Information processing methods, information processing devices, computer programs, and application programs

Abstract

To provide an information processing method capable of collecting correct log information and grasping illegal operation of an application program without deteriorating the availability of the application program, an information processing device, a computer program and the application program.SOLUTION: An information processing device acquires an application program, analyzes an execution format file in the acquired application program, specifies a call place of calling a log collection function for transmitting a log to an outside, and changes the application program so as to transmit security verification information for verifying security related to the application program to the outside in addition to the log in the case that the execution format file calls the log collection function at the specified call place.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an information processing method, an information processing apparatus, a computer program, and an application program.

Background Art

[0002] In recent years, a service that collects and analyzes the usage status of an application program as log information after distributing the application program to an end-user's terminal device has become widespread. Such a service is used for the purpose of collecting information on illegal acts and marketing information by the application program. As a method of collecting log information, it is often the case that a log collection API (Application Programming Interface) is called within the application program. On the other hand, there is a real threat that a pirated application generated by analyzing a distributed application program in an illegal operating environment and then modifying it is redistributed.

[0003] Patent Document 1 discloses a method of incorporating digital watermark information and verification information into an application to prevent illegal tampering (repackaging) and using this for tampering determination. In addition, Patent Document 2 discloses a debugger analysis prevention method that monitors illegal acts such as debugger analysis by introducing a dummy debugger and monitoring its process, and terminates the execution of the program when illegal behavior is confirmed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, with the repackaging detection described in Patent Document 1 and the debugger analysis prevention described in Patent Document 2, if the application program fails to start or shuts down during operation due to the detection of malicious activity or false detection, it may become impossible to collect log information in malicious situations, and the availability of the application program may decrease. Furthermore, if the log information collection method is tampered with in the aforementioned pirated applications, there is a risk that the malicious operation of the application program will go unnoticed, and the original purpose of log aggregation may not be achieved.

[0006] This invention has been made in view of the above circumstances, and aims to provide an information processing method, information processing device, computer program, and application program that enable the correct identification and collection of log information without reducing the availability of the application program, and that enable the understanding of the malicious operation status of the application program. [Means for solving the problem]

[0007] The present invention includes several means for solving the above problem, but to give one example, the information processing method acquires an application program, analyzes the executable file within the acquired application program, identifies a call location that invokes a log collection function to send logs externally, and when the executable file invokes the log collection function at the identified call location, modifies the application program to send security verification information to the outside in addition to the logs, for verifying the security related to the application program. [Effects of the Invention]

[0008] According to the present invention, it is possible to correctly identify and collect log information without reducing the availability of the application program, and to grasp the abnormal operation status of the application program. [Brief explanation of the drawing]

[0009] [Figure 1] This figure shows an example of the configuration of the information processing device according to this embodiment. [Figure 2] This figure shows an example of the configuration of the application program before modification. [Figure 3] This figure shows an example of a functional unit included in an information processing device. [Figure 4] This figure shows an example of the structure of the modified application program. [Figure 5] This figure shows an example of the processing of the log transmission function and the log transmission extension function. [Figure 6] This diagram shows an example of the configuration of the security verification information collection unit. [Figure 7] This figure shows an example of the processing of the application program before modification. [Figure 8] This figure shows an example of the processing of the modified application program. [Modes for carrying out the invention]

[0010] The embodiments of the present invention will be described below. Figure 1 is a diagram showing an example of the configuration of the information processing device 50 of this embodiment. The information processing device 50 comprises a control unit 51 that controls the entire device, an input unit 52, a memory 53, a display panel 54, an output unit 55, an operation unit 56, and a storage unit 57. The information processing device 50 can be configured as, for example, a personal computer, but it may also be configured as a tablet terminal or a smartphone. Furthermore, the functions of the information processing device 50 may be distributed and configured as multiple information processing devices.

[0011] The control unit 51 may be configured by incorporating a required number of IC (Integrated Circuit) chips, CPUs (Central Processing Units), MPUs (Micro-Processing Units), GPUs (Graphics Processing Units), etc. Alternatively, the control unit 51 may be configured by combining DSPs (Digital Signal Processors), FPGAs (Field-Programmable Gate Arrays), etc.

