Determination system, determination method, and program

Abstract

Provided is a determination device and the like which are capable of determining the validity of an inspection of software. This determination system 10 comprises: a first result receiving unit 120 that receives a first inspection result which is the result of a first inspection of the vulnerability of target software; a second result receiving unit 140 that receives a second inspection result which is the result of a second inspection of the vulnerability of the target software; a determining unit 150 that determines the validity of the first inspection from undetected vulnerability which is the vulnerability detected in the result of the second inspection and is not detected in the result of the first inspection; and an output unit 160 that outputs the result of the determination of the validity.

Description

[Technical field]

[0001] The present disclosure relates to a technique for verifying the validity of an inspection. [Background technology]

[0002] With the recent increase in cybercrime, ensuring software security has become increasingly important.

[0003] Patent Document 1 discloses an example of a software inspection method for inspecting whether software is safe or not. In the software inspection method of Patent Document 1, a plurality of pieces of software executed by a first domain are inspected by a second domain that inspects whether the software is safe or not. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] International Publication No. 2008 / 096891 Summary of the Invention [Problem to be solved by the invention]

[0005] Even if software vulnerabilities are inspected, if the inspection is not valid, the safety of the software cannot be ensured. With the technology of Patent Document 1, it is not possible to confirm whether the inspection that was performed is valid.

[0006] One object of the present disclosure is to provide a determination device or the like that can determine the validity of software testing. [Means for solving the problem]

[0007] A determination system according to one embodiment of the present disclosure includes a first result receiving means for receiving a first test result which is the result of a first test of vulnerabilities of a target software, a second result receiving means for receiving a second test result which is the result of a second test of vulnerabilities of the target software, a determination means for determining the validity of the first test based on undetected vulnerabilities which are vulnerabilities detected in the result of the second test but not detected in the result of the first test, and an output means for outputting a result of the validity determination.

[0008] A determination method according to one embodiment of the present disclosure receives a first test result that is a result of a first test of vulnerabilities of a target software, receives a second test result that is a result of a second test of vulnerabilities of the target software, determines the validity of the first test based on undetected vulnerabilities that are vulnerabilities detected in the results of the second test but not detected in the results of the first test, and outputs a result of the determination of the validity.

[0009] A storage medium according to an embodiment of the present disclosure stores a program that causes a computer to execute a first result receiving process for receiving a first test result that is a result of a first test of vulnerabilities of target software, a second result receiving process for receiving a second test result that is a result of a second test of vulnerabilities of the target software, a determination process for determining the validity of the first test from undetected vulnerabilities that are vulnerabilities that are detected in the result of the second test but not detected in the result of the first test, and an output process for outputting a result of the determination of the validity. One embodiment of the present disclosure is also realized by the above-mentioned program. Effect of the Invention

[0010] The present disclosure has an effect of making it possible to determine the validity of software testing. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram illustrating an example of a configuration of a determination system according to a first embodiment of the present disclosure. [Diagram 2]FIG. 2 is a flowchart illustrating an example of the operation of the determination system according to the first embodiment of the present disclosure. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a configuration of a determination system according to the second embodiment of the present disclosure. [Figure 4] FIG. 4 is a block diagram illustrating an example of the operation of the determination system according to the second embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of a hardware configuration of a computer capable of realizing the determination system according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

[0013] <First embodiment> First, a first embodiment of the present disclosure will be described in detail with reference to the drawings.

[0014] <Configuration> FIG. 1 is a block diagram showing an example of the configuration of a determination system according to a first embodiment of the present disclosure. In the example shown in FIG. 1, a determination system 10 of this embodiment includes a first result receiving unit 120, a second result receiving unit 140, a determination unit 150, and an output unit 160. The first result receiving unit 120 receives a first test result that is a result of a first test of vulnerabilities of the target software. The second result receiving unit 140 receives a second test result that is a result of a second test of vulnerabilities of the target software. The determination unit 150 determines the validity of the first test from undetected vulnerabilities that are vulnerabilities that are detected in the result of the second test but not detected in the result of the first test. The output unit 160 outputs a result of the determination of the validity.

[0015] Target software is software that is the subject of vulnerability testing. The first test is a vulnerability test conducted by a testing agency. The testing agency that conducts the first test is referred to as the first testing agency. The second test is a vulnerability test conducted by a testing agency different from the first testing agency. The testing agency that conducts the second test is referred to as the second testing agency. The method of the first test and the method of the second test do not have to be the same. The criteria for determining the severity of a vulnerability (hereafter referred to as severity) are the same for the first test and the second test. The criteria for determining the number of vulnerabilities are also the same for the first test and the second test. The criteria for determining the type of vulnerability are also the same for the first test and the second test.

