Backdoor inspection device, backdoor inspection method, and backdoor inspection program

Abstract

The present invention contributes to efficiently identifying an execution path that is highly likely a backdoor. A backdoor inspection device according to the present invention comprises: an execution path extraction unit that analyzes a program and extracts an execution path; an external input branch extraction unit that, from among condition branches included in the execution path, extracts, as external input branches, condition branches which includes an external input in a condition; an authentication branch determination unit that, from among the external input branches, extracts, as an authentication branch determining the success / failure of authentication, an external input branch which includes a plurality of different external inputs in a condition; and a backdoor determination unit that, when the execution path does not use the authentication branch or a function which is for use in authentication, determines that the execution path is highly likely a backdoor.

Description

Backdoor inspection device, backdoor inspection method, and backdoor inspection program

[0001] The present invention relates to a backdoor inspection device, a backdoor inspection method, and a backdoor inspection program.

[0002] As one of the countermeasures against supply chain risk, the detection of malicious functions in software known as backdoors is becoming increasingly important. Today's computer systems are so complex that it is difficult to construct them using only products from a single company. Therefore, it is common to procure products from outside and combine them to construct a system. In this case, it is assumed that the manufacturers and supply chains of the procured products are trustworthy. This is because detecting backdoors is also required as part of this.

[0003] However, detecting backdoors in software without source code requires a great deal of time and effort, as it requires reverse engineering, detailed analysis of suspicious functions and execution paths, and manual screening for backdoors. Therefore, for example, Patent Literature 1 proposes a method for defining library functions and system calls that are often used by backdoors as policies, and identifying such important functions contained in a program and the execution paths that call them.

[0004] International Publication No. 2021 / 028989

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] Although there are tools available to assist in the work of detecting backdoors, they can detect execution paths to malicious functions added by attackers as likely backdoors, but they have the problem of not being able to detect backdoor execution paths that circumvent authentication functions using external input. As a result, it is not possible to efficiently narrow down execution paths that are likely to be backdoors, and the burden of the inspection work remains heavy.

[0007] In view of the above-mentioned problems, an object of the present invention is to provide a backdoor inspection device, a backdoor inspection method, and a backdoor inspection program that contribute to efficiently narrowing down execution paths that are likely to be backdoors.

[0008] In a first aspect of the present invention, there is provided a backdoor inspection device comprising: an execution path extraction unit that analyzes a program to extract an execution path; an external input branch extraction unit that extracts, from conditional branches included in the execution path, those whose conditions include an external input as external input branches; an authentication branch determination unit that extracts, from the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible; and a backdoor determination unit that determines that there is a high possibility of a backdoor when the execution path does not pass through either the authentication branch or a function used for authentication.

[0009] In a second aspect of the present invention, there is provided a backdoor inspection method comprising: analyzing a program to extract an execution path; extracting, from among conditional branches included in the execution path, those whose conditions include an external input as external input branches; extracting, from among the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible; and determining that an execution path that does not pass through the authentication branch and a function used for authentication is highly likely to be a backdoor.

[0010] In a third aspect of the present invention, there is provided a backdoor inspection program that causes an information processing device to execute the following steps: an execution path extraction process that analyzes a program to extract an execution path; an external input branch extraction process that extracts, from conditional branches included in the execution path, those whose conditions include an external input as external input branches; an authentication branch determination process that extracts, from the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible; and a backdoor determination process that determines that an execution path that does not pass through the authentication branch and a function used for authentication is likely to be a backdoor. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product.

[0011] According to each aspect of the present invention, it is possible to provide a backdoor inspection device, a backdoor inspection method, and a backdoor inspection program that contribute to efficiently narrowing down execution paths that are highly likely to be backdoors.

[0012] FIG. 1 is a diagram showing three classifications of conditional branches included in execution paths. FIG. 2 is a diagram showing an example of a processing flow with an authentication function and a processing flow of an authentication bypass backdoor. FIG. 3 is a schematic configuration diagram of a backdoor inspection device according to an embodiment of the present invention. FIG. 4 is a diagram explaining the processing performed by an execution path extraction unit. FIG. 5 is a diagram explaining the processing performed by an external input branch extraction unit. FIG. 6 is a diagram explaining the processing performed by an authentication branch determination unit. FIG. 7 is a diagram explaining the processing performed by a backdoor determination unit. FIG. 8 is a diagram showing an example of the hardware configuration of a backdoor inspection device used in an embodiment.

