Information processing device, information processing method and system

Abstract

To facilitate generation of an identifier for specifying software included in an apparatus in a predetermined format.SOLUTION: An information processing device includes: a first vulnerability information acquisition unit that acquires first vulnerability information from a first server; a second vulnerability information acquisition unit that acquires second vulnerability information from a second server; a first configuration information acquisition unit that acquires first configuration information including a name and a version of object software included in an object apparatus; a scanner that, based on the first configuration information, detects a first identifier including the name of the object software from the first vulnerability information, and specifies a vulnerability identifier corresponding to the detected first identifier; a retrieval unit that, based on the second vulnerability information, specifies a second identifier corresponding to the vulnerability identifier specified by the scanner and also including the same software name as the object software name; and an output unit that generates a third identifier by replacing a version included in the specified second identifier with the version of the object software.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] FIELD Embodiments of the present invention relate to an information processing device, an information processing method, and a system. [Background technology]

[0002] Every day, information about vulnerabilities in various products (vulnerability information) is published on public servers (general-purpose servers) all over the world. Product manufacturers need to determine whether the published vulnerabilities are contained in the products they manufacture. As a result, there is an increasing need for vulnerability monitoring systems that collect the vulnerability information published daily and compare it with information on devices (products) to detect vulnerabilities.

[0003] On general-purpose servers, vulnerabilities correspond to configuration information that indicates the software and other components affected by the vulnerability. A generic, global identifier called a Common Platform Enumeration (CPE) is used to represent configuration information on general-purpose servers. Therefore, by looking at the CPE on a general-purpose server, manufacturers can determine whether the same CPE that indicates information about the components included in the equipment they manufactured has been published. If so, they can determine what vulnerabilities the equipment they manufactured contains. To achieve this, vulnerability monitoring systems must store and describe device configuration information in a specified CPE format. However, the CPE format is complex, making it difficult to create a CPE, and creating it manually is costly (in terms of time and money). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-21309 Summary of the Invention [Problem to be solved by the invention]

[0005] The embodiments of the present invention provide an information processing device, an information processing method, and a system that enable easy generation of an identifier that identifies software included in a device in a predetermined format. [Means for solving the problem]

[0006] an information processing device according to this embodiment, comprising: a first vulnerability information acquisition unit that acquires, from a first server specific to a platform, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; a second vulnerability information acquisition unit that acquires, from a second server, a second identifier that identifies software included in an equipment in a predetermined format including the name and version of the software, and second vulnerability information in which the vulnerability identifier corresponds to the software; a first configuration information acquisition unit that acquires, from a target equipment of vulnerability testing, first configuration information in which the name and version of target software included in the target equipment; a scanner that, based on the first configuration information, detects a first identifier including the name of the target software from the first vulnerability information and identifies a vulnerability identifier corresponding to the detected first identifier; a search unit that, based on the second vulnerability information, identifies a second identifier that corresponds to the vulnerability identifier identified by the scanner and includes a software name that is the same as the name of the target software; and an output unit that generates a third identifier that identifies the target software included in the target equipment in the predetermined format by replacing the version included in the second identifier identified by the search unit with the version of the target software. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram of a vulnerability monitoring system according to an embodiment. [Figure 2] FIG. 4 is a diagram showing an example of first configuration information. [Figure 3] FIG. 10 is a diagram showing an example of first vulnerability information. [Figure 4]FIG. 10 is a diagram showing an example of second vulnerability information. [Figure 5] FIG. 10 is a diagram showing an example of second configuration information. [Figure 6] 10 is a flowchart showing an example of processing of the vulnerability monitoring system. [Figure 7] FIG. 2 is a block diagram of a configuration information conversion unit according to a first configuration example of an embodiment. [Figure 8] FIG. 10 is a diagram showing first configuration information in which a version has been invalidated and information in a first vulnerability database. [Figure 9] FIG. 10 is a diagram showing first configuration information and information in a first vulnerability database in which versions have been invalidated. [Figure 10] 10 is a flowchart showing an example of processing by a configuration information conversion unit. [Figure 11] FIG. 10 is a block diagram of a configuration information conversion unit according to a second configuration example of an embodiment. [Figure 12] FIG. 10 is a block diagram of a configuration information conversion unit according to a third configuration example of an embodiment. [Figure 13] FIG. 10 is a block diagram of a configuration information conversion unit according to a fourth configuration example of an embodiment. [Figure 14] FIG. 1 is a diagram showing a hardware configuration of an information processing apparatus according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0009] [Overall overview of vulnerability monitoring system 1] 1 is a block diagram showing a vulnerability monitoring system 1, which is an information processing system according to one embodiment. An overview of the vulnerability monitoring system 1 will be described below.

[0010] The vulnerability monitoring system 1 includes a vulnerability monitoring device 2, a specific server 6, a general-purpose server 7, and multiple types of devices 10_1 to 10_M (M≧1). M represents the number of types of devices 10, not the number. Hereinafter, any type i of device 10 will be referred to as device 10_i (i=1 to M).

[0011] The vulnerability monitoring system 1 collects configuration information of multiple types of devices 10_1 to 10_M, which are products before shipment, and constantly monitors vulnerabilities that may occur in the products.If a vulnerability is discovered, the vulnerability monitoring system 1 notifies the user of the vulnerability monitoring system 1.

[0012] One or more pieces of software that realize various functions are installed in a device 10_i of type i. Typically, there are various types of devices 10_i, each with different configuration information. The device 10_i is, for example, a PC or a device that is a target of IoT (Internet of Things).

[0013] The configuration information is information indicating what components (software, etc.) the device 10_i is configured of. For example, the configuration information is information such as "the device 10_i includes software 1 and software 2."

[0014] Software specific to a certain platform (e.g., OS) is installed in the device 10 in units called packages when the platform is Linux, for example. A package is a collection of software executable files, configuration files, documentation, etc. It is common for platforms other than Linux to manage a complete set of software using a system equivalent to a package. For the sake of convenience, software specific to a certain platform will be referred to as a "package" below, but this does not limit the platform to Linux.

[0015] FIG. 2 shows an example of the configuration information (first configuration information) of the devices 10_1 to 10_M. That is, FIG. 2 shows an example of information (package information) of packages installed in the devices 10_1 to 10_M. The package information includes the name of the package (package name) and the version of the package. The package information is a platform-specific identifier (first identifier) ​​prepared by the platform. In other words, the configuration information included in the device 10_i is platform-specific and not general-purpose. Furthermore, a package is uniquely identified by the package name and version of the package.

[0016] In the example of FIG. 2, "Package 1" of "Version 1.3.6" is installed in the device 10_1. Note that the platforms of packages installed in the same type of device 10_i do not need to be the same. For the sake of explanation, the package installed in the device 10_1 may be referred to as package X (target software) below.

[0017] The unique server 6 accumulates and publishes vulnerability information (first vulnerability information) that is discovered daily all over the world. The unique server 6 is a server that is publicly available on the Internet, and anyone can view the contents.

