Vulnerability handling device, vulnerability handling method, and vulnerability handling program

Abstract

The detection unit (101) detects vulnerabilities to fault attacks contained in the program code (210). The correction unit (103) corrects the program code (210) to address the vulnerabilities detected by the detection unit (101). The determination unit (102) determines whether or not the corrected program code (130) corrected by the correction unit (103) has vulnerabilities to fault attacks.

Description

[Technical Field]

[0001] The present disclosure relates to techniques for dealing with fault attacks. A fault attack is an attack that causes a fault in a device, causing the device to malfunction, resulting in the leakage of confidential information, unauthorized modification of functions, etc. [Background technology]

[0002] One technology for dealing with cyberattacks is disclosed in Patent Document 1. In the technology of Patent Document 1, a patch that addresses vulnerabilities to cyberattacks is applied to binary code. Furthermore, in Patent Document 1, a functional test is performed using the binary code after the patch has been applied to verify whether the binary code after the patch has been applied functions correctly. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-034027 Summary of the Invention [Problem to be solved by the invention]

[0004] The technology of Patent Document 1 can deal with vulnerability to cyber attacks, but has the problem that it cannot deal with fault attacks. Furthermore, although Patent Document 1 makes it possible to verify whether binary code functions correctly after a patch has been applied, it has the problem of not being able to verify whether vulnerabilities remain.

[0005] One of the main objectives of the present disclosure is to solve such problems. More specifically, the main objective of the present disclosure is to appropriately modify program code to address vulnerabilities to fault attacks. [Means for solving the problem]

[0006] A vulnerability addressing device according to the present disclosure includes: a detection unit that detects vulnerabilities to fault attacks contained in program code; a correction unit that corrects the program code to address the vulnerability detected by the detection unit; and a determination unit that determines whether or not the program code after the modification by the modification unit is vulnerable to the fault attack. [Effects of the Invention]

[0007] According to the present disclosure, modifications can be appropriately made to program code to address vulnerabilities to fault attacks. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram showing an example of the functional configuration of a vulnerability handling device according to the first embodiment. [Figure 2] FIG. 2 is a diagram showing an example of the hardware configuration of the vulnerability handling device according to the first embodiment. [Figure 3] 4 is a flowchart showing an example of the operation of the vulnerability handling device according to the first embodiment. [Figure 4] 4 is a flowchart showing an example of the operation of the vulnerability handling device according to the first embodiment. [Figure 5] 4 is a flowchart showing an example of the operation of the vulnerability handling device according to the first embodiment. [Figure 6] FIG. 10 is a diagram showing an example of the functional configuration of a vulnerability handling device according to a second embodiment. [Figure 7] 10 is a flowchart showing an example of the operation of the vulnerability handling device according to the second embodiment. [Figure 8] 10 is a flowchart showing an example of the operation of the vulnerability handling device according to the second embodiment. [Figure 9] 10 is a flowchart showing an example of the operation of the vulnerability handling device according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the embodiments and the drawings, the same reference numerals denote the same or corresponding parts.

[0010] Embodiment 1 ***Configuration Description*** FIG. 1 shows an example of the functional configuration of a vulnerability handling device 100 according to this embodiment. FIG. 2 shows an example of the hardware configuration of the vulnerability handling device 100 according to this embodiment. The vulnerability handling device 100 is a computer. The operation procedure of the vulnerability handling device 100 corresponds to a vulnerability handling method, and the program that realizes the operation of the vulnerability handling device 100 corresponds to a vulnerability handling program. First, an example of the hardware configuration of the vulnerability handling device 100 will be described with reference to FIG.

[0011] As shown in FIG. 2, the vulnerability handling device 100 includes, as hardware, a processor 901, a main storage device 902, an auxiliary storage device 903, and an input / output device 904. The vulnerability handling device 100 also includes, as functional components, a detection unit 101, a determination unit 102, and a correction unit 103 shown in Fig. 1. The functional components in Fig. 1 are realized by, for example, a program. The auxiliary storage device 903 stores programs that realize these functions. These programs are loaded from the auxiliary storage device 903 into the main storage device 902. Then, the processor 901 executes these programs to perform the operations of the functional components in FIG. FIG. 2 shows a schematic diagram of a state in which a processor 901 is executing a program that implements the functions of the functional components of FIG. The input / output device 904 is a mouse, a keyboard, a recording medium reading device, a recording medium writing device, a network device, a display, etc. The network device is, for example, a wired or wireless network. The network is, for example, the Internet, a LAN (Local Area Network), Wi-Fi (registered trademark), etc.

[0012] Next, an example of the functional configuration of the vulnerability handling device 100 will be described with reference to FIG.

[0013] The detection unit 101 acquires the program code 210 . For example, the detection unit 101 acquires the program code 210 via a recording medium reading device of the input / output device 904 . The program code 210 may be binary code or source code. When the detection unit 101 acquires source code as the program code 210, the detection unit 101 includes a compiler (not shown) that converts the source code into binary code. In the following description, it is assumed that the detection unit 101 acquires binary code as the program code 210.

