VERIFICATION INFORMATION GENERATING SYSTEM, VERIFICATION INFORMATION GENERATING METHOD, AND VERIFICATION INFORMATION GENERATING PROGRAM

TECHNICAL FIELD

The present invention relates to a verification information creation system, a verification information creation method, and a verification information creation program.

BACKGROUND ART

Conventionally, in order to verify that there is no security problem with software installed on various equipment (to verify integrity), there have been techniques for detecting any change or falsification of files related to the software (see Non-Patent Literatures 1 and 2). Here, the software is updated as a result of setting changes, application of security patches, or the like. Thus, system operators need to check integrity as appropriate in daily use as well as at the time of software installation.

CITATION LIST
Patent Literature

Patent Literature 1: Japanese Patent Laid-Open No. 2019-8738

Patent Literature 2: Japanese Patent Laid-Open No. 2019-8377

Non-Patent Literature

Non-Patent Literature 1: Tripwire, found online on an Internet site at https://www.tripwire.co.jp/about/on Jul. 11, 2019

Non-Patent Literature 2: “Intel TXT Enhances Security in Virtual Environments,” Nikkei XTECH, found online on an Internet site at https://tech.nikkeibp.co.jp/it/article/COLUMN/20071114/287197/ on Jul. 11, 2019

SUMMARY OF THE INVENTION
Technical Problem

However, in conventional techniques, the collation information (verification information) used to check for the above-mentioned integrity has a problem in that the collation information allows checks to be made for integrity only at certain time points, does not support a typical software, makes it necessary to manually set verification information, and so on. Thus, an object of the present invention is to provide means of creating verification information that solves the above problem.

Means for Solving the Problem

To achieve the above object, the present invention comprises: an acquisition section configured to acquire a file path and a hash value of a file to be checked using the hash value during verification of the file out of files contained in a software package by executing a predetermined command for the software package; and a verification information creation section configured to create verification information used to verify software in the software package, the verification information including the file path and the hash value of the file, the file path and the hash value being acquired by the acquisition section.

Effects of the Invention

The present invention can provide means of creating verification information.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram showing a configuration example of a verification information creation system.

FIG. 2 is a diagram showing an example of a verification information list.

FIG. 3 is a diagram showing an example of a signed verification information list.

FIG. 4 is a flowchart showing exemplary processing procedures of a verification information creation apparatus shown in FIG. 1.

FIG. 5 is a flowchart showing an exemplary verification process using a hash value contained in collation information.

FIG. 6 is a flowchart showing an exemplary verification process for addition of an unnecessary file, where the verification process uses collation information.

FIG. 7 is a flowchart showing an exemplary verification process for deletion of a mandatory file, where the verification process uses collation information.

FIG. 8 is a flowchart showing an exemplary access-source verification process that uses collation information.

FIG. 9 is a diagram showing an example of a computer that executes verification information creation program.

FIG. 10 is a diagram showing an example of a collation information list.

DESCRIPTION OF EMBODIMENT

Mode for carrying out the present invention (embodiment) will be described below with reference to the accompanying drawings. The present invention is not limited to the embodiment described below. Note that verification information described below serves as a basis for verification of whether or not files related to software installed on equipment have been changed or falsified and verification information modified to suit equipment that verifies whether or not files have actually been changed or falsified is defined as collation information.

[Outline]

A verification information creation apparatus (verification information creation system) according to the present embodiment creates verification information about software installed, for example, on a verification apparatus, and thus uses analysis results on information contained in the software package of the software.

For example, Linux (registered trademark) has program distribution formats such as an rpm package and a deb package. With these packages, installation directories have been specified such that the user can install the software by simply executing a command.

Note that the rpm package is a system developed by Red Hat Inc. and used to manage software packages. The deb packages, examples of which include Debian and Ubuntu, are binary packages used by Linux.

For example, the rpm package can acquire various information by executing rpm commands as shown below after settings are completed.