[0018] The specific server 6 is a server set up by a vendor for the platform it provides, and vulnerability information is written in a format specific to use on that platform. The vendor is responsible for managing the products that belong to that platform. For example, the specific server 6 provided by a Linux distributor stores information that can reliably discover vulnerabilities in packages installed on Linux.

[0019] FIG. 3 shows an example of the first vulnerability information held by the specific server 6. A vulnerability is uniquely identified by a vulnerability number. On the specific server 6, as shown in FIG. 3, a vulnerability number corresponds to the package name and version (range) of the package affected by the vulnerability. For example, a vulnerability indicated by vulnerability number CVE-2018-XXXX indicates that it affects package 1 up to version 1.1.1.

[0020] On the specific server 6, there is no ambiguity or error in the contents of the package name, affected version (range), and vulnerability number, and even if there is an error, it is highly likely that it will be corrected immediately.

[0021] The scope of impact of a vulnerability may be defined with an upper and lower limit, such as "0.5.1 to 1.1.1." However, in reality, vulnerabilities often exist in packages other than the latest version, and so on the dedicated server 6, the scope of impact is generally defined by only the upper limit. In the following, we will assume realistic registration content and define the scope of impact by only the upper limit.

[0022] The vulnerability number is, for example, CVE (Common Vulnerabilities and Exposures). CVE is written with the publication year and a serial number. CVE is common worldwide and is common to the specific server 6 and the general-purpose server 7.

[0023] Both the device 10_i and the specific server 6 use the first identifier (package name and version (range)). This is because the specific server 6 is expected to be used mainly by a platform-specific vulnerability scanner (scanner). A scanner is software that determines whether a package contains vulnerabilities based on package information of the package of the platform being inspected.

[0024] For example, assume that package X, which is "Package 1" with version 1.3.6, is installed on device 10_1 (target device) that is the target of the scanner. Based on the information shown in Figure 3, the scanner determines that package X is package 1 and that the version of package X is greater than 1.1.1, and determines that the target device does not contain the vulnerability "CVE-2018-XXXX." Similarly, the scanner determines that the version of package X is less than 6.0.0, and determines that package X contains the vulnerability "CVE-2021-YYYY."

[0025] The general-purpose server 7 accumulates and publishes vulnerability information (secondary vulnerability information) that is discovered daily all over the world. The general-purpose server 7 is a server that is publicly available on the Internet, and anyone can view its contents.

[0026] The general-purpose server 7 is not dependent on a specific platform and contains general-purpose information. Here, "general-purpose information" refers to information that can be read by humans and does not contain information that is only useful for a specific platform. Therefore, a general-purpose identifier (second identifier) ​​is used on the general-purpose server to represent configuration information. The second identifier is, for example, a CPE. The general-purpose server 7 is, for example, an NVD (National Vulnerability Database). In the following description, the second identifier is assumed to be a CPE.

[0027] A CPE is an identifier that uniquely identifies a component, such as software (package) included in a device, by describing that component in a specific format. For example, one piece of software included in a device is described by one CPE. Therefore, multiple CPEs are associated with a device that includes multiple pieces of software. Components can include not only software but also hardware, an OS, etc.

[0028] The CPE is written in a specific format (CPE format). The CPE format is, for example, a URI format. Specifically, each element for uniquely identifying a component is written, such as "cpe: / type:vendor name:product name:version:update:edition:language."

[0029] "Type" describes the type of platform for the component, such as hardware (h), OS (o), or application (a). "Vendor name" describes the name of the component's vendor. "Product name" describes the name of the component's product. "Version" describes a specific number or other information that indicates the version of the component. "Update" describes information about product updates and service packs. "Edition" describes how the product is provided. "Language" describes the language used in the product. Each element may be omitted as needed. If any element follows, it may be omitted with an asterisk (*).

[0030] According to the rules, CPE is recommended to use the existing vendor name and product name, and to identify a single piece of software, etc., using elements from the version onwards.

[0031] FIG. 4 shows the second vulnerability information held by the general-purpose server 7. As shown in FIG. 4, the general-purpose server 7 stores vulnerability information that links a vulnerability summary, risk level, and configuration information described with a second identifier. Vulnerability information is uniquely identified by a vulnerability number (CVE). The vulnerability summary is written in natural language. The risk level of the vulnerability is evaluated, for example, using CVSS. Each vulnerability corresponds to configuration information described in CPE format. In other words, on the general-purpose server 7, a vulnerability (vulnerability number) corresponds to configuration information affected by the vulnerability and described with a second identifier.

[0032] A person who can describe the first configuration information included in the device 10_i using the second identifier can identify the vulnerability included in the device 10_i from the second vulnerability information on the general-purpose server 7. For example, a person who knows that the device 10_i includes a component indicated by CPE1 can know that the device 10_i includes the vulnerability "CVE-2018-XXXX."

[0033] The vulnerability monitoring device 2 includes a configuration information conversion unit 3, a storage unit 4, and a vulnerable device determination unit 5. The vulnerability monitoring device 2 collects and stores configuration information from devices 10_1 to 10_M before shipment, and if a vulnerability is found in a device 10, notifies a user of the vulnerability monitoring system 1 of a warning. Specifically, when vulnerability information is made public on the general-purpose server 7 and / or the specific server 6, the vulnerability monitoring device 2 identifies a component affected by the vulnerability from an identifier corresponding to the vulnerability, and if the component is included in the device 10_1 to 10_M, notifies a warning to the user of the vulnerability monitoring system 1.

[0034] However, as described above, the first configuration information of the device 10_i is written using the first identifier, and therefore does not directly correspond to the second vulnerability information published on the general-purpose server 7. Therefore, it is necessary to generate second configuration information by converting the first identifier of the first configuration information collected from the devices 10_1 to 10_M into a third identifier (referred to as CPE') written in the same format (CPE format) as the second identifier. Here, vulnerability detection using the first vulnerability information on the specific server 6 can be performed using the first configuration information acquired from the device 10_i as is without converting it, and since the operation is self-evident, a description thereof will be omitted as appropriate.

[0035] First, the configuration information conversion unit 3 collects first configuration information from the devices 10_1 to 10_M. Since there are various types of devices 10, the configuration information conversion unit 3 collects the first configuration information without depending on a specific platform.

[0036] Then, the configuration information conversion unit 3 converts the collected first configuration information into second configuration information described with the third identifier (CPE'), and outputs the second configuration information. A specific conversion method will be described later.

[0037] 5 is an example of the second configuration information output by the configuration information conversion unit 3. As shown in FIG. 5, by describing the configuration information of the device 10_i in advance using the third identifier, the second vulnerability information on the general-purpose server 7 can be used to detect vulnerabilities in the device 10_i. As will be described later, the CPE' can be generated by replacing the version portion of the CPE (second identifier) ​​identified by the CPE search unit 312 (see FIG. 7) with the version of the software (target software) in the target device 10_i. The CPE' corresponds to a third identifier that describes the software in the target device 10_i in a predetermined format (CPE format in this embodiment) including the name and version of the software.

[0038] The storage unit 4 stores the second configuration information output by the configuration information conversion unit 3. With the storage unit 4, even if the device 10_i has been shipped and the user (manufacturer) does not have the actual device 10_i, the second configuration information of the device 10_i can be checked retroactively. Note that the storage unit 4 may also store the first configuration information.

