Vulnerability addressing device, vulnerability addressing method, and vulnerability addressing program

Abstract

A detection unit (101) detects vulnerability to fault attacks contained in program code (210). A correction unit (103) makes a correction to the program code (210) to address the vulnerability detected by the detection unit (101). A determination unit (102) determines whether or not vulnerability to fault attacks is present in corrected program code (130) after the correction has been made by the correction unit (103).

Description

Vulnerability handling device, vulnerability handling method, and vulnerability handling program

[0001] The present disclosure relates to a technique for dealing with fault attacks, which are attacks that cause a fault in a device, causing the device to malfunction and resulting in the leakage of confidential information, unauthorized modification of functions, and the like.

[0002] One technology for dealing with cyberattacks is disclosed in Patent Document 1. In the technology of Patent Document 1, a patch that addresses vulnerabilities to cyberattacks is applied to binary code. Furthermore, in Patent Document 1, a functional test is performed using the binary code after the patch has been applied to verify whether the binary code after the patch has been applied functions correctly.

[0003] Japanese Patent Application Laid-Open No. 2021-034027

[0004] The technology of Patent Document 1 can deal with vulnerabilities to cyber attacks, but has the problem that it cannot deal with fault attacks. Also, while Patent Document 1 can verify whether binary code functions correctly after a patch is applied, it has the problem that it cannot verify whether vulnerabilities remain.

[0005] One of the main objectives of the present disclosure is to solve such problems. More specifically, the main objective of the present disclosure is to appropriately modify program code to address vulnerabilities to fault attacks.

[0006] The vulnerability handling device according to the present disclosure includes a detection unit that detects vulnerabilities to fault attacks contained in program code, a correction unit that applies corrections to the program code to address the vulnerabilities detected by the detection unit, and a determination unit that determines whether or not the program code after the corrections have been made by the correction unit still has vulnerabilities to the fault attacks.

[0007] According to the present disclosure, modifications can be appropriately made to program code to address vulnerabilities to fault attacks.

[0008] FIG. 1 is a diagram showing an example of the functional configuration of a vulnerability handling device according to embodiment 1. FIG. 2 is a diagram showing an example of the hardware configuration of a vulnerability handling device according to embodiment 1. FIG. 3 is a flowchart showing an example of the operation of a vulnerability handling device according to embodiment 1. FIG. 4 is a flowchart showing an example of the operation of a vulnerability handling device according to embodiment 1. FIG. 5 is a diagram showing an example of the functional configuration of a vulnerability handling device according to embodiment 2. FIG. 6 is a flowchart showing an example of the operation of a vulnerability handling device according to embodiment 2. FIG. 7 is a flowchart showing an example of the operation of a vulnerability handling device according to embodiment 2.

[0009] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the embodiments and the drawings, the same reference numerals denote the same or corresponding parts.

[0010] Embodiment 1. ***Description of Configuration*** Fig. 1 shows an example of the functional configuration of a vulnerability handling device 100 according to this embodiment. Fig. 2 shows an example of the hardware configuration of the vulnerability handling device 100 according to this embodiment. The vulnerability handling device 100 is a computer. The operating procedure of the vulnerability handling device 100 corresponds to a vulnerability handling method. Furthermore, a program that realizes the operation of the vulnerability handling device 100 corresponds to a vulnerability handling program. First, an example of the hardware configuration of the vulnerability handling device 100 will be described with reference to Fig. 2.

[0011] As shown in FIG. 2 , the vulnerability handling device 100 includes, as hardware components, a processor 901, a main memory device 902, an auxiliary memory device 903, and an input / output device 904. The vulnerability handling device 100 also includes, as functional components, the detection unit 101, the determination unit 102, and the correction unit 103 shown in FIG. 1 . The functional components of FIG. 1 are implemented, for example, by programs. The auxiliary memory device 903 stores programs that implement these functions. These programs are loaded from the auxiliary memory device 903 to the main memory device 902. The processor 901 then executes these programs to perform the operations of the functional components of FIG. 1 . FIG. 2 schematically illustrates a state in which the processor 901 is executing programs that implement the functions of the functional components of FIG. 1 . The input / output device 904 is, for example, a mouse, a keyboard, a recording medium reading device, a recording medium writing device, a network device, a display, etc. The network device is, for example, a wired or wireless network. The network is, for example, the Internet, a LAN (Local Area Network), Wi-Fi (registered trademark), etc.

[0012] Next, an example of the functional configuration of the vulnerability handling device 100 will be described with reference to FIG.

[0013] The detection unit 101 acquires the program code 210. For example, the detection unit 101 acquires the program code 210 via a recording medium reading device of the input / output device 904. The program code 210 may be binary code or source code. When the detection unit 101 acquires source code as the program code 210, the detection unit 101 has a compiler (not shown), which converts the source code into binary code. In the following description, the detection unit 101 will be described assuming that it acquires binary code as the program code 210.

