Program, processing device, and method

Abstract

A processing device according to the present disclosure comprises: an acquisition unit that acquires target software including a code corresponding to a processing flow; and a symbolic execution unit that performs symbolic execution on a per-data-flow basis for a target data flow, which is one of a first data flow and a second data flow into which the processing flow is divided before and after a control instruction due to the control instruction, or each of the first data flow and the second data flow.

Description

Program, processing device, and method

[0001] The present disclosure relates to a program, a processing device, and a method.

[0002] Symbolic execution is used for software analysis (see, for example, Patent Document 1). In symbolic execution, abstract symbols (symbolic values) that represent constants without specific values ​​are assigned to variables that store input values ​​to a program, instead of specific numerical values ​​or specific characters. By simulating the execution of a program using symbols, the execution path of the program can be efficiently traced.

[0003] Japanese Patent Application Laid-Open No. 2017-204163

[0004] However, the technology of Patent Document 1 treats the entire processing flow, including conditional branches (i.e., control instructions and branch instructions), as a symbolic execution unit, which may increase the resources required for calculation. A "processing flow" refers to a group of processing steps from a starting processing step to an ending processing step.

[0005] An object of the present disclosure is to provide a program, a processing device, and a method that can reduce the computational resources required for symbolic execution. It should be noted that this object is only one of multiple objects that multiple embodiments disclosed in this specification aim to achieve. Other objects or problems and novel features will become apparent from the description of this specification or the accompanying drawings.

[0006] The program according to the present disclosure causes a processing device to execute a process including acquiring target software including code corresponding to a processing flow, and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow by a control instruction into data flows before and after the control instruction, or for each of the first data flow and the second data flow.

[0007] The processing device according to the present disclosure includes an acquisition unit that acquires target software including code corresponding to a processing flow, and a symbolic execution unit that performs symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow into data flows before and after the control instruction, or for each of the first data flow and the second data flow.

[0008] A method according to the present disclosure is a method executed by a processing device, and includes acquiring target software including code corresponding to a processing flow, and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow in which the processing flow is divided by a control instruction before and after the control instruction, or for each of the first data flow and the second data flow.

[0009] The present disclosure can provide a program, a processing device, and a method that can reduce the computational resources required for symbolic execution.

[0010] FIG. 1 is a diagram provided for explanation of terms. FIG. 2 is a block diagram showing an example of a processing device of the present disclosure. FIG. 3 is a flowchart showing an example of processing operation of the processing device of the present disclosure. FIG. 4 is a block diagram showing an example of a processing device of the present disclosure. FIG. 5 is a flowchart showing another example of processing operation of the processing device of the present disclosure. FIG. 6 is a block diagram showing an example of a processing device of the present disclosure. FIG. 7 is a flowchart showing another example of processing operation of the processing device of the present disclosure. FIG. 8 is a diagram showing an example of the configuration of a processing device.

[0011] First, the main terms used in this disclosure will be explained. Figure 1 is a diagram used to explain the terms.

[0012] As mentioned above, a "processing flow" refers to a group of processing steps from a starting processing step to an end processing step. Figure 1 shows an example of a processing flow. As shown in Figure 1, the starting point of a processing flow is called the "source" and the end point is called the "sink." In particular, in the example shown in Figure 1, the source is a process that receives data, and the sink is a security-sensitive process. The data reception process may be a data input process in the target software that includes the processing flow, such as a process in which the target software obtains data from the Internet. It may also be a process in which data is passed to the target software by another software on the same server where the target software is running relaying communication from the Internet. A security-sensitive process refers to a process that could cause a vulnerability if executed carelessly. For example, a process that outputs an HTML document is considered security-sensitive because outputting data that has not been properly escaped could cause a cross-site scripting vulnerability. Alternatively, the process of issuing an SQL query can be considered a security-sensitive process because issuing an SQL query without proper sanitization processing can lead to an SQL injection vulnerability.Also, the process of executing an arbitrary command can be considered a security-sensitive process because it can lead to an arbitrary command execution vulnerability if the conditions for executing the process are not implemented properly.

[0013] The process flow can be identified by an existing method for identifying a process flow. For example, an analysis unit (not shown) may hold a first list that holds candidate functions that are the starting points of the process flow and a second list that holds candidate functions that are the ending points of the process flow. The analysis unit (not shown) may then analyze the target software (software code) to identify the starting function and the ending function included in the target software, and identify the dependency relationships (data dependency, control dependency) between the starting function and the ending function to identify the process flow.

[0014] As shown in Figure 1, when Data 1 is processed to become Data 1', Data 1 and Data 1' are in a "data dependency" relationship. Note that processing here includes data assignment and copying. Also, as shown in Figure 1, when Data 1" is used as input for a control instruction and Data 2 is created when a specific condition is met, Data 1" and Data 2 are in a "control dependency" relationship. Here, a control instruction refers to an instruction that changes the subsequent processing to be executed based on the result of the condition associated with the instruction. Examples of control instructions include code that implements conditional branching, such as if statements, switch statements, je instructions, and beq instructions. Control instructions also include exception handling instructions, such as try-catch statements, that execute a specified process when an exception that meets a specific condition occurs. Control instructions in a processing flow control whether to continue sensitive processing based on whether the input data or data that has a dependency on the input data meets a specified condition.