[0039] The vulnerable device determination unit 5 constantly monitors the general-purpose server 7. When new second vulnerability information is published in the general-purpose server 7, the vulnerable device determination unit 5 acquires the second vulnerability information. Then, the vulnerable device determination unit 5 compares the second identifier included in the second vulnerability information with the third identifier included in the second configuration information stored in the storage unit 4. If a matching second identifier is present in the second vulnerability information, the vulnerable device determination unit 5 determines that the device 10_i in the second configuration information including the third identifier is vulnerable. Note that the vulnerable device determination unit 5 may also use the first configuration information and the first vulnerability information to detect vulnerabilities in the device 10_i in the same manner as described above.

[0040] 6 is a flowchart of the processing performed by the vulnerability monitoring device 2. The processing performed by the vulnerability monitoring device 2 will be described below with reference to FIG.

[0041] First, the configuration information conversion unit 3 acquires all of the first configuration information of the device 10_i from the device 10_i (step S1).

[0042] Next, the configuration information conversion unit 3 converts the first configuration information into second configuration information (step S2).

[0043] Next, the configuration information conversion unit 3 stores the second configuration information in the storage unit 4 (step S3).

[0044] Next, the vulnerable device determination unit 5 compares the third identifier included in the second configuration information stored in the storage unit 4 with the second identifier included in the second vulnerability information on the general-purpose server 7. If the two match, it is determined that the device 10_i that includes the second configuration information that includes the third identifier is vulnerable (step S4).

[0045] As described above, according to the vulnerability monitoring system 1, the vulnerability of the device 10_i having the configuration information described with the first identifier can be detected by using the second vulnerability information described with the third identifier.

[0046] <Configuration information conversion unit 3> [First configuration example] 7 is a block diagram of the configuration information conversion unit 3, which is an information processing device according to a first configuration example of an embodiment. The configuration of the configuration information conversion unit 3 and the processing performed by the configuration information conversion unit 3 will be described in detail below.

[0047] As described above, the configuration information conversion unit 3 is a device for converting the first configuration information acquired from the devices 10_1 to 10_M into second configuration information.

[0048] To convert the first configuration information into the second configuration information written in CPE, there is a method using the CPE dictionary published by the general-purpose server 7. The CPE dictionary contains the correspondence between package information and CPE. However, due to the historical reasons described below, the CPE dictionary has the following problems.

[0049] First, the CPE dictionary contains a large number of CPEs, making it difficult to determine which CPE is appropriate. Here, "appropriate CPE" refers to a proven CPE that has been regularly used on general-purpose servers 7 in the past. Appropriate CPEs do not necessarily have the correct description format, as shown below.

[0050] Second, vendor and software names are not standardized and are often written using common names, making it difficult to determine which CPE is appropriate. Also, vendor and software names may change due to acquisitions or company name changes, but some CPEs are written using the old vendor and software names to ensure compatibility with past CPEs.

[0051] Third, CPE descriptions are not strictly checked, so some CPEs contain errors. In addition, some CPEs containing errors are still in use to ensure compatibility with older CPEs.

[0052] For the above reasons, even if a CPE dictionary is used, it is difficult to convert the first configuration information. Furthermore, even those who are familiar with how to write CPEs cannot always write appropriate CPEs. In consideration of the above problems, the configuration information conversion unit 3 is configured to convert the first configuration information using the first vulnerability information on the specific server 6.

[0053] The configuration information conversion unit 3 includes a first vulnerability information acquisition unit 301, a first vulnerability DB 302, a second vulnerability information acquisition unit 303, a CPE candidate DB 304, a first configuration information acquisition unit 305, a name identification unit 306, a version identification unit 307, a version invalidation unit 308, an in-DB version invalidation unit 309, a scanner selection unit 310, a scanner 311, a CPE search unit 312 (search unit), a CPE output unit 313 (output unit), and a first configuration information DB 314.

[0054] The first vulnerability information acquisition unit 301 acquires, from the specific server 6, the first vulnerability information that has been made public on the specific server 6. The acquired first vulnerability information may be the information that has been made public by the specific server 6, as shown in Fig. 3. The first vulnerability information acquisition unit 301 may periodically acquire the first vulnerability information from the specific server 6, or may acquire the first vulnerability information every time the first vulnerability information is updated on the specific server 6.

[0055] The first vulnerability DB 302 stores the first vulnerability information acquired by the first vulnerability information acquisition unit 301. The first vulnerability DB 302 is initialized in advance, and the first vulnerability information is added and updated each time by the first vulnerability information acquisition unit 301. This is because the information on the specific server 6 changes daily.

[0056] 3 is stored in the first vulnerability DB 302. The first vulnerability DB 302 is a database used by the scanner 311 when detecting vulnerabilities from the first configuration information of the device 10_i. If the package name and version are known, the CVE of the vulnerability contained in the package can be identified by referring to the information in the first vulnerability DB 302.

[0057] The storage format of the first vulnerability DB 302 depends on the scanner 311 that uses the first vulnerability DB 302. The storage format is, for example, SQLite3 format or CSV (Comma Separated Value) format. As will be described later, an existing scanner may be used as the scanner 311, and an information acquisition program that comes with the existing scanner may be used as the first vulnerability information acquisition unit 301. In this case, multiple first vulnerability DBs 302 may be created for each type of scanner or platform.

[0058] The second vulnerability information acquisition unit 303 acquires, from the general-purpose server 7, second vulnerability information published on the general-purpose server 7. The acquired second vulnerability information may be the information itself published by the general-purpose server 7, as shown in FIG. 4. Alternatively, the second vulnerability information acquisition unit 303 may parse and import information published as a website by the general-purpose server 7, or may acquire second vulnerability information that is published in a structured format such as JSON or XML for easier program processing. The second vulnerability information acquisition unit 303 may periodically acquire the second vulnerability information from the general-purpose server 7, or may acquire the second vulnerability information every time the second vulnerability information is updated on the general-purpose server 7.

[0059] The CPE candidate DB 304 stores the second vulnerability information acquired by the second vulnerability information acquisition unit 303. The CPE candidate DB 304 is initialized in advance, and the second vulnerability information is added and updated each time by the second vulnerability information acquisition unit 303. This is because the information on the general-purpose server 7 changes daily.

[0060] Hereinafter, it is assumed that the information shown in Fig. 4 is stored in the CPE candidate DB 304. The CPE candidate DB 304 is a database used by the CPE search unit 312 (described later) when identifying a CPE from a CVE, and it is sufficient that it stores at least pairs of CVEs and CPEs. Therefore, in order to improve processing speed and reduce storage capacity, the CPE candidate DB 304 may delete elements other than the CVE and CPE (such as the vulnerability summary and risk level shown in Fig. 4) as appropriate. One CVE may correspond to more than one CPE.

