Access management device, access management method program

Abstract

To provide an access management device for contributing to the matter that a user executes correspondence to which access can be finally approved even if the access is denied, an access management method and a program.SOLUTION: According to an embodiment of the disclosure, an access management device includes an acquisition part for determining access validity / invalidity to a first combination being a combination of a plurality of access attributes by using an access determination engine, a specification part for specifying a correspondence method to the first combination to which access is approved by determining, using the access determination engine, access validity / invalidity to one or more second combinations obtained by changing at least a portion of access attributes in the first combination if the acquisition part determines that access to the first combination is denied, and a notification part for notifying the correspondence method specified by the specification part.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an access management device, an access management method, and a program. [Background technology]

[0002] 2. Description of the Related Art Technologies that take security into consideration when deciding how to handle content are evolving.

[0003] For example, Patent Document 1 discloses an information processing device that controls how to handle content by using the security level (first security information) of the content that a processing means is to process and the security state (second security information) of the processing means. The information processing device executes the control of the handling by using a data structure that indicates the correspondence between the combination of the first security information and the second security information and the type of handling. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 7047515 Summary of the Invention [Problem to be solved by the invention]

[0005] The information processing device described in the cited document 1 is capable of controlling how content is handled. However, in the cited document 1, when processing is not permitted, the user cannot obtain information on what action to take to permit the processing. This causes a problem that the user gives up on processing the desired content, or it takes a long time before processing the content is permitted.

[0006] One of the objectives that the embodiments of the present disclosure attempt to achieve is to provide an access management device, an access management method, and a program that contribute to a user taking a measure that will ultimately authorize access even if access is denied. It should be noted that this objective is merely one of multiple objectives that the multiple embodiments disclosed herein attempt to achieve. Other objectives or problems and novel features will become apparent from the description of this specification or the accompanying drawings. [Means for solving the problem]

[0007] According to one aspect, an access management device includes: an acquisition unit that acquires a result of an access permission determination made by an access determination engine for a first set, which is a combination of a plurality of access attributes; a determination unit that, when the acquisition unit acquires that access to the first set is to be denied, determines whether or not access is permitted for one or more second sets that have at least a part of the access attributes of the first set changed, by using the access determination engine, and identifies a method of dealing with the first set for granting access; and a notification unit that notifies the user of the response method identified by the identification unit.

[0008] According to one aspect, an access management method includes: when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; It is a computer implemented method.

[0009] In one aspect, the program comprises: when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; The present invention is directed to a computer that executes the above steps. Effect of the Invention

[0010] The present disclosure makes it possible to provide an access management device, an access management method, and a program that contribute to a user taking measures that will ultimately result in access being authorized, even if access is denied. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram illustrating an example of an access management device according to the present disclosure. [Diagram 2] 1 is a flowchart illustrating an example of a representative process of the access management device according to the present disclosure. [Diagram 3] FIG. 1 is a block diagram illustrating an example of an access management system according to the present disclosure. [Figure 4] FIG. 13 is a diagram illustrating an example of a causal relationship indicated by a plurality of response methods and a plurality of attributes. [Diagram 5] 11 is a table showing an example of a response cost calculated for a response method by a response cost calculation unit. [Figure 6] 11 is a table illustrating an example of recommendation costs calculated for corresponding methods by a recommendation cost calculation unit. [Figure 7] 7 is a schematic diagram showing an example of the state shown in FIG. 6. [Figure 8A] 1 is a flowchart illustrating an example of a representative process of an access management system according to the present disclosure. [Figure 8B]1 is a flowchart illustrating an example of a representative process of an access management system according to the present disclosure. [Figure 9] FIG. 2 is a block diagram showing an example of a hardware configuration of an apparatus according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, the embodiments of the present disclosure will be described with reference to the drawings. Note that the following description and drawings in the embodiments are omitted and simplified as appropriate for clarity of explanation. In addition, in this disclosure, unless otherwise specified, when "at least one of the multiple items" is defined for multiple items, the definition may mean any one item, or may mean any multiple items including all items.

[0013] Each drawing referred to in the embodiment is merely an example for describing one or more embodiments. Each drawing may not be related to only one particular embodiment, but may be related to one or more other embodiments. As can be understood by a person skilled in the art, various features or steps described with reference to any one drawing may be combined with features or steps shown in one or more other drawings to create an embodiment not explicitly shown or described, for example. Not all features or steps shown in any one drawing are necessarily required to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0014] Additionally, common definitions used in this disclosure are explained below.

[0015] [Definition explanation] In this disclosure, the term "user" refers to all people who may be involved in access management, including end users who issue access requests to resources to be accessed (hereinafter also referred to as access resources), as well as administrators who manage access control. An access resource refers to any access target, such as an information asset, an application, a computer file, or a device to be accessed.

[0016] In this disclosure, an "access attribute" refers to any element that specifies the nature of access when an access destination is accessed. Specific examples of elements may include one or more specific pieces of information (values) related to the nature of the access, such as (1) various data of the access source, (2) various data of the access destination, and (3) other data indicating the nature of the access. Hereinafter, "access attribute" is also referred to simply as "attribute."

[0017] (1) Specific examples of various data (Subject Attributes) of the access source include any one or more of information on the ID (IDentification) of the access source, information on the end user, information on at least one of the device or subsystem of the access source, information on the IP (Internet Protocol) address of the access source, information on the port number, software name (e.g., application name), access authentication means, etc. Here, the information on the ID of the access source includes any one or more of the ID of the access source (e.g., end user ID), end user name, device ID, subsystem ID, application ID, end user authentication result (authentication history) of the ID of the access source, etc. The information on the end user includes any one or more of the affiliation (organization) of the end user, job title, job type, end user location (or location of the device of the access source), affiliation of the device of the access source, behavior abnormality degree of the end user or the device of the access source, etc. The information on the device of the access source includes any one or more of the version of the OS (Operating System) used by the device of the access source, the manufacturer name, etc. The information on the IP address of the access source includes, for example, one or more of the IP address of the access source, the risk level of the IP address of the access source, etc. In the above, the OS version indicates the vulnerability of the access, and the behavior abnormality level indicates the possibility of an attack.

[0018] (2) Specific examples of various data (Object Attributes) of the accessed destination include any one or more of the following: information on the ID of the accessed destination, information on the accessed resource, the address of the accessed destination (e.g., IP address or Web address), information on the OS used by the accessed device, operation type, etc. Information on the ID of the accessed destination includes any one or more of the following: the subsystem ID of the accessed destination, resource ID, owner name of the accessed resource ID, etc. Information on the accessed resource includes any one or more of the following: the organization of the accessed destination (the organization that owns the accessed resource), the type of the accessed resource requested, the creator, the creation date and time, confidentiality, etc. The confidentiality of the accessed resource indicates the expected damage in the event of an attack.

[0019] (3) Other specific examples of data indicating the nature of access include any one or more of the following: frequency of requests from the access source ID to the access resource ID, time period (or time) of access, session key method, importance of the access resource to the requesting subject, traffic level such as bandwidth usage rate, network abnormality level in access, traffic encryption strength, various data related to authentication, etc. Various data related to authentication include any one or more of the following: various authentication methods (including, for example, information on authentication strength), device authentication results, application authentication results, various authentication times, number of times various authentications have failed, etc. The importance of the access resource to the requesting subject indicates the usability of access, and the bandwidth usage rate indicates the possibility of performance degradation when controlling multiple accesses. However, the elements shown above are merely examples, and elements indicating attributes are not limited to these.

[0020] In this disclosure, a "combination of multiple attributes" means that there are multiple elements as described above. For example, assume that X, Y, and Z are attributes, and assume that X1 and X2 are elements with different values ​​of the same attribute X, Y1 and Y2 are elements with different values ​​of the same attribute Y, and Z1 and Z2 are elements with different values ​​of the same attribute Z. In this case, the "combination of multiple attributes" corresponds to any set from "X1, Y1", "X1, Z1", "Y1, Z1", "X1, Y2", ... "X1, Y1, Z1", ... "X2, Y2, Z2".

[0021] In the present disclosure, "access permission" is information indicating at least whether the action for access corresponds to permission or denial, or the degree to which it corresponds to permission and denial. For example, access permission may be information indicating whether it corresponds to permission or denial, or may be information indicating whether it corresponds to permission, prohibition, or conditional permission (additional authentication request). Access permission may also be indicated as a numerical value in a predetermined range. In this case, a numerical value at one end of the predetermined range corresponds to permission, a numerical value at the other end of the predetermined range corresponds to denial, and other numerical values ​​indicate the degree of permission or denial. However, the information indicated by "access permission" is not limited to that shown above.

