Method for generating CBOM and system for implementing same

Abstract

A method for generating a cryptography bill-of-materials (CBOM) performed by a computing system, according to one embodiment of the present disclosure, comprises the step of: acquiring information on a cryptographic asset automatically identified through analysis of a software development output; if an unidentified cryptographic asset not automatically identified through the analysis of the development output exists, generating a report on the unidentified cryptographic asset; and generating a CBOM using information on the automatically identified cryptographic asset together with additional information on the unidentified cryptographic asset inserted into a source code.

Description

How to create a CBOM and a system to implement it

[0001] The present disclosure relates to a CBOM generation method and a system for implementing the same, and more particularly, to a CBOM generation method for providing the current status of use of encryption technology applied to an IT system in the format of a standardized CBOM (Cryptography Bill-of-Materials), and a system for implementing the same.

[0002] As quantum computer technology advances, the security industry is warning of the threat of attacks on encryption systems utilizing Cryptography Relevant Quantum Computers (CRQCs).

[0003] To prepare for these threats, standardization of post-quantum cryptography (PQC) algorithms has been carried out, and research on quantum-resistant cryptography system migration (PQC Migration) is underway.

[0004] In order to prepare for the transition to quantum-resistant encryption systems, it is essential to understand the current state of encryption technologies in use. Furthermore, it is expected that continuous monitoring of the current state of encryption technologies will be required to confirm the completion of the transition and to respond to future changes in encryption technologies.

[0005] In the past, to understand the current state of encryption usage applied to IT systems, the current state of encryption technology was understood from the perspective of the operating environment, including analysis of the versions of encryption modules included in the IT system, analysis of provided encryption protocols, and analysis of certificate files.

[0006] However, understanding the encryption status from an operational environment perspective has limitations in that the scope of what can be understood is limited or subject to change depending on the settings of the IT system or the tasks being performed.

[0007] Accordingly, since standardization research on the data format of Cryptography Bill-of-Materials (CBOM), which extends Software Bill-of-Materials (SBOM), is currently being conducted on the supplier side, it is necessary to secure technology for creating and consuming CBOM-related formats.

[0008] Meanwhile, encryption modules are generally composed of APIs that provide multiple types of encryption algorithms, so simply referencing a module has limitations in identifying the encryption functions actually being used.

[0009] In addition, the encryption API is provided in a form that receives and performs arguments for encryption operations, and the argument values ​​can be managed through source code, configuration files, environment variables, external storage, etc., so IT system suppliers also have difficulty understanding and systematically managing the encryption operations being performed.

[0010] Therefore, a technology capable of automatically identifying the implementation status of cryptographic APIs in IT systems is needed. Furthermore, even in cases where automatic identification of cryptographic API implementation is not possible, reference information needs to be provided to developers and operators.

[0011] The technical problem that the present disclosure seeks to solve is to provide a Cryptography Bill-of-Materials (CBOM) generation method capable of providing a CBOM in a standardized format by utilizing the cryptographic usage status automatically identified through analysis of software development output, and a system for implementing the same.

[0012] Another technical problem that the present disclosure seeks to solve is to provide a CBOM generation method that enables application when generating a CBOM by providing reference information about encryption functions that are not automatically identified through analysis of software development outputs to developers or operators, and a system for implementing the same.

[0013] Another technical challenge that the present disclosure seeks to address is to provide a CBOM generation method capable of providing a function of verifying a CBOM by comparing the CBOM generated in a software development environment with the cryptographic usage status identified in an operating environment in which the software is executed, and a system for implementing the same.

[0014] The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art of the present disclosure from the description below.

[0015] In order to solve the above technical problem, a method for generating a CBOM performed by a computing system according to an embodiment of the present disclosure includes a step of acquiring information on a cryptographic asset automatically identified through analysis of a software development output, a step of generating a report on an unidentified cryptographic asset if there is an unidentified cryptographic asset that is not automatically identified through analysis of the development output, and a step of generating a CBOM (Cryptography Bill-of-Materials) using information on the automatically identified cryptographic asset and additional information on the unidentified cryptographic asset inserted into a source code.

[0016] As one embodiment, the step of obtaining information about the automatically identified cryptographic asset may include the step of receiving information about additional parameters from an external source, and the step of identifying information about the cryptographic asset from the development output using the information about the additional parameters.

[0017] As one embodiment, the step of obtaining information on the automatically identified cryptographic asset may include a step of obtaining information on the cryptographic asset as a result of performing at least one of rule-based analysis and LLM (Large Language Model)-based analysis using the development output and the additional parameter as input data.

[0018] In one embodiment, the step of generating a report on the unidentified cryptographic asset may include the step of generating a report including the path of the source code for the unidentified cryptographic asset, line information within the source code, and the name of the API used.

[0019] As an example, the step of generating the Cryptography Bill-of-Materials (CBOM) may include the step of identifying an annotation for the unidentified cryptographic asset inserted into the source code.

[0020] As one embodiment, the step of generating the Cryptography Bill-of-Materials (CBOM) may include the step of automatically generating recommended additional information for the unidentified cryptographic asset using the generated report, the step of providing the recommended additional information to a user terminal, and the step of automatically inserting the recommended additional information into the source code when receiving an input from the user terminal to accept the recommended additional information.

[0021] As one embodiment, the method may further include a step of performing verification on the generated CBOM.

[0022] As one embodiment, the step of performing verification on the generated CBOM may include the step of obtaining information on an automatically identified execution cryptographic asset through analysis of execution data of the development output, and the step of outputting a comparison result of the information on the automatically identified execution cryptographic asset and the CBOM.