[0014] The detection unit 101 detects vulnerability to fault attacks contained in the program code 210. The detection unit 101 generates a vulnerability list 110 in which the detected vulnerabilities are described. Then, the detection unit 101 outputs the vulnerability list 110 to the determination unit 102. Furthermore, the detection unit 101 outputs the program code 210 to the modification unit 103 . The detection unit 101 may obtain the correction program code 130 from the correction unit 103. The modified program code 130 is the program code after modification has been made to address the vulnerability to fault attacks contained in the program code 210. When the detection unit 101 acquires the modified program code 130, the detection unit 101 detects the vulnerability to fault attacks remaining in the modified program code 130. The detection unit 101 also generates a vulnerability list 110 that lists the detected vulnerabilities. Then, the detection unit 101 outputs the vulnerability list 110 to the determination unit 102. The detection unit 101 may acquire the modified program code 130 multiple times. The detection unit 101 detects vulnerabilities and outputs the vulnerability list 110 every time the detection unit 101 acquires the modified program code 130. The processing performed by the detection unit 101 corresponds to a detection processing.

[0015] The determination unit 102 refers to the vulnerability list 110 and determines whether or not the program code 210 or the modified program code 130 is vulnerable to a fault attack. Specifically, if the vulnerability list 110 does not contain any vulnerability, the determining unit 102 determines that the program code 210 or the modified program code 130 does not contain any vulnerability. The determination unit 102 outputs the determination result 120 to the correction unit 103 . If it is determined that no vulnerability exists in the program code 210, the determining unit 102 outputs a determination result 120 to the correcting unit 103, notifying the correcting unit 103 that correction of the program code 210 is not necessary. If it is determined that the modified program code 130 does not have any vulnerability, the determining unit 102 instructs the modifying unit 103 in the determination result 120 to output the modified program code 130 as the final modified program code 220 . If it is determined that a vulnerability exists in the program code 210 or the modified program code 130, the determination unit 102 outputs a determination result 120 that instructs the modification unit 103 to modify the program code 210 or the modified program code 130. In other words, the determination unit 102 instructs the modification unit 103 in the determination result 120 to modify the program code 210 or the modified program code 130 to address the vulnerability described in the vulnerability list 110. The process performed by the determining unit 102 corresponds to a determining process.

[0016] The correction unit 103 acquires the program code 210 from the detection unit 101 . Furthermore, the correction unit 103 acquires the determination result 120 from the determination unit 102 . If the determination result 120 indicates that the program code 210 should be modified, the modifying unit 103 performs a modification to address the vulnerability detected by the detecting unit 101. That is, the modifying unit 103 performs a modification on the program code 210 to remove the vulnerability described in the vulnerability list 110. Then, the modifying unit 103 outputs the modified program code 210 to the detecting unit 101 as modified program code 130. If the determination result 120 indicates that the modification of the modification program code 130 is to be performed, the modification unit 103 performs a modification to address the vulnerability detected by the detection unit 101 and remaining in the latest modification program code 130. In other words, the modification unit 103 performs a modification on the latest modification program code 130 to remove the vulnerability described in the vulnerability list 110. Then, the modification unit 103 outputs the modified modification program code 130 to the detection unit 101. If the determination result 120 indicates that the final modified program code 220 should be output, the modifying unit 103 outputs the latest modified program code 130 as the final modified program code 220. For example, the modifying unit 103 outputs the final modified program code 220 to a display of the input / output device 904. The modifying unit 103 also outputs the final modified program code 220 to a recording medium via a recording medium writing device of the input / output device 904. The processing performed by the correction unit 103 corresponds to the correction processing.

[0017] ***Explanation of Operation*** FIG. 3 shows an example of the operation of the vulnerability handling device 100 according to this embodiment.

[0018] First, in step S1, the detection unit 101 acquires the program code 210.

[0019] Next, in step S2, the detection unit 101 analyzes the program code 210 for vulnerabilities. Specifically, the detection unit 101 uses, for example, a fault model to execute the program code 210. In other words, the detection unit 101 simulates a fault attack on a device that executes the program code 210. The execution environment of the program code 210 may be a native machine or an emulator. The fault model is a model of fault attacks. Possible fault models include instruction skipping, bit flipping, and random multiple byte changes. Furthermore, the detection unit 101 analyzes the execution result of the program code 210 . Specifically, the detection unit 101 refers to the predetermined attack success conditions and evaluates whether or not the fault attack on the program code 210 has been successful. The conditions for a successful attack include whether or not a certain address is reached (entering a path that is always false), and whether or not a certain function output contains certain data (for example, the correct encryption result is not obtained even though encryption has been performed). If there is an attack for which the attack success condition is satisfied, the program code 210 is vulnerable to that attack. The detection unit 101 generates a vulnerability list 110 in which the detected vulnerabilities are described. Specifically, the vulnerability list 110 describes "program address, assembler instruction, fault model" as a vulnerability. The detection unit 101 outputs the vulnerability list 110 to the determination unit 102. The detection unit 101 also outputs the program code 210 to the modification unit 103.

[0020] Next, in step S3, the determining unit 102 refers to the vulnerability list 110 and determines whether or not the program code 210 needs to be modified. If no modification of the program code 210 is required, the process ends. On the other hand, if the program code 210 needs to be modified, the process proceeds to step S4. Step S3 will be described in detail later.

