Security verification method and device

• US 7,176,791 B2
• Filed: 12/10/2004
• Issued: 02/13/2007
• Est. Priority Date: 12/11/2003
• Status: Expired due to Fees

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Sakaki, Hiroshi, Fujiwara, Toru, Ishihara, Yasunori, Yoshida, Maki
• Primary Examiner(s): TRIEU, VAN THANH
• Application Number:
  US11/009,297
• Publication Number:
  US 20050144475A1
• Time in Patent Office: 795 Days
• Field of Search: 340/500, 340/502, 340/506, 380/216, 380/229, 710/11, 710/14, 711/161, 711/162, 726/26
• US Class Current: 340/502
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security verification method for verifying whether improper settings that indicate composite errors of security settings exist in an object system, which is an object of examination, includes steps of: reading data transfer paths that represent data movement in the object system and that are generated based on program operation information that describes operations of a program that is used in the object system, integrating the access rights of data transfer paths that have been read; and searching for improper paths among the data transfer paths for which access rights have been integrated based on security verification policies in which improper paths, which are paths of data movement that are improper from the standpoint of security, have been set in advance.

Claims

1. A security verification method for verifying whether improper settings that indicate composite errors of security settings exist in an object system, said method comprising the steps of:

reading data transfer paths that represent data movement in said object system and that have been generated based on program operation information that describes operations of a program that is used in said object system;

integrating access rights of data transfer paths that have been read; and

based on security verification policies in which improper paths, which are paths of data movement that are improper from a standpoint of security, have been set in advance, searching for improper paths among data transfer paths for which access rights have been integrated.

2. The method according to claim 1, comprising the step of, based on the program operation information, searching composite security settings that allow data movement on improper paths that have been discovered.

3. The method according to claim 2, comprising the step of displaying the composite security settings that have been discovered are displayed.

4. The method according to claim 1, further comprising the steps of:

collecting setting information that indicates security settings in the object of system;

generating data transfer paths based on the setting information that has been collected and the program operation information; and

storing the data transfer paths that have been generated for use in the integration of the access rights.

5. The method according to claim 1, further comprising the steps of:

converting data transfer paths for which the access rights have been integrated to data of tree structure; and

searching whether paths that match the improper paths that are indicated by the security verification policies exist among the data transfer paths that have been converted to data of tree structure.

6. A security verification method for verifying whether improper settings that indicate composite errors of security settings exist in an object system, said security verification method comprising the steps of:

storing in a storage device an operation model that represents operation contents of said object system and that is generated based on program operation information that describes operations of a program that is used said object system; and

verifying whether data movement that is represented by security verification policies in which data movement that is proper or improper from a standpoint of security has been set in advance conform with the operation contents of said object system that is represented by the operation model that has been stored in said storage device.

7. A security verification device for verifying whether improper settings that indicate composite errors of security settings exist in an object system;

said security verification device comprising;

data transfer path storage means for storing data transfer paths that indicate data movement in said object system and that have been generated based on program operation information that describes operations of a program that is used in said object system;

access right integration means for integrating access rights of data transfer paths that represent data movement in said object system that have been stored in said data transfer path storage means; and

search means for, based on security verification policies in which improper paths, which are paths of data movement that is improper from a standpoint of security, have been set in advance, searching for improper paths among data transfer paths for which access rights have been integrated.

8. The device according to claim 7, further comprising:

security settings search means for, based on said program operation information, searching for composite security settings that allow data movement on improper paths that have been discovered by said search means.

9. The device according to claim 8, further comprising:

search results display means for displaying composite security settings that have been discovered by said security settings search means.

10. The device according to claim 7, further comprising:

search result output means for displaying improper paths that have been discovered by said search means.

11. The device according to claim 7, comprising:

setting information storage means for storing setting information;

setting information collection means for collecting setting information that indicates the security settings in said object system and that is stored in said setting information storage means;

program operation information storage means for storing program operation information that describes the operations of a program that is used in said object system; and

data transfer path generation means for generating data transfer paths based on setting information that has been collected by said setting information collection means and program operation information that is stored in said program operation information storage means;

wherein said data transfer path generation means stores data transfer paths that have been generated in said data transfer path storage means.

12. The device according to claim 7, wherein:

said search means is provided with data conversion means for converting data transfer paths for which access rights have been integrated to data of tree structure; and

said search means searches to determine whether paths exist among data transfer paths that have been converted by said data conversion means that match with improper paths that are indicated by security verification policies.

