Illegal module identifying device, information processing device, illegal module identifying method, illegal module identifying program, integrated circuit, illegal module disabling system, and illegal module disabling method

A malicious-module identification method used in a malicious-module identification device for identifying and deactivating a malicious module operating on an information processing device connected to the malicious update module identification device via a network, the malicious update module identification method comprising the steps of:

• receiving results of tampering detection from a plurality of modules performing tampering detection;
• assuming that a module among the plurality of modules is a normal module, determining, based on the assumption, whether a contradiction is detected in the received results of tampering detection, and identifying the module assumed to be a normal module as a malicious module when determining that a contradiction is detected;
• and
• outputting an instruction to deactivate the module identified as the malicious module,
• wherein the determining whether the contradiction is detected includes:
• storing an identifier of a module assumed to be a normal module;
• selecting a module among the plurality of modules, assuming that the module is a normal module, and storing an identifier of the module in an assumed normal module group storage unit;
• repeating, starting from the module assumed to be a normal module, a process of assuming that a module in which tampering is not detected is a normal module and storing the corresponding identifier in the assumed normal module group storage unit;
• determining whether a contradiction is detected in results of tampering detection by modules corresponding to the identifiers stored in the assumed normal module group storage unit;
• and
• identifying, when it is determined that a contradiction is detected, the module assumed to be a normal module as a malicious module.

A malicious-module identification program stored on a non-transitory storage medium for identifying and deactivating a malicious module operating on an information processing device connected to the malicious update module identification device via a network, the malicious update module identification program causing a malicious-module identification device to perform the steps of:

• receiving results of tampering detection from a plurality of modules performing tampering detection;
• assuming that a module among the plurality of modules is a normal module, determining, based on the assumption, whether a contradiction is detected in the received results of tampering detection, and identifying the module assumed to be a normal module as a malicious module when determining that a contradiction is detected;
• and
• outputting an instruction to deactivate the module identified as the malicious module,
• wherein the determining whether the contradiction is detected includes:
• storing an identifier of a module assumed to be a normal module,
• selecting a module among the plurality of modules, assuming that the module is a normal module, and storing an identifier of the module in an assumed normal module group storage unit;
• repeating, starting from the module assumed to be a normal module, a process of assuming that a module in which tampering is not detected is a normal module and storing the corresponding identifier in the assumed normal module group storage unit;
• determining whether a contradiction is detected in results of tampering detection by modules corresponding to the identifiers stored in the assumed normal module group storage unit;
• and
• identifying, when it is determined that a contradiction is detected, the module assumed to be a normal module as a malicious module.

An integrated circuit used in a malicious-module identification device for identifying and deactivating a malicious module operating on an information processing device connected to the malicious update module identification device via a network, the integrated circuit comprising:

• a hardware processor configured to operate as:
• a reception unit that receives results of tampering detection from a plurality of modules performing tampering detection;
• a determination unit that assumes that a module among the plurality of modules is a normal module, to determine, based on the assumption, whether a contradiction is detected in the received results of tampering detection, and to identify the module assumed to be a normal module as a malicious module when determining that a contradiction is detected;
• and
• a deactivation unit that outputs an instruction to deactivate the module identified as the malicious module,
• wherein the determination unit includes:
• an assumed normal module group storage unit that stores an identifier of the module assumed to be normal module;
• an assumption unit that selects a module among the plurality of modules, assumes that the module is a normal module, and stores an identifier of the module in the assumed normal module group storage unit;
• an assumed normal module group generation unit that repeats, starting from the module assumed to be a normal module by the assumption unit, a process of assuming that a module in which tampering is not detected is a normal module and storing the corresponding identifier in the assumed normal module group storage unit;
• a contradiction detection unit that determines whether a contradiction is detected in results of tampering detection by modules corresponding to the identifiers stored in the assumed normal module group storage unit;
• and
• an identification unit that identifies, when the contradiction detection unit determines that a contradiction is detected, the module assumed by the assumption unit to be a normal module as a malicious module.

A malicious-module deactivation system including an information processing device and a malicious-module identification device for identifying and deactivating a malicious module operating on the information processing device,

• the information processing device comprising:
• an encrypted application program including confidential data;
• a protection control module that protects the confidential data;
• and
• a plurality of update modules that update software and verify each other for tampering,
• the malicious-module identification device comprising:
• a hardware processor configured to operate as:
• a reception unit that receives results of tampering detection from the plurality of update modules;
• a determination unit that assumes that an update module among the plurality of modules is a normal module, to determine, based on the assumption, whether a contradiction is detected in the received results of tampering detection, and to identify the update module assumed to be a normal module as a malicious module when determining that a contradiction is detected;
• and
• a deactivation unit that outputs, to the information processing device, an instruction to deactivate the update module identified as the malicious module,
• wherein the determination unit includes:
• an assumed normal module group storage unit that stores an identifier of the module assumed to be a normal module;
• an assumption unit that selects a module among the plurality of modules, assumes that the module is a normal module, and stores an identifier of the module in the assumed normal module group storage unit;
• an assumed normal module group generation unit that repeats, starting from the module assumed to be a normal module by the assumption unit, a process of assuming that a module in which tampering is not detected is a normal module and storing the corresponding identifier in the assumed normal module group storage unit;
• a contradiction detection unit that determines whether a contradiction is detected in results of tampering detection by modules corresponding to the identifiers stored in the assumed normal module group storage unit;
• and
• an identification unit that identifies, when the contradiction detection unit determines that a contradiction is detected, the module assumed by the assumption unit to be a normal module as a malicious module.

A malicious-module deactivation method used in a malicious-module deactivation system including an information processing device and a malicious-module identification device for identifying and deactivating a malicious module operating on the information processing device,

• the information processing device comprising:
• an encrypted application program including confidential data;
• a protection control module that protects the confidential data;
• and
• a plurality of update modules that update software and verify each other for tampering,
• the malicious-module deactivation method comprising the steps of:
• a mutual tampering detection step in which the plurality of update modules perform mutual tampering detection;
• receiving results of the tampering detection from the plurality of update modules;
• assuming that an update module among the plurality of update modules is a normal module, determining, based on the assumption, whether a contradiction is detected in the received results of tampering detection, and identifying the update module assumed to be a normal module as a malicious module when determining that a contradiction is detected;
• and
• outputting an instruction to deactivate the module identified as the malicious module,
• wherein the determining whether the contradiction is detected includes:
• storing an identifier of a module assumed to be a normal module;
• selecting a module among the plurality of modules, assuming that the module is a normal module, and storing an identifier of the module in an assumed normal module group storage unit;
• repeating, starting from the module assumed to be a normal module, a process of assuming that a module in which tampering is not detected is a normal module and storing the corresponding identifier in the assumed normal module group storage unit;
• determining whether a contradiction is detected in results of tampering detection by modules corresponding to the identifiers stored in the assumed normal module group storage unit;
• and
• identifying, when it is determined that a contradiction is detected, the module assumed to be a normal module as a malicious module.