[0022] First embodiment [Configuration Description] An example of the configuration of the access management device will be described with reference to Fig. 1. The access management device 10 includes an acquisition unit 11, an identification unit 12, and a notification unit 13, and each unit of the access management device 10 is controlled by a hardware controller (not shown). Each unit of the access management device 10 will be described below.

[0023] The acquisition unit 11 acquires the result of judging whether or not access is permitted for a first set, which is a combination of a plurality of attributes, using an access judgment engine. The first set may be, for example, a combination of attributes indicating an actual access made by an end user who is the access source. However, the first set may also be a combination of attributes indicating an access made when a simulation of the access is performed.

[0024] The access determination engine may be provided either inside or outside the access management device 10. In addition, the determination as to whether access is permitted or not may be executed either inside or outside the access management device 10.

[0025] The access determination engine may be configured with an algorithm or a table using, for example, a method such as rule matching or risk score base. As one example, the access permission is determined by inputting a combination of multiple attributes indicated by the first set into an algorithm, and outputting information on the access permission for the first set from the algorithm. As another example, the access permission is determined by comparing the combination of multiple attributes indicated by the first set with a combination of attributes recorded in a table, and extracting information on the access permission corresponding to the first set from the table.

[0026] Alternatively, the access judgment engine may be realized by a pre-trained AI (Artificial Intelligence) model. This AI model is trained by inputting training data including a plurality of sets of combinations of a plurality of attributes as samples and information indicating accessibility as a correct label. After this training, a first set of information to be judged is input to the AI ​​model. In response to this input, the AI ​​model outputs information on accessibility corresponding to the first set. The acquisition unit 11 can acquire the information on accessibility output by this inference process.

[0027] When the acquisition unit 11 acquires that access to the first set is denied, the identification unit 12 executes the following process. First, the identification unit 12 uses an access judgment engine to judge whether or not access is permitted for one or more second sets in which at least some attributes of the first set have been changed. The access judgment engine used by the identification unit 12 for the judgment is the same as the access judgment engine used for the judgment for the first set. The method of acquiring information on whether or not access is permitted for the second set is the same as the method of acquiring information on whether or not access is permitted for the first set, and therefore a detailed description thereof will be omitted.

[0028] For example, assume that X, Y, and Z are attributes of the access, X1 and X2 are elements of different values ​​of the same attribute X, Y1 and Y2 are elements of different values ​​of the same attribute Y, and Z1 and Z2 are elements of different values ​​of the same attribute Z. When the first set is "X1, Y1, Z1", the specification unit 12 may set at least one of "X2, Y1, Z1", "X1, Y2, Z1", "X1, Y1, Z2", "Y1, Z1", "X1, Z1" and "X1, Y1" as a second set in which one attribute is changed in the first set. "X2, Y1, Z1", "X1, Y2, Z1" and "X1, Y1, Z2" are the first set in which the value of one element is changed. Also, "Y1, Z1", "X1, Z1", and "X1, Y1" are the first set in which one element is deleted. Using a similar method, the specification unit 12 may set a second set by changing two attributes in the first set.

[0029] The identification unit 12 uses an access determination engine to determine whether or not each of the one or more second pairs described above is accessible. The identification unit 12 uses the result of the determination of whether or not the second pair is accessible to determine which attribute in the first pair should be changed and how it should be changed to allow access. For example, if there is a second pair for which the determination result is "allowed," the identification unit 12 can determine that the difference in attributes between the second pair and the first pair leads to the authorization of access. In addition, the identification unit 12 may determine that the difference in attributes between the second pair and the first pair leads to the authorization of access for a second pair for which the determination result of "denied" has not been obtained. Information on at least one of the attributes to be changed and the change mode identified in this manner can be used as a response method for granting access.

[0030] For example, the identification unit 12 may determine whether or not access is permitted for each of one or more second sets obtained by changing one attribute in the first set. The more similar the combination of the first set and the second set is, the easier it is for the identification unit 12 to determine which attribute in the first set should be changed and how to change it to allow access. However, the second set used in the determination by the identification unit 12 is not limited to this.

[0031] Note that, when it is determined that a response other than denial of access (for example, approval) is to be taken for the first pair, the specification unit 12 does not necessarily need to execute the above-described process.

[0032] The notification unit 13 notifies the identification unit 12 of the response method identified. The notification unit 13 notifies, as the response method information, information indicating at least one of which one or more attributes in the first set are to be changed in order to grant access authorization, or to which value the attribute to be changed is to be changed.

[0033] The notification unit 13 notifies the user of the response method using any mode such as display, printing, audio, etc. The notification destination of the response method is, for example, the user terminal that performed the access (hereinafter, also referred to as the user terminal), the access manager's terminal, a display unit, a speaker, a printer, etc. connected to the access management device 10. The notification unit 13 may, for example, display the response method on the display unit of the terminal or the access management device 10.

[0034] [Flow description] 2 is a flowchart showing an example of a representative process of the access management device 10, and this flowchart explains the process of the access management device 10. Note that the details of each process are as described above, and therefore will not be explained again.

[0035] First, the acquisition unit 11 acquires the result of the access permission / denial judgment for the first set using the access judgment engine (step S11: acquisition step). When the acquisition unit 11 acquires that the access is denied for the first set, the identification unit 12 judges the access permission / denial for one or more second sets using the access judgment engine. As a result, the identification unit 12 identifies a response method for the first set to allow the access (step S12: identification step). The notification unit 13 notifies the identification unit 12 of the response method identified (step S13: notification step).

[0036] [Effect description] As described above, when access to the first set is denied, the identification unit 12 can identify a response method for the first set to allow access by determining whether or not access is permitted for the second set. The notification unit 13 notifies the user of the response method, so that the user can obtain the response method and take a response that allows access to be permitted according to the response method. Therefore, the access management device 10 contributes to the user taking a response that allows access to be finally permitted even when access is denied.

[0037] Generally, when access is denied, the user cannot obtain information regarding what action should be taken to allow access. As a result, the user either gives up on processing the desired content or takes a long time to allow processing of the content. In particular, when the access decision engine is an AI model, it is difficult to externally determine the criteria that the AI ​​model uses to decide whether or not access should be allowed. Therefore, it is considered to be quite difficult for the user to determine what action should be taken to allow access without additional information.

[0038] However, by executing the above process, the access management device 10 can output information that gives the user a hint on how to handle the request to authorize the access. Therefore, the access management device 10 can solve the above problem.

[0039] Even when the access decision engine uses a wide variety of attributes to make access decisions and there are many possible ways to deal with the issues, the access management device 10 can solve the above problems. Therefore, the access management device 10 can be applied to complex systems.

[0040] The access management device 10 may be configured as a single computer device, or may be configured as a distributed system having multiple computer devices. In a distributed system, the processing executed by the access management device 10 can be shared and executed by multiple computer devices. In other words, the acquisition unit 11, the identification unit 12, and the notification unit 13 may be distributed and installed in two or more computer devices.

[0041] As yet another example, the access management device 10 may have some or all of its components provided in a cloud server constructed on a cloud, or may be provided in other types of virtualized servers generated using virtualization technology or the like. Functions other than those provided in such servers are placed in edges. For example, in a system that controls access permission and selects a communication path at an access destination, an edge may be realized as a server device at the access destination.

[0042] Embodiment 2 In the following embodiment 2, a specific example of the access management device described in embodiment 1 will be disclosed. However, the specific example of the access management device shown in embodiment 1 is not limited to the one shown below. Furthermore, the configuration and processing described below are examples and are not limited to these.

[0043] [Configuration Description] An example of the configuration of an access management system will be described with reference to Fig. 3. The access management system S includes a user interface 100 and an access control device 200. The user interface 100 includes a reception unit 101 and a presentation unit 102, and each unit of the user interface 100 is controlled by a hardware controller (not shown).

[0044] The access control device 200 includes a response candidate constraint unit 201, a response method decision unit 202, an access judgment engine 203, a response cost calculation unit 204, and a recommendation cost calculation unit 205. Each unit of the access control device 200 is controlled by a hardware controller (not shown). The user interface 100 and each unit of the access control device 200 will be described below.

[0045] The reception unit 101 receives an access request for a certain access resource from a user terminal, and transmits information related to the received access request to the access control device 200. When the access request is rejected by the access determination engine 203, the reception unit 101 obtains a combination of multiple attributes representing the access request, and outputs the obtained information to the corresponding candidate constraint unit 201 as a first set of information.

