JP2008234409A - Security threat analysis support system, method therefor, and security threat analysis support program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security threat analysis support system for comprehensively extracting security threats and facilitating review of an analysis result due to specification change. <P>SOLUTION: The security threat analysis support system is provided with an analysis target input means inputting component information composed of names, types, connection relations, inclusion relations of components constituting an analysis target system, an access point extraction means extracting an access point (an accessible point such as an interface and a point on a communication system path) between the components based on the inputted component information, a security threat input means inputting security threat information showing a possible type of attack on the extracted access point, and a security threat verification support means classifying the security threat information based on a predetermined condition. When the access point is extracted based on the information of the components constituting the analysis target system, and security threat analysis is carried out based on the access point. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to the field of security design technology in which security threat analysis is performed to comprehensively extract security threats that are assumed to be analyzed in security design.

Conventionally, security threat analysis in security design has been performed based on information assets handled in the analysis target (Patent Document 1). For this reason, the extraction of security threats that do not depend on information assets (for example, step stools and denial of service) has relied on empirical rules.

Especially in the security threat analysis in the upstream design phase such as requirement definition, if there are uncertain parts in the analysis target components and interface specifications, they must be analyzed again after being confirmed. In this case, it was necessary to review the impact of the specification change for each information asset. Therefore, as a result, the entire result of the security threat analysis had to be reviewed.
JP 2005-242754 A

Security threat analysis based on information assets cannot exhaustively extract security threats, and security threat analysis in the upstream design phase must review the impact of specification changes for each information asset. The production efficiency of the design was deteriorated.

The present invention has been made in consideration of such circumstances, and the object of the present invention is to provide a security threat analysis support system that can comprehensively extract security threats and easily review analysis results by changing specifications. Is to provide.

In the present invention, security threat analysis based on access points (accessible points such as interfaces and communication paths) enables comprehensive extraction of security threats including steps and service interruptions that do not depend on information assets. It was.

When performing security threat analysis based on access points performed at the stage including the uncertain part of the internal configuration, it is only necessary to review the security threats associated with the access points corresponding to the changed interface. Absent.

In the security threat analysis support system of the present invention, security threats can be comprehensively extracted, and the analysis result can be easily reviewed by changing specifications.

FIG. 1 is a block diagram showing the configuration of the present invention. When the designer 30 performs the security threat analysis of the present invention, first, the component and its attributes are input by the analysis target input means 1. The inputted security threat analysis range is stored in the component information storage means 7 as component information. The constituent element information includes at least a constituent element definition, a constituent element connection relation, and a constituent element inclusion relation.

Next, an access point is automatically extracted by the access point extraction means 2. An access point is a point at which some access can be assumed, such as an interface to a component or a point on a communication path between components.

With respect to the extracted access points, the designer 30 inputs the usage method by the access point usage method input means 3. The elements of the usage method are narrowed down by referring to the component element information, and can be input efficiently. In addition, in the analysis level 2 and later, the access points defined in the higher analysis level and the method of using the same are automatically inherited for further efficiency (the analysis level will be described later). Information regarding these access points and usage methods is stored in the access point information storage means 8 as access point information.

Next, the designer 30 uses the security threat input means 4 to select an access point to be edited. A security threat is input by the security threat editing means 5 to the selected access point. The input of security threat elements is narrowed down by referring to the component element information, and can be input efficiently. In addition, after the analysis level 2, the access points defined in the higher analysis level and their security threats are automatically inherited for further efficiency.

Information on these security threats is stored in the security threat information storage means 9 as security threat information.

Next, the security threat verification support means 6 verifies that the security threat based on the access point indicated by the security threat information is not leaked from the viewpoint different from the access point. At this time, threats that may be leaked are automatically extracted, and the designer 30 can efficiently find a leak by selecting an appropriate one from them.

If the security threat verification support means 6 finds a leak in the security threat extraction work, the security threat input means 4 inputs a new security threat and the security threat verification support means 6 performs verification.

When an access point is added, deleted, or specification is changed, the change is reflected by the access point extraction means 2, a new security threat is input by the security threat input means 4, and a security threat is verified by the security threat verification support means 6. Check for leaks.