[0015] A data flow is a representation of how data created or received in a process within a program is used and propagated. As shown in FIG. 1, a group of processing steps related to data 1 and data 1' and data 1" derived from data 1 constitute the data flow of data 1. A group of processing steps related to data 2 and data 2' derived from data 2 constitutes the data flow of data 2. A processing flow may also be called processing flow code, and a data flow may also be called data flow code or partial code.

[0016] Hereinafter, embodiments will be described with reference to the drawings. In this disclosure, the drawings may relate to one or more embodiments. Furthermore, each element in the drawings may apply to one or more embodiments. Furthermore, in the embodiments, identical or equivalent elements are given the same reference numerals, and redundant description will be omitted.

[0017] First Embodiment Configuration Example of Processing Device Fig. 2 is a block diagram showing an example of a processing device according to the present disclosure. In Fig. 2, a processing device 10 includes an acquisition unit 11 and a symbolic execution unit 12.

[0018] The acquisition unit 11 acquires target software (e.g., software to be inspected) that includes code corresponding to a processing flow. For example, the starting point of the processing flow is an external data input process, and the end point of the processing flow is a security-sensitive process.

[0019] The symbolic execution unit 12 executes symbolic execution on the target data flow in data flow units. The target data flow may be one of a "first data flow" and a "second data flow" obtained by dividing a processing flow into parts before and after a control instruction using a control instruction. Alternatively, the target data flow may be each of a "first data flow" and a "second data flow" obtained by dividing a processing flow into parts before and after a control instruction using a control instruction. Note that the number of control instructions included in a processing flow may be one, or two or more. In other words, the number of data flows included in a processing flow may be two, or three or more. In this disclosure, for simplicity, two cases will be described as examples.

[0020] <Example of Processing Device Operation> FIG. 3 is a flowchart showing an example of processing operation of the processing device of the present disclosure.

[0021] The acquisition unit 11 acquires the target software including the code corresponding to the processing flow (step S11).

[0022] The symbolic execution unit 12 executes symbolic execution on the target data flow in units of data flow (step S12).

[0023] As described above, according to the first embodiment, the symbolic execution unit 12 in the processing device 10 executes symbolic execution on a data flow basis for a target data flow. The target data flow may be one of a "first data flow" and a "second data flow" obtained by dividing a processing flow into parts before and after a control instruction using a control instruction. Alternatively, the target data flow may be each of the "first data flow" and the "second data flow" obtained by dividing a processing flow into parts before and after a control instruction using a control instruction.

[0024] This configuration of the processing device 10 allows for a reduction in the computational resources required for symbolic execution. For example, symbolic execution can be terminated when the symbolic execution for each target data flow is completed, and the resources used for the symbolic execution can be released upon completion. This allows for a reduction in the computational resources required for symbolic execution. Furthermore, for example, if the symbolic execution of a first data flow determines that there is no case in which a second data flow starts, symbolic execution for the second data flow can be avoided. This allows for a reduction in the computational resources required for symbolic execution.

[0025] Second Embodiment Configuration Example of Processing Device Fig. 4 is a block diagram showing an example of a processing device according to the present disclosure. In Fig. 4, a processing device 20 includes an acquisition unit 21, a symbolic execution unit 22, and an output unit 23.

[0026] The acquisition unit 21 acquires target software (e.g., software to be inspected) that includes code related to a processing flow, similar to the acquisition unit 11. The acquisition unit 21 also acquires "information related to the processing flow" (i.e., dependency relationships (data dependency, control dependency, etc.) between a starting processing step and an ending processing step) identified by the analysis unit (not shown).

[0027] The symbolic execution unit 22 performs symbolic execution using, as symbols, input data of a function that is the starting point of a target data flow included in the processing flow of the target software acquired by the acquisition unit 21, and using, as constraints, the conditions of the control instructions that are the end points of the target data flow. That is, the symbolic execution unit 22 uses, as constraints, the conditions of the control instructions that are the end points of the target data flow, and solves, as a constraint satisfaction problem, the input data when the constraints are satisfied. For example, the target data flow may be the first data flow that is the front of a "first data flow" and a "second data flow" that are obtained by dividing the processing flow by a control instruction into a "first data flow" and a "second data flow" before and after the control instruction.

[0028] For example, the symbolic execution unit 22 sets a target data flow based on "information about the processing flow." The symbolic execution unit 22 also sets a "symbol" for the input data that is the starting point of the target data flow. The symbolic execution unit 22 also sets a "constraint" for the condition of the control command that is the end point of the target data flow. For example, the "constraint" includes the condition of the control command being in a state that allows the processing flow to continue. The symbolic execution unit 22 then executes symbolic execution on the target data flow using the set symbols and constraints. This allows the symbolic execution unit 22 to identify the "value of the input data that is the starting point of the target data flow" when the constraint is satisfied.

[0029] The output unit 23 outputs the "value of the input data that is the starting point of the target data flow when the constraint is satisfied" identified by the symbolic execution unit 22.

[0030] <Example of Processing Device Operation> FIG. 5 is a flowchart showing another example of the processing device operation of the present disclosure.