[0046] The access request is expressed as a first set, which is a combination of multiple attributes, based on input information from an end user, the input environment of the end user, and information on various data of the access source. The input information includes any information on various data of the access destination, such as information on the ID of the access destination, information on the data of the access destination, the address of the access destination, information on the data of the access destination, etc. The input environment includes any information on data indicating the nature of the access, such as the frequency of requests from the ID of the access source to the access resource ID, the time period of access, the method of the session key, the level of traffic, the degree of network abnormality during access, the encryption strength of the traffic, various data related to authentication, etc.

[0047] The first set representing the access request changes according to changes in the input information, the input environment, and information on various data of the access source. If an end user is an attacker and maliciously issues an access request to an access resource, it is assumed that the attacker will arbitrarily select attributes to be input and issue multiple access requests. The access control device 200 determines the response method and presentation mode to be presented, taking into consideration the possibility that the end user is an attacker.

[0048] The presentation unit 102 determines a presentation destination to which the response method determined by the access control device 200 is to be presented, and transmits information indicating that the access request has been denied and the response method to the determined presentation destination. For example, the presentation unit 102 can select a person, a terminal, or a device to be the presentation destination. For example, the presentation destination can be a user terminal, a terminal of an administrator who manages access control, or both.

[0049] As an example, the presenting unit 102 may also acquire at least any one of information on the response cost, the recommended cost, or the total cost for each response method from the response method determination unit 202 together with the response method. The total cost is an evaluation value combining the response cost and the recommended cost. At this time, the presenting unit 102 selects to transmit the response method to both the user terminal and the administrator's terminal, or to transmit the response method to the administrator's terminal but not to the user terminal, based on at least any one of the response cost, the recommended cost, or the total cost of the response method. When the presenting unit 102 does not transmit the response method to the user terminal, the presenting unit 102 transmits information indicating that the access request has been denied to the user terminal.

[0050] For example, when the recommended cost of the handling method is less than a predetermined threshold, the presenting unit 102 transmits the handling method to both the user terminal and the manager's terminal. On the other hand, when the recommended cost of the handling method is equal to or greater than a predetermined threshold, the presenting unit 102 transmits the handling method to the manager's terminal but does not transmit it to the user terminal. Here, the presenting unit 102 may transmit, to the manager's terminal, an inquiry for permission to transmit the handling method to the user terminal together with the handling method. When an instruction for permission to transmit the handling method is received from the manager's terminal in response to the inquiry, the presenting unit 102 is able to transmit the handling method to the user terminal.

[0051] As described later, the recommendation cost indicates the possibility of providing an attacker with information indicating the boundary between the types of actions output by the access determining engine 203 being "approved" and "denied". Therefore, if the recommendation cost is equal to or greater than a predetermined threshold, when the presenting unit 102 transmits information with a relatively high recommendation cost to the user terminal, if the end user is an attacker, there is a possibility that the information provided may be advantageous to the attacker. Therefore, the presenting unit 102 first transmits a response method to the administrator's terminal, thereby making the administrator determine whether or not it is acceptable to present the response method to the end user. If the administrator determines that it is acceptable to present the response method to the end user, the administrator operates the terminal to output an instruction to permit transmission to the presenting unit 102.

[0052] However, when at least one of the response cost or the total cost of the response method is less than a predetermined threshold, the presenting unit 102 may transmit the response method to both the user terminal and the manager's terminal. On the other hand, when at least one of the response cost or the total cost of the response method is equal to or greater than a predetermined threshold, the presenting unit 102 transmits the response method to the manager's terminal, but may not transmit it to the user terminal. Here, the presenting unit 102 may transmit, together with the response method, an inquiry for permission to transmit the response method to the user terminal to the manager's terminal. When an instruction for permission to transmit the response method is received from the manager's terminal in response to the inquiry, the presenting unit 102 can transmit the response method to the user terminal.

[0053] Furthermore, when presenting a response method to the user, the presentation unit 102 may also present a notification regarding the recommended cost of the response method. The notification regarding the recommended cost may, for example, indicate a numerical value of the recommended cost of the response method, or may indicate that the recommended cost of the response method is equal to or less than a predetermined threshold used by the response method determination unit 202 when selecting a response method. The presentation unit 102 may present the response method and the numerical value of the recommended cost of the response method to the manager's terminal. Furthermore, the presentation unit 102 may present, to the user terminal, the response method and the fact that the recommended cost of the response method is equal to or less than a predetermined threshold.

[0054] Similarly, when presenting a response method to the user, the presentation unit 102 may also present a notification regarding at least one of the response cost or the total cost of the response method. The notification regarding the response cost or the total cost may, for example, indicate the numerical value of the response cost or the total cost of the response method, or may indicate that the response cost or the total cost of the response method is equal to or less than a predetermined threshold used by the response method determination unit 202 when selecting a response method. The presentation unit 102 may present the response method and the numerical value of the response cost or the total cost of the response method to the manager's terminal. Furthermore, the presentation unit 102 may present the response method and the fact that the response cost or the total cost of the response method is equal to or less than a predetermined threshold to the user terminal.

[0055] Furthermore, the presenting unit 102 can also determine an upper limit on the number of times that a countermeasure method is presented to the same presentation destination (for example, the same user terminal). As described above, if an end user is an attacker and maliciously executes an access request to an access resource, it is assumed that the attacker executes multiple access requests. Therefore, the presenting unit 102 can determine an upper limit on the number of times that a countermeasure method is presented, with the intention of suppressing the provision to the attacker of information on a clear boundary that separates between cases where access is permitted and cases where access is denied.

[0056] For example, the presenting unit 102 refers to a list in which specific terminals are described, and determines whether or not the user terminal that transmitted the access request received by the receiving unit 101 is described in the list. If the user terminal is not described in the list, the presenting unit 102 sets an upper limit (predetermined threshold) for the number of presentations within a predetermined period for the user terminal. If the same user terminal issues access requests for different first sets to the receiving unit 101 a number of times that exceeds the upper limit within a predetermined period, the presenting unit 102 does not present a response method for the access requests that exceed the upper limit to the user terminal. Alternatively, the presenting unit 102 presents a response method for the access requests that exceed the upper limit to the administrator's terminal, not to the user terminal.

[0057] Furthermore, when presenting a response method for a certain access request, the presenting unit 102 may select a communication path to be used for transmitting information on the response method based on at least one attribute indicated by the access request. For example, the presenting unit 102 may determine, based on at least one attribute, whether or not to use a protected communication path for transmitting the information on the response method to a user terminal to which the response method is to be presented. Alternatively, the presenting unit 102 may determine, based on at least one attribute, whether or not to perform information conversion, such as encryption or encoding, on the information on the response method to be transmitted.

[0058] The presentation unit 102 may present one response method or a plurality of response methods together as the response methods determined by the access control device 200. When the presentation unit 102 acquires information indicating that no response method has been found from the access control device 200, the presentation unit 102 can present the information.

[0059] Furthermore, the presenting unit 102 may output information on the constraint conditions associated with the attribute change together with the response method to the user's terminal. The constraint conditions are determined by the response candidate constraining unit 201, and details thereof will be described later. The information on the constraint conditions refers to information that indirectly represents all or a part of the constraint conditions, or at least a part of the constraint conditions. Information that indirectly represents at least a part of the constraint conditions refers to information that has been processed in some way on the constraint conditions so that the constraint conditions are not presented as they are, and the information on the constraint conditions cannot be identified.

[0060] The presentation unit 102 outputs information on all or part of the constraint conditions as is, together with the response method, to the manager's terminal. On the other hand, the presentation unit 102 outputs information indirectly indicating at least part of the constraint conditions, together with the response method, to the user's terminal.

[0061] The corresponding candidate constraint unit 201 acquires a first set of information related to the access request from the receiving unit 101. Based on the first set of information, the corresponding candidate constraint unit 201 determines a constraint condition to be used when searching for a combination of attributes for which access is permitted that is similar to the first set of information. The corresponding candidate constraint unit 201 outputs the determined constraint condition and the first set of information to the response method determination unit 202.

[0062] In this example, the corresponding candidate restricting unit 201 determines, as a restricting condition, a search range of the second set for which accessibility is determined using the access determining engine 203, and a search order of the second set for which accessibility is determined using the access determining engine 203. However, the corresponding candidate restricting unit 201 may determine either the search range or the search order.