[0061] The first configuration information acquiring unit 305 acquires all first configuration information (package information) included in the device 10_i from the device 10_i. The first configuration information acquiring unit 305 is connected to the device 10_i before shipment via a network, and collects the first configuration information from the device 10_i at any timing. The first configuration information acquiring unit 305 may be connected to the device 10_i wirelessly via a wireless access point, or may be connected via a wired connection including Ethernet installed in a factory or the like. The first configuration information acquiring unit 305 may also collect the first configuration information indirectly from the manufacturer of the device 10_i, etc.

[0062] When acquiring the first configuration information, the first configuration information acquisition unit 305 first determines the platform of the device 10_i, and then accesses the device 10_i by an appropriate method to acquire the first configuration information. If the platform is Linux, the first configuration information acquisition unit 305 may use a package management command of the OS or may refer to an installed software management file. If the platform is Windows, the first configuration information acquisition unit 305 may check the contents of the registry. In addition, the first configuration information acquisition unit 305 stores the platform type of the device 10 in the first configuration information DB 314.

[0063] The first configuration information DB 314 stores the first configuration information of the device 10_i. The scanner 311 and CPE search unit 312, which will be described later, perform processing to identify the CPE of a package, but this processing depends on the contents of the first vulnerability DB 302 and the CPE candidate DB 304. The contents of both databases change daily along with the contents of the specific server 6 and the general-purpose server 7, so the processing may need to be redone at a later date. For this reason, the first configuration information acquisition unit 305 may store the first configuration information of devices that has been acquired so far in the first configuration information DB 314.

[0064] The name identifying unit 306 identifies the package name from the first configuration information acquired by the first configuration information acquiring unit 305 .

[0065] The version identification unit 307 identifies the version of the package from the first configuration information acquired by the first configuration information acquisition unit 305. The name identification unit 306 and the version identification unit 307 store the package name and version in the first configuration information DB 314.

[0066] When first configuration information (package name and version) is input, scanner 311 refers to first vulnerability information on specific server 6 and determines whether or not there are any vulnerabilities contained in the package indicated by the first configuration information.

[0067] The scanner 311 may be implemented independently, or an existing scanner such as a commercial or open source scanner may be used. When an existing scanner is used, a different existing scanner is required for each platform. Therefore, a maximum of as many scanners 311 as the number of platform types of packages included in the devices 10_1 to 10_M are required. The following description of the scanner 311 assumes that an existing scanner is used.

[0068] The first configuration information needs to be input to the scanner 311 in a specific format. For example, some scanners 311 receive the input of the first configuration information in a JSON format file, while other scanners 311 receive the input of the first configuration information in an XML format file. Furthermore, some scanners 311 receive the input of the first configuration information through inter-process communication, while other scanners 311 receive the input through TCP communication.

[0069] The scanner selection unit 310 determines the platform of the device 10_i based on the first configuration information DB 314, and determines a scanner 311 that can determine the vulnerability of the device 10_i from among a plurality of scanners 311. The scanner selection unit 310 also determines a method for disabling the version, which will be described later.

[0070] The version invalidation unit 308 invalidates the version included in the first configuration information of the device 10_i input to the scanner 311 as a preparation for a vulnerability scan performed by the scanner 311. The version invalidation unit 308 rewrites the version of the first configuration information input to the scanner 311 to a value smaller than any possible value for the version. In this embodiment, as an example, the version is forcibly rewritten to "0.0.0" as shown in FIG. 8. The version invalidation unit 308 rewrites the first configuration information in a format compatible with the scanner 311, in accordance with a method for inputting the first configuration information that is specific to the scanner 311.

[0071] For example, if the scanner 311 selected by the scanner selection unit 310 is designed to input information via a file, the version invalidation unit 308 rewrites the contents of the file in advance. Alternatively, if the scanner 311 selected by the scanner selection unit 310 is designed to involve some kind of communication, the version invalidation unit 308 forcibly changes the communication content.

[0072] By performing the above process, vulnerabilities will be detected for all versions of a package, since package versions are generally never smaller than 0.0.0. In other words, the presence or absence of vulnerabilities, which would normally be determined based on the package name and version, can now be determined based on the package name alone.

[0073] For example, assume that package X, which is "Package 1" with version 1.3.6, is installed on device 10_1. Normally, "Package 1" and "1.3.6" are input as the package name and version to scanner 311. As described above, scanner 311 identifies that package X is package 1 and its version is less than "6.0.0," and determines that package X contains vulnerability "CVE-2021-YYYY" (see Figure 3).

[0074] However, when the version invalidation unit 308 inputs "0.0.0" as the version, the scanner 311 determines that package X is package 1 and that its version is "1.1.1" and less than "6.0.0." Therefore, it is determined that package X contains the vulnerability "CVE-2018-XXXX" and the vulnerability "CVE-2021-YYYY" (see FIG. 8).

[0075] As shown above, if the input package version is "0.0.0", all known vulnerabilities in "Package 1" will be detected. Also, the version to be rewritten does not need to be 0.0.0; it can be any number small enough that it is not commonly used as a version number.

[0076] The DB version invalidation unit 309 invalidates versions using a method different from that used by the version invalidation unit 308. The DB version invalidation unit 309 rewrites the upper limit of the vulnerability impact range, i.e., the upper limit of the range of versions affected by the vulnerability, to a value greater than the possible value of the version, in accordance with a storage format specific to the first vulnerability DB (i.e., a format compatible with the scanner 311). In this embodiment, as an example, the value is forcibly rewritten to "up to 9999" as shown in FIG. 9. This expands the version range.

[0077] By performing the above process, vulnerabilities will be detected for all versions of a package, since package versions generally do not have such large values. In other words, the presence or absence of vulnerabilities, which would normally be determined by package name and version, can now be determined by package name alone.

[0078] For example, assume that package X, which is "Package 1" with version 1.3.6, is installed on device 10_1. As mentioned above, package X would normally be determined to contain the vulnerability "CVE-2021-YYYY" (see Figure 3).

[0079] However, when the in-DB version invalidation unit 309 rewrites the version range of the first vulnerability information in the first vulnerability DB 302 to "up to 9999," the scanner 311 determines that package X is package 1 and that its version is less than 9999. Therefore, it is determined that package X includes the vulnerability "CVE-2018-XXXX" and the vulnerability "CVE-2021-YYYY" (see FIG. 9).

[0080] As described above, if the version range of the first vulnerability information is "up to 9999", all known vulnerabilities in "package 1" will be detected.

[0081] Note that the in-DB version invalidation unit 309 may dynamically hook the reading of the first configuration information by the scanner 311 and rewrite the version portion of the first configuration information, rather than directly rewriting the values ​​in the first vulnerability DB 302. Also, the (upper limit of) the version range to be rewritten does not need to be 9999, but may be any number large enough that it is not commonly used as a version number. For example, it may be the maximum integer value that the first vulnerability DB 302 can handle.

[0082] Whether to use the version invalidation unit 308 or the in-DB version invalidation unit 309 to invalidate the version is determined by the scanner selection unit 310. For example, if the first vulnerability information is defined with an upper limit and a lower limit, it may be determined that the in-DB version invalidation unit 309 is used to invalidate the version.