These repetitions are repeated until there is no threat leakage or access point change (interface specifications are finalized).

FIG. 2 shows a system configuration diagram of a document management system used as a security threat analysis target.

In the document management system, a client PC 12 on which a Web browser is arranged and a document management server system 14 are connected via an external network 13. The document management server system 14 includes a Web server 16 in which Web software 17 and user identification data 18 are arranged, a DB server 19 in which DB software 20 and document data 21 are arranged, and an external network 13 connected via an internal network 15. Has been.

The external network 13 is a public network and may be used by other systems.

The user identification data 18 is data in which a user ID for identifying a regular user registered by the administrator is registered. The document data 21 is data in which a document registered by the user is stored.

The following is a specification of a document management system which is a system targeted by the security threat analysis support system in this embodiment.

The user 10 can access the document management server system 14 from the client PC 12 via the external network 13 and use the document data registration, browsing, and deletion functions provided by the document management server system 14.

When the user 10 accesses the document data 21 from the client PC 12, when the user first accesses the web software 17 of the web server 16 from the web browser 11 of the client PC 12, the web software 17 responds to the user 10 with the user ID. Returns an input form that prompts for input.

When the user 10 inputs the user ID from the Web browser 11 and transmits it to the Web software 17, the user ID received by the Web software 17 is checked against the user identification data 18. If the user ID is a registered user ID, the Web software determines that the user is a legitimate user, and if the user ID is an unregistered user ID, the web software determines that the user ID is not a legitimate user. To do. If it is an unregistered user ID, the Web software 17 returns a warning message to the user as a response, and does not perform any further processing. If it is a registered user ID, the Web software 17 returns an input form asking for input of a processing type (either registration, browsing, or deletion) and a processing target document name as a response.

When the user 10 inputs a processing type, a processing target document name, and a document (when the processing type is registered) from the Web browser 11 and sends the document to the Web software 17, the Web software 17 determines the DB server 19 according to the processing type. The document data 21 is accessed through the DB software 20, and writing, reading, and deletion are performed, and a processing result is returned as a response.

The administrator 22 can use the user registration and deletion functions provided by the document management server system 14 from the Web server 16 of the document management server system 14.

The administrator 22 can update the software of the Web software 17 and the DB software 20 from the consoles of the Web server 16 and the DB server 19 of the document management server system 14, respectively.

FIG. 3 is a display example of a graphical language editor provided by the analysis target input means 1. The analysis target input means 1 uses the graphical language editor to input the component name, component type, component description, component connection relationship, and component inclusion relationship of the analysis target. “Analysis level: 1” shown in the window title indicates that this is the first security threat analysis. At this stage, document management software that realizes a document management function as a component in the document management server system 14 23, user identification data 18 for identifying users of the system, and document data 21 for storing documents exist, and the internal components and their connection relations are clear. Make it not exist.

When the constituent elements in the document management server system 14 are clarified and the security threat analysis is further advanced, the analysis is performed as analysis level 2, analysis level 3,. The component is represented by a graphic with a character string, and the character string represents the component name. The component type is expressed in the shape of a figure that represents the component. The doll is the participant, the rectangle is the component (single or assembled subsystem), the ellipse is the communication path, the rounded rectangle is the program, and the cylinder is the data. , Expressing each. The component connection relation is expressed by a line segment connecting the components. The component inclusion relationship is expressed by the inclusion relationship of the graphic representing the component. In addition, by clicking a graphic representing a component, it is possible to edit the component name, component type, and component description.

FIG. 4 is an example of storage at the analysis level 1 of the component element definition among the component element information stored in the component element information storage unit 7. The component element definition is composed of a component element name, a component element type, and a component element description.

FIG. 5 shows an example of storage at the analysis level 1 of the component connection relation among the component element information stored in the component element information storage means 7. The component connection relationship includes a component name and a connection component, and indicates which component is connected for each component.

FIG. 6 shows an example of storage at the analysis level 1 of the component inclusion relationship among the component information stored in the component information storage means 7. The constituent element inclusion relationship is composed of constituent element names and inclusion constituent elements, and indicates a relation as to which constituent element is included for each constituent element.

