Inspection device, inspection method, and program

Abstract

To provide an inspection device, an inspection method, and a program that can certify reliability of software while obfuscating the software.SOLUTION: In an inspection device, an identifying unit identifies a plurality of code blocks included in software to be inspected. An inspection unit executes inspection processing on a backdoor for the plurality of the code blocks identified by the identifying unit. An adjustment processing unit executes adjustment processing including obfuscation processing on the software to be inspected. A certificate generation unit generates a first certificate containing at least information on a result of the inspection processing. An output unit outputs the software to be inspected on which the adjustment processing has been performed together with the first certificate.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a backdoor inspection device, a backdoor inspection method, and a computer-readable medium. [Background technology]

[0002] Infrastructures and corporate systems are becoming more complex. For this reason, infrastructures and corporate systems are no longer composed of devices from a single company, but are built by procuring devices from various companies and combining them.

[0003] However, in recent years, many incidents have been reported in which hidden functions that users are not aware of or do not expect have been discovered in both the software (firmware) and hardware of these devices. That is, many incidents related to "backdoors" have been reported. A "backdoor" can be defined as a function that is incorporated as part of software that includes multiple functions and that is not known to and is not desired by the user.

[0004] A method for detecting a specific type of backdoor is disclosed in, for example, Non-Patent Document 1. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] F. Schuster and T. Holz, “Towards reducing the attack surface of software backdoors,” In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security (CCS), 2013. Summary of the Invention [Problem to be solved by the invention]

[0006] The present inventors have found that, for example, there is a need for device manufacturers of devices in which software is installed to prove that the software does not include a backdoor, and that there is a need to obfuscate the software installed in the device from the viewpoint of intellectual property protection. That is, the present inventors have found that there is a need to both prove the reliability of software and obfuscate the software. Note that the obfuscation process includes, for example, a process of encrypting the software or a process of embedding dummy code in the software.

[0007] An object of the present disclosure is to provide a backdoor inspection device, a backdoor inspection method, and a computer-readable medium that can achieve both software authenticity proof and software obfuscation. [Means for solving the problem]

[0008] The backdoor inspection device according to the first aspect includes: an identification unit that identifies a plurality of code blocks included in software to be inspected; a testing means for testing each identified code block for a backdoor; A processing means for executing an adjustment process including an obfuscation process on the software; a certificate generating means for generating a first certificate including at least result information of the inspection process; an output means for outputting the software that has been subjected to the adjustment process together with the first certificate; Equipped with:

[0009] A backdoor inspection method according to a second aspect includes identifying a plurality of code blocks included in software to be inspected; running a backdoor test on each identified block of code; performing a conditioning process on the software, the conditioning process including an obfuscation process; generating a first certificate including at least result information of the inspection process; and outputting the adjusted software together with the first certificate; Includes.

[0010] A non-transitory computer-readable medium according to a third aspect includes: identifying a plurality of code blocks included in software to be inspected; running a backdoor test on each identified block of code; performing a conditioning process on the software, the conditioning process including an obfuscation process; generating a first certificate including at least result information of the inspection process; and outputting the adjusted software together with the first certificate; The program that causes the backdoor inspection device to execute the process including the steps described above is stored. Effect of the Invention

[0011] The present disclosure makes it possible to provide a backdoor inspection device, a backdoor inspection method, and a computer-readable medium that can achieve both software authenticity proof and software obfuscation. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram showing an example of a backdoor inspection device in a first embodiment. FIG. [Diagram 2] FIG. 11 is a block diagram showing an example of a backdoor inspection device in a second embodiment. [Diagram 3] 10 is a flowchart showing an example of a processing operation of the backdoor inspection device in the second embodiment. [Figure 4] FIG. 13 is a block diagram showing an example of a determination unit in the third embodiment. [Diagram 5] FIG. 1 is a diagram illustrating a control flow graph. [Figure 6]FIG. 2 is a diagram illustrating an example of a hardware configuration of a backdoor inspection device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment will be described with reference to the drawings. In the embodiments, the same or equivalent elements are denoted by the same reference numerals, and duplicated explanations will be omitted.

[0014] First Embodiment Fig. 1 is a block diagram showing an example of a backdoor inspection device in the first embodiment. The backdoor inspection device 10 shown in Fig. 1 is installed in, for example, a certification agency for use. The backdoor inspection device 10 receives software transmitted from, for example, an equipment manufacturer. This software is the object of inspection, and may be simply referred to as "target software" below. The target software may be source code before compilation, or may be binary code after compilation.