[0014] The detection unit 101 detects vulnerabilities to fault attacks contained in the program code 210. The detection unit 101 generates a vulnerability list 110 in which the detected vulnerabilities are described. The detection unit 101 then outputs the vulnerability list 110 to the determination unit 102. The detection unit 101 also outputs the program code 210 to the modification unit 103. The detection unit 101 may acquire modified program code 130 from the modification unit 103. The modified program code 130 is program code after modification has been performed to address vulnerabilities to fault attacks contained in the program code 210. When the detection unit 101 acquires the modified program code 130, it detects vulnerabilities to fault attacks remaining in the modified program code 130. The detection unit 101 also generates a vulnerability list 110 in which the detected vulnerabilities are indicated. The detection unit 101 then outputs the vulnerability list 110 to the determination unit 102. The detection unit 101 may acquire the modified program code 130 multiple times. Every time the detection unit 101 acquires the modified program code 130, the detection unit 101 detects vulnerabilities and outputs the vulnerability list 110. The process performed by the detection unit 101 corresponds to a detection process.

[0015] The determination unit 102 refers to the vulnerability list 110 to determine whether or not the program code 210 or the modified program code 130 is vulnerable to a fault attack. Specifically, if no vulnerability is described in the vulnerability list 110, the determination unit 102 determines that no vulnerability exists in the program code 210 or the modified program code 130. The determination unit 102 outputs a determination result 120 to the modification unit 103. If it is determined that no vulnerability exists in the program code 210, the determination unit 102 outputs the determination result 120 to notify the modification unit 103 that modification of the program code 210 is unnecessary. If it is determined that no vulnerability exists in the modified program code 130, the determination unit 102 instructs the modification unit 103 in the determination result 120 to output the modified program code 130 as the final modified program code 220. If it is determined that a vulnerability exists in the program code 210 or the modified program code 130, the determination unit 102 outputs a determination result 120 that instructs the modification unit 103 to modify the program code 210 or the modified program code 130. In other words, the determination unit 102 instructs the modification unit 103 in the determination result 120 to modify the program code 210 or the modified program code 130 to address the vulnerability described in the vulnerability list 110. The processing performed by the determination unit 102 corresponds to a determination process.

[0016] The modifying unit 103 obtains the program code 210 from the detecting unit 101. The modifying unit 103 also obtains the determination result 120 from the determining unit 102. If the determination result 120 indicates that the program code 210 should be modified, the modifying unit 103 performs a modification to address the vulnerability detected by the detecting unit 101. That is, the modifying unit 103 performs a modification on the program code 210 to remove the vulnerability described in the vulnerability list 110. The modifying unit 103 then outputs the modified program code 210 to the detecting unit 101 as the modified program code 130. If the determination result 120 indicates that the modified program code 130 should be modified, the modifying unit 103 performs a modification on the latest modified program code 130 to address the vulnerability detected by the detecting unit 101 and remaining in the latest modified program code 130. That is, the modifying unit 103 performs a modification on the latest modified program code 130 to remove the vulnerability described in the vulnerability list 110. Then, the modifying unit 103 outputs the modified modified program code 130 to the detecting unit 101. If the determination result 120 instructs output of the final modified program code 220, the modifying unit 103 outputs the latest modified program code 130 as the final modified program code 220. For example, the modifying unit 103 outputs the final modified program code 220 to a display of the input / output device 904. The modifying unit 103 also outputs the final modified program code 220 to a recording medium via a recording medium writing device of the input / output device 904. The processing performed by the modifying unit 103 corresponds to the modification process.

[0017] ***Explanation of Operation*** FIG. 3 shows an example of the operation of the vulnerability handling device 100 according to this embodiment.

[0018] First, in step S1 , the detection unit 101 acquires the program code 210 .

[0019] Next, in step S2, the detection unit 101 analyzes the vulnerability of the program code 210. Specifically, the detection unit 101 executes the program code 210 using, for example, a fault model. That is, the detection unit 101 simulates a fault attack on a device executing the program code 210. The execution environment of the program code 210 may be a native machine or an emulator. The fault model is a model of a fault attack. Possible fault models include instruction skipping, bit inversion, and random changes to multiple bytes. The detection unit 101 also analyzes the execution result of the program code 210. Specifically, the detection unit 101 evaluates whether the fault attack on the program code 210 is successful by referring to predetermined attack success conditions. Possible attack success conditions include whether a certain address is reached (entering a path that is always false). Possible attack success conditions include whether certain data is included in a certain function output (e.g., if a correct encryption result is not obtained despite encryption). If there is an attack for which the attack success condition is satisfied, the program code 210 is found to be vulnerable to that attack. The detection unit 101 generates a vulnerability list 110 in which the detected vulnerabilities are described. Specifically, the vulnerability list 110 describes "program address, assembler instruction, and fault model" as vulnerabilities. The detection unit 101 outputs the vulnerability list 110 to the determination unit 102. The detection unit 101 also outputs the program code 210 to the modification unit 103.

[0020] Next, in step S3, the determination unit 102 refers to the vulnerability list 110 and determines whether or not the program code 210 needs to be modified. If the program code 210 does not need to be modified, the process ends. On the other hand, if the program code 210 needs to be modified, the process proceeds to step S4. Details of step S3 will be described later.

[0021] In step S4, the determining unit 102 instructs the modifying unit 103 to modify the program code 210. Specifically, the determining unit 102 outputs a determination result 120 that instructs the modifying unit 103 to modify the program code 210. The determination result 120 includes the vulnerability list 110.

