Falsification detection device and falsification detection method for software

The present invention relates to software tampering detection technology, and is suitable for use in a computer system whose specifications such as a PC (personal computer) have been published.

Conventionally, when it is necessary to protect the rights of programs and data in general software products, the rights are protected by obfuscating or encrypting the programs and data. However, as seen in the PC environment, in an environment where users can easily tamper with software using various tools, the above-mentioned rights protection method is merely a time-saver. For example, even if a program or data is encrypted, the encryption strength is meaningless because it is decrypted by software.

Technology for detecting or preventing fraud such as software tampering is required, and a tampering detection method using hardware is effective. This is a method in which external hardware is installed to compare with the correct answer prepared in advance, and the external hardware is used to monitor whether the program, data, or the like has been tampered with.

In addition, a virus diagnosis function for computer viruses is generated in the object program itself, which is software, and the object program itself detects alteration of the object program due to virus infection (see, for example, Patent Document 1). ..

<patcit num="1"><text>JP-A-7-146788</text></patcit>

<p> However, when tampering is prevented by using hardware as described above, tampering other than the data code confirmed at the time of execution can be detected and prevented, but the tampering of the data code confirmed at the time of execution is There was a problem that it was difficult to detect and prevent. In other words, tampering with static storage areas such as program code and fixed data that are fixed at compile time can be easily prevented, but dynamically data such as data created at runtime (at the start of execution or during execution) It was very difficult to prevent tampering with the changing storage area.</p><p> For example, the program code string executed by the CPU is a pointer to the program code (dynamic link library: DLL) linked at runtime and the functions allocated in the stack or heap at runtime, in addition to the main program expanded in the user space. (Including instances such as classes), and can be thought of as a one-dimensional column that is executed sequentially under the influence of function pointers in the data area, and does not deviate from this column.</p><p> However, anywhere in this column, the program or data is tampered with to branch to the program code prepared by the attacker, adding processing necessary for the attacker or skipping unnecessary processing (skipping unnecessary processing). After performing the processing such as, it is possible to create a bypass such as returning to the regular route again. As described above, the data code determined before execution, that is, the data code in the static memory area can be protected by using the hardware together, but this protection is not sufficient. The pointer to the function included in the so-called class instance, which is expanded on the stack or heap, is fixed at the time of execution. For example, the number of instances and the memory position are the data stored in the dynamic storage area and are external. It is not something that can be easily identified from. Therefore, it is difficult to check by the above-mentioned conventional method, and even if it is performed, it is very inefficient, and there is a possibility that data in a dynamic storage area such as a function pointer in the stack or heap may be tampered with and bypassed. There is.</p><p> The present invention has been made in view of such a problem, and an object of the present invention is to enable detection of tampering with a dynamic storage area.</p>

<p> The tampering detection device of the software of the present invention has a static storage area in which information determined before the execution of the processing related to the program code is stored and the tampering of the information is periodically inspected, and is changed according to the execution of the processing. A storage means having a dynamic storage area for storing information, an area information storage means for storing address information indicating the range of the static storage area, and an address information stored in the dynamic storage area are referred to and statically. When executing processing based on the information stored in the target storage area, the information is determined by determining whether or not the address information referenced from the dynamic storage area specifies the range of the static storage area. It is provided with a detection means for detecting tampering.</p><p> According to the above configuration, whether or not the address information stored in the dynamic storage area referred to for performing control processing such as branch processing and return processing specifies the range of the static storage area. By checking, it becomes possible to detect falsification of the address information stored in the dynamic storage area. If the referenced address information does not specify the range of the static storage area, it can be detected that the address information stored in the dynamic storage area has been tampered with.</p>

<p> According to the present invention, static storage that stores information that has been determined before execution of processing by referring to address information stored in a dynamic storage area that stores information that can be changed with the execution of processing. When executing a process based on the information stored in the area, it is determined whether or not the address information referenced from the dynamic storage area specifies the range of the static storage area. As a result, if the address information referenced from the dynamic storage area does not specify the range of the static storage area, it is detected that the address information stored in the dynamic storage area has been tampered with. Can be done. Therefore, it is possible to detect falsification of the information stored in the dynamic storage area and prevent falsification of the information only by a simple comparison of the address information.</p>

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a hardware configuration example of a computer system 100 to which a manipulation detection device according to an embodiment of the present invention is applied.