[0083] If the scanner 311 is a completely original implementation and is capable of scanning ignoring the version without rewriting the input first configuration information or the contents of the first vulnerability DB, the DB version invalidation unit 309 and the version invalidation unit 308 will not operate.

[0084] In any case, by disabling the version and then performing a vulnerability scan on device 10_1 on which package X is installed, known vulnerabilities contained in all versions of package X will be detected.

[0085] Furthermore, the contents of the first vulnerability DB 302 change daily as the contents of the specific server 6 are updated daily. Therefore, even after the scanner 311 has performed a vulnerability scan once, it may perform another vulnerability scan at a later date. In this case, the first configuration information stored in the first configuration information DB 314 may be used.

[0086] The CPE search unit 312 searches for the CVE row in the CPE candidate DB 304 (see FIG. 4) and determines whether the CVE acquired by the scanner 311 exists. If the CVE exists, the CPE corresponding to the CVE is identified. For example, since the CVEs included in package X are "CVE-2018-XXXX" and "CVE-2021-YYYY", "CPE1" and "CPE2" are identified.

[0087] The above processing by the CPE search unit 312 depends on the contents of the CPE candidate DB 304. The contents of the CPE candidate DB 304 change daily as the contents of the general-purpose server 7 are updated daily. Therefore, even if the CPE search unit 312 determines once that the CVE acquired by the scanner 311 does not exist in the CPE candidate DB 304, the CPE search unit 312 may perform the above processing again based on the contents of the CPE candidate DB 304 that are changed at a later date. At that time, the scanner 311 may perform a vulnerability scan again based on the first configuration information stored in the first configuration information DB 314.

[0088] The CPE output unit 313 formats the CPEs identified by the CPE search unit 312 into CPEs that take into account the package version, and stores the CPEs in the storage unit 4. CPE1 and CPE2 are merely CPEs that describe components affected by vulnerabilities in past versions of "Package 1." Therefore, the version portion of the identified CPEs is likely to differ from the version of Package X that is actually installed in the device 10_1.

[0089] Therefore, the CPE output unit 313 performs a formatting process to replace the version portion of the CPE with the original version. For example, assume that CPE1 is described as "cpe: / a:vendor1:package1:10:*". The CPE output unit 313 replaces the version "10" in CPE1 "cpe: / a:vendor1:package1:10:*" with "1.3.6" to generate CPE1' "cpe: / a:vendor1:package1:1.3.6:*". Similarly, the CPE output unit 313 replaces the version portion of CPE2 with the original version to generate CPE2'. The CPE output unit 313 outputs the generated CPE1' and CPE2'. CPE1' and CPE2' generated by the CPE output unit 311 correspond to a third identifier that identifies each of the multiple packages installed in the device 10_1 in a predetermined format (CPE format) including a package name and a version.

[0090] Note that the output CPE1' and CPE2' may be CPEs that are not in use on the general-purpose server 7 at the time of output. As mentioned above, the rule recommends that CPEs use existing vendor names and product names, and identify a single piece of software, etc., using elements from the version onwards. Therefore, if a new vulnerability is discovered in package X, it is highly likely that the vulnerability will be described in a CPE that matches CPE1' or CPE2'.

[0091] In addition, when multiple CPEs are identified by the CPE search unit, some of the CPEs may not include a package name or version. For such CPEs, the CPE can be output without replacing the version part.

[0092] As described above, CPEs (CPE1', CPE2', etc.) that are highly likely to be appropriate CPEs are output by the CPE output unit 313. The output CPEs are stored in the storage unit 4 in association with the device 10_1.

[0093] Through the above process, the CPE can be identified from one piece of first configuration information (one set of package name and version). This process is repeated for the first configuration information of all packages included in the device 10_i, and the CPE identification and storage process is performed for all packages installed in the device 10_i. As a result, the second configuration information shown in Figure 5 is generated.

[0094] 10 is a flowchart illustrating the processing executed by the configuration information conversion unit 3. The processing executed by the configuration information conversion unit 3 will be described below with reference to the drawing.

[0095] First, the configuration information conversion unit 3 initializes the first vulnerability DB 302 and the CPE candidate DB 304 (step S21).

[0096] Next, the first vulnerability information acquisition unit 301 and the second vulnerability information acquisition unit 303 acquire the first vulnerability information and the second vulnerability information from the specific server 6 and the general-purpose server 7, respectively (step S22). The acquired first vulnerability information and second vulnerability information are stored in the first vulnerability DB 302 and the CPE candidate DB 304, respectively.

[0097] Next, the first configuration information acquiring unit 305 acquires the first configuration information of all packages included in the device 10_i from the device 10_i (step S23).

[0098] Next, the name identifying unit 306 and the version identifying unit 307 identify the name and version of the package, respectively, from the first configuration information acquired by the first configuration information acquiring unit 305 (step S24).

[0099] Next, in a state where the version has been invalidated by the version invalidation unit 308, the in-DB version invalidation unit 309, or the uniquely implemented scanner 311, the scanner 311 scans the first configuration information (step S25).

[0100] Next, as a result of the scan, the scanner 311 detects all vulnerabilities (CVE) that the above packages had in the past, regardless of the version (step S26).

[0101] Next, the CPE search unit 312 determines whether the detected CVE exists in the CPE candidate DB 304 (step S27).

[0102] If it is determined that the detected CVE exists (step S27: Yes), the version portion of the CPE corresponding to the CVE is replaced with the actual package version and output (step S28).

[0103] If it is determined that no detected CVE exists, the process proceeds to step S29 (step S27: No).

[0104] Next, it is determined whether there is any unprocessed package among the packages installed in the device 10_i (step S29).

[0105] If there are any unprocessed packages, the process returns to step S24, and the processes from steps S24 to S28 are performed for the unprocessed packages (step S29: No).

[0106] If there are no unprocessed packages, the process ends (step S29: Yes).

[0107] If it is determined in step S27 that no detected CVE exists, steps S21 to S27 may be executed again at a later date using a new CPE candidate DB 304 and first vulnerability DB 302.

[0108] As described above, according to the first configuration example of one embodiment, the first configuration information written in the first identifier can be converted into the second configuration information written in the appropriate third identifier (CPE').

[0109] [Second configuration example] One dedicated server 6 is provided for each platform, but the granularity at which platforms are considered to be the same varies depending on the platform. For example, even if the OS undergoes major changes, it may be considered to be the same over a long period of time, or it may be considered to be a different platform with each minor release. In the latter case, if only the first vulnerability information of one dedicated server 6 is used, there is a possibility that only vulnerabilities discovered within a short period of time will be detected.

[0110] For example, suppose a vendor releases a new version of an OS they provide, "OS ver. 2," in addition to the existing version "OS ver. 1." In this case, the vendor prepares a new server 6 for "OS ver. 2" in addition to the server 6 for "OS ver. 1." If "Package 1" version 3 was already installed on the OS before "OS ver. 2" was released, it is highly likely that the server 6 for "OS ver. 2" will not contain vulnerability information for versions of package 1 prior to "Version 3."

[0111] Therefore, in order to detect all vulnerabilities in past versions of a package, it is necessary to refer not only to the specific server 6 (and the first vulnerability DB based on it) provided for the latest platform, but also to the specific server 6 provided for past platforms.

