Data dependence analyzer, information processor, data dependence analysis method and program

• US 9,027,123 B2
• Filed: 11/25/2009
• Issued: 05/05/2015
• Est. Priority Date: 12/08/2008
• Status: Active Grant

• Current Assignee: IP Wave Pte. Ltd.
• Original Assignee: NEC Corporation
• Inventors: Yanoo, Kazuo
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Shepperd, Eric W
• Application Number:
  US13/132,233
• Publication Number:
  US 20110239309A1
• Time in Patent Office: 1,987 Days
• Field of Search: 726 26- 27, 726/30, 726/32, 726 22- 24, 713/189, 713/193, 380/201, 707/646, 707/648, 707/695, 707/703, 719/312, 719/320, 719/329, 714/25, 714/27, 714/37, 714/39
• US Class Current: 726/22
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A data dependence analyzer includes: inter-process communication detection means which, on the basis of a processing content of inter-process communication performed for transferring data to be copied between resources, detects the inter-process communication; access detection means which successively detects an access event to the data in the resource due to the process; recording means which, for each of the access events detected by the access detection means, records the access target data in the access event; and analysis means which, among the access target data recorded by the recording means, searches data respectively corresponding to the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means and imparts a dependence relationship between the searched data.

Claims

1. A data dependence analyzer comprising:

inter-process communication detection means which, on a basis of processing content of inter-process communication, detects the inter-process communication performed for transferring data to be copied between resources;

access detection means which successively detects access events to access the data in the resources during the inter-process communication;

dynamic information flow analysis means which checks the transfer of data in the inter-process communication until data read from a resource to the inter-process communication is written out by the inter-process communication and which adds a tag corresponding to a first resource to a memory buffer when data from the first resource is read to the memory buffer, and outputs information representing that a second resource is dependent on the first resource, when the data in the memory buffer is written to the second resource;

recording means which, for each of the access events detected by the access detection means, records an access target data in the access event; and

analysis means which, from among the access target data recorded by the recording means, searches data respectively corresponding to a copy source and a copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means and imparts a dependence relationship between the searched data,

wherein the analysis means searches data written to a resource by a communication destination process in the inter-process communication detected by the inter-process communication detection means, so as to set the searched data as copy destination data, and searches data read from the resource by a communication source process in the inter-process communication before copy destination data is written, so as to set the searched data as copy source data.

2. The data dependence analyzer according to claim 1, wherein, on a basis of a type of protocol used in inter-process communication and on a basis of processing content in the inter-process communication, the inter-process communication detection means detects inter-process communication for transferring data to be copied between the resources.

3. The data dependence analyzer according to claim 1,

wherein the recording means further records capacity of the access target data by associating the capacity of the access target data with the access event, and

wherein the analysis means further defines a degree of the dependence relationship on a basis of the capacity associated with copy source data and with copy destination data.

4. The data dependence analyzer according to claim 1, further comprising

definition information defining a write system call which is called by a process of writing data to a resource, and an argument to which transfer source data in the write system call is set,

wherein, when the write system call is issued by the process of writing data, the recording means further stores, on a basis of the definition information, the transfer source data set to the argument by associating the transfer source data with the access target data, and

wherein the analysis means searches data written in a resource by a communication destination process in the inter-process communication detected by the inter-process communication detection means, so as to set the searched data as copy destination data, and sets, as copy source data, the transfer source data associated with the copy destination data.

5. The data dependence analyzer according to claim 1,

wherein a security level representing a degree of confidentiality is set to a resource,

the data dependence analyzer further comprising security level acquisition means which, when data is read from the resource, acquires the security level set to the resource,

wherein the recording means further records the security level acquired by the security level acquisition means by associating the security level with the access target data, and wherein, from among access target data associated with the security level higher than a predetermined value, the analysis means searches data respectively corresponding to the copy source and the copy destination of the data transferred through the inter-process communication detected by the inter-process communication detection means.

6. The data dependence analyzer according to claim 5, wherein, when data is written to a resource, the security level acquisition means further acquires a security level of the write destination resource,

the data dependence analyzer further comprising write means which, when writing, to the write destination resource, data read from a resource as a read source, writes the read data to the write destination resource if the security level of the write destination resource, acquired by the security level acquisition means, is higher than a security level of the read source resource, acquired by the security level acquisition means.

7. The data dependence analyzer according to claim 5, further comprising:

encryption means which, when data is written to a resource, acquires a security level set to the write resource and encrypts data to write the encrypted data to the write resource if the acquired security level is higher than a predetermined value; and

decryption means which, when the encrypted data written by the encryption means is read from a read resource, acquires a security level set to the read resource and decrypts the encrypted data on a basis of the security level of the read resource.

8. A data dependence analysis method, comprising:

detecting inter-process communication performed for transferring data to be copied between resources using an inter-process communication detection unit;

detecting access events to access the data in the resources during the inter-process communication using an access detection unit;

checking the transfer of data in the inter-process communication until data read from a resource to the inter-process communication is written out by the inter-process communication using a dynamic information flow analysis unit;

adding a tag corresponding to a first resource to a memory buffer when data from the first resource is read to the memory buffer, and outputting information representing that a second resource is dependent on the first resource, when the data in the memory buffer is written to the second resource;

recording an access target data in the access event for each of the access events detected using a recording unit; and

searching, from among the access target data recorded, data respectively corresponding to a copy source and a copy destination of the data transferred through the inter-process communication detected and imparting a dependence relationship between the searched data using an access unit.