[0023] In one embodiment, the step of outputting the information on the automatically identified execution cryptographic asset and the comparison result of the CBOM may include the steps of generating first information on a matching item included in the execution cryptographic asset among a plurality of items included in the CBOM, generating second information on a missing item not included in the execution cryptographic asset among a plurality of items included in the CBOM, generating third information on a new item included only in the execution cryptographic asset but not among the plurality of items included in the CBOM, and outputting a verification result report including at least one of the first information, the second information, and the third information.

[0024] As one embodiment, the step of performing verification on the generated CBOM may include a step of generating a verification result on the CBOM as a result of performing at least one of rule-based analysis and LLM-based analysis using execution data of the development output and the generated CBOM as input data.

[0025] As one embodiment, the method may further include a step of updating the CBOM using the result of performing verification on the CBOM.

[0026] As an example, the step of updating the CBOM using the result of performing verification on the CBOM may include the step of automatically generating a recommended annotation using the result of performing the verification, and the step of automatically inserting the recommended annotation into the source code.

[0027] In order to solve the above technical problem, a method for generating a CBOM performed by a user terminal according to an embodiment of the present disclosure includes a step of outputting a report including information on an unidentified cryptographic asset that has not been automatically identified through analysis of a development output of software, a step of displaying an input window that induces input of additional information on the unidentified cryptographic asset, and a step of inserting the additional information on the unidentified cryptographic asset into a source code of the software according to a user input through the input window.

[0028] In one embodiment, the step of outputting a report including information about the unidentified cryptographic asset to a screen may include a step of receiving a report including information about the unidentified cryptographic asset from a server, and further include a step of providing the source code with the additional information inserted to the server after the step of inserting the additional information, wherein the additional information is information used by the server to generate a CBOM.

[0029] In order to solve the above technical problem, a CBOM generation system according to one embodiment of the present disclosure includes one or more processors, a memory for loading a computer program to be executed by the processors, and a storage for storing the computer program, wherein the computer program includes instructions for performing an operation of acquiring information on a cryptographic asset automatically identified through analysis of a software development output, an operation of generating a report on an unidentified cryptographic asset when an unidentified cryptographic asset that has not been automatically identified through analysis of the development output exists, and an operation of generating a CBOM (Cryptography Bill-of-Materials) using the information on the automatically identified cryptographic asset and additional information on the unidentified cryptographic asset inserted into a source code.

[0030] As one embodiment, the operation of obtaining information about the automatically identified cryptographic asset may include the steps of receiving information about additional parameters from an external source, and using the information about the additional parameters to identify information about the cryptographic asset from the development output.

[0031] As one embodiment, the operation of generating a report regarding the unidentified cryptographic asset may include an operation of generating a report including the path of the source code for the unidentified cryptographic asset, line information within the source code, and the name of the API used.

[0032] As an example, the act of generating the Cryptography Bill-of-Materials (CBOM) may include the act of identifying an annotation for the unidentified cryptographic asset inserted into the source code.

[0033] As one embodiment, the computer program may further include instructions for performing an operation of performing verification on the generated CBOM.

[0034] As an example, the operation of performing verification on the generated CBOM may include a step of obtaining information on an automatically identified execution cryptographic asset through analysis of execution data of the development output, and an operation of outputting a comparison result of the information on the automatically identified execution cryptographic asset and the CBOM.

[0035] FIG. 1 illustrates the configuration of a CBOM generation system according to an embodiment of the present disclosure.

[0036] FIG. 2 is a flowchart illustrating a CBOM generation method according to one embodiment of the present disclosure.

[0037] Figure 3 is a flowchart for explaining additional steps performed after the steps illustrated in Figure 2.

[0038] FIG. 4 is a flowchart illustrating a method performed by a user terminal according to another embodiment of the present disclosure.

[0039] FIG. 5 is a flowchart illustrating a CBOM generation method according to another embodiment of the present disclosure.

[0040] FIG. 6 is a flowchart illustrating a CBOM generation method according to another embodiment of the present disclosure.

[0041] FIG. 7 is an example illustrating a system configuration including an analyzer and a validator according to some embodiments of the present disclosure.

[0042] FIG. 8 is an example of automatically identifiable source code according to some embodiments of the present disclosure.

[0043] FIG. 9 is an example of an automatically identifiable settings file according to some embodiments of the present disclosure.

[0044] FIG. 10 is an example of automatically identifiable source code when applying the output results of a validator according to some embodiments of the present disclosure.

[0045] Figure 11 is an example of the output result of a validator that can be applied to Figure 10.

[0046] FIG. 12 is an example of source code that requires annotation writing according to some embodiments of the present disclosure.

[0047] Figure 13 is an example of the report output required for writing the annotation of Figure 12.

[0048] Figure 14 is an example of annotations written at the statement level in the source code of Figure 12.

[0049] Figure 15 is an example of annotations written at the method level in the source code of Figure 12.

[0050] Figure 16 is an example of annotations written at the class level in the source code of Figure 12.

[0051] FIG. 17 is an example of annotations written in a settings file according to some embodiments of the present disclosure.

[0052] FIG. 18 is an example of a CBOM format output by an analyzer according to some embodiments of the present disclosure.

[0053] FIG. 19 is an example of output of a matching item output by a validator according to some embodiments of the present disclosure.

[0054] FIG. 20 is an example of output of missing items output by a validator according to some embodiments of the present disclosure.

[0055] FIG. 21 is an example of output of a new item output by a validator according to some embodiments of the present disclosure.

[0056] FIG. 22 is an example of output for feedback purposes to an analyzer output by a validator according to some embodiments of the present disclosure.

[0057] FIG. 23 is a hardware configuration diagram of an exemplary computing system capable of implementing methods according to one embodiment of the present disclosure.

[0058] Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the attached drawings. The advantages and features of the present disclosure, and methods for achieving them, will become clear with reference to the embodiments described in detail below together with the attached drawings. However, the technical idea of ​​the present disclosure is not limited to the following embodiments and may be implemented in various different forms. The following embodiments are provided only to complete the technical idea of ​​the present disclosure and to fully inform those skilled in the art of the present disclosure of the scope of the present disclosure, and the technical idea of ​​the present disclosure is defined only by the scope of the claims.