[0022] Next, in step S5, the modifying unit 103 modifies the program code 210. That is, the modifying unit 103 modifies the program code 210 to remove vulnerabilities described in the vulnerability list 110 included in the determination result 120. For example, the modifying unit 103 modifies the program code 210 using a machine learning model. The machine learning model is a model obtained by performing machine learning to modify vulnerabilities from the program code based on the descriptions in the vulnerability list 110. The modifying unit 103 outputs the modified program code 210 to the detection unit 101 as modified program code 130.

[0023] The machine learning model used to modify the program code 210 may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning, or may be a model obtained by performing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. Further, examples of machine learning models include a Neural Network (NN) model, a Convolutional Neural Network (CNN) model, a Recurrent Neural Network (RNN), a Variational Autoencoder (VAE), a Generative Adversarial Network (GAN), a Diffusion model, a Transformer model, a Large Language Model (LLM), a Visual Language Model (VLM), and a Bidirectional Encoder Representations from BERT (BERT). The machine learning model may be a model called a Generative Pre-trained Transformer (GPT), a Generative Pre-trained Transformer (CLIP), or a model called a CLIP. Furthermore, the machine learning model may be, for example, a rule-based model, such as a decision tree or a random forest, that obtains an output result by referencing a predetermined table or making a judgment based on predetermined conditions. The above-mentioned models are not exclusive, and for example, LLM, VLM, BERT, and GPT are included in the Transformer model. Furthermore, for example, the Transformer model is included in the NN model. Furthermore, machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include what are called multimodal models, which are learned by combining multiple different types of data.

[0024] The machine learning model used to modify the program code 210 may be configured internally or externally to the vulnerability handling device 100. When the machine learning model is configured internally, the modification unit 103 inputs the vulnerability list 110 and the program code 210 included in the determination result 120 into the machine learning model. The modification unit 103 may, for example, convert the vulnerability list 110 into a prompt or the like for instructing program modification and input the converted vulnerability list 110 into the machine learning model. The machine learning model modifies the program code 210 to remove vulnerabilities based on the description in the vulnerability list 110, thereby generating modified program code 130. When the machine learning model is configured externally, the modification unit 103 transmits the vulnerability list 110 and the program code 210 included in the determination result 120 to the machine learning model via a network interface device of the input / output device 904. The modification unit 103 may, for example, convert the vulnerability list 110 into a prompt or the like for instructing program modification and transmit the converted vulnerability list 110 to the machine learning model. The machine learning model modifies the program code 210 to remove vulnerabilities based on the description in the vulnerability list 110, thereby generating modified program code 130. The machine learning model transmits the generated modified program code 130 to the modifying unit 103 via the network interface device of the input / output device 904 .

[0025] Next, in step S6, the detection unit 101 acquires the modified program code 130.

[0026] Next, in step S7, the detection unit 101 analyzes vulnerabilities in the modified program code 130. As in step S2, the detection unit 101 executes the modified program code 130 using a fault model. That is, the detection unit 101 simulates a fault attack on the device executing the modified program code 130. As in step S2, the detection unit 101 also analyzes the execution results of the modified program code 130. If there is an attack for which the attack success condition is satisfied, it means that the modified program code 130 is vulnerable to that attack. The detection unit 101 generates a vulnerability list 110 that describes vulnerabilities detected in the modified program code 130. The contents of the vulnerability list 110 are as described above. The detection unit 101 outputs the vulnerability list 110 to the determination unit 102.

[0027] Next, in step S8, the determination unit 102 refers to the vulnerability list 110 to determine whether or not the modification of the modification program code 130 is necessary. If the modification of the modification program code 130 is not necessary, the process proceeds to step S11. In this case, the determination unit 102 outputs the determination result 120 instructing the modification unit 103 to output the final modification program code 220, while if the modification of the modification program code 130 is necessary, the process proceeds to step S9. Details of step S8 will be described later.

[0028] In step S9, the determining unit 102 instructs the modifying unit 103 to modify the modification program code 130. Specifically, the determining unit 102 outputs a determination result 120 instructing the modifying unit 103 to modify the modification program code 130. The determination result 120 includes the vulnerability list 110.

[0029] Next, in step S10, the modifying unit 103 modifies the modified program code 130. That is, the modifying unit 103 modifies the modified program code 130 to remove vulnerabilities described in the vulnerability list 110 included in the determination result 120. The modifying unit 103 modifies the modified program code 130 in the same procedure as in step S5. The modifying unit 103 outputs the modified modified program code 130 to the detecting unit 101. Thereafter, steps S6 to S10 are repeated until the determination in step S8 is NO.

[0030] In step S11 , the modifying unit 103 acquires the determination result 120 instructing the output of the final modified program code 220 , and outputs the latest modified program code 130 as the final modified program code 220 .

[0031] Next, step S3 in FIG. 3 will be described in detail with reference to FIG.

[0032] First, in step S31, the determination unit 102 determines whether or not a vulnerability ("program address, assembler instruction, fault model") is described in the vulnerability list 110. If a vulnerability is described in the vulnerability list 110, the process proceeds to step S32. On the other hand, if a vulnerability is not described in the vulnerability list 110, the process proceeds to step S34.

