Authentication device, authentication method, authentication program, and authentication obfuscation program

Abstract

To provide an authentication device, an authentication method, and an authentication program that can detect an attack on an obfuscated program.SOLUTION: A server 10 includes: an authentication value setting unit 111 that sets names of one or more functions included in an authentication program to be executed by a terminal 20 to a character string including an authentication value; an error setting unit 112 that generates a predetermined error in a code executed by the function and obtain a stack trace string at time of occurrence of a corresponding error; an obfuscation processing unit 113 that obfuscates the authentication program except for the authentication value and generates an obfuscated program; a program transmission unit 114 that transmits the obfuscated program to the terminal 20; and a verification unit 115 that receives data that allows confirmation of an execution result of the obfuscated program and at least part of the stack trace string, and verifies that the execution result matches expected data and that the stack trace string includes the authentication value.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an authentication system that receives data generated by a specific program and verifies the validity of the data. [Background technology]

[0002] Conventionally, when taking measures against phishing, in order to verify that the terminal of the communication partner is using the program intended by the server, data generated by this program is sent from the terminal to the server, and the server verifies the value and checks whether the value sent is correct. If the communication partner is running the correct program, this verification makes it possible to infer that other operations in this program, such as functions to check that the terminal is not behaving in an unauthorized manner, are also operating.

[0003] In order to protect the programs provided by the server to the terminals from analysis by attackers, various obfuscation techniques have been proposed. Obfuscation is a technique that increases the cost of analyzing a program by converting the program into a complex form without changing the execution result of the program (for example, see Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2011-018119 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, when a program is protected by obfuscation, there is a known method of making the program malfunction without removing the obfuscation, for example, an attack in which part of the program is copied into a function and executed within the variable scope of the attack. Measures against this attack have been taken, such as making it difficult to discover variables used in the program, but these measures are not sufficient, and it is not possible to discover an attack when it occurs.

[0006] An object of the present invention is to provide an authentication device, an authentication method, and an authentication program that are capable of detecting attacks on obfuscated programs. [Means for solving the problem]

[0007] The authentication device of the present invention includes an authentication value setting unit that sets the names of one or more functions included in an authentication program to be executed by a terminal to a string including an authentication value; an error setting unit that is configured to cause a specified error in code executed by the function and obtain a stack trace string at the time the error occurs; an obfuscation processing unit that obfuscates the authentication program except for the authentication value and generates an obfuscated program; a program transmission unit that transmits the obfuscated program to the terminal; and a verification unit that receives data that allows the execution result of the obfuscated program and at least a part of the stack trace string to be confirmed, and verifies that the execution result matches expected data and that the authentication value is included in the stack trace string.

[0008] The authentication device may include a location acquisition unit that acquires location information in which the authentication value is described in the obfuscated program, and the verification unit may extract location information of the function from the stack trace character string and further verify that it matches the location information acquired by the location acquisition unit.

[0009] The position information may be at least one of a line number and a character number from the beginning of a line in the obfuscated program.

[0010] The data capable of confirming at least a portion of the stack trace string is a value indicating whether the authentication value is included in the stack trace string, and the error setting unit may be configured to determine whether the acquired stack trace string includes the authentication value and return the result to a server.

[0011] An authentication method according to the present invention is an authentication system in which a server authenticates a terminal, the server sets the names of one or more functions to strings including an authentication value, generates a specified error in code executed by the function, and transmits an authentication program, which is obfuscated excluding the authentication value, to the terminal, the authentication program being configured to obtain a stack trace string at the time the error occurred, the terminal transmits to the server the execution result of the received program and data that allows at least a part of the stack trace string to be confirmed, and the server verifies that the received execution result matches expected data and that the authentication value is included in the stack trace string.

[0012] An authentication program according to the present invention causes a computer to function as the authentication device.

[0013] The authentication program of the present invention is a program that a server has a terminal execute, in which the names of one or more functions included in the authentication obfuscation program are set to a string including an authentication value and are obfuscated except for the authentication value, and a specified error is generated in the code executed by the function, and a stack trace string at the time of the error occurrence is obtained, thereby allowing the server to receive data that can confirm the execution result of the authentication obfuscation program and at least a part of the stack trace string, and to verify that the execution result matches expected data and that the authentication value is included in the stack trace string. Effect of the Invention

[0014] According to the present invention, attacks on obfuscated programs can be detected. [Brief description of the drawings]

[0015] [Figure 1] FIG. 2 is a diagram showing a communication flow in the authentication system of the embodiment. [Diagram 2] FIG. 2 is a diagram illustrating a functional configuration of a server according to an embodiment. [Diagram 3] 11 is a diagram illustrating an example of a stack trace character string acquired when an error occurs in an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] An example of an embodiment of the present invention will now be described. In the authentication method of this embodiment, an authentication value is set in advance as a function name, and a stack trace output in the event of an error during program execution is acquired within the program. The authentication device verifies whether the program is being executed within an unintended scope by checking whether the authentication value is included in the stack trace, thereby discovering an attack.

