Apparatus and method for processing information and program

Abstract

To determines whether or not to permit an access to information asset based on a risk for the access to the information asset.SOLUTION: An apparatus for processing information comprises an access-attribute presuming section that presumes an access attribute representing an attribute for an access request for information asset sent from a terminal device to the information asset, a likelihood calculating section that calculates a likelihood for the access attribute, an access-risk calculating section that calculates an access risk for the access request using the likelihood, and a determining section that determines whether or not to permit the access request for the information asset based on the access risk.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, an information processing method, and a program that executes access control. [Background technology]

[0002] 2. Description of the Related Art Techniques for analyzing access to information assets held by an organization are known in order to protect the information assets from threats.

[0003] As a related technique, Patent Document 1 discloses a policy generation device that automatically defines an access control policy. The policy generation device of Patent Document 1 acquires, for a plurality of elements related to access control, relationship data indicating relationships between the plurality of elements and score data in which at least one of a score based on the viewpoint of access risk and a score based on the viewpoint of access need is defined, and generates an access control policy using the relationship data and the score data.

[0004] As a related technique, Patent Document 2 discloses an information processing device that grants a secure access right even when authentication accuracy is low. The information processing device of Patent Document 2 first obtains an index value indicating the possibility that the person to be authenticated is a plurality of registered users based on the degree of agreement between a feature amount extracted from authentication information acquired from the person to be authenticated and each of the features of a plurality of registered users whose features have been acquired in advance. Next, the information processing device sets a composite access right by combining the access right of a certain user among the plurality of users to a plurality of resources and the access right of another user other than the certain registered user among the plurality of registered users based on the index value. Next, the information processing device permits the person to be authenticated to access the resource to which access is set as permitted by the composite access right. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] International Publication No. 2022 / 244179 [Patent Document 2] JP 2018-142198 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, the technologies in Patent Documents 1 and 2 do not adequately evaluate the risks associated with access to information assets, and therefore may result in excessive access restrictions relative to acceptable risks, or in allowing access that involves unacceptable risks.

[0007] One example of the objective of the present disclosure is to determine whether or not to permit access to an information asset based on the risk of accessing the information asset taking into account the likelihood. [Means for solving the problem]

[0008] In order to achieve the above object, an information processing device according to one aspect of the present disclosure includes: an access attribute estimation unit that estimates an access attribute representing an attribute of an access request for an information asset transmitted from a terminal device to the information asset; a likelihood calculation unit for calculating a likelihood for the access attribute; an access risk calculation unit that calculates an access risk for the access request using the likelihood; a determination unit that determines whether or not to permit the access request to the information asset based on the access risk; The present invention is characterized by having the following.

[0009] In order to achieve the above object, an information processing method according to one aspect of the present disclosure includes: An information processing device, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; Calculating a likelihood for the access attribute; calculating an access risk for the access request using the likelihood; determining whether to permit the access request to the information asset based on the access risk; It is characterized by:

[0010] Furthermore, in order to achieve the above object, a program according to one aspect of the present disclosure includes: On the computer, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; Calculating a likelihood for the access attribute; calculating an access risk for the access request using the likelihood; determining whether or not to permit the access request to the information asset based on the access risk; It is characterized by: Effect of the Invention

[0011] As described above, according to the present disclosure, it is possible to determine whether or not to permit access to an information asset based on the risk to the access to the information asset taking into account the likelihood. [Brief description of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an information processing device according to the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of a system including an information processing device according to the present disclosure. [Diagram 3] FIG. 3 is a diagram for explaining an example of the estimation of an access attribute and the calculation of a likelihood according to the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining an example of the estimation of an access attribute and the calculation of a likelihood according to the present disclosure. [Diagram 5] FIG. 5 is a diagram for explaining an example of calculation of an access risk according to the present disclosure. [Figure 6]FIG. 6 is a diagram for explaining an example of the operation of the information processing device of the present disclosure. [Figure 7] FIG. 7 is a diagram for explaining an example of calculation of an access risk according to the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of the configuration of a system including an information processing device according to the present disclosure. [Figure 9] FIG. 9 is a diagram for explaining an example of calculation of access needs according to the present disclosure. [Figure 10] FIG. 10 is a diagram for explaining an example of access permission of the present disclosure. [Figure 11] FIG. 11 is a diagram for explaining an example of the operation of the information processing device of the present disclosure. [Figure 12] FIG. 12 is a diagram for explaining an example of access permission of the present disclosure. [Figure 13] FIG. 13 is a diagram illustrating an example of the configuration of a system according to the present disclosure. [Figure 14] FIG. 14 is a diagram illustrating an example of a computer that realizes an information processing device according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment will be described with reference to the drawings. In the drawings described below, elements having the same or corresponding functions are denoted by the same reference numerals, and repeated description thereof may be omitted.

[0014] (Embodiment 1) The first embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram for explaining an example of the configuration of an information processing device of the present disclosure.

[0015] [Device configuration] 1, the information processing device 10 determines whether to permit access based on the risk of access to an information asset. Also, in the example of Fig. 1, the information processing device 10 has an access attribute estimation unit 11, a likelihood calculation unit 12, an access risk calculation unit 13, and a determination unit 14.

[0016] The access attribute estimation unit 11 estimates an access attribute that indicates an attribute of an access request to an information asset, the access attribute being transmitted from a terminal device to the information asset.

[0017] The access attributes include, for example, information representing the user of the terminal device (user identification information), information representing the role of the user (user role information), information representing the label of the information asset (information asset label information), etc. However, the access attributes are not limited to the above-mentioned user identification information, user role information, and information asset label information.

[0018] The user identification information is, for example, information for identifying a user who is using a terminal device. The user role information is, for example, information indicating the position and affiliation of each user in an organization to which the user belongs.

[0019] The information asset label information is, for example, information indicating the classification of the information asset, information indicating whether or not personal information is included in the information asset, etc. The classification information is, for example, information indicating whether or not a file held by the information asset is confidential information, etc. Personal information is, for example, customer information included in a file held by the information asset, etc.