[0012] The input unit 52 is equipped with a communication module and an interface module, and has the function of performing wired or wireless communication with external devices. The input unit 52 acquires the application program before modification. The application program before modification is modified by processing by the control unit 51.

[0013] The output unit 55 includes a communication module and an interface module, and has the function of performing wired or wireless communication with external devices. The output unit 55 outputs the modified application program.

[0014] The storage unit 57 can be configured as, for example, a hard disk or semiconductor memory, and stores the computer program 60 (program product) and necessary information (for example, data and processing results during processing by the information processing device 50).

[0015] The computer program 60 may be downloaded from an external device via the input unit 52 and stored in the storage unit 57. Alternatively, the computer program 60 recorded on a recording medium (for example, an optically readable disc storage medium such as a CD-ROM) may be read by the recording medium reading unit and stored in the storage unit 57. The computer program 60 can be deployed to run on a single computer or on multiple computers interconnected by a communication network.

[0016] Memory 53 can be composed of semiconductor memory such as SRAM (Static Random Access Memory), DRAM (Dynamic Random Access Memory), or flash memory. The computer program 60 can be loaded into memory 53, and the control unit 51 can execute the computer program 60. The control unit 51 can execute the processing defined in the computer program 60. In other words, the processing performed by the control unit 51 is also the processing performed by the computer program 60.

[0017] The display panel 54 can be composed of, for example, a liquid crystal panel or an organic EL (Electro Luminescence) display.

[0018] The operation unit 56 is composed of, for example, a hardware keyboard, a mouse, etc., and can perform operations on icons displayed on the display panel 54, such as moving and operating the cursor, and inputting characters, etc. Note that the operation unit 56 may be composed of a touch panel.

[0019] The information processing device 50 can generate an application program (modified version) that enables correct log information collection and grasps an unauthorized operation situation without degrading usability by performing a predetermined process on the application program (before modification) acquired via the input unit 52. That is, the computer program 60 is a computer program for modifying an application program.

[0020] FIG. 2 is a diagram showing an example of the configuration of the application program 100 before modification. The application program 100 is composed of a plurality of files, etc. Such files include an execution format file and a signature data area. The signature data area includes a signature format file, a data area or a data block in a specific data structure, etc. The execution format file is, for example, coded by the developer of the application program 100. The execution format file collects logs at a location or timing (any location) where useful logs (also referred to as log information) for the application program 100 can be obtained. In the execution flow of the application program 100, the collected logs are sent by the log sending function 10 to the log collection unit (also referred to as the log collection API) 20. The log sending function 10 is a code group that realizes a function of calling the log collection unit 20 at the call location in the execution format file. The log collection unit 20 collects logs from each execution format file by being called by the log sending function 10 in the execution format file, and sends the collected logs to the external server 300.

[0021] The external server 300 is equipped with a log processing unit that corresponds to the log collection unit 20. The log processing unit can analyze the collected logs and generate information such as the operating status and usage status of the application program 100.

[0022] Next, we will explain the functions performed by the functional unit of the information processing device 50, namely the control unit 51 (computer program 60).

[0023] Figure 3 shows an example of the functional units of the information processing device 50. The information processing device 50 includes the following functional units: a file structure analysis unit 501, an internal file extraction unit 502, a file information analysis unit 503, a file information storage unit 504, a log transmission function extension unit 505, an integrity verification module generation unit 506, an execution environment information acquisition module generation unit 507, a security verification information management module generation unit 508, and an application program reconstruction unit 509. In other words, the control unit 51 (computer program 60) performs various processes such as file structure analysis, internal file extraction, file information analysis, file information storage, log transmission function extension, integrity verification module generation, execution environment information acquisition module generation, security verification information management module generation, and application program reconstruction.

[0024] The information processing device 50 retrieves the application program 100 before modification. That is, the control unit 51 retrieves the application program 100.

[0025] The file structure analysis unit 501 analyzes the file structure of the acquired application program 100. In other words, the control unit 51 analyzes the file structure of the application program 100.

[0026] The internal file extraction unit 502 extracts the executable file and the signature data area by referring to the file structure analyzed by the file structure analysis unit 501. In other words, the control unit 51 extracts the executable file and the signature data area.