[0031] The acquisition unit 21 acquires target software including code corresponding to a processing flow (step S21). The acquisition unit 21 also acquires "information related to the processing flow" (step S21).

[0032] The symbolic execution unit 22 sets the target data flow based on the "information on the processing flow" (step S22).

[0033] The symbolic execution unit 22 sets a "symbol" to the input data that is the starting point of the target data flow (step S23).The symbolic execution unit 22 also sets a "constraint" to the condition of the control command that is the end point of the target data flow (step S23).

[0034] For example, in the case of the processing flow shown in FIG. 1, the symbolic execution unit 22 sets the data flow of data 1 as the target data flow. Then, the symbolic execution unit 22 sets a symbol for data 1. Furthermore, the symbolic execution unit 22 sets the condition of the control instruction in which data 1" is used as input to the control instruction as a constraint. Here, as described above, the "constraint" may be that the condition of the control instruction is in a state that allows the processing flow to continue. In the example of FIG. 1, this constraint is "the condition of the control instruction is satisfied and the processing proceeds to the processing step that creates data 2."

[0035] The symbolic execution unit 22 executes symbolic execution on the target data flow using the set symbols and constraints (step S24).

[0036] The output unit 23 outputs the "value of the input data that will be the starting point of the target data flow when the constraint is satisfied" identified by the symbolic execution unit 22 (step S25). This "value of the input data that will be the starting point of the target data flow when the constraint is satisfied" enables dynamic analysis of the processing flow. This makes it easy to determine the vulnerability of the processing flow, formulate a correction policy, and test the corrections.

[0037] Here, "the value of the input data that is the starting point of the target data flow when the constraint is satisfied" refers to the value of the input data that is the starting point of the target data flow related to a logically valid process flow. In other words, the value of the input data related to a logically invalid process flow is not output, so that false positive process flows can be excluded.

[0038] As described above, according to the second embodiment, the symbolic execution unit 22 in the processing device 20 performs symbolic execution using the input data of the function that is the starting point of the target data flow included in the processing flow of the target software acquired by the acquisition unit 21 as a symbol, and the condition of the control instruction that is the end point of the target data flow as a constraint.

[0039] This configuration of the processing device 20 makes it possible to identify the value of the input data that will be the starting point of the target data flow when the constraint is satisfied. This enables dynamic analysis of the processing flow using the value of the input data that will be the starting point of the target data flow when the constraint is satisfied, making it easier to determine the vulnerability of the processing flow, formulate a correction policy, and test the corrections.

[0040] <Modification of the Second Embodiment> The symbolic execution unit 22 may further set a first variable that exists between the starting point and the ending point in the target data flow and has a data dependency relationship with the input data as the "other symbol." The symbolic execution unit 22 may further set the content of the data dependency relationship between the first variable and a second variable that has the first variable as the dependent variable of the data dependency relationship as the "other constraint," and execute symbolic execution. For example, in the example of FIG. 1 , Data1' may be set as the other symbol, and the data dependency relationship between Data1' and Data1" may be set as the other constraint.

[0041] Third Embodiment Configuration Example of Processing Device Fig. 6 is a block diagram showing an example of a processing device according to the present disclosure. In Fig. 6, a processing device 30 includes an acquisition unit 31, a symbolic execution unit 32, a determination unit 33, and an output unit 34.

[0042] The acquisition unit 31 acquires target software (e.g., software to be inspected) that includes code related to a processing flow, similar to the acquisition unit 21. Also, similar to the acquisition unit 21, the acquisition unit 31 acquires "information related to the processing flow" (i.e., dependency relationships (data dependency, control dependency, etc.) between a starting processing step and an ending processing step) identified by the analysis unit (not shown).

[0043] The symbolic execution unit 32 defines each of the "first data flow" and "second data flow" obtained by dividing the processing flow by a control instruction into a target data flow and a target data flow, and performs symbolic execution on the target data flow in data flow units. For example, the symbolic execution unit 32 performs symbolic execution using a variable that is the starting point of the first data flow as a symbol and a condition of a control instruction that is the end point of the first data flow as a constraint. The symbolic execution unit 32 also performs symbolic execution using another variable that is the starting point of a second data flow as a different symbol and a condition of another control instruction that is the end point of the second data flow as a different constraint. In other words, for each target data flow, the symbolic execution unit 32 defines the condition of a control instruction that is the end point of the target data flow as a constraint and solves the input data when the constraint is satisfied as a constraint satisfaction problem.

[0044] For example, the symbolic execution unit 32 sets the first data flow as the target data flow based on the "information about the processing flow." The symbolic execution unit 22 also sets a "symbol" for the input data that is the starting point of the first data flow. The symbolic execution unit 22 also sets a "constraint" for the condition of the control instruction that is the end point of the first data flow. For example, the "constraint" includes the condition of the control instruction being in a state that allows the processing flow to continue. The symbolic execution unit 32 then executes symbolic execution on the first data flow using the set symbol and constraint.