As shown in FIG. 1, the computer system 100 in the present embodiment includes a CPU 101, a ROM 102, a RAM 103, a keyboard controller (KBC) 105 of a keyboard (KB) 109, and a CRT display (CRT) 110 as a display unit. The CRT controller (CRTC) 106, the disk controller (DKC) 107 of the hard disk (HD) 111 and the flexible disk (FD) 112, the network interface card (NIC) 108, and the tamper detection device (DTC) 114 are on the system bus. It is configured so that it can communicate with each other via 104.

The CPU 101 comprehensively controls and executes each component connected to the system bus 104 by executing the software (program) stored in the ROM 102 or the HD 111 or the software (program) supplied from the FD 112. Achieve desired software-based functionality. That is, the CPU 101 controls to realize the required operation by reading the processing program for realizing the desired function from the ROM 102, the HD 111, or the FD 112 and executing the program.

RAM103 functions as the main memory or work area of CPU101. The RAM 103 has a static storage (memory) area in which the program code and fixed data are stored as described later, and the presence or absence of data tampering is periodically detected by the tampering detection device (DTC) 114, and is determined at the time of execution. It consists of a dynamic storage (memory) area where data is stored.

KBC105 controls instruction input from KB109, a pointing device (not shown), or the like. CRTC106 controls the display of CRT110. The DKC107 controls access to HD111 and FD112, which store boot programs, various applications, user files, network management programs, processing programs, and the like. NIC 108 is for exchanging data in both directions with other devices on the network 113.

The tampering detection device (DTC) 114 periodically stores data stored in a static storage area (for example, a user program area) in which program codes and fixed data loaded from ROM 102, HD 111, or FD 112 are stored in RAM 103 or the like. Detect whether or not tampering has been performed. As the tampering detection device 114, a known tampering detection mechanism that periodically checks a static storage area by hardware may be applied.

FIG. 2A is a block diagram showing a functional configuration example of the computer system shown in FIG. Note that FIG. 2 (A) shows only the main feature parts for realizing tampering detection in the computer system.

In FIG. 2A, the processing execution unit 201 reads and executes the program code loaded in the memory 202, and performs control and the like to realize a desired operation. When executing the program code, the processing execution unit 201 refers to the data stored in the memory 202 as necessary. The memory 202 includes a static storage area 202a and a dynamic storage area 202b, and the static storage area 202a stores the loaded program code and fixed data that does not change when the program code is executed, and operates. Data that can be changed when the program code is executed (for example, data in the stack or heap) is stored in the typical storage area 202b.

The first tampering detection unit 203 corresponds to the tampering detection device 114 shown in FIG. 1, is configured by hardware, and stores data (program code) in the static storage area 202a in the memory 202. Includes.) Is checked regularly to detect whether or not it has been tampered with. Specifically, the first tampering detection unit 203 determines the correct answer data for determining whether or not the data stored in the static storage area 202a is correct (not tampered with). It is held outside or inside, and the data stored in the static storage area 202a is compared with the correct answer data to determine whether or not it has been tampered with.

In this way, the first tampering detection unit 203 periodically checks the static storage area 202a in the memory 202 including the user program area and the like so that fraud cannot be performed. Therefore, the invalid bypass code cannot be allocated in the memory space (static storage area 202a) where the legitimate (program) code exists. When the first tampering detection unit 203 determines as a result of the determination that the data stored in the static storage area 202a has been tampered with, the first tampering detection unit 203 notifies the processing execution unit 201 or the outside. Is also good.

The second tampering detection unit 204 detects whether or not the data stored in the dynamic storage area 202b in the memory 202 has been tampered with, and the address comparison unit 205, the determination unit 206, And has a detection information storage unit 207.

The address comparison unit 205 returns to the static storage area 202a by referring to the data stored in the dynamic storage area 202b during program code execution by the processing execution unit 201, for example, in return processing or branch processing. Alternatively, when branching, the address specified as the return destination or branch destination is compared with the address information stored in the static area information storage unit 208. The static area information storage unit 208 stores in advance address information (for example, the start address and end address of the area) indicating the area range of the static storage area 202a in the memory 202.

That is, the address comparison unit 205 performs processing based on the data stored in the dynamic storage area 202b, and then performs processing based on the data stored in the static storage area 202a. In this case, the address value indicating the range of the static storage area 202a stored in the static area information storage unit 208 is compared with the address specified as the return destination or the branch destination.

The determination unit 206 determines whether or not the data stored in the dynamic storage area 202b has been tampered with or otherwise fraudulently based on the comparison result of the address comparison unit 205. Specifically, the determination unit 206 dynamically stores the comparison result of the address comparison unit 205 when the address specified as the return destination or the branch destination is not included in the static storage area 202a. It is determined that the data in region 202b has been tampered with.