[0013] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. In addition, the same or corresponding elements in each drawing are appropriately designated by the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of each element may differ from those in reality. There may also be parts in which the dimensional relationships and ratios differ between the drawings.

[0014] First, the basic idea of ​​the present invention will be explained. The backdoor inspection device, backdoor inspection method, and backdoor inspection program according to the embodiments of the present invention identify functions with authentication functions and conditional branches that determine whether authentication is successful, and determine that execution paths that do not pass through them are likely to be authentication bypass backdoors. In other words, the backdoor inspection method and backdoor inspection program, which have the following functions, notify the inspector of execution paths contained in a program that are likely to be backdoor execution paths.

[0015] 1. Manages the "execution path list" extracted from the program, and the "authentication function list" and "authentication branch list" created in advance. 2. For an execution path in the "execution path list," the conditional branches included before reaching a specified program point are judged using the authentication branch judgment method described below, and if they are judged to be authentication functions, they are stored in the "authentication branch list." 3. For an execution path in the "execution path list," the "authentication function list" and "authentication branch list" are referenced, and if neither the authentication function nor the authentication branch is passed through, the inspector is notified that the execution path is likely to be a backdoor.

[0016] (Authentication branch judgment method) The authentication functions used by applications can be (1) using a known authentication API provided by the OS or a module installed in the OS, or (2) the application can provide its own authentication function or use a database. An example of (1): Remote login services such as ssh and telnet using PAM (Pluggable authentication module) An example of (2): BASIC authentication using an HTTP server such as Apache

[0017] In the case of (1), the authentication part within the program can be identified by creating a list of library functions that require authentication as knowledge in advance. For example, there is the pam_authenticate function that requests authentication in PAM, which is widely used in Linux (registered trademark).

[0018] In the case of (2), the authentication part within the program can be identified by identifying the conditional branch that compares data such as ID and password entered by the user (hereinafter referred to as requested data) with data read from a password file, database, etc. (hereinafter referred to as authentication data).

[0019] The branching conditions of authentication functions are characterized by the nature of what is compared with external input. Authentication data uses external data such as databases and password files, and is compared with data entered by the attacker. On the other hand, hidden accounts created by attackers that serve as backdoor triggers are hard-coded within the program. Attackers want to minimize their evidence, so it is unlikely that they would leave any unnecessary information outside the program. Error detection also generally involves comparison with strings or constants hard-coded within the program.

[0020] Therefore, as shown in Figure 1, the conditional branches included in the execution path can be classified into three types. (A) in Figure 1 is a comparison of an external input with a constant, so it is unlikely to be an authentication branch. (B) in Figure 1 is a comparison of two external inputs, so it is likely to be an authentication branch. On the other hand, (C) in Figure 1 is likely to be a backdoor, because it can skip the authentication function by comparing a string hard-coded in the program with the external input.

[0021] By focusing on these characteristics, it is possible to detect execution paths that are likely to be backdoors as follows:

[0022] FIG. 2 shows an example of a process flow with an authentication function and an example of a process flow of an authentication bypass backdoor. A in FIG. 2 shows an example of a process flow with an authentication function, and B in FIG. 2 shows an example of a process flow of an authentication bypass backdoor. As shown in A in FIG. 2, in the example of the process flow with the authentication function, conditional branch CB1 compares the request data (inbuf) entered by the user with the authentication data (pw) read from a database or file. If the request data (inbuf) and the authentication data (pw) match, authentication is successful; if the request data (inbuf) and the authentication data (pw) do not match, authentication is unsuccessful. Although conditional branch CB1 exists in the flow shown in A in FIG. 2, it is a normal authentication branch, and the risk of a backdoor is low. On the other hand, as shown in B of Figure 2, in the example of the processing flow of an authentication bypass backdoor, the conditional branch CB3 compares the request data (inbuf) entered by the user with data (backdoor) known only to the attacker, and if the request data (inbuf) matches the data (backdoor), the authentication success process can be performed without going through the conditional branch CB2. Such a conditional branch CB3, which compares the request data (inbuf) entered by the user with data (backdoor) coded in the program, can be determined to have a high possibility of being a backdoor trigger.