[0112] In the first configuration example, it was assumed that the number of dedicated servers 6 would not increase due to platform releases, etc. In the second configuration example, a process will be described for the case where the number of dedicated servers 6 increases due to platform releases, etc.

[0113] 11 is a block diagram of a configuration information conversion unit 3A, which is an information processing device according to a second configuration example of an embodiment. Elements with the same names or functions as those in the previously described configuration examples are assigned the same reference numerals. Hereinafter, explanations will be omitted except for changes or additions.

[0114] The configuration information conversion unit 3A includes a first vulnerability DB switching unit 315. The first vulnerability DB switching unit 315 improves the accuracy of vulnerability scanning by the scanner 311, ignoring the version.

[0115] The first vulnerability DB switching unit 315 switches the first vulnerability DB 302 used by the scanner 311 to the first vulnerability DB 302 for a different platform (that is, an older platform) so that more vulnerabilities can be detected.

[0116] For example, the first vulnerability DB switching unit 315 may replace the file of the first vulnerability DB 302 read by the scanner 311 with a symbolic link, or may rewrite an argument to read a different file. If the first vulnerability DB 302 has the same format and can be read by the scanner 311 without any contradictions, it can be switched by the first vulnerability DB switching unit 315. In other words, in this embodiment, if there are multiple first vulnerability DBs 302 that can be read by the scanner 311 without any contradictions, the multiple first vulnerability DBs 302 are considered to be first vulnerability DBs 302 for the same platform.

[0117] As described above, according to the second configuration example of one embodiment, even if the number of unique servers 6 increases due to platform releases, etc., vulnerabilities in all past versions of the package can be detected.

[0118] [Third configuration example] Preferably, when a vulnerability is discovered in a package, it is associated with only one CPE (i.e., there is a one-to-one correspondence between CVE and CPE).

[0119] On the other hand, there are operating systems and hardware that incorporate packages as components. In this case, if a vulnerability is discovered in the package, the operating system or hardware that uses the package may also be considered vulnerable.

[0120] For example, if the vulnerability "CVE-2022-XXXX" affects "version 1" of the package "package1" developed by "vendor", the following is listed on general-purpose server 7: Vulnerability Number CVE-2022-XXXX overview This vulnerability is related to package1... Affected Components (CPE List) cpe: / a:vendor:package1:1:* cpe: / o:vendor:os_system:2:* cpe: / h:vendor:hardware1:1:*

[0121] As mentioned above, the affected components (CPE list) will list not only the package "cpe: / a:vendor1:package1:1:*", which is the root cause of the vulnerability, but also the OS "cpe: / o:vendor2:os_system:2:*" and hardware "cpe: / h:vendor3:hardware1:1:*" that use "package1".

[0122] However, from the perspective of vulnerability management, it is rare to want to identify the OS or hardware that uses the package in question; in most cases, you want to identify the underlying vulnerability cause, "cpe: / a:vendor1:package1:1:*".

[0123] In addition to the above examples, it is possible that multiple inappropriate CPEs may be listed for a single CVE in addition to appropriate CPEs.

[0124] When the second vulnerability information acquisition unit 303 adds and updates the second vulnerability information stored in the CPE candidate DB 304 based on such Web information from the general-purpose server 7, multiple CPEs are associated with one CVE. As a result, the second configuration information stored in the storage unit 4 becomes redundant, and the vulnerable device determination unit 5 also detects insignificant vulnerabilities.

[0125] In the first and second configuration examples, it is assumed that there is a one-to-one correspondence between CVEs and CPEs on the general-purpose server 7. In the third configuration example, a process for selecting a CPE with a high priority when there is a one-to-many correspondence between CVEs and CPEs will be described.

[0126] 12 is a block diagram of a configuration information conversion unit 3B, which is an information processing device according to a third configuration example of an embodiment. Elements with the same names or functions as those in the previously described configuration examples are assigned the same reference numerals. Hereinafter, explanations will be omitted except for changes or additions.

[0127] The configuration information conversion unit 3B includes a prioritized CPE selection unit 316 and a subordinate CPE exclusion unit 317.

[0128] The priority CPE selector 316 supports updating of the CPE candidate DB 304, which can identify CPEs with higher priority. After the CPE candidate DB 304 is updated, the priority CPE selector 316 rewrites the CPE candidate DB 304 into a CPE candidate DB 304 that includes only priority CPEs.

[0129] Specifically, first, the priority CPE selection unit 316 scans the CPE candidate DB 304 to search for CVEs associated with multiple CPEs. If a matching CVE is found as a result of the search, the CPE listed at the top of the CPE list is designated as the priority CPE by referring to the web information of the general-purpose server 7 using the CVE as a key. In other words, when the CPEs in the CPE list are sorted in order, the first CPE is designated as the priority CPE. Then, the priority CPE selection unit 316 deletes CPEs other than the priority CPE from among the CPEs associated with the matching CVE.

[0130] Because websites are viewed by humans, they are often listed in order of importance, usually listing the package that caused the vulnerability first, followed by the OS and hardware that includes that package, as shown above. Therefore, the CPE at the top of the CPE list is likely to be the desired, appropriate CPE.

[0131] Furthermore, when the second vulnerability information stored in the CPE candidate DB 304 is updated based on the structured vulnerability information (second vulnerability information) such as JSON or XML distributed by the general-purpose server 7, the order in which CPEs are listed in the CPE candidate DB 304 may become undefined. Therefore, the priority CPE is selected based on the vulnerability information of the general-purpose server 7 that is listed on the Web.

[0132] After the above processing, the CPE search unit 312 performs a CPE search using the CPE candidate DB 304 rewritten by the priority CPE selection unit 316, thereby identifying only the CPE that is the root cause of the vulnerability for one CVE.

[0133] It is also possible to use a method that does not directly rewrite the CPE candidate DB 304. For example, each time the CPE search unit 312 identifies a CPE using the CPE candidate DB 304, the CPE search unit 312 may refer to the priority CPE selection unit 316 and ignore the identified CPE if it is not a priority CPE.

[0134] As described above, according to the third configuration example of an embodiment, it is possible to associate only desired or high-priority CPEs with the CVE identified by the scanner 311. This also makes it possible to prevent the second configuration information from becoming redundant.

[0135] [Fourth configuration example] When multiple vulnerabilities are discovered in a single package, a CPE is identified for each vulnerability. However, as the operation of the vulnerability monitoring system 1 progresses, if a specific CPE is assigned, it may become clear that other CPEs are incorrect or unnecessary.

[0136] Even after the above knowledge was obtained, associating multiple CPEs with one package would make the second configuration information stored in the storage unit 4 redundant. In the fourth configuration example, a process for excluding such redundant CPEs in advance will be described.

[0137] 13 is a block diagram of a configuration information conversion unit 3C, which is an information processing device according to a fourth configuration example of an embodiment. Elements with the same names or functions as those in the previously described configuration examples are assigned the same reference numerals. Hereinafter, explanations will be omitted except for changes or additions.