[0027] The file information analysis unit 503 analyzes the extracted executable file and the information in the signature data area. Specifically, the file information analysis unit 503 analyzes the information of the log transmission function 10 in the extracted executable file and identifies log collection API information such as the log collection API method, the log collection API implementation location, and the log collection API call location, based on the code group that implements the function of calling the log collection unit (log collection API) 20, for example. The log collection API method includes information such as the type of API and the log collection specifications of the API (for example, the number of parameters to collect and send externally and the configuration of the parameter list). The log collection API implementation location includes information that identifies where the log collection API is implemented. The log collection API call location includes information that identifies where in the code within the executable file the log collection API is called. By identifying the log collection API information, the information collected and sent externally can be extended using the code of the executable file before modification (security verification information added by this embodiment can be added in addition to the logs determined by the application program developer). The file information analysis unit 503 stores the identified log collection API information in the file information storage unit 504. In other words, the control unit 51 analyzes the information of the log transmission function 10 in the extracted executable file to identify the log collection API information.

[0028] The file information storage unit 504 can be provided within the storage unit 57.

[0029] The file information analysis unit 503 analyzes the extracted signature data area to identify the signature information attached to the application program. The signature information includes, for example, the signer, fingerprint information, verification algorithm, signing date and time, and signature expiration date. The file information analysis unit 503 calculates a hash value for the data of a specific file within the application program using a predetermined hash algorithm and identifies the calculated hash value. The specific file can be any file within the application program, but which file to use is predetermined. The file information analysis unit 503 stores the identified signature information and hash value as integrity information in the file information storage unit 504. The integrity information is used to verify the authenticity of the application program being verified. That is, the control unit 51 analyzes the signature data area within the acquired application program to identify the signature information attached to the application program and records the identified signature information as integrity information. The control unit 51 also identifies the hash value of an arbitrary file within the acquired application program and records the identified hash value as integrity information.

[0030] The log transmission function extension unit 505 extends the transmission function of the log transmission function 10 so that, in addition to the log collection intended by the application program developer, it can also transmit security verification information. In other words, the log transmission function extension unit 505 can generate log transmission extension functions. The security verification information is information for verifying the security related to the application program, and includes, for example, the integrity information mentioned above and the execution environment information when the application program is running. Details of the transmission function extension of the log transmission function 10 will be described later.

[0031] The consistency verification module generation unit 506 generates a consistency verification module for verifying the consistency of the application program to be verified, using the consistency information identified by the file information analysis unit 503.

[0032] The execution environment information acquisition module generation unit 507 generates an execution environment information acquisition module for acquiring execution environment information when the application program under verification is running. The execution environment information includes information that can identify the environment in which the application program is running (for example, the type and version of the operating system, whether or not it is an emulator environment, etc.).

[0033] The security verification information management module generation unit 508 manages the integrity verification module and the execution environment information acquisition module, and generates a security verification information management module that has an interface function with the log transmission extension function (extended log transmission function).

[0034] The application program reconstruction unit 509 installs the generated log transmission extension function, integrity verification module, execution environment information acquisition module, and security verification information management module into the application program and reconstructs the application file.

[0035] As described above, the control unit 51 can modify the application program 100 by generating a log transmission extension function, an integrity verification module, an execution environment information acquisition module, and a security verification information management module.

[0036] Figure 4 shows an example of the configuration of the modified application program 150. The difference between the modified application program 150 and the original application program 100 is that the modified application program 150 includes a log transmission extension function 15 that extends the log transmission function 10 within the executable file, and also includes a security verification information collection unit 30.

[0037] The log transmission extension function 15 includes the functions of the log transmission function 10 and collects logs intended by the developer of the application program 100 at required points or timings in the processing flow of the executable file, and sends the collected logs to the log collection unit 20. At the same time that the log transmission extension function 15 sends the aforementioned logs to the log collection unit 20, it also acquires security verification information previously collected by the security verification information collection unit 30 and sends the acquired security verification information together with the aforementioned logs to the log collection unit 20. The log collection unit 20 receives the logs and security verification information sent by the log transmission extension function 15 and transmits the received logs and security verification information to the external server 300.