[0023] By implementing the basic idea of ​​the present invention described above, it is possible to automatically screen out execution paths from external inputs to functions that could have a significant impact if exploited, and identify those that are likely to be execution paths of authentication function bypass backdoors, thereby reducing the workload of analysts.

[0024] 3 is a schematic diagram of a backdoor inspection device according to an embodiment of the present invention. As shown in FIG. 3, the backdoor inspection device 10 includes an execution path extraction unit 11, an external input branch extraction unit 12, an authentication branch determination unit 13, and a backdoor determination unit 14.

[0025] The execution path extraction unit 11 analyzes the program to extract an execution path, the external input branch extraction unit 12 extracts, from among the conditional branches included in the execution path, those whose conditions include external inputs as external input branches, the authentication branch determination unit 13 extracts, from among the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible, and the backdoor determination unit 14 determines that there is a high possibility of a backdoor when the execution path does not pass through either the authentication branch or a function used for authentication.

[0026] The processes performed by the components of the backdoor inspection device 10 can also be implemented as a backdoor inspection method. The processes performed by the components of the backdoor inspection device 10 can also be implemented as a program that causes an information processing device to perform the processes. The processes performed by the components of the backdoor inspection device 10 will be described in more detail below.

[0027] Figure 4 is a diagram illustrating the processing performed by the execution path extraction unit. As shown in Figure 4, a sensitive function list L2, which lists important functions to be analyzed and which would have a significant impact on the system if exploited, and an external input function list L1, which defines variables using external inputs, are input to the execution path extraction unit 11. The execution path extraction unit 11 references the sensitive function list L2 and the external input function list L1 to extract execution paths from functions corresponding to the external input function list L1 to functions corresponding to the sensitive function list L2. For example, in the example flow shown in Figure 4, an execution path list L3 is obtained.

[0028] FIG. 5 is a diagram illustrating the processing performed by the external input branch extraction unit. As shown in the flowchart of FIG. 5, the external input branch extraction unit 12 obtains the list of execution paths created by the execution path extraction unit 11 and extracts one execution path from the list (Step 1). Next, the external input branch extraction unit 12 extracts one conditional branch included in the execution path (Step 2). Then, the external input branch extraction unit 12 determines whether the conditional branch includes an external input (Step 3). If the conditional branch includes an external input, the external input branch extraction unit 12 stores the external input in the external input conditional branch list (Step 4). For example, in the example flow shown in FIG. 5, the conditional branch CB1 included in the execution path list L3 includes external inputs A and B, so that the conditional branch CB1 corresponds to an external input conditional branch, and the external input conditional branch list L4 is obtained from the execution path list L3.

[0029] 6 is a diagram illustrating the processing performed by the authentication branch determination unit 13. The authentication branch determination unit 13 extracts, from among the external input branches, those whose conditions include multiple different external inputs as authentication branches that determine whether authentication is possible. For example, in the example flow shown in FIG. 6, an execution path in the external input condition branch list L4 in which the external inputs are different and the external input condition branches overlap can be determined to be a condition branch for determining whether authentication is successful, and therefore the condition branch CB1 included in this execution path is stored in the authentication branch list L5.

[0030] FIG. 7 is a diagram illustrating the processing performed by the backdoor determination unit. The backdoor determination unit 14 determines that an execution path that does not pass through either the authentication branch or the function used for authentication is likely to be a backdoor. As shown in FIG. 7, the backdoor determination unit 14 determines an execution path that is likely to be a backdoor using the execution path list L3 created by the execution path extraction unit 11, the authentication branch list L5 created by the authentication branch determination unit 13, and the authentication function list L6 prepared in advance. As shown in the flowchart of FIG. 7, the backdoor determination unit 14 extracts one execution path from the execution path list L3 (Step 1). Then, the backdoor determination unit 14 determines whether the execution path passes through an authentication function by referring to the authentication function list L6 (Step 2). Furthermore, the backdoor determination unit 14 determines whether the execution path passes through an authentication function by referring to the authentication branch list L5 (Step 3). The backdoor determination unit 14 notifies the inspector that an execution path that does not pass through either the authentication branch or the authentication function is likely to be a backdoor (Step 4). For example, in the execution path list L3 shown in FIG. 7, EP #4 executes the security-sensitive function funcE without passing through the authentication function or authentication branch, so it is reported that there is a high possibility of it being a backdoor.