[0017] FIG. 1 is a diagram showing a communication flow in an authentication system 1 of the present embodiment. The authentication system 1 includes a server 10 serving as an authentication device and a terminal 20.

[0018] In order for server 10 to verify that terminal 20 has executed a specific program, server 10 transmits an obfuscated authentication program to terminal 20 and has terminal 20 execute it (step S1), and server 10 receives the value generated as a result of executing this program and verifies its legitimacy by confirming that it matches the expected data (step S2).

[0019] At this time, the server 10 receives from the terminal 20 data generated based on the stack trace in addition to the values ​​generated by the program, and confirms that this data includes a preset authentication value, thereby verifying that the program has been executed correctly.

[0020] FIG. 2 is a diagram showing the functional configuration of the server 10 in this embodiment. The server 10 is an information processing device (computer) including a control unit 11, a storage unit 12, and various input / output interfaces.

[0021] The control unit 11 is a part that controls the entire server 10, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 12. The control unit 11 may be a CPU.

[0022] The storage unit 12 is a storage area for storing various programs for causing the hardware group to function as the server 10, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like.

[0023] The control unit 11 includes an authentication value setting unit 111, an error setting unit 112, an obfuscation processing unit 113, a program transmission unit 114, and a verification unit 115. The control unit 11 may further include a position acquisition unit .

[0024] The authentication value setting unit 111 sets the names of one or more functions included in the authentication program, which is executed by the terminal 20 to cause it to output expected data, in a character string including the authentication value. Specifically, the authentication value setting unit 111 selects one of the functions included in the authentication program, and if the randomly generated authentication value is, for example, "561", the name of the selected function is set to "function auth561()", etc. Alternatively, the authentication value itself may be set as the function name.

[0025] The error setting unit 112 configures the authentication program so as to generate a predetermined error in the code executed by the function selected by the authentication value setting unit 111, and to obtain a stack trace character string at the time of the error occurrence.

[0026] Specifically, the error setting unit 112 intentionally generates an error inside the selected function or in the execution code of the program called from the function. The error to be generated may be an actual error, such as a reference from a null value or a call to a non-existent function, or may be an error generated by the error setting unit 112 itself, such as "new Error()". This error can be referenced directly by a “try{…}catch(e){…}” block or a variable to obtain the stack trace string at the time the error occurred.

[0027] The obfuscation processor 113 obfuscates the authentication program except for the authentication value set by the authentication value setting unit 111, and generates an obfuscated program. For example, the obfuscation processor 113 performs obfuscation on the function name selected by the authentication value setting unit 111 as a non-target, and then replaces the function name with a character string including the authentication value.

[0028] The program transmission unit 114 transmits the obfuscated program generated by the obfuscation processing unit 113 to the terminal 20 for execution. When the terminal 20 executes the received obfuscated program, it follows the instructions of the program and transmits to the server 10 the entire stack trace string at the time the error occurred, or data generated based on the stack trace string (data including a value that can confirm the presence of the authentication value, such as an authentication value or a hash of the authentication value).

[0029] In addition, the data that can confirm at least a part of the stack trace string, i.e., the value that can confirm the presence of the authentication value, may be, for example, a value such as a flag that is 1 if the authentication value is included in the stack trace string and 0 if it is not included. In this case, the error setting unit 112 configures the authentication program so as to determine whether or not the acquired stack trace character string includes an authentication value, and to return the determination result to the server.

[0030] The verification unit 115 receives from the terminal 20 the execution result of the obfuscated program and data that can verify at least a part of the stack trace string, and verifies that the execution result matches the expected data and that the stack trace string contains an authentication value.

[0031] FIG. 3 is a diagram illustrating an example of a stack trace character string acquired when an error occurs in this embodiment. Here, the authentication value is "cl38fe24ny", and the authentication value exists as a function name in the stack trace hierarchy. This makes it possible to verify that the authentication program (kick.js) generated by the server 10 is executed in the specified order, that is, by being called from the function HTMLScriptElement.d.onload of load.js.

[0032] The location acquisition unit 116 acquires location information in which an authentication value is written in the obfuscated program. This position information is, for example, at least one of the number of lines from the beginning of the obfuscated program and the number of characters from the beginning of a line.