[0038] Figure 5 shows an example of the processing of the log transmission function 10 and the log transmission extension function 15. The log transmission function 10 calls the log collection API to send logs collected at required locations and timings during the execution of the executable file to an external source. More specifically, the log transmission function 10 converts the events to be recorded and the required parameters into a data format handled by the log collection API and passes them to the log collection API. In the example in Figure 5, the collected logs A1, A2, and A3 are set as parameters 1, 2, and 3 respectively, and the API call method is executed. In the API call method, the event name and parameters 1, 2, and 3 are passed in a predetermined data format. As a result, logs A1, A2, and A3 are sent to the log collection unit 20 along with the event names to be recorded.

[0039] Meanwhile, the log transmission extension function 15 executes an API call method based on the log collection specifications of the log collection API (log collection function) that is called by the API call method executed by the log transmission function 10. Specifically, as shown in Figure 5, the collected logs A1, A2, A3 and security verification information X1, X2 are set as parameters 1, 2, 3, 4, and 5 respectively, and the API call method is executed. In the API call method, the event name and parameters 1, 2, 3, 4, and 5 are passed in a predetermined data format. As a result, logs A1, A2, A3 and security verification information X1, X2 are sent to the log collection unit 20 along with the event name to be recorded.

[0040] As described above, the control unit 51 can modify the application program to transmit logs and security verification information to an external source based on the log collection specifications of the log collection unit 20 (log collection function).

[0041] Figure 6 shows an example of the configuration of the security verification information collection unit 30. The security verification information collection unit 30 comprises a integrity verification module 31, an execution environment information acquisition module 35, and a security verification information management module 36. The integrity verification module 31 comprises integrity information 32, an application information acquisition module 33, and an integrity determination module 34. In this specification, security verification information includes either or both of the integrity information 32 and the execution environment information.

[0042] As shown in Figure 1, consistency information 32 is a fixed value embedded within the application being modified by the information processing device 50 when the application program is modified, and includes signature information assigned to the application program, hash values ​​of any files within the application program, etc. In addition, consistency information 32 may also include partial data of any file within the application program, symbol information, data links, execution flow of an executable file, etc. Symbol information is, for example, names such as variable names and function names, and is like a table that defines the link relationship between each identifier (name) in the source code of the application program and its respective content (including information such as data type and location in memory). Note that consistency information 32 is not limited to these, and may include any information that can be used to verify the integrity of the application program, such as information or code that identifies the interface between the log transmission extension function 15 and the security verification information collection unit 30. In this specification, the consistency information 32 embedded within the application being modified as described above is also referred to as true consistency information 32. That is, the control unit 51 can modify the application program to obtain true consistency information 32.

[0043] The modified application program 150 can cause the computer to execute a process that sends the genuine integrity information 32 as security verification information to the external server 300.

[0044] The application information acquisition module 33 acquires application information necessary to generate integrity information for verification in order to verify the integrity of the application program when the application program under verification is running. The integrity information for verification is information that is compared and verified with the genuine integrity information 32, and in this specification, it is referred to as "integrity information for verification" to distinguish it from the genuine integrity information 32. The application information is information for verifying the authenticity of the application program under verification, and may also be information necessary to generate the integrity information for verification. In other words, the control unit 51 can modify the application program to acquire application information for verifying the authenticity of the application program under verification as integrity information for verification when the application program under verification is running.

[0045] The modified application program 150 can cause the computer to execute a process that sends the application information (the integrity information to be verified, which is compared with the genuine integrity information 32) acquired by the application information acquisition module 33 to the external server 300 as security verification information.

[0046] The integrity determination module 34 compares the genuine integrity information 32 with the application information acquired by the application information acquisition module 33 to determine integrity. Specifically, it compares the integrity information of the application to be verified, generated based on the application information acquired by the application information acquisition module 33, with the genuine integrity information 32. If they match, it determines that the application program to be verified is consistent, and it can be determined that no unauthorized tampering has occurred. On the other hand, it compares the integrity information of the application to be verified, generated based on the application information, with the genuine integrity information 32. If they do not match, it determines that the application program to be verified is inconsistent, and it can be determined that unauthorized tampering has occurred. In other words, the control unit 51 can modify the application program to acquire the result of a comparison (integrity determination result) between the application information for verifying the authenticity of the application program to be verified, acquired during the operation of the application program, and the genuine integrity information 32 of the application program that has been recorded in advance (for example, at least one of the signature information attached to the application program and the hash value of any file within the application program) as integrity information.