[0021] In step S 4 , the determination unit 102 instructs the correction unit 103 to correct the program code 210 . Specifically, the determining unit 102 outputs a determination result 120 that instructs modification of the program code 210. The determination result 120 includes a vulnerability list 110.

[0022] Next, in step S5, the modifying unit 103 modifies the program code 210. That is, the modifying unit 103 modifies the program code 210 to remove the vulnerabilities described in the vulnerability list 110 included in the determination result 120 . For example, the correction unit 103 uses a machine learning model to correct the program code 210. The machine learning model is a model obtained by performing machine learning to correct vulnerabilities from the program code based on the descriptions in the vulnerability list 110. The modifying unit 103 outputs the modified program code 210 to the detecting unit 101 as modified program code 130 .

[0023] The machine learning model used to modify the program code 210 may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning. The machine learning model may be a model obtained by executing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. The machine learning model may also be, for example, a neural network (NN) model, a convolutional neural network (CNN) model, a recurrent neural network (RNN), a variational autoencoder (VAE), a generative adversarial network (GAN), a diffusion model, a transformer model, a large language model (LLM), a visual language model (VLM), a bidirectional encoder representations from transformers (BERT), a generative pre-trained transformer (GPT), or a CLIP model. The machine learning model may also be a rule-based model, such as a decision tree or random forest, that obtains an output result by referencing a predetermined table or making a decision based on predetermined conditions. The above-mentioned models are not exclusive; for example, LLM, VLM, BERT, and GPT are included in the Transformer model. Furthermore, for example, the Transformer model is included in the NN model. Furthermore, machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include what are called multimodal models, which are trained by combining multiple different types of data.

[0024] The machine learning model used to modify the program code 210 may be an internal configuration of the vulnerability handling device 100 or an external configuration. If the machine learning model is an internal configuration, the correction unit 103 inputs the vulnerability list 110 and the program code 210 included in the determination result 120 into the machine learning model. Note that the correction unit 103 may, for example, convert the vulnerability list 110 into a prompt or the like for instructing the program to be corrected, and input the converted vulnerability list 110 into the machine learning model. The machine learning model corrects the program code 210 to remove vulnerabilities based on the description in the vulnerability list 110, and generates corrected program code 130. If the machine learning model is configured externally, the correction unit 103 transmits the vulnerability list 110 and the program code 210 included in the determination result 120 to the machine learning model via a network interface device of the input / output device 904. Note that the correction unit 103 may, for example, convert the vulnerability list 110 into a prompt or the like for instructing the program to be corrected and transmit the converted vulnerability list 110 to the machine learning model. The machine learning model corrects the program code 210 to remove vulnerabilities based on the description in the vulnerability list 110, and generates corrected program code 130. The machine learning model transmits the generated corrected program code 130 to the correction unit 103 via a network interface device of the input / output device 904.

[0025] Next, in step S6, the detection unit 101 acquires the modified program code 130.

[0026] Next, in step S7, the detection unit 101 analyzes the vulnerability of the patch program code 130. As in step S2, the detection unit 101 uses the fault model to execute the correction program code 130. That is, the detection unit 101 simulates a fault attack on the device that executes the correction program code 130. Furthermore, the detection unit 101 analyzes the execution result of the modified program code 130, similarly to step S2. If there is an attack for which the attack success condition is satisfied, the patch program code 130 is vulnerable to that attack. The detection unit 101 generates a vulnerability list 110 in which vulnerabilities detected in the modified program code 130 are described. The contents of the vulnerability list 110 are as described above. The detection unit 101 outputs the vulnerability list 110 to the determination unit 102 .

[0027] Next, in step S8, the determining unit 102 refers to the vulnerability list 110 to determine whether or not the modified program code 130 needs to be modified. If the modification of the modified program code 130 is not necessary, the process proceeds to step S11. In this case, the determination unit 102 outputs the determination result 120 to the modification unit 103, which instructs the output of the final modified program code 220. On the other hand, if the modification program code 130 needs to be modified, the process proceeds to step S9. Step S8 will be described in detail later.

[0028] In step S9, the determining unit 102 instructs the modifying unit 103 to modify the modified program code 130. Specifically, the determining unit 102 outputs a determination result 120 that instructs the modification of the modification program code 130. The determination result 120 includes a vulnerability list 110.

[0029] Next, in step S10, the modifying unit 103 modifies the modified program code 130. That is, the modifying unit 103 modifies the modified program code 130 to remove the vulnerabilities described in the vulnerability list 110 included in the determination result 120 . The modifying unit 103 modifies the modified program code 130 in the same procedure as in step S5. The modifying unit 103 outputs the modified program code 130 to the detecting unit 101 . Thereafter, steps S6 to S10 are repeated until the determination in step S8 is NO.

[0030] In step S11, the modifying unit 103 acquires the determination result 120 instructing the output of the final modified program code 220, and outputs the latest modified program code 130 as the final modified program code 220.

[0031] Next, step S3 in FIG. 3 will be described in detail with reference to FIG.

[0032] First, in step S31, the determining unit 102 determines whether or not the vulnerability list 110 describes a vulnerability ("program address, assembler instruction, fault model"). If the vulnerability is described in vulnerability list 110, the process proceeds to step S32. On the other hand, if the vulnerability is not described in vulnerability list 110, the process proceeds to step S34.