FIG. 7 is a display example of a graphical language editor provided by the access point extraction means 2. The access point extraction unit 2 extracts an access point and assigns an access point ID to the added component. In FIG. 7, A, B, etc. indicate access points, and the alphabetical characters in the circles indicate access point IDs for identifying access points.

The access point is extracted by the following procedure.

1) For the newly added component e, if the component type of the component e is a communication route, create one access point on the communication path, and if it is a component, create another access point or access point on the component Create access points at all connection points.

In FIG. 7, since the component type of the external network 13 is a communication path, one access point is created on the communication system path. Further, since the document management server system 14 has a component type as a component, access points are created at the connection points of the document management server system 14 with the external network 13 and the connection points with other administrators 22.

2) If there is a newly added component for which no access point has been extracted, go to 1). 3) At end analysis level 1, access point IDs of access points are created in the order of creation, A, B, C. A unique number is assigned. By clicking the access point portion, the access point utilization method input means 3 can be displayed.

FIG. 8 is a display example of the access point utilization method input means 3 when the access point portion is clicked in the graphical language editor provided by the access point extraction means 2. In FIG. 8, there are five usage method elements: who, where, what, what, and what, but the number of elements and the number of elements are not limited to these.

For the input of each element, the contents of the drop-down list are displayed with reference to the component element information to make the input more efficient. For example, in the case of inputting a participant such as who, by clicking on the input field, the constituent elements whose constituent element type is the participant such as a user and an administrator can be listed and selected from there. In the case of inputting a location such as where and where, similarly, a component whose component type is a component or a communication path is listed and can be selected therefrom. When inputting an object such as what, a component whose component type is data or a program is listed. Although it depends on the specifications of the analysis target, it is a free description, but typical patterns may be listed according to the type of the target.

FIG. 9 is an example of storage at the analysis level 1 of the access point information stored in the access point information storage means 8. For each access point, the usage method assumed in the analysis target is shown, and a plurality of usage methods can be associated with one access point. As the usage method, a unique identification number is assigned at the access point, and one usage method is specified by a combination of the access point ID and the identification number of the usage method. This facilitates specification of the use method of the inheritance source when the use method is inherited at the analysis level 2 or later. In the belonging component, the component name of the component to which the access point indicated by the access point ID belongs is stored. In FIG. 9, the usage method is expressed by five elements, “who”, “from”, “where”, “what”, and “what”. It is not limited.

FIG. 10 is a display example of a graphical language editor provided by the security threat input means 4. By clicking the plotted access point ID part, it is possible to input a security threat assumed at the access point. At analysis level 2 or higher, the analysis result at analysis level 1 is inherited and created (described later).

FIG. 11 is a display example of the security threat editing means 5 that is displayed when an access point is clicked in the graphical language editor provided by the access point extraction means 2. The input method is basically the same as the access point input, except that “who” lists “third parties” for the purpose of attacking the analysis target, and “what” is a security threat. The difference is that you enter an action.

FIG. 12 shows an example of storage at the analysis level 1 of security threat information stored in the security threat information storage means 4. For each access point, a security threat assumed in the analysis target is shown, and a plurality of security threats can be associated with one access point. A security threat is assigned a unique identification number at an access point, and one security threat is specified by a combination of an access point ID and a security threat identification number. This facilitates the identification of the inheritance source security threat when inheriting the security threat at the analysis level 2 or later. In the belonging component, the component name of the component to which the access point indicated by the access point ID belongs is stored. In FIG. 12, the security threat is expressed by five elements, “who”, “from”, “where”, “what”, and “what”. It is not limited.

The countermeasure implementation level indicates at which analysis level the countermeasure is taken, and is used by the security threat verification support means 6 described later.

FIG. 13 is a display example of the security threat classification condition setting window of the security threat verification support means 6. Security threat verification support means 6 provides a display that makes it easier for a designer to find out if a security threat has been extracted by classifying the security threats extracted based on the access points in terms of security threat elements and their combinations. To do. The security threat classification condition setting window sets which element of the security threat to classify. Elements can be classified and combined by multiple selection. For example, if “where” and “what” are the classification conditions, classification based on the information asset to be protected on the analysis target is possible, and it is not possible to extract security threats from the viewpoint of the information asset to be protected. It is easy to verify whether there is any.