# rpm-q--qf“[%{name},%{filenames},%{filemodes:octal},%{fileflags:: fflags},%{filedigests},%{fileverifyflags:hex}\n]” [Math. 1]

- name package name
- filenames names of files included in the package
- filemodes modes of files (file types+permission)
  - file types d: directory/c: character device/s: socket/-: file
  - permission r: file or directory is readable/w: file or directory is writable/x: file is executable
- fileflags whether the file is a document, or a config file and a flagged file
- filedigests hash value (MD5)
- fileverifyflags numeric values of verification flags for respective files

That is, by executing the rpm command, it is possible to acquire the package name; the names of files included in the package; file modes; file types (d: directory/c: character device/s: socket/-: file); permission (r: file or directory is readable/w: file or directory is writable/x: file is executable); whether the file is a document, or a config file and a flagged file; hash value (MD5); and numeric values of verification flags for respective files and the like from the rpm package.

By executing the rpm command, for example, with respect to an rpm package, the verification information creation apparatus can acquire each piece of the information described above.

Here, of the files contained in the package, it can be considered that the files subject to hash checking at the time of file verification are binary files that do not undergo file rewriting. Thus, the verification information creation apparatus uses, as verification information, a file that gives a value of 1 when the value (0x********) of %{fileverifyflags:hex} described above is logically ANDed with 0x00000001.

Also, of the files contained in the package, it can be considered that no change will be made to a write-protected config file once settings are made. Thus, with reference to the value of %{fileflags}, the verification information creation apparatus also uses a write-protected config file as verification information.

By performing the above process, the verification information creation apparatus creates, for example, the verification information shown in FIG. 2. That is, the verification information creation apparatus creates verification information including the package name and package character strings (the package name of the software package plus identification information about the equipment on which the software package is to be installed) of the software package for which verification information is to be created, information on the file path or directory path of the file to be verified on the given equipment, the hash value and essentiality attribute of the file, and the like, for example, shown in FIG. 2.

Note that in the case of a deb package the file path and hash value (MD5) of each file included in each package can be acquired using the following command after installation. Thus, the verification information creation apparatus can use information acquired by the following command as verification information.

# dlocate--md5sum package name

In this way, the verification information creation apparatus analyzes a software package and creates verification information using information about a file unlikely to be changed in daily use out of the files contained in the software package. Consequently, even if any file related to the software is changed in daily use after the software is installed, the verification apparatus that uses the verification information in verifying the software installed on the verification apparatus itself can check (verify) the integrity of the software.

[Configuration]

Next, a configuration example of a verification information creation system will be described using FIG. 1. The verification information creation system includes, for example, a verification information creation apparatus 10 configured to create verification information about software in a software package and a verification apparatus 20 configured to perform a verification process of software installed on the verification apparatus 20 itself, using the verification information.

The verification information creation apparatus 10 includes a data processing unit 11 and a data storage unit 12. The verification information creation apparatus 10 is connected to a user terminal via a network such as the Internet.

The data processing unit 11 includes a process reception section 111, an analysis processor 112, and a signature adding section 115. The data storage unit 12 includes a verification information list storage section 121, a signed verification information list storage section 122, and an analysis rule storage section 123.

First, components of the data processing unit 11 will be described. The process reception section 111 receives a request to create verification information about software in a software package from the user terminal and returns results thereon.

The analysis processor 112 analyzes the software package and thereby creates verification information. The analysis processor 112 includes an analysis section (acquisition section) 113 and a verification information creation section 114.

The analysis section 113 reads rules for analyzing the software package for which verification information is to be created, out of the analysis rule storage section 123. Then, following the read rules, the analysis section 113 acquires information about files unlikely to be changed in daily use from the files contained in the software package.