[0063] The corresponding candidate constraint unit 201 can determine the search range, for example, by constraining the number of attributes to be changed simultaneously from the first set as a reference to a predetermined threshold value N or less (N is any integer equal to or greater than 1). For example, when N is 2, the corresponding candidate constraint unit 201 sets the number of attributes to be changed simultaneously from the first set to a range between 1 and 2, so that the presence or absence of access authorization is determined using the access determination engine 203.

[0064] As described below, the corresponding candidate constraint unit 201 can determine constraint conditions based on the characteristics of the attributes in the first set. Note that the constraint condition setting methods described below can be appropriately combined.

[0065] For example, the corresponding candidate constraint unit 201 may set a search order such that a second set in which a predetermined type of attribute is changed from the first set is given priority over a second set in which other types of attributes are changed to determine whether or not access is permitted. For example, the corresponding candidate constraint unit 201 may use a tool such as SHAP or LIME related to machine learning models to identify attributes that affect the access determination engine 203's access permission determination. The corresponding candidate constraint unit 201 can set a search order such that a combination in which only the identified attributes from the first set are changed at the same time is given priority over a combination in which attributes other than the first set are changed to determine whether or not access is permitted.

[0066] Furthermore, when determining the search range by restricting the number of attributes to be changed to be equal to or less than a predetermined threshold value N, the corresponding candidate restricting unit 201 may set the search order so that a combination in which the number of attributes to be changed simultaneously from the first set is given priority in determining whether or not access is authorized. In other words, the corresponding candidate restricting unit 201 sets the search order so that the second set in which the number of attributes is changed from the first set by only one is searched first, followed by the second set in which the number of attributes is changed from the first set by two, the second set in which the number of attributes is changed from the first set by three, and so on.

[0067] Furthermore, the response candidate constraint unit 201 may determine the search range, which is a constraint condition, according to the causal relationship indicated by a plurality of attributes. Fig. 4 is a diagram showing an example of the causal relationship indicated by a plurality of response methods and a plurality of attributes. OS update, re-authentication, and access by another account shown on the left side of Fig. 4 are methods that may be presented as response methods. Meanwhile, the device OS (the OS used by the device from which the access originates), authentication time, user's department, behavioral anomaly level, and number of vulnerabilities shown on the right side of Fig. 4 indicate attributes.

[0068] As shown in Fig. 4, an OS update changes the device OS, re-authentication changes the authentication time and the behavior anomaly level, and access by another account changes the authentication time, the department to which the user belongs, and the behavior anomaly level. Here, the number of vulnerabilities is changed according to the device OS. Therefore, when determining a search range for the set of five attribute information pieces shown in Fig. 4, the correspondence candidate restricting unit 201 does not need to set the device OS and the number of vulnerabilities as independent variables for the attributes. By treating the device OS and the number of vulnerabilities as a set of variables, the correspondence candidate restricting unit 201 can reduce the time required for searching compared to when both attributes are treated as independent variables.

[0069] The corresponding candidate constraint unit 201 may acquire the causal relationships between a plurality of attributes as shown in Fig. 4 by, for example, executing a simulation. The corresponding candidate constraint unit 201 can specify two or more attributes that can be treated as a set of variables in the first set of attributes by applying the first set of information related to the access request to the previously acquired information on the causal relationships.

[0070] Furthermore, the corresponding candidate constraint unit 201 may determine the search range by determining a constraint condition for a direction in which the attribute is changed so that the safety level of the attribute is higher for one or more attributes changed from the first set. That is, the corresponding candidate constraint unit 201 may determine a constraint condition such that the action is more likely to be "permitted" when the presence or absence of access authorization is determined using the access determination engine 203, compared with the first set. The corresponding candidate constraint unit 201 may determine a constraint condition, for example, using quantitative or qualitative information indicating the safety level of the attribute value.

[0071] For example, the corresponding candidate restricting unit 201 may determine a restricting condition so that the authentication method, which is one attribute of the first set, is changed to a stronger authentication method (i.e., a method with a higher degree of security than the current authentication method). Alternatively, the corresponding candidate restricting unit 201 may determine a restricting condition so that the elapsed time since the last authentication was successful or the elapsed time since the latest authentication was performed (hereinafter, also simply referred to as elapsed time) which is one attribute of the first set is changed to be shorter than the current elapsed time. Alternatively, the corresponding candidate restricting unit 201 may determine a restricting condition so that the update of the device OS, which is one attribute of the first set, is changed to be newer than the OS currently used by the device that is the access source. Alternatively, the corresponding candidate restricting unit 201 may determine a restricting condition so that the access resource, which is one attribute of the first set, is changed to be a different access resource.

[0072] Furthermore, the corresponding candidate constraint unit 201 may output information on the constraint conditions to the presentation unit 102 so as to notify the user of information on the constraint conditions (information indirectly indicating all or part of the constraint conditions, or at least part of the constraint conditions).

[0073] Returning to Fig. 3, the description of the access management system S will be continued. The response method determination unit 202 generates a plurality of second sets so as to satisfy the search range of the constraint condition determined by the response candidate constraint unit 201. The second sets are the first sets in which one or more attributes have been changed based on a certain response method. The second sets can also be said to be candidates for attribute change indicated by the response method presented to the user.

[0074] Here, the response method determination unit 202 changes one or more attributes in the first set according to various response methods shown below. The response methods include, for example, at least one of re-authentication, introduction of an authentication method different from the existing authentication method, change of access time, processing at the access source, processing related to the accessed resource, and the like. The introduction of a different authentication method includes, for example, introduction of at least one of password authentication, biometric authentication, two-step authentication, device authentication, behavior authentication, and the like. The processing at the access source includes, for example, at least one of changing the department to which the user of the access source belongs, changing the position of the access source, updating the device OS, changing software, performing security inspection, changing the location, and the like. Here, the software change includes, for example, at least one of installing, uninstalling, and updating the version of software. The processing related to the accessed resource includes, for example, at least one of changing the accessed resource (for example, changing the department of the accessed destination), changing the encryption method of the accessed resource, changing the owner information of the accessed resource, waiting for a change in the utilization status of the accessed resource, changing the security requirements of the accessed resource, changing the communication path for transmitting the accessed resource to the access source, and the like. However, the response methods are not limited to those shown above.

[0075] The response method determination unit 202 inputs the generated second sets to the access determination engine 203. At this time, if the response candidate constraint unit 201 determines a search order as a constraint condition, the response method determination unit 202 makes the order in which the generated second sets are input to the access determination engine 203 match the search order.

[0076] The response method determination unit 202 acquires the result of the access permission judgment output by the access judgment engine 203 for each second pair. For example, if the result of the access permission judgment is expressed as "approved" or "denied", the response method determination unit 202 extracts the second pair whose result is "approved". If the result of the access permission judgment is expressed as a numerical value in a predetermined range, the response method determination unit 202 extracts the second pair whose result exists within a numerical range that is within a predetermined difference from one end numerical value of the range indicating "approved". In other words, the response method determination unit 202 extracts the second pair whose result is likely to be "approved".

[0077] The handling method determination unit 202 outputs information including all the extracted second sets and the first set to the handling cost calculation unit 204 and the recommendation cost calculation unit 205. The handling cost calculation unit 204 calculates the handling cost of changing the attribute from the first set to the second set for each of the second sets, as described later. Also, the recommendation cost calculation unit 205 calculates the recommendation cost of changing the attribute from the first set to the second set for each of the second sets, as described later.

[0078] Then, the handling method determination unit 202 acquires, for each extracted second pair, a handling method corresponding to the second pair and a handling cost calculated by the handling cost calculation unit 204 from the handling cost calculation unit 204. Also, for each extracted second pair, the handling method determination unit 202 acquires, for the second pair, a handling method corresponding to the second pair and a recommendation cost calculated by the recommendation cost calculation unit 205 from the recommendation cost calculation unit 205. The handling method determination unit 202 uses the acquired handling cost and recommendation cost to select one or more handling methods corresponding to the extracted second pair as handling methods that can be presented to the user. However, the handling method determination unit 202 may determine that there is no handling method that can be presented to the user. In other words, the handling method may not be presented to the user.

[0079] For example, the handling method determination unit 202 may select a handling method that satisfies at least one of the following conditions: the handling cost is equal to or less than a predetermined first threshold, or the recommendation cost is equal to or less than a predetermined second threshold, from among the handling methods corresponding to the extracted second pair. Alternatively, the handling method determination unit 202 may select a handling method that satisfies at least one of the following conditions: the handling cost is equal to or less than a predetermined third threshold, from among the handling methods corresponding to the extracted second pair.