[0045] The symbolic execution unit 32 also sets the second data flow as the target data flow based on the "information about the processing flow." The symbolic execution unit 32 also sets "other symbols" to the input data that is the starting point of the second data flow. The symbolic execution unit 32 also sets "other constraints" to the conditions of other control instructions that are the end points of the second data flow. For example, the "other constraints" include the conditions of other control instructions that allow the processing flow to continue. The symbolic execution unit 32 then executes symbolic execution on the second data flow using the set other symbols and other constraints. Here, the symbolic execution unit 32 may terminate the symbolic execution if it cannot be completed with the specified computational resources. The specified computational resources may be, for example, an upper limit on computation time or an upper limit on storage capacity.

[0046] The determination unit 33 determines whether there is a case in which both the above constraint and the other constraint are satisfied as a result of the symbolic execution by the symbolic execution unit 32. That is, the determination unit 33 determines whether the above processing flow is a logically valid processing flow. The determination unit 33 may further determine whether the symbolic execution by the symbolic execution unit 32 is completed with predetermined computational resources. For example, the determination unit 33 determines that the symbolic execution by the symbolic execution unit 32 is not completed if at least one of the symbolic execution for the first data flow and the symbolic execution for the second data flow is not completed. That is, the determination unit 33 determines that the symbolic execution by the symbolic execution unit 32 is completed only when both the symbolic execution for the first data flow and the symbolic execution for the second data flow are completed.

[0047] When the determination unit 33 determines that a case exists in which both the constraint and the other constraint are satisfied, the output unit 34 outputs information indicating that a case exists in which both the constraint and the other constraint are satisfied. The information indicating that a case exists in which both the constraint and the other constraint are satisfied may be information indicating that the processing flow is a logically possible processing flow. Furthermore, when the determination unit 33 determines that a case exists in which both the constraint and the other constraint are satisfied, the output unit 34 outputs information indicating that a case does not exist in which both the constraint and the other constraint are satisfied. The information indicating that a case does not exist in which both the constraint and the other constraint are satisfied may be information indicating that the processing flow is a logically impossible processing flow. Furthermore, when the symbolic execution by the symbolic execution unit 32 is not completed, the output unit 34 outputs information indicating that the symbolic execution is not completed.

[0048] Here, the information output from the output unit 34 may be a score. This score may indicate the malignancy of the processing flow. For example, information indicating that there is a case in which both the above constraint and the other constraint are satisfied may be a score of "1." Information indicating that there is no case in which both the above constraint and the other constraint are satisfied may be a score of "0." Information indicating that the symbolic execution is not completed may be a score of "0.5." Alternatively, the information indicating that the symbolic execution is not completed may be calculated as a lower score when the number of symbolic executions that are not completed is greater for multiple symbolic executions. For example, given a processing flow including 10 data flows, the score may be "0.9" when the symbolic execution of one of the 10 data flows is not completed, and the score may be "0.8" when the symbolic execution of two data flows is not completed.

[0049] <Example of Processing Device Operation> FIG. 7 is a flowchart showing another example of the processing device operation of the present disclosure.

[0050] The acquisition unit 31 acquires target software including code corresponding to a process flow (step S31). The acquisition unit 31 also acquires "information related to the process flow" (step S31).

[0051] The symbolic execution unit 32 sets the first data flow and the second data flow as target data flows based on the "information on the processing flow" (step S32).

[0052] The symbolic execution unit 32 sets a "symbol" to the input data that is the starting point of the first data flow (step S33). The symbolic execution unit 22 also sets a "constraint" to the condition of the control instruction that is the end point of the first data flow (step S33).

[0053] For example, in the case of the processing flow shown in FIG. 1, the symbolic execution unit 32 sets the data flow of data 1 as the target data flow. Then, the symbolic execution unit 32 sets a symbol for data 1. Furthermore, the symbolic execution unit 32 sets the condition of the control instruction in which data 1" is used as input to the control instruction as a constraint. Here, as described above, the "constraint" may be that the condition of the control instruction is in a state that allows the processing flow to continue. In the example of FIG. 1, this constraint is "the condition of the control instruction is satisfied and the processing proceeds to the processing step that creates data 2."

[0054] The symbolic execution unit 32 also sets "another symbol" to the input data that is the starting point of the second data flow (step S33), and sets "another constraint" to the condition of another control instruction that is the end point of the second data flow (step S33).

[0055] For example, in the processing flow shown in FIG. 1 , the symbolic execution unit 32 sets the data flow of data 2 as the target data flow. Then, the symbolic execution unit 32 sets another symbol for data 2. Furthermore, the symbolic execution unit 32 sets the condition of another control instruction in which data 2' is used as input to the other control instruction as another constraint. Here, as described above, the "other constraint" may be that the condition of the other control instruction is in a state that allows the processing flow to continue. In the example of FIG. 1 , this other constraint is "the condition of the other control instruction is satisfied, and the processing proceeds to security-sensitive processing."

[0056] The symbolic execution unit 32 executes symbolic execution on the first data flow using the set symbols and constraints (step S34).The symbolic execution unit 32 also executes symbolic execution on the second data flow using the set other symbols and other constraints (step S34).

[0057] The determination unit 33 determines whether the symbolic execution by the symbolic execution unit 32 has completed (step S35). If it is determined that the symbolic execution by the symbolic execution unit 32 has not completed (step S35 NO), the output unit 34 outputs information indicating that the symbolic execution has not completed (step S36). Then, the flow of the flowchart in FIG. 7 ends.

