Processing flow visualization device, processing flow visualization method, and processing flow visualization program

Abstract

The present invention contributes to reducing the number of propagation paths for investigating vulnerability. This process flow visualization device comprises: a control path between a certain start point and an end point on a program; a path DB that stores propagation paths between two base points in the control path; a code DB which stores codes that retain a correspondence relationship with each element on the path DB; and a code display unit that acquires a relevant propagation path from the path DB with regard to a base point to focus on, and extracts, from the code DB, a portion of a code on the basis of the propagation path, and displays the portion of the code.

Description

Technical Field

[0001] The present invention relates to a processing flow visualization device, a processing flow visualization method, and a processing flow visualization program.

Background Art

[0002] As one of the measures against supply chain risks, the importance of detecting unauthorized functions in software called backdoors has been increasing. Current computer systems have become complex and it is difficult to configure them using only products of a single company. Therefore, it is common to procure products from the outside and configure a system by combining the procured products. At this time, it is handled on the premise that the manufacturers and supply chains of the procured products are trustworthy. This is because the detection of backdoors is also required as part of this.

[0003] However, detecting backdoors in software without source code requires a great deal of time and effort. In the detection of backdoors in software without source code, reverse engineering is performed, and suspicious function groups and execution paths are analyzed in detail to manually screen for backdoors. Therefore, for example, in Patent Document 1, a technique has been proposed to display data dependence / control dependence propagation in units of variables on a program as a graph structure or a tree structure, and to emphasize and visualize statements on the source code corresponding to the selected variables.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Furthermore, the disclosures in the above-mentioned prior art documents are incorporated into this book by reference. The following analysis was conducted by the inventors.

[0006] Although tools exist to assist in backdoor detection, the data-dependent / control-dependent propagation at the variable level in a program is complex, and the number of propagation paths between variables increases exponentially with length, making it difficult to examine all propagation paths. As a result, identifying the condition variables of control instructions that could trigger a backdoor becomes time-consuming.

[0007] Therefore, it is necessary to visualize the processing flow in the program, from the process of receiving external input (src) to the process that has a serious impact on the system (sink), so that its potential danger (likelihood of being a backdoor) can be easily investigated. This danger can be investigated by tracking how the condition variables of control instructions that could trigger a backdoor are calculated and by tracing the propagation of those variables.

[0008] In view of the above-mentioned problems, the object of the present invention is to provide a processing flow visualization device, a processing flow visualization method, and a processing flow visualization program that contribute to making software easier to investigate. [Means for solving the problem]

[0009] In a first aspect of the present invention, a processing flow visualization device is provided, comprising: a control path between a certain start point and end point in a program; a path DB that stores a propagation path between two base points in the control path; a code DB that stores codes that maintain the correspondence between each element in the path DB; and a code display unit that obtains a related propagation path from the path DB for a base point of interest, and extracts and displays a part of the code from the code DB based on the propagation path.

[0010] A second aspect of the present invention provides a processing flow visualization method performed by an information processing device comprising a control path between a certain start point and end point in a program, a path DB that stores a propagation path between two base points in the control path, a code DB that stores a code that maintains the correspondence between each element in the path DB, and a code display unit, wherein the processing flow visualization method obtains the relevant propagation path from the path DB for a base point of interest, extracts a part of the code from the code DB based on the propagation path, and displays it on the code display unit.

[0011] A third aspect of the present invention provides a processing flow visualization program that is executed by an information processing device comprising a control path between a certain start point and end point in a program, a path DB that stores a propagation path between two base points in the control path, a code DB that stores a code that maintains the correspondence between each element in the path DB, and a code display unit, wherein the information processing device is instructed to perform the following processes: obtaining a related propagation path from the path DB for a base point of interest, and extracting a part of the code from the code DB based on the propagation path and displaying it on the code display unit. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as semiconductor memory, hard disk, magnetic recording medium, or optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0012] According to each aspect of the present invention, it is possible to provide a processing flow visualization device, a processing flow visualization method, and a processing flow visualization program that contribute to facilitating software investigation. [Brief explanation of the drawing]

[0013] [Figure 1] Figure 1 is a schematic diagram of the flow visualization device according to an embodiment. [Figure 2]Figure 2 illustrates the control path and propagation path. [Figure 3] Figure 3 illustrates control-dependent propagation in the control path. [Figure 4] Figure 4 illustrates data-dependent propagation in the propagation path. [Figure 5] Figure 5 shows an example of a list of reference points used to select a reference point to focus on. [Figure 6] Figure 6 shows the steps from selecting a starting point to focus on to displaying a portion of the code. [Figure 7] Figure 7 illustrates a mechanism that can reduce the number of routes to be investigated. [Figure 8] Figure 8 shows an example of the hardware configuration of the flow visualization device used in the embodiment. [Modes for carrying out the invention]

[0014] Embodiments of the present invention will be described below with reference to the drawings. However, the present invention is not limited to the embodiments described below. In each drawing, the same or corresponding elements are appropriately denoted by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those of reality. Even between drawings, there may be parts where the dimensional relationships and ratios differ from each other.