[0080] Here, the method by which the handling method determination unit 202 calculates the total cost using the handling cost and the recommendation cost is arbitrary. For example, the handling method determination unit 202 may calculate the total cost by simply adding the handling cost and the recommendation cost. As another example, the handling method determination unit 202 may calculate the total cost by adding the handling cost and the recommendation cost after weighting at least one of the handling cost and the recommendation cost. Furthermore, the handling method determination unit 202 may calculate the total cost by multiplying the handling cost by the recommendation cost.

[0081] As yet another example, the handling method determination unit 202 may sort the handling costs and recommendation costs of the extracted handling methods corresponding to the second pair in ascending order. The handling method determination unit 202 may select a handling method that satisfies at least one of the following: the handling cost is within a rank of a predetermined fourth threshold, or the recommendation cost is within a rank of a predetermined fifth threshold. The above-described methods for selecting a handling method that can be presented to a user may be used in appropriate combination.

[0082] As yet another example, the response method determination unit 202 may select a response method that can be presented to the user by using an AI model that has been trained in advance. This AI model is trained by inputting training data including a plurality of sets of response costs and recommendation costs of sample attribute combinations and information indicating whether or not the response method can be presented to the user as a correct label. After this training, the response method determination unit 202 inputs the response costs and recommendation costs of the response method to be determined to the AI ​​model. In response to this input, the AI ​​model executes an inference process that outputs information indicating whether or not the response method can be presented to the user. The response method determination unit 202 executes this process for each of the response methods corresponding to the extracted second set, thereby acquiring information indicating whether or not each of the response methods can be presented to the user. The response method determination unit 202 selects a response method that can be presented to the user based on the information indicating whether or not the response method can be presented to the user.

[0083] The response method determination unit 202 can select a response method that can be presented to the user by using any of the above-described methods. Here, when there are multiple selected response methods, the response method determination unit 202 may determine all of the multiple response methods as the response methods to be actually presented to the user.

[0084] However, the response method determination unit 202 may select some of the selected multiple response methods to determine one or more response methods to be actually presented to the user. For example, the response method determination unit 202 may identify multiple response methods from the selected multiple response methods such that at least one difference between the recommendation cost and the response cost is equal to or less than a predetermined threshold. The response method determination unit 202 randomly selects some of the identified multiple response methods. Alternatively, the response method determination unit 202 may simply randomly select some of the selected multiple response methods to determine one or more response methods to be actually presented to the user. By performing the above-described process by the response method determination unit 202, even if the end user is an attacker, it is possible to prevent the attacker from being provided with information on a clear boundary between cases where access is permitted and cases where access is denied.

[0085] The response method determination unit 202 outputs one or more response methods selected as described above to the presentation unit 102. When the number of selected second sets is 0, the response method determination unit 202 outputs information indicating that no response method has been found to the presentation unit 102. As described above, the presentation unit 102 presents the information output by the response method determination unit 202 to the user.

[0086] Furthermore, when outputting one or more handling methods to the presentation unit 102, the handling method determination unit 202 may output to the presentation unit 102 at least any one of information on the handling cost, the recommended cost, and the total cost for each handling method.

[0087] The access determining engine 203 may be realized by a pre-trained AI model. The learning and inference processing of this AI model is as described in the first embodiment, and therefore will not be described again. When a first set related to an access request acquired from the receiving unit 101 is input, the access determining engine 203 outputs "deny" as an action for access. The information of "deny" output by the access determining engine 203 is output to the receiving unit 101.

[0088] Furthermore, the access determining engine 203 outputs an action for each second pair when the second pair is input from the response method determining unit 202. Information on the action output by the access determining engine 203 is output to the response method determining unit 202.

[0089] The response cost calculation unit 204 calculates the response cost of changing the attribute from the first group to the second group for each of the second groups output by the response method determination unit 202. That is, the response cost calculation unit 204 identifies a response method for changing the first group related to the access request to the second group, and calculates the response cost for the response method for each second group. Note that, for any second group, the response cost calculation unit 204 identifies a response method for changing from the first group to the second group based on the difference in attributes between the second group and the first group.

[0090] Fig. 5 is a table showing an example of the response cost calculated by the response cost calculation unit 204 for the response method. In Fig. 5, the response methods described are (A) changing the authentication method, which is additional authentication, to A, (B) changing the elapsed time to B, (C) changing the OS to C, which is updating the device OS, and (D) changing the department to D, which is changing the department of the access destination. In addition, as constraints for each response method, it is set that for (A), A is stronger than the current authentication method, for (B), B is less than the current elapsed time, and for (C), C is newer than the current OS. Note that no constraints are set for (D).

[0091] In Figure 5, the calculated response costs for (A), (B), (C), and (D) are 5, 1, 10, and 20, respectively. This indicates that the cost for an end user to take each response method is highest for (D), followed by (C), (A), and then (B). In other words, the order of the least likely response methods for an end user is (D), followed by (C), (A), and then (B).

[0092] The correspondence cost calculation unit 204 may calculate the correspondence cost based on at least one of the costs of time, expense, labor, and physical constraints required for the user to change attributes from the first set to the second set. The correspondence cost calculation unit 204 expresses the correspondence cost as a numerical value. When the correspondence method to be calculated is changed, the correspondence cost calculation unit 204 can change the correspondence cost to be calculated. When the second set to be calculated for the correspondence cost is a combination in which multiple attributes have been changed compared to the first set, the correspondence cost calculation unit 204 calculates the correspondence cost for the second set by adding up the correspondence costs for changing each attribute.

[0093] Alternatively, the response cost calculation unit 204 may estimate the response cost of the response method to be calculated based on the selection history data of the response method acquired in advance, for example, by using a data mining technique. For example, the AI ​​model may be trained in advance by inputting each response method indicated in the selection history data and at least one of the costs (correct answer label) of the time, cost, effort, and physical constraints required for each response method. The response cost calculation unit 204 inputs the response method to be calculated to the trained AI model, thereby acquiring information on the response cost of each response method output by the AI ​​model.

[0094] Alternatively, the response cost calculation unit 204 may use any algorithm. For example, the response cost calculation unit 204 may use a logistic regression method to generate a regression model regarding response costs based on previously acquired response method selection history data. The response cost calculation unit 204 inputs the response method to be calculated to the regression model, thereby acquiring information on the response cost of each response method output by the regression model. The response cost calculation unit 204 outputs the response cost of each response method acquired in this way by the response cost calculation unit 204 to the response method determination unit 202.

[0095] Returning to FIG. 3, the description will be continued. The recommendation cost calculation unit 205 calculates a recommendation cost for changing the attribute from the first group to the second group for each of the second groups output by the handling method determination unit 202. That is, the recommendation cost calculation unit 205 identifies a handling method for changing the first group related to the access request to the second group, and calculates a recommendation cost for the handling method for each second group. Note that, for any second group, the recommendation cost calculation unit 205 identifies a handling method for changing from the first group to the second group based on the difference in attributes between the second group and the first group.

[0096] The recommendation cost calculation unit 205 calculates, as a recommendation cost, the possibility (security risk) of providing an attacker with information indicating the boundary between the types of actions output by the access judgment engine 203 being "approved" and "denied" when an action is taken to change attributes from the first set to the second set.

[0097] The recommendation cost calculation unit 205 expresses the recommendation cost as a numerical value. When the method of handling the calculation target is changed, the recommendation cost calculation unit 205 can change the recommendation cost to be calculated. When the second pair to be calculated for the recommendation cost is a combination in which multiple attributes are changed compared to the first pair, the recommendation cost calculation unit 205 calculates the recommendation cost for the second pair by adding up the recommendation costs for changing each attribute.

[0098] Fig. 6 is a table showing an example of recommendation costs calculated by the recommendation cost calculation unit 205 for the corresponding method. In Fig. 6, the corresponding methods described are (E1) updating the OS from C1 to C2 as an update of the device OS, (E2) updating the OS from C1 to C3 as an update of the device OS, and (E3) updating the OS from C1 to C3 as an update of the device OS and further changing the elapsed time as an update of the device OS. (E1) to (E3) are specific examples of (C) shown in Fig. 5. Here, C2 is a newer version of the OS than C1, and C3 is a newer version of the OS than C2.

[0099] In Fig. 6, the response costs of (E1), (E2), and (E3) are calculated as 20, 5, and 2, respectively. This indicates that the likelihood of providing an attacker with information indicating the above-mentioned boundary increases in the order of (E1), (E2), and (E3). In other words, from the viewpoint of security, the response methods are more preferable in the order of (E3), (E2), and (E1).