For example, by executing a predetermined command, the analysis section 113 acquires the file path and the hash value of the file (e.g., a binary file) to be checked using the hash value during verification as well as the file path of a non-rewritable config file, out of the files contained in the software package. Also, the analysis section 113 acquires the package name and verification information ID (e.g., serial number) of the software package.

Based on information acquired as a result of analysis conducted on the software package by the analysis section 113, the verification information creation section 114 creates verification information about the software in the software package. For example, based on information acquired as a result of analysis conducted on the software package by the analysis section 113, the verification information creation section 114 creates verification information (see FIG. 2) indicating the package name and verification information ID of the software package, information on the file path or directory path of the file to be verified, the hash value and essentiality attribute of the file, and the like. Subsequently, the verification information creation section 114 stores the created verification information in the verification information list storage section 121 and returns a notice to the user terminal, informing the user terminal that verification information has been created.

Note that when instructions to read verification information are received via the user terminal, the process reception section 111 reads the verification information specified by the instructions out of the verification information list storage section 121 and transmits the verification information to the user terminal. Subsequently, upon receiving a modification of the verification information from the user terminal, the process reception section 111 stores verification information that reflects the modification in the verification information list storage section 121.

For example, if the process reception section 111 is instructed by the user terminal to add an access source (executable file path of a program having access permission) permitted by an access source permission list (see FIG. 2) in the verification information to the verification information, the process reception section 111 stores the verification information modified based on the instructions, in the verification information list storage section 121.

Note that the process reception section 111 may store verification information transmitted from an external apparatus (e.g., the user terminal) in the verification information list storage section 121.

The signature adding section 115 adds a public-key certificate signed by the user to the verification information. For example, when the signature adding section 115 receives a request to add a signature to verification information, from the user terminal, the process reception section 111 selects appropriate verification information from the verification information list storage section 121 and passes the verification information to the signature adding section 115. Then, the signature adding section 115 replaces the verification information ID with a package ID (the package name plus the verification information ID plus identification information about the equipment in which the verification information is to be stored), adds a user signature of the equipment in which the verification information is to be stored and the public-key certificate signed by the user to the verification information, and stores the resulting verification information (see FIG. 3) in the signed verification information list storage section 122.

Next, components of the data storage unit 12 will be described. The verification information list storage section 121 of the data storage unit 12 stores a list of verification information (a verification information list). For example, as shown in FIG. 2, the verification information includes the package name and package character strings of the software package, the file path or directory path information about the file to be verified, the hash value of the file, an essentiality attribute, and the like. Also, as shown in FIG. 2, the verification information may include a configuration check requirement attribute, an access source permission list, and the like.

The essentiality attribute provides attribute information as to whether the file indicated by file path/directory path information of the verification information is a required file of the equipment on which the software package is to be installed.

Also, the configuration check requirement attribute provides attribute information as to whether the file indicated by file path/directory path information of the verification information is marked for configuration checking.

Furthermore, the access source permission list provides information that shows an executable file path of a program having access permission, to the file indicated by the file path/directory path information of the verification information.

Information about the essentiality attribute, the configuration check requirement attribute, and the access source permission list is entered, for example, via the user terminal.

The signed verification information list storage section 122 stores a list of signed verification information (see FIG. 3). The list of signed verification information is a list of verification information to which the user signature of the equipment in which the verification information is to be stored and a public-key certificate signed by the user have been added. For example, the list of signed verification information shown in FIG. 3 is created by replacing the verification information ID with a package ID made up of the package name plus the verification information ID plus identification information about the equipment in which the verification information is to be stored and adding a user signature of the equipment in which the verification information is to be stored and the public-key certificate signed by the user to each piece of the verification information shown in FIG. 2.

For each software package, the analysis rule storage section 123 stores information (analysis rules) showing an analysis method used to create verification information about the software in the software package. For example, the analysis rules execute an rpm command for an rpm package, thereby acquire information about binary files that undergo a hash check at the time of file verification, and acquire information about a write-protected config file.