[0020] The likelihood calculation unit 12 calculates the likelihood for the access attribute. The likelihood is calculated for each of, for example, user identification information, user role information, and information asset label information. The likelihood calculation (likelihood calculation process) may be performed, for example, by a program that can calculate the likelihood. The access attribute estimation unit 11 and the likelihood calculation unit 12 may be configured as an integrated element. In other words, they may be configured to derive the attribute for an access request to an information asset together with its likelihood.

[0021] The access risk calculation unit 13 calculates an access risk for an access request using the likelihood. Specifically, the access risk calculation unit 13 first derives an attribute risk for each combination of access attributes. Next, the access risk calculation unit 13 calculates an access risk for the access request using the derived attribute risk and the likelihood.

[0022] The attribute risk is calculated by, for example, referring to attribute risk assessment information that has been created in advance and stored in a storage device and that associates combinations of access attributes with attribute risks, and deriving the attribute risk corresponding to the combination of access attributes.

[0023] In addition, the attribute risk may be derived by, for example, inputting a combination of access attributes into an attribute risk derivation model. The attribute risk derivation model is, for example, a trained machine learning model.

[0024] The attribute risk derivation model may be created, for example, by using as learning data data for a set of access requests, with combinations of access attributes as explanatory variables and label information indicating whether access is permitted or not as the objective variable.

[0025] The set of access requests may be a list of expected accesses by an administrator or the like. Alternatively, the set of access requests may be extracted from past access logs. Furthermore, each access attribute and a label indicating whether or not access is permitted may be set by an administrator or the like.

[0026] The access risk is calculated, for example, by using a weighted sum of likelihoods of multiple likelihoods for each access attribute included in the combination and an attribute risk derived for each combination of access attributes.

[0027] In addition, the access risk for the access request may be derived by inputting a combination of access attributes and a likelihood for each combination of access attributes into an access risk derivation model. The access risk derivation model is, for example, a trained machine learning model.

[0028] The access risk derivation model may be created, for example, by using data for a set of access requests, in which each combination of access attributes and the likelihood of each combination of access attributes are used as explanatory variables, and label information indicating whether access is allowed or not is used as the objective variable.

[0029] The set of access requests may be a list of expected accesses by an administrator or the like. Alternatively, the set of access requests may be extracted from past access logs. Furthermore, each access attribute and a label indicating whether or not access is permitted may be set by an administrator or the like.

[0030] The determination unit 14 determines whether or not to permit an access request to an information asset based on the access risk. Specifically, the determination unit 14 permits an access request to an information asset when the access risk is equal to or less than a preset threshold. On the other hand, the determination unit 14 does not permit an access request to an information asset when the access risk exceeds a preset threshold.

[0031] In this way, in the first embodiment, it is possible to determine whether or not to permit access based on the risk associated with access to an information asset.

[0032] [System Configuration] A system 100 including the information processing device 10 will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining an example of the configuration of a system including the information processing device of the present disclosure.

[0033] 2, the system 100 includes an information processing device 10, terminal devices 20 (20a, 20b,...), information assets 30 (30a, 30b,...), and an output device 40. The information processing device 10, the terminal devices 20 (20a, 20b,...), the information assets 30 (30a, 30b,...), and the output device 40 are connected to a network. However, the output device 40 does not necessarily have to be provided in the system 100.

[0034] The network is a general network constructed using communication lines such as the Internet, a LAN (Local Area Network), a dedicated line, a telephone line, an in-house network, a mobile communication network, Bluetooth (registered trademark), or Wi-Fi (Wireless Fidelity) (registered trademark).

[0035] The information processing device 10 is, for example, an information processing device such as a CPU (Central Processing Unit), a programmable device such as an FPGA (Field-Programmable Gate Array), a GPU (Graphics Processing Unit), or a circuit equipped with any one or more of them, a server computer, a personal computer, a mobile terminal, etc. The information processing device 10 may be provided in a device such as a communication device.

[0036] The terminal devices 20 (20a, 20b, etc.) are, for example, information processing devices such as a CPU, an FPGA, or a circuit equipped with one or more of them, a personal computer, or a mobile terminal.

[0037] The information assets 30 (30a, 30b, etc.) are, for example, a CPU, or an FPGA, or a circuit equipped with one or more of these, a storage device such as a database, an information processing device such as a server computer, or various control devices, or files, services, or APIs (Application Programming Interfaces) provided on these.

[0038] The output device 40 acquires the output information converted into an outputtable format, and outputs the generated image and sound based on the output information. The output device 40 is, for example, an image display device using a liquid crystal, an organic EL (Electro Luminescence), or a CRT (Cathode Ray Tube). Furthermore, the image display device may also include an audio output device such as a speaker. The output device 40 may also be a printing device such as a printer.

[0039] The information processing device 10 will now be described in detail. 2, the information processing device 10 includes an access attribute estimation unit 11, a likelihood calculation unit 12, an access risk calculation unit 13, a determination unit 14, and an output information generation unit 15. However, the output information generation unit 15 does not necessarily have to be provided in the information processing device 10.

[0040] The access attribute estimation unit 11 first receives an access request for the information asset 30 when the request is transmitted from the terminal device 20 to the information asset 30 (each time an access request occurs). Next, the access attribute estimation unit 11 estimates the attribute (access attribute) of the received access request. Next, the access attribute estimation unit 11 outputs the estimated access attribute to the likelihood calculation unit 12.

[0041] Specifically, the access attribute estimation unit 11 estimates the access attribute for the access request by referring to one or more of information included in the access request and information stored in advance in a storage device (not shown).

[0042] The one or more pieces of information are at least information such as past access logs, information regarding the network configuration within the organization, past communication status, statistical information on past communication status, information on past security audits, personnel information, asset register, NDR (Network Detection and Response), IDS (Intrusion Detection System), UEM (Unified Endpoint Management), firewall, EDR (Endpoint Detection and Response), AD (Active Directory) (registered trademark), and proxy logs.