[0033] In step S32, the determination unit 102 determines to modify the program code 210. Then, the determination unit 102 outputs a determination result 120 instructing the modification unit 103 to modify the program code 210.

[0034] Furthermore, in step S33, the determination unit 102 increments the counter value, which is a value for counting the number of times the correction unit 103 has corrected the program code 210.

[0035] In step S34, the determining unit 102 determines that no modification to the program code 210 is necessary.

[0036] Next, step S8 in FIG. 3 will be described in detail with reference to FIG.

[0037] First, in step S81, the determination unit 102 determines whether or not a vulnerability ("program address, assembler instruction, fault model") is described in the vulnerability list 110. If a vulnerability is described in the vulnerability list 110, the process proceeds to step S82. On the other hand, if a vulnerability is not described in the vulnerability list 110, the process proceeds to step S85.

[0038] In step S82, the determination unit 102 determines whether the counter value has reached the threshold value. If the counter value has not reached the threshold value, the process proceeds to step S83. On the other hand, if the counter value has reached the threshold value, the process proceeds to step S85.

[0039] In step S83, the determining unit 102 determines to modify the modified program code 130. Then, the determining unit 102 outputs the determination result 120 instructing the modifying unit 103 to modify the modified program code 130.

[0040] Furthermore, in step S84, the determination unit 102 increments the counter value, and then the process of step S9 in FIG.

[0041] In step S85, the determining unit 102 determines that the modification to the program code 210 is finished.

[0042] Next, in step S86, the determination unit 102 instructs the modification unit 103 to output the final modified program code 220. That is, the determination unit 102 outputs the determination result 120 to the modification unit 103, instructing the modification unit 103 to output the latest modified program code 130 as the final modified program code 220. Thereafter, the process of step S11 in FIG. 3 is performed.

[0043] ***Description of Effects of the Embodiment*** According to this embodiment, program code can be appropriately modified to address vulnerabilities to fault attacks. That is, in this embodiment, it is verified whether vulnerabilities remain in the modified program code, and the program code is repeatedly modified until the vulnerabilities are eliminated. Therefore, according to this embodiment, program code that is resistant to fault attacks can be obtained.

[0044] Embodiment 2 In this embodiment, differences from embodiment 1 will be mainly described. Note that matters not described below are the same as in embodiment 1.

[0045] ***Description of Configuration*** Fig. 6 shows an example of the functional configuration of the vulnerability handling device 100 according to this embodiment. Compared to Fig. 1, Fig. 6 additionally includes an inspection unit 104.

[0046] The inspection unit 104 acquires the program code 210 from the detection unit 101. The inspection unit 104 also acquires the modified program code 130 from the modification unit 103. The inspection unit 104 then inspects whether the modified program code 130 is equivalent to the program code 210. That is, the inspection unit 104 inspects whether the program code after modification by the modification unit 103 is equivalent to the program code before modification by the modification unit 103. Equivalent means that the modified program code 130 retains the same functions as the program code 210. For example, if the modified program code 130 passes test cases that the program code 210 passed, the modified program code 130 and the program code 210 are equivalent. If the inspection unit 104 determines that the modified program code 130 is equivalent to the program code 210, it outputs the modified program code 130 to the detection unit 101 and the determination unit 102. On the other hand, if it is determined that the modified program code 130 is not equivalent to the program code 210, the inspection unit 104 causes the modification unit 103 to modify the modified program code 130 again. In other words, the inspection unit 104 causes the modification unit 103 to modify the modified program code 130 so that the modified modified program code 130 is equivalent to the program code 210. If the modification of the modified program code 130 is necessary, the inspection unit 104 outputs an inspection result 140 to the modification unit 103, instructing the modification unit 103 to modify the modified program code 130. The function of the inspection unit 104 is also realized by a program, similar to the detection unit 101, etc. The program that realizes the function of the inspection unit 104 is executed by the processor 901.

[0047] In this embodiment, the correction unit 103 outputs the correction program code 130 to the inspection unit 104. Furthermore, when the inspection unit 104 instructs the correction of the correction program code 130, the correction unit 103 corrects the correction program code 130 so that the corrected correction program code 130 is equivalent to the program code 210.

[0048] The detection unit 101 outputs the program code 210 to the determination unit 102, the correction unit 103, and the inspection unit 104. The detection unit 101 also acquires the modified program code 130 that has been determined by the inspection unit 104 to be equivalent to the program code 210, and detects vulnerabilities in the acquired modified program code 130.

[0049] The determination unit 102 acquires the program code 210 from the detection unit 101. The determination unit 102 also acquires the modified program code 130 from the inspection unit 104. As in the first embodiment, the determination unit 102 refers to the vulnerability list 110 to determine whether or not a vulnerability remains in the modified program code 130. In the present embodiment, the determination unit 102 compares the program code 210 with the modified program code 130 or compares the latest modified program code 130 with the modified program code 130 immediately before the latest modified program code 130, and determines whether or not the modification unit 103 has made a new modification to the modified program code 130. If a vulnerability remains but the modification unit 103 is no longer able to make a new modification to the modified program code 130, the determination unit 102 decides to end the modification of the modified program code 130.