[0100] FIG. 7 is a schematic diagram showing example states (E1) to (E3). State P0 indicates an initial state in which the device OS is C1 and the elapsed time is 13 hours. State P1 indicates a state in which the response method (E1) has been applied to state P0, the device OS is C2, and the elapsed time is 13 hours. State P2 indicates a state in which the response method (E2) has been applied to state P0, the device OS is C3, and the elapsed time is 13 hours. State P3 indicates a state in which the response method (E3) has been applied to state P0, the device OS is C3, and the elapsed time is 1 hour.

[0101] Region R1 indicates the region where the action is "Deny", and region R2 indicates the region where the action is "Approve". In state P0, which is the initial state, the action is "Deny", so state P0 is located within region R1. On the other hand, in states P1 to P3, the action is "Approve", so states P1 to P3 are located within region R2. In addition, in FIG. 7, the border between region R1 and region R2 is denoted as BA.

[0102] In this example, the response method (E1) is information indicating a boundary BA where the types of actions output by the access determining engine 203 are divided into "approval" and "denial", or information indicating a location close to the boundary BA. If the response method (E1) is presented to an end user, and it is assumed that the end user is an attacker, then information on a clear boundary that divides between cases where access is approved and cases where access is denied will be provided to the attacker. Therefore, the recommendation cost calculation unit 205 calculates the recommendation cost of (E1) to be high.

[0103] On the other hand, in the case of (E2), a margin is added to the response of (E1). Therefore, if (E2) is presented to an end user, assuming that the end user is an attacker, it is unclear to the attacker whether the boundary between when access is permitted and when it is denied is when the device OS is updated from C1 to C2, or when the device OS is updated from C1 to C3. Therefore, the recommendation cost calculation unit 205 calculates the recommendation cost of (E2) to be lower than the recommendation cost of (E1).

[0104] In the case of (E3), a further margin is added to the response of (E2). Therefore, when (E3) is presented to an end user, assuming that the end user is an attacker, the boundary between when access is permitted and when it is denied becomes unclear to the attacker, as described below. In other words, it becomes unclear to the attacker whether the boundary is updating the device OS from C1 to C2, updating the device OS from C1 to C3, changing the elapsed time, or changing the elapsed time and further updating the device OS from C1 to C2 or C3. Therefore, the recommendation cost calculation unit 205 calculates the recommendation cost of (E3) to be even lower than the recommendation cost of (E2).

[0105] By calculating the recommendation cost as described above, the recommendation cost calculation unit 205 reduces the possibility of information indicating the boundary between actions being “approved” and “denied” being leaked when a countermeasure is presented.

[0106] 7, the recommendation cost calculation unit 205 may calculate the recommendation cost as follows: A distance D between the boundary BA and the state x (i.e., the second set) when the response method to be calculated is applied to the initial state (i.e., the first set) is defined as follows:

number

[0107] As another example, the recommendation cost calculation unit 205 may define the distance D between the boundary BA and the state x in the case where the response method to be calculated is applied to the initial state z as follows:

number

[0108] The recommendation cost calculation unit 205 calculates a function f(D) indicating the recommendation cost of the method to be calculated, for example, −D, D ―1 It can be set to be any monotonically decreasing function of D, such as

[0109] The recommendation cost calculation unit 205 may estimate the recommendation cost of the action method to be calculated based on the recommendation cost history data of the action method acquired in advance, for example, by using a data mining technique. For example, the AI ​​model may be trained in advance by inputting each action method indicated in the recommendation cost history data and the recommendation cost (correct label) for each action method. The recommendation cost calculation unit 205 inputs the action method to be calculated to the trained AI model, thereby acquiring information on the recommendation cost of each action method output by the AI ​​model.

[0110] Alternatively, the recommendation cost calculation unit 205 may use any algorithm. For example, the recommendation cost calculation unit 205 may use a logistic regression method to generate a regression model for recommendation costs based on recommendation cost history data of the handling methods acquired in advance. The recommendation cost calculation unit 205 inputs the handling methods to be calculated to the regression model, thereby acquiring information on the recommendation costs of each handling method output by the regression model. The recommendation cost calculation unit 205 outputs the recommendation costs of each handling method acquired by the recommendation cost calculation unit 205 in this way to the handling method determination unit 202.

[0111] However, the recommendation costs of at least some of the countermeasures may be defined by an administrator or the like, rather than being calculated by the recommendation cost calculation unit 205. The recommendation cost defined by the administrator or the like may be, for example, a recommendation cost related to a change in an attribute indicating the boundary between the types of actions being "approved" and "denied" (i.e., information that is not desired to be given to an attacker). The administrator can set the recommendation cost related to such a change in an attribute to a value significantly higher than the recommendation costs related to other changes in attributes.

[0112] The recommendation cost calculation unit 205 outputs the recommendation cost for each second pair calculated as above to the handling method determination unit 202.

[0113] As described above, the handling method determination unit 202 selects the second group related to the handling method to be presented to the user from the extracted second groups using the handling cost and recommendation cost for each second group. Explaining with reference to Figs. 5 and 6, the handling method determination unit 202 selects the handling method (E3) as the handling method with the smallest recommendation cost shown in Fig. 6 or the recommendation cost equal to or less than a predetermined threshold (e.g., 4). Then, the handling method determination unit 202 determines that the handling cost required for the selected (E3) is the sum of (B) and (C) shown in Fig. 5, and determines that the handling cost is 11 (=1+10). The handling method determination unit 202 determines that this handling cost is equal to or less than a predetermined threshold (e.g., 15), and determines that the handling method (E3) is problem-free from the viewpoint of the handling cost as well. Alternatively, the handling method determination unit 202 determines that the total cost, which is an evaluation value obtained by adding up the recommendation cost and the handling cost, is equal to or less than a predetermined threshold (e.g., 20), and determines that the handling method (E3) is acceptable from the viewpoint of the total cost as well. Therefore, the handling method determination unit 202 outputs the handling method (E3) to the presentation unit 102. The presentation unit 102 presents to the user terminal, as the output handling method (E3), "update the OS from C1 to C3 as an update of the device OS, and further change the elapsed time."

[0114] The response cost calculation unit 204 and the recommendation cost calculation unit 205 may each indicate the cost as qualitative information rather than a numerical value. For example, the response cost and the recommendation cost may be expressed as qualitative and discrete information such as high, medium, and low. The response method determination unit 202 can select a second set of response methods to be presented to the user based on the response cost and the recommendation cost expressed in this way.

[0115] For example, the handling method determination unit 202 may select a handling method that satisfies at least one of the following conditions: the handling cost is equal to or less than a predetermined level, or the recommendation cost is equal to or less than a predetermined level, from among the handling methods corresponding to the extracted second set. Furthermore, the handling method determination unit 202 may select a handling method to be presented to the user by using an AI model trained in advance for the handling cost and recommendation cost indicated as qualitative information.

[0116] [Flow description] 8A and 8B are flowcharts showing an example of a typical process of the access management system S, and the process of the access management system S is explained using this flowchart. Note that the details of each process are as described above, and therefore will not be explained as appropriate.

[0117] First, the access determining engine 203 determines whether or not to permit access to the first set related to the access request acquired from the receiving unit 101. When the access determining engine 203 outputs "deny", the access control device 200 denies the access request (step S21: denial step).

[0118] When the access request is denied, the reception unit 101 requests the access control device 200 to determine how to handle the denial (step S22: request step). Specifically, the reception unit 101 acquires a combination of multiple attributes representing the access request, and outputs the acquired information as a first set of information to the corresponding candidate constraint unit 201. The corresponding candidate constraint unit 201 determines constraint conditions to be used in the search based on the acquired first set of information (step S23: constraint condition determination step).

[0119] The response method determination unit 202 generates a second set (candidates for attribute change) by modifying the first set in accordance with the determined constraint condition (step S24: generation step). Here, the response method determination unit 202 outputs the second set to the access determination engine 203 every time the second set is generated. If the search order is determined as a constraint condition, the response method determination unit 202 generates the second set in accordance with the order related to the search order. The access determination engine 203 outputs an action for the input second set.

[0120] The response method determination unit 202 judges whether the action output by the access determining engine 203 is "approval" (step S25: authorization determination step). If the action is "denial" (No in step S25), the response method determination unit 202 returns to the process of step S24 and generates a second set that has not been judged by the access determining engine 203 according to the determined constraint condition. Then, the judgment of step S25 is executed for the generated second set.