When the detection information storage unit 207 determines that the data in the dynamic storage area 202b has been tampered with by the determination unit 206, for example, the fraudulent location or the content of the fraud is fraudulent. Memorize the information related to. The fraudulent information stored in the detection information storage unit 207 can be read from the outside. Therefore, by analyzing the information related to the fraud stored in the detection information storage unit 207, it is possible to take countermeasures against the detected fraud.

If the determination unit 206 determines that the data in the dynamic storage area 202b has been tampered with or otherwise fraudulent, the determination unit 206 may immediately take measures against the fraud, but the detection information storage unit 207 is fraudulent. By memorizing the information related to the fraud and taking measures against the fraud detected later, it is possible to prevent the fraud detected in which operation from being identified as the fraudulent one, and higher falsification. A preventive effect can be expected.

In FIG. 2A, the memory 202 is composed of a static storage area 202a and a dynamic storage area 202b, that is, both the static storage area 202a and the dynamic storage area 202b are included. Although the case of being composed of one continuous area is shown as an example, the division of the area in the memory is arbitrary, and as shown in FIG. 2 (B), for example, a plurality of static storage areas 209a, 209c, The memory 209 may be divided into 209e and a plurality of dynamic storage areas 209b, 209d, and 209f.

When the memory 209 area is divided as shown in FIG. 2 (B), the first tampering detection unit 203 detects the presence or absence of tampering with the static storage areas 209a, 209c, and 209e, and the second tampering detection unit 203 detects the presence or absence of tampering. The detection unit 204 detects whether or not the dynamic storage areas 209b, 209d, and 209f have been tampered with. At this time, the static area information storage unit 208 stores the address information indicating each of the static storage areas 209a, 209c, and 209e in a table or the like.

Next, the operation of the computer system to which the above-described tampering detection device according to the present embodiment is applied will be described with reference to specific examples. In the following description, the "protected area" is a static in the memory 202 in which the data (including the program code) is periodically examined by the first tampering detection unit 203 and the tampering is detected. It is a storage area, and as described above, an invalid bypass code (illegal code) cannot be secured in the area. On the other hand, the "unprotected area" is a dynamic storage area in the memory 202 in which data tampering is detected by the second tampering detection unit 203.

(Operation Example 1) FIGS. 3 and 4 are diagrams for explaining a specific operation example of the computer system in the present embodiment.

For example, as shown in Fig. 3 (A), process A is executed (step S1), and then in branch process 1, addresses such as pointers (function pointers of variables, pointers to virtual function tables in class instances), etc. Consider the case where branching / control is performed with reference to the value P1 (step S2) and process B is executed (step S3). Process A, branch process 1, and process B of steps S1 to S3 are executed based on the program code and data in the protected area. Further, the address value P1 referred to in the branch processing 1 is generated while the program is operating, that is, is dynamically generated, and is stored in an unprotected area.

When executing the process shown in FIG. 3 (A), according to the prior art, the address value for reading the invalid code string C1 inserted in the unprotected area (the invalid code string C1 is stored). By specifying the address value) as the address value P1 referenced in branch processing 1 and the branch destination address related to processing B in the invalid code C1, processing A branch processing as shown in Fig. 3 (B). It is possible to execute the process as 1 invalid code process B, and execute the process according to the invalid code C1 before executing the process B.

In the computer system of the present embodiment, when the process execution unit 201 executes the process shown in FIG. 3 (A), the process is executed as shown in FIG. First, process A is executed based on the program code and data in the area protected in step S1.

Next, when branching from the code string in the area protected by the branch process 1 in step S2, the address value P1 indicating the branch destination by the second tampering detection unit 204 in step S1A, which is the previous stage of step S2. Authenticate related to. That is, in step S1A, the second tampering detection unit 204 evaluates the address value P1 indicating the branch destination, and determines whether or not the branch destination is within the protected area.

Specifically, in step S1A, the address comparison unit 205 refers to the branch destination address value P1, and the address information indicating the range of the static storage area 202a stored in the static area information storage unit 208. Compare with. As a result of the comparison, when the address value P1 is within the range of the static storage area 202a, the determination unit 206 determines that the falsification has not been performed. On the other hand, if the address value P1 is not within the static storage area 202a, the determination unit 206 determines that the address value P1 has been tampered with, and stores the fraudulent information in the detection information storage unit 207. To do.

