Information processing device, information processing method, and program

Abstract

An information processing device comprises a syntax analysis unit that: receives a program described in an object-oriented programming language as an input; performs syntax analysis on the program; assigns a label, on the basis of information included in a second syntax tree that includes a leaf node of an instance name and a leaf node of an instance variable name in a first syntax tree that includes a node having a prescribed function, to a block that includes the information; and outputs a verification logical expression that includes the label.

Description

Information processing device, information processing method, and program

[0001] The present invention relates to a technique for verifying a program.

[0002] Various conventional techniques for verifying programs are known (for example, Non-Patent Document 1). However, verifying programs written in object-oriented programming languages ​​is difficult because it is difficult to associate classes and variables.

[0003] For example, in the analysis of personal data, programs are often written in object-oriented programming languages ​​such as Python (registered trademark). Therefore, to verify that such programs are written correctly, program verification technology for object-oriented programming languages ​​is required.

[0004] Tsubasa Tokoshi, Hitoshi Yoshimura, Misato Nakabayashi, Tetsuya Okuda, "A Secure and Private Execution Method of Programs Using Proof-Carrying Code and TEE," 2022-CSEC-97

[0005] The present invention has been made in view of the above points, and has as its object to provide a technique that enables verification of a program written in an object-oriented programming language.

[0006] According to the disclosed technology, there is provided an information processing device having a syntax analysis unit that receives as input a program written in an object-oriented programming language, performs syntax analysis on the program, and assigns a label to a block containing information based on information contained in a second syntax tree that includes leaf nodes of instance names and leaf nodes of instance variable names in a first syntax tree that includes a node of a specified function, and outputs a verification logical formula that includes the label.

[0007] The disclosed technology provides a technology that enables verification of a program written in an object-oriented programming language.

[0008] FIG. 1 is a diagram for explaining a problem with a data analysis program for personal data. FIG. 1 is a diagram for explaining an example of the functional configuration of an information processing device 100. FIG. 2 is a flowchart for explaining an example of the operation of the information processing device 100. FIG. 2 is a diagram for explaining an example of an input program. FIG. 3 is a diagram for explaining a problem specific to an object-oriented program. FIG. 4 is a diagram for explaining an example of the operation of a syntax analysis unit 110 for solving the problem. FIG. 5 is a diagram for explaining an example of the operation of a syntax analysis unit 110 for solving the problem. FIG. 6 is a diagram for explaining an example of input code in a specific example. FIG. 7 is a diagram for explaining an example of a verification logical formula in a specific example. FIG. 8 is a diagram for explaining an example of the hardware configuration of a device.

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0010] In the following, the problem will first be described in more detail, and then the technology according to the present embodiment will be described.

[0011] (Regarding the Issues) As mentioned above, with conventional technology, it is difficult to verify programs written in object-oriented programming languages. Furthermore, programs for personal data analysis are often written in object-oriented programming languages. Furthermore, there is a high need for verification of programs for personal data analysis. The reasons for this are as follows.

[0012] When analyzing personal data, it is necessary to apply appropriate data protection processing to the raw data. However, determining the safety of data protection processing requires specialized knowledge. In addition, data protection processing functions cannot be reused for each development, so the safety of data protection processing must be verified for each development.

[0013] 1, in the case of medical case A, data protection processing is included in preprocessing (such as anonymous synthesis), and in the case of medical case B, data protection processing is included in the analysis program. In other words, to achieve high usability, it is necessary to create a data protection processing program for each analysis purpose. Therefore, there is an advantage to automating program verification.

[0014] However, as mentioned above, in the prior art, it has been difficult to verify a program written in an object-oriented programming language.

[0015] Below, we will explain a technology that solves the above problems and enables verification of programs written in object-oriented programming languages.

[0016] The personal data analysis program is merely one example of a program to which the technology according to the present embodiment can be applied. The technology according to the present embodiment can be applied to all programs written in object-oriented programming languages.

[0017] (Outline of the embodiment) In the present embodiment, the information processing device 100 converts a program into a verification logical formula that extracts information required for verification while maintaining the association of variables and classes.

[0018] (Configuration and Operation of Information Processing Device 100) In the following description, it is assumed that the "object-oriented programming language" used in the program (also referred to as code) is Python (registered trademark). However, using Python (registered trademark) as the object-oriented programming language is just one example, and the technology according to the present embodiment can be applied to any language used as the object-oriented programming language.