[0031] By performing backdoor inspection using the above-described procedure, the backdoor inspection device according to the embodiment can efficiently narrow down execution paths that are likely to be backdoors, thereby reducing the workload of backdoor inspection.

[0032] (Hardware Configuration Example) FIG. 8 is a diagram showing an example of the hardware configuration of a backdoor inspection device used in the embodiment. That is, the backdoor inspection device 10 makes it possible to realize each function of the backdoor inspection device 10 by executing the above-described backdoor inspection method as a program on an information processing device (computer) 20 employing the hardware configuration shown in FIG. 8. However, the hardware configuration example shown in FIG. 8 is an example of a hardware configuration that realizes each function of the backdoor inspection device 10 and is not intended to limit the hardware configuration of the backdoor inspection device 10. The backdoor inspection device 10 may include hardware not shown in FIG. 8.

[0033] As shown in FIG. 8, the hardware configuration that can be adopted by the backdoor inspection device 10 includes a CPU (Central Processing Unit) 21, a main memory device 22, an auxiliary memory device 23, and an IF (Interface) unit 24, which are interconnected by, for example, an internal bus.

[0034] The CPU 21 executes each command included in the backdoor inspection program executed by the information processing device (computer) 20. The main storage device 22 is, for example, a RAM (Random Access Memory), and temporarily stores various programs, such as the backdoor inspection program executed by the information processing device (computer) 20, for processing by the CPU 21.

[0035] The auxiliary storage device 23 is, for example, a hard disk drive (HDD), and is capable of storing, for the medium to long term, various programs such as a backdoor inspection program executed by the information processing device (computer) 20. Various programs such as a backdoor inspection program can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0036] The IF unit 24 provides an interface related to input and output of the backdoor inspection device 10, for example.

[0037] The information processing device (computer) 20 employing the above-described hardware configuration implements the functions of the backdoor inspection device 10 by executing the above-described backdoor inspection method as a program.

[0038] Some or all of the above embodiments may be described as, but are not limited to, the following supplementary notes. [Supplementary Note 1] A backdoor inspection device comprising: an execution path extraction unit that analyzes a program to extract an execution path; an external input branch extraction unit that extracts, from conditional branches included in the execution path, those whose conditions include an external input as external input branches; an authentication branch determination unit that extracts, from the external input branches, those whose conditions include a plurality of different external inputs as authentication branches whose conditions determine whether authentication is possible; and a backdoor determination unit that determines that there is a high possibility of a backdoor when the execution path does not pass through either the authentication branch or a function used for authentication. [Supplementary Note 2] The backdoor inspection device according to Supplementary Note 1, in which the backdoor determination unit determines the possibility of a backdoor by referring to a list of functions used for authentication. [Supplementary Note 3] The backdoor inspection device according to Supplementary Note 1 or Supplementary Note 2, wherein the execution path extraction unit references a sensitive function list describing important functions to be analyzed that have a significant impact on the system if exploited and an external input function list that defines variables using external inputs, and extracts an execution path from a function corresponding to the external input function list to a function corresponding to the sensitive function list. [Supplementary Note 4] The backdoor inspection device according to any one of Supplementary Note 1 to Supplementary Note 3, wherein the authentication branch determination unit compares an external input input from outside a device that executes the program with an external input stored inside the device, and extracts, as the authentication branch, one of the branches. [Supplementary Note 5] A backdoor inspection method comprising: analyzing a program to extract an execution path; extracting, from conditional branches included in the execution path, as external input branches, those whose conditions include an external input; and extracting, from the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible; and determining that an execution path that does not pass through the authentication branch and a function used for authentication is highly likely to be a backdoor. [Supplementary Note 6] The backdoor inspection method according to Supplementary Note 5, wherein the possibility of a backdoor is determined by referring to a list of functions used for the authentication.[Supplementary Note 7] The backdoor inspection method according to Supplementary Note 5 or Supplementary Note 6, which refers to a sensitive function list describing important functions to be analyzed that have a large impact on the system if exploited, and an external input function list that defines variables using external inputs, and extracts an execution path from a function corresponding to the external input function list to a function corresponding to the sensitive function list. [Supplementary Note 8] The backdoor inspection method according to any one of Supplementary Note 5 to Supplementary Note 7, which extracts, as the authentication branch, one that compares an external input input from outside the device that executes the program with an external input stored inside the device. [Supplementary Note 9] A backdoor inspection program characterized by having an information processing device execute the following steps: an execution path extraction process that analyzes a program to extract an execution path; an external input branch extraction process that extracts, from conditional branches included in the execution path, those whose conditions include an external input as external input branches; an authentication branch determination process that extracts, from the external input branches, those whose conditions include a plurality of different external inputs as authentication branches that determine whether authentication is possible; and a backdoor determination process that determines that there is a high possibility of a backdoor if the execution path does not pass through the authentication branch and a function used for authentication. [Supplementary Note 10] The backdoor inspection program according to Supplementary Note 9, in which the backdoor determination process determines the possibility of a backdoor by referring to a list of functions used for authentication.