[0016] The above-mentioned inspection result specifically indicates information on the inspection result, which includes, for example, the date and time of the inspection, a list of information on vulnerabilities detected by the inspection (also referred to as a vulnerability information list), the procedure of the intrusion inspection, etc.

[0017] <First result receiving unit 120> The first result receiving unit 120 receives a result of the first inspection of the target software from a first inspection organization that performs the first inspection (specifically, an information processing device (hereinafter, also referred to as a first device) managed by the first inspection organization). The result of the first inspection is a result of an inspection of the vulnerability of the target software (i.e., the first inspection) performed by the first inspection organization. The first result receiving unit 120 may receive a digital signature of the result of the first inspection in addition to the result of the first inspection. The digital signature of the result of the first inspection is digital data generated by one of various existing methods that certifies that the result of the first inspection was generated by the first inspection organization and has not been tampered with. Specifically, the digital signature of the result of the first inspection is data generated by encrypting a hash value of the electronic data of the result of the first inspection using the private key of the first inspection organization.

[0018] <Second result receiving unit 140> The second result receiving unit 140 receives the result of the second inspection of the target software from a second inspection organization (specifically, an information processing device (hereinafter, also referred to as the second device) managed by the second inspection organization) that performs the second inspection. The result of the second inspection is the result of an inspection of the vulnerability of the target software (i.e., the second inspection) performed by the second inspection organization. In addition to the result of the second inspection, the second result receiving unit 140 may receive a digital signature of the result of the second inspection. The digital signature of the result of the second inspection is electronic data generated by one of various existing methods that certifies that the result of the second inspection was generated by the second inspection organization and has not been tampered with. Specifically, the digital signature of the result of the second inspection is data generated by encrypting a hash value of the electronic data of the result of the second inspection using the private key of the second inspection organization.

[0019] <Judgment section 150> The determination unit 150 compares the result of the first test with the result of the second test, and extracts vulnerabilities that are detected in the result of the second test but not in the result of the first test (hereinafter referred to as undetected vulnerabilities). The determination unit 150 determines the validity of the first test from the extracted undetected vulnerabilities. A specific example of a method for determining the validity of the first test will be described in detail later.

[0020] <Output unit 160> The output unit 160 outputs the result of the validity determination to, for example, a display device or another information processing device, etc. The output unit 160 may output information on the undetected vulnerability (for example, a severity indicating the degree of severity of the undetected vulnerability, a type of the undetected vulnerability, and a description of the undetected vulnerability).

[0021] <Operation> Next, the operation of the determination system according to the first embodiment of the present disclosure will be described in detail with reference to the drawings.

[0022] Fig. 2 is a flowchart showing an example of the operation of the determination system according to the first embodiment of the present disclosure. In the example shown in Fig. 2, the first result receiving unit 120 receives the result of the first test for vulnerabilities of the target software (step S11). The second result receiving unit 140 receives the result of the second test for vulnerabilities of the target software (step S12). Then, the determination unit 150 determines the validity of the first test from undetected vulnerabilities that are detected in the result of the second test but not detected in the result of the first test (step S13). The output unit 160 outputs the result of the validity determination, i.e., the determined validity (step S14).

[0023] <Effects> The present disclosure has an effect of being able to judge the validity of software testing. This is because the judging unit 150 judges the validity of the first testing from undetected vulnerabilities that are detected in the result of the second testing but not in the result of the first testing. Then, the output unit 160 outputs the result of the validity judgment. Thereby, if the second testing is valid, it is possible to know whether the first testing is valid or not.

[0024] <Specific method of judgment> The determining unit 150 may determine the validity of the first check from the number of undetected vulnerabilities.

[0025] Specifically, the determination unit 150 may determine that the first inspection is inappropriate when the total number of undetected vulnerabilities is equal to or greater than a predetermined number, and may determine that the first inspection is appropriate when the total number of undetected vulnerabilities does not exceed the predetermined number. In this case, the determination unit 150 may determine the number of undetected vulnerabilities by subtracting the number of vulnerabilities detected by the first inspection from the number of vulnerabilities detected by the second inspection. The determination unit 150 may identify vulnerabilities that were also detected by the first inspection among the vulnerabilities detected by the second inspection. Then, the determination unit 150 may identify vulnerabilities that were detected by the second inspection and not detected by the first inspection. The determination unit 150 may determine the number of identified vulnerabilities that were detected by the second inspection and not detected by the first inspection as the number of undetected vulnerabilities.

