Safety assessment system, safety assessment device, method, and program

Abstract

A security determination system according to one aspect of the present disclosure comprises: a conversion unit configured so as to convert an encryption protocol configured by one or more messages into series data of data in which the messages are expressed in a tree structure; a security verification unit configured so as to use the series data as input, and output a security verification value representing a verification result regarding a prescribed security requirement of the encryption protocol by using a machine learning model having trained model parameters; and a determination unit configured so as to determine, on the basis of the security verification value, whether the encryption protocol satisfies the security requirement.

Description

[Technical field]

[0001] The present disclosure relates to a safety determination system, a safety determination device, a method, and a program. [Background technology]

[0002] In recent years, as cryptographic protocols become more complex, automatic verification tools are being used to verify their security. Major automatic verification tools use an automatic verification technique called formal verification, but formal verification has the problem that termination is not guaranteed and that even if the verification does terminate, it requires an enormous amount of verification time. In response to this, research is being conducted into the verification of the security of cryptographic protocols using machine learning (for example, Non-Patent Documents 1 and 2). Compared to formal verification, methods using machine learning have a shorter verification time and termination is guaranteed, but they have the problem that their accuracy is not necessarily 100%.

[0003] In the existing methods described in the above Non-Patent Documents 1 and 2, etc., a cryptographic protocol is converted into sequence-structured data and a machine learning model is constructed. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Zhuo Ma, Yang Liu, Zhuzhu Wang, Haoran Ge, and Meng Zhao. "A machine learning-based scheme for the security analysis of authentication and key agreement protocols". Neural Computing and Applications, Vol. 32, No. 22, pp. 16819-16831, 2020. [Non-Patent Document 2] Behnam Zahednejad, Lishan Ke, and Jing Li. "A novel machine learning-based approach for security analysis of authentication and key agreement protocols". Security and Communication Networks, Vol. 2020, 2020. Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the existing methods, an independent conversion process is performed for each message element of the cryptographic protocol, so the structure of the message is lost, resulting in low accuracy of security verification.

[0006] The present disclosure has been made in consideration of the above points, and provides a technology for verifying the security of a cryptographic protocol with high accuracy using machine learning. [Means for solving the problem]

[0007] A security assessment system according to one embodiment of the present disclosure includes a conversion unit configured to convert a cryptographic protocol consisting of one or more messages into sequence data of data representing the messages in a tree structure, a security verification unit configured to use the sequence data as input and to output a security verification value representing a verification result regarding a specified security requirement of the cryptographic protocol using a machine learning model having learned model parameters, and a judgment unit configured to judge whether the cryptographic protocol satisfies the security requirement based on the security verification value. Effect of the Invention

[0008] Machine learning provides technology that can verify the security of cryptographic protocols with high accuracy. [Brief description of the drawings]

[0009] [Figure 1] FIG. 2 is a diagram illustrating an example of components of a message. [Diagram 2] FIG. 13 is a diagram showing an example of a method for constructing a message. [Diagram 3] FIG. 13 is a diagram showing an example of party behavior. [Figure 4] FIG. 2 is a diagram illustrating an example of a tree structure representing a cryptographic protocol. [Diagram 5] FIG. 1 is a diagram illustrating an example of a safety verification model. [Figure 6] FIG. 2 is a diagram illustrating an example of a hardware configuration of a safety determination device according to the present embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a functional configuration of a safety determination device at the time of inference. [Figure 8] FIG. 2 is a diagram illustrating an example of a functional configuration of a safety determination device during learning. [Figure 9] 10 is a flowchart illustrating an example of a safety determination process according to the embodiment. [Figure 10] 10 is a flowchart illustrating an example of a learning process according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment of the present invention will be described below, which is a security determination device 10 that constructs a machine learning model capable of verifying security requirements of a cryptographic protocol with high accuracy, and then uses the machine learning model to determine whether a desired cryptographic protocol satisfies the security requirements.

[0011] In the following, a key exchange protocol and an authentication protocol are assumed as cryptographic protocols, and confidentiality is assumed as a security requirement for the key exchange protocol, and authenticity is assumed as a security requirement for the authentication protocol. However, cryptographic protocols and their security requirements are not limited to these, and the present embodiment can be similarly applied to other cryptographic protocols and their security requirements.

[0012] <Preparation> Below, terms, concepts, definitions, etc. necessary for explaining this embodiment will be prepared.