[0050] ***Explanation of Operation*** Next, an example of operation of the vulnerability handling device 100 according to this embodiment will be described with reference to FIGS.

[0051] 7, steps S1 to S5 are the same as those described in embodiment 1, and therefore will not be described again. In this embodiment, after step S5, correction unit 103 outputs corrected program code 130, which is program code 210 after correction, to inspection unit 104.

[0052] The inspection unit 104 obtains the modified program code 130 from the modification unit 103 and inspects the modified program code 130 in step S21. That is, the inspection unit 104 inspects whether the modified program code 130 is equivalent to the program code 210. For example, the inspection unit 104 inspects whether the modified program code 130 passes a test case that the program code 210 passed (whether the input and output of the function are the same). If the modified program code 130 passes the test case, the inspection unit 104 determines that the modified program code 130 and the program code 210 are equivalent. The inspection unit 104 may also inspect whether the state of a specific register value and / or a specific memory value at a specific program address is the same between the program code 210 and the modified program code 130. If the states of specific register values ​​and / or specific memory values ​​are the same between the program code 210 and the modified program code 130, the checking unit 104 determines that the modified program code 130 and the program code 210 are equivalent.

[0053] If the modified program code 130 and the program code 210 are not equivalent (NO in step S22), the process proceeds to step S24. On the other hand, if the modified program code 130 and the program code 210 are equivalent (YES in step S22), the process proceeds to step S6 in Fig. 8. Furthermore, the inspection unit 104 outputs the modified program code 130 to the detection unit 101 and the determination unit 102.

[0054] In step S24, the inspection unit 104 instructs the modification unit 103 to modify the modified program code 130 so that the modified program code 130 is equivalent to the program code 210. The inspection unit 104 outputs an inspection result 140 to the modification unit 103, which instructs the modification unit 103 to modify the modified program code 130.

[0055] Next, in step S25, the modification unit 103 modifies the modified program code 130 so that the modified program code 130 is equivalent to the program code 210. The modification unit 103 modifies the modified program code 130 using, for example, a machine learning model. The machine learning model is a model obtained by performing machine learning to realize a modification that can remove vulnerabilities and makes the modified program code equivalent to the program code before modification. The modification unit 103 may also use, for example, the modification method described in Patent Document 1. The modification unit 103 outputs the modified modified program code 130 to the inspection unit 104.

[0056] The machine learning model used to modify the modification program code 130 may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning. The machine learning model may be a model obtained by executing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. The machine learning model may also be a model called an NN model, a CNN model, an RNN, a VAE, a GAN, a diffusion model, a Transformer model, an LLM, a VLM, a BERT, a GPT, or a CLIP. The machine learning model may also be a rule-based model, such as a decision tree or a random forest, that obtains output results by referencing a predetermined table or making a decision based on predetermined conditions. The above-mentioned models are not exclusive; for example, LLM, VLM, BERT, and GPT are included in the Transformer model. For example, the Transformer model is included in the NN model. The machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include what are called multimodal models, which are trained by combining multiple different types of data.

[0057] The machine learning model used to modify the modification program code 130 may be configured internally or externally to the vulnerability handling device 100. When the machine learning model is configured internally, the modification unit 103 inputs the modification program code 130 and the program code 210 to the machine learning model. The modification unit 103 may, for example, input a prompt or the like to instruct the machine learning model to modify the program. The machine learning model modifies the modification program code 130 so that the modified modification program code 130 is equivalent to the program code 210. When the machine learning model is configured externally, the modification unit 103 transmits the modification program code 130 and the program code 210 to the machine learning model via a network interface device of the input / output device 904. The modification unit 103 may, for example, transmit a prompt or the like to instruct the machine learning model to modify the program. The machine learning model modifies the modification program code 130 so that the modified modification program code 130 is equivalent to the program code 210. The machine learning model transmits the modified program code 130 after the modification to the modifying unit 103 via the network interface device of the input / output device 904 .

[0058] Thereafter, the processing from step S21 onwards is repeated until it is determined that the modified program code 130 after the modification is equivalent to the program code 210. The inspection unit 104 may count the number of modifications of the modified program code 130 and terminate the modification of the modified program code 130 when the number of modifications reaches a predetermined threshold. In this case, the inspection unit 104 displays, for example, a message on the display of the input / output device 904 indicating that the processing has terminated because the number of modifications has reached the threshold.

[0059] In FIG. 8, steps S6 and S7 are the same as those explained in the first embodiment, and therefore explanations thereof will be omitted.

[0060] In step S80, the determination unit 102 determines whether or not the modification program code 130 needs to be modified. More specifically, similar to the first embodiment, the determination unit 102 determines whether or not vulnerabilities remain in the modification program code 130 and whether or not the counter value has reached a threshold value. Furthermore, in this embodiment, the determination unit 102 determines whether or not the modification unit 103 has made new modifications to the modification program code 130. Details of step S80 will be described later.

[0061] If the modification of the modification program code 130 is necessary, the process proceeds to steps S9 and S10. On the other hand, if the modification of the modification program code 130 is not necessary, the process proceeds to step S11. Steps S9 to S11 are the same as those described in the first embodiment, and therefore their description will be omitted. In this embodiment, after step S10, the modification unit 103 outputs the modified modification program code 130 to the inspection unit 104.