[Processing Procedures]

Next, exemplary processing procedures of the verification information creation apparatus 10 will be described using FIG. 4. For example, when an input is received from the user terminal or the like, indicating that verification information about software in a software package will be created, the verification information creation apparatus 10 performs the following process.

First, the analysis section 113 of the verification information creation apparatus 10 acquires a software package for which verification information is to be created (S1) and conducts analysis on the software package based on analysis rules for the software package (S2). Subsequently, the verification information creation section 114 creates verification information about the software package based on analysis results on the software package produced by the analysis section 113 (S3). Then, the verification information creation section 114 stores the verification information created in S3 in the verification information list storage section 121.

Subsequently, if the process reception section 111 receives as input a modification of the verification information from the user terminal or the like (Yes in S4), the process reception section 111 stores verification information that reflects the modification in the verification information list storage section 121 (S5: modify verification information). Subsequently, the signature adding section 115 adds a user signature and a user-signed public-key certificate to the verification information to be stored in the verification information list storage section 121 and stores the verification information in the signed verification information list storage section 122 (S6: add signature to verification information). On the other hand, if the process reception section 111 does not receive as input a modification of the verification information (No in S4), the process reception section 111 goes to S6 by skipping the process of S5.

This allows the verification information creation apparatus 10 to create verification information about the software in the software package and add a signature to the verification information.

[Example of Verification Process]

Next, an example of verification process using verification information created by the verification information creation apparatus 10 will be described. For example, the verification apparatus 20 shown in FIG. 1 acquires verification information about the verification apparatus 20 itself from the verification information creation apparatus 10 and performs the verification process shown in FIGS. 5 to 8. First, an example of the verification process using a hash value of verification information will be described with reference to FIG. 5. The verification information created by the verification information creation apparatus 10 is stored in the verification apparatus 20. Based on the user signature and the user-signed public-key certificate, the verification apparatus 20 makes sure that the received verification information has not been falsified. The verification apparatus 20 compares the software installed on the verification apparatus 20 with the verification information and stores the information that fits the verification apparatus 20 as collation information. This information is used later to check files for any change or falsification. For example, in the signed verification information list shown in FIG. 3, the entries in the essentiality attribute of software packages tomcat-9.0.4 and clamav-0.100 are “NO.” Here, if it is assumed that tomcat-9.0.4 has been installed, but clamav-0.100 has not been installed, on the verification apparatus 20, information shown in FIG. 10 is saved as collation information. That is, the verification apparatus 20 stores information of the signed verification information list as collation information by removing verification information about software files actually not installed on the verification apparatus 20.

[Verification Process Using Hash Value]

First, upon detecting access to a file in the verification apparatus 20, the verification apparatus 20 determines whether the path of the accessed file matches any path registered in the verification information (S11). Here, if the verification apparatus 20 determines that the path of the accessed file matches any path registered in the collation information (Yes in S11) and that a hash value exists in the appropriate path in the collation information (Yes in S12), the verification apparatus 20 determines whether the hash value of the accessed file matches the hash value of the appropriate path in the collation information (S13).

If the verification apparatus 20 determines in S13 that the hash value of the accessed file does not match the hash value of the appropriate path in the collation information (No in S13), this means that the file has been falsified, and thus the verification apparatus 20 gives a bad integrity determination result (S14). Then, the verification apparatus 20 outputs the result of determination to a log (S17).

On the other hand, if the verification apparatus 20 determines that the hash value of the accessed file matches the hash value of the appropriate path in the collation information (Yes in S13), the verification apparatus 20 gives a good integrity determination result (not falsified) to the file (S15). Then, the verification apparatus 20 outputs the result of determination to the log (S17).

Note that if the verification apparatus 20 determines in S11 that the path of the accessed file does not match any path registered in the collation information (No in S11), the verification apparatus 20 determines that the file is not protected (S16) and outputs the result of determination to the log (S17). Also, even if the verification apparatus 20 determines that a hash value does not exist for the appropriate path in the collation information (No in S12), the verification apparatus 20 determines that the file is not protected (S16) and outputs the result of determination to the log (S17).

