Data processing system

Abstract

To support improvement processing by alternative processing of a part of compliance business in each enterprise.SOLUTION: In a data processing system that supports compliance business by communicating a first data terminal 1 with a server device 4 through a predetermined communication medium, the server device 4 includes: a generation unit that executes predetermined processes 42-44 consisting of a plurality of modules to generate an evaluated diagnosis result on the basis of at least one selected publicly-known reference and company regulations acquired from the first terminal 1; and an output unit 32 that outputs the generated diagnosis result in a predetermined form.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a data processing system that executes a predetermined compliance process and supports compliance operations. [Background technology]

[0002] Regulations and standards serve to ensure the safety of social systems that have become increasingly complex due to advances in computer network systems and technological innovation. Individual business entities must comply with these regulations and standards, and typically formulate in-house regulations to set rules for such compliance.

[0003] For example, under the Financial Supervision Business Act, financial institutions are required to establish a system risk management system and to demonstrate this to the supervisory authorities. However, comparing publicly known standards that serve as the norm for system risk management with internal company standards that govern in-house system management and adapting the internal company standards to the publicly known standards requires advanced specialized knowledge and a huge amount of time, and it is expected that there will be many situations in which they will have difficulty responding due to the time spent on this task in addition to their regular business operations.

[0004] In such a situation, legal personnel at each company must use their relevant knowledge to make considerable considerations about which internal regulations should be revised and how to revise them in order to establish optimal internal regulations. Furthermore, taking into account the differences in the organizational structures of various companies, formulating optimal internal regulations (compliance) requires an enormous amount of processing time.

[0005] The following Patent Document 1 states that "individual entities responsible for ensuring the security of information often implement problem-solving oriented measures such as firewalls, encryption software, password tokens, etc., without a full understanding of the impact that will have on the overall security posture of these organizations. The lack of documented security standards and regulations that address information security issues has created an environment in which security solutions or computer system architectures are driven by 'best industry standards.' In some cases, solutions may even include ad-hoc patches that are designed to solve individual or specific security problems."

[0006] Individual entities responsible for securing information often implement problem-solving oriented measures such as firewalls, encryption software, password tokens, etc., without a full understanding of how they impact the overall security posture of those organizations. The lack of documented security standards and regulations addressing information security issues has created an environment in which security solutions or computer system architectures are driven by "industry best practices. In some cases, the solution has even involved the application of ad-hoc patches designed to solve individual or specific security problems." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Special Publication No. 2006-526220 Summary of the Invention [Problem to be solved by the invention]

[0008] However, with electronic business being processed in a network environment that is evolving daily, even a single company needs to refer to relevant publicly known standards when formulating or revising best internal standards. It is extremely difficult for departments tasked with explaining compliance to supervisory authorities and system authorities to thoroughly browse the vast number of publicly known standards, and there is an urgent need to develop a system to support compliance work.

[0009] In addition, it was pointed out that the evaluation process relies on the manpower of the legal affairs department, and that even if the standards adopted deviate significantly from publicly known standards, it is inevitable that internal company standards will be evaluated without recognizing that fact.

[0010] The present invention has been made to solve the above-mentioned problems, and an object of the present invention is to provide a data processing system that can substitute for part of the compliance work within each company and support its improvement process by utilizing AI to perform high-speed analysis processing while comparing known standards with company regulations. [Means for solving the problem]

[0011] The data processing system of the present invention is a data processing system that supports compliance work by communicating between a data terminal and a server device via a specified communication medium, and is characterized in that the server device is equipped with a generation means that generates an evaluated diagnostic result by executing a specified compliance process consisting of a plurality of modules based on at least one selected publicly known criterion and internal company regulations obtained from the data terminal, and an output means that outputs the diagnostic result generated by the generation means in a specified format. Effect of the Invention

[0012] According to the data processing system of the present invention, in an environment in which a server device is used, it is possible to freely create an environment in which a part of the compliance work within each company can be processed on behalf of the server device as a service provided by the server device, thereby supporting improvement processing. [Brief description of the drawings]