[0026] The determining unit 150 may determine the validity of the first test from the number of undetected vulnerabilities whose severity is higher than the predetermined severity (i.e., undetected vulnerabilities whose severity is higher than the severity indicated by the predetermined severity). Specifically, for example, the determining unit 150 may determine that the first test is not valid when the number of vulnerabilities whose severity is higher than the predetermined severity detected in the second test is smaller than the number of vulnerabilities whose severity is the same as that detected in the first test. Then, the determining unit 150 may determine that the first test is valid when the number of vulnerabilities whose severity is higher than the predetermined severity detected in the second test is not smaller than the number of vulnerabilities whose severity is the same as that detected in the first test. The determining unit 150 may determine whether all of the vulnerabilities whose severity is higher than the predetermined severity detected in the second test were also detected in the first test. The determining unit 150 may determine that the first test is valid when all of the vulnerabilities whose severity is higher than the predetermined severity detected in the second test were also detected in the first test. The determining section 150 may determine that the first test is invalid if at least one or more vulnerabilities detected in the second test and having a severity higher than a predetermined severity were not detected in the first test.

[0027] The determination unit 150 may determine the validity of the first test from the number of undetected vulnerabilities for each severity. In this case, the determination unit 150 may calculate, for each severity, the product of a coefficient corresponding to the severity and the number of vulnerabilities detected by the second test but not detected by the first test, and may set the sum of the calculated products as the score. Then, the determination unit 150 may determine that the first test is valid if the score is smaller than a predetermined score. The determination unit 150 may determine that the first test is invalid if the score is equal to or greater than the predetermined score. In this case, the coefficient corresponding to the severity and the above-mentioned predetermined score may be set so that the score is equal to or greater than the predetermined score if at least one or more vulnerabilities detected in the second test and having a severity higher than the predetermined severity were not detected in the first test.

[0028] The method of determination is not limited to the example described above.

[0029] <Second embodiment> Next, a second embodiment of the present disclosure will be described in detail with reference to the drawings.

[0030] <Configuration> Fig. 3 is a block diagram showing an example of a configuration of a determination system according to a second embodiment of the present disclosure. In the example shown in Fig. 3, the determination system 100 includes a software reception unit 110, a first result receiving unit 120, a software provision unit 130, a second result receiving unit 140, a determination unit 150, and an output unit 160. The determination system 100 is communicatively connected to each of a software provision device 200, a first inspection device 300, a second inspection device 400, and an output destination device 500.

[0031] <Software providing device 200> The software providing device 200 provides the target software and authenticity information of the target software to the software receiving unit 110 of the determination system 100. The software providing device 200 is an information processing device managed by the provider of the target software. The provided target software is data necessary for installing the target software. The target software may be provided in the form of, for example, one file. The authenticity information of the target software is data that proves that the target software has been provided by the provider of the target software and has not been tampered with. The authenticity information of the target software may be data generated by encrypting a hash value of the file of the target software using a private key of the provider of the target software, for example.

[0032] <First inspection device 300> The first inspection device 300 receives the target software and authenticity information of the target software from the software providing unit 130 of the determination system 100. The first inspection device 300 is, for example, a device that performs the above-mentioned first inspection. The first inspection device 300 is, for example, an information processing device managed by an inspection organization (in the following description, the first inspection organization) that performs the first inspection. The first inspection device 300 uses the received authenticity information to verify the authenticity of the target software. In other words, the first inspection device 300 uses the received authenticity information to verify that the target software received from the software providing unit 130 is provided by the provider of the target software and has not been tampered with. If the authenticity information is data generated by encrypting a hash value of the file of the target software using a private key of the provider of the target software, the first inspection device 300 acquires a public key of the provider of the target software. Then, the first inspection device 300 uses the received authenticity information and the acquired public key of the provider of the target software to verify the authenticity of the target software. The method for acquiring the public key of the provider of the target software and the method for verifying the authenticity of the target software using the received authenticity information and the acquired public key of the provider of the target software may be an existing method. If the authenticity of the target software is not verified, the first inspection device 300 does not need to perform the first inspection of the target software.

[0033] The first inspection device 300 performs a first inspection, which is an inspection of vulnerabilities of the target software whose authenticity has been confirmed. The first inspection device 300 generates data representing the result of the first inspection (also simply referred to as the result of the first inspection in the description of this disclosure) and a digital signature of the data representing the result of the first inspection. The first inspection device 300 transmits the result of the first inspection and the digital signature of the result of the first inspection to the first result receiving unit 120 of the determination system 100.