After that, in the branch process 1 in step S2, the branch process is executed with reference to the address value P1, and then the invalid code C1 and the process B in step S3 are sequentially executed.

(Operation Example 2) FIGS. 5 and 6 are diagrams for explaining another specific operation example of the computer system in the present embodiment.

As shown in FIG. 5 (A), process A is executed (step S11), then branch process 1 refers to the address value P11 and branches to process B (step S12), and process B is executed (step S12). S13). Further, consider a case where the process B is executed, the process B is returned to the process C by referring to the address value P12 in the return process 1 (step S14), and the process C is executed (step S15). Process A, branch process 1, process B, return process 1, and process C in steps S11 to S15 are executed based on the program code and data in the protected area, and the address value referred to in branch process 1 is executed. P11 is stored in the protected area. On the other hand, the address value P12 referred to in the return process 1 is dynamically generated while the program is operating, and is stored in an unprotected area (stack).

When executing the process shown in FIG. 5 (A), according to the prior art, the address value in which the invalid code string C11 inserted in the unprotected area is stored is referred to in the return process 1. By specifying the address value P12 and specifying the return destination address related to the process C in the invalid code C11, as shown in Fig. 5 (B), the return process 1 responds to the invalid code C11 before executing the process C. It is possible to execute the processing.

In the computer system of the present embodiment, when the process execution unit 201 executes the process shown in FIG. 5 (A), the process is executed as shown in FIG. First, process A is executed based on the program code and data in the protected area in step S11. Next, in the branch process 1 in step S12, the branch process is executed with reference to the address value P11 stored in the protected area, and the process B is executed in step S13.

Subsequently, when returning by referring to the address value P12 outside the area protected by the return process 1 in step S14, the return destination is determined by the second tampering detection unit 204 in step S13A, which is the previous stage of step S14. Authenticate the indicated address value P12. In the process in step S13A, similarly to step S1A in FIG. 5 described above, the second tampering detection unit 204 evaluates the address value P12 indicating the return destination, and whether or not the return destination is within the protected area. To judge.

After that, in the return process 1 in step S14, the return process is executed with reference to the address value P12, and then the invalid code C11 and the process C in step S15 are sequentially executed.

In operation examples 1 and 2, if falsification of the address value stored in the unprotected area is detected, countermeasures against fraud (stop processing, etc.) may be taken immediately, but refer to as described above. By executing the fraudulent codes C1 and C11 according to the specified address value and taking countermeasures against the fraud detected later, it is possible to prevent the fraud detected in which operation from being identified as the fraudulent one. , Higher tamper-proof effect can be expected. Further, in the operation examples 1 and 2, the branch processing and the return processing are shown as an example, but the protected area is protected by referring to arbitrary information stored in the unprotected area such as the stack, heap, and call stack. It can be applied to any process that shifts to control (process) based on the program code and data stored in.

As described above, according to the present embodiment, the static storage area (protected area) 202a in the memory 202 in which the program code and fixed data that have already been determined at the time of execution are stored is the first. The tampering detection unit 203 periodically checks for tampering. In addition, the dynamic storage area (unprotected area) 202b in the memory 202 where data that can be changed at the time of execution such as the branch address and return address expanded in the stack or heap is stored is dynamically stored. When the control process based on the program code and data stored in the static storage area 202a is executed with reference to the address stored in the area 202b, the second tampering detection unit 204 dynamically stores the storage area. It is determined whether the address obtained from 202b specifies the range of the static storage area, and the presence or absence of tampering is checked.

As a result, if the address referenced from the dynamic storage area 202b in the memory 202 does not specify the range of the static storage area 202a, the address stored in the dynamic storage area 202b is tampered with. It is possible to detect what has been done, and in addition to the presence or absence of tampering with the static storage area 202a, it is possible to detect tampering with the dynamic storage area 202b and prevent tampering with information by simply comparing addresses. it can.

Further, the code such as a function in the protected area may not be directly called from the code existing in the unprotected area. Specifically, the call stack is read at the entrance of the function in the protected area, and if the read address specifies the outside of the protected area, that is, the unprotected area, it is considered to be invalid. .. This makes it possible to prevent the code in the protected area from being called by malicious code existing in the unprotected area.

In addition, when using a dynamic link library (DLL) that is dynamically linked when the program code is executed so that it can be shared with other software applications, etc., tampering and fraud are prevented in advance and secure. If it is a DLL, it is possible to prevent tampering or fraud by transferring control after authenticating that it is legitimate when transferring control to it. It can be confirmed that the DLL is legitimate by comparing it with the correct answer data stored in the pre-protected area by using, for example, a hash or the like.