[0013] The drawings show specific embodiments of the present invention, including essential features of the invention as well as alternative and preferred embodiments. [Figure 1] 1 is a block diagram illustrating a configuration of a data processing system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram illustrating a hardware configuration of the data processing system shown in FIG. [Diagram 3] 3 is a block diagram illustrating a module configuration deployed on a RAM of the server device shown in FIG. 2. [Figure 4] FIG. 4 is a diagram for explaining details of the module shown in FIG. 3 . [Diagram 5] FIG. 4 is a diagram for explaining details of the module shown in FIG. 3 . [Figure 6] FIG. 4 is a diagram for explaining details of the module shown in FIG. 3 . [Figure 7] FIG. 4 is a diagram for explaining details of the module shown in FIG. 3 . [Figure 8] 5A and 5B are diagrams for explaining the progress of in-house regulation evaluation processing in the data processing system according to the embodiment; [Figure 9] 5A and 5B are diagrams for explaining the progress of in-house regulation evaluation processing in the data processing system according to the embodiment; [Figure 10] 5A and 5B are diagrams for explaining the progress of in-house regulation evaluation processing in the data processing system according to the embodiment; [Figure 11] 5A and 5B are diagrams for explaining the progress of in-house regulation evaluation processing in the data processing system according to the embodiment; [Figure 12] 5A and 5B are diagrams for explaining the progress of in-house regulation evaluation processing in the data processing system according to the embodiment; [Figure 13] 4 is a flowchart for explaining a data processing procedure in the data processing system according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Next, the best mode for carrying out the present invention will be described with reference to the drawings. The following embodiment relates to a data processing system and a data terminal shown in Figures 1 to 13, and includes not only essential configurations of the invention but also optional and preferred embodiments.

[0015] <System configuration> [First embodiment] 1 is a block diagram for explaining the configuration of a data processing system according to the present embodiment, which is an example of a data processing system that supports compliance work by executing a predetermined compliance process.

[0016] In Fig. 1, reference numeral 1 denotes a first data terminal, which is configured to be capable of bidirectional communication with a server device 4 via a network 3 in accordance with a predetermined protocol. The first data terminal 1 is operated by a person in the legal department, who uploads the company's internal regulations to the server device 4 and receives the results of the evaluation of the internal regulations by the server device 4, as will be described later.

[0017] A second data terminal 2 stores publicly known standards prescribed by government agencies, the Financial Services Agency, etc., and reads them as standards for evaluating company regulations uploaded from the first data terminal 1 to the server device 4.

[0018] Here, standards include IIAIA Standard, Financial Services Agency AML, FISC, J-SOX / ITGC, etc., and also include global standards that are based on the latest versions of these standards, newly expanded standards, or newly formulated standards.

[0019] FIG. 2 is a block diagram illustrating the hardware configuration of the data processing system shown in FIG. It is assumed that the first data terminal 1 and the second data terminal 2 have similar hardware.

[0020] In FIG. 2, reference numeral 11 denotes a communication unit which performs bidirectional data communication with a communication unit 21 of a server device 4 via a network 3 in accordance with an Internet communication protocol.

[0021] Reference numeral 12 denotes a CPU, which performs overall control of devices connected to the internal bus based on a BIOS stored in a ROM 13. Reference numeral 14 denotes a RAM, which functions as a work memory for applications stored in the CPU 12, and is configured so that the memory capacity can be expanded as necessary. Note that various applications are stored in non-volatile large-capacity memory media such as a hard disk or SSD, but these are omitted from the diagram.

[0022] An input / output interface (I / O) 15 transmits and receives data and control information to and from a display unit 16 and an input unit 17 .

[0023] Similarly, in the server device 4, a CPU 22 comprehensively controls devices connected to the internal bus based on a BIOS stored in a ROM 23. A RAM 24 functions as a work memory for applications stored in the CPU 22, and is configured so that the memory capacity can be expanded as necessary. Note that various applications are stored in non-volatile large-capacity memory media such as a hard disk or SSD, but are omitted from the drawing.

[0024] An input / output interface (I / O) 25 transmits and receives data and control information to and from a display unit 26 and an input unit 27 .

[0025] FIG. 3 is a block diagram for explaining the configuration of modules developed on the RAM 24 of the server device 4 shown in FIG. 2, and the same reference numerals are used for the same hardware as in FIG.

[0026] In FIG. 3, reference numeral 31 denotes a compliance wizard module that functions as a generation unit, and is made up of a first module 31-1, a second module 31-2, and a third module 31-3.