[0059] When assigning reference numerals to components in each drawing, it should be noted that identical components are assigned the same numerals whenever possible, even if they appear on different drawings. Furthermore, when describing the present disclosure, if a detailed description of a related known configuration or function is deemed likely to obscure the gist of the present disclosure, such detailed description will be omitted.

[0060] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in the same sense as commonly understood by those of ordinary skill in the art to which this disclosure pertains. Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise. The terminology used herein is for the purpose of describing embodiments and is not intended to limit the disclosure. In this specification, singular forms also include plural forms, unless specifically stated otherwise.

[0061] Additionally, terms such as first, second, A, B, (a), (b), etc. may be used to describe components of the present disclosure. These terms are only intended to distinguish the components from other components, and the nature, order, or sequence of the components are not limited by the terms. When a component is described as being "connected," "coupled," or "connected" to another component, it should be understood that the component may be directly connected or connected to the other component, but another component may also be "connected," "coupled," or "connected" between each component.

[0062] The terms "comprises" and / or "comprising" as used in the specification do not exclude the presence or addition of one or more other components, steps, operations and / or elements.

[0063] Hereinafter, some embodiments of the present disclosure will be described in detail with reference to the attached drawings.

[0064] FIG. 1 illustrates the configuration of a CBOM generation system according to an embodiment of the present disclosure.

[0065] Referring to FIG. 1, a CBOM generation system (1) according to an embodiment of the present disclosure includes a development server (11) and an operation server (12) as devices for performing development and operation of a software product, and the development server (11) and the operation server (12) are interconnected via a network.

[0066] The development server (11) is connected to the developer's first terminal (2) via a network and can manage development outputs such as source codes written and uploaded by the developer of the first terminal (2) during the software development process. In addition, the development server (11) can perform tasks such as testing and debugging on the development outputs.

[0067] Meanwhile, the operating server (12) is connected to the operator's second terminal (3) via a network, and can execute or test a software product distributed by the development server (11) at the request of the second terminal (3). Here, the operating server (12) can also execute and test software products at the request of terminals of developers, testers, or general customers, in addition to the operator.

[0068] In the illustrated configuration, the development server (11) and the operation server (12) are provided in a separate form, but are not necessarily limited to this form, and according to various embodiments, the development server (11) and the operation server (12) may be provided in a form implemented in a single device.

[0069] In the CBOM generation system (1) according to the embodiment of the present disclosure, the development server (11) includes an analysis module (110), and the operation server (12) includes a verification module (120). Here, the analysis module (110) and the verification module (120) may be agents running within an IDE (Integrated Development Environment) or separate processes running outside the IDE.

[0070] The analysis module (110) can automatically identify cryptographic assets contained in software development outputs through analysis of the development outputs. Here, the development outputs may include, in addition to source code, libraries, system configuration files, and database configuration files.

[0071] Cryptographic assets refer to multiple cryptographic parameters that are argument values ​​for cryptographic APIs. These argument values ​​are managed through sources such as source code, configuration files, environment variables, and external storage. However, if the arguments for cryptographic APIs are processed as variables and then managed externally, such as in configuration files, it is difficult to identify them through source code analysis.

[0072] The analysis module (110) can perform static application security testing (SAST) to analyze software development output. At this time, tools for performing static application security testing (SAST) may include, for example, source code syntax analysis technology, source code vulnerability analysis technology, binary format analysis technology for executable files / libraries, and text format analysis technology for configuration file analysis.

[0073] Accordingly, the analysis module (110) can obtain automatically identified cryptographic assets by performing analysis using static application security testing (SAST) on the development output.

[0074] Meanwhile, if there are unidentified cryptographic assets that are not identified through such analysis, the analysis module (110) can generate information on the unidentified cryptographic assets in the form of a report and provide it to the developer's first terminal (2). In this case, the developer of the first terminal (2) can create annotations, which are additional information on the unidentified cryptographic assets, within the source code by referring to the report on the unidentified cryptographic assets provided from the analysis module (110) of the development server (11).

[0075] Accordingly, the development output includes both automatically identifiable cryptographic assets and additional information (e.g., annotations) written by the developer with reference to the report, and at this time, the analysis module (110) can generate a Cryptography Bill-of-Materials (CBOM) (111) that includes both information on automatically identified cryptographic assets and additional information on unidentified cryptographic assets through analysis of the development output.

[0076] The verification module (120) receives the CBOM (111) generated by the analysis module (110) as input data.

[0077] Additionally, the verification module (120) can automatically obtain identified cryptographic assets by analyzing the execution data of development outputs executed at the request of the operator's second terminal (3) on the operation server (12). The execution data may include, for example, execution processes, execution environment settings, network packets, etc.

[0078] Hereinafter, the cryptographic asset automatically identified in the verification module (120) will be referred to as an ‘execution cryptographic asset’ to distinguish it from the cryptographic asset identified in the analysis module (120).

[0079] The verification module (120) can perform dynamic application security testing (DAST) to analyze execution data of development outputs. At this time, tools for performing dynamic application security testing (DAST) may include, for example, Byte Code Instrumentation (BCI) for execution process analysis, API Hooking, memory analysis technology such as memory dump, analysis technology for environment variables of the execution environment (OS, JVM, interpreter, etc.), and security protocol identification technology through network packet analysis.

[0080] Accordingly, the verification module (120) can obtain automatically identified execution cryptographic assets by performing analysis using dynamic application security testing (DAST) on the execution data of the development output.

[0081] The verification module (120) can perform a verification operation to compare the CBOM provided from the analysis module (110) with the execution cryptographic asset automatically identified through analysis of the execution data.