[0058] If it is determined that the symbolic execution by the symbolic execution unit 32 has been completed (YES in step S35), the determination unit 33 determines whether there is a case in which both the constraint and the other constraint are satisfied as a result of the symbolic execution (step S37).

[0059] If it is determined that a case exists in which both the constraint and the other constraint are satisfied as a result of the symbolic execution (YES in step S37), the output unit 34 outputs information indicating that a case exists in which both the constraint and the other constraint are satisfied (step S38), and the flow of the flowchart in FIG.

[0060] If it is determined that there is no case in which both the constraint and the other constraint are satisfied as a result of the symbolic execution (step S37 NO), the output unit 34 outputs information indicating that there is no case in which both the constraint and the other constraint are satisfied (step S39), and the flow of the flowchart in FIG.

[0061] As described above, according to the third embodiment, the symbolic execution unit 32 in the processing device 30 performs symbolic execution using a variable that is the starting point of a first data flow as a symbol and a condition of a control instruction that is the end point of the first data flow as a constraint. The symbolic execution unit 32 also performs symbolic execution using another variable that is the starting point of a second data flow as a different symbol and a condition of another control instruction that is the end point of the second data flow as a different constraint.

[0062] This configuration of the processing device 30 makes it possible to check cases where both the above constraint and the other constraint are satisfied, cases where one or both of the constraints are not satisfied, and cases where symbolic execution does not end. This makes it possible to eliminate logically invalid processing flows when determining vulnerability in processing flows, making it easier to determine vulnerability.

[0063] <Modification of Third Embodiment> The symbolic execution unit 32 may further set a first variable that exists between the start point and end point in the target data flow and has a data dependency relationship with the input data as the "other symbol." The symbolic execution unit 32 may further set the content of the data dependency relationship between the first variable and a second variable that has the first variable as the dependency source of the data dependency relationship as the "other constraint," and execute symbolic execution. For example, in the example of FIG. 1 , Data1' may be set as the other symbol, and the data dependency relationship between Data1' and Data1" may be set as the other constraint.

[0064] <Other Embodiments> <1> In the first to third embodiments, when symbolic execution is applied to a data flow, the source process or a call location of a function that implements the source process may be set as the starting point of analysis in the symbolic execution, and a control instruction may be set as the end point of analysis in the symbolic execution. Alternatively, an instruction that is executed when the process flow continues from the control instruction may be set as the end point of analysis in the symbolic execution.

[0065] <2> FIG. 8 is a diagram showing an example of the configuration of a processing device. In FIG. 8, the processing device 100 has a processor 101 and a memory 102. The processor 101 may be, for example, a microprocessor, a micro processing unit (MPU), or a central processing unit (CPU). The processor 101 may include multiple processors. The memory 102 is configured by a combination of volatile memory and non-volatile memory. The memory 102 may include storage located away from the processor 101. In this case, the processor 101 may access the memory 102 via an I (Input) / O (Output) interface (not shown).

[0066] The processing devices 10, 20, and 30 of the first to third embodiments may each have the configuration shown in FIG. 8 . The acquisition units 11, 21, and 31, the symbolic execution units 12, 22, and 32, the output units 23 and 34, and the determination unit 33 of the processing devices 10, 20, and 30 of the first to third embodiments may be implemented by the processor 101 reading and executing a program stored in the memory 102. That is, the processing devices 10, 20, and 30 of the first to third embodiments may be implemented by software. The program can be stored using various types of non-transitory computer-readable media and supplied to the processing devices 10, 20, and 30. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, and hard disk drives) and magneto-optical recording media (e.g., magneto-optical disks). Further examples of non-transitory computer-readable media include CD-ROMs (Read Only Memory), CD-Rs, and CD-R / Ws. Further, examples of non-transitory computer-readable media include semiconductor memory. Semiconductor memory includes, for example, mask ROM, programmable ROM (PROM), erasable PROM (EPROM), flash ROM, and random access memory (RAM). The program may also be provided to the processing devices 10, 20, and 30 by various types of transitory computer-readable media. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. The transitory computer-readable media may provide the program to the processing devices 10, 20, and 30 via wired communication paths such as electrical wires and optical fibers, or wireless communication paths.

[0067] Alternatively, the acquisition units 11, 21, and 31, the symbolic execution units 12, 22, and 32, the output units 23 and 34, and the determination unit 33 of the processing devices 10, 20, and 30 of the first to third embodiments may each be realized by dedicated hardware. Furthermore, some or all of the components of each device may be realized by general-purpose or dedicated circuits, processors, etc., or a combination thereof. These may be configured by a single chip or by multiple chips connected via a bus. Some or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc., and a program. Furthermore, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an FPGA (Field-Programmable Gate Array), a quantum processor (quantum computer control chip), etc., may be used as the processor.

[0068] Furthermore, when some or all of the components of the processing devices 10, 20, and 30 of the first to third embodiments are realized by multiple information processing devices, circuits, etc., the multiple information processing devices, circuits, etc. may be centrally or distributed. For example, the information processing devices, circuits, etc. may be realized as a client-server system, a cloud computing system, or the like, in a form in which each is connected via a communication network. Furthermore, the functions of the processing devices 10, 20, and 30 of the first to third embodiments may be provided in a Software as a Service (SaaS) format.