[0043] Possible access attributes include the user, the user role (job title, affiliation), the confidentiality classification of the files held by the information asset, personal information contained in the files held by the information asset, as well as the security status of the equipment (host) on the network, the security status of the communication path, the type of device from which the access originates, etc. However, the access attributes are not limited to the attributes mentioned above.

[0044] The user (user identification information) and user role (user role information) are estimated based on, for example, past access logs. Also, the information asset label information (confidential classification of the files held by the information asset, personal information contained in the files held by the information asset) is estimated by, for example, executing natural language processing on the text contained in the files.

[0045] The host security state is estimated by estimating the presence, number, or severity of vulnerabilities contained in the host based on, for example, information on past vulnerability scans of the host and the number of days that have passed since a certain point in time. The certain point in time can be, for example, the date and time when a vulnerability scan was performed in the past, the date and time when the host was set up, the date and time when a security update for the host was performed, etc.

[0046] The security state of the communication path is estimated by, for example, estimating the protocol and encryption suite used for access.

[0047] The type of device from which the access originates is estimated, for example, by checking whether or not the content of other communications whose source IP address matches the access contains a signature that matches a predefined signature.

[0048] The likelihood calculation unit 12 first acquires an access attribute. Next, the likelihood calculation unit 12 calculates a likelihood for the acquired access attribute. Next, the likelihood calculation unit 12 outputs the calculated likelihood to the access risk calculation unit 13.

[0049] The likelihood calculation unit 12 will be described with reference to Fig. 3 and Fig. 4. Fig. 3 and Fig. 4 are diagrams for explaining an example of the estimation of an access attribute and the calculation of a likelihood according to the present disclosure.

[0050] FIG. 3 shows an example of estimating access attributes and calculating likelihoods for user attributes when the access source IP address is "192.168.0.x". In the example of FIG. 3, first, the access attribute estimation unit 11 refers to the access log 31, extracts records (rows) corresponding to the access source IP address "192.168.0.x", and derives user candidates as access attributes. Next, the likelihood calculation unit 12 refers to the access log 31, and extracts records (rows) corresponding to the access source IP address "192.168.0.x". Next, the likelihood calculation unit 12 calculates the likelihood for each user included in the extracted records.

[0051] In the example of Figure 3, the extracted records indicate that the user is either "User A," "User B," or "User D." Furthermore, as shown in Table 32, the number of extracted records is five, of which three are for user "User A," so the likelihood for "User A" (user attribute) is "0.6" (= 3 / 5). Furthermore, the likelihood for "User B" (user attribute) is "0.2" (= 1 / 5). Furthermore, the likelihood for "User D" (user attribute) is "0.2" (= 1 / 5).

[0052] Next, in the example of FIG. 4, the likelihood calculation unit 12 first extracts the user's job title with reference to the personnel information 41. Next, the likelihood calculation unit 12 calculates the likelihood for each extracted job title. In the example of FIG. 4, the user is one of "User A", "User B", and "User D", and among them, "User A" and "User D" have the position of section manager (position attribute). Therefore, the likelihood for the user's job title "section manager" (position attribute) is "0.8" by adding the likelihood of "User A" of "0.6" and the likelihood of "User D" of "0.2". In addition, among "User A", "User B", and "User D", only "User B" has the user's job title "regular employee", so the likelihood for the user's job title "regular employee" (position attribute) is "0.2" by using the likelihood of "User B" of "0.2".

[0053] Also, in the example of FIG. 4, the likelihood calculation unit 12 extracts the affiliation of the user with reference to the personnel information 41. Next, the likelihood calculation unit 12 calculates the likelihood for each extracted affiliation. In the example of FIG. 4, the user is one of "User A", "User B", and "User D", and only "User A" has the sales department (attribute of affiliation). Therefore, the likelihood for the user's affiliation "Sales Department" (attribute of affiliation) is "0.6" by using the likelihood of "User A" of "0.6". Also, among "User A", "User B", and "User D", "User B" and "User D" have the "Development Department" (attribute of affiliation), so the likelihood for the user's affiliation "Development Department" (attribute of position) is "0.4" by adding the likelihood of "User B" of "0.2" and the likelihood of "User D" of "0.2".

[0054] For attributes other than those mentioned above, the likelihood is calculated for each attribute using a predetermined calculation method that is set in advance. The calculation method may be any method that can calculate the likelihood for an attribute.

[0055] In addition, if there is an access attribute that can be used without estimation, the likelihood of that access attribute is set to 1.

[0056] The access risk calculation unit 13 first uses the estimated access attributes to generate a combination of the estimated access attributes. Next, the access risk calculation unit 13 derives an attribute risk for each combination of the access attributes. Note that the attribute risk is derived, for example, by using the attribute risk evaluation information or the attribute risk derivation model as described above.

[0057] Next, the access risk calculation unit 13 calculates an access risk for the access request using the derived attribute risk and the likelihood calculated by the likelihood calculation unit 12. Specifically, the access risk calculation unit 13 calculates an access risk (weighted sum by likelihood) using multiple likelihoods for each access attribute included in the combination and an attribute risk set for each combination of access attributes.

[0058] An example of calculation of an access risk will be described with reference to Fig. 5. Fig. 5 is a diagram for explaining an example of calculation of an access risk according to the present disclosure.

[0059] In the example of Fig. 5, a case will be described in which the combination of access attributes is a "host security status attribute" and a "secret classification attribute." In the example of Fig. 5, the likelihood of the "host security status attribute" is assumed to be "0.2" for "not vulnerable" and "0.8" for "vulnerable," as shown in likelihood information 51. In addition, the likelihood of the "secret classification attribute" is assumed to be "0.1" for "top secret," "0.7" for "secret," and "0.2" for "public," as shown in likelihood information 52 of Fig. 5.

[0060] Furthermore, the attribute risk assessment information 53 is set in advance to an attribute risk of "100" for the combination of (vulnerable, top secret), an attribute risk of "80" for the combination of (vulnerable, confidential), an attribute risk of "10" for the combination of (vulnerable, public), an attribute risk of "10" for the combination of (no vulnerability, top secret), an attribute risk of "5" for the combination of (no vulnerability, confidential), and an attribute risk of "0" for the combination of (no vulnerability, public).