[0082] For example, the verification module (120) may output items included in the CBOM that are also included in the execution encryption asset as matching items, and output items not included in the execution encryption asset as missing items. In addition, the verification module (120) may output items that are not included in the CBOM but are only included in the execution encryption asset as new items.

[0083] The verification module (120) can output verification result information (121) including the results of comparing the CBOM and the automatically identified execution cryptographic asset as described above.

[0084] Additionally, the verification module (120) may provide verification result information (121) as feedback information to the analysis module (110). In this case, the analysis module (110) may update the previously created CBOM (111) by applying the feedback information provided from the verification module (120) to the development output.

[0085] According to the configuration of the system according to the present disclosure as described above, when generating a CBOM that provides encryption usage status, it is possible to provide visibility into the used encryption technology regardless of the form of application of the encryption API by including not only information on cryptographic assets automatically identified through analysis of software development output, but also additional information on cryptographic assets that are not automatically identified.

[0086] Additionally, even after generating a CBOM, it is possible to generate a CBOM that contains accurate information about the cryptographic technology used through comparison verification with cryptographic assets automatically identified in the operating environment.

[0087] FIG. 2 and FIG. 3 are flowcharts for explaining a CBOM generation method according to one embodiment of the present disclosure.

[0088] The CBOM generation method according to an embodiment of the present disclosure can be executed by the CBOM generation system (1) illustrated in FIG. 1 or the computing system (100) illustrated in FIG. 25. The computing system (100) executing the method according to the present embodiment may be a computing device equipped with an application program execution environment. The computing system (100) may be composed of at least one device capable of performing a computational function, such as a PC or a server.

[0089] It should be noted that the description of the subject performing some operations included in the method according to the embodiment of the present disclosure may be omitted, and in such a case, the subject is the computing system (100).

[0090] First, referring to FIG. 2, in operation S10, the computing system (100) obtains information on a cryptographic asset automatically identified through analysis of the development output of the software.

[0091] Here, development artifacts may include, for example, source code, libraries, system configuration files, and database configuration files. Cryptographic assets refer to multiple cryptographic parameters that are argument values ​​for an encryption API, and the argument values ​​may be managed through, for example, source code, configuration files, environment variables, and external storage.

[0092] Next, in operation S15, the computing system (100) automatically determines whether an unidentified cryptographic asset exists.

[0093] If, as a result of performing operation S15, an unidentified cryptographic asset that has not been automatically identified exists, in operation S20, the computing system (100) generates a report regarding the unidentified cryptographic asset. Here, the report may include, for example, the path of the source code for the unidentified cryptographic asset, line information within the source code, and the name of the API used.

[0094] Next, in operation S30, the computing system (100) can generate a CBOM using information about automatically identified cryptographic assets and additional information about unidentified cryptographic assets.

[0095] Here, additional information may include annotations or comments regarding unidentified cryptographic assets inserted into development outputs such as source code.

[0096] For example, such additional information can be directly written into development artifacts, such as source code, by a developer or user referencing a report generated in operation S20. In this case, the computing system (100) can identify annotations for unidentified cryptographic assets inserted into source code, etc., through analysis of the development artifacts.

[0097] As another example, the computing system (100) may automatically generate additional recommended information for unidentified cryptographic assets using the generated report and provide it to the developer's first terminal (2). Upon receiving an input from the first terminal (2) accepting the additional recommended information, the computing system (100) may automatically insert the additional recommended information (e.g., annotation) into the source code. In this case, the computing system (100) may identify the additional recommended information automatically inserted into the source code, etc.

[0098] If, as a result of performing operation S15, there are no automatically identified unidentified cryptographic assets, in operation S31, the computing system (100) can create a CBOM using only information about automatically identified cryptographic assets.

[0099] Next, referring to FIG. 3, the computing system (100) performs a verification task on the CBOM generated in operation S30 or operation S31 in operations S40 to S60.

[0100] In operation S40, the computing system (100) obtains information on automatically identified execution cryptographic assets through analysis of execution data of development outputs.

[0101] Next, in operation S50, the computing system (100) automatically generates and outputs the result of comparing information about the identified execution cryptographic asset with the CBOM generated in operation S30 or operation S31.

[0102] For example, the computing system (100) may generate first information regarding matching items included in the execution cryptographic asset among the plurality of items included in the CBOM, and second information regarding missing items not included in the execution cryptographic asset. In addition, the computing system (100) may generate third information regarding new items included only in the execution cryptographic asset but not among the plurality of items included in the CBOM. Accordingly, the computing system (100) may output a verification result report including at least one of the first information, the second information, and the third information.

[0103] Finally, in operation S60, the computing system (100) updates the CBOM using the comparison result generated in operation S50.

[0104] For example, the computing system (100) can automatically generate recommended annotations using the generated comparison results and automatically insert the generated recommended annotations into the source code. Here, the recommended annotations can include information about new items of cryptographic assets included in the comparison results.

[0105] Accordingly, the computing system (100) can obtain information on new items of cryptographic assets by identifying newly inserted recommended annotations through analysis of the source code, and can update the CBOM by adding information on the new items to the previously created CBOM.

[0106] FIG. 4 is a flowchart illustrating a method performed by a user terminal according to another embodiment of the present disclosure.

[0107] The CBOM generation method according to an embodiment of the present disclosure can be executed by the developer's first terminal (2) (hereinafter referred to as "user terminal (2)") illustrated in FIG. 1. The user terminal (2) executing the method according to the present embodiment may be a computing device equipped with an application program execution environment. The user terminal (2) may be configured with at least one device capable of performing a computing function, such as a PC, a mobile phone, a tablet, or a laptop.