[0138] The configuration information conversion unit 3C includes a subordinate CPE exclusion unit 317. When a pre-specified CPE is selected, the subordinate CPE exclusion unit 317 excludes other CPEs.

[0139] After the processing of the CPE search unit 312 is completed, the subordinate CPE exclusion unit 317 determines whether or not the CPE designated in advance by the user is included in the CPEs selected by the CPE search unit 312. If the designated CPE is included, the subordinate CPE exclusion unit 317 excludes the other CPEs.

[0140] As described above, according to the fourth configuration example of an embodiment, when a specific CPE is assigned, by excluding CPEs other than the specific CPE in advance, it is possible to prevent the second configuration information from becoming redundant. Also, it is possible to reduce the processing load of the CPE output unit 313.

[0141] (Hardware configuration) 14 shows the hardware configuration of an information processing device according to each embodiment. The information processing device is configured by a computer device 600. The computer device 600 includes a CPU 601, an input interface 602, a display device 603, a communication device 604, a main memory device 605, and an external memory device 606, which are interconnected by a bus 607.

[0142] The CPU (Central Processing Unit) 601 executes an information processing program, which is a computer program, on the main memory device 605. The information processing program is a program that realizes each of the above-mentioned functional components of the information processing device. The information processing program may be realized not as a single program, but as a combination of multiple programs and scripts. Each functional component is realized by the CPU 601 executing the information processing program.

[0143] The input interface 602 is a circuit for inputting operation signals from input devices such as a keyboard, a mouse, a touch panel, etc. to the information processing apparatus. The input interface 602 corresponds to the input unit of the information processing apparatus according to each embodiment.

[0144] The display device 603 displays data output from the information processing device. The display device 603 is, for example, but not limited to, an LCD (liquid crystal display), an organic electroluminescence display, a CRT (cathode ray tube), or a PDP (plasma display). Data output from the computer device 600 can be displayed on the display device 603. The display device 603 corresponds to the output unit of the information processing device according to each embodiment.

[0145] The communication device 604 is a circuit that enables the information processing device to communicate with an external device wirelessly or via a wire. Data can be input from the external device via the communication device 604. The data input from the external device can be stored in the main memory device 605 or the external memory device 606.

[0146] The main memory device 605 stores an information processing program, data required for executing the information processing program, data generated by executing the information processing program, etc. The information processing program is deployed and executed on the main memory device 605. The main memory device 605 is, for example, a RAM, a DRAM, or an SRAM, but is not limited to these. Each storage unit or database of the information processing device according to each embodiment may be constructed on the main memory device 605.

[0147] The external storage device 606 stores information processing programs, data required for executing the information processing programs, data generated by executing the information processing programs, etc. These information processing programs and data are read into the main storage device 605 when the information processing programs are executed. The external storage device 606 is, for example, a hard disk, an optical disk, a flash memory, or a magnetic tape, but is not limited to these. Each storage unit or database of the information processing device may be constructed on the external storage device 606.

[0148] The information processing program may be pre-installed in the computer device 600, or may be stored in a storage medium such as a CD-ROM. The information processing program may also be uploaded onto the Internet.

[0149] Furthermore, the information processing device may be configured as a single computer device 600, or may be configured as a system made up of multiple computer devices 600 connected to each other.

[0150] The present invention is not limited to the above-described embodiments, and the components can be modified and embodied in practice without departing from the spirit of the invention. Furthermore, various inventions can be created by appropriately combining multiple components disclosed in the above-described embodiments. For example, configurations in which some components are omitted from all the components shown in each embodiment may also be considered. Furthermore, components described in different embodiments may be appropriately combined.

[0151] This embodiment can also be configured as follows. [Item 1] a first vulnerability information acquisition unit that acquires, from a first server specific to a platform, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; a second vulnerability information acquisition unit that acquires, from a second server, a second identifier that identifies software included in the device in a predetermined format including the name and version of the software, and second vulnerability information that corresponds to the vulnerability identifier; a first configuration information acquisition unit that acquires first configuration information from a target device of vulnerability testing, the first configuration information including the name and version of target software included in the target device; a scanner that detects a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifies a vulnerability identifier corresponding to the detected first identifier; a search unit that identifies, based on the second vulnerability information, a second identifier that corresponds to the vulnerability identifier identified by the scanner and includes a name of software that is the same as a name of the target software; an output unit that generates a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the second identifier identified by the search unit with the version of the target software; An information processing device comprising: [Item 2] a version invalidation unit that rewrites a value of the version of the target software in the acquired first configuration information to a value that is smaller than a possible value of the version; the first identifier included in the first vulnerability information identifies the software by the name and version range of the software; The scanner detects the first identifier, the version of which included in the first configuration information is included in the range of versions. Item 1. An information processing device according to item 1. [Item 3] the first identifier included in the first vulnerability information identifies the software by the name and version range of the software; a DB version invalidation unit that rewrites an upper limit value of the range of the version of the acquired first vulnerability information to a value greater than a value that the version can take, thereby expanding the range; The scanner detects the first identifier in which the version included in the first configuration information is included in the extended range. Item 3. The information processing device according to item 1 or 2. [Item 4] the first vulnerability information acquisition unit acquires a plurality of pieces of first vulnerability information from a plurality of first servers associated with a plurality of the platforms; The plurality of pieces of first vulnerability information associate the vulnerability identifiers with first identifiers having the same name but different versions of the software, respectively; The scanner detects a first identifier including a name of the target software from each of the plurality of pieces of first vulnerability information, and identifies a vulnerability identifier corresponding to the detected first identifier. 4. The information processing device according to any one of items 1 to 3. [Item 5] the second vulnerability information acquired from the second server associates a plurality of the second identifiers with one of the vulnerability identifiers, and the plurality of second identifiers in the second vulnerability information are arranged in an arbitrary order; a selection unit that selects a second identifier at a position that satisfies a selection condition from the plurality of second identifiers in the second vulnerability information, The search unit uses only the selected second identifier and the vulnerability identifier as part of the second vulnerability information. 5. The information processing device according to any one of items 1 to 4. [Item 6] The position that satisfies the selection condition is the first position Item 5. An information processing device according to item 5. [Item 7] the scanner detects the first identifiers from the first vulnerability information and identifies the vulnerability identifiers corresponding to the detected first identifiers; further comprising an exclusion unit that, when a designated second identifier is included in the plurality of second identifiers identified by the search unit for the plurality of vulnerability identifiers, excludes second identifiers other than the designated second identifier from the plurality of second identifiers identified by the search unit; The output unit generates the third identifier of the target software using only the specified second identifier. 7. The information processing device according to any one of items 1 to 6. [Item 8] acquires, from a first server specific to a platform, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; acquire, from a second server, second vulnerability information in which a second identifier that identifies software included in the device in a predetermined format including the name and version of the software corresponds to the vulnerability identifier; acquire first configuration information from a target device of vulnerability testing, the first configuration information including the name and version of target software included in the target device; Detecting a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifying a vulnerability identifier corresponding to the detected first identifier; Identifying a second identifier that corresponds to the identified vulnerability identifier and includes a software name that is the same as the name of the target software, based on the second vulnerability information; generating a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the identified second identifier with the version of the target software; Information processing methods. [Item 9] The target devices for vulnerability testing, a first server that manages software vulnerabilities specific to a platform and related to said platform; a second server that manages vulnerabilities of components included in the device; an information processing device capable of communicating with the target device, the first server, and the second server; The information processing device includes: a first vulnerability information acquisition unit that acquires, from the first server, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; a second vulnerability information acquisition unit that acquires, from the second server, a second identifier that identifies software included in the device in a predetermined format including the name and version of the software, and second vulnerability information that corresponds to the vulnerability identifier; a first configuration information acquisition unit that acquires, from the target device of the vulnerability inspection, first configuration information including a name and a version of target software included in the target device; a scanner that detects a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifies a vulnerability identifier corresponding to the detected first identifier; a search unit that identifies, based on the second vulnerability information, a second identifier that corresponds to the vulnerability identifier identified by the scanner and includes a name of software that is the same as a name of the target software; an output unit that generates a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the second identifier identified by the search unit with the version of the target software; a vulnerable device determination unit that determines vulnerability of the target device by checking whether the second vulnerability information acquired from the second server includes a second identifier that matches the third identifier; An information processing system comprising: [Explanation of symbols]