[0061] Each of the attribute risks in the attribute risk assessment information 53 described above may be determined, for example, by experiments, simulations, or the like.

[0062] Under the above conditions, the access risk can be calculated using a weighted sum according to the likelihood as shown in Equation 1.

[0063] (Number 1) Access risk Ar=0.8×0.1×100 (vulnerable, top secret) +0.8×0.7×80 (vulnerable, confidential) +0.8×0.2×10 (vulnerable, public) +0.2×0.1×10 (No vulnerability, Top secret) +0.2×0.7×5 (no vulnerability, confidential) +0.2×0.2×0 (No vulnerability, publicly disclosed) =55.3

[0064] The access risk may be derived using an access risk derivation model. In this case, data in which a combination of access attributes and a likelihood corresponding to the combination of access attributes are associated with each other is input to the access risk derivation model, and an access risk for an access request is output.

[0065] The judgment unit 14 first acquires an access risk. Next, the judgment unit 14 judges whether or not the access risk is equal to or less than a preset threshold. Next, if the access risk is equal to or less than a preset threshold (judgment threshold), the judgment unit 14 permits an access request to the information asset. On the other hand, if the access risk exceeds the preset threshold, the judgment unit 14 does not permit an access request to the information asset.

[0066] The determination threshold value may be determined, for example, through experiments or simulations.

[0067] The output information generation unit 15 generates output information for outputting one or more of the access request, the estimated access attribute, the likelihood, the attribute risk, the access risk, the determination result, and statistical information thereof to the output device 40. Next, the output information generation unit 15 outputs the generated output information to the output device 40.

[0068] The information processing device 10 may store a log of the determination result for the access request in a storage device.

[0069] [Device operation] An example of the operation of the information processing device in the first embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram for explaining an example of the operation of the information processing device of the present disclosure. In the following description, the diagram will be referred to as appropriate. In addition, in the first embodiment, the information processing method is implemented by operating the information processing device. Therefore, the description of the information processing method in the first embodiment will be replaced with the description of the operation of the information processing device below.

[0070] As shown in FIG. 6, the access attribute estimation unit 11 estimates an access attribute that indicates an attribute of an access request to an information asset, the access attribute being transmitted from a terminal device to the information asset (step A1).

[0071] Specifically, in step A1, the access attribute estimation unit 11 first receives an access request for the information asset 30 transmitted from the terminal device 20 to the information asset 30. Next, in step A1, the access attribute estimation unit 11 estimates an attribute (access attribute) of the received access request. Next, the access attribute estimation unit 11 outputs the estimated access attribute to the likelihood calculation unit 12.

[0072] Next, the likelihood calculation unit 12 calculates the likelihood for the access attribute (step A2). Specifically, in step A2, first, the likelihood calculation unit 12 acquires the access attribute from the access attribute estimation unit 11. Next, in step A2, the likelihood calculation unit 12 calculates the likelihood for the acquired access attribute. Next, in step A2, the likelihood calculation unit 12 outputs the calculated likelihood to the access risk calculation unit 13. Note that step A1 and step A2 may be integrated into one step. That is, the attribute (access attribute) of the received access request may be estimated and its likelihood may be calculated.

[0073] The access risk calculation unit 13 calculates the access risk for the access request using the likelihood (step A3). Specifically, in step A3, first, the access risk calculation unit 13 uses the estimated access attributes to generate a combination of the estimated access attributes. Next, in step A3, the access risk calculation unit 13 derives an attribute risk for each combination of access attributes. The attribute risk is derived using, for example, attribute risk evaluation information or an attribute risk derivation model.

[0074] Next, in step A3, the access risk calculation unit 13 uses the derived attribute risk and the likelihood calculated by the likelihood calculation unit 12 to calculate an access risk for the access request.

[0075] Specifically, the access risk calculation unit 13 calculates the access risk (weighted sum by the likelihood) using multiple likelihoods for each access attribute included in the combination and an attribute risk set for each combination of access attributes. Alternatively, the access risk calculation unit 13 may derive the access risk using an access risk derivation model.

[0076] The judgment unit 14 judges whether or not to permit the access request to the information asset based on the access risk (step A4). Specifically, in step A4, the judgment unit 14 first acquires the access risk. Next, in step A4, the judgment unit 14 judges whether or not the access risk is equal to or less than a preset threshold. Next, in step A4, if the access risk is equal to or less than a preset threshold (judgment threshold), the judgment unit 14 permits the access request to the information asset. On the other hand, in step A4, if the access risk exceeds the preset threshold, the judgment unit 14 does not permit the access request to the information asset.

[0077] The output information generation unit 15 generates output information and outputs it to the output device 40 (step A5). Specifically, in step A5, the output information generation unit 15 generates output information for outputting one or more of the access request, the estimated access attribute, the likelihood, the attribute risk, the access risk, the judgment result, and statistical information thereof to the output device 40. Next, in step A5, the output information generation unit 15 outputs the generated output information to the output device 40. Note that step A5 may be omitted.

[0078] In this way, the information processing device 10 repeats the processes of steps A1 to A4. Note that the process of step A5 may also be repeated or may be executed as appropriate.

[0079] [Effects of the First Embodiment] As described above, according to the first embodiment, it is possible to determine whether or not to permit access based on the risk of access to an information asset. In particular, according to the first embodiment, the risk is evaluated taking into account the likelihood of the access attribute, so that it is possible to determine whether or not to permit access based on a more precise risk.

[0080] (Variation 1) Modification 1 will be described. The difference between embodiment 1 and modification 1 is that the likelihood calculation unit 12 calculates the likelihood for combinations using all the estimated access attributes. Note that in modification 1, the operations of the access attribute estimation unit 11, the access risk calculation unit 13, and the determination unit 14 are the same as those in embodiment 1, so detailed explanations will be omitted.