[0027] The first module 31-1 functions as an Explanation Module, the details of which will be described later, and includes a large-scale language model (LLM) 31-1-1 that uses natural language code for AI behavior control to reproduce expert knowledge in the comparison process between known standards and the company regulations. The second module 31-2 functions as an Assessment Module, and includes a large-scale language model (LLM) 31-2-1. The third module 31-3 functions as an Improvement Module, and includes a large-scale language model (LLM) 31-3-1.

[0028] An output unit 32 executes a process of outputting the evaluation result generated by the third module 31-3 to the requesting first data terminal 1. The process of outputting to the first data terminal 1 includes a specific encryption and compression process as appropriate, and employs a configuration that ensures confidentiality.

[0029] In FIG. 4, 41 to 45 indicate various processes, and process 41 corresponds to the process of inputting (importing) the company regulations uploaded from the first data terminal 1 and the known standards obtained from the second data terminal 2 into the compliance wizard 31.

[0030] 5, the process 42 corresponds to a process executed by the Explanation Module, and when the user on the server device 4 side selects a target framework, the company regulations to be input are specified. Next, a prompt adapted to the large-scale language model (LLM) 31-1-1 is dynamically generated based on the input document and the master definition, and the evaluation result is output in a predetermined format.

[0031] Also, process 43 corresponds to the process performed by the Assessment Module, as shown in FIG. 6, in which the regulatory requirements and the internal compliance status are compared by a large-scale language model (LLM) 31-2-1 based on dynamically generated prompts, and the desired results are output.

[0032] 7, the process 44 corresponds to the process executed by the Improvement Module, and for requirements not meeting the GC, the large-scale language model (LLM) 31-3-1 generates improvement proposals based on their specific aspects, regulatory requirements, and general interpretations of the regulatory requirements, and stores them in a data table secured on the RAM 24. Then, the output unit 32 reads out the data table secured on the RAM 24, and outputs the results in the form of a report to the first data terminal 1 that is the request source.

[0033] In this embodiment, the quality of the assessment results can be improved by executing the process so that the Explanatory prompts and the Assessment prompts are separated.

[0034] [Process 42 Configuration] In Fig. 5, 42-1 is a Framework Library, which registers libraries that can be selected as publicly known standards. For example, if ISMAP is selected, the corresponding URL (http: / / www.ismap.go.jp / csm) is accessed and the publicly known standards can be obtained.

[0035] 42-2 is a Requirement Library (IIA), which sets parameters corresponding to Desc, knowledge, input1, and input2 extracted from publicly known criteria selected from Framework Library 42-1. Note that Desc here complies with the DESC method and corresponds to "Describe", "Explain", "Specify", and "Choose".

[0036] 42-3 is a user screen that clearly indicates input instructions related to company regulations. 42-4 is an Input table (IIA) that has the items Desc, user question, and Input.

[0037] An Explanatory Prompt Module 42-5 obtains a description from a Requirement Library (IIA) 42-2 and obtains an input from an Input Table (IIA) 42-4. These processes are dynamically performed by the LLM 31-1-1.

[0038] An explanation table 42-6 is generated by writing the description in the requirement library (IIA) 42-2 and the processing result of the explanatory prompt module 42-5, and is passed to the assessment module (second module) 31-2, which is the next process.

[0039] [Process 43 Configuration] In FIG. 6, 43-1 is an explanation table, which is the same as the explanation table 42-6 generated in the process shown in FIG.

[0040] 43-2 is an AssessmentPromptModule, which compares the Desc and Explanation items in the Explanationtable 43-1, and writes the processed result and reason in the Explanationtable 43-3 by the LLM 31-2-1 based on the logical judgment criteria and result classification criteria.

[0041] As a result, the Explanation table 43-1 is completed as a table in which the processed result and reason have been written, and the Explanation table 43-3 is passed to the next process 44.

[0042] [Process 44 Configuration] In Fig. 7, 44-1 is an explanation table, which is the same as the explanation table 43-3 generated in the process shown in Fig. 6. 44-2 is a requirement library (IIA), which has items Desc, knowledge, and Input1 and 2.

[0043] 44-3 is an ImprovementPromptModule, which obtains Description and knowledge from the RequirementLibrary (IIA) 44-2, and obtains Result and Reason from the ExplanationTable 44-1. The LLM 31-3-1 performs calculations on each of these to write Improvement, which indicates the direction of improvement, into ExplanationTable 44-4, and generates a readable information table as the final evaluation result.