[0033] In step S32, the determination unit 102 determines to modify the program code 210. Then, the determination unit 102 outputs the determination result 120, which instructs the modification unit 103 to modify the program code 210.

[0034] Furthermore, in step S33, the decision unit 102 increments the counter value. This counter value is a value for counting the number of times the program code 210 is modified by the modifying unit 103.

[0035] In step S34, the determination unit 102 determines that no modification to the program code 210 is necessary.

[0036] Next, step S8 in FIG. 3 will be described in detail with reference to FIG.

[0037] First, in step S81, the determining unit 102 determines whether or not the vulnerability list 110 describes a vulnerability (“program address, assembler instruction, fault model”). If the vulnerability is described in vulnerability list 110, the process proceeds to step S82. On the other hand, if the vulnerability is not described in vulnerability list 110, the process proceeds to step S85.

[0038] In step S82, the determination unit 102 determines whether the counter value has reached the threshold value. If the counter value has not reached the threshold value, the process proceeds to step S83. On the other hand, if the counter value has reached the threshold value, the process proceeds to step S85.

[0039] In step S83, the determination unit 102 determines to modify the modified program code 130. Then, the determination unit 102 outputs the determination result 120 to the modification unit 103, which instructs to modify the modified program code 130.

[0040] Furthermore, in step S84, the decision unit 102 increments the counter value. Thereafter, the process of step S9 in FIG. 3 is carried out.

[0041] In step S85, the determination unit 102 determines that the modification to the program code 210 is finished.

[0042] Next, in step S86, the determining unit 102 instructs the modifying unit 103 to output the final modified program code 220. That is, the determining unit 102 outputs the determination result 120 to the modifying unit 103, which instructs the modifying unit 103 to output the latest modified program code 130 as the final modified program code 220. Thereafter, the process of step S11 in FIG. 3 is carried out.

[0043] ***Explanation of the effect of the embodiment*** According to this embodiment, it is possible to appropriately modify program code to address vulnerabilities to fault attacks. In other words, in this embodiment, whether or not vulnerabilities remain in the modified program code is verified, and the program code is repeatedly modified until the vulnerabilities are eliminated. Therefore, according to this embodiment, it is possible to obtain program code that is resistant to fault attacks.

[0044] Embodiment 2 In this embodiment, differences from the first embodiment will be mainly described. The matters not explained below are the same as those in the first embodiment.

[0045] ***Configuration Description*** FIG. 6 shows an example of the functional configuration of the vulnerability handling device 100 according to this embodiment. 1, an inspection unit 104 is added in FIG.

[0046] The inspection unit 104 acquires the program code 210 from the detection unit 101 . Furthermore, the inspection unit 104 acquires the modified program code 130 from the modification unit 103 . Then, the checking unit 104 checks whether the modified program code 130 is equivalent to the program code 210. In other words, the checking unit 104 checks whether the program code after modification by the modifying unit 103 is equivalent to the program code before modification by the modifying unit 103. Equivalent means that the modified program code 130 has the same functions as the program code 210. For example, if the modified program code 130 passes a test case that the program code 210 passed, the modified program code 130 and the program code 210 are equivalent. If the checking unit 104 determines that the modified program code 130 is equivalent to the program code 210, it outputs the modified program code 130 to the detecting unit 101 and the determining unit 102. On the other hand, when it is determined that the modified program code 130 is not equivalent to the program code 210, the inspection unit 104 causes the modification unit 103 to re-modify the modified program code 130. In other words, the inspection unit 104 causes the modification unit 103 to modify the modified program code 130 so that the modified modified program code 130 is equivalent to the program code 210. If the correction program code 130 needs to be corrected, the inspection unit 104 outputs an inspection result 140 to the correction unit 103, which instructs the correction program code 130 to be corrected. The function of the inspection unit 104 is also realized by a program, similar to the detection unit 101 etc. The program that realizes the function of the inspection unit 104 is executed by the processor 901.

[0047] In this embodiment, the modifying unit 103 outputs the modified program code 130 to the checking unit 104 . Furthermore, when the inspecting unit 104 instructs the modification of the modified program code 130 , the modifying unit 103 modifies the modified program code 130 so that the modified program code 130 is equivalent to the program code 210 .

[0048] The detection unit 101 outputs the program code 210 to the determination unit 102 , the correction unit 103 and the inspection unit 104 . Furthermore, the detection unit 101 acquires the modified program code 130 that has been determined by the inspection unit 104 to be equivalent to the program code 210, and detects vulnerabilities in the acquired modified program code 130.

[0049] The determining unit 102 acquires the program code 210 from the detecting unit 101. The determining unit 102 also acquires the modified program code 130 from the inspecting unit 104. As in the first embodiment, the determining unit 102 refers to the vulnerability list 110 and determines whether or not any vulnerability remains in the modified program code 130. Furthermore, in this embodiment, the determination unit 102 compares the program code 210 with the modified program code 130 or the latest modified program code 130 with the modified program code 130 immediately before the latest modified program code 130, and determines whether the modification unit 103 has made a new modification to the modified program code 130. If the modification unit 103 is no longer able to make a new modification to the modified program code 130, even though vulnerabilities remain, the determination unit 102 decides to end the modification to the modified program code 130.