[0081] A case where the likelihood is calculated for a combination using all the estimated access attributes will be described with reference to Fig. 7. Fig. 7 is a diagram for explaining an example of calculation of an access risk according to the present disclosure.

[0082] 7, the estimated access attributes are "user affiliation attribute," "host security status attribute," and "personal information attribute." Table 71 shows the likelihood of the combination of the estimated access attributes.

[0083] That is, as shown in Table 71, the likelihood calculation unit 12 calculates the likelihood of (Sales Department, vulnerable, included) as "0.05", the likelihood of (Development Department, no vulnerability, included) as "0.40", the likelihood of (Development Department, no vulnerability, excluded) as "0.25", the likelihood of (General Affairs Department, no vulnerability, included) as "0.20", and the likelihood of (General Affairs Department, no vulnerability, excluded) as "0.10".

[0084] Next, the access risk calculation unit 13 derives the attribute risk by using, for example, the attribute risk evaluation information or the attribute risk derivation model as described above. For example, the attribute risk is derived by using the attribute risk evaluation information 72 shown in FIG.

[0085] Next, the access risk calculation unit 13 calculates an access risk for the access request using the derived attribute risk and the likelihood calculated by the likelihood calculation unit 12.

[0086] Each of the attribute risks in the attribute risk assessment information 72 described above may be determined, for example, by experiments, simulations, or the like.

[0087] Under the above conditions, the access risk is expressed as an equation representing a weighted sum according to the likelihood, as shown in Equation 2.

[0088] (Number 2) Access risk Ar = 0.05 x 20 (Sales department, vulnerable, included) +0.40×10 (Development department, no vulnerability, included) +0.25×0 (Development department, no vulnerability, not included) +0.20×100 (General Affairs Department, no vulnerability, included) +0.10×50 (General Affairs Department, no vulnerability, not included) =30

[0089] If the likelihood is small (below a preset exclusion threshold), the combination of access attributes with a small likelihood may be excluded. For example, in the example of Table 71, records (rows) with a likelihood of 0.05 or less, which is the exclusion threshold, are excluded.

[0090] Then, under the above conditions, the access risk is expressed as an equation representing a weighted sum according to the likelihood, as shown in Equation 3.

[0091] (Number 3) Access risk Ar = 0.40 x 10 (Development department, no vulnerability, included) +0.25×0 (Development department, no vulnerability, not included) +0.20×100 (General Affairs Department, no vulnerability, included) +0.10×50 (General Affairs Department, no vulnerability, not included) =29

[0092] In the above description, the access risk is calculated using an equation representing a weighted sum, but it may be derived using an access risk derivation model.

[0093] [Effects of Modification 1] As described above, according to the first modification, it is possible to determine whether or not to permit access based on the risk of access to an information asset. In particular, according to the first modification, since the risk is evaluated taking into account the likelihood of the access attribute, it is possible to determine whether or not to permit access based on a more precise risk.

[0094] [program] The program in the first embodiment and the first modification may be any program that causes a computer to execute steps A1 to A5 shown in Fig. 6. By installing and executing this program in a computer, the information processing device 10 and the information processing method in the first embodiment and the first modification can be realized. In this case, the processor of the computer functions as an access attribute estimation unit 11, a likelihood calculation unit 12, an access risk calculation unit 13, a determination unit 14, and an output information generation unit 15, and performs the processes.

[0095] The programs in the first embodiment and the first modification may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the access attribute estimation unit 11, the likelihood calculation unit 12, the access risk calculation unit 13, the determination unit 14, and the output information generation unit 15.

[0096] (Embodiment 2) A description will be given of the second embodiment. The difference between the first and second embodiments is that the access needs are used to determine whether or not to permit access to an information asset. In the second embodiment, the access attribute estimation unit 11, the likelihood calculation unit 12, and the access risk calculation unit 13 have been described in the first embodiment, so detailed description thereof will be omitted.

[0097] [System Configuration] A system 100a including an information processing device 10a will be described with reference to Fig. 8. Fig. 8 is a diagram for explaining an example of the configuration of a system including an information processing device according to the present disclosure.

[0098] 8, the system 100a includes an information processing device 10a, terminal devices 20 (20a, 20b,...), information assets 30 (30a, 30b,...), and an output device 40. The information processing device 10a, the terminal devices 20 (20a, 20b,...), the information assets 30 (30a, 30b,...), and the output device 40 are connected to a network. However, the output device 40 does not necessarily have to be provided in the system 100a.

[0099] Incidentally, the terminal devices 20 (20a, 20b, . . .), the information assets 30 (30a, 30b, . . .), and the output device 40 have been described in the first embodiment, so detailed description thereof will be omitted.

[0100] The information processing device 10a will now be described in detail. 8, the information processing device 10a includes an access attribute estimation unit 11, a likelihood calculation unit 12, an access risk calculation unit 13, an access needs calculation unit 81, a determination unit 82, and an output information generation unit 15. However, the output information generation unit 15 does not necessarily have to be provided in the information processing device 10a.

[0101] The access needs calculation unit 81 calculates the business access needs for the access request using the likelihood for the access attribute. The attribute needs of the attribute needs evaluation information indicate the degree of business necessity of the access having the attribute. The attribute needs may be determined, for example, by experiments, simulations, etc.

[0102] Specifically, the access needs calculation unit 81 first refers to attribute needs evaluation information that is stored in advance in a storage device (not shown) and that associates combinations of access attributes with attribute needs for each combination of access attributes, and determines attribute needs for each combination of estimated access attributes. The access needs calculation unit 81 derives attribute needs using the attribute needs evaluation information or an attribute needs derivation model, etc.

[0103] Next, the access needs calculation unit 81 calculates the access needs for the access request using the derived attribute needs and the likelihoods calculated by the likelihood calculation unit 12. Specifically, the access needs calculation unit 81 calculates the access needs (weighted sum by likelihoods) using multiple likelihoods for each access attribute included in the combination and the attribute needs set for each combination of access attributes.