FIG. 14 is a display example of security threat classification results by the security threat verification support means 6 according to the classification conditions of FIG. It is classified by “where” and “what”, which are elements of security threats. From this classification result, it is verified whether or not “who”, “from”, and “what” are not classified conditions, and they become security threats.

The flow of verification in the verification support means is as follows.

For threats belonging to the same classification group, a combination of security threat elements not extracted is listed as a security threat candidate in consideration of the component connection relation and the component inclusion relation of the component information. View listed security threats, and designers remove inappropriate ones from the list. Add the remaining threats to the security threat information. The above is repeated for all classification groups.

As a result, for example, the third party can destroy or falsify the document data on the document management server system from the document management system. From the document management software on the document management server system, which is destroyed or falsified, it is possible to find a missing security threat that a third party destroys or falsifies from an external network.

FIG. 15 is a display example of a classification result to which three new security threats extracted by the security threat verification support means 6 are added.

FIG. 16 shows a display example at the analysis level 1 of the countermeasure implementation level. In the measure execution level column, it is possible to specify at least whether to take measures at the current analysis level or at a lower level. Measures at a lower level indicate that there are unclear components that will be addressed when they become clear. In the embodiment, “◯” indicates a countermeasure at the current analysis level, and “Δ” indicates a countermeasure at a lower level. This eliminates the need for measures at the lower level for threats marked “◯”, so there is no need for inheritance, and the inheritance of explosive threats by raising the analysis level is suppressed.

FIG. 17 shows security threat information in which the countermeasure implementation level is set. This state is the final security threat at analysis level 1.

FIG. 18 is a display example of a graphical language editor provided by the analysis target input means 1. Since the internal configuration of the document management server system 14 has been clarified, the component information is input as the analysis level 2 as in the analysis level 1. The five components of the internal network 15, the Web server 16, the Web software 17, the DB server 19, and the DB software 20 are newly clarified components at the analysis level 2. The document management software at the analysis level 1 is embodied as Web software 17 and DB software 20.

FIG. 19 shows an example of storage at the analysis level 2 of the component element definition among the component element information stored in the component element information storage means 7. The component element definition is composed of a component element name, a component element type, and a component element description. The five shaded components are newly stored at analysis level 2.

FIG. 20 shows an example of storage at the analysis level 2 of the component connection relation among the component element information stored in the component element information storage means 7. The component connection relationship includes a component name and a connection component, and indicates which component is connected for each component. The five shaded components are newly stored at analysis level 2.

FIG. 21 shows an example of storage at the analysis level 2 of the component inclusion relationship among the component information stored in the component information storage means 7. The constituent element inclusion relationship is composed of constituent element names and inclusion constituent elements, and indicates a relation as to which constituent element is included for each constituent element. The five shaded components are newly stored at analysis level 2.

FIG. 22 is a display example of a graphical language editor provided by the access point extraction means 2. The access point extraction unit 2 extracts an access point and assigns an access point ID to the added component. The five access points shaded are access points extracted based on the components newly added at the analysis level 2.

The access point is extracted by the following procedure.

1) For the newly added component e, if the component type of the component e is a communication route, create one access point on the communication path, and if it is a component, create another access point or access point on the component Create access points at all connection points.

In FIG. 22, since the component type of the internal network is a communication path, one access point is created on the communication system path. In addition, since the component type of the Web server 16 is a component, access points are created at the connection point with the internal network 15 on the Web server 16 and the connection point with the access point 5 which is another access point. . A DB server can be created in the same way.

2) If there is a newly added component for which no access point has been extracted, go to 1) 3) Finish The access point ID of the newly extracted access point is as follows so that the hierarchical relationship can be clearly indicated Determine by procedure.

1) An identification number (1, 2, 3,...) Is assigned to a component whose component type is a component and a communication path among newly added components.

In FIG. 22, the Web server is 1, the DB server is 2, and the internal network is 3.

2) For the newly extracted access point a, obtain the ID at the access point of the upper layer component connected to a directly or via a communication path.

At the access point D-1 in FIG. 22, the access point ID (= D) at the access point of the document management server system connected via the internal network that is the communication path is acquired.