[0015] FIG. 1 is a schematic configuration diagram of a flow visualization device according to an embodiment. As shown in FIG. 1, the flow visualization device 10 includes a path DB 11, a code DB 12, and a code display unit 13. The path DB 11 stores a control path between a certain start point and an end point in a program and a propagation path between two base points in the control path. The code DB 12 stores codes that hold the correspondence with each element on the path DB. The code display unit 13 acquires a related propagation path from the path DB 11 for a base point of interest, and extracts and displays a part of the code from the code DB 12 based on the propagation path. Note that the code stored in the code DB 12 is preferably a source code, but is not limited to the source code, and may be an assembly format code, an intermediate code, a byte code, or the like.

[0016] FIG. 2 is a diagram for explaining a control path and a propagation path. As shown in FIG. 2, the control path is a flow of control instructions connecting a start point (src) and an end point (sink). The start point (src) is a process that receives an external input, and the end point (sink) is a process that has a serious impact on the system. Therefore, in the flow of control instructions connecting the start point (src) and the end point (sink), an unexpected control instruction may be a trigger for activating a backdoor.

[0017] On the other hand, as shown in FIG. 2, the propagation path is a flow indicating the dependency relationship of variables between two base points in the control path. Here, since the base points in the control path are the start point (src), the end point (sink), or a control instruction, the propagation path between two base points in the control path corresponds to the propagation path from the start point (src) to a control instruction, from a control instruction to a control instruction, and from a control instruction to the end point (sink). In the example of the control path shown in FIG. 2, the propagation paths from the start point (src) to control instruction A, from control instruction A to control instruction B, from control instruction B to control instruction C, and from control instruction C to the end point (sink) are the flows between two base points in the control path. The path DB 11 stores a control path indicating the dependency relationship of variables between a certain start point and an end point in a program as shown in FIG. 2 and a propagation path between two base points in the control path.

[0018] Figure 3 is a diagram for explaining control dependence propagation in a control path. As shown in Figure 3, control dependence propagation refers to the propagation that transitions from a conditional variable according to a true / false value. The control path shown in Figure 2 is a flow indicating control dependence propagation in a control instruction that connects between a start point (src) and an end point (sink).

[0019] Figure 4 is a diagram for explaining data dependence propagation in a propagation path. As shown in Figure 4, variables in a propagation path have a propagation relationship based on data dependence. In the example shown in Figure 4, there is a relationship where variables "param1" and "param2" of operation "op1" are propagated to variable "param0", and there is a relationship where variable "param0" of operation "op1" is propagated to variable "param1" of operation "op3". The propagation path shown in Figure 2 is also a flow that connects the start point (src) to control instruction A, control instruction A to control instruction B, control instruction B to control instruction C, and from control instruction C to the end point (sink) through data dependence propagation of variables.

[0020] Figure 5 is a diagram showing an example of a list of base points for selecting a base point of interest. Since the base points in a control path are a start point (src), an end point (sink), or a control instruction, the base point of interest can be considered to be the control instruction of interest. As already explained, the code display unit 13 acquires a related propagation path from the path DB11 for the base point of interest, and extracts and displays a part of the code from the code DB12 based on that propagation path. Regarding the method of specifying the base point of interest at this time, it is possible for the user to specify it using an input device such as a keyboard, but considering the ease of operation, it is preferable to present a list as shown in Figure 5 to the user and have the user select from the list.

[0021] Figure 6 shows the procedure from selecting a base point of interest to displaying a portion of the code. As already explained, the code display unit 13 obtains the relevant propagation path from the path DB 11 for the base point of interest, and extracts and displays a portion of the code from the code DB 12 based on that propagation path. The base point of interest (control command) is selected from the list as described above. Next, the code display unit 13 obtains the relevant control path from the path DB 11 for the selected base point of interest (control command), and obtains the propagation path between that control point and the previous base point on that control path. Then, the code display unit 13 extracts and displays a portion of the code corresponding to that propagation path from the code DB 12. At this time, as shown in Figure 6, the control command of interest and each variable on the propagation path are highlighted to assist in investigating whether the control command may be a backdoor trigger.