[0108] A user terminal (2) may include one or more processors, a memory for loading a computer program executed by the processors, a display for displaying information, and storage for storing the computer programs. In this case, the computer program may include instructions for performing operations S1 to S3 described below.

[0109] First, referring to FIG. 4, in operation S1, the user terminal (2) outputs a report on the screen that includes information on unidentified cryptographic assets that have not been automatically identified through analysis of the development output of the software.

[0110] Next, in operation S2, the user terminal (2) displays an input window that prompts the user to input additional information about the unidentified cryptographic asset.

[0111] Finally, in operation S3, the user terminal (2) inserts additional information about the unidentified cryptographic asset into the development output such as source code according to user input through the input window.

[0112] As an example, a user terminal (2) can receive a report including information about an unidentified cryptographic asset from the development server (11) of FIG. 1.

[0113] At this time, the user of the user terminal (2) can insert additional information about the unidentified cryptographic asset into the source code through the input window by referring to the information about the unidentified cryptographic asset included in the received report.

[0114] Accordingly, the user terminal (20) can transmit the source code with the additional information inserted to the analysis module (110) of the development server (11) so that the analysis module (110) of the development server (11) can identify the additional information inserted in the source code and generate a CBOM.

[0115] As described above, according to the method performed by a user terminal according to an embodiment of the present disclosure, when information on cryptographic assets not automatically identified in a development environment is provided to the user terminal in the form of a report, the user terminal can be prompted to create additional information about the source code by referencing the report. Accordingly, a CBOM can be created that includes not only information on automatically identified cryptographic assets, but also additional information created by the user for cryptographic assets not automatically identified.

[0116] Hereinafter, FIGS. 5 and 6 will describe a CBOM generation method according to another embodiment of the present disclosure.

[0117] The CBOM generation method according to the embodiment of the present disclosure can be executed by the CBOM generation system (1) illustrated in FIG. 1 or the computing system (100) illustrated in FIG. 25.

[0118] First, referring to FIG. 5, in operation S100, the computing system (100) generates a CBOM using information on a cryptographic asset automatically identified through analysis of a software development output.

[0119] At this time, Static Application Security Testing (SAST) can be performed to analyze development output. For example, SAST can utilize techniques such as source code parsing, source code vulnerability analysis, binary format analysis for executables / libraries, and text format analysis for configuration files.

[0120] As an example, the computing system (100) may generate a report on unidentified cryptographic assets that are not automatically identified through analysis of development output, and may also initially update the generated CBOM using additional information on unidentified cryptographic assets inserted into the source code.

[0121] Next, in operation S200, the computing system (100) determines whether to perform a second update of the CBOM based on the result of comparing the CBOM generated in operation S100 with information on the execution cryptographic asset automatically identified through analysis of the execution data of the development output.

[0122] At this time, Dynamic Application Security Testing (DAST) can be performed to analyze execution data. For example, DAST can utilize BCI (Blockchain Interaction Interface), API Hooking, memory analysis, analysis of execution environment variables, and security protocol identification through network packet analysis.

[0123] As an example, as a result of the comparison in operation S200, information on matching items that are identically included in the automatically identified execution encryption asset among the plurality of encryption items included in the CBOM, missing items that are not included, or new items that are included only in the execution encryption asset can be generated and output in the form of a verification result report.

[0124] At this time, the computing system (100) can automatically generate recommended additional information for new and missing items using the output verification result report and insert it into the source code. Accordingly, the computing system (100) can identify the additional information inserted into the source code and perform a secondary update on the previously generated CBOM.

[0125] Meanwhile, if there are no new or missing items in the verification result report and only matching items exist, no secondary update to the CBOM will be performed.

[0126] As another embodiment, referring to FIG. 6, first, in operation S1000, the computing system (100) obtains information on automatically identified cryptographic assets through analysis of the development output of software.

[0127] Next, in operation S2000, the computing system (100) obtains comparison information by comparing the information on the cryptographic asset automatically identified through operation S1000 with the information on the execution cryptographic asset automatically identified through analysis of the execution data of the development output. Here, the comparison information may include information on matching items, missing items, and new items, similar to the embodiment described above in FIG. 5.

[0128] Next, in operation S3000, the computing system (100) may generate a CBOM using information about automatically identified cryptographic assets and the comparison information. For example, the CBOM may be generated by adding new items included in the comparison information and excluding missing items from the information about automatically identified cryptographic assets.

[0129] At this time, after performing operation S3000, the computing system (100) may further perform an operation of identifying additional information inserted into the source code using unidentified cryptographic assets that have not been automatically identified through analysis of the development output, and updating the CBOM generated in operation S3000 using the identified additional information.

[0130] FIG. 7 is an example illustrating a system configuration including an analyzer and a validator according to some embodiments of the present disclosure.

[0131] In the illustrated configuration, the CBOM generation system is composed of a development device (31) and an operating device (41), where the development device (31) corresponds to the development server (11) of FIG. 1 described above, and the operating device (41) corresponds to the operating server (12) of FIG. 1.

[0132] The development device (31) stores and manages development outputs of software products developed by developers. For example, the development outputs managed by the development device (31) may include source code (311), an encryption library (311), an external library (312), and a configuration file (314).

[0133] The development device (31) includes a configuration of a Cryptography Parameter Analyzer (32) (hereinafter referred to as an analyzer (32)) capable of analyzing cryptographic assets applied to the development output. Here, the analyzer (32) corresponds to the analysis module (110) of FIG. 1 described above.

[0134] The operating device (41) operates and manages the execution data of the development output distributed by the development device (31). For example, the execution data managed by the operating device (41) may include an execution file (411) in binary format, an encryption library (412), a configuration file (413), system settings (414), and runtime parameters (410).

[0135] The operating device (41) includes a configuration of a Cryptography Parameter Validator (42) (hereinafter referred to as a validator (42)) capable of verifying a CBOM by comparing the cryptographic asset applied to the execution data with the CBOM generated by the development device (31). Here, the validator (42) corresponds to the verification module (120) of FIG. 1 described above.