[0015] In FIG. 1, the backdoor inspection device 10 includes an identification unit 11, an inspection unit 12, an adjustment processing unit 13, a certificate generation unit 14, and an output unit 15.

[0016] The identification unit 11 identifies a plurality of "code blocks" included in the target software. The "code blocks" may be, for example, functional blocks corresponding to functions included in the target software, or basic blocks that are smaller units than functional blocks.

[0017] The inspection unit 12 performs an inspection process for a backdoor on each code block identified by the identification unit 11. Here, it is technically difficult to perform an inspection process on the target software after the obfuscation process. However, since the inspection unit 12 performs an inspection process on the target software before the "obfuscation process" is performed, the inspection process can be performed reliably.

[0018] The adjustment processing unit 13 executes an "adjustment process" including an "obfuscation process" on the target software. As described above, the "obfuscation process" includes a process of encrypting the target software or a process of embedding dummy code in the target software. Note that the adjustment processing unit 13 may execute the adjustment process when the inspection process gives a result that the target software does not have a code block that is a backdoor, and may execute the adjustment process when the inspection process gives a result that the target software has a code block that is a backdoor.

[0019] The certificate generation unit 14 generates a certificate (hereinafter, sometimes referred to as a "first certificate") that includes at least the result information of the inspection process. The result information of the inspection process includes, for example, information indicating whether or not a code block that is a backdoor exists in the target software.

[0020] The output unit 15 outputs the target software that has been subjected to the adjustment process together with the first certificate. As a result, the software that has been subjected to the adjustment process and the first certificate are transmitted together to, for example, the device manufacturer.

[0021] The above-described configuration of the backdoor inspection device 10 makes it possible to both prove the authenticity of software and obfuscate the software. Incidentally, if an equipment manufacturer obfuscates the target software after receiving a certificate for the target software, the certificate becomes meaningless. In contrast, the backdoor inspection device 10 can both prove the authenticity of software and obfuscate the software, so such a problem does not occur.

[0022] The backdoor inspection device 10 executes a backdoor inspection method, which includes identifying a plurality of code blocks included in software to be inspected, executing an inspection process for a backdoor on each of the identified code blocks, executing an adjustment process including an obfuscation process on the software, generating a first certificate including at least result information of the inspection process, and outputting the software that has been subjected to the adjustment process together with the first certificate.

[0023] <Second embodiment> The second embodiment relates to a more specific embodiment.

[0024] <Example of the configuration of a backdoor inspection device> Fig. 2 is a block diagram showing an example of a backdoor inspection device in the second embodiment. In Fig. 2, the backdoor inspection device 20 includes an identification unit 11, an inspection unit 12, an adjustment processing unit 13, an output unit 15, a hash value calculation unit 21, and a certificate generation unit 22.

[0025] The hash value calculation unit 21 calculates a hash value of the target software that has been subjected to the adjustment process by the adjustment processing unit 13.

[0026] The certificate generation unit 22 generates a first certificate including result information of the inspection process and the hash value calculated by the hash value calculation unit 21. For example, when the inspection process by the inspection unit 12 is completed, the certificate generation unit 22 generates a certificate (hereinafter, sometimes referred to as a "second certificate") including result information of the inspection process. Then, when the hash value is calculated by the hash value calculation unit 21, the certificate generation unit 22 generates a first certificate by adding the hash value to the second certificate. That is, the first certificate in the second embodiment includes the inspection result and the hash value as information linking the inspection result to the target software after the adjustment process.

[0027] <Example of backdoor inspection device operation> An example of the processing operation of the backdoor inspection device 20 having the above configuration will be described. Fig. 3 is a flowchart showing an example of the processing operation of the backdoor inspection device in the second embodiment. The processing flow shown in Fig. 3 starts, for example, when the backdoor inspection device 20 receives the target software.

[0028] The identification unit 11 in the backdoor inspection device 20 identifies a plurality of code blocks included in the target software (step S101).

[0029] The inspection unit 12 executes an inspection process for a backdoor for each identified code block (step S102).

[0030] Certificate generating unit 22 generates a second certificate including the inspection result (step S103).

[0031] The adjustment processing unit 13 executes the adjustment process on the target software (step S104).