[0033] If the server 10 is equipped with a location acquisition unit 116, the verification unit 115 extracts location information of the function including the authentication value from the stack trace string, and further verifies that it matches the location information acquired by the location acquisition unit 116. Specifically, for example, from the stack trace string in Figure 3, it can be extracted that the function "cl38fe24ny" was called at the 33rd line and 7273rd character of the program kick.js. Therefore, by storing in advance the position where the corresponding function is called in the obfuscated program and comparing it, it is possible to verify that the authentication value exists at the specified hierarchy.

[0034] According to this embodiment, the authentication system 1 can verify with a high degree of probability that a function has been correctly called via a specified path by checking that a function name, which is a preset authentication value, is included in a stack trace string when an error is intentionally generated in the terminal 20. This enables the authentication system 1 to detect attacks on obfuscated programs. As a result, the accuracy of the value output by the obfuscated program executed on the terminal 20 can be improved.

[0035] Furthermore, the authentication system 1 can perform even stricter verification by not only checking the existence of an authentication value but also using location information to confirm that this authentication value is in a specified hierarchy, thereby confirming not only that it was called from a function containing an authentication value, but also that no other unintended scopes are included.

[0036] For example, if multiple authentication programs are executed in multiple stages, it is difficult to modify variables in the later scope. Therefore, by setting the function name used in this later scope as the authentication value, it is possible to verify that the authentication program was executed correctly by confirming its presence in the stack trace string. In addition, for example, if part of the authentication program is copied and used, the calling function name, which is the authentication value, will no longer exist. Therefore, by checking the presence of the authentication value in the stack trace string, it is possible to verify that the authentication program was executed correctly.

[0037] Furthermore, the authentication system 1 can conceal the verification contents by transmitting data that can confirm the authentication value, particularly a value indicating the presence or absence, from the terminal 20 to the server 10, rather than the authentication value itself. Even if the stack trace character string itself is transmitted, it is difficult to determine the authentication procedure from it, since it is a normal error log. Therefore, phishing attacks can be suppressed.

[0038] According to this embodiment, for example, it is possible to improve the authentication strength of terminals and create a site that is less susceptible to phishing, which makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0039] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0040] The authentication method by the server 10 (authentication device) is realized by software. When it is realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0041] 1 Authentication System 10 Server (authentication device) 11 Control section 12 Storage section 20 Terminals 111 Authentication value setting section 112 Error setting section 113 Obfuscation Processor 114 Program Transmission Unit 115 Verification Department 116 Position acquisition part

Claims

1. an authentication value setting unit that sets the name of one or more functions included in an authentication program to be executed by a terminal to a character string including an authentication value; an error setting unit configured to cause a predetermined error in a code executed by the function and to obtain a stack trace character string at the time of the error occurrence; an obfuscation processing unit that obfuscates the authentication program except for the authentication value and generates an obfuscated program; a program transmission unit that transmits the obfuscated program to the terminal; a verification unit that receives an execution result of the obfuscated program and data capable of verifying at least a portion of the stack trace string, and verifies that the execution result matches expected data and that the stack trace string includes the authentication value.

2. a location acquisition unit that acquires location information in which the authentication value is described in the obfuscated program; The authentication device according to claim 1 , wherein the verification unit extracts location information of the function from the stack trace character string, and further verifies that the location information matches the location information acquired by the location acquisition unit.

3. The authentication device according to claim 2 , wherein the position information is at least one of a line number and a character number from the beginning of a line in the obfuscated program.

4. the data by which at least a portion of the stack trace string can be identified is a value indicating whether the stack trace string includes the authentication value; 2 . The authentication device according to claim 1 , wherein the authentication program is configured so that the error setting unit determines whether the acquired stack trace character string includes the authentication value and returns a result of the determination to a server.

5. In an authentication system in which a server authenticates a terminal, the server sets the name of one or more functions to a character string including an authentication value, generates a predetermined error in a code executed by the function, and acquires a stack trace character string at the time of the error occurrence, and transmits the authentication program to the terminal in an obfuscated form excluding the authentication value; the terminal transmits to the server an execution result of the received program and data enabling confirmation of at least a part of the stack trace character string; The authentication method includes the server verifying that the received execution results match expected data and that the stack trace string includes the authentication value.

6. An authentication program for causing a computer to function as the authentication device according to any one of claims 1 to 4.

7. An obfuscated program for authentication that a server causes a terminal to execute, The name of one or more functions included in the authentication obfuscated program is set to a character string including an authentication value, and the name is obfuscated except for the authentication value; An obfuscated program for authentication that generates a specified error in code executed by the function, and obtains a stack trace string at the time of the error occurrence, thereby allowing the server to receive data that enables confirmation of the execution result of the obfuscated program for authentication and at least a part of the stack trace string, and verify that the execution result matches expected data and that the stack trace string includes the authentication value.

Images