3) The access point ID of the access point a is determined by combining the ID acquired in 2) with the identification number of the component to which the access point a assigned in 1) belongs.

In the access point D-1 in FIG. 22, the ID (= D) acquired in 2) and the web server identification number (= 1) are combined with a hyphen, and “D-1” is set as the access point ID. From the access point ID determined by the above procedure, the access point from which the access point is derived (upper layer) can be read. The access point D-1 in FIG. 22 can be identified as being derived from the access point D.

As with analysis level 1, by clicking on an access point, the access point utilization method can be entered (the description with the editor display example is the same as in analysis level 1 and is omitted).

FIG. 23 is an example of storage at the analysis level 2 of access point information stored in the access point information storage means. However, access point D, access point E, and access points derived from them are omitted. The usage method relating to the newly added access point is created by inheriting the usage method of the upper access point. The access point usage method is inherited by the following procedure.

1) Among the access points at the higher analysis level, for the access point a with a younger order relation of the belonging component,
1-1) The method of using the access point a is duplicated as a method of using the access point derived from the access point A. The method of using access point D was duplicated as the method of using access points D-1, D-2, and D-3.

1-2) Regarding the usage method copied
1-2-1) In the “from” and “where” portions, the same element as the belonging component of the access point of the higher analysis level is replaced with the belonging component of the duplicated access point.

  1-2-2) When the component type of the belonging component is a component, “where” and “what” do not satisfy the inclusion relationship of the component information, and are included in the belonging component Replace the component type with “Program” and replace “What” with “Use”.

  In the method of using access point D-1 (identification number 1), it is “Web server document data” before the change, and the inclusion relationship is not satisfied. For this reason, “What” was replaced from document data to Web software. When there is a higher order component, “From” is replaced with the higher order component.

In the method of using access point D-2 (identification number 1), “From” was replaced with the Web server, which is a higher component. If it is a communication path, replace “how” with “relay”.

  In the method of using access point D-3 (identification number 1), “how” is replaced with “relay”.

  1-4) As a result of inheritance, those that are not supposed to be used are deleted.

  The access point E-2 usage method (identification number 1) is that the “user identification data” of “What” is changed to “DB software” by inheritance, but the DB software of the DB server must be used from the DB server. Because there is no, delete.

  1-3) If there are other usages that have been duplicated, go to 1-2).

2) If there are other access points of higher analysis level, go to 1).

3) End FIG. 24 is an example of storage at the analysis level 2 of security threat information stored in the security threat information storage means. However, access point D, access point E (next page), and access points derived from them are omitted. The security threat related to the newly added access point is basically created by inheriting the security threat of the upper access point.

Access point security threats are inherited by the following procedure.

1) Among the access points at the higher analysis level, for the access point a with a younger order relation of the belonging components,
1-1) The security threat at the access point a is replicated as a security threat at the access point derived from the access point a.

  The security threat at access point D was replicated as a method of using the security threat at access points D-1, D-2, and D-3.

1-2) Regarding copied security threats
1-2-1) In the “from” and “where” portions, the same element as the belonging component of the access point of the higher analysis level is replaced with the belonging component of the duplicated access point.

  1-2-2) When the component type of the belonging component is a component, “where” and “what” do not satisfy the inclusion relationship of the component information, and are included in the belonging component Replace the component type with “Program” and replace “What” with “Use”.

  The security threat (identification number 1) at access point D-1 is “Web server document data” before the change, and does not satisfy the inclusion relationship. For this reason, “What” was replaced from document data to Web software. When there is a higher order component, “From” is replaced with the higher order component.

  In the security threat at access point D-2 (identification number 1), “from where” was replaced with the higher-level component Web server. If it is a communication path, replace “how” with “sniff”.

  In the security threat at access point D-3 (identification number 1), "how to" was replaced with "tapping".

  1-4) Delete those that are not security threats as a result of inheritance.

  1-3) If a duplicated security threat exists, go to 1-2).

2) If there are other access points of higher analysis level, go to 1).