[0022] Furthermore, it is preferable that the code display unit 13 obtains the direct dependencies of the corresponding elements on the propagation path by selecting variables in the code and highlights the corresponding elements in the code. This is because by sequentially selecting the highlighted direct dependency variables from the condition variables, it is possible to track how the condition variables are calculated and efficiently investigate whether or not it is a backdoor trigger.

[0023] According to the flow visualization device 10 according to an embodiment of the present invention, the number of paths to be investigated can be reduced by focusing on tracking dependencies between control instructions. Figure 7 is a diagram illustrating the mechanism by which the number of paths to be investigated can be reduced. As shown in Figure 7, the dependency relationships between variables do not necessarily involve only one path between control instructions, so the number of paths increases exponentially when viewed on a control instruction basis. On the other hand, when investigating by dividing the process into control instructions, even if there are multiple paths between control instructions, the paths are not tracked across control instructions, so the number of paths increases linearly when viewed on a control instruction basis. As a result, the flow visualization device 10 according to an embodiment of the present invention can keep the number of paths to be investigated when detecting backdoors to a minimum.

[0024] (Example hardware configuration) Figure 8 shows an example of the hardware configuration of a flow visualization device used in the embodiment. That is, the flow visualization device 10 enables the realization of each function of the flow visualization device 10 by executing the flow visualization method described above as a program on an information processing device (computer) 20 that employs the hardware configuration shown in Figure 8. However, the example hardware configuration shown in Figure 8 is just one example of a hardware configuration that realizes each function of the flow visualization device 10, and is not intended to limit the hardware configuration of the flow visualization device 10. The flow visualization device 10 may include hardware not shown in Figure 8.

[0025] As shown in Figure 8, the hardware configuration that the flow visualization device 10 may employ includes, for example, a CPU (Central Processing Unit) 21, a main memory 22, an auxiliary memory 23, and an IF (Interface) unit 24, all interconnected by an internal bus.

[0026] The CPU 21 executes each instruction included in the flow visualization program run by the information processing device (computer) 20. The main memory 22 is, for example, RAM (Random Access Memory) and temporarily stores various programs, such as the processing flow visualization program run by the information processing device (computer) 20, for processing by the CPU 21.

[0027] The auxiliary storage device 23 is, for example, an HDD (Hard Disk Drive) and can store various programs, such as processing flow visualization programs, executed by the information processing device (computer) 20, for medium to long term. These various programs, such as processing flow visualization programs, can be provided as program products recorded on a non-transitory computer-readable storage medium.

[0028] The IF unit 24 provides, for example, an interface for the input and output of the flow visualization device 10.

[0029] The information processing device (computer) 20, which employs the hardware configuration described above, realizes each function of the flow visualization device 10 by executing the aforementioned flow visualization method as a program.

[0030] Some or all of the above embodiments may also be described as follows, but are not limited to the following: [Note 1] A control path between a certain start point and end point in the program, and a path DB that stores the propagation path between two base points in the control path, A code database that stores codes that maintain the correspondence between each element on the route database, A code display unit obtains the relevant propagation path from the route database for the point of interest, and extracts and displays a portion of the code from the code database based on the propagation path. A processing flow visualization device equipped with the following features. [Note 2] The code display unit obtains the control path including the base point of interest and the propagation path between the previous base point in the control path from the path database, and obtains and displays the partial code corresponding to the propagation path from the code database. The processing flow visualization device described in Appendix 1. [Note 3] The code display unit displays a list of base points for selecting the base point of interest. A processing flow visualization device as described in Appendix 1 or Appendix 2. [Note 4] The processing flow visualization device according to any one of Appendix 1 to Appendix 3, wherein the base point in the control path is the start point, the end point, or a control command. [Note 5] The code display unit highlights the variables of the subcodes that are dependent on each variable on the propagation path, as described in any one of the processing flow visualization devices described in Appendix 2 to Appendix 4. [Note 6] The code display unit obtains variables dependent on the variable selected on the subcode from the propagation path and highlights them together with the corresponding location on the subcode for the variable immediately preceding the dependent variable, as described in Appendix 5. [Note 7] A method for visualizing a processing flow performed by an information processing device comprising: a control path between a certain start point and end point in a program; a path DB that stores a propagation path between two base points in the control path; a code DB that stores codes that maintain the correspondence between each element in the path DB; and a code display unit, For the starting point of interest, obtain the relevant propagation path from the aforementioned path database. A method for visualizing a processing flow by extracting a portion of a code from the code database based on the aforementioned propagation path and displaying it on the code display unit. [Note 8] The processing flow visualization method described in Appendix 7, comprising obtaining a control path including the aforementioned base point of interest and a propagation path between the previous base point in the control path from the path DB, and obtaining a partial code corresponding to the propagation path from the code DB and displaying it in the code display unit. [Note 9] A processing flow visualization program executed by an information processing device comprising a control path between a certain start point and end point in the program, a path DB that stores a propagation path between two base points in the control path, a code DB that stores a code that maintains the correspondence between each element in the path DB, and a code display unit, The process involves obtaining the relevant propagation path from the aforementioned path database for the point of interest, A processing flow visualization program that causes the information processing device to perform the following processes: extracting a portion of the code from the code database based on the aforementioned propagation path and displaying it on the code display unit. [Note 10] The processing flow visualization program described in Appendix 9, which causes the information processing device to perform the following processes: obtaining a control path including the aforementioned base point of interest and a propagation path between the previous base point in the control path from the path DB; and obtaining a partial code corresponding to the propagation path from the code DB and displaying it on the code display unit.