[0047] The modified application program 150 can cause the computer to perform a process that compares the genuine integrity information 32 with the integrity information to be verified, which is generated based on the application information acquired by the application information acquisition module 33, and sends the integrity determination result as security verification information to the external server 300.

[0048] The execution environment information acquisition module 35 periodically and irregularly observes the system state and collects information about the execution environment while the application program under verification is running. The observed items include, for example, one or more known or expected feature points in the system that cause differences between an unauthorized operating environment and a normal (non-unauthorized) operating environment. For example, it includes information such as "an executable file that should not normally exist in the system is present." In other words, the control unit 51 can modify the application program to acquire execution environment information during the operation of the application program under verification as security verification information.

[0049] The modified application program 150 can cause the computer to execute a process that sends the execution environment information acquired by the execution environment information acquisition module 35 as security verification information to the external server 300.

[0050] The security verification information management module 36 holds authentic integrity information 32, application information acquired by the application information acquisition module 33, the integrity determination result by the integrity determination module 34, and execution environment information acquired by the execution environment information acquisition module 35. In response to a request from the log output extension function 15, the security verification information management module 36 outputs at least one of the held authentic integrity information 32, application information, integrity determination result, and execution environment information to the log output extension function 15 in accordance with the request.

[0051] As described above, the information processing device 50 of this embodiment, that is, the control unit 51 (computer program 60), acquires an application program, analyzes the executable file within the acquired application program, identifies a call point that invokes a log collection function to send logs externally, and when the executable file invokes the log collection function at the identified call point, the application program can be modified to send security verification information to the outside in addition to the logs, for verifying the security related to the application program.

[0052] As described above, according to this embodiment, by focusing on the log output function within the executable file of an existing application program and editing the log output function, security verification information for verifying the security of the application program can be added to the existing log (log information). This eliminates the need for application program developers to be aware of protections for log information collection methods, and allows protections for log information collection methods to be incorporated into existing application programs. Furthermore, since the added security verification information includes integrity information of the application program itself and information on the application program's execution environment, it is possible to determine whether the collected log (data) was obtained legitimately or under unauthorized circumstances. In addition, even if an unauthorized activity is detected, log collection can continue without stopping the application program or shutting down the system. Thus, according to this embodiment, it is possible to correctly identify and collect log information without reducing the availability of the application program, and to grasp the unauthorized operation status of the application program.

[0053] Next, we will explain the processing of the application program. First, as a comparative example, we will explain the processing of the application program 100 before modification.

[0054] Figure 7 shows an example of the processing of the application program 100 before modification. The application program 100 causes the computer to execute the processing shown in Figure 7, so the computer will be described as the main entity performing the processing below. The computer starts the application program 100 (S11) and initializes the functions of the log collection unit 20 (log collection API) (S12).

[0055] The computer collects log A (S13) and converts the collected log A into a data format for the log collection API (S14). The computer sends the converted log A to the log collection unit 20 (S15). The computer sends the converted log A from the log collection unit 20 to the external server 300 (S16) and terminates the process. The external server 300 can obtain log A in the original data format by restoring the converted log A.

[0056] Figure 8 shows an example of the processing of the modified application program 150. The computer starts the application program 150 (S21) and initializes the functions of the log collection unit 20 (log collection API) (S22).

[0057] The computer collects log A (S23) and converts the collected log A into a data format for the log collection API (S24). The computer collects security verification information X (S25).

[0058] The computer restores the converted log A to its original data format (S26), adds security verification information X to the restored log A, and converts it to a data format for the log collection API (S27). By converting log A collected in step S24, the coding flow of the developer who created the application program 100 before modification is directly reused. As a result, the developer does not need to worry about the processing flow of the modified application 150 at all.

[0059] The computer sends the converted log A and security verification information X to the log collection unit 20 (S28). The computer sends the converted log A and security verification information X from the log collection unit 20 to the external server 300 (S29) and terminates the process. The external server 300 can obtain the log A and security verification information X in their original data format by restoring the converted log A and security verification information X.