[Verification Process for Addition of Unnecessary File]

Next, an exemplary verification process for addition of an unnecessary file will be described using FIG. 6. First, upon detecting access to a file in the verification apparatus 20, the verification apparatus 20 determines whether the accessed file is marked for configuration checking in the collation information (S21). Here, if the verification apparatus 20 determines that the accessed file is marked for configuration checking in the collation information (Yes in S21), the verification apparatus 20 determines whether the path of the accessed file exists under a directory registered in the collation information (S22).

If the verification apparatus 20 determines in S22 that the path of the accessed file exists under a directory registered in the collation information (Yes in S22), the verification process goes to S23.

If the verification apparatus 20 determines in S23 that the path of the accessed file does not match any file name or directory name just under the directory of the collation information (No in S23), because an unintended file has been added, the verification apparatus 20 gives a bad integrity determination result (S24). Then, the verification apparatus 20 outputs the result of determination to the log (S27).

On the other hand, if the verification apparatus 20 determines that the path of the accessed file match any file name or directory name just under the directory registered in the collation information and marked for configuration checking (Yes in S23), the verification apparatus 20 gives a good integrity determination result (no unnecessary file has been added) to the file (S25). Then, the verification apparatus 20 outputs the result of determination to the log (S27).

Note that in S21, if the file, to which access is detected by the verification apparatus 20 is not marked for configuration checking in the collation information (No in S21), the verification apparatus 20 determines that the file is not protected (S26) and outputs the result of determination to the log (S27).

Also, if the verification apparatus 20 determines in S22 that the path of the accessed file does not exist under the directory registered in the collation information and marked for configuration checking (No in S22), the verification apparatus 20 determines that the file is not protected (S26) and outputs the result of determination to the log (S27).

[Verification Process for Deletion of a Mandatory File]

Next, an exemplary verification process for deletion of a mandatory file will be described using FIG. 7. First, upon detecting access to a file in the verification apparatus 20, if the accessed file is marked for configuration checking in the collation information (Yes in S31), the verification apparatus 20 determines whether the accessed file is located under a directory registered in the collation information (S32).

If the verification apparatus 20 determines in S32 that the accessed file is located under a directory registered in the collation information (Yes in S32), the verification apparatus 20 gives a good integrity determination result (the file has not been deleted) to the file (S34). Then, the verification apparatus 20 outputs the result of determination to the log (S36).

On the other hand, if the verification apparatus 20 determines that the accessed file is not located under a directory registered in the collation information (No in S32), the verification apparatus 20 gives a bad integrity determination result because the file has been deleted (S33). Then, the verification apparatus 20 outputs the result of determination to the log (S36).

Note that in S31, even if the path of the file, to which access is detected by the verification apparatus 20 is not marked for configuration checking (No in S31), the verification apparatus 20 determines that the file is not protected (S35) and outputs the result of determination to the log (S36).

[Access-Source Verification Process]

Next, an exemplary access-source verification process will be described using FIG. 8. First, upon detecting access to a file in the verification apparatus 20, if the verification apparatus 20 determines that the path of the accessed file matches any path registered in the collation information (Yes in S41), the verification apparatus 20 determines whether an access source permission list is set on the appropriate path in the collation information (S42).

If the verification apparatus 20 determines in S42 that an access source permission list for the accessed file is set on the appropriate path in the collation information (Yes in S42), the verification apparatus 20 determines whether an access source process path of the accessed file matches a path put on the access source permission list for the appropriate path in the collation information (S43).

If the verification apparatus 20 determines in S43 that the access source process path of the accessed file does not match the path put on the access source permission list for the appropriate path in the collation information (No in S43), the verification apparatus 20 gives a bad integrity determination result because the access source is not permitted (S47). Then, the verification apparatus 20 outputs the result of determination to the log (S49).