[0069] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0070] Each drawing is merely an example for describing one or more embodiments. Each drawing may not relate to only one particular embodiment, but may also relate to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0071] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes: (Supplementary Note 1) A program that causes a processing device to execute a process including: acquiring target software including code corresponding to a processing flow; and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow into a data flow before and a data flow after a control instruction by the control instruction, or for each of the first data flow and the second data flow. (Supplementary Note 2) The program according to Supplementary Note 1, wherein performing the symbolic execution includes performing symbolic execution using input data of a function that is a starting point of the target data flow as a symbol and using a condition of the control instruction that is an end point of the target data flow as a constraint. (Supplementary Note 3) The program according to Supplementary Note 2, wherein performing the symbolic execution includes performing symbolic execution with a first variable that exists between the starting point and the ending point in the target data flow and has a data dependency relationship with the input data as another symbol, and with a content of a data dependency relationship between the first variable and a second variable that has the first variable as a dependency source of the data dependency relationship as another constraint. (Supplementary Note 4) The program according to Supplementary Note 2 or 3, wherein the constraint includes a condition of the control instruction being in a state that allows the processing flow to continue. (Supplementary Note 5) The program according to any one of Supplements 2 to 4, wherein the processing further includes outputting the input data when the constraint is satisfied. (Supplementary Note 6) The program according to Supplementary Note 1, wherein performing the symbolic execution includes performing symbolic execution using a variable that is a starting point of the first data flow as a symbol and a condition of the control instruction that is an end point of the first data flow as a constraint, and performing symbolic execution using another variable that is a starting point of the second data flow as a other symbol and a condition of another control instruction that is an end point of the second data flow as another constraint. (Supplementary Note 7) The program according to Supplementary Note 6, wherein the constraint includes a condition of the control instruction being a state that allows the processing flow to continue, and the other constraint includes a condition of the other control instruction being a state that allows the processing flow to continue.(Supplementary Note 8) The program according to Supplementary Note 6 or 7, wherein the processing further includes determining whether or not a case exists in which both the constraint and the other constraint are satisfied. (Supplementary Note 9) The program according to Supplementary Note 8, wherein the processing further includes outputting information indicating that the processing flow is logically valid when it is determined that a case exists in which both the constraint and the other constraint are satisfied. (Supplementary Note 10) The program according to Supplementary Note 6 or 7, wherein the processing further includes determining whether symbolic execution for each data flow of the processing flow is completed, and outputting a score indicating whether or not the processing flow is logically valid based on the number of symbolic executions that have not been completed. (Supplementary Note 11) The program according to any one of Supplements 1 to 10, wherein a starting point of the processing flow is a data input process, and an end point of the processing flow is a security-sensitive process. (Supplementary Note 12) The program according to Supplementary Note 2, wherein performing the symbolic execution includes determining a value of a symbol when the constraint is satisfied. (Supplementary Note 13) A processing device comprising: an acquisition unit that acquires target software including code corresponding to a processing flow; and a symbolic execution unit that performs symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow by a control instruction into data flows before and after the control instruction, or for each of the first data flow and the second data flow. (Supplementary Note 14) The processing device according to Supplementary Note 13, wherein the symbolic execution unit performs symbolic execution using input data of a function that is a starting point of the target data flow as a symbol and a condition of the control instruction that is an end point of the target data flow as a constraint. (Supplementary Note 15) The processing device according to Supplementary Note 14, wherein the symbolic execution unit performs symbolic execution using a first variable that exists in the target data flow between the starting point and the end point and has a data dependency relationship with the input data as another symbol, and a content of a data dependency relationship between the first variable and a second variable that has the first variable as a dependency source of the data dependency relationship.(Supplementary Note 16) The processing device according to Supplementary Note 14 or 15, wherein the constraint includes a condition of the control instruction being a state that allows the processing flow to continue. (Supplementary Note 17) The processing device according to any one of Supplementary Notes 14 to 16, further comprising an output unit that outputs the input data when the constraint is satisfied. (Supplementary Note 18) The symbolic execution unit performs symbolic execution using a variable that is a starting point of the first data flow as a symbol and a condition of the control instruction that is an end point of the first data flow as a constraint, and performs symbolic execution using another variable that is a starting point of the second data flow as a other symbol and a condition of another control instruction that is an end point of the second data flow as another constraint. (Supplementary Note 19) The processing device according to Supplementary Note 18, wherein the constraint includes a condition of the control instruction being a state that allows the processing flow to continue, and the other constraint includes a condition of the other control instruction being a state that allows the processing flow to continue. (Supplementary Note 20) The processing device according to Supplementary Note 18 or 19, further comprising a determination unit that determines whether a case exists in which both the constraint and the other constraint are satisfied. (Supplementary Note 21) The processing device according to Supplementary Note 20, further comprising an output unit that outputs information indicating that the processing flow is logically valid when it is determined that a case exists in which both the constraint and the other constraint are satisfied. (Supplementary Note 22) The processing device according to Supplementary Note 18 or 19, further comprising: a determination unit that determines whether symbolic execution for each data flow of the processing flow is completed; and an output unit that outputs a score indicating whether the processing flow is logically valid based on the number of symbolic executions that have not been completed. (Supplementary Note 23) The processing device according to any one of Supplements 13 to 22, wherein the starting point of the processing flow is a data input process, and the end point of the processing flow is a security-sensitive process. (Supplementary Note 24) The processing device according to Supplementary Note 14, wherein the symbolic execution unit determines a value of a symbol when the constraint is satisfied.(Supplementary Note 25) A method executed by a processing device, comprising: acquiring target software including code corresponding to a processing flow; and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow by a control instruction into a data flow before and a data flow after the control instruction, or for each of the first data flow and the second data flow. (Supplementary Note 26) The method according to Supplementary Note 25, wherein performing the symbolic execution includes performing symbolic execution using input data of a function that is a starting point of the target data flow as a symbol and a condition of the control instruction that is an end point of the target data flow as a constraint. (Supplementary Note 27) The method according to Supplementary Note 26, wherein performing the symbolic execution includes performing symbolic execution using a first variable that exists in the target data flow between the starting point and the end point and has a data dependency relationship with the input data as another symbol, and using content of a data dependency relationship between the first variable and a second variable that has the first variable as a source of the data dependency relationship as another constraint. (Supplementary Note 28) The method of Supplementary Note 26 or 27, wherein the constraint includes a condition of the control instruction being in a state that allows the processing flow to continue. (Supplementary Note 29) The method of any one of Supplements 26 to 28, further comprising outputting the input data when the constraint is satisfied. (Supplementary Note 30) The method of Supplementary Note 25, wherein performing symbolic execution includes performing symbolic execution using a variable that is a starting point of the first data flow as a symbol and a condition of the control instruction that is an end point of the first data flow as a constraint, and performing symbolic execution using another variable that is a starting point of the second data flow as a other symbol and a condition of another control instruction that is an end point of the second data flow as a other constraint. (Supplementary Note 31) The method of Supplementary Note 30, wherein the constraint includes a condition of the control instruction being in a state that allows the processing flow to continue, and the other constraint includes a condition of the other control instruction being in a state that allows the processing flow to continue. 32. The method of claim 30 or 31, further comprising determining whether a case exists in which both the constraint and the other constraint are satisfied.(Supplementary Note 33) The method according to Supplementary Note 32, further comprising outputting information indicating that the processing flow is logically valid when it is determined that a case exists in which both the constraint and the other constraint are satisfied. (Supplementary Note 34) The method according to Supplementary Note 30 or 31, further comprising: determining whether symbolic execution for each data flow of the processing flow is completed; and outputting a score indicating whether the processing flow is logically valid based on the number of symbolic executions that have not been completed. (Supplementary Note 35) The method according to any one of Supplements 25 to 34, wherein the starting point of the processing flow is a data input process, and the end point of the processing flow is a security-sensitive process. (Supplementary Note 36) The method according to Supplementary Note 26, wherein performing the symbolic execution includes determining the value of a symbol when the constraint is satisfied.