[0104] An example of calculation of an access risk will be described with reference to Fig. 9. Fig. 9 is a diagram for explaining an example of calculation of access needs according to the present disclosure.

[0105] In the example of Fig. 9, a case will be described in which the combination of access attributes is "affiliation attribute" and "personal information attribute." In the example of Fig. 9, the likelihood of the "affiliation attribute" is assumed to be "0.3" for "Sales Department," "0.1" for "Development Department," and "0.6" for "General Affairs Department," as shown in likelihood information 91. In addition, the likelihood of the "personal information attribute" is assumed to be "0.7" for "include," and "0.3" for "not include," as shown in likelihood information 92 of Fig. 9.

[0106] Furthermore, in the attribute needs evaluation information 93, the attribute needs of "100" are set in advance for the combination of (Sales Department, included), the attribute needs of 50 for the combination of (Sales Department, not included), the attribute needs of "0" for the combination of (Development Department, included), the attribute needs of "50" for the combination of (Development Department, not included), the attribute needs of "30" for the combination of (General Affairs Department, included), and the attribute needs of "50" for the combination of (General Affairs Department, not included).

[0107] Each of the attribute needs in the attribute needs assessment information 93 described above may be determined, for example, by experiments, simulations, or the like.

[0108] Next, the access needs calculation unit 81 calculates the access needs. Under the above conditions, the access needs can be calculated using a weighted sum according to the likelihood as shown in Equation 4.

[0109] (Number 4) Access needs An = 0.3 x 0.7 x 100 (including sales department) +0.3×0.3×50 (Sales department not included) +0.1×0.7×0 (including development department) +0.1×0.3×50 (Development department not included) +0.6×0.7×30 (General Affairs Department, included) +0.6×0.3×50 (General Affairs Department, not included) =48.6

[0110] The access needs may be derived using an access needs derivation model. In this case, data in which a combination of access attributes and a likelihood corresponding to the combination of access attributes are associated with each other is input to the attribute needs derivation model, and the access needs for the access request are output.

[0111] The determination unit 82 determines whether or not to permit an access request to an information asset based on the access risk and the access needs. Specifically, the determination unit 82 first obtains the access risk calculated by the access risk calculation unit 13 and the access needs calculated by the access needs calculation unit 81.

[0112] Next, if the access needs exceed the access risks, the determination unit 82 permits the access request to the information asset, whereas if the access needs are equal to or greater than the access risks, the determination unit 82 does not permit the access request to the information asset.

[0113] Alternatively, the determination unit 82 determines whether or not to permit an access request to an information asset based on access permission information stored in advance in a storage device (not shown).

[0114] An example of access permission will be described with reference to Fig. 10. Fig. 10 is a diagram for explaining an example of access permission of the present disclosure. In the example of Fig. 10, access permission information 101 is referenced using access needs and access risks to determine whether or not to permit an access request to an information asset.

[0115] The output information generating unit 15 generates output information for outputting one or more of the access request, the estimated access attribute, the likelihood, the attribute risk, the access risk, the attribute needs, the access needs, the determination result, and statistical information thereof to the output device 40. Next, the output information generating unit 15 outputs the generated output information to the output device 40.

[0116] [Device operation] An example of the operation of the information processing device in the second embodiment will be described with reference to Fig. 11. Fig. 11 is a diagram for explaining an example of the operation of the information processing device of the present disclosure. In the following description, the diagram will be referred to as appropriate. Also, in the second embodiment, an information processing method is implemented by operating the information processing device. Therefore, the description of the information processing method in the second embodiment will be replaced with the description of the operation of the information processing device below.

[0117] In the operation of the second embodiment, first, the processes of steps A1 to A3 are executed as shown in Fig. 11. Note that the processes of steps A1 to A3 and A5 have already been explained, so the explanation will be omitted.

[0118] The access needs calculation unit 81 calculates the access needs when an access request is permitted, using the likelihood for the access attribute (step B1).

[0119] Specifically, in step B1, the access needs calculation unit 81 first refers to attribute needs evaluation information, which is stored in advance in a storage device (not shown) and which associates combinations of access attributes with attribute needs for each combination of access attributes, and obtains attribute needs for each combination of estimated access attributes. The access needs calculation unit 81 derives the attribute needs using the attribute needs evaluation information or an attribute needs derivation model, etc.

[0120] Next, in step B1, the access needs calculation unit 81 calculates the access needs for the access request using the derived attribute needs and the likelihood calculated by the likelihood calculation unit 12.

[0121] Specifically, the access needs calculation unit 81 calculates the access needs (weighted sum by the likelihoods) using multiple likelihoods for each access attribute included in the combination and the attribute needs set for each combination of access attributes.

[0122] Alternatively, the access needs may be derived using an access needs derivation model, in which data relating combinations of access attributes to likelihoods corresponding to the combinations of access attributes is input to the attribute needs derivation model, and access needs for an access request are output.

[0123] The determination unit 82 determines whether or not to permit the access request to the information asset based on the access risk and the access needs (step B2). Specifically, in step B1, the determination unit 82 first acquires the access risk calculated by the access risk calculation unit 13 and the access needs calculated by the access needs calculation unit 81.

[0124] Next, in step B1, the determination unit 82 permits the access request to the information asset if the access needs exceed the access risks, whereas it does not permit the access request to the information asset if the access needs are equal to or greater than the access risks.

[0125] Alternatively, the determination unit 82 determines whether or not to permit an access request to an information asset based on access permission information stored in advance in a storage device (not shown).

[0126] In this manner, the information processing device 10a repeats the processes of steps A1 to A3, B1 to B2, and A5.

[0127] [Effects of the second embodiment] As described above, according to the second embodiment, it is possible to determine whether or not to permit access based on the risk of access to an information asset. In particular, according to the second embodiment, the risk and need are evaluated taking into account the likelihood of the access attribute, so that it is possible to determine whether or not to permit access based on more precise risks and needs.