[0060] In the process described above, the timing of the process in step S25 does not matter as long as it occurs before the process in step S27. Also, the processes from step S23 to step S29 may be repeated any number of times. Each time it is repeated, the security verification information to be collected may be updated, or a different type of information may be collected. In the process described above, log A is collected in step S23, but the number of logs to be collected and the locations where they are collected are not limited to one; multiple logs may be collected, and logs may be collected in multiple locations. Similarly, although security verification information X is collected in step S25, the number of security verification information to be collected and the locations where it is collected are not limited to one; multiple pieces of security verification information may be collected, and security verification information may be collected in multiple locations.

[0061] As described above, the modified application program 150 can cause the computer to perform the following processes: collect logs for transmission to an external source using a log collection function that transmits logs externally; collect security verification information for verifying the security related to the application program 150; and, at the call point where the log collection function is invoked, send the collected security verification information in addition to the collected logs to the log collection function, and transmit the logs and security verification information externally through the log collection function.

[0062] Furthermore, the application program 150 can cause the computer to perform the following processes: restore logs that have been converted to a data format handled by the log collection function back to their original data format, add the collected security verification information to the restored logs, convert them back to a data format handled by the log collection function, and send the converted logs and security verification information to the log collection function. This eliminates the need to modify the coding related to log collection in the existing application program before the modification.

[0063] Furthermore, the security verification information transmitted externally by the application program 150 includes at least one of integrity information for verifying the authenticity of the application program and information about the execution environment when the application program is running. This makes it possible to determine whether the collected logs (data) were obtained legitimately or under fraudulent circumstances.

[0064] (Note 1) The information processing method involves acquiring an application program, analyzing the executable file within the acquired application program, identifying a call point that invokes a log collection function to send logs externally, and, when the executable file invokes the log collection function at the identified call point, modifying the application program to send, in addition to the logs, security verification information for verifying the security related to the application program to an external source.

[0065] (Note 2) The information processing method involves modifying the application program in accordance with Note 1 to transmit the logs and security verification information to an external source based on the log collection specifications of the log collection function.

[0066] (Note 3) In the information processing method, as specified in Note 1 or Note 2, the security verification information includes integrity information for verifying the authenticity of the application program to be verified.

[0067] (Note 4) The information processing method, as described in Note 3, modifies the application program to obtain application information for verifying the authenticity of the application program to be verified as integrity information for the application program to be verified when the application program to be verified is running.

[0068] (Note 5) The information processing method involves analyzing the signature data area within the acquired application program as described in Note 3 or Note 4 to identify the signature information assigned to the application program, and recording the identified signature information as the integrity information.

[0069] (Note 6) The information processing method involves identifying the hash value of any file within the acquired application program in any one of Notes 3 to 5, and recording the identified hash value as the consistency information.

[0070] (Note 7) The information processing method modifies the application program in any one of Notes 3 to 6 to obtain the consistency information as the result of a comparison between application information for verifying the authenticity of the application program to be verified, which is obtained when the application program to be verified is running, and at least one of the previously recorded signature information attached to the application program and the hash value of any file within the application program.

[0071] (Note 8) The information processing method involves modifying the application program in any one of Notes 2 to 7 to obtain the execution environment information of the application program under verification as security verification information.

[0072] (Note 9) The information processing device includes a control unit, which acquires an application program, analyzes the executable file within the acquired application program, identifies a call point that invokes a log collection function to send logs to an external location, and when the executable file invokes the log collection function at the identified call point, modifies the application program to send, in addition to the logs, security verification information for verifying the security related to the application program to an external location.

[0073] (Note 10) The computer program causes the computer to obtain an application program, analyze the executable file within the obtained application program, identify a call point that invokes a log collection function to send logs externally, and, if the executable file invokes the log collection function at the identified call point, to modify the application program to send security verification information to the outside in addition to the logs, for verifying the security related to the application program.

[0074] (Note 11) An application program is an application program that collects logs for transmission to an external party using a log collection function that transmits logs to an external party, collects security verification information for verifying the security related to the application program, and causes a computer to execute a process at a call point that calls the log collection function, which sends the collected security verification information in addition to the collected logs to the log collection function, and transmits the logs and security verification information to an external party through the log collection function.