[0013] <Cryptographic protocols covered> This embodiment targets cryptographic protocols that satisfy the following (1) to (3). Note that an executor of a cryptographic protocol is called a party. Also, one execution of a cryptographic protocol by a party (i.e., from the start of message exchange to authentication, exchange of session keys, etc.) is called a session.

[0014] (1) Parties P1, , P s (where s is an integer greater than or equal to 2) between s parties.

[0015] (2) Each party is assigned an ID, a private key to be used for a long time (long-term private key), a public key for the long-term private key, and a private key to be used for a short time only within the session (temporary private key).

[0016] (3) It exchanges messages between parties and provides functions such as authentication and key exchange.

[0017] <How to write a cryptographic protocol> We define the messages and party behavior as follows, and define a cryptographic protocol as a sequence of party behavior. Note that messages are sometimes called protocol messages.

[0018] Message components An example of the elements that make up a message and their notation is shown in Figure 1. In Figure 1, P represents one of the parties. That is, P∈{P1, ,P s}. In the following, the set of elements that make up a message is denoted as AN={a1, ,a N} (where N is the total number of elements that make up the message). The elements that make up AN (the elements that make up the message) are defined according to the cryptographic protocol in question. For example, if the cryptographic protocol in question is an authentication protocol, the session key SK shared by party P is P An AN that does not include may be defined.

[0019] How to compose a message An example of the party's operations and their representation when constructing a message is shown in Figure 2. In Figure 2,

[0020]

number

[0021] Party Behavior An example of the behavior of parties in a protocol and how to express it is shown in Figure 3. In Figure 3, → m represents a sequence of any message. In the following, we define the set of behaviors of the parties in the protocol as BN={b1, ,b L} (where L is the total number of behaviors of the parties in the protocol). The behaviors that make up BN are defined according to the cryptographic protocol in question. For example, if the cryptographic protocol in question is an authentication protocol, then acceptI( → m) and acceptR( → A BN that does not include m) may be defined.

[0022] <Modeling of cryptographic protocols> With the above preparation, a cryptographic protocol is expressed as a sequence of messages exchanged between parties. Each message is composed of an element a in AN and an operation f in FN applied to a message or a sequence of messages after determining the behavior of the party with respect to that message. For example, the following (a) and (b) are both messages.

[0023] (a) sendItoR(esk I ) (b) sendRtoI(ID I ,esk I ,esk R ,aenc I (ID R ,SK),sign R (ID I ,esk I ,esk R ,aenc I (ID R ,SK))) Here, aenc I (·) is aenc(·;pk I ) (where pk I represents the public key of the initiator I. Also, sign R (·) is sign(·;lsk R ) (where lsk R represents the long-term private key of responder R).

[0024] Note that the above (a) and (b) are messages of the authentication protocol (ISO / IEC 11770-3 key distribution mechanism 4) described in Reference 1.

[0025] For this reason, each message in a cryptographic protocol can be represented by a tree structure (syntax tree) with the behavior of the party as the root node, the operation as the internal node, and the elements of the message as the leaf nodes. For example, the message shown in (a) above can be represented by the tree structure shown in the left diagram of Figure 4, and the message shown in (b) above can be represented by the tree structure shown in the right diagram of Figure 4.

[0026] Therefore, a cryptographic protocol is expressed as a sequence of messages represented as a tree. That is, each message in the tree is expressed as m t If the number of messages exchanged in a cryptographic protocol is T, then the cryptographic protocol can be expressed as {m t It can be represented as data with a sequence structure and tree structure, i.e., |t=1,...,T}.

[0027] By expressing each message as a tree structure, it is possible to take into account the grammatical structure between messages (in other words, the structural information of the cryptographic protocol), making it possible to build a more accurate machine learning model. For example, consider the following two messages (c) and (d).

[0028] (c) sendItoR(sign I (aenc R (ID I ,SK))) (d) sendItoR(sign R (aenc I (ID I ,SK))) In this case, existing methods (e.g., Non-Patent Documents 1 and 2) convert the messages into the same vector, and the structural information of the cryptographic protocol is lost. On the other hand, by expressing the messages in a tree structure, the above two messages (c) and (d) can be distinguished, and the structural information of the cryptographic protocol can be taken into consideration. Therefore, a machine learning model that reflects the structural information of the cryptographic protocol can be constructed, enabling more accurate security verification.