[0019] Fig. 2 shows an example of the functional configuration of the information processing device 100 according to this embodiment. As shown in Fig. 2, the information processing device 100 includes a syntax analysis unit 110 and a verification unit 120. The syntax analysis unit 110 and the verification unit 120 may be provided in separate devices. An example of the operation of the information processing device 100 will be described below in accordance with the steps of the flowchart in Fig. 3.

[0020] <S101 (Step 101)> In S101, a program to be verified and an information file are input to the syntax analysis unit 110. The program is written in an object-oriented programming language. The information file contains information that should be kept secret, information that may be made public, functions of interest, and the like.

[0021] <S102> In S102, the syntax analysis unit 110 performs syntax analysis of the input program, generates a verification logical formula based on the input information file, and outputs the verification logical formula. The syntax analysis unit 110 may also be called a "syntax analyzer." For example, Lark or the like can be used as the syntax analysis unit 110. The syntax analysis unit 110 includes a syntax analysis function and a verification logical formula generation function.

[0022] A verification logical formula is a logical formula having the property that "if this verification logical formula is true, the program satisfies the requirement." The verification logical formula itself is an existing technology (for example, Non-Patent Document 1). A requirement is, for example, "variables labeled as confidential are not written to the outside." The requirement may be determined in advance, or may be input to the syntax analysis unit 110 in S101.

[0023] Assuming that the program to be verified is a program that implements a DP (Differential Privacy) mechanism, and verifying whether DP is correctly implemented in the program, the verification logical formula is code in which the elements necessary to verify DP are expressed as logical formulas.

[0024] In this embodiment, the syntax analysis unit 110 performs syntax analysis while maintaining the relationships between variables and classes in the program. A specific example of this will be described later.

[0025] <S103> The verification logical formula output from the syntax analysis unit 110 is input to the verification unit 120. The verification unit 120 may also be called a verifier. The verification unit 120 determines whether the verification logical formula is true or false (TRUE / FALSE) and outputs TRUE or FALSE as the verification result of the program. The verification unit 120 can be realized by, for example, Prolog or the like.

[0026] As described above, the parsing unit 110 in this embodiment performs parsing of a program while maintaining the relationships between variables and classes in the program, thereby enabling verification of a program written in an object-oriented programming language.

[0027] An example of the above syntax analysis operation will be described below. First, the problems specific to object-oriented programs will be described, and then an example of syntax analysis operation as a method for solving the problems will be described.

[0028] (Issues Specific to Object-Oriented Programs) Here, the Python (registered trademark) program shown in FIG. 4 is used as an example of an input program.

[0029] In the example shown in Figure 4, "Yamamoto" is assumed to be sensitive data, and "&kj#8" is assumed to be data that can be made public without any problems. Note that it is assumed that the information that "Yamamoto" is sensitive data and "&kj#8" is data that can be made public without any problems is provided from outside, for example, by an information file.

[0030] Consider a case where variables in a program are labeled as private or public, and verification is performed to determine whether variables labeled as private are written to the outside. For example, in the procedural language covered in Non-Patent Document 1, by labeling variable names, it is possible to track in a verification logic formula whether the information should be private (or public). In Non-Patent Document 1, the labels are called "annotations."

[0031] On the other hand, in an object-oriented programming language such as that shown in Figure 4, it is not possible to label variables as private or public, as shown in Figure 5. The left side of Figure 5 shows the syntax tree for line 7 of Figure 4, and the right side of Figure 5 shows the syntax tree for line 8. As shown in Figure 5, even after syntactic analysis, only the variable name "name" can be identified, so it is not possible to label variables as private or public.

[0032] (Solution) An example of the operation of the parser 110 for solving the above-mentioned problem will be described with reference to Figures 6 and 7. An example of the input program to be dealt with is shown in Figure 4.

[0033] First, the parser 110 focuses on the leaf node of the instance name (e.g., sample1) and the leaf node of the instance variable name (e.g., name) in the subtree containing the node of the notable function (e.g., print) written in the information file in the syntax tree obtained by parsing. In the above example, the leaf node is indicated by "A" in the syntax tree on the seventh line in Figure 6.

[0034] Next, the syntax analysis unit 110 focuses on an instance syntax tree block that includes a leaf node for the instance name (e.g., sample1) and a leaf node for the instance variable name (e.g., name). This instance syntax tree block is shown in B in FIG. 7 and is the block under assign_stmt. Specifically, this block is the syntax tree on line 5 in FIG. 4. Note that line 5 in FIG. 4 is a program that generates an instance, sample1, whose name is "Yamamoto", from the class Sample.