[0062] The checking unit 104 obtains the modified program code 130 from the modifying unit 103, and in step S26 checks the modified program code 130. The checking unit 104 checks whether the modified program code 130 is equivalent to the program code 210 in the same manner as in step S21.

[0063] If the modified program code 130 and the program code 210 are not equivalent (NO in step S27), the process proceeds to step S28. On the other hand, if the modified program code 130 and the program code 210 are equivalent (YES in step S27), the process proceeds to step S6. In addition, the inspection unit 104 outputs the modified program code 130 to the detection unit 101 and the determination unit 102.

[0064] In step S28, the inspection unit 104 instructs the modification unit 103 to modify the modified program code 130 so that the modified program code 130 is equivalent to the program code 210. The inspection unit 104 outputs the inspection result 140 to the modification unit 103, which instructs the modification unit 103 to modify the modified program code 130.

[0065] Next, in step S29, the correction unit 103 corrects the corrected program code 130 so that the corrected program code 130 is equivalent to the program code 210. The correction unit 103 corrects the corrected program code 130 in the same manner as in step S25 so that the corrected program code 130 is equivalent to the program code 210. The correction unit 103 outputs the corrected corrected program code 130 to the inspection unit 104.

[0066] Thereafter, the processing from step S26 onwards is repeated until it is determined that the modified program code 130 after the modification is equivalent to the program code 210. The inspection unit 104 may count the number of modifications of the modified program code 130 and terminate the modification of the modified program code 130 when the number of modifications reaches a predetermined threshold. In this case, the inspection unit 104 displays, for example, a message on the display of the input / output device 904 indicating that the processing has terminated because the number of modifications has reached the threshold.

[0067] Next, step S80 in FIG. 8 will be described in detail with reference to FIG.

[0068] First, step S81 is the same as that described in embodiment 1, and therefore the description thereof will be omitted. If a vulnerability is described in the vulnerability list 110, the process proceeds to step S801. On the other hand, if a vulnerability is not described in the vulnerability list 110, the process proceeds to step S85.

[0069] In step S801, the determination unit 102 determines whether the modified program code 130 has changed from the program code 210 or the immediately previous modified program code 130. If the program code immediately previous to the latest modified program code 130 is program code 210, the determination unit 102 compares the modified program code 130 with the program code 210 to determine whether the modified program code 130 has changed from the program code 210. If the program code immediately previous to the latest modified program code 130 is modified program code 130, the determination unit 102 compares the latest modified program code 130 with the immediately previous modified program code 130 to determine whether the latest modified program code 130 has changed from the immediately previous modified program code 130.

[0070] If the program code has changed, the process proceeds to step S802, whereas if the program code has not changed, the process proceeds to step S803.

[0071] In step S802, the determination unit 102 clears the invariant count, which is the number of times the program code remains unchanged.

[0072] In step S803, the determination unit 102 determines whether the number of invariant times has reached the threshold. If the number of invariant times has reached the threshold, the process proceeds to step S85. On the other hand, if the number of invariant times has not reached the threshold, the process proceeds to step S804.

[0073] In step S804, the determination unit 102 increments the invariant count.

[0074] Steps S82 to S86 are the same as those described in the first embodiment, and therefore the description thereof will be omitted.

[0075] In this manner, in this embodiment, the determination unit 102 determines whether or not a new modification has been made to the latest program code since the previous program code. If no new modification has been made, the determination unit 102 determines to end the modification of the program code.

[0076] ***Description of Effects of the Embodiment*** In this embodiment, whether or not the modified program code retains the functionality of the program code before modification is checked. Therefore, according to this embodiment, it is possible to ensure that the modified program code retains the functionality of the program code before modification. Furthermore, in this embodiment, if no new modifications have been made to the latest program code from the previous program code, it is determined that modification of the program code will be terminated. Therefore, according to this embodiment, it is possible to quickly end a state in which the program code cannot be completely modified.

[0077] In the first and second embodiments, the modification unit 103 modifies the program code using a machine learning model. Alternatively, the modification unit 103 may perform syntax analysis and vulnerability classification to select a program code modification method and modify the program code according to the selected modification method. The modification method may be preset in, for example, a modification method database. Through syntax analysis, the modification unit 103 can determine the program code modification target portion. For syntax analysis, known syntax analysis methods such as the LR algorithm and the LALR algorithm may be used. Syntax analysis may also be performed using a machine learning model. The machine learning model is a model obtained by performing machine learning to perform syntax analysis of program code based on program grammar. Furthermore, in vulnerability classification, the modification unit 103 can classify vulnerabilities based on a fault model and a target instruction type (arithmetic operation, bit operation, branch, memory access, jump, etc.). Information for classifying vulnerabilities is preset in, for example, a vulnerability database. Vulnerability classification is possible by referring to the vulnerability database and searching for matching vulnerabilities. Vulnerability classification may also be performed using a machine learning model. The machine learning model is a model obtained by performing machine learning to classify program code vulnerabilities based on a fault model and a target instruction type.