[0044] [Examples of data processing based on company regulations] 8 to 12 are diagrams for explaining the progress of the in-house regulation evaluation process in the data processing system according to this embodiment, and will explain an example of evaluating guidelines for system development regulations, for example.

[0045] When the system development regulations formulated as shown in FIG. 8 are uploaded to the server device 4, the compliance wizard 31 is started in the server device 4, and the required items are automatically read from the uploaded text information into the information security policy form. For example, from the items related to development / implementation 4.2, a management table TB1 as shown in FIG. 9 is created, and items IT1 to IT3 are secured.

[0046] The control measure standard corresponding to item IT2 is set with text information extracted from the company regulations. Item IT3 is set with text information that points out deficiencies in the current system development regulations as the evaluation result.

[0047] FIG. 10 shows a state in which details of the results of evaluation by GC and DC as item IT4 in control number 14.2.1.1 and control number 14.2.1.2 are presented in text form as a result of executing processes 42 and 43.

[0048] Figure 11 shows the state in which, as a result of executing process 44, specific content to be added to the current regulations as improvements to the company regulations is presented in text form in control measure number 14.2.1.2.

[0049] After going through this process, the final evaluation report will present improvement and enhancement opportunities in the data format shown in Figure 12 (category, overview, improvement and enhancement opportunities).

[0050] [Effects of the first embodiment] According to this embodiment, document processing that would require weeks to months of manual searching, review, and revision by legal staff can be completed in a short time, dramatically improving the efficiency of the entire data processing process from the formulation, announcement, and approval of internal company regulations.

[0051] [First to third module processing] 13 is a flow chart for explaining the data processing procedure in the data processing system according to this embodiment. Note that (1) to (12) indicate each step, which is realized by the CPU 22 of the server device 4 executing a data processing program loaded on the RAM 24. Also, the process up to the establishment of communication between the first data terminal 1 and the server device 4 is left to well-known processing, and the description thereof will be omitted.

[0052] The legal officer of the first data terminal 1 operates the input unit 17 to select one publicly known standard for comparison verification from the publicly known standards listed on the UI screen displayed on the display unit 16 (1), and then selects the internal company regulation to be audited and presses the upload button displayed on the same screen (2). In order to start processing for evaluating and auditing the internal company regulation in the server device 4, the legal officer of the first data terminal 1 operates the input unit 17 to press the compliance assessment button displayed on the display unit 16 (3), and then presses the check AI button (not shown) (4). The server device 4 then launches the following processing.

[0053] First, the first module 31-1 shown in Fig. 3 is executed (5) to start data calculation processing in accordance with the process 42, the Explanation Module shown in Fig. 5 is started, and the LLM 31-1-1 generates a plurality of prompts while generating an Explanation table 42-6 to be handed over to the process 43. After this, (6) the Explanation table 42-6 is handed over to the process 43. Next, the second module 31-2 shown in Fig. 3 is executed (7) to start data calculation processing in accordance with the process 43, the Assessment Module shown in Fig. 6 is started, and the LLM 31-2-1 generates a plurality of prompts while generating an Explanation table 43-3 to be handed over to the process 44. After this, (8) the Explanation table 43-3 is handed over to the process 44.

[0054] Next, the third module 31-3 shown in Fig. 3 is executed (9) to start data calculation processing conforming to the process 44, the Improvement Module shown in Fig. 7 is started, and when the processing of the Improvement Module is completed (10), the LLM 31-3-1 generates a number of prompts and creates a report corresponding to the evaluation results to be output (11). Next, the output unit 32 outputs the created report to the first data terminal 1 via the network 3 (12), and the processing ends.

[0055] In addition, taking into consideration program extensibility, bug detection, and data processing efficiency, data processing using correction programs and extension programs may be executed between each step as appropriate.

[0056] This allows departments that are obligated to explain compliance to supervisory authorities or system authorities to obtain highly valid evaluation results for the company's regulations by simply preparing publicly known regulations for comparison and the company's internal regulations, as well as obtain reasonable guidelines for operating the internal regulations as legitimate regulations.