[0034] <Second Inspection Apparatus 400> The second inspection device 400 receives the target software and authenticity information of the target software from the software providing unit 130 of the determination system 100. The second inspection device 400 is, for example, a device that performs the first inspection described above. The second inspection device 400 is, for example, an information processing device managed by an inspection organization (in the following description, the first inspection organization) that performs the second inspection. The second inspection device 400 uses the received authenticity information to verify the authenticity of the target software. In other words, the second inspection device 400 uses the received authenticity information to verify that the target software received from the software providing unit 130 is provided by the provider of the target software and has not been tampered with. If the authenticity information is data generated by encrypting a hash value of the file of the target software using a private key of the provider of the target software, the second inspection device 400 acquires the public key of the provider of the target software. Then, the second inspection device 400 uses the received authenticity information and the acquired public key of the provider of the target software to verify the authenticity of the target software. The method for acquiring the public key of the provider of the target software and the method for verifying the authenticity of the target software using the received authenticity information and the acquired public key of the provider of the target software may be an existing method. If the authenticity of the target software is not verified, the second inspection device 400 does not need to perform the second inspection of the target software.

[0035] The second inspection device 400 performs a second inspection, which is an inspection of vulnerabilities of the target software whose authenticity has been confirmed. The second inspection device 400 generates data representing the result of the second inspection (also simply referred to as the result of the second inspection in the description of this disclosure) and a digital signature of the data representing the result of the second inspection. The second inspection device 400 transmits the result of the second inspection and the digital signature of the result of the second inspection to the second result receiving unit 140 of the determination system 100.

[0036] <Output destination device 500> The destination device 500 receives a result of the determination of the validity of the first test from the output unit 160 of the determination system 100. The destination device 500 may further receive information on undetected vulnerabilities, which are vulnerabilities that were not detected by the first test but were detected by the second test, from the output unit 160 of the determination system 100. The destination device 500 may receive information on vulnerabilities detected by the first test and information on vulnerabilities detected by the second test from the output unit 160 of the determination system 100.

[0037] The destination device 500 is, for example, a display or an information processing device equipped with a display. The destination device 500 may display the received information. The destination device 500 may store the received information.

[0038] <Software reception unit 110> The software reception unit 110 receives the target software and authenticity information of the target software from the software provision device 200. The software reception unit 110 stores the target software and the authenticity information of the target software from the software provision device 200 in the information storage unit 170.

[0039] <Software provision department 130> The software providing unit 130 provides (in other words, transmits) the target software and the authenticity information of the target software stored in the information storage unit 170 to the first inspection device 300. The software providing unit 130 further provides (in other words, transmits) the target software and the authenticity information of the target software stored in the information storage unit 170 to the second inspection device 400.

[0040] <First result receiving unit 120> The first result receiving unit 120 receives the result of the first inspection and the digital signature of the result of the first inspection from the first inspection device 300. The first result receiving unit 120 stores the result of the first inspection and the digital signature of the result of the first inspection received from the first inspection device 300 in the information storage unit 170.

[0041] <Information storage section 170> The information storage unit 170 stores the target software and the authenticity information of the target software stored by the software reception unit 110. The information storage unit 170 may store the target software and the authenticity information of the target software such that the target software and the authenticity information of the target software once stored cannot be changed. Specifically, for example, the information storage unit 170 may reject a request to rewrite, delete, or overwrite the stored target software and the authenticity information of the target software. When the target software and its authenticity information are repeatedly stored, the information storage unit 170 may store the newly stored target software and its authenticity information separately while retaining the target software and its authenticity information already stored.

[0042] The information storage unit 170 further stores the result of the first inspection and the electronic signature of the result of the first inspection stored by the first result receiving unit 120. The information storage unit 170 may store the result of the first inspection and the electronic signature of the result of the first inspection such that the result of the first inspection and the electronic signature of the result of the first inspection cannot be changed once they are stored. Specifically, for example, the information storage unit 170 may reject a request to rewrite the stored result of the first inspection and the electronic signature of the result of the first inspection, a request to delete, and a request to overwrite. When the result of the first inspection and the electronic signature of the result of the first inspection are repeatedly stored, the information storage unit 170 may store the newly stored result of the first inspection and the electronic signature of the result of the first inspection separately while retaining the result of the first inspection and the electronic signature of the result of the first inspection that have already been stored.

[0043] The information storage unit 170 may further store the result of the second inspection and the electronic signature of the result of the second inspection stored by the second result receiving unit 140. The information storage unit 170 may store the result of the second inspection and the electronic signature of the result of the second inspection such that the result of the second inspection and the electronic signature of the result of the second inspection cannot be changed once they are stored. Specifically, for example, the information storage unit 170 may reject a request to rewrite the stored result of the second inspection and the electronic signature of the result of the second inspection to the electronic signature of the result of the second inspection, a request to delete the result, and a request to overwrite the result. When the result of the second inspection and the electronic signature of the result of the second inspection are repeatedly stored, the information storage unit 170 may store the newly stored result of the second inspection and the electronic signature of the result of the second inspection separately while retaining the result of the second inspection and the electronic signature of the result of the second inspection that are already stored.