[0050] ***Explanation of Operation*** Next, an example of the operation of the vulnerability handling device 100 according to this embodiment will be described with reference to FIGS.

[0051] In FIG. 7, steps S1 to S5 are the same as those described in the first embodiment, and therefore the description will be omitted. In this embodiment, after step S5, the correcting unit 103 outputs the corrected program code 130, which is the program code 210 after the correction, to the checking unit 104.

[0052] The inspection unit 104 acquires the modified program code 130 from the modification unit 103, and inspects the modified program code 130 in step S21. That is, the checking unit 104 checks whether the modified program code 130 is equivalent to the program code 210 . For example, the checking unit 104 checks whether the modified program code 130 passes a test case that the program code 210 passed (whether the input and output of the function are the same). If the modified program code 130 passes the test case, the checking unit 104 determines that the modified program code 130 and the program code 210 are equivalent. Furthermore, the inspection unit 104 may inspect whether or not the state of a specific register value and / or a specific memory value at a specific program address is the same between the program code 210 and the modified program code 130. If the state of the specific register value and / or a specific memory value is the same between the program code 210 and the modified program code 130, the inspection unit 104 determines that the modified program code 130 and the program code 210 are equivalent.

[0053] If the modified program code 130 and the program code 210 are not equivalent (NO in step S22), the process proceeds to step S24. On the other hand, if the modified program code 130 and the program code 210 are equivalent (YES in step S22), the process proceeds to step S6 in Fig. 8. Furthermore, the inspection unit 104 outputs the modified program code 130 to the detection unit 101 and the determination unit 102.

[0054] In step S24, the inspection unit 104 instructs the modification unit 103 to modify the modified program code 130 so that the modified program code 130 is equivalent to the program code 210. The inspection unit 104 outputs the inspection result 140 to the modification unit 103, which instructs the modification unit 103 to modify the modified program code 130.

[0055] Next, in step S25, the modifying unit 103 modifies the modified program code 130 so that the modified program code 130 becomes equivalent to the program code 210. The modification unit 103 modifies the modified program code 130 by using, for example, a machine learning model. The machine learning model is a model obtained by performing machine learning to realize a modification that can remove vulnerabilities and makes the modified program code equivalent to the program code before modification. Moreover, the correction unit 103 may use the correction method described in Patent Document 1, for example. The correcting unit 103 outputs the corrected program code 130 to the checking unit 104 .

[0056] The machine learning model used to modify the modification program code 130 may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning. The machine learning model may be a model obtained by performing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. The machine learning model may also be a model called an NN model, a CNN model, an RNN, a VAE, a GAN, a diffusion model, a Transformer model, an LLM, a VLM, a BERT, a GPT, or a CLIP. The machine learning model may also be a rule-based model, such as a decision tree or a random forest, that obtains output results by referencing a predetermined table or making a decision based on predetermined conditions. The above-mentioned models are not exclusive; for example, LLM, VLM, BERT, and GPT are included in the Transformer model. The Transformer model is also included in the NN model. Machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include multimodal models, which are trained by combining multiple different types of data.

[0057] The machine learning model used to correct the correction program code 130 may be an internal configuration of the vulnerability handling device 100 or an external configuration. If the machine learning model is an internal configuration, the correction unit 103 inputs the corrected program code 130 and the program code 210 to the machine learning model. Note that the correction unit 103 may input, for example, a prompt or the like to instruct the machine learning model to correct the program. The machine learning model corrects the corrected program code 130 so that the corrected corrected program code 130 is equivalent to the program code 210. When the machine learning model is configured externally, the correction unit 103 transmits the modified program code 130 and the program code 210 to the machine learning model via a network interface device of the input / output device 904. The correction unit 103 may transmit, for example, a prompt or the like to instruct the machine learning model to modify the program. The machine learning model corrects the modified program code 130 so that the modified modified program code 130 is equivalent to the program code 210. The machine learning model transmits the modified modified program code 130 to the correction unit 103 via a network interface device of the input / output device 904.

[0058] Thereafter, the processes from step S21 onwards are repeated until it is determined that the modified program code 130 after the modification is equivalent to the program code 210. The inspection unit 104 may count the number of times the correction program code 130 has been corrected, and when the number of times has reached a predetermined threshold, may terminate the correction of the correction program code 130. In this case, the inspection unit 104 may display, for example, on the display of the input / output device 904, a message indicating that the processing has ended because the number of times the correction has reached the threshold.

[0059] In FIG. 8, steps S6 and S7 are the same as those explained in the first embodiment, and therefore explanations thereof will be omitted.

[0060] In step S80, the determination unit 102 determines whether or not the modified program code 130 needs to be modified. More specifically, the determining unit 102 determines whether or not a vulnerability remains in the modified program code 130 and whether or not the counter value has reached a threshold value, similarly to the first embodiment. Furthermore, in this embodiment, the determining unit 102 determines whether or not the modifying unit 103 has made a new modification to the modified program code 130. Step S80 will be described in detail later.

[0061] If the modification program code 130 needs to be modified, the process proceeds to steps S9 and S10. On the other hand, if the modification of the modification program code 130 is not necessary, the process proceeds to step S11. Steps S9 to S11 are the same as those explained in the first embodiment, and therefore explanations thereof will be omitted. In this embodiment, after step S10, the correcting unit 103 outputs the corrected program code 130 to the checking unit 104.