[0078] The machine learning model used for syntax analysis and vulnerability classification may be a model obtained by machine learning using, for example, supervised learning, reinforcement learning, or unsupervised learning. The machine learning model may be a model obtained by executing learning according to, for example, deep learning, genetic programming, functional logic programming, or other known algorithms or methods. The machine learning model may also be a model called an NN model, a CNN model, an RNN, a VAE, a GAN, a diffusion model, a Transformer model, an LLM, a VLM, a BERT, a GPT, or a CLIP. The machine learning model may also be a rule-based model, such as a decision tree or a random forest, that obtains output results by referencing a predetermined table or making a decision based on predetermined conditions. The above-mentioned models are not exclusive; for example, LLM, VLM, BERT, and GPT are included in the Transformer model. For example, the Transformer model is included in the NN model. The machine learning learning algorithms and models may be a combination of multiple types. Machine learning models also include what are called multimodal models, which are trained by combining multiple different types of data.

[0079] The machine learning model used for syntax analysis and vulnerability classification may be configured internally or externally to the vulnerability handling device 100. If the machine learning model is configured internally, the correction unit 103 inputs the program code 210 to the machine learning model. The correction unit 103 may input, for example, a prompt or the like to instruct the machine learning model to analyze the program. The machine learning model performs syntax analysis and vulnerability classification of the program code 210, and generates a program modification method as the analysis result. If the machine learning model is configured externally, the correction unit 103 transmits the program code 210 to the machine learning model via a network interface device of the input / output device 904. The correction unit 103 may transmit, for example, a prompt or the like to instruct the machine learning model to analyze the program. The machine learning model performs syntax analysis and vulnerability classification of the program code 210, and generates a program modification method as the analysis result. The machine learning model transmits the generated program modification method to the correction unit 103 via the network interface device of the input / output device 904. By using a machine learning model to perform syntax analysis and vulnerability classification, a more precise program modification method can be generated, allowing the modification unit 103 to improve the accuracy of program modification. Note that the program modification method generated by the machine learning model may be a text-readable prompt, command sequence, source code program, etc., or an executable binary program. By making the program modification method text-readable, a user can easily confirm whether the program modification method generated by the machine learning model is correct.

[0080] Although the first and second embodiments have been described above, these two embodiments may be implemented in combination. Alternatively, one of these two embodiments may be implemented in part. Alternatively, these two embodiments may be implemented in part in combination. Furthermore, the configurations and procedures described in these two embodiments may be modified as necessary.

[0081] *** Supplementary Explanation of Hardware Configuration *** Here, a supplementary explanation of the hardware configuration of the vulnerability handling device 100 will be provided. The processor 901 shown in FIG. 2 is an IC (Integrated Circuit) that performs processing. The processor 901 is a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or the like. The main storage device 902 shown in FIG. 2 is a RAM (Random Access Memory). The auxiliary storage device 903 shown in FIG. 2 is a ROM (Read Only Memory), a flash memory, an HDD (Hard Disk Drive), or the like.

[0082] The auxiliary storage device 903 also stores an operating system (OS). At least a portion of the OS is executed by the processor 901. While executing at least a portion of the OS, the processor 901 executes programs that implement the functions of the functional components shown in FIGS. 1 and 6. The processor 901 executes the OS to perform tasks, memory management, file management, communication control, and the like. At least one of information, data, signal values, and variable values ​​indicating the results of processing by the functional components shown in FIGS. 1 and 6 is stored in at least one of the main storage device 902, the auxiliary storage device 903, and registers and cache memory within the processor 901. The programs that implement the functions of the functional components shown in FIGS. 1 and 6 may be stored on a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Portable recording media storing the programs that implement the functions of the functional components shown in FIGS. 1 and 6 may be distributed.

[0083] Furthermore, the "part" of at least any of the functional components shown in FIGS. 1 and 6 may be interpreted as a "circuit," a "step," a "procedure," a "process," or a "circuitry." Furthermore, the vulnerability handling device 100 may be realized by a processing circuit. The processing circuit may be, for example, a logic IC (Integrated Circuit), a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array). In this case, the functional components shown in FIGS. 1 and 6 are each realized as part of the processing circuit. In this specification, the generic concept of a processor and a processing circuit is referred to as a "processing circuitry." In other words, a processor and a processing circuit are each specific examples of "processing circuitry."