[0044] The determination system 100 allows addition to the information storage unit 170, but is controlled so that the information stored in the information storage unit 170 cannot be rewritten or deleted. Specifically, for example, the software reception unit 110 may be configured not to change, overwrite, or delete the target software and the authenticity information of the target software stored in the information storage unit 170. The first result reception unit 120 may be configured not to change, overwrite, or delete the result of the first inspection stored in the information storage unit 170. The second result reception unit 140 may be configured not to change, overwrite, or delete the result of the second inspection stored in the information storage unit 170. The information storage unit 170 may be configured not to accept an instruction to rewrite information already stored in the information storage unit 170, an instruction to overwrite information already stored in the information storage unit 170, or an instruction to delete information already stored in the information storage unit 170.

[0045] <Second result receiving unit 140> The second result receiving unit 140 receives the result of the second inspection and the electronic signature of the result of the second inspection from the second inspection device 400. The second result receiving unit 140 sends the result of the second inspection and the electronic signature of the result of the second inspection received from the second inspection device 400 to the determination unit 150. In the example shown in FIG. 4, a line connecting the second result receiving unit 140 and the information storage unit 170 is omitted for simplicity, but the second result receiving unit 140 may store the result of the second inspection and the electronic signature of the result of the second inspection received from the second inspection device 400 in the information storage unit 170.

[0046] <Judgment section 150> The judgment unit 150 reads out the result of the first inspection and the digital signature of the result of the first inspection from the information storage unit 170. The judgment unit 150 uses the digital signature of the result of the first inspection that has been read out to verify that the result of the first inspection has been generated by the first inspection organization and has not been tampered with. If the digital signature of the result of the first inspection is data that has been generated by encrypting the hash value of the result of the first inspection with the private key of the first inspection organization, the judgment unit 150 acquires the public key of the first inspection organization. Then, the judgment unit 150 verifies that the result of the first inspection has been generated by the first inspection organization and has not been tampered with by an existing method that uses the digital signature of the result of the first inspection that has been read out and the public key of the first inspection organization that has been acquired.

[0047] The judgment unit 150 receives the result of the second inspection and the digital signature of the result of the second inspection from the second result receiving unit 140. When the result of the second inspection and the digital signature of the result of the second inspection are stored in the information storage unit 170, the judgment unit 150 may read the result of the second inspection and the digital signature of the result of the second inspection from the information storage unit 170. The judgment unit 150 uses the digital signature of the result of the second inspection that has been read out to verify that the result of the second inspection has been generated by the second inspection organization and has not been tampered with. When the digital signature of the result of the second inspection is data that has been generated by encrypting the hash value of the result of the second inspection with the private key of the second inspection organization, the judgment unit 150 acquires the public key of the second inspection organization. Then, the judgment unit 150 verifies that the result of the second inspection has been generated by the second inspection organization and has not been tampered with by an existing method using the digital signature of the result of the second inspection that has been read out and the public key of the second inspection organization that has been acquired.

[0048] When it is confirmed that the result of the first test is generated by the first test organization and has not been tampered with, and the result of the second test is generated by the second test organization and has not been tampered with, the determination unit 150 determines the validity of the first test from undetected vulnerabilities that are vulnerabilities that are detected in the result of the second test but not detected in the result of the first test. The method of determining the validity of the first test in this embodiment may be the same as the method of determining the validity of the first test in the first embodiment.

[0049] The determination section 150 sends the result of the determination of the validity of the first check to the output section 160.

[0050] In the process of determining the validity of the first test, the determination unit 150 identifies information on the vulnerability detected by the first test and information on the vulnerability detected by the second test. The determination unit 150 may send the information on the vulnerability detected by the first test and information on the vulnerability detected by the second test to the output unit 160.

[0051] In the process of determining the validity of the first test, the determination unit 150 identifies an undetected vulnerability that is not detected by the first test but is detected by the second test. The determination unit 150 may send information on the undetected vulnerability to the output unit 160.

[0052] <Output unit 160> The output section 160 receives the result of the determination of the validity of the first check from the determination section 150. In this case, the output section 160 outputs the result of the determination of the validity of the first check received from the determination section 150 to the output destination device 500.

[0053] The output unit 160 may receive information on an undetected vulnerability, which is a vulnerability that is not detected by the first test but is detected by the second test, from the determination unit 150. In this case, the output unit 160 outputs the information on the undetected vulnerability received from the determination unit 150 to the output destination device 500.