[0072] REFERENCE SIGNS LIST 10 Processing device 11 Acquisition unit 12 Symbolic execution unit 20 Processing device 21 Acquisition unit 22 Symbolic execution unit 23 Output unit 30 Processing device 31 Acquisition unit 32 Symbolic execution unit 33 Determination unit 34 Output unit

Claims

1. A program that causes a processing device to execute a process including: acquiring target software containing code corresponding to a processing flow; and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow into a first data flow and a second data flow before and after the control instruction, or for each of the first data flow and the second data flow.

2. The program according to claim 1, wherein said symbolic execution includes performing symbolic execution using input data of a function that is the starting point of said target data flow as a symbol and using the condition of said control instruction that is the end point of said target data flow as a constraint.

3. The program of claim 2, wherein the symbolic execution includes performing symbolic execution using a first variable that exists between the starting point and the ending point in the target data flow and has a data dependency relationship with the input data as another symbol, and using the content of the data dependency relationship between the first variable and a second variable that has the first variable as a source of the data dependency relationship as another constraint.

4. The program according to claim 2 or 3, wherein the constraint includes a condition of the control instruction being a state that allows the processing flow to continue.

5. The program according to claim 2 or 3, wherein the processing further comprises outputting the input data when the constraint is satisfied.

6. The program of claim 1, wherein performing the symbolic execution includes performing symbolic execution using a variable that is the starting point of the first data flow as a symbol and a condition of the control instruction that is the end point of the first data flow as a constraint, and performing symbolic execution using another variable that is the starting point of the second data flow as a different symbol and a condition of another control instruction that is the end point of the second data flow as a different constraint.

7. The program of claim 6, wherein the constraints include a condition of the control command that causes the processing flow to continue, and the other constraints include a condition of the other control command that causes the processing flow to continue.

8. The program according to claim 6 or 7, wherein the processing further comprises determining whether or not there exists a case in which both the constraint and the other constraint are satisfied.

9. The program according to claim 8, wherein the processing further includes outputting information indicating that the processing flow is logically valid when it is determined that there is a case in which both the constraint and the other constraint are satisfied.