[0128] [program] The program in the second embodiment may be a program that causes a computer to execute steps A1 to A3, B1 to B2, and A5 shown in Fig. 11. By installing and executing this program in a computer, it is possible to realize the information processing device 10a and the information processing method in the second embodiment. In this case, the processor of the computer functions as the access attribute estimation unit 11, the likelihood calculation unit 12, the access risk calculation unit 13, the access needs calculation unit 81, the determination unit 82, and the output information generation unit 15, and performs the processes.

[0129] The program in the second embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the access attribute estimation unit 11, the likelihood calculation unit 12, the access risk calculation unit 13, the access needs calculation unit 81, the determination unit 82, and the output information generation unit 15.

[0130] (Variation 2) Modification 2 will be described. In Modification 2, the judgment unit 14 of the first embodiment and the judgment unit 82 of the second embodiment may output a judgment other than whether or not to permit access to an access request. The judgment unit may output a judgment result such as (i) permitting the access request, (ii) not permitting, and (iii) notifying an administrator or the like at the same time as permitting, (iv) leaving a log to that effect at the same time as permitting, (v) permitting for a limited time, or (vi) permitting only if additional authentication is requested and passed. Also, a combination of (i) to (vi) may be output.

[0131] Specifically, the judgment unit 14 or 82 may make the following judgment. For example, using a first threshold and a second threshold set in advance, if the access risk is equal to or less than the first threshold, the access request is permitted. If the access risk is greater than the first threshold and equal to or less than the second threshold, the access request is permitted and a notification is given to an administrator or the like. Furthermore, if the access risk exceeds the second threshold, the access request is not permitted.

[0132] Alternatively, the determination unit 14 or 82 may make a determination on the access request by referring to access permission information 101a as shown in Fig. 12. Fig. 12 is a diagram for explaining an example of access permission of the present disclosure.

[0133] (Variation 3) Modification 3 will be described. In Modification 3, the information processing device 10 or the information processing device 10a of the present disclosure may be used in a system configuration as shown in FIG. 13. FIG. 13 is a diagram for explaining an example of a system configuration having the information processing device of the present disclosure. In the system 100b of FIG. 13, the terminal device 20 and the information asset 30 are configured to communicate with each other via the control device 10b. Also, the information processing device 10 or the information processing device 10a and the control device 10b are configured to be able to communicate with each other.

[0134] The control device 10b is a device that controls whether or not to allow access from the terminal device 20 to the information asset 30 to pass. The control device 10b may be, for example, a device such as a switch, a router, a Software Defined Network (SDN) switch, a firewall, a Unified Threat Management (UTM), a Network Access Control (NAC), a proxy, an authentication gateway, an application gateway, or an AD. Alternatively, the control device 10b may be an Endpoint Detection and Response (EDR) installed in the terminal device.

[0135] When the terminal device 20 attempts to access the information asset 30, the control device 10b transmits information regarding the access to the information processing device 10 or the information processing device 10a as an access request. The access request includes information such as the access source IP address, the access destination IP address, the access source port number, the access destination port number, the access protocol, the user identifier, the access source terminal identifier, the access destination information asset identifier, authentication information, a token, a ticket, etc. However, the information is not limited to the above-mentioned information.

[0136] Next, the information processing device 10 or the information processing device 10a that has received the access request determines whether or not to permit the access request, and transmits the result of the determination to the control device 10b.

[0137] Next, the control device 10b receives the result of the judgment on the access request and controls whether or not to allow the access to pass, in accordance with the result of the judgment.

[0138] Alternatively, the information processing device 10 or the information processing device 10a may be configured to transmit an access request anticipated in advance and its judgment result to the control device 10b, and the control device 10b may be configured to control whether or not to pass an access request from a terminal device in accordance with the anticipated access request and its judgment result.

[0139] [Physical configuration] Here, a computer that realizes an information processing device by executing the programs in the first embodiment, the first modification, the second embodiment, and the second and third modifications will be described with reference to Fig. 14. Fig. 14 is a diagram for explaining an example of a computer that realizes the information processing device of the present disclosure.

[0140] 14, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These components are connected to each other via a bus 121 so as to be able to communicate data with each other. Note that the computer 110 may include a GPU or an FPGA in addition to the CPU 111 or instead of the CPU 111.

[0141] The CPU 111 loads a program in the embodiment, which is composed of a group of codes and is stored in the storage device 113, into the main memory 112, and executes each code in a predetermined order to perform various calculations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory).

[0142] Moreover, the program in the embodiment is provided in a state stored in a computer-readable recording medium 120. Note that the program in the embodiment may be distributed on the Internet connected via the communication interface 117.

[0143] Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and input devices 118 such as a keyboard and a mouse. The display controller 115 is connected to a display device 119 and controls the display on the display device 119.

[0144] Data reader / writer 116 mediates data transmission between CPU 111 and recording medium 120, reads programs from recording medium 120, and writes processing results in computer 110 to recording medium 120. Communication interface 117 mediates data transmission between CPU 111 and other computers.

[0145] Specific examples of recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic recording media such as a flexible disk, or optical recording media such as a CD-ROM (Compact Disk Read Only Memory).

[0146] The information processing devices 10 and 10a in the first embodiment, the first modification, the second embodiment, the second modification, and the third modification can be realized by using hardware corresponding to each part, for example, electronic circuits, instead of a computer with a program installed. Furthermore, the information processing devices 10 and 10a may be realized in part by a program and the remaining part by hardware. In the first embodiment, the first modification, the second embodiment, the second modification, and the third modification, the computer is not limited to the computer shown in FIG. 14.

[0147] [Note] The following supplementary notes are further disclosed regarding the above-described embodiments. A part or all of the above-described embodiments can be expressed by (Supplementary Note 1) to (Supplementary Note 18) described below, but are not limited to the following descriptions.

[0148] (Appendix 1) an access attribute estimation unit that estimates an access attribute representing an attribute of an access request for an information asset transmitted from a terminal device to the information asset; a likelihood calculation unit for calculating a likelihood for the access attribute; an access risk calculation unit that calculates an access risk for the access request using the likelihood; a determination unit that determines whether or not to permit the access request to the information asset based on the access risk; An information processing device having the above configuration.