[0029] <Safety verification model> Below, we consider data with sequence structure and tree structure,t We will explain the configuration of a machine learning model that takes a cryptographic protocol expressed as {t=1,...,T} as input and outputs a security verification value that represents the verification result of the security requirements of the cryptographic protocol. Hereinafter, this machine learning model will be called the "security verification model."

[0030] 5 shows an example of the configuration of the safety verification model 1000. As shown in FIG. 5, the safety verification model 1000 is composed of a TreeLSTM 1100, an LSTM 1200, and a linear classifier 1300.

[0031] TreeLSTM1100 is a neural network model based on Child-Sum Tree-LSTM (Reference 2), which is an extension of LSTM (Long Short-Term Memory) to a tree structure. In TreeLSTM1100, the latent vector of each node in the tree structure is calculated based on the latent vector of its child nodes. Specifically, when a message m t Let C(j) be the set of child nodes of node j in the j ∈R n and memory cell c j ∈R n (where n is the latent vector h j and memory cell c j The number of dimensions of is calculated and updated by the following formula:

[0032]

number

[0033]

number

[0034] For the TreeLSTM1100 above, we use sequence-structured and tree-structured data {m t By inputting the cryptographic protocol represented by |t=1, ,T}, each message m t The features related to the tree structure of (t=1, ,T) are the sequence of latent vectors of the action nodes h m_1 ,···,h m_T The sequence of these latent vectors h m_1 ,···,h m_T are input to the LSTM1200. Note that “m_1”, , and “m_T” are “m1”, , and “m T " represents.

[0035] LSTM1200 is an improved version of the Recurrent Neural Network (RNN) model (Reference 3). LSTM1200 is a method to extract the sequence of latent vectors obtained by TreeLSTM1100, m_1 ,···,h m_T With input, latent vector h'=h' m_T ∈R n where h' is the j represents the latent vector of LSTM. Note that in LSTM, h' jWhen calculating, past latent vectors are required, but if the past latent vectors have not been calculated, the uncalculated latent vectors can be defined as 0 vectors, for example. Since LSTM1200 is similar to existing LSTMs, a detailed explanation is omitted, but please refer to Reference 3, etc. as necessary.

[0036] The linear classifier 1300 receives the latent vector h' obtained by the LSTM 1200 as input and outputs a safety verification value. That is, the linear classifier 1300 linearly converts the latent vector h' into a vector with the dimension of the number of labels related to the safety requirements, and sets the softmax function value for the corresponding element of the vector as the safety verification value. Therefore, the safety verification value is expressed as a probability.

[0037] For example, when there are two labels related to the security requirements, "satisfies confidentiality" and "does not satisfy confidentiality", the linear classifier 1300 linearly converts the latent vector h' into a two-dimensional vector. For this reason, for example, the softmax function value for the element corresponding to the label representing "satisfies confidentiality" may be set as the security verification value. As a result, for example, when the security verification value exceeds a predetermined threshold, the corresponding cryptographic protocol is determined to satisfy confidentiality, and when it does not, it is determined to not satisfy confidentiality. In the following, a case will be described assuming that there are two labels related to the security requirements, "satisfies the corresponding security requirements" and "does not satisfy the corresponding security requirements". However, this is an example and is not limited to this. For example, "satisfies confidentiality" and "satisfies authenticity" may be used as labels related to the security requirements, or "satisfies confidentiality", "does not satisfy confidentiality", "satisfies authenticity" and "does not satisfy authenticity" may be used as labels related to the security requirements.

[0038] <Learning safety verification models> The parameters to be trained in the safety verification model 1000 described above are the weight matrix W c ,U cand bias b, the weight matrix and bias of the LSTM 1200, and the weight matrix and bias used in the linear transformation of the linear classifier 1300. Hereinafter, these parameters will be referred to as model parameters.

[0039] When training the security verification model 1000, a training data set is given, which is a set of a cryptographic protocol and a security evaluation label that represents the result of evaluating the security requirements of the protocol. Hereinafter, this training data set is denoted as D={(Prt i ,y i )|i=1,···,|D|}. Prt i is the i-th cryptographic protocol, y i is its safety evaluation label. Safety evaluation label y i For example, if the safety requirement is met, the value is 1, and if not, the value is 0.