On the other hand, if the verification apparatus 20 determines in S43 that the access source process path of the accessed file matches the path put on the access source permission list for the appropriate path in the collation information (Yes in S43), the verification apparatus 20 checks the hash value of the access source process of the accessed file. Then, if the hash value of the access source process of the file, to which access is detected by the verification apparatus 20 does not check OK (No in S44), the verification apparatus 20 gives a bad integrity determination result because the file has been falsified (S45). Then, the verification apparatus 20 outputs the result of determination to the log (S49).

On the other hand, if the hash value of the access source process of the file, to which access is detected by the verification apparatus 20 checks OK in S44 (Yes in S44), the verification apparatus 20 gives a good integrity determination result to the file (S46). Then, the verification apparatus 20 outputs the result of determination to the log (S49).

Note that in S41, if the file, to which access is detected by the verification apparatus 20 does not match any path registered in the collation information (No in S41), the verification apparatus 20 determines that the file is not protected (S48) and outputs the result of determination to the log (S49).

Also, even if the verification apparatus 20 determines in S42 that an access source permission list for the accessed file is not set on the appropriate path in the collation information (No in S42), the verification apparatus 20 determines that the file is not protected (S48) and outputs the result of determination to the log (S49).

This allows the verification apparatus 20 to perform various verification processes using the collation information modified to suit the software files installed on the verification apparatus 20, based on the verification information created by the verification information creation apparatus 10.

Note that the verification processes may be performed, for example, by the verification information creation apparatus 10 described above.

[Program]

Also, a program that implements functions of the verification information creation apparatus 10 described according to the embodiments can be implemented by being installed on a desired information processing apparatus (computer). For example, by being caused to execute the above program provided as packaged software or online software, the information processing apparatus can be made to function as the verification information creation apparatus 10. What is referred to as information processing apparatus herein may be a desktop computer, a laptop personal computer, a rack-mounted server computer, or the like. Besides, mobile communications terminals such as a smartphone, a cellphone, and a PHS (Personal Handyphone System) as well as a PDA (Personal Digital Assistant) are included in the category of the information processing apparatus. Also, the verification information creation apparatus 10 may be implemented on a cloud server.

An example of a computer that executes the above program (verification information creation program) will be described using FIG. 9. As shown in FIG. 9, a computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are interconnected via a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected, for example, with a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected, for example, with a display 1130.

Here, as shown in FIG. 9, the hard disk drive 1090 stores, for example, an OS 1091, application programs 1092, program modules 1093, and program data 1094. The data storage unit described in the above embodiments is provided, for example, in the hard disk drive 1090 or the memory 1010.

Then, the CPU 1020 loads the program modules 1093 or the program data 1094 into RAM 1012 as required from the hard disk drive 1090 and carries out the above procedures.

Note that the program modules 1093 and program data 1094 related to the verification information creation program may not only be stored in the hard disk drive 1090, but also be stored, for example, in a removable storage medium and be read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program modules 1093 and program data 1094 related to the verification information creation program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and be read by the CPU 1020 via the network interface 1070.

REFERENCE SIGNS LIST

- 10 Verification information creation apparatus
- 20 Verification apparatus
- 11 Data processing unit
- 12 Data storage unit
- 111 Process reception section
- 112 Analysis processor
- 113 Analysis section
- 114 Verification information creation section
- 115 Signature adding section
- 121 Verification information list storage section
- 122 Signed verification information list storage section
- 123 Dynamic analysis rule storage section

VERIFICATION INFORMATION GENERATING SYSTEM, VERIFICATION INFORMATION GENERATING METHOD, AND VERIFICATION INFORMATION GENERATING PROGRAM

Information

Publication Number

Date Filed

Date Published

Inventors

Original Assignees

CPC

International Classifications

Abstract

Description

Claims

PCT Information