[0032] The hash value calculation unit 21 calculates a hash value of the target software after the adjustment process (step S105).

[0033] Certificate generating unit 22 generates a first certificate by adding the hash value to the second certificate (step S106).

[0034] The output unit 15 outputs the adjusted target software together with the first certificate (step S107).

[0035] According to the second embodiment described above, the hash value calculation unit 21 of the backdoor inspection device 20 calculates a hash value of the target software that has been subjected to the adjustment processing by the adjustment processing unit 13. The certificate generation unit 22 generates a first certificate including result information of the inspection processing and the hash value calculated by the hash value calculation unit 21.

[0036] This configuration of the backdoor inspection device 20 makes it possible to generate a first certificate that includes both result information of the inspection process and a hash value that links the result information to the target software after the adjustment process, thereby improving the reliability of the result information of the inspection process (i.e., the reliability of the first certificate).

[0037] <Modification> <1> The adjustment process may include "processing for adding security functions" by rewriting code together with or instead of the obfuscation process. For example, the adjustment processing unit 13 may embed a "function" that periodically scans the memory of the target software to check for tampering as the "processing for adding security functions" into the target software. Specifically, the adjustment processing unit 13 may add an execution code of the function that checks for tampering to the target software, and rewrite the target software so that the added execution code is called.

[0038] The adjustment process may include, together with or instead of the obfuscation process, a "debug information deletion process" of the debug information included in the target software. The debug information is, for example, function names, variable names, and information associated with lines of source code included in an executable file. For example, when the target software is Linux (registered trademark), the adjustment processing unit 13 may delete these using a strip command.

[0039] <2> The certificate generating unit 22 may also include in the first certificate a signature of an inspection organization in which the backdoor inspection device 20 is disposed. The certificate generating unit 22 may also include in the first certificate a signature of the backdoor inspection device 20. The certificate generating unit 22 may also include in the first certificate a hash value or a name of the target software before the adjustment process is performed. The certificate generating unit 22 may also include in the first certificate a version of the backdoor inspection device 20, an ID of an analyst who performed the analysis using the backdoor inspection device 20, a signature of the analyst, an organization to which the analyst belongs, or a name of the analyst, etc. The certificate generating unit 22 may also include in the first certificate information on the position of the code block that is a backdoor in the target software as result information of the inspection process.

[0040] <Third embodiment> The third embodiment relates to a configuration example of the identifying unit. Fig. 4 is a block diagram showing an example of the identifying unit in the third embodiment. In Fig. 4, the identifying unit 11 includes an identifying processing unit 11A and a structure analysis unit 11B.

[0041] The specific processing unit 11A identifies a "predetermined code block" that corresponds to a "predetermined function" in the target software. The "predetermined function" is, for example, an "interface function," an "authentication function (authentication routine)," and a "command parser function (parser routine)." In other words, the "predetermined function" is a function that is followed by various functions. In other words, the "predetermined function" corresponds to a code block that is the starting point in a control flow graph for the target software.

[0042] The identification processing unit 11A may identify the predetermined code block by using, for example, an "identification rule table (first identification table)" that associates a plurality of predetermined functions with the characteristics of the predetermined code block corresponding to each predetermined function. In this case, the identification processing unit 11A identifies, as the predetermined code block, a portion of the target software that matches the characteristics of each predetermined code block stored in the identification rule table. Alternatively, instead of a table, the identification processing unit 11A may execute one or more algorithms or modules for identifying the predetermined function to identify the predetermined code block.

[0043] The structure analysis unit 11B analyzes the structure of the target software by tracing the control flow starting from the predetermined code block identified by the identification processing unit 11A, and identifies code blocks corresponding to functions other than the predetermined function. For example, the structure analysis unit 11B creates a control flow graph as shown in FIG. 5 by tracing the control flow starting from the code block of the authentication function identified by the identification processing unit 11A. Then, the structure analysis unit 11B identifies code blocks corresponding to functions other than the predetermined function using an "identification rule table ("second identification table")". The "second identification table" associates the type of the code block that is the starting point with the characteristics of the identified code block that should be identified according to the type. For example, in the "second identification table", the "code block that exists after passing through the authentication routine in the control flow graph" is associated with the "code block of the authentication function" that is the starting code block as the "characteristics of the identified code block". Also, for example, in the "second identification table", the "code block of the command parser function" which is the starting code block is associated with a "function block including a command or function dispatched by the parser" as a "characteristic of the identified code block". In the control flow graph shown in Figure 3, the "code block of the authentication function" and the "identified code block (shown as a circle in Figure 5)" can also be called "nodes". In the control flow graph shown in Figure 5, the arrows correspond to the control flows.