10. The program according to claim 6 or 7, wherein the processing further includes: determining whether symbolic execution for each data flow of the processing flow has been completed; and outputting a score indicating whether the processing flow is logically valid based on the number of symbolic executions that have not been completed.

11. The program according to any one of claims 1 to 3, wherein the starting point of the processing flow is a data input process, and the end point of the processing flow is a security-sensitive process.

12. The program of claim 2, wherein performing the symbolic execution includes determining the value of a symbol when the constraint is satisfied.

13. A processing device comprising: an acquisition unit that acquires target software including code corresponding to a processing flow; and a symbolic execution unit that performs symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow into a first data flow and a second data flow before and after the control instruction, or for each of the first data flow and the second data flow.

14. The processing device according to claim 13, wherein the symbolic execution unit performs symbolic execution using input data of a function that is the starting point of the target data flow as a symbol and using the condition of the control instruction that is the end point of the target data flow as a constraint.

15. The processing device according to claim 14, wherein the symbolic execution unit performs symbolic execution using a first variable that exists between the starting point and the ending point in the target data flow and has a data dependency relationship with the input data as another symbol, and the content of the data dependency relationship between the first variable and a second variable that has the first variable as a source of the data dependency relationship as another constraint.

16. The processing device according to claim 14 or 15, wherein the constraint includes a condition of the control command being a state that allows the processing flow to continue.

17. The processing device according to claim 14 or 15, further comprising an output unit that outputs the input data when the constraint is satisfied.

18. The processing device according to claim 13, wherein the symbolic execution unit performs symbolic execution using a variable that is the starting point of the first data flow as a symbol and a condition of the control instruction that is the end point of the first data flow as a constraint, and performs symbolic execution using another variable that is the starting point of the second data flow as a different symbol and a condition of another control instruction that is the end point of the second data flow as a different constraint.

19. The processing device according to claim 18, wherein the constraint includes a condition of the control command that causes the processing flow to continue, and the other constraint includes a condition of the other control command that causes the processing flow to continue.

20. The processing device according to claim 18 or 19, further comprising a determination unit that determines whether or not there is a case in which both the constraint and the other constraint are satisfied.

21. The processing device according to claim 20, further comprising an output unit that outputs information indicating that the processing flow is logically valid when it is determined that there is a case in which both the constraint and the other constraint are satisfied.

22. The processing device according to claim 18 or 19, further comprising: a determination unit that determines whether symbolic execution for each data flow of the processing flow has been completed; and an output unit that outputs a score indicating whether the processing flow is logically valid based on the number of symbolic executions that have not been completed.

23. The processing device according to any one of claims 13 to 15, wherein the starting point of the processing flow is a data input process, and the end point of the processing flow is a security-sensitive process.

24. The processing device according to claim 14, wherein the symbolic execution unit determines the value of a symbol when the constraint is satisfied.

25. A method executed by a processing device, comprising: acquiring target software including code corresponding to a processing flow; and performing symbolic execution on a data flow basis for one of a first data flow and a second data flow obtained by dividing the processing flow by a control instruction into a first data flow and a second data flow before and after the control instruction, or for each of the first data flow and the second data flow.

26. The method according to claim 25, wherein performing the symbolic execution includes performing symbolic execution using input data of a function that is the starting point of the target data flow as a symbol and using the condition of the control instruction that is the end point of the target data flow as a constraint.

27. The method according to claim 26, wherein said performing symbolic execution includes performing symbolic execution using a first variable that exists between the starting point and the ending point in the target data flow and has a data dependency relationship with the input data as another symbol, and using the content of the data dependency relationship between the first variable and a second variable that has the first variable as a dependent variable of the data dependency relationship as another constraint.

28. The method of claim 26 or 27, wherein the constraint includes a condition of the control instruction being a state that allows the process flow to continue.

29. The method of claim 26 or 27, further comprising outputting the input data if the constraints are satisfied.

30. The method of claim 25, wherein performing the symbolic execution includes performing symbolic execution using a variable that is the starting point of the first data flow as a symbol and a condition of the control instruction that is the end point of the first data flow as a constraint, and performing symbolic execution using another variable that is the starting point of the second data flow as a different symbol and a condition of another control instruction that is the end point of the second data flow as a different constraint.

31. The method of claim 30, wherein the constraints include conditions of the control instructions that cause the process flow to continue, and the other constraints include conditions of the other control instructions that cause the process flow to continue.

32. The method of claim 30 or 31, further comprising determining whether a case exists in which both the constraint and the other constraint are satisfied.

33. The method according to claim 32, further comprising outputting information indicating that the processing flow is logically valid when it is determined that a case exists in which both the constraint and the other constraint are satisfied.

34. The method of claim 30 or 31, further comprising: determining whether symbolic execution for each data flow of the processing flow has been completed; and outputting a score indicating whether the processing flow is logically valid based on the number of symbolic executions that have not been completed.

35. The method according to any one of claims 25 to 27, wherein the starting point of the process flow is a data entry process, and the ending point of the process flow is a security-sensitive process.

36. The method of claim 26, wherein performing symbolic execution includes determining values ​​of symbols when the constraints are satisfied.

Images