[0040] At this time, Prt i After converting the data into sequence-structured and tree-structured data, the probability distribution of the safety verification value when inputted to the safety verification model 1000 is expressed as p=p(y|Prt i ), then the safety evaluation label y i The cross entropy function for l(p,y i ) = -logp(y i |Prt i ) can be defined as 0 <p(y i |Prt i )<1, so l(p,y i )>0. Therefore, p(y i |Prt i The smaller l(p,y i ) takes a large value, and l(p,y i ) represents the magnitude of error between the prediction by the safety verification model 1000 and the true label. Therefore, the average error for the training data set D, that is, (l(p,y1)+···+l(p,y |D| )) / |D| can be used as the loss function.

[0041] The model parameters are trained so as to minimize the loss function. A known method such as a gradient method may be used to minimize the loss function. In the following, the case where the model parameters are trained is referred to as "training time", and the case where a security verification value for a desired cryptographic protocol is obtained by a security verification model using the trained model parameters is referred to as "inference time".

[0042] <Hardware Configuration Example of Safety Determination Device 10> An example of a hardware configuration of the safety assessment device 10 according to this embodiment is shown in Fig. 6. As shown in Fig. 6, the safety assessment device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0043] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the safety determination device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0044] The external I / F 103 is an interface with an external device such as a recording medium 103a. The safety determination device 10 can read and write data from and to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), a SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0045] The communication I / F 104 is an interface for connecting the safety assessment device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a storage device (storage device) such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is an arithmetic device such as a central processing unit (CPU).

[0046] The safety assessment device 10 according to this embodiment has the hardware configuration shown in Fig. 6 and can realize various processes described below. Note that the hardware configuration shown in Fig. 6 is an example, and the hardware configuration of the safety assessment device 10 is not limited to this. For example, the safety assessment device 10 may have multiple auxiliary storage devices 107 and multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0047] <Example of Functional Configuration of Safety Determination Device 10> An example of the functional configuration of the security assessment device 10 according to this embodiment will be described below. It is assumed that a cryptographic protocol Prt, the security assessment device 10 is provided with to assess whether it satisfies a security requirement during inference, and that a training data set D is provided to the security assessment device 10 during training.

[0048] ≪At the time of inference≫ An example of a functional configuration of the safety judgment device 10 at the time of inference is shown in Fig. 7. As shown in Fig. 7, the safety judgment device 10 at the time of inference has a structure conversion unit 201, a safety verification processing unit 202, and a safety judgment unit 203. Each of these units is realized, for example, by a process in which one or more programs installed in the safety judgment device 10 are executed by the processor 108.

[0049] The structure conversion unit 201 converts a given cryptographic protocol Prt into data {m t |t=1, ,T}, where each m t is a tree-structured representation of the t-th message that constitutes the cryptographic protocol Prt. Below, we will call a cryptographic protocol represented as data with sequence and tree structures Prt={m t This is written as |t=1,···,T}.

[0050] The security verification processing unit 202 is realized by a security verification model 1000 having trained model parameters, and a cryptographic protocol Prt={m t The security verification processing unit 202 receives an input of |t=1, . . . , T} and outputs a security verification value of the cryptographic protocol. Here, the security verification processing unit 202 includes a tree structure feature extraction unit 211, a sequence structure feature extraction unit 212, and a classification unit 213.

[0051] The tree structure feature extraction unit 211 is realized by a TreeLSTM 1100 having trained model parameters, and Prt={m t |t=1, ,T} as input, and the sequence of latent vectors h m_1 ,···,h m_T Output.

[0052] The sequence structure feature extraction unit 212 is realized by an LSTM 1200 having trained model parameters, and the sequence of latent vectors h m_1 ,···,h m_T With input, latent vector h'=h' m_T Output.

[0053] The classification unit 213 is realized by a linear classifier 1300 having trained model parameters, and receives the latent vector h′ as input and outputs a safety verification value.

[0054] The security judgment unit 203 compares the security verification value with a predetermined threshold, and judges that the cryptographic protocol Prt satisfies the security requirements if the security verification value exceeds the predetermined threshold, and judges that the cryptographic protocol Prt does not satisfy the security requirements if the security verification value does not exceed the predetermined threshold. This judgment result (security judgment result) is output to a predetermined output destination (for example, the auxiliary storage device 107, another device connected via a communication network, etc.).

[0055] <When studying> An example of a functional configuration of the safety assessment device 10 during learning is shown in Fig. 8. As shown in Fig. 8, the safety assessment device 10 during learning has a structure conversion unit 201, a safety verification processing unit 202, and a learning unit 204. Each of these units is realized, for example, by a process in which one or more programs installed in the safety assessment device 10 are executed by the processor 108.