[0035] Next, the parsing unit 110 determines whether or not there is sensitive information in the block of interest, based on the information file. In the example of FIG. 7 , "Yamamoto" indicated by C corresponds to sensitive information, so the parsing unit 110 determines that there is sensitive information. If the parsing unit 110 determines that there is sensitive information, it labels the block containing that information (block indicated by B in FIG. 7 ) as confidential. If there is no sensitive information in the block of interest, it labels it as public. Note that the unit for performing confidential / public labeling is not limited to the blocks shown in FIG. 7 . It is sufficient to label blocks that may contain sensitive information.

[0036] The parser 110 outputs a verification formula including a confidential / public label. A specific verification formula may be in the form of a list of terms (Horn clauses) connected by AND in the verification formula, as disclosed in Non-Patent Document 1, for example.

[0037] (Specific Example) An example of input code for an algorithm (Laplace mechanism) that adds Laplace noise to data to convert it into DP is shown in Fig. 8. Also, an example of a verification logical formula output by the parser 110 using the input code is shown in Fig. 9.

[0038] 9, the program will expose sensitive data, so the evaluation will be "FALSE." In the example of "Data Output Location Before Differential Privacy Processing," the program will expose non-sensitive data, so the evaluation will be "TRUE."

[0039] (Hardware Configuration Example) The information processing device 100 described in this embodiment can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0040] That is, the information processing device 100 can be realized by using hardware resources such as a CPU and memory built into a computer to execute a program corresponding to the processing performed by the information processing device 100. The program can be recorded on a computer-readable recording medium (such as a portable memory) and can be saved or distributed. The program can also be provided via a network such as the Internet or email.

[0041] Fig. 10 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 10 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. The computer may further include a GPU.

[0042] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0043] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions of the information processing device 100 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0044] (Effects of the embodiment) As described above, the technology described in the present embodiment makes it possible to verify a program written in an object-oriented programming language.

[0045] In the future, it is expected that data analysis programs and the associated data protection will be designed and developed individually. As a result, a single expert will not be able to keep up with the verification. Therefore, automating the verification using the technology according to this embodiment will enable safe and efficient verification.

[0046] In other words, by using the technology according to the present embodiment, it becomes possible to automatically verify an object-oriented program including a data analysis program. Examples of use cases include a differential privatization program and a program including encryption processing.

[0047] The following additional notes are provided regarding the above-described embodiments.

[0048] <Additional Notes> (Additional Item 1) An information processing device comprising: a memory; and at least one processor connected to the memory, wherein the processor receives a program written in an object-oriented programming language as input, performs syntactic analysis of the program, and assigns a label to a block including information based on information included in a second syntax tree including leaf nodes of instance names and leaf nodes of instance variable names in a first syntax tree including a node of a predetermined function, and outputs a verification logical formula including the label. (Additional Item 2) The information processing device according to Additional Item 1, wherein the processor assigns a label to the block indicating that the information should be kept confidential if the information is sensitive information, and assigns a label to the block indicating that the information may be made public if the information is not sensitive information. (Supplementary Item 3) An information processing method executed by an information processing device, comprising a syntactic analysis step of: receiving a program written in an object-oriented programming language as input, performing syntactic analysis on the program, and assigning labels to blocks containing information based on information contained in a second syntax tree containing leaf nodes of instance names and leaf nodes of instance variable names in a first syntax tree containing nodes of a predetermined function, and outputting a verification logical formula containing the labels. (Supplementary Item 4) A non-transitory storage medium storing a program for causing a computer to function as the information processing device described in Supplementary Item 1.

[0049] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0050] REFERENCE SIGNS LIST 100 Information processing device 110 Syntax analysis unit 120 Verification unit 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device having a syntax analysis unit that takes a program written in an object-oriented programming language as input, performs syntax analysis on the program, and assigns labels to blocks containing information based on information contained in a second syntax tree that includes leaf nodes of instance names and leaf nodes of instance variable names in a first syntax tree that includes a node of a specified function, and outputs a verification logical formula that includes the labels.

2. The information processing device according to claim 1, wherein the parsing unit assigns a label to the block indicating that the information should be kept confidential if the information is sensitive information, and assigns a label to the block indicating that the information may be made public if the information is not sensitive information.

3. An information processing method executed by an information processing device, comprising a syntactic analysis step of: receiving a program written in an object-oriented programming language as input; performing syntactic analysis on the program; assigning a label to a block containing information based on information contained in a second syntax tree containing leaf nodes of instance names and leaf nodes of instance variable names in a first syntax tree containing a node of a specified function; and outputting a verification logical formula containing the label.

4. A program for causing a computer to function as the syntax analysis unit in the information processing device according to claim 1.

Images