[0054] The output unit 160 may receive information on vulnerabilities detected by the first inspection and information on vulnerabilities detected by the second inspection from the determination unit 150. In this case, the output unit 160 outputs the information on vulnerabilities detected by the first inspection and the information on vulnerabilities detected by the second inspection received from the determination unit 150 to the output destination device 500, for example, in a format that allows both pieces of information to be compared.

[0055] <Operation> FIG. 4 is a block diagram illustrating an example of the operation of the determination system according to the second embodiment of the present disclosure.

[0056] In the example shown in FIG. 4, first, the software reception unit 110 receives the target software from the software providing device 200 (step S101). In step S101, the software reception unit 110 may receive the target software and authenticity information of the target software. The software reception unit 110 stores the received target software and authenticity information of the target software in the information storage unit 170. The information storage unit 170 stores the target software (step S102). Specifically, the information storage unit 170 stores the target software and the authenticity information of the target software stored by the software reception unit 110.

[0057] Next, the software providing unit 130 provides the target software to the first inspection device 300 (step S103). Specifically, the software providing unit 130 reads the target software and authenticity information of the target software from the information storage unit 170, and provides the read target software and authenticity information of the target software to the first inspection device 300.

[0058] The first result receiving unit 120 receives the result of the first test of the target software from the first test device 300 (step S104). In step S104, the first result receiving unit 120 receives the result of the first test of the target software and the electronic signature of the result of the first test of the target software from the first test device 300. Then, the first result receiving unit 120 stores the received result of the first test of the target software and the electronic signature of the result of the first test of the target software in the information storage unit 170. The information storage unit 170 memorizes the result of the first test of the target software (specifically, the result of the first test of the target software and the electronic signature of the result of the first test of the target software) stored by the first result receiving unit 120 (step S105).

[0059] Next, the software providing unit 130 provides the target software to the second inspection device 400 (step S106). In step S106, the software providing unit 130 reads the target software and authenticity information of the target software from the information storage unit 170, and provides the read target software and authenticity information of the target software to the second inspection device 400.

[0060] The second result receiving unit 140 receives the result of the second inspection of the target software from the second inspection device 400 (step S107). In step S107, the second result receiving unit 140 may receive the result of the second inspection of the target software and the electronic signature of the result of the second inspection of the target software from the second inspection device 400. The second result receiving unit 140 sends the received result of the second inspection of the target software and the electronic signature of the result of the second inspection of the target software to the determination unit 150. The second result receiving unit 140 may further store the received result of the second inspection of the target software and the electronic signature of the result of the second inspection of the target software in the information storage unit 170.

[0061] The determination unit 150 reads out the result of the first inspection of the target software and the electronic signature of the result of the first inspection of the target software from the information storage unit 170. The determination unit 150 further receives the result of the second inspection of the target software and the electronic signature of the result of the second inspection of the target software from the second result receiving unit 140. The determination unit 150 may read out the result of the second inspection of the target software and the electronic signature of the result of the second inspection of the target software from the information storage unit 170.

[0062] The determination unit 150 compares the result of the first check with the result of the second check (step S108). Then, the determination unit 150 determines the validity of the first check (step S109). The determination unit 150 sends the result of the determination of the validity of the first check to the output unit 160.

[0063] Then, the output section 160 outputs the result of the determination of the validity of the first check (step S110).

[0064] <Effects> This embodiment has the same effects as the first embodiment, for the same reasons that the effects of the first embodiment are obtained.

[0065] <Other embodiments> The determination system 10 of the first embodiment and the determination system 100 of the second embodiment can be realized by a computer including a processor that executes a program loaded into a memory. The determination system 10 and the determination system 100 can also be realized by dedicated hardware. The determination system 10 and the determination system 100 can also be realized by a combination of the above-mentioned computer and dedicated hardware.

[0066] FIG. 5 is a diagram illustrating an example of a hardware configuration of a computer 1000 that can realize a determination system according to an embodiment of the present disclosure. In the example illustrated in FIG. 5, the computer 1000 includes a processor 1001, a memory 1002, a storage device 1003, and an I / O (Input / Output) interface 1004. The computer 1000 can also access a storage medium 1005. The memory 1002 and the storage device 1003 are, for example, storage devices such as a RAM (Random Access Memory) and a hard disk. The storage medium 1005 is, for example, a storage device such as a RAM or a hard disk, a ROM (Read Only Memory), or a portable storage medium. The storage device 1003 may be the storage medium 1005. The processor 1001 can read and write data and programs from and to the memory 1002 and the storage device 1003. The processor 1001 can access, for example, the software providing device 200, the first inspection device 300, the second inspection device 400, and the output destination device 500 via the I / O interface 1004. The processor 1001 can access a storage medium 1005. The storage medium 1005 stores a program that causes the computer 1000 to operate as a determination system according to an embodiment of the present disclosure.