[0031] Furthermore, the disclosures of the above-mentioned patent documents and other materials cited are incorporated into this document by reference. Within the framework of the full disclosure of the present invention (including the claims), further modifications and adjustments to the embodiments or examples are possible based on the fundamental technical concept. Also, within the framework of the full disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosure elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes the full disclosure, including the claims, and various modifications and alterations that a person skilled in the art could make in accordance with the technical concept. In particular, with respect to the numerical ranges described in this document, any numerical value or sub-range included within that range should be interpreted as being specifically described, even if not otherwise stated. Furthermore, the disclosures of the above-mentioned cited documents may, if necessary, be used in part or in whole as part of the disclosure of the present invention, in accordance with the spirit of the present invention, and these may also be considered to be included in the disclosures of this application. [Explanation of Symbols]

[0032] 10 Flow Visualization Device 11 Route DB 12 Code DB 13 Code display section 20 Information Processing Devices 21 CPU 22 Main storage 23 Auxiliary storage device 23 IF section

Claims

1. A control path between a certain start point and end point in the program, and a path DB that stores the propagation path between two base points in the control path, A code database that stores codes that maintain the correspondence between each element on the route database, A code display unit obtains the relevant propagation path from the route DB for the base point of interest, and extracts and displays a portion of the code from the code DB based on the propagation path. A processing flow visualization device equipped with the following features.

2. The code display unit obtains the control path including the base point of interest and the propagation path between the previous base point in the control path from the path DB, and obtains and displays the partial code corresponding to the propagation path from the code DB. The processing flow visualization device according to claim 1.

3. The code display unit displays a list of base points for selecting the base point of interest. A processing flow visualization device according to claim 1 or claim 2.

4. The processing flow visualization device according to claim 1 or claim 2, wherein the base point in the control path is the start point, the end point, or a control command.

5. The processing flow visualization device according to claim 2, wherein the code display unit highlights the variables of the subcodes that are dependent on each variable on the propagation path.

6. The processing flow visualization device according to claim 5, wherein the code display unit obtains variables dependent on the variable selected on the subcode from the propagation path and highlights them together with the location on the subcode corresponding to the variable immediately preceding the dependent variable.

7. A method for visualizing a processing flow performed by an information processing device comprising: a control path between a certain start point and end point in a program; a path DB that stores a propagation path between two base points in the control path; a code DB that stores a code that maintains the correspondence between each element in the path DB; and a code display unit, The information processing device obtains the relevant propagation path from the path database for the base point it is focusing on, A method for visualizing a processing flow in which the information processing device extracts a portion of a code from the code database based on the propagation path and displays it on the code display unit.

8. The processing flow visualization method according to claim 7, comprising obtaining a control path including the aforementioned base point of interest and a propagation path between the previous base point in the control path from the path DB, and obtaining a partial code corresponding to the propagation path from the code DB and displaying it on the code display unit.

9. A processing flow visualization program executed by an information processing device comprising a control path between a certain start point and end point in the program, a path DB that stores a propagation path between two base points in the control path, a code DB that stores a code that maintains the correspondence between each element in the path DB, and a code display unit, The process involves obtaining the relevant propagation path from the aforementioned path database for the point of interest, A processing flow visualization program that causes the information processing device to perform the following processes: extracting a portion of the code from the code database based on the aforementioned propagation path and displaying it on the code display unit.

10. The processing flow visualization program according to claim 9, wherein the information processing device is instructed to perform the following processes: obtaining from the path DB a control path including the aforementioned base point of interest and a propagation path between the previous base point in the control path; and obtaining a partial code corresponding to the propagation path from the code DB and displaying it on the code display unit.

Images