[0075] (Note 12) The application program causes the computer to perform the following processing: restore the log, which has been converted to a data format handled by the log collection function as described in Note 11, back to its original data format; add the collected security verification information to the restored log and convert it back to the data format; and send the converted log and security verification information to the log collection function.

[0076] (Note 13) In Note 11 or Note 12, the security verification information of the application program includes at least one of integrity information for verifying the authenticity of the application program and execution environment information for when the application program is running.

[0077] The matters described in each embodiment can be combined with each other. Furthermore, the independent and dependent claims described in the claims can be combined with each other in any combination, regardless of the form of reference. In addition, the claims use a form in which claims referencing two or more other claims (multi-claim form), but are not limited to this. A form in which multi-claims referencing at least one multi-claim (multi-multi-claim) may also be used. [Explanation of symbols]

[0078] 10. Log transmission function 15. Log Sending Extension 20 Log Collection Department 30 Security Verification Information Collection Department 31. Integrity Verification Module 32 Consistency information 33. App Information Acquisition Module 34. Integrity Determination Module 35. Module for obtaining execution environment information 36. Security Verification Information Management Module 50 Information Processing Devices 51 Control Unit 52 Input section 53 memory 54 Display Panel 55 Output section 56 Operation section 57 Memory section 60 Computer Programs 100 Application program before modification 150 Modified application program 300 External Servers

Claims

1. An information processing device, Obtain the application program, The executable file within the acquired application program is analyzed to identify the call location that invokes the log collection function that sends logs externally. When the executable file invokes the log collection function at a specified call location, the application program is modified to send, in addition to the log, security verification information related to the application program to an external source. Information processing methods.

2. The information processing device The application program is modified to transmit the logs and security verification information to an external source based on the log collection specifications of the log collection function. The information processing method according to claim 1.

3. The information processing device The aforementioned security verification information includes integrity information for verifying the authenticity of the application program being verified. The information processing method according to claim 1.

4. The information processing device The application program to be verified is modified to acquire application information as integrity information for verifying the authenticity of the application program to be verified while the application program to be verified is running. The information processing method according to claim 3.

5. The information processing device, The signature data area within the acquired application program is analyzed to identify the signature information attached to the application program. The identified signature information is recorded as the integrity information. The information processing method according to claim 3.

6. The information processing device Identify the hash value of any file within the acquired application program, The identified hash value is recorded as the consistency information. The information processing method according to claim 3.

7. The information processing device, The application program is modified to obtain, as integrity information, the result of comparing application information obtained during the operation of the application program to be verified, at least one of the pre-recorded signature information attached to the application program and the hash value of any file within the application program. The information processing method according to claim 3.

8. The information processing device Modify the application program so that it acquires the execution environment information of the application program under verification as security verification information. The information processing method according to any one of claims 2 to 7.

9. Equipped with a control unit, The control unit, Obtain the application program, The executable file within the acquired application program is analyzed to identify the call location that invokes the log collection function that sends logs externally. When the executable file invokes the log collection function at a specified call location, the application program is modified to send, in addition to the log, security verification information related to the application program to an external source. Information processing device.

10. On the computer, Obtain the application program, The executable file within the acquired application program is analyzed to identify the call location that invokes the log collection function that sends logs externally. When the executable file invokes the log collection function at a specified call location, the application program is modified to send, in addition to the log, security verification information related to the application program to an external source. A computer program that executes a process.

11. An application program, The log collection function, which sends logs to an external source, collects logs for external transmission. Collect security verification information to verify the security related to the aforementioned application program, At the call point where the log collection function is invoked, the collected security verification information is sent to the log collection function in addition to the collected logs. The log collection function transmits the log and security verification information to an external party. An application program that causes a computer to perform a process.

12. The log, which has been converted to the data format handled by the log collection function, is restored to its original data format. The collected security verification information is added to the restored logs and converted to the aforementioned data format. The converted logs and security verification information are sent to the log collection function. An application program according to claim 11 that causes a computer to perform a process.

13. The aforementioned security verification information is This includes at least one of integrity information for verifying the authenticity of the application program and execution environment information for when the application program is running. The application program according to claim 11 or claim 12.

Images