[0039] The disclosures of the above-cited patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concepts thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by a person skilled in the art in accordance with the entire disclosure and technical concepts, including the claims. In particular, with regard to the numerical ranges described herein, any numerical value or subrange within the range should be construed as specifically described, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents, when used in part or in whole in combination with the disclosures herein as part of the disclosure of the present invention, in accordance with the spirit of the present invention, are also deemed to be included in the disclosures of this application.

[0040] REFERENCE SIGNS LIST 10 Backdoor inspection device 11 Execution path extraction unit 12 External input branch extraction unit 13 Authentication branch determination unit 14 Backdoor determination unit 20 Information processing device 21 CPU 22 Main storage device 23 Auxiliary storage device 23 IF unit

Claims

1. an execution path extraction unit that analyzes a program and extracts an execution path; an external input branch extraction unit that extracts, from among the conditional branches included in the execution path, those that include an external input as a condition, as external input branches; an authentication branch determination unit that extracts, from the external input branches, those in which a plurality of different external inputs are included in a condition as an authentication branch for determining whether or not authentication is possible; a backdoor determination unit that determines that an execution path that does not pass through either the authentication branch or a function used for authentication is highly likely to be a backdoor; A back door inspection device comprising:

2. The backdoor inspection device according to claim 1 , wherein the backdoor determination unit determines the possibility of a backdoor by referring to a list of functions used for the authentication.

3. 2. The backdoor inspection device according to claim 1, wherein the execution path extraction unit refers to a sensitive function list that lists important functions to be analyzed and that have a large impact on the system if abused, and an external input function list that defines variables using external inputs, and extracts execution paths from functions that fall under the external input function list to functions that fall under the sensitive function list.

4. 4. The backdoor inspection device according to claim 1, wherein the authentication branch determination unit compares an external input input from outside the device that executes the program with an external input stored inside the device to extract the authentication branch.

5. Analyze the program to extract execution paths, extracting, from among the conditional branches included in the execution path, those that include an external input as a condition as an external input branch; extracting, from the external input branches, those in which a plurality of different external inputs are included as conditions, as authentication branches for determining whether or not authentication is possible; A backdoor inspection method characterized in that it is determined that there is a high possibility of a backdoor when an execution path does not pass through the authentication branch and the function used for authentication.

6. The backdoor inspection method according to claim 5, wherein the possibility of a backdoor is determined by referring to the list of functions used for authentication.

7. 6. The backdoor inspection method according to claim 5, further comprising: referring to a sensitive function list describing important functions to be analyzed that have a large impact on the system if exploited, and an external input function list that defines variables using external inputs; and extracting execution paths from functions corresponding to the external input function list to functions corresponding to the sensitive function list.

8. The backdoor inspection method according to any one of claims 5 to 7, wherein a comparison between an external input input from outside the device that executes the program and an external input stored inside the device is extracted as the authentication branch.

9. an execution path extraction process that analyzes the program and extracts execution paths; an external input branch extraction process for extracting, from among the conditional branches included in the execution path, those whose conditions include an external input as external input branches; an authentication branch determination process for extracting, from the external input branches, those in which a plurality of different external inputs are included as conditions, as authentication branches for determining whether or not authentication is possible; a backdoor determination process for determining that an execution path that does not pass through the authentication branch and the function used for authentication is highly likely to be a backdoor; A backdoor inspection program characterized by causing an information processing device to execute the above.

10. The backdoor inspection program according to claim 9 , wherein the backdoor determination process determines the possibility of a backdoor by referring to a list of functions used for authentication.