3) End FIG. 25 shows a security threat related to the access point E, which is a continuation of the storage example at the analysis level 2 of the security threat information stored in the security threat information storage means 9. Hereinafter, the security threat input unit, the security threat verification support unit, and the countermeasure implementation level input unit are processed in the same manner as in the analysis level 1 and thus are omitted.

It is a block diagram which shows the structure of the security analysis assistance system of this invention. 1 is a system configuration diagram of a document management system used as a security threat analysis target. FIG. FIG. 6 is a diagram showing a display example of a graphical language editor provided by the analysis target input means 1. FIG. 5 is a diagram showing an example of storage at the analysis level 1 of the component element definition among the component element information stored in the component element information storage unit 7. FIG. 5 is a diagram showing an example of storage at the analysis level 1 of the component connection relation among the component element information stored in the component element information storage unit 7. FIG. 5 is a diagram showing an example of storage at the analysis level 1 of the component element inclusion relationship among the component element information stored in the component element information storage unit 7. 6 is a diagram showing a display example of a graphical language editor provided by access point extraction means 2. FIG. FIG. 10 is a diagram showing a display example of an access point utilization method input unit 3 when an access point part is clicked in a graphical language editor provided by the access point extraction unit 2; 7 is a diagram showing an example of storage at the analysis level 1 of access point information stored in the access point information storage means 8. FIG. 6 is a diagram showing a display example of a graphical language editor provided by the security threat input means 4. FIG. FIG. 10 is a diagram showing a display example of security threat editing means 5 displayed when an access point is clicked in the graphical language editor provided by access point extracting means 2. 7 is a diagram showing an example of storage at security level 1 of security threat information stored in security threat information storage means 4. FIG. FIG. 11 is a view showing a display example of a security threat classification condition setting window of the security threat verification support means 6. FIG. 14 is a diagram showing a display example of security threat classification results based on the classification conditions of FIG. 13 by the security threat verification support means 6. It is a figure which shows the example of a display of the classification result to which the three new security threats extracted by the security threat verification assistance means 6 were added. It is a figure which shows the display in the analysis level 1 of a countermeasure implementation level. It is a figure which shows the security threat information to which the countermeasure implementation level was set. FIG. 6 is a diagram showing a display example of a graphical language editor provided by the analysis target input means 1. It is a figure which shows the example of a storage in the analysis level 2 of a component element definition among the component element information stored in the component element information storage means 7. FIG. It is a figure which shows the example of a storage in the analysis level 2 of the component connection relation among the component information stored in the component information storage means 7. FIG. FIG. 5 is a diagram showing a storage example at an analysis level 2 of component element inclusion relationships among the component element information stored in the component element information storage unit 7. 6 is a diagram showing a display example of a graphical language editor provided by access point extraction means 2. FIG. It is a figure which shows the example of a storage in the analysis level 2 of the access point information stored in an access point information storage means. It is a figure which shows the example of a storage in the analysis level 2 of the security threat information stored in the security threat information storage means 9. FIG. FIG. 10 is a diagram showing a continuation of an example of storage of security threat information stored in security threat information storage means 9 at analysis level 2;

Explanation of symbols

1 Analytical input method
2 Access point extraction means
4 Security threat input means
6 Security threat verification support means

Claims (3)

Based on the component input information input by the analysis target input unit, the analysis target input unit that inputs the component element information including the name, type, connection relationship, and inclusion relationship of the component configuring the system to be analyzed. Access point extracting means for extracting access points between elements, and security threat input means for inputting security threat information indicating what kind of attack is likely to be applied to the access points extracted by the access point extracting means And a security threat analysis support system for classifying the security threat information based on a predetermined condition. A step of inputting component element information consisting of names, types, connection relationships, and inclusion relationships of components constituting the system to be analyzed, and a step of extracting access points between the components based on the input component element information And inputting security threat information indicating what kind of attack is likely to be applied to the extracted access point, and classifying the security threat information based on a predetermined condition. A characteristic security threat analysis support method. A step of inputting component element information consisting of names, types, connection relationships, and inclusion relationships of components constituting the system to be analyzed, and a step of extracting access points between the components based on the input component element information And a step of inputting security threat information indicating what kind of attack is likely to be applied to the extracted access point, and a step of classifying the security threat information based on a predetermined condition. Security threat analysis support program to be executed.

Images