign the CWE number 23 by means of a generation AI or the like.

[0028] Then, the vulnerability registration unit 14 associates the identification means for identifying the software with the vulnerability information, which is information for classifying vulnerabilities in the software, and registers them in the vulnerability management DB 20 (S104). In this case, the vulnerability registration unit 14 associates and registers the software information 21, the analysis result 22, and the CWE number 23 in the vulnerability management DB 20. This process corresponds to the process shown in 1D of FIG.

[0029] Note that analysis results may be registered repeatedly during development in order to keep a record of "fixed vulnerability information" as a history of "vulnerabilities that have been addressed." Therefore, even for the same software, registration may be made each time a vulnerability is addressed.

[0030] FIG. 5 is a flowchart showing a second operation example of the information processing device 10. FIG. 5 shows the operation of the information processing device 10 when narrowing down the scope of investigation when investigating the impact of a vulnerability newly discovered during the operation of software. First, the vulnerability information acquisition unit 15 acquires vulnerability information about a newly discovered vulnerability (S201). This process corresponds to the process shown in 2A of FIG. Next, the analysis result acquisition unit 12 assigns classification type information to the newly discovered vulnerability (S202). The classification type information is, for example, CWE number 23, and if it is included in the vulnerability information, this is used. The classification type information may also be assigned using a generation AI or the like.

[0031] Furthermore, the vulnerability information comparison unit 16 refers to the vulnerability management DB 20 and determines whether the classification type matches each of the already registered software (S203). In this case, matching is performed for the CWE number 23. This process corresponds to the process shown in 2B of FIG. 3. As a result, if there is a match (Yes in S203), it is added to the output result (S204), and if there is no match (No in S203), it is not added to the output result. S203 to S204 form a loop, which is performed for all software already registered in the vulnerability management DB 20. Then, when the loop of S203 to S204 ends, the result output unit 17 outputs information about the corresponding software (S205). This process corresponds to the process shown in 2C of FIG.

[0032] In the second operation example shown in FIG. 5 , in S203 and S204, the vulnerability information comparison unit 16 compares the vulnerability information about the newly discovered vulnerability with the vulnerability information registered in the registration unit to determine whether they match. If they match, information about the matching software is output in S205. This narrows down the scope of registered software to be investigated for the impact of the newly discovered vulnerability. In other words, if there is no match, it is considered that the newly discovered vulnerability has no impact, and no further analysis is performed on this vulnerability. On the other hand, if there is a match, the newly discovered vulnerability may have an impact. Therefore, it is possible to narrow down registered software to software that may be affected by the newly discovered vulnerability. Reviewing the impact of all vulnerabilities every time a vulnerability is discovered would require an enormous amount of work. In contrast, in this embodiment, when a new vulnerability is discovered, software that may be affected by the new vulnerability is narrowed down. Then, the analysis result acquisition unit 12 performs vulnerability analysis on the narrowed down software. This reduces the amount of work required to analyze software vulnerabilities.

[0033] For commonly known software (OpenSSL, Apache, etc.), vulnerability information (CVE, etc.) is published based on the software name and version information, so vulnerability management can be carried out by managing it using an SBOM (Software Bill of Materials).On the other hand, it is difficult to manage vulnerabilities using SBOM, etc. for in-house developed software (proprietary software). According to the embodiment described above, it is possible to provide an information processing device 10 that can narrow down the software that may be affected by a new vulnerability when a new vulnerability is discovered, even if the software is developed in-house, thereby reducing labor costs.

[0034] Furthermore, when the vulnerability information has a hierarchical structure, the vulnerability information matching unit 16 can perform matching according to the hierarchical structure. This makes the matching result more accurate. For example, when the classification type information has a hierarchical structure (the classification types have a parent-child relationship) as in CWE, this is taken into consideration. In the case of CWE, the higher the layer, the more abstract the vulnerability type is represented, and the lower the layer, the more specific the vulnerability type or individual vulnerability is represented. For example, the vulnerability information matching unit 16 performs matching on vulnerability information in the upper layers of the hierarchical structure, and also on vulnerability information in the lower layers. This makes it possible to perform matching more appropriately.

[0035] <Explanation of the data structure of the vulnerability management DB20> FIG. 6 is a diagram showing the data structure of the vulnerability management DB 20. As shown in FIG. The data structure shown in the figure consists of the following items: #, vulnerability details, affected software, version, fix, file, line, and CWE. "#" is the ID assigned to the software. "Vulnerability details" indicates the details of the vulnerability. "Affected software" and "Version" are the name of the software and its version. "Fix" indicates whether the vulnerability has been fixed or not; "Not yet" indicates that it has not been fixed, and "Fixed" indicates that it has been fixed. "File" is the file that makes up the software. "Line" is the line in the software where the vulnerability exists. "CWE" is CWE number 23.

[0036] The vulnerability management DB 20 registers this information by the vulnerability registration unit 14. In this case, it can be said that the vulnerability registration unit 14 registers an identification means for identifying software (in this case, "#" or "target software") and vulnerability information (in this case, CWE number 23), which is information for classifying vulnerabilities in the software, in association with each other. It can also be said that the vulnerability registration unit 14 registers information on whether the vulnerability has already been fixed (in this case, "fixed") in further association with each other.