[0062] The inspection unit 104 acquires the modified program code 130 from the modification unit 103, and inspects the modified program code 130 in step S26. The checking unit 104 checks whether the modified program code 130 is equivalent to the program code 210 in the same manner as in step S21.

[0063] If the modified program code 130 and the program code 210 are not equivalent (NO in step S27), the process proceeds to step S28. On the other hand, if the modified program code 130 and the program code 210 are equivalent (YES in step S27), the process proceeds to step S6. Also, the checking unit 104 outputs the modified program code 130 to the detecting unit 101 and the determining unit 102.

[0064] In step S28, the inspection unit 104 instructs the modification unit 103 to modify the modified program code 130 so that the modified program code 130 is equivalent to the program code 210. The inspection unit 104 outputs the inspection result 140 to the modification unit 103, which instructs the modification unit 103 to modify the modified program code 130.

[0065] Next, in step S29, the modifying unit 103 modifies the modified program code 130 so that the modified program code 130 becomes equivalent to the program code 210. The modifying unit 103 modifies the modified program code 130 so that the modified program code 130 becomes equivalent to the program code 210 in the same manner as in step S25. The correcting unit 103 outputs the corrected program code 130 to the checking unit 104 .

[0066] Thereafter, the processes from step S26 onwards are repeated until it is determined that the modified program code 130 after the modification is equivalent to the program code 210. The inspection unit 104 may count the number of times the correction program code 130 has been corrected, and when the number of times has reached a predetermined threshold, may terminate the correction of the correction program code 130. In this case, the inspection unit 104 may display, for example, on the display of the input / output device 904, a message indicating that the processing has ended because the number of times the correction has reached the threshold.

[0067] Next, step S80 in FIG. 8 will be described in detail with reference to FIG.

[0068] First, step S81 is the same as that explained in the first embodiment, and therefore the explanation will be omitted. If the vulnerability is described in the vulnerability list 110, the process proceeds to step S801. On the other hand, if the vulnerability is not described in the vulnerability list 110, the process proceeds to step S85.

[0069] In step S801, the determination unit 102 determines whether the modified program code 130 has changed from the program code 210 or the previous modified program code 130. If the program code immediately before the latest modified program code 130 is the program code 210, the determination unit 102 compares the modified program code 130 with the program code 210 to determine whether the modified program code 130 has changed from the program code 210. When the program code immediately before the latest modified program code 130 is the modified program code 130, the determination unit 102 compares the latest modified program code 130 with the immediately previous modified program code 130 to determine whether the latest modified program code 130 has changed from the immediately previous modified program code 130.

[0070] If the program code has changed, the process proceeds to step S802, whereas if the program code has not changed, the process proceeds to step S803.

[0071] In step S802, the decision unit 102 clears the invariant count. The number of invariants is the number of times the program code remains unchanged.

[0072] In step S803, the determination unit 102 determines whether the number of invariant times has reached a threshold value. If the number of invariants reaches the threshold value, the process proceeds to step S85. On the other hand, if the number of invariants has not reached the threshold value, the process proceeds to step S804.

[0073] In step S804, the determination unit 102 increments the invariant count.

[0074] Steps S82 to S86 are the same as those explained in the first embodiment, and therefore the explanation will be omitted.

[0075] In this manner, in this embodiment, the determination unit 102 determines whether or not a new modification has been made to the latest program code from the previous program code. If a state in which a new modification has not been made continues, the determination unit 102 determines to end the modification of the program code.

[0076] ***Explanation of the effect of the embodiment*** In this embodiment, it is checked whether the modified program code retains the functions of the program code before modification, and therefore, according to this embodiment, it is possible to ensure that the modified program code retains the functions of the program code before modification. Furthermore, in this embodiment, if no new modifications have been made to the latest program code from the previous program code, it is determined that the modification of the program code will be terminated. Therefore, according to this embodiment, it is possible to quickly terminate a state in which the program code cannot be completely modified.

[0077] In the first and second embodiments, the correction unit 103 corrects the program code using a machine learning model. Alternatively, the modifying unit 103 may perform syntax analysis and vulnerability classification to select a method for modifying the program code, and modify the program code in accordance with the selected method. The modification method may be preset in a modification method database, for example. By performing the syntactic analysis, the correction unit 103 can determine the portion of the program code to be corrected. For the syntactic analysis, a known syntactic analysis method such as the LR algorithm or the LALR algorithm can be used. The syntactic analysis may also be performed using a machine learning model. The machine learning model is a model obtained by performing machine learning for syntactic analysis of the program code based on the program grammar. Furthermore, in vulnerability classification, the repair unit 103 can classify vulnerabilities based on a fault model and a target instruction type (arithmetic operation, bit operation, branch, memory access, jump, etc.). Information for classifying vulnerabilities is set in advance in a vulnerability database, for example. Vulnerability classification can be performed by referring to the vulnerability database and searching for matching vulnerabilities. Vulnerability classification may also be performed using a machine learning model. The machine learning model is a model obtained by performing machine learning to classify vulnerabilities in program code based on a fault model and a target instruction type.