[0149] (Appendix 2) The access risk calculation unit: Deriving an attribute risk for each combination of the access attributes; calculating an access risk for the access request using the attribute risk and the likelihood; 2. An information processing device according to claim 1.

[0150] (Appendix 3) The access risk calculation unit: inputting the combination of access attributes into an attribute risk derivation model, and outputting the attribute risk; 3. An information processing device according to claim 2.

[0151] (Appendix 4) The access risk calculation unit: inputting the combination of access attributes and the likelihood for each combination of access attributes into an access risk derivation model, and outputting the access risk for the access request; 3. An information processing device according to claim 2.

[0152] (Appendix 5) an access needs calculation unit that calculates access needs in a case where the access request is permitted by using the likelihood for the access attribute; The determination unit is determining whether to permit the access request to the information asset based on the access risk and the access needs; 5. An information processing device according to any one of claims 1 to 4.

[0153] (Appendix 6) The access attribute includes at least information representing a user of the terminal device, information representing a role of the user, and information representing a label of the information asset. 2. An information processing device according to claim 1.

[0154] (Appendix 7) An information processing device, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; Calculating a likelihood for the access attribute; calculating an access risk for the access request using the likelihood; determining whether to permit the access request to the information asset based on the access risk; Information processing methods.

[0155] (Appendix 8) The information processing device includes: Deriving an attribute risk for each combination of the access attributes; calculating an access risk for the access request using the attribute risk and the likelihood; 8. An information processing method as described in Appendix 7.

[0156] (Appendix 9) The information processing device includes: inputting the combination of access attributes into an attribute risk derivation model, and outputting the attribute risk; 10. An information processing method as described in Appendix 8.

[0157] (Appendix 10) The information processing device includes: inputting the combination of access attributes and the likelihood for each combination of access attributes into an access risk derivation model, and outputting the access risk for the access request; 10. An information processing method as described in Appendix 8.

[0158] (Appendix 11) The information processing device includes: further calculating access needs in the case where the access request is permitted using the likelihood for the access attribute; determining whether to permit the access request to the information asset based on the access risk and the access needs; 11. An information processing method according to any one of claims 7 to 10.

[0159] (Appendix 12) The access attribute includes at least information representing a user of the terminal device, information representing a role of the user, and information representing a label of the information asset. 8. An information processing method as described in Appendix 7.

[0160] (Appendix 13) On the computer, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; A likelihood for the access attribute is calculated; An access risk for the access request is calculated using the likelihood; determining whether to permit the access request to the information asset based on the access risk; program.

[0161] (Appendix 14) The computer includes: Deriving an attribute risk for each combination of the access attributes; calculating an access risk for the access request using the attribute risk and the likelihood; 14. The program according to claim 13.

[0162] (Appendix 15) The computer includes: inputting the combination of access attributes into an attribute risk derivation model and outputting the attribute risk; 15. The program according to claim 14.

[0163] (Appendix 16) The computer includes: inputting the combination of access attributes and the likelihood for each combination of access attributes into an access risk derivation model, and outputting the access risk for the access request; 15. The program according to claim 14.

[0164] (Appendix 17) The computer includes: further, calculating access needs in the case where the access request is permitted using the likelihood for the access attribute; determining whether or not to permit the access request to the information asset based on the access risk and the access needs; 17. The program according to any one of appendix 13 to 16.

[0165] (Appendix 18) The access attribute includes at least information representing a user of the terminal device, information representing a role of the user, and information representing a label of the information asset. 14. The program according to claim 13.

[0166] Although the invention has been described above with reference to the embodiments, the invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the invention within the scope of the invention. [Industrial Applicability]

[0167] According to the above description, it is possible to determine whether or not to permit access to an information asset based on the risk of accessing the information asset, and the present invention is useful in fields where access to information assets is required. [Explanation of symbols]

[0168] 10, 10a Information processing device 10b Control device 11 Access attribute estimation unit 12 Likelihood calculation section 13 Access Risk Calculation Unit 14 Judgment section 20, 20a, 20b Terminal device 30, 30a, 30b Information Assets 40 Output Device 81 Access Needs Calculation Department 82 Judgment section 100, 100a, 100b systems 110 Computer 111 CPU 112 Main memory 113 Storage device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Devices 119 Display device 120 Recording media 121 Bus

Claims

1. an access attribute estimation means for estimating an access attribute representing an attribute of an access request for an information asset transmitted from a terminal device to the information asset; a likelihood calculation means for calculating a likelihood for the access attribute; an access risk calculation means for calculating an access risk for the access request using the likelihood; a determination means for determining whether or not to permit the access request to the information asset based on the access risk; An information processing device having the above configuration.

2. The access risk calculation means Deriving an attribute risk for each combination of the access attributes; calculating an access risk for the access request using the attribute risk and the likelihood; The information processing device according to claim 1 .

3. The access risk calculation means inputting the combination of access attributes into an attribute risk derivation model, and outputting the attribute risk; The information processing device according to claim 2 .

4. The access risk calculation means inputting the combination of access attributes and the likelihood for each combination of access attributes into an access risk derivation model, and outputting the access risk for the access request; The information processing device according to claim 2 .

5. further comprising an access needs calculation means for calculating access needs in a case where the access request is permitted by using the likelihood for the access attribute, The determination means is determining whether to permit the access request to the information asset based on the access risk and the access needs; 5. The information processing device according to claim 1.

6. The access attribute includes at least information representing a user of the terminal device, information representing a role of the user, and information representing a label of the information asset. The information processing device according to claim 1 .

7. An information processing device, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; Calculating a likelihood for the access attribute; calculating an access risk for the access request using the likelihood; determining whether to permit the access request to the information asset based on the access risk; Information processing methods.

8. On the computer, Estimating an access attribute representing an attribute of an access request to an information asset transmitted from a terminal device to the information asset; Calculating a likelihood for the access attribute; calculating an access risk for the access request using the likelihood; determining whether to permit the access request to the information asset based on the access risk; program.

Images