[0136] First, the analyzer (32) performs an analysis to identify cryptographic assets using the development outputs, namely source code (311), an encryption library (311), an external library (312), and a configuration file (314), as input data. At this time, the analyzer (32) may perform, for example, static application security testing (SAST) to identify cryptographic assets.

[0137] Accordingly, the analyzer (32) can obtain information on automatically identified cryptographic assets through analysis of development outputs such as source code (311). Here, the cryptographic assets may include, for example, argument values ​​of an encryption API and items to which an encryption function is applied.

[0138] As an example, Figure 8 shows an example of source code that enables automatic identification of arguments of an encryption API. In the source code illustrated in Figure 8, arguments for the encryption API are explicitly set (e.g., "RSA" in line 3, 512 in line 4, and "SHA256withRSA" in line 10).

[0139] That is, if the argument of the encryption API is set in the source code as in Fig. 8, it can be automatically identified through analysis.

[0140] As another example, Figure 9 illustrates an example of a configuration file capable of automatically identifying encrypted items. The configuration file illustrated in Figure 9 can include well-known encryption items or encryption items added by the user as needed.

[0141] That is, as shown in Fig. 9, if an encryption item is set in the settings file, it can be automatically identified through analysis.

[0142] As an example, the analyzer (32) may use the verification result output from the validator (42) as input data. For example, the validator (42) may analyze the execution data of the development artifact, compare the automatically identified execution cryptographic assets with the CBOM generated by the analyzer (32), and output information about identically matching items, newly discovered new items, and missing items as the verification result (43).

[0143] Fig. 11 is an example of a verification result (43) output by a validator (42) that only includes information on new items. Fig. 10 is an example of source code that can be automatically identified when utilizing the output result of Fig. 11. That is, the analyzer (32) can identify information on new items input as additional information in the source code of Fig. 10 by using the output result of Fig. 11 as input data. For example, the additional information may be annotations or comments that a developer or user directly writes in the source code with reference to the output result of the validator (42) of Fig. 11. As another example, the additional information may be a recommended annotation or recommended comment that is automatically inserted in the source code by utilizing the output result of the validator (42) of Fig. 11.

[0144] As an example, the analyzer (32) may receive information about additional parameters (315) from the outside in addition to the input data. In this case, the additional parameters (315) may include information about, for example, an API list, a property list, a parameter DB, etc.

[0145] The analyzer (32) can identify information about cryptographic assets from development outputs using information about additional parameters (315) received from the outside.

[0146] As an example, the analyzer (32) can obtain information on a cryptographic asset as a result of performing at least one of rule-based analysis and LLM (Large Language Model)-based analysis using development outputs such as source code (311) and additional parameters (315) as input data.

[0147] For example, when LLM-based analysis is performed, the analyzer (32) can generate an AI model through learning using large-scale past data for additional parameters, and input the development output and additional parameters into the AI ​​model to obtain information on automatically identified cryptographic assets as output results.

[0148] Meanwhile, the analyzer (32) can output a report if there are unidentified cryptographic assets that are not automatically identified through analysis of development output.

[0149] For example, FIG. 12 illustrates an example of source code in which cryptographic assets are not automatically identified, and FIG. 13 illustrates an example of a report output that includes information about APIs that were not automatically identified through analysis of the source code of FIG. 12. As illustrated in FIG. 13, the report may include information about the APIs that were not automatically identified, such as the file name, line within the file, and API name.

[0150] As an example, when the analyzer (32) outputs a report on unidentified cryptographic assets as in FIG. 13, the developer can refer to this and write additional information on the unidentified cryptographic assets in the development output (source code (311), encryption library (311), external library (312), and configuration file (314)). At this time, the additional information may be, for example, annotations or comments.

[0151] As an example, the example illustrated in FIG. 14 shows a case where a developer inserted a statement level annotation into the source code, referring to a report on unidentified cryptographic assets output by the analyzer (32).

[0152] The example illustrated in FIG. 15 shows a case where a developer has inserted a method level annotation into the source code, referring to a report on unidentified cryptographic assets output by the analyzer (32).

[0153] Additionally, the example illustrated in FIG. 16 shows a case where a developer inserted a class level annotation into the source code, referring to a report on unidentified cryptographic assets output by the analyzer (32).

[0154] Additionally, the example illustrated in FIG. 17 shows a case where a developer inserted an annotation (configuration level annotation) into a configuration file by referring to a report on unidentified cryptographic assets output by the analyzer (32).

[0155] The analyzer (32) generates a CBOM (33) including information on automatically identified cryptographic assets in FIGS. 8 to 10 and information identified from additional information on unidentified cryptographic assets inserted into development outputs in FIGS. 14 to 17, and can output the CBOM (33) in a standardized form, as shown in FIG. 18.

[0156] Meanwhile, the validator (42) performs an analysis to identify an executable encryption asset using as input data an executable file (411) in binary format, which is the execution data of the development output distributed by the development device (31), an encryption library (412), a configuration file (413), system settings (414), and runtime parameters (410). At this time, the validator (42) can perform, for example, dynamic application security testing (DAST) as an analysis to identify an executable encryption asset.

[0157] That is, the validator (42) can obtain information on automatically identified execution encryption assets through analysis of execution data such as binary format executable files (411). Here, the execution encryption assets may include, for example, argument values ​​of an encryption API and items to which an encryption function is applied.

[0158] Additionally, the validator (42) can receive the CBOM (33) generated by the analyzer (32) as input data.

[0159] Accordingly, the validator (42) can compare information about the automatically identified execution cryptographic assets with the multiple cryptographic items included in the CBOM (33).