[0078] The machine learning model used for syntax analysis and vulnerability classification may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning. The machine learning model may be a model obtained by executing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. In addition, the machine learning model may be, for example, an NN model, a CNN model, an RNN, a VAE, a GAN, a diffusion model, a Transformer model, an LLM, a VLM, a BERT, a GPT, or a CLIP. The machine learning model may be a rule-based model that obtains an output result by referencing a predetermined table or making a decision based on predetermined conditions, such as a decision tree or random forest. The above-mentioned models are not exclusive, and for example, LLM, VLM, BERT, and GPT are included in the Transformer model. For example, the Transformer model is included in the NN model. Machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include what are called multimodal models that are trained by combining multiple different types of data.

[0079] The machine learning model used for syntax analysis and vulnerability classification may be an internal configuration of the vulnerability handling device 100 or an external configuration. If the machine learning model is an internal configuration, the correction unit 103 inputs the program code 210 to the machine learning model. The correction unit 103 may input, for example, a prompt for instructing the analysis of the program to the machine learning model. The machine learning model performs syntax analysis and vulnerability classification of the program code 210, and generates a program correction method as the analysis result. If the machine learning model is configured externally, the correction unit 103 transmits the program code 210 to the machine learning model via a network interface device of the input / output device 904. The correction unit 103 may transmit, for example, a prompt for instructing the machine learning model to analyze the program. The machine learning model performs syntax analysis and vulnerability classification of the program code 210, and generates a program correction method as the analysis result. The machine learning model transmits the generated program correction method to the correction unit 103 via a network interface device of the input / output device 904. By using a machine learning model to perform syntax analysis and vulnerability classification, a more precise program modification method can be generated, and therefore the modifying unit 103 can improve the accuracy of program modification. The program correction method generated by the machine learning model may be a text-readable prompt, a command sequence, a source code program, or the like, or may be an executable binary program. By making the program correction method text-readable, the user can easily confirm whether the program correction method generated by the machine learning model is correct.

[0080] Although the first and second embodiments have been described above, these two embodiments may be combined and implemented. Alternatively, one of these two embodiments may be partially implemented. Alternatively, these two embodiments may be partially combined and implemented. Furthermore, the configurations and procedures described in these two embodiments may be modified as necessary.

[0081] ***Additional hardware configuration information*** Here, a supplementary explanation of the hardware configuration of the vulnerability handling device 100 will be given. The processor 901 shown in FIG. 2 is an integrated circuit (IC) that performs processing. The processor 901 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or the like. The main storage device 902 shown in FIG. 2 is a RAM (Random Access Memory). The auxiliary storage device 903 shown in FIG. 2 is a ROM (Read Only Memory), a flash memory, an HDD (Hard Disk Drive), or the like.

[0082] The auxiliary storage device 903 also stores an OS (Operating System). At least a part of the OS is executed by the processor 901 . The processor 901 executes at least a part of the OS, and also executes programs that implement the functions of the functional components shown in FIGS. The processor 901 executes the OS, which performs task management, memory management, file management, communication control, and the like. In addition, at least one of information, data, signal values, and variable values ​​indicating the results of processing of the functional components shown in Figures 1 and 6 is stored in at least one of the main memory device 902, the auxiliary memory device 903, and the registers and cache memory within the processor 901. 1 and 6 may be stored on a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, a DVD, etc. The portable recording medium storing the program for realizing the functions of the functional components shown in FIG. 1 and 6 may be distributed.

[0083] Furthermore, the "part" of at least one of the functional components shown in FIGS. 1 and 6 may be read as a "circuit" or a "step" or a "procedure" or a "process" or a "circuitry." The vulnerability handling device 100 may be realized by a processing circuit. The processing circuit may be, for example, a logic IC (Integrated Circuit), a GA (Gate Array), or an ASIC (Application Specific Integrated Circuit). FPGA (Field-Programmable Gate Array). In this case, the functional components shown in FIGS. 1 and 6 are each implemented as part of a processing circuit. In this specification, the term "processing circuitry" refers to a generic concept that encompasses a processor and a processing circuit. That is, a processor and a processing circuit are each specific examples of "processing circuitry."

