Method, apparatus, system and computer program for identifying and responding to quantum vulnerability using dynamic analysis for application
The disclosure relates to a method, an apparatus, a system, and a computer program for identifying and responding to quantum vulnerability with respect to an application by using a dynamic analysis agent and, specifically, as a method of identifying quantum vulnerability with respect to an application by using a computing apparatus, the disclosure may include an operation of identifying one or more cryptographic associated functions performed in an application based on analysis of a code, executed while the application is in an operating state, by using a dynamic analysis agent corresponding to the application, an operation of calculating, based on the one or more cryptographic associated functions, a cryptography algorithm list used in the application, and an operation of identifying, based on the cryptography algorithm list, quantum vulnerability with respect to the application.
1 . A method of identifying quantum vulnerability with respect to an application by using a computing apparatus, the method comprising:
identifying one or more cryptography-associated functions performed in an application while the application executes in an operating state and based on analysis of a code, executed while the application is in an operating state, by using a dynamic analysis agent corresponding to the application;
based on the one or more cryptography-associated functions, calculating a runtime cryptography algorithm list used in the application by intercepting application-programming-interface (API) calls made by the application to cryptography libraries and extracting, from arguments passed to the APIs during execution, algorithm identifiers actually used at runtime; and
based on the cryptography algorithm list, identifying quantum vulnerability with respect to the application.
2 . The method of claim 1 , further comprising correcting, by using the dynamic analysis agent, a code area corresponding to the quantum vulnerability identified in the application that is in the operating state.
3 . The method of claim 1 , wherein the dynamic analysis agent is configured to identify quantum vulnerability with respect to the application by using a rule set configured based on a predetermined configuration file for the application.
4 . The method of claim 1 , wherein the application and the dynamic analysis agent are configured to interoperate with each other in one same process.
5 . The method of claim 4 , wherein the dynamic analysis agent is configured to identify quantum vulnerability with respect to the application that is in the operating state by using intercepting for the application.
6 . The method of claim 2 , wherein the corrected code area is applied to the application, and
wherein configuration is made so that, upon subsequent recalls of the application, the application executes the corrected code without loading the dynamic analysis agent.
7 . The method of claim 2 , wherein a degree of effect on the application is verified by using a code to which the corrected code area is applied by executing, in parallel, an instance with the corrected code and an instance without the corrected code and comparing results to confirm functional equivalence.
8 . The method of claim 1 , wherein, in the calculating, the dynamic analysis agent calculates a cryptography algorithm list used for the application specifically while calling and executing an API of the one or more cryptography-associated functions and logging the algorithm identifiers passed to the API at runtime.
9 . A server comprising a processor and a memory, and configured to identify quantum vulnerability with respect to an application,
wherein the memory comprises instructions configured to cause, when executed by the processor, the server to perform a predetermined operation comprising:
identifying one or more cryptography-associated functions executed in the application while the application executes in an operating state and based on analysis of a code, executed while the application is in an operating state, by using a dynamic analysis agent corresponding to the application;
calculating, based on the one or more cryptography-associated functions, a runtime cryptography algorithm list used in the application by intercepting API calls made by the application to cryptography libraries and extracting, from arguments passed to the APIs during execution, algorithm identifiers actually used at runtime; and
identifying, based on the cryptography algorithm list, the quantum vulnerability with respect to the application by comparing the extracted algorithm identifiers to a configuration-file-defined rule set and, responsive to a vulnerable algorithm, rewriting at runtime a corresponding code region to invoke a PQC algorithm and persisting the rewritten code such that subsequent executions of the application omit loading the dynamic analysis agent.
10 . The server of claim 9 , wherein the predetermined operation further comprises correcting, by using the dynamic analysis agent, a code area corresponding to the quantum vulnerability identified in the application that is in the operating state.
11 . The server of claim 9 , wherein the dynamic analysis agent is configured to identify the quantum vulnerability with respect to the application by using a rule set configured based on a predetermined configuration file for the application.
12 . The server of claim 9 , wherein the application and the dynamic analysis agent are configured to interoperate with each other in one same process.
13 . The server of claim 12 , wherein the dynamic analysis agent is configured to identify the quantum vulnerability with respect to the application that is in the operating state, by using intercepting for the application.
14 . The server of claim 10 , wherein the corrected code area is applied to the application, and
wherein configuration is made so that, upon subsequent recalls of the application, the application executes the corrected code without loading the dynamic analysis agent.
15 . The server of claim 10 , wherein a degree of effect on the application is verified using a code to which the corrected code area is applied by executing, in parallel, an instance with the corrected code and an instance without the corrected code and comparing results to confirm functional equivalence.
16 . The server of claim 9 , wherein, in the calculating, the dynamic analysis agent is configured to calculate a cryptography algorithm list used for the application specifically while calling and executing an API of the one or more cryptography-associated functions and logging the algorithm identifiers passed to the API at runtime.
17 . A non-transitory computer-readable storing medium that stores instructions configured to, when executed by a processor, cause a server to implement a predetermined operation, the server including the processor and identifying quantum vulnerability with respect to an application, and the predetermined operation comprising:
identifying one or more cryptography-associated functions executed in the application based on analysis of a code, executed when the application is in an operating state, by using a dynamic analysis agent corresponding to the application;
based on the one or more cryptography-associated functions, calculating a runtime cryptography algorithm list used in the application by intercepting API calls to cryptography libraries and extracting algorithm identifiers passed at runtime; and
based on the cryptography algorithm list, identifying quantum vulnerability with respect to the application by consulting a configuration-file-defined rule set and, responsive to identifying a vulnerable algorithm, rewriting a corresponding code region at runtime to invoke a PQC algorithm and persisting the rewritten code for subsequent executions without loading the dynamic analysis agent.