On the other hand, in the case of an insecure DLL, when using the DLL, it may be statically linked (statically linked) in advance and included in the protected area, or a DLL whose safety has been confirmed by providing an authentication unit. Creating and using replicas in a protected area (if used by other applications, with the same code but in a different DLL) or being bypassed by malicious code within the DLL will have an impact. It is possible to prevent falsification and fraud by transferring control after performing appropriate processing so that it does not reach the limit.

It should be noted that the above embodiments are merely examples of embodiment of the present invention, and the technical scope of the present invention should not be construed in a limited manner by these. That is, the present invention can be implemented in various forms without departing from the technical idea or its main features. Various aspects of the present invention are shown below as additional notes.

(Appendix 1) A static storage area in which information determined before executing processing related to the program code including at least the program code is stored and tampering of the information is periodically inspected, and execution of processing related to the program code. A storage means having a dynamic storage area for storing information that can be changed in accordance with the above, an area information storage means for storing address information indicating the range of the static storage area in the storage means, and the dynamic storage area. When the processing based on the information stored in the static storage area is executed with reference to the address information stored in the dynamic storage area, the address information referred to from the dynamic storage area is stored in the area information storage means. It is characterized by comprising a detection means for determining whether or not the range of the static storage area indicated by the address information is specified and detecting falsification of the information stored in the dynamic storage area. Software tamper detection device. (Appendix 2) When the detection means detects falsification of information stored in the dynamic storage area, it further stores information related to the detected falsification, and falsification of the software according to Appendix 1. Detection device. (Appendix 3) The detection means is a comparison means for comparing the address information referenced from the dynamic storage area with the address information stored in the area information storage means, and the dynamic storage based on the comparison result by the comparison means. The software tampering detection device according to Appendix 1 or 2, further comprising a determination means for determining whether or not the address information referred to from the area specifies the range of the static storage area. (Appendix 4) Any of Appendix 1 to 3, wherein the address information stored in the dynamic storage area is at least one of the branch destination address in the branch processing and the return address in the return processing according to the program code. The software tampering detection device described in item 1. (Appendix 5) Before executing the branch processing or the return processing related to the program code, the address information is specified within the range of the static storage area by referring to the address information stored in the dynamic storage area. The software tampering detection device described in Appendix 4, which is characterized in determining whether or not the software is to be tampered with. (Appendix 6) The software tampering detection device according to any one of Supplementary note 1 to 5, wherein at least one of the static storage area and the dynamic storage area in the storage means is a plurality of and each is a continuous area. (Appendix 7) A static storage area in which information determined before executing processing related to the program code including at least the program code is stored and tampering of the information is periodically inspected, and execution of processing related to the program code. This is a method for detecting tampering with software in an information processing system including a storage unit having a dynamic storage area in which information that can be changed in accordance with the above is stored, and the address information stored in the dynamic storage area is referred to. When processing based on the information stored in the static storage area is executed, the address information referred to from the dynamic storage area is statically defined in advance by the address information indicating the range of the static storage area. A determination step of determining whether or not the range of the storage area is specified, and a detection step of detecting falsification of information stored in the dynamic storage area based on the determination result in the determination step. A method for detecting tampering with software, which comprises the above. (Appendix 8) When the falsification of the information stored in the dynamic storage area is detected in the detection step, the additional feature is that the detection information storage step further stores the information related to the detected falsification in the storage unit. 7 How to detect tampering with the software described.

<figref num="1">It is a block diagram which shows the hardware configuration example of the computer system which applied the tampering detection apparatus by this Embodiment.</figref><figref num="2">It is a block diagram which shows the functional structure example of the computer system in this embodiment.</figref><figref num="3">It is a figure for demonstrating the specific operation example of the computer system in this embodiment.</figref><figref num="4">It is a figure for demonstrating the specific operation example of the computer system in this embodiment.</figref><figref num="5">It is a figure for demonstrating another concrete operation example of the computer system in this embodiment.</figref><figref num="6">It is a figure for demonstrating another concrete operation example of the computer system in this embodiment.</figref>

Code description

100 Computer system 101 CPU 102 ROM 103 RAM 104 System bus 114 Manipulation detection device 201 Processing execution unit 202 Memory 202a Static storage area 202b Dynamic storage area 203 First tampering detection unit 204 Second tampering detection unit 205 Address Comparison unit 206 Judgment unit 207 Detection information storage unit 208 Static area information storage unit