[0121] If the action is "approved" (Yes in step S25), the handling method determination unit 202 outputs information including the second set determined to be "approved" and the first set to the handling cost calculation unit 204 and the recommendation cost calculation unit 205, respectively. The handling cost calculation unit 204 calculates the handling cost of the handling method of changing the attribute from the first set to the second set for the second set (step S26). In addition, the recommendation cost calculation unit 205 calculates the recommendation cost of the handling method of changing the attribute from the first set to the second set for the second set (step S27). Note that the process of step S26 and the process of step S27 may be executed first, or both processes may be executed in parallel. Thereafter, the handling method determination unit 202 acquires the handling cost and recommendation cost of the handling method from the handling cost calculation unit 204 and the recommendation cost calculation unit 205, respectively.

[0122] Based on the calculated response cost and recommendation cost, the handling method determination unit 202 determines whether or not there are a predetermined threshold or more of handling methods that can be presented to the user in the second set in which the action has been determined to be "approved" (step S28: presentation determination step). This predetermined threshold is an arbitrary value equal to or greater than 1. If the number of handling methods that can be presented is less than the predetermined threshold (No in step S28), the processes of steps S24 to S28 are executed until the number of handling methods that can be presented becomes equal to or greater than the predetermined threshold.

[0123] If the number of presentable response methods is equal to or greater than a predetermined threshold (Yes in step S28), the response method determination unit 202 determines a response method to be presented to the user (step S29). The response method determination unit 202 may determine all response methods determined to be presentable as the response methods to be presented to the user. Alternatively, the response method determination unit 202 may determine a response method randomly selected from all response methods determined to be presentable as the response method to be presented to the user. The response method determination unit 202 outputs the determined response method to the presentation unit 102. The presentation unit 102 presents the determined response method to the user (step S30).

[0124] If the number of presentable response methods is equal to or greater than a predetermined threshold, the response method determination unit 202 can execute the following process. The response method determination unit 202 may terminate the process without causing the access determination engine 203 to determine whether or not access is possible for the second set, which is within the search range of the constraint condition and has not yet been determined by the access determination engine 203. The reason for executing this process is that the number of response methods presentable to the user has already been generated to the predetermined threshold or more, and there is no need to search for any more response methods.

[0125] 8A and 8B, the processes of steps S26 and S27 may be executed before the determination process of step S25, or the processes of steps S26 and S27 may be executed in parallel with the determination process of step S25. After that, the response method determination unit 202 executes the determination process of step S28.

[0126] As another variation, the response method determination unit 202 may generate a predetermined number of second sets or all second sets that satisfy the constraint condition, and then input the generated second sets to the access determination engine 203. If a search order is determined as a constraint condition, the response method determination unit 202 may input the generated second sets to the access determination engine 203 based on the order. If the access determination result of the second set output by the access determination engine 203 is "approved", the response method determination unit 202 outputs information on the second set to the response cost calculation unit 204 and the recommended cost calculation unit 205. On the other hand, if the access determination result of the second set output by the access determination engine 203 is "denied", the response method determination unit 202 does not output information on the second set to the response cost calculation unit 204 and the recommended cost calculation unit 205. If a search order is set for the second sets, the above processing is performed based on the search order.

[0127] However, as shown in Figures 8A and 8B, the response method determination unit 202 can input the second pairs that satisfy the constraint conditions to the access judgment engine 203 in the order specified by the search order as soon as the second pairs that satisfy the constraint conditions are generated, without waiting for all the second pairs that satisfy the constraint conditions to be generated. In this case, the response method determination unit 202 can obtain the response methods that can be presented from the viewpoints of response cost and recommendation cost as early as possible. Therefore, the access management system S can shorten the time required for the entire process of presenting the response methods, and improve the convenience for the user.

[0128] [Effect description] In recent years, the importance of access control in zero trust networks has increased with the advancement of zero trust network technology. Zero trust networks can be applied to local 5G used by companies, local governments, etc.

[0129] As an example, the zero trust network calculates a security score for access from devices in the entire communication path and determines whether to allow the access. The devices in the entire communication path include relay nodes with different providers, 5G core nodes, data centers, etc. There are threats on the network, such as DoS (Denial of Services), ciphertext decryption, and session hijacking. However, even if such threats invade the network, the zero trust network can prevent the threats from reaching important resources by access control, and prevent the damage from spreading. In addition, the zero trust network does not block access from outside the network in general, but can allow reliable access by making a judgment based on the above-mentioned score calculation. Therefore, it is possible to achieve both security and availability of communication even when using a network that includes untrusted nodes.

[0130] In such a zero trust network, when access is denied, the user cannot obtain information on what action to take to allow access. However, the access management system S can output information that gives the user a hint on what action to take to allow access by executing the above process.

[0131] Furthermore, the response candidate constraint unit 201 may determine, as constraint conditions, the range or order of a second set for determining whether access is possible or not using the access determination engine 203. By determining the constraint conditions of the second set to be determined, it is possible to terminate the search early, and the time required for the entire process of presenting response methods can be shortened. Furthermore, by determining the constraint conditions, it is possible to suppress the presentation of response methods that are considered inappropriate for improving the security of access, such as downgrading the OS. Therefore, the security of access can be improved.

[0132] Furthermore, the presenting unit 102 may further notify the user of information related to the constraint conditions together with a method of dealing with the constraints. This makes it possible to notify the user of what kind of access determination processing the access management system S has executed. This allows the user (e.g., the administrator) to grasp the processing status of the access management system S. This makes it possible to increase the transparency of the access management system S.

[0133] In addition, the correspondence candidate constraint unit 201 may determine the constraint condition based on the characteristics of each of the multiple attributes in the first set. This allows the access management system S to set appropriate constraint conditions for the access request, thereby improving the efficiency while maintaining accuracy in the selection of the correspondence method.

[0134] In addition, the corresponding candidate constraint unit 201 may determine the search range of the second set by using the causal relationship between multiple attributes in the first set as a feature. This allows the access management system S to improve the efficiency of the search process in response to an access request.

[0135] Furthermore, the response method determination unit 202 may specify a response method by determining whether or not the second set of responses can be accessed using the access determination engine 203 based on the search order. When the number of the specified response methods is equal to or greater than a predetermined threshold, the response method determination unit 202 ends the determination of whether or not the second set of responses can be accessed using the access determination engine 203. In this way, by ending the search when no more search for response methods is required, the access management system S can reduce the time required for the entire process of presenting response methods.

[0136] Furthermore, when an access request (a request to determine whether or not access is permitted) is made for each of the different first sets a number of times exceeding the upper limit within a predetermined period, the presenting unit 102 may not notify the end user of a response method for the number of times exceeding the upper limit. Alternatively, the presenting unit 102 may change the notification destination of the response method for the number of times exceeding the upper limit. In this way, even if the end user is an attacker, the presenting unit 102 can suppress the provision of information on a clear boundary that distinguishes whether or not access is permitted to the attacker. Therefore, the degree of security of access can be increased.

[0137] Furthermore, the recommendation cost calculation unit 205 may calculate, as a recommendation cost, a security risk associated with a measure to change an attribute for at least a part of attributes to be changed in the first set. The measure determination unit 202 uses the recommendation cost to identify a measure to be presented to the user. In this way, even if an end user is an attacker, the access management system S can suppress the provision of information on a clear boundary between cases where access is permitted and cases where access is denied to the attacker. Therefore, the degree of security of access can be increased.

[0138] Furthermore, the presenting unit 102 may change the notification destination of the response method according to the recommended cost of the response method. This allows the presenting unit 102 to not immediately notify the end user of a response method that may be information advantageous to an attacker. This can increase the security of access.

[0139] In addition, when presenting a response method to the user, the presentation unit 102 may also present a notification regarding the recommended cost of the response method. This allows the user to grasp the processing status of the access management system S. Therefore, the transparency of the access management system S can be improved.

[0140] Furthermore, the response cost calculation unit 204 may calculate the user's cost for changing attributes for at least some of the attributes to be changed in the first set as the response cost. The response method determination unit 202 uses the response cost to identify a response method to be presented to the user. In this way, the access management system S can suppress the presentation of a response method that is difficult for the user to implement or requires a great deal of effort. Therefore, the usability of the access management system S can be improved.

[0141] In addition, when presenting a response method to the user, the presentation unit 102 may also present a notification regarding the response cost of the response method. This allows the user to understand the processing status of the access management system S. Therefore, the transparency of the access management system S can be improved.