[0160] As an example, the validator (42) may generate and output information about a matching item among multiple items included in the CBOM (33) that is identically included in the execution cryptographic asset. As an example, referring to FIG. 19, the validator (42) may output information about the matching item "SHA512withRSA."

[0161] Additionally, the validator (42) can generate and output information on missing items not included in the execution cryptographic asset among the multiple items included in the CBOM (33). As an example, referring to FIG. 20, the validator (42) can output information on the missing item "Dillithium5."

[0162] Additionally, the validator (42) can generate and output information about a new item that is not included in the multiple items included in the CBOM (33) but is included only in the execution cryptographic asset. For example, referring to FIG. 21, the validator (42) can output information about the new item "AES-128-GCM."

[0163] Accordingly, the validator (42) can output a verification result (43) including information on at least one of a matching item, a missing item, and a new item, as illustrated in FIG. 22. The verification result (43) output in this manner can be provided as feedback information for the analyzer (32). At this time, the analyzer (32) can automatically insert additional information using the verification result into a development output such as source code (311) using the verification result provided from the validator (42).

[0164] As described above, according to the embodiments of the present disclosure, a standardized CBOM can be provided using encryption usage data automatically identified through analysis of software development output. Furthermore, for encryption functions not automatically identified, a report can be provided to developers or operators, ensuring that such information is included when generating the CBOM.

[0165] In addition, according to an embodiment of the present disclosure, a function for verifying a CBOM can be provided by comparing a CBOM generated in a software development environment with an encryption usage status identified in an operating environment in which the software is executed.

[0166] FIG. 23 is a hardware configuration diagram of an exemplary computing system that can implement methods according to some embodiments of the present invention. As illustrated in FIG. 23, the computing system (100) may include one or more processors (101), a bus (107), a network interface (102), a memory (103) for loading a computer program (105) executed by the processor (101), and a storage (104) for storing the computer program (105). However, FIG. 23 only illustrates components related to embodiments of the present invention. Therefore, those skilled in the art will appreciate that other general components may be included in addition to the components illustrated in FIG. 23.

[0167] The processor (101) controls the overall operation of each component of the computing system (100). The processor (101) may be configured to include at least one of a CPU (Central Processing Unit), an MPU (Micro Processor Unit), an MCU (Micro Controller Unit), a GPU (Graphics Processing Unit), or any other type of processor well known in the art of the present invention. In addition, the processor (101) may perform operations for at least one application or program for executing methods / operations according to various embodiments of the present invention. The computing system (100) may include one or more processors.

[0168] The memory (103) stores various data, commands, and / or information. The memory (103) can load one or more programs (105) from the storage (104) to execute methods / operations according to various embodiments of the present invention. For example, when a computer program (105) is loaded into the memory (103), logic (or modules) can be implemented on the memory (103). An example of the memory (103) may be, but is not limited to, RAM.

[0169] The bus (107) provides a communication function between components of the computing system (100). The bus (107) can be implemented as various types of buses, such as an address bus, a data bus, and a control bus.

[0170] The network interface (102) supports wired and wireless Internet communication of the computing system (100). The network interface (102) may also support various communication methods other than Internet communication. To this end, the network interface (102) may be configured to include a communication module well known in the technical field of the present invention.

[0171] Storage (104) can non-temporarily store one or more computer programs (105). Storage (104) can be configured to include non-volatile memory such as flash memory, a hard disk, a removable disk, or any form of computer-readable recording medium well known in the art to which the present invention pertains.

[0172] The computer program (105) may include one or more instructions implementing methods / operations according to various embodiments of the present invention. When the computer program (105) is loaded into the memory (103), the processor (101) may execute the one or more instructions to perform the methods / operations according to various embodiments of the present invention.

[0173] In some embodiments, the computing system (100) described with reference to FIG. 25 may be configured using one or more physical servers included in a server farm based on cloud technologies such as virtual machines. In this case, at least some of the components illustrated in FIG. 25, such as the processor (101), memory (103), and storage (104), may be virtual hardware, and the network interface (102) may also be configured as a virtualized networking element such as a virtual switch.

[0174] As one embodiment, the computer program (105) may include instructions for performing an operation of obtaining information on a cryptographic asset automatically identified through analysis of a development output of software, an operation of generating a report on an unidentified cryptographic asset if there is an unidentified cryptographic asset that has not been automatically identified through analysis of the development output, and an operation of generating a CBOM using information on the automatically identified cryptographic asset and additional information on the unidentified cryptographic asset inserted into the source code.

[0175] Various embodiments of the present invention and the effects thereof have been described with reference to FIGS. 1 through 23. The effects of the technical concept of the present invention are not limited to the effects described above, and other effects not mentioned will be readily apparent to those skilled in the art from the description below.

[0176] The technical idea of ​​the present invention described so far can be implemented as a computer-readable code on a computer-readable medium. The computer-readable recording medium can be, for example, a removable recording medium (CD, DVD, Blu-ray disc, USB storage device, removable hard disk) or a fixed recording medium (ROM, RAM, computer-attached hard disk). The computer program recorded on the computer-readable recording medium can be transmitted to another computing device via a network such as the Internet and installed on the other computing device, thereby allowing it to be used on the other computing device.

[0177] Although all components constituting the embodiments of the present invention have been described as being combined or operated in conjunction with one another, the technical concept of the present invention is not necessarily limited to these embodiments. That is, within the scope of the present invention, all components may be selectively combined and operated one or more times.

[0178] Although operations are depicted in the drawings in a particular order, this should not be understood to imply that the operations must be performed in the particular order depicted, or in any sequential order, or that all depicted operations must be performed to achieve the desired results. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various components in the embodiments described above should not be understood to imply that such separation is absolutely necessary, and it should be understood that the program components and systems described may generally be integrated together into a single software product or packaged into multiple software products.