[0044] Then, for example, the inspection unit 12 detects a "path (illegal path)" in the control flow graph created by the structural analysis unit 11B that does not pass through the authentication code block and leads to the code block identified by the structural analysis unit 11B (i.e., the execution part that requires authentication).

[0045] Furthermore, the inspection unit 12 detects, in the control flow graph created by the structure analysis unit 11B, a code block that includes a command (or a function) that is not described in the specifications.

[0046] <Other embodiments> FIG. 6 is a diagram showing an example of a hardware configuration of a backdoor inspection device. In FIG. 6, the backdoor inspection device 100 has a processor 101 and a memory 102. The processor 101 may be, for example, a microprocessor, a micro processing unit (MPU), or a central processing unit (CPU). The processor 101 may include a plurality of processors. The memory 102 is configured by a combination of a volatile memory and a non-volatile memory. The memory 102 may include a storage located away from the processor 101. In this case, the processor 101 may access the memory 102 via an I / O interface not shown.

[0047] The backdoor inspection devices 10 and 20 of the first and second embodiments may each have the hardware configuration shown in FIG. 6. The identifying unit 11, the inspection unit 12, the adjustment processing unit 13, the certificate generating units 14 and 22, the output unit 15, and the hash value calculating unit 21 of the backdoor inspection devices 10 and 20 of the first and second embodiments may be realized by the processor 101 reading and executing a program stored in the memory 102. The program can be stored using various types of non-transitory computer readable media and supplied to the backdoor inspection devices 10 and 20. Examples of the non-transitory computer readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives) and magneto-optical recording media (e.g., magneto-optical disks). Further, examples of the non-transitory computer readable media include CD-ROMs (Read Only Memory), CD-Rs, and CD-R / Ws. Further, examples of the non-transitory computer readable media include semiconductor memories. The semiconductor memory includes, for example, a mask ROM, a programmable ROM (PROM), an erasable PROM (EPROM), a flash ROM, and a random access memory (RAM). The program may also be provided to the backdoor inspection devices 10 and 20 by various types of transitory computer readable media. Examples of the transitory computer readable media include an electric signal, an optical signal, and an electromagnetic wave. The transitory computer readable medium can provide the program to the backdoor inspection devices 10 and 20 via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

[0048] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention. [Explanation of symbols]

[0049] 10 Backdoor inspection device 11 Specific section 11A Specific Processing Unit 11B Structural Analysis Department 12 Inspection Department 13 Adjustment processing section 14 Certificate Generation Unit 15 Output section 20 Backdoor Inspection Device 21 Hash value calculation unit 22 Certificate Generation Unit

Claims

1. A testing means for testing the presence or absence of a backdoor in the software; A processing means for generating first information in which an obfuscating process has been executed on the software; generating means for generating a certificate including second information indicative of a result of the inspection; an output means for outputting the first information together with the certificate; An inspection device comprising:

2. The inspection means inspects the code block of the software for the presence or absence of a backdoor.

2. The inspection device according to claim 1.

3. A calculation unit for calculating a hash value of the first information is further provided, the generating means generates the certificate including the second information and the hash value.

3. The inspection device according to claim 1 or 2.

4. The generating means adds the hash value to the first information.

4. The inspection device according to claim 3.

5. the processing means further adds a process indicating a security function to the software, and the first information includes the process indicating the security function. The inspection device according to any one of claims 1 to 4.

6. the processing means includes a process of deleting debug information included in the software; The inspection device according to any one of claims 1 to 5.

7. the processing means creates the first information if the software does not have a backdoor, and does not create the first information if the software has a backdoor; 2. The inspection device according to claim 1.

8. 1. A computer implemented inspection method comprising: Checking for backdoors in software; creating first information in which an obfuscating process has been performed on the software; generating a certificate including second information indicative of a result of the inspection; and outputting the first information together with the certificate; The inspection method includes:

9. Checking for backdoors in software; creating first information in which an obfuscating process has been performed on the software; generating a certificate including second information indicative of a result of the inspection; and outputting the first information together with the certificate; A program that causes a computer to execute a process including the steps of:

Images