DATA DEPENDENCE ANALYZER, INFORMATION PROCESSOR, DATA DEPENDENCE ANALYSIS METHOD AND PROGRAM

• US 20110239309A1
• Filed: 11/25/2009
• Published: 09/29/2011
• Est. Priority Date: 12/08/2008
• Status: Active Grant

• Current Assignee: IP Wave Pte. Ltd.
• Original Assignee: NEC Corporation
• Inventors: Yanoo, Kazuo
• Granted Patent: US 9,027,123 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A data dependence analyzer includes: inter-process communication detection means which, on the basis of a processing content of inter-process communication performed for transferring data to be copied between resources, detects the inter-process communication; access detection means which successively detects an access event to the data in the resource due to the process; recording means which, for each of the access events detected by the access detection means, records the access target data in the access event; and analysis means which, among the access target data recorded by the recording means, searches data respectively corresponding to the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means and imparts a dependence relationship between the searched data.

Claims

1. A data dependence analyzer comprising:

inter-process communication detection means which, on the basis of processing content of inter-process communication, detects the inter-process communication performed for transferring data to be copied between resources;

access detection means which successively detects an access event to access the data in the resource during the process;

recording means which, for each of the access events detected by the access detection means, records the access target data in the access event; and

analysis means which, from among the access target data recorded by the recording means, searches data respectively corresponding to the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means and imparts a dependence relationship between the searched data.

2. The data dependence analyzer according to claim 1, wherein, on the basis of the type of protocol used in inter-process communication and on the basis of processing content in the inter-process communication, the inter-process communication detection means detects inter-process communication for transferring data to be copied between the resources.

3. The data dependence analyzer according to erclaim 1,

wherein the recording means further records the capacity of the access target data by associating the capacity of the access target data with the access event, and

wherein the analysis means further defines the degree of the dependence relationship on the basis of the capacity associated with the copy source data and with the copy destination data.

4. The data dependence analyzer according to claim 1, wherein the analysis means searches data written to the resource by the communication destination process in the inter-process communication detected by the inter-process communication detection means, so as to set the searched data as copy destination data, and searches data read from the resource by the communication source process in the inter-process communication befbre the copy destination data is written, so as to set the searched data as copy source data.

5. The data dependence analyzer according to claim 1, further comprising

definition information defining a write system call which is called by a process of writing data to a resource, and an argument to which transfer source data in the write system call is set,

wherein, when the write system call is issued by the process, the recording means further stores, on the basis of the definition information, the transfer source data set to the argument by associating the transfer source data with the access target data, and

wherein the analysis means searches data written in the resource by the communication destination process in the inter-process communication detected by the inter-process communication detection means, so as to set the searched data as copy destination data, and sets, as copy source data, the transfer source data associated with the copy destination data.

6. The data dependence analyzer according to claim 1,

wherein a security level representing a degree of confidentiality is set to the resource,

the data dependence analyzer further comprising security level acquisition means which, when data is read from the resource, acquires the security level set to the resource,

wherein the recording means further records the security level acquired by the security level acquisition means by associating the security level with the access target data, and wherein, from among access target data associated with the security level higher than a predetermined value, the analysis means searches data respectively corresponding the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means.

7. The data dependence analyzer according to claim 6, wherein, when data is written to a resource, the security level acquisition means further acquires the security level set to the resource,

the data dependence analyzer further comprising write means which, when writing, to the write destination resource, data read from a resource as a read source, writes the data to the write destination resource if the security level of the write destination resource, acquired by the security level acquisition means, is lower than the security level of the read source resource, acquired by the security level acquisition means.

8. The data dependence analyzer according to claim 6, further comprising:

encryption means which, when data is written to a resource, acquires the security level set to the resource and encrypts the data to write the encrypted data to the resource if the acquired security level is higher than the predetermined value; and

decryption means which, when the data written by the encryption means is read from the resource, acquires the security level set to the resource and decrypts the data on the basis of the security level.

9. A data dependence analysis method,

wherein, on the basis of processing content of inter-process communication, inter-process communication detection means detects the inter-process communication performed for transferring data to be copied between resources,

wherein access detection means successively detects an access event to access the data in the resource during the process,

wherein, for each of the access events detected by the access detection means, recording means records the access target data in the access event, and

wherein, from among the access target data recorded by the recording means, analysis means searches data respectively corresponding to the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means and imparts a dependence relationship between the searched data.

10. (canceled)