[0067] The processor 1001 loads a program stored in the storage medium 1005, which causes the computer 1000 to operate as a determination system according to an embodiment of the present disclosure, into the memory 1002. The processor 1001 then executes the program loaded into the memory 1002, causing the computer 1000 to operate as the determination system according to an embodiment of the present disclosure.

[0068] The software reception unit 110, the first result receiving unit 120, the software provision unit 130, the second result receiving unit 140, the determination unit 150, and the output unit 160 can be realized, for example, by a processor 1001 that executes a program loaded into a memory 1002. The information storage unit 170 can be realized by a memory 1002 or a storage device 1003 such as a hard disk device included in the computer 1000. Some or all of the software reception unit 110, the first result receiving unit 120, the software provision unit 130, the second result receiving unit 140, the determination unit 150, the output unit 160, and the information storage unit 170 can be realized by a dedicated circuit that realizes the function of each unit.

[0069] Furthermore, some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0070] (Appendix 1) a first result receiving unit that receives a first test result that is a result of a first test of vulnerabilities of the target software; a second result receiving unit that receives a second test result that is a result of a second test of vulnerabilities of the target software; a determination unit that determines the validity of the first inspection based on an undetected vulnerability that is a vulnerability that is detected in a result of the second inspection but not detected in a result of the first inspection; an output unit that outputs a result of the validity determination; A determination system comprising:

[0071] (Appendix 2) The determination unit determines the validity based on the number of undetected vulnerabilities. 2. The determination system according to claim 1.

[0072] (Appendix 3) The determining unit determines the validity based on the number of the undetected vulnerabilities whose severity level is higher than a predetermined severity level. 3. The determination system according to claim 2.

[0073] (Appendix 4) The determination unit determines the validity based on the number of the undetected vulnerabilities for each severity level. 4. The determination system according to claim 3.

[0074] (Appendix 5) The determination unit determines the validity based on the number of undetected vulnerabilities for each type. 5. A determination system according to any one of claims 1 to 4.

[0075] (Appendix 6) an information storage unit that stores the target software and authenticity information of the target software; a software providing unit that provides the target software and the authenticity information to a first inspection device that performs the first inspection and a second inspection device that performs the second inspection; a first result receiving unit that receives the result of the first inspection and a digital signature of the result of the first inspection from the first inspection device, and stores the result of the first inspection and the digital signature of the result of the first inspection in the information storage unit; a second result receiving unit that receives a result of the second inspection and a digital signature of the result of the second inspection from the second inspection device; an output unit that outputs a result of the validity determination; Equipped with the information storage unit stores the first test result in such a manner that the stored first test result cannot be changed; The output unit further outputs information about the undetected vulnerability. 6. A determination system according to any one of claims 1 to 5.

[0076] (Appendix 7) receiving a first test result, which is a result of a first test of vulnerabilities in the target software; receiving a second test result, the second test result being a result of a second test of vulnerabilities of the target software; determining the validity of the first inspection based on an undetected vulnerability that is a vulnerability detected in a result of the second inspection but not detected in a result of the first inspection; outputting a result of the determination of validity; Judgment method.

[0077] (Appendix 8) The validity is determined based on the number of undetected vulnerabilities. The determination method described in Appendix 7.

[0078] (Appendix 9) The validity is determined based on the number of the undetected vulnerabilities whose severity level is higher than a predetermined severity level. The determination method described in Appendix 8.

[0079] (Appendix 10) The validity is determined based on the number of the undetected vulnerabilities for each severity level. The determination method described in Appendix 9.

[0080] (Appendix 11) The validity is determined based on the number of undetected vulnerabilities by type. A method for determining whether or not a substance is soluble in water.

[0081] (Appendix 12) storing the target software and authenticity information of the target software in an information storage unit; providing the target software and the authenticity information to a first inspection device that performs the first inspection and a second inspection device that performs the second inspection; receiving a result of the first inspection and a digital signature of the result of the first inspection from the first inspection device, and storing the received result of the first inspection and the digital signature of the result of the first inspection in the information storage unit; receiving from the second inspection device a result of the second inspection and a digital signature of the result of the second inspection; outputting a result of the validity determination; storing the first test result so that the stored first test result cannot be changed; Further output information on the undetected vulnerability A method for determining whether or not a substance is soluble in water.

[0082] (Appendix 13) a first result receiving process for receiving a first test result which is a result of a first test of vulnerabilities of the target software; A second result receiving process for receiving a second test result which is a result of a second test of the vulnerability of the target software; a determination process for determining the validity of the first inspection based on an undetected vulnerability that is a vulnerability detected in a result of the second inspection but not detected in a result of the first inspection; an output process for outputting a result of the validity determination; A storage medium that stores a program that causes a computer to execute the above.