[0084] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) a detection unit that detects vulnerabilities to fault attacks contained in program code; a correction unit that corrects the program code to address the vulnerability detected by the detection unit; a determination unit that determines whether or not the program code after the correction by the correction unit is vulnerable to the fault attack. (Appendix 2) The correction unit when the determination unit determines that the program code is vulnerable to the fault attack, the determination unit modifies the program code to address the vulnerability determined to be present in the program code; The determination unit 2. A vulnerability handling device according to claim 1, which determines whether or not the program code after modification by the modification unit is vulnerable to the fault attack. (Appendix 3) The determination unit 3. A vulnerability handling device according to claim 1, which decides to end modification of the program code when it is determined that the program code is not vulnerable to the fault attack. (Appendix 4) The determination unit A vulnerability handling device according to any one of appendices 1 to 3, which decides to end modification of the program code when the program code is vulnerable to the fault attack but the number of times that it has been determined whether the program code is vulnerable to the fault attack has reached a threshold value. (Appendix 5) The determination unit A vulnerability handling device described in any of Appendices 1 to 4, which decides to end modifications to the program code when the program code is vulnerable to the fault attack but the modification unit is no longer able to make new modifications to the program code. (Appendix 6) The vulnerability handling device further a verification unit that verifies whether the program code after the modification by the modification unit is equivalent to the program code before the modification by the modification unit; The determination unit A vulnerability handling device as described in any of Appendices 1 to 5, which, when the inspection unit determines that the program code after modification by the modification unit is equivalent to the program code before modification by the modification unit, determines whether the program code after modification by the modification unit is vulnerable to the fault attack. (Appendix 7) The inspection unit A vulnerability addressing device as described in Appendix 6, which causes the modification unit to modify the program code again if it determines that the program code after modification by the modification unit is not equivalent to the program code before modification by the modification unit. (Appendix 8) The correction unit 8. A vulnerability handling device according to any one of appendices 1 to 7, which uses a trained model obtained by machine learning to make modifications to the program code to address vulnerabilities detected by the detection unit. (Appendix 9) The correction unit A vulnerability handling device according to any one of appendices 1 to 8, which analyzes vulnerabilities detected by the detection unit, selects a method of modifying the program code based on the analysis results, and modifies the program code in accordance with the selected method of modifying. (Appendix 10) The computer detects a vulnerability to a fault attack in the program code, the computer applies modifications to the program code to address the detected vulnerabilities; The vulnerability handling method includes the computer determining whether or not the program code after the correction is vulnerable to the fault attack. (Appendix 11) a detection process for detecting vulnerabilities to fault attacks contained in program code; a correction process for correcting the program code to address the vulnerability detected by the detection process; and a determination process for determining whether or not the program code after the correction process has been performed is vulnerable to the fault attack. [Explanation of symbols]

[0085] 100 vulnerability handling device, 101 detection unit, 102 judgment unit, 103 correction unit, 104 inspection unit, 110 vulnerability list, 120 judgment result, 130 correction program code, 140 inspection result, 210 program code, 220 final correction program code, 901 processor, 902 main memory device, 903 auxiliary memory device, 904 input / output device.

Claims

1. a detection unit that detects vulnerabilities to fault attacks contained in program code; a correction unit that classifies the vulnerabilities detected by the detection unit based on a fault model and a target instruction type, selects a correction method for the program code based on the classification result, and corrects the program code to address the vulnerabilities detected by the detection unit in accordance with the selected correction method; a determination unit that determines whether the program code after the modification unit has performed the modification is vulnerable to the fault attack, and if it determines that the program code is not vulnerable to the fault attack, decides to end the modification to the program code even if the number of times that it has determined whether the program code is vulnerable to the fault attack has not reached a threshold.

2. The correction unit when the determination unit determines that the program code is vulnerable to the fault attack, the determination unit modifies the program code to address the vulnerability determined to be present in the program code; The determination unit The vulnerability handling device according to claim 1 , wherein it is determined whether or not the program code after the correction by the correction unit is vulnerable to the fault attack.

3. The determination unit A vulnerability handling device as described in claim 1, which decides to end modifications to the program code when the program code is vulnerable to the fault attack and the number of times it has been determined whether the program code is vulnerable to the fault attack has reached a threshold.

4. The determination unit A vulnerability handling device as described in claim 1, which decides to end modifications to the program code when the program code is vulnerable to the fault attack but the modification unit is no longer able to make new modifications to the program code.

5. The vulnerability handling device further a verification unit that verifies whether the program code after the modification by the modification unit is equivalent to the program code before the modification by the modification unit; The determination unit A vulnerability handling device as described in claim 1, wherein when the inspection unit determines that the program code after being modified by the modification unit is equivalent to the program code before being modified by the modification unit, it determines whether the program code after being modified by the modification unit is vulnerable to the fault attack.

6. The inspection unit A vulnerability addressing device as described in claim 5, which causes the modification unit to modify the program code again when it determines that the program code after modification by the modification unit is not equivalent to the program code before modification by the modification unit.

7. The correction unit The vulnerability detection device according to claim 1, wherein the program code is modified to address the vulnerability detected by the detection unit using a trained model obtained by machine learning. Sexual coping device.

8. The computer detects a vulnerability to a fault attack in the program code, the computer classifies the detected vulnerabilities based on a fault model and a target instruction type, selects a modification method for the program code based on the classification result, and modifies the program code to address the detected vulnerabilities in accordance with the selected modification method; A vulnerability handling method in which the computer determines whether the program code after the correction is made is vulnerable to the fault attack, and if it determines that the program code is not vulnerable to the fault attack, decides to end the correction to the program code even if the number of times it has determined whether the program code is vulnerable to the fault attack has not reached a threshold.

9. a detection process for detecting vulnerabilities to fault attacks contained in program code; a correction process of classifying the vulnerabilities detected by the detection process based on a fault model and a target instruction type, selecting a correction method for the program code based on the classification result, and correcting the program code to address the vulnerabilities detected by the detection process in accordance with the selected correction method; A vulnerability management program that causes a computer to execute a determination process that determines whether or not the program code after the correction process has been performed is vulnerable to the fault attack, and if it is determined that the program code is not vulnerable to the fault attack, decides to end the correction to the program code even if the number of times that the program code has been determined to be vulnerable to the fault attack has not reached a threshold.

Images