[0057] [Examples of user stories] The user stories are: (1) The head of the compliance department in the legal department operates the first data terminal 1 to select an available corresponding regulatory framework. (2) The framework covers publicly known frameworks such as the IIA's Audit Standard, the Financial Services Agency's Supervision Guidelines, and the ISMAP Management Standards of the NISC of the Ministry of Economy, Trade and Industry's Digital Agency (see Figure 5). Note that this does not cover laws. (3) The head of the Compliance Department uploads the company regulations by following the instructions in the tool. (4) The head of the Compliance Management Department clicks the "Compliance Assessment" button. Natural language calculations are performed through API processing, and the current situation is mapped against the standards using the entered company regulations as the source data. (5) When you press the Check AI button, a compliance check will be performed on the mapping results above, and the result classification (Generally complied, Partially complied, Do not complied) and its details will be displayed. (6) The head of the Compliance Department prints out a report and checks the compliance status for each chapter and section of the major division. In this report, the evaluation of each regulatory requirement and the details of the reasons for it can be seen. (7) When the head of the Compliance Department presses a button on a UI screen (not shown) that suggests improvements, improvement proposals for compliance are generated for each regulatory requirement. The results can be viewed in a list format. (8) After revising the regulations and procedures in accordance with the improvement proposal, the head of the Compliance Department can re-import the regulations and perform an evaluation to check the status of improvement.

[0058] The disclosure regarding the present invention described above can be summarized at least as follows.

[0059] (1) A data processing system that supports compliance work by communicating between a data terminal and a server device via a specified communication medium, wherein the server device is characterized in having a generation means that generates a diagnostic result evaluated by executing a specified compliance process consisting of a plurality of modules based on at least one selected publicly known criterion and company regulations acquired from the data terminal, and an output means that outputs the diagnostic result generated by the generation means in a specified format.

[0060] (2) The generation means generates the diagnostic result by a large-scale language model (LLM) using natural language code for AI behavior control to reproduce expert knowledge by comparing the publicly known standards with the in-house regulations.

[0061] (3) The large-scale language model (LLM) is characterized by being composed of an LLM-API and linking with the specified compliance process.

[0062] (4) The predetermined compliance process is characterized by being configured by combining an Explanation process, an Assessment process, and an Improvement process.

[0063] (5) The explanation process is characterized in that prompts for a large-scale language model (LLM) are dynamically generated, and an evaluation result is generated using the large-scale language model (LLM).

[0064] (6) The prompt is characterized in that it is configured to include the knowledge of an expert and to be capable of replacing the work of the expert.

[0065] (7) The Assessment process is characterized by dynamically generating prompts for a large-scale language model (LLM) and generating comparison results by the large-scale language model (LLM) based on the generated prompts.

[0066] (8) The Improvement process is characterized by generating an improvement proposal that improves the comparison results generated by the Assessment process using a large-scale language model (LLM). [Explanation of symbols]

[0067] 1 First Data Terminal 2 Second Data Terminal 3. Network 4. Server equipment

Claims

1. A data processing system that supports compliance operations by communicating between a data terminal and a server device via a predetermined communication medium, The server device includes: A generating means for generating an evaluated diagnostic result by executing a predetermined compliance process composed of a plurality of modules based on at least one selected known criterion and an in-house regulation acquired from the data terminal; an output means for outputting the diagnostic result generated by the generation means in a predetermined format; A data processing system comprising:

2. The data processing system according to claim 1, characterized in that the generation means generates the diagnostic result by a large-scale language model (LLM) using natural language code for AI behavior control to reproduce expert knowledge by comparing the publicly known standards with the in-house regulations.

3. 3. The data processing system according to claim 2, wherein the large scale language model (LLM) is configured with an LLM-API and cooperates with the predetermined compliance process.

4. 2. The data processing system according to claim 1, wherein the predetermined compliance process is configured by combining an Explanation process, an Assessment process, and an Improvement process.

5. 5. The data processing system of claim 4, wherein the explanation process dynamically generates prompts for a large language model (LLM) and generates an evaluation result using the large language model (LLM).

6. 6. The data processing system according to claim 5, wherein the prompt includes knowledge of an expert and is capable of replacing the work of the expert.

7. 5. The data processing system of claim 4, wherein the Assessment process dynamically generates prompts for a large language model (LLM) and generates a comparison result by the large language model (LLM) based on the generated prompts.

8. 5. The data processing system according to claim 4, wherein the Improvement process generates an improvement proposal by improving the comparison result generated by the Assessment process using a large-scale language model (LLM).

Images