13. A security verification device for verifying whether improper settings that indicate composite errors of security settings exist in an object system;

said security verification device comprising;

setting information storage means for storing setting information;

setting information collection means for collecting setting information that indicates security settings in said object system and that is stored in said setting information storage means;

program operation information storage means for storing program operation information that describes operations of a program that is used in said object system; and

data transfer path generation means for generating data transfer paths based on setting information that has been collected by said setting information collection means and program operation information that is stored in said program operation information storage means.

14. A security verification device for verifying whether improper settings that indicate composite errors of security settings exist in an object system;

said security verification device comprising;

operation model storage means for storing operation model that represents operation contents of said object system and that is generated based on program operation information that describes operations of a program that is used in said object system; and

verification means for verifying whether the operation contents of said object system that are represented by operation model that have been stored in said operation model storage means conform with relevant data movement that is represented by security verification policies in which data movement that is proper or improper from a standpoint of security has been set in advance.

15. The device according to claim 14, wherein said operation model that represents operation contents of said object system and that is stored in said operation model storage means are generated based on:

host information relating to a host that makes up said object system;

network connection expression information that represents the network configuration of said object system;

user information that represents a user that is affiliated with said hosts;

file information that represents a storage site of data;

service information that represents a service that is offered to said user by means of said object system;

access control information that represents access authority of said user;

network access information that represents filtering in a communication network;

authority acquisition relation information of a network service that represents authority acquisition relations between users that use the communication network; and

cascade relation information that represents a service that, when said user have used said service to acquire access right of another user, can be used by said user through said access right of said another user.

16. The device according to claim 15, wherein security verification policies are described by logical expressions that include:

data flow relation information that represents data movement, or authority acquisition relation information, cascade relation information, and access control information.

17. A security verification device for verifying whether improper settings that indicate composite errors of security settings exist in an object system that is connected to a communication network;

said security verification device comprising;

search means for searching for improper paths among data transfer paths that represent data movement in said object system based on security verification policies in which improper paths, which are paths of data movement that are improper from a standpoint of security, have been set in advance; and

security setting search means for, based on program operation information that describes operations of a program that is used in said object system, searching for composite security settings that allow data movement on improper paths that have been discovered by said search means.

18. The device according to claim 17, further comprising search result display means for displaying composite security settings that have been discovered by said security settings search means.

19. The device according to claim 17, further comprising:

access integration means for integrating access rights of data transfer paths based on said program operation information;

wherein said search means includes data conversion means for converting data transfer paths for which access rights have been integrated to data of tree structure; and

wherein said search means searches to determine existence of paths for which improper paths that are indicated by security verification policies match with data transfer paths that have been converted by said data conversion means.

20. A program product for verifying whether improper settings that indicate composite errors in security settings exist in an object system;

said program product causing a computer to execute steps of;

reading data transfer paths that represent data movement in an object system and that are generated based on program operation information that describes operations of a program that is used in said object system;

integrating access rights of data transfer paths that have been read; and

searching for improper paths among data transfer paths for which access rights have been integrated based on security verification policies in which improper paths, which are paths of data movement that is improper from a standpoint of security, have been set in advance.

21. The program product according to claim 20 for causing said computer to further execute a step of, based on said program operation information, searching for composite security settings that allow data movement on improper paths that have been discovered.

22. The program product according to claim 21 for causing said computer to further execute a step of displaying composite security settings that have been discovered.

23. The program product according to claim 20 for causing said computer to further execute steps of:

collecting setting information that indicates security settings in said object system; and

generating data transfer paths based on setting information that has been collected and program operation information that describes operations of a program that is used by said object system;

wherein data transfer paths that have been generated are used in the integration of access rights.

24. The program product according to claim 20 for causing said computer to further execute steps of:

converting data transfer paths for which access rights have been integrated to data of tree structure; and

searching to determine whether paths exist for which improper path that are indicated by security verification policies match with data transfer paths that have been converted to data of tree structure.

25. A program product for verifying whether improper settings that indicate composite errors of security settings exist in an object system, said program product causing a computer to execute steps of:

storing in a storage device operation models that represent operation contents of said object system and that are generated based on program operation information that describes operations of a program that is used by said object system; and

verifying whether data movement that is represented by security verification policies in which data movement that is proper or improper from a standpoint of security has been set in advance conforms with operation contents of said object system that are represented by operation models that are stored in said storage device.