[0152] 1. Vulnerability Monitoring System 2 Vulnerability monitoring device 3, 3A, 3B, 3C Configuration information conversion section 4 Storage section 5 Vulnerable device determination section 6 Unique Server 7 General-purpose servers 10, 10_i, 10_1~10_M equipment 301 1st Vulnerability Information Acquisition Department 302 1st vulnerability DB 303 2nd Vulnerability Information Acquisition Department 304 CPE candidate database 305 First configuration information acquisition unit 306 Name Identification Section 307 Version Identification Section 308 Version Invalidation Section 309 Internal Version Invalidation Section 310 Scanner selection section 311 Scanner 312 CPE Search Department 313 CPE output section 314 1st configuration information DB 315 First Vulnerability DB Switching Unit 316 Priority CPE Selection Unit 317 Subordinated CPE Exclusion Division 600 Computer equipment 602 Input Interface 603 Display device 604 Communication equipment 605 Main storage 606 External storage device 607 Bus

Claims

1. a first vulnerability information acquisition unit that acquires, from a first server specific to a platform, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; a second vulnerability information acquisition unit that acquires, from a second server, a second identifier that identifies software included in the device in a predetermined format including the name and version of the software, and second vulnerability information that corresponds to the vulnerability identifier; a first configuration information acquisition unit that acquires first configuration information from a target device of vulnerability testing, the first configuration information including a name and a version of target software included in the target device; a scanner that detects a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifies a vulnerability identifier corresponding to the detected first identifier; a search unit that identifies, based on the second vulnerability information, a second identifier that corresponds to the vulnerability identifier identified by the scanner and includes a name of software that is the same as a name of the target software; an output unit that generates a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the second identifier identified by the search unit with the version of the target software; An information processing device comprising:

2. a version invalidation unit that rewrites a value of the version of the target software in the acquired first configuration information to a value that is smaller than a possible value of the version; the first identifier included in the first vulnerability information identifies the software by a name and a version range of the software; The scanner detects the first identifier such that the version included in the first configuration information is included in the range of versions. The information processing device according to claim 1 .

3. the first identifier included in the first vulnerability information identifies the software by a name and a version range of the software; a DB version invalidation unit that rewrites an upper limit value of the range of the version of the acquired first vulnerability information to a value greater than a value that the version can take, thereby expanding the range; The scanner detects the first identifier in which the version included in the first configuration information is included in the extended range. The information processing device according to claim 1 .

4. the first vulnerability information acquisition unit acquires a plurality of pieces of first vulnerability information from a plurality of first servers associated with a plurality of the platforms; The plurality of pieces of first vulnerability information associate the vulnerability identifiers with first identifiers having the same name but different versions of the software, respectively; The scanner detects a first identifier including a name of the target software from each of the plurality of pieces of first vulnerability information, and identifies a vulnerability identifier corresponding to the detected first identifier. The information processing device according to claim 1 .

5. the second vulnerability information acquired from the second server associates a plurality of the second identifiers with one of the vulnerability identifiers, and the plurality of second identifiers in the second vulnerability information are arranged in an arbitrary order; a selection unit that selects a second identifier at a position that satisfies a selection condition from the plurality of second identifiers in the second vulnerability information, The search unit uses only the selected second identifier and the vulnerability identifier as part of the second vulnerability information. The information processing device according to claim 1 .

6. The position that satisfies the selection condition is the first position The information processing device according to claim 5 .

7. the scanner detects the plurality of first identifiers from the first vulnerability information, and identifies the plurality of vulnerability identifiers corresponding to the detected plurality of first identifiers; further comprising an exclusion unit that, when a designated second identifier is included in the plurality of second identifiers identified by the search unit for the plurality of vulnerability identifiers, excludes second identifiers other than the designated second identifier from the plurality of second identifiers identified by the search unit; The output unit generates the third identifier of the target software using only the specified second identifier. The information processing device according to claim 1 .

8. A computer comprising: acquires, from a first server specific to a platform, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; acquire, from a second server, second vulnerability information in which a second identifier that identifies software included in the device in a predetermined format including the name and version of the software corresponds to the vulnerability identifier; acquiring first configuration information from a target device of vulnerability testing, the first configuration information including a name and a version of target software included in the target device; Detecting a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifying a vulnerability identifier corresponding to the detected first identifier; Identifying a second identifier that corresponds to the identified vulnerability identifier and includes a name of software that is the same as a name of the target software, based on the second vulnerability information; generating a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the identified second identifier with the version of the target software; Information processing methods.

9. The target devices for vulnerability testing, a first server that manages platform-specific software vulnerabilities related to said platform; a second server that manages vulnerabilities of components included in the device; an information processing device capable of communicating with the target device, the first server, and the second server; The information processing device includes: a first vulnerability information acquisition unit that acquires, from the first server, first vulnerability information in which a first identifier that identifies software related to the platform by the name and version of the software corresponds to a vulnerability identifier that identifies a vulnerability in the software; a second vulnerability information acquisition unit that acquires, from the second server, a second identifier that identifies software included in the device in a predetermined format including the name and version of the software, and second vulnerability information that corresponds to the vulnerability identifier; a first configuration information acquisition unit that acquires, from the target device of the vulnerability testing, first configuration information including a name and a version of target software included in the target device; a scanner that detects a first identifier including a name of the target software from the first vulnerability information based on the first configuration information, and identifies a vulnerability identifier corresponding to the detected first identifier; a search unit that identifies, based on the second vulnerability information, a second identifier that corresponds to the vulnerability identifier identified by the scanner and includes a name of software that is the same as a name of the target software; an output unit that generates a third identifier that identifies the target software included in the target device in the predetermined format by replacing the version included in the second identifier identified by the search unit with the version of the target software; a vulnerable device determination unit that determines vulnerability of the target device by checking whether the second vulnerability information acquired from the second server includes a second identifier that matches the third identifier; An information processing system comprising:

Images