[0056] The structure conversion unit 201 converts the cryptographic protocol Prt i Let us consider data {m t (i) |t=1, ,T (i)} where each m t (i) is the cryptographic protocol Prt i The t-th message that constitutes the sequence structure is expressed as a tree structure. In the following, the cryptographic protocol expressed as data with sequence structure and tree structure is called Prt i ={m t (i) |t=1, ,T (i)} is written as

[0057] The security verification processing unit 202 is realized by a security verification model 1000 having untrained model parameters, and is i ={m t (i) |t=1, ,T (i)} is used as input, and the probability distribution of the safety evaluation value p=p(y|Prt iHere, safety verification processing unit 202 includes tree structure feature extraction unit 211, sequence structure feature extraction unit 212, and classification unit 213.

[0058] The tree structure feature extraction unit 211 is realized by a TreeLSTM 1100 having trained model parameters. i ={m t (i) |t=1, ,T (i)} as input, and the sequence of latent vectors h m_1 ,···,h m_T Output.

[0059] The sequence structure feature extraction unit 212 is realized by an LSTM 1200 having trained model parameters, and the sequence of latent vectors h m_1 ,···,h m_T With input, latent vector h'=h' m_T Output.

[0060] The classification unit 213 is realized by a linear classifier 1300 having trained model parameters, and receives the latent vector h′ as input and calculates the probability distribution p=p(y|Prt i ) to output.

[0061] The learning unit 204 calculates the probability distribution p=p(y|Prt i ) and the safety assessment label y contained in the given training data set D i The model parameters are trained to minimize the loss function using

[0062] <Processing details> The following describes in detail the processing executed by the safety determination device 10 according to this embodiment. Note that the safety determination processing is executed by the safety determination device 10 during inference, and the learning processing is executed by the safety determination device 10 during learning.

[0063] <Safety Judgment Processing> The safety determination process according to this embodiment will be described with reference to FIG.

[0064] The structure conversion unit 201 converts a given cryptographic protocol Prt into data {m t |t=1, . . . , T} (step S101).

[0065] Next, the security verification processing unit 202 verifies the cryptographic protocol Prt={m t |t=1, . . . , T} is input, and a security verification value of the cryptographic protocol is output (step S102).

[0066] Then, the security judgment unit 203 judges whether or not the cryptographic protocol Prt satisfies the security requirements, using the security verification value output in the above step S102 and a predetermined threshold value (step S103).

[0067] <Learning process> The learning process according to this embodiment will be described with reference to FIG.

[0068] The learning unit 204 initializes model parameters (step S201). Note that the learning unit 204 may initialize the model parameters using a known method.

[0069] The following steps S202 to S203 are repeatedly executed for each i=1, . . . , |D|.

[0070] The structure conversion unit 201 converts the cryptographic protocol Prt i Let us consider data {m t (i) |t=1, ,T (i)} (step S202).

[0071] Next, the security verification processing unit 202 performs the security verification of the cryptographic protocol Prt i ={m t (i) |t=1, ,T (i)} is used as input, and the probability distribution of the safety evaluation value p=p(y|Prt i ) is output (step S203).

[0072] Then, the learning unit 204 calculates the probability distribution p=p(y|Prt i ) and the cryptographic protocol Prt i Safety evaluation label corresponding to i Using the above, model parameters are learned so as to minimize the loss function (step S204).

[0073] <Summary> As described above, the security assessment device 10 according to this embodiment can verify the security requirements of a cryptographic protocol using a machine learning model. In this case, the security assessment device 10 according to this embodiment extracts not only the characteristics of the sequence structure of messages constituting the cryptographic protocol, but also the characteristics of the tree structure of each message, and then verifies the security requirements of the cryptographic protocol from these characteristics. This makes it possible to verify the security requirements of a cryptographic protocol with higher accuracy than conventional methods.

[0074] In the above embodiment, the safety assessment device 10 is implemented as one device, but the present invention is not limited to this, and the safety assessment device 10 may be implemented as a plurality of devices connected to each other via a communication network. In this case, the safety assessment device 10 may be called a safety assessment system or the like.

[0075] In addition, in the above embodiment, the same device is used as the safety judgment device 10 during inference and learning, but this is not limited to this, and for example, the safety judgment device 10 during inference and the safety judgment device 10 during learning may be different devices.