[0037] In this way, vulnerabilities are left in place when, for example, the risk of exploitation is determined to be low under certain conditions, as described above. This location is, for example, a location that is not accessible from the outside and corresponds to an unused function. This allows for the selection of a more appropriate target in the software as a location where the impact of a vulnerability is considered to be low. Therefore, it can be said that the vulnerability information (in this case, "CWE") registered by the vulnerability registration unit 14 is assigned to a location in the software where the impact of a vulnerability is considered to be low. This allows for the impact of a new vulnerability to be verified without modifying the location in the software where the impact of a vulnerability is considered to be low. It can also be said that the vulnerability registration unit 14 further associates and registers information (in this case, "Line") indicating the location in the software where the impact of a vulnerability is considered to be low. This allows for the location where the impact of a new vulnerability is verified to be identified when a new vulnerability is discovered.

[0038] The vulnerability registration unit 14 does not delete the vulnerability even if the vulnerability has been fixed. In other words, the vulnerability registration unit 14 does not delete the vulnerability even if the "fix" is "done." This allows a history to be kept that the vulnerability has been dealt with.

[0039] In the above embodiment, the information processing device 10 and the terminal device 30 are separate devices, but they may be integrated into the same device. Also, the information processing device 10 and the terminal device 30 may each be configured as multiple devices.

[0040] <Explanation of information processing method> The processing performed by the information processing device 10 is realized by the cooperation of software and hardware resources. That is, a processor such as a CPU provided in the information processing device 10 loads into a main memory and executes a program that realizes each function of the information processing device 10, thereby realizing each function. Therefore, the processing performed by the information processing device 10 described above can be considered to be an information processing method in which, by having the processor execute a program recorded in memory, an identification means for identifying software and vulnerability information, which is information for classifying vulnerabilities in the software, are associated and registered, and when a new vulnerability is discovered, the vulnerability information for the newly discovered vulnerability is compared with the vulnerability information registered in the registration unit, and the scope of investigation into the impact of the newly discovered vulnerability among the registered software is narrowed down based on the comparison result by the comparison unit. This makes it possible to provide an information processing method that, when a new vulnerability is discovered, narrows down the software that the new vulnerability may affect, thereby reducing the amount of work required.

[0041] The program for realizing this embodiment can be provided not only by communication means but also by being stored on a recording medium such as a CD-ROM.

[0042] Although the present embodiment has been described above, the technical scope of the present invention is not limited to the scope described in the above embodiment. It is clear from the claims that various modifications and improvements to the above embodiment are also included in the technical scope of the present invention. [Explanation of symbols]

[0043] 1...information processing system, 10...information processing device, 11...communication unit, 12...analysis result acquisition unit, 13...software information acquisition unit, 14...vulnerability registration unit, 15...vulnerability information acquisition unit, 16...vulnerability information matching unit, 17...result output unit, 18...vulnerability information DB, 19...product information DB, 20...vulnerability management DB, 21...software information, 22...analysis result, 23...CWE number, 30, 30a to 30c...terminal device, 40...network

Claims

1. a registration unit that associates and registers an identification means for identifying software with vulnerability information that is information for classifying vulnerabilities in the software; a collating unit that, when a new vulnerability is discovered, collates vulnerability information about the newly discovered vulnerability with the vulnerability information registered in the registration unit; a narrowing-down unit that narrows down the scope of investigation into the impact of newly discovered vulnerabilities in registered software based on the collation result by the collation unit; An information processing device comprising:

2. 2. The information processing apparatus according to claim 1, wherein the vulnerability information registered by the registration unit is given to a portion of software that is considered to have a small impact from the vulnerability.

3. 3. The information processing apparatus according to claim 2, wherein the software portion considered to be less susceptible to vulnerability is at least one of a portion that is not accessible from the outside and a portion that corresponds to an unused function.

4. The information processing apparatus according to claim 2 , wherein the registration unit further associates and registers information indicating a portion of the software that is considered to have a small impact on the software due to the vulnerability.

5. The information processing apparatus according to claim 1 , wherein the registration unit further associates and registers information indicating whether the vulnerability has already been fixed.

6. The information processing apparatus according to claim 5 , wherein the registration unit does not delete the vulnerability but leaves it even if the vulnerability has been fixed.

7. The information processing apparatus according to claim 1 , wherein when the vulnerability information has a hierarchical structure, the matching unit performs matching according to the hierarchical structure.

8. The information processing apparatus according to claim 7 , wherein the matching unit performs matching on vulnerability information in an upper layer of the hierarchical structure, and also performs matching on vulnerability information in a lower layer.

9. The processor executes the program stored in the memory. registering an identification means for identifying software and vulnerability information, which is information for classifying vulnerabilities in the software, in association with each other; When a new vulnerability is discovered, the vulnerability information for the newly discovered vulnerability is compared with the registered vulnerability information, Based on the matching results, the scope of research into the impact of newly discovered vulnerabilities in registered software is narrowed down. Information processing methods.

10. an information processing device that analyzes software vulnerabilities; a terminal device that provides software to the information processing device; Equipped with The information processing device includes: a registration unit that associates and registers an identification means for identifying software with vulnerability information that is information for classifying vulnerabilities in the software; a collating unit that, when a new vulnerability is discovered, collates vulnerability information about the newly discovered vulnerability with the vulnerability information registered in the registration unit; a narrowing-down unit that narrows down the scope of investigation into the impact of newly discovered vulnerabilities in registered software based on the collation result by the collation unit; An information processing system comprising:

Images