[0084] Aspects of the present disclosure are summarized below as appendices. (Appendix 1) A vulnerability handling device comprising: a detection unit that detects vulnerabilities to fault attacks contained in program code; a correction unit that applies a correction to the program code to address the vulnerability detected by the detection unit; and a determination unit that determines whether the program code after the correction by the correction unit is vulnerable to the fault attack. (Appendix 2) The vulnerability handling device according to Appendix 1, wherein, when the determination unit determines that the program code is vulnerable to the fault attack, the correction unit applies a correction to the program code to address the vulnerability determined by the determination unit to exist in the program code, and the determination unit determines whether the program code after the correction by the correction unit is vulnerable to the fault attack. (Appendix 3) The vulnerability handling device according to Appendix 1 or 2, wherein, when the determination unit determines that the program code is not vulnerable to the fault attack, the determination unit determines to end the correction of the program code. (Supplementary Note 4) The vulnerability handling device according to any one of Supplements 1 to 3, wherein the determination unit decides to end the modification of the program code when the program code is vulnerable to the fault attack but the number of times that determinations as to whether the program code is vulnerable to the fault attack has reached a threshold. (Supplementary Note 5) The vulnerability handling device according to any one of Supplements 1 to 4, wherein the determination unit decides to end the modification of the program code when the program code is vulnerable to the fault attack but the modification unit is no longer able to make new modifications to the program code.(Supplementary Note 6) The vulnerability handling device according to any one of Supplements 1 to 5, further including an inspection unit that inspects whether the program code after modification by the modification unit is equivalent to the program code before modification by the modification unit, and the determination unit, when the inspection unit determines that the program code after modification by the modification unit is equivalent to the program code before modification by the modification unit, determines whether the program code after modification by the modification unit is vulnerable to the fault attack. (Supplementary Note 7) The vulnerability handling device according to Supplementary Note 6, wherein, when the inspection unit determines that the program code after modification by the modification unit is not equivalent to the program code before modification by the modification unit, the inspection unit causes the modification unit to modify the program code again. (Supplementary Note 8) The vulnerability handling device according to any one of Supplements 1 to 7, wherein the modification unit uses a trained model obtained by machine learning to modify the program code to address the vulnerability detected by the detection unit. (Supplementary Note 9) The vulnerability handling device according to any one of Supplements 1 to 8, wherein the correction unit analyzes vulnerabilities detected by the detection unit, selects a correction method for the program code based on the analysis results, and corrects the program code in accordance with the selected correction method. (Supplementary Note 10) A vulnerability handling method, wherein a computer detects vulnerabilities to fault attacks contained in program code, the computer makes corrections to the program code to address the detected vulnerabilities, and the computer determines whether or not the program code after the corrections are made is vulnerable to the fault attacks. (Supplementary Note 11) A vulnerability handling program that causes a computer to execute a detection process that detects vulnerabilities to fault attacks contained in program code, a correction process that makes corrections to the program code to address the vulnerabilities detected by the detection process, and a determination process that determines whether or not the program code after the corrections are made is vulnerable to the fault attacks.

[0085] 100 vulnerability handling device, 101 detection unit, 102 judgment unit, 103 correction unit, 104 inspection unit, 110 vulnerability list, 120 judgment result, 130 correction program code, 140 inspection result, 210 program code, 220 final correction program code, 901 processor, 902 main memory device, 903 auxiliary memory device, 904 input / output device.

Claims

1. A vulnerability handling device having a detection unit that detects vulnerabilities to fault attacks contained in program code, a correction unit that applies corrections to the program code to address the vulnerabilities detected by the detection unit, and a determination unit that determines whether or not the program code after the corrections have been made by the correction unit still has vulnerabilities to the fault attacks.

2. The vulnerability handling device described in claim 1, wherein, when the judgment unit determines that the program code is vulnerable to the fault attack, the correction unit makes a correction to the program code to address the vulnerability that the judgment unit determines to exist in the program code, and the judgment unit determines whether the program code after the correction by the correction unit is vulnerable to the fault attack.

3. A vulnerability handling device as described in claim 1 or 2, wherein the judgment unit decides to end modification of the program code when it determines that the program code is not vulnerable to the fault attack.

4. A vulnerability handling device as described in any one of claims 1 to 3, wherein the judgment unit decides to end modification of the program code when the program code is vulnerable to the fault attack but the number of times that the program code has been judged as to whether it is vulnerable to the fault attack reaches a threshold value.

5. A vulnerability handling device as described in any one of claims 1 to 4, wherein the judgment unit decides to end modifications to the program code when the program code is vulnerable to the fault attack but the modification unit is no longer able to make new modifications to the program code.

6. The vulnerability handling device according to any one of claims 1 to 5, further comprising an inspection unit that inspects whether the program code after modification by the modification unit is equivalent to the program code before modification by the modification unit, and the determination unit, when the inspection unit determines that the program code after modification by the modification unit is equivalent to the program code before modification by the modification unit, determines whether the program code after modification by the modification unit is vulnerable to the fault attack.

7. A vulnerability handling device as described in claim 6, wherein the inspection unit causes the modification unit to modify the program code again when it determines that the program code after modification by the modification unit is not equivalent to the program code before modification by the modification unit.

8. A vulnerability handling device as described in any one of claims 1 to 7, wherein the correction unit uses a trained model obtained by machine learning to make corrections to the program code to address vulnerabilities detected by the detection unit.

9. A vulnerability handling device as described in any one of claims 1 to 8, wherein the correction unit analyzes the vulnerability detected by the detection unit, selects a correction method for the program code based on the analysis results, and corrects the program code in accordance with the selected correction method.

10. A vulnerability handling method in which a computer detects a vulnerability to a fault attack contained in program code, the computer modifies the program code to address the detected vulnerability, and the computer determines whether the program code after the modification is made is still vulnerable to the fault attack.

11. A vulnerability countermeasure program that causes a computer to execute a detection process that detects vulnerabilities to fault attacks contained in program code, a correction process that applies corrections to the program code to address the vulnerabilities detected by the detection process, and a determination process that determines whether or not the program code after the corrections have been made by the correction process is vulnerable to the fault attacks.

Images