[0179] Although the embodiments of the present invention have been described with reference to the attached drawings, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical concept or essential characteristics thereof. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included within the scope of the technical ideas defined by the present invention.

Claims

1. In a method performed by a computing system, A step of obtaining information on automatically identified cryptographic assets through analysis of software development output; A step of generating a report on unidentified cryptographic assets, if any unidentified cryptographic assets exist that have not been automatically identified through analysis of the above development output; and A step of generating a Cryptography Bill-of-Materials (CBOM) using information about the automatically identified cryptographic asset and additional information about the unidentified cryptographic asset inserted into the source code, How to create a CBOM.

2. In paragraph 1, The step of obtaining information about the automatically identified cryptographic asset is as follows: A step of receiving information about additional parameters from an external source; and A step of identifying information about the cryptographic asset from the development output using information about the additional parameters, How to create a CBOM.

3. In paragraph 2, The step of obtaining information about the automatically identified cryptographic asset is as follows: A step of obtaining information on the cryptographic asset as a result of performing at least one of rule-based analysis and LLM (Large Language Model)-based analysis using the development output and the additional parameter as input data, How to create a CBOM.

4. In paragraph 1, The step of generating a report on the above unidentified cryptographic assets is as follows: Comprising a step of generating a report including the path of the source code for the above unidentified cryptographic asset, line information within the source code, and the name of the API used. How to create a CBOM.

5. In paragraph 1, The steps for generating the above CBOM (Cryptography Bill-of-Materials) are: A step of identifying an annotation for the unidentified cryptographic asset inserted into the source code, How to create a CBOM.

6. In paragraph 5, The steps for generating the above CBOM (Cryptography Bill-of-Materials) are: A step of automatically generating recommended additional information for the unidentified cryptographic asset using the generated report; A step of providing the above recommended additional information to a user terminal; and When receiving an input for accepting the recommended additional information from the user terminal, a step of automatically inserting the recommended additional information into the source code is included. How to create a CBOM.

7. In paragraph 1, Further comprising a step of performing verification on the generated CBOM, How to create a CBOM.

8. In paragraph 7, The step of performing verification on the above generated CBOM is as follows: A step of obtaining information on automatically identified execution cryptographic assets through analysis of execution data of the above development output; and A step of outputting information about the automatically identified execution cryptographic asset and the comparison result of the CBOM, How to create a CBOM.

9. In paragraph 8, The step of outputting information on the automatically identified execution cryptographic asset and the comparison result of the CBOM is as follows: A step of generating first information about a matching item included in the execution encryption asset among a plurality of items included in the CBOM; A step of generating second information about missing items among the plurality of items included in the CBOM that are not included in the execution encryption asset; A step of generating third information about a new item that is included only in the execution cryptographic asset and does not belong to the multiple items included in the CBOM; and A step of outputting a verification result report including at least one of the first information, the second information, and the third information, How to create a CBOM.

10. In paragraph 7, The step of performing verification on the above generated CBOM is as follows: A step of generating a verification result for the CBOM as a result of performing at least one of rule-based analysis and LLM-based analysis using the execution data of the development output and the generated CBOM as input data, How to create a CBOM.

11. In paragraph 7, Further comprising a step of updating the CBOM using the result of performing verification on the CBOM. How to create a CBOM.

12. In paragraph 11, The step of updating the CBOM using the results of performing verification on the CBOM is as follows: A step of automatically generating recommended annotations using the results of the above verification; and A step of automatically inserting the above recommended annotation into the source code, How to create a CBOM.

13. In a method performed by a user terminal, A step of outputting a report on the screen containing information on unidentified cryptographic assets that have not been automatically identified through analysis of the development output of the software; A step of displaying an input window that prompts for input of additional information about the above unidentified cryptographic asset; and Including a step of inserting the additional information about the unidentified cryptographic asset into the source code of the software according to user input through the input window. How to create a CBOM.

14. In paragraph 13, The step of displaying a report containing information on the above unidentified cryptographic assets on the screen is as follows: A step of receiving a report including information about the above unidentified cryptographic asset from a server, After the step of inserting the above additional information, Further comprising a step of providing the source code with the additional information inserted therein to the server, wherein the additional information is information used by the server to generate a CBOM. How to create a CBOM.

15. One or more processors; A memory that loads a computer program to be executed by the processor; and Including storage for storing the above computer program, The above computer program, An action to obtain information about automatically identified cryptographic assets through analysis of software development output; An operation of generating a report on unidentified cryptographic assets that are not automatically identified through analysis of the above development output, and An instruction for performing an operation of generating a Cryptography Bill-of-Materials (CBOM) using information about the automatically identified cryptographic asset and additional information about the unidentified cryptographic asset inserted into the source code. CBOM generation system.

16. In paragraph 15, The action of obtaining information about the automatically identified cryptographic asset is as follows: The action of receiving information about additional parameters from the outside, and An operation for identifying information about the cryptographic asset from the development output using information about the additional parameters, CBOM generation system.

17. In paragraph 15, The action of generating a report on the above unidentified cryptographic assets is: Including an action to generate a report including the path of the source code for the above unidentified cryptographic asset, line information within the source code, and the name of the API used. CBOM generation system.

18. In paragraph 15, The operation of generating the above CBOM (Cryptography Bill-of-Materials) is: Including an action to identify an annotation for the unidentified cryptographic asset inserted into the source code, CBOM generation system.

19. In paragraph 15, The above computer program, Further comprising an instruction for performing an operation of performing verification on the generated CBOM. CBOM generation system.

20. In paragraph 19, The operation of performing verification on the above generated CBOM is as follows: An operation of obtaining information on automatically identified execution cryptographic assets through analysis of execution data of the above development output, and Including an operation of outputting information about the automatically identified execution cryptographic asset and a comparison result of the CBOM. CBOM generation system.

Images