[0076] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0077] [Reference 1] Reference 1: International Standard. Iso: Information technology - security techniques - key management - part 3: Mechanisms using asymmetric techniques iso / iec 11770-3, 2015. 3rd edition. Reference 2: Kai Sheng Tai, Richard Socher, and Christopher D. Manning. Improved semantic representations from tree-structured long short-term memory networks. In Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics and the 7th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 1556-1566, Beijing, China, July 2015. Association for Computational Linguistics. Reference 3: Sepp Hochreiter and J¨urgen Schmidhuber. Long Short-Term Memory. Neural Computation, Vol. 9, No. 8, pp.1735-1780, 11 1997. [Explanation of symbols]

[0078] 10 Safety determination device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Structural conversion section 202 Safety Verification Processing Unit 203 Safety Judgment Department 204 Learning Department 211 Tree Structure Feature Extraction Unit 212 Sequence Structure Feature Extraction Unit 213 Classification Department

Claims

1. a converter configured to convert a cryptographic protocol consisting of one or more messages into sequence data of data represented in a tree structure; a security verification unit configured to receive the sequence data as an input, and output a security verification value representing a verification result regarding a predetermined security requirement of the cryptographic protocol using a machine learning model having trained model parameters; a determination unit configured to determine whether the cryptographic protocol satisfies the security requirements based on the security verification value; A safety assessment system having the above structure.

2. The conversion unit is 2. The security determination system according to claim 1, wherein, when the cryptographic protocol is composed of T messages, for each t (t∈{1, ..., T}), the t-th message is converted into tree-structured data in which a behavior of a party with respect to the message is represented as a root node, elements of the message are represented as leaf nodes, and operations on either the elements or results of operations on the elements are represented as internal nodes, and a sequence of the converted data is used as the sequence data.

3. The behavior includes at least one of sending a message from the initiator to the responder and sending a message from the responder to the initiator; The elements include at least one of an ID of the initiator or the responder, a temporary private key of the initiator or the responder, a long-term private key of the initiator or the responder, a public key of the initiator or the responder, a timestamp of the initiator or the responder, a private key previously shared by the initiator and the responder, and a session key shared by the initiator and the responder; 3. The security determination system of claim 2, wherein the operations include at least one of a common key ciphertext creation operation using the private key for at least one string of the elements, a public key ciphertext creation operation using the public key for at least one string of the elements, an electronic signature creation operation using the long-term private key for at least one string of the elements, a hash value calculation operation for at least one string of the elements, a concatenation operation of two of the elements, an operation of exponentiating one of the two elements by the other, an addition operation of two of the elements, and a multiplication operation of two of the elements.

4. The machine learning model is Using the sequence data as input, a sequence of first latent vectors representing characteristics of a tree structure expressing the message is output using a model based on Child-Sum Tree-LSTM; Using the sequence of the first latent vector as an input, outputting a second latent vector representing a feature of a sequence structure of the sequence data by an LSTM; The safety determination system according to claim 1 , wherein the second latent vector is input, and the safety verification value is output by a linear classifier constituted by a linear transformation and a Softmax function.

5. a converter configured to convert a cryptographic protocol consisting of one or more messages into sequence data of data represented in a tree structure; a security verification unit configured to receive the sequence data as an input, and output a security verification value representing a verification result regarding a predetermined security requirement of the cryptographic protocol using a machine learning model having trained model parameters; a determination unit configured to determine whether the cryptographic protocol satisfies the security requirements based on the security verification value; A safety assessment device having the above structure.

6. a conversion step of converting a cryptographic protocol consisting of one or more messages into sequence data of data represented in a tree structure by the messages; a security verification step of inputting the sequence data and outputting a security verification value representing a verification result regarding a predetermined security requirement of the cryptographic protocol using a machine learning model having trained model parameters; a determination step of determining whether the cryptographic protocol satisfies the security requirements based on the security verification value; How a computer executes.

7. a conversion step of converting a cryptographic protocol consisting of one or more messages into sequence data of data represented in a tree structure by the messages; a security verification step of inputting the sequence data and outputting a security verification value representing a verification result regarding a predetermined security requirement of the cryptographic protocol using a machine learning model having trained model parameters; a determination step of determining whether the cryptographic protocol satisfies the security requirements based on the security verification value; A program that causes a computer to execute the following.

Images