[0083] (Appendix 14) The determination process determines the validity based on the number of undetected vulnerabilities. 14. A storage medium as described in claim 13.

[0084] (Appendix 15) The determination process determines the validity from the number of the undetected vulnerabilities whose severity level is higher than a predetermined severity level. 15. A storage medium as described in claim 14.

[0085] (Appendix 16) The determination process determines the validity based on the number of the undetected vulnerabilities for each severity level. 16. The storage medium of claim 15.

[0086] (Appendix 17) The determination process determines the validity based on the number of undetected vulnerabilities for each type. 17. A storage medium according to any one of appendixes 13 to 16.

[0087] (Appendix 18) an information storage process for storing the target software and authenticity information of the target software in an information storage unit; a software providing process for providing the target software and the authenticity information to a first inspection device that performs the first inspection and a second inspection device that performs the second inspection; a first result receiving process for receiving a result of the first inspection and a digital signature of the result of the first inspection from the first inspection device, and storing the received result of the first inspection and the digital signature of the result of the first inspection in the information storage unit; a second result receiving process for receiving a result of the second inspection and a digital signature of the result of the second inspection from the second inspection device; an output process for outputting a result of the validity determination; Run the following on your computer: The information storage process stores the first test result so that the stored first test result cannot be changed; The output process further outputs information on the undetected vulnerability. 18. A storage medium according to any one of appendixes 13 to 17.

[0088] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. [Explanation of symbols]

[0089] 10 Judging System 100 Judgment System 110 Software Reception Department 120 First result receiving section 130 Software Distribution Department 140 Second result receiving section 150 Judgment section 160 Output section 170 Information storage section 200 Software provision device 300 First Inspection Device 400 Second Inspection Device 500 Output device 1000 Computers 1001 Processor 1002 Memory 1003 Storage device 1004 I / O Interface 1005 Storage medium

Claims

1. a first result receiving means for receiving a first test result which is a result of a first test of vulnerabilities of the target software; a second result receiving means for receiving a second test result which is a result of a second test of the vulnerability of the target software; a determination means for determining the validity of the first inspection based on an undetected vulnerability that is a vulnerability detected in a result of the second inspection but not detected in a result of the first inspection; an output means for outputting a result of the validity determination; A determination system comprising:

2. The determining means determines the validity based on the number of undetected vulnerabilities. The determination system according to claim 1 .

3. The determining means determines the validity from the number of the undetected vulnerabilities whose severity level is higher than a predetermined severity level. The determination system according to claim 2 .

4. The determining means determines the validity based on the number of the undetected vulnerabilities for each severity level. The determination system according to claim 3 .

5. The determining means determines the validity based on the number of undetected vulnerabilities for each type. The determination system according to any one of claims 1 to 4.

6. an information storage means for storing the target software and authenticity information of the target software; a software providing means for providing the target software and the authenticity information to a first inspection device that performs the first inspection and a second inspection device that performs the second inspection; a first result receiving means for receiving a result of the first inspection and a digital signature of the result of the first inspection from the first inspection device, and storing the received result of the first inspection and the digital signature of the result of the first inspection in the information storage means; a second result receiving means for receiving a result of the second inspection and a digital signature of the result of the second inspection from the second inspection device; an output means for outputting a result of the validity determination; Equipped with the information storage means stores the first test result in such a manner that the stored first test result cannot be changed; The output means further outputs information on the undetected vulnerability. The determination system according to any one of claims 1 to 5.

7. A computer comprising: receiving a first test result that is a result of a first test of vulnerabilities in the target software; receiving a second test result that is a result of a second test of vulnerabilities of the target software; determining the validity of the first inspection based on an undetected vulnerability that is a vulnerability that is detected in a result of the second inspection but not detected in a result of the first inspection; outputting a result of the determination of validity; Judgment method.

8. The computer, The validity is determined based on the number of undetected vulnerabilities. The method according to claim 7.

9. The computer, The validity is determined based on the number of the undetected vulnerabilities whose severity level is higher than a predetermined severity level. The method according to claim 8.

10. a first result receiving process for receiving a first test result which is a result of a first test of vulnerabilities of the target software; a second result receiving process for receiving a second test result which is a result of a second test of the vulnerability of the target software; a determination process for determining the validity of the first inspection based on an undetected vulnerability that is a vulnerability detected in a result of the second inspection but not detected in a result of the first inspection; an output process for outputting a result of the validity determination; A program that causes a computer to execute the following.

Images