[0142] Furthermore, the response method determination unit 202 may calculate a total cost, which is an evaluation value that combines the response cost and the recommendation cost, and use the total cost to identify a response method to be presented to the user. In this way, the access management system S considers the trade-off between the response cost and the recommendation cost. Therefore, the access management system S can suppress providing a response method that is difficult for the user to implement or requires a lot of effort, and suppress providing an attacker with information on a clear boundary that distinguishes whether access is possible or not. As a result, the access management system S can improve the usability of the access management system S and the security of access.

[0143] The access management system S, like the access management device 10, may be configured as a single computer device, or may be configured as a distributed system having multiple computer devices.

[0144] In the above-described embodiment, the present disclosure has been described as a hardware configuration, but the present disclosure is not limited to this. The present disclosure can also be realized by causing a processor in a computer to execute a computer program to perform the processing of the access management device 10 or each device constituting the access management system S described in the above-described embodiment.

[0145] 9 is a block diagram showing an example of a hardware configuration of an information processing device in which the processing of the system or device shown in each embodiment is executed. Referring to FIG. 9, an information processing device 90 includes a signal processing circuit 91, a processor 92, and a memory 93.

[0146] The signal processing circuit 91 is a circuit for processing signals in accordance with the control of the processor 92. The signal processing circuit 91 may include a communication circuit for receiving a signal from a transmitting device.

[0147] The processor 92 is connected to the memory 93, and performs the processing of the device described in the above embodiment by reading and executing a computer program from the memory 93. As an example of the processor 92, one of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an FPGA (Field-Programmable Gate Array), a DSP (Demand-Side Platform), and an ASIC (Application Specific Integrated Circuit) may be used, or a plurality of them may be used in parallel.

[0148] The memory 93 is composed of a volatile memory, a non-volatile memory, or a combination thereof. The memory 93 is not limited to one, and a plurality of memories may be provided. The volatile memory may be, for example, a RAM (Random Access Memory) such as a DRAM (Dynamic Random Access Memory) or a SRAM (Static Random Access Memory). The non-volatile memory may be, for example, a ROM (Read Only Memory) such as a PROM (Programmable Random Only Memory) or an EPROM (Erasable Programmable Read Only Memory), a flash memory, or an SSD (Solid State Drive).

[0149] The memory 93 is used to store one or more instructions. Here, the one or more instructions are stored as programs in the memory 93. The processor 92 can perform the processes described in the above-mentioned embodiments by reading these programs from the memory 93 and executing them.

[0150] The memory 93 may include a memory built into the processor 92 in addition to a memory provided outside the processor 92. The memory 93 may also include a storage device disposed away from the processors constituting the processor 92. In this case, the processor 92 can access the memory 93 via an I / O (Input / Output) interface.

[0151] As described above, one or more processors included in each device in the above-mentioned embodiments execute one or more programs including a set of instructions for causing a computer to execute the algorithm described using the drawings. By executing the programs, the information processing described in each embodiment can be realized.

[0152] The program includes instructions or software codes that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disk (DVD), Blu-ray (registered trademark) disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagating signals. The transitory computer-readable medium or communication medium may provide the program to the computer via a wired communication path such as electric wire and optical fiber, or via a wireless communication path.

[0153] Some or all of the above embodiments may be described as, but are not limited to, the following appendices. In addition, some or all of the elements (e.g., configurations and functions) described in appendices 2 to 16 that are dependent on appendices 1 may also be dependent on appendices 17 and 18 in the same dependent relationship as appendices 2 to 16. In this way, some or all of the elements described in any appendices may be applied to various hardware, software, recording means for recording software, systems, and methods. (Appendix 1) an acquisition unit that acquires a result of an access permission determination made by an access determination engine for a first set, which is a combination of a plurality of access attributes; a determination unit that, when the acquisition unit acquires that access to the first set is to be denied, determines whether or not access is permitted for one or more second sets that have at least a part of the access attributes of the first set changed, by using the access determination engine, and identifies a method of dealing with the first set for granting access; a notification unit that notifies the user of the response method identified by the identification unit. Access control devices. (Appendix 2) the specifying unit determines at least one of a range of the second set for which access permission is determined using the access determining engine, or an order of the second set for which access permission is determined, based on a constraint condition associated with a change in the access attribute. 2. An access management device as described in claim 1. (Appendix 3) The notification unit further notifies information regarding the constraint condition. 3. An access management device as described in claim 2. (Appendix 4) the identification unit determines the constraint condition based on characteristics indicated by the plurality of access attributes in the first set. 4. An access management device according to claim 2 or 3. (Appendix 5) the identification unit determines a range of the second set by using a causal relationship between the plurality of access attributes in the first set as the characteristic. 5. The access management device of claim 4. (Appendix 6) the identifying unit identifies the response method by determining whether or not the second set is accessible using the access determining engine based on the order, and when the identified response method is equal to or greater than a predetermined threshold, ends the determination of whether or not the second set is accessible using the access determining engine. 6. An access management device according to any one of claims 2 to 5. (Appendix 7) when a request for determining whether or not access is permitted is made for each of the first sets that are different a number of times exceeding a predetermined threshold number within a predetermined period, the notification unit does not notify the response method or changes a notification destination of the response method for the number of times exceeding the predetermined threshold number. 7. An access management device according to any one of claims 1 to 6. (Appendix 8) the identification unit calculates a security risk associated with a measure to change the access attributes for at least the part of the access attributes to be changed in the first set, and identifies the measure by using the security risk. 8. An access management device according to any one of claims 1 to 7. (Appendix 9) the notification unit changes a notification destination of the response method according to the security risk in the response method identified by the identification unit. 9. The access management device of claim 8. (Appendix 10) the notification unit notifies the user of the security risk in the response method identified by the identification unit together with the response method. 9. The access management device of claim 8. (Appendix 11) the identification unit calculates a cost to a user for changing the access attributes of at least a portion of the access attributes to be changed in the first set, and identifies the method of changing the access attributes by using the cost. 11. An access management device according to any one of claims 1 to 10. (Appendix 12) the notification unit notifies the user of the cost of the response method identified by the identification unit together with the response method. 12. The access management device of claim 11. (Appendix 13) the identification unit calculates an evaluation value for at least some of the access attributes to be changed in the first set, the evaluation value being a combination of a security risk associated with the action to change the access attributes and a cost associated with the action to change the access attributes, and identifies the action method by using the evaluation value. 13. An access management device according to any one of claims 1 to 12. (Appendix 14) The notification unit notifies the user of the response method identified by the identification unit, the notification relating to the security risk and the cost, together with the response method. 14. The access management device of claim 13. (Appendix 15) when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; A computer-implemented method of access control. (Appendix 16) when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; A program that causes a computer to do something.

[0154] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be appropriately combined with other embodiments. [Explanation of symbols]

[0155] 10 Access control devices 11 Acquisition Department 12 Specification Department 13 Notification Department S Access Control System 100 User Interface 101 Reception section 102 Presentation section 200 Access control device 201 Response candidate constraint unit 202 Response method decision unit 203 Access decision engine 204 Corresponding cost calculation unit 205 Recommendation Cost Calculation Unit

Claims

1. an acquisition unit that acquires a result of an access permission determination made by an access determination engine for a first set, which is a combination of a plurality of access attributes; a determination unit that, when the acquisition unit acquires that access to the first set is to be denied, determines whether or not access is permitted for one or more second sets that have at least a part of the access attributes of the first set changed, by using the access determination engine, and determines a method of responding to the first set so that access is permitted; a notification unit that notifies the user of the response method identified by the identification unit. Access control devices.

2. the specifying unit determines at least one of a range of the second set for which access permission is determined using the access determining engine, or an order of the second set for which access permission is determined, based on a constraint condition associated with a change in an access attribute. The access management device according to claim 1 .

3. The notification unit further notifies information regarding the constraint condition. The access management device according to claim 2 .

4. the specification unit determines the constraint condition based on characteristics indicated by the plurality of access attributes in the first set.

4. The access management device according to claim 2 or 3.

5. the identifying unit determines a range of the second set by using a causal relationship between the plurality of access attributes in the first set, as the characteristic. The access management device according to claim 4.

6. the identifying unit identifies the response method by determining whether or not the second set is accessible using the access determining engine based on the order, and when the identified response method is equal to or greater than a predetermined threshold, ends the determination of whether or not the second set is accessible using the access determining engine.

4. The access management device according to claim 2 or 3.

7. when a request for determining whether or not access is permitted is made for each of the first sets that are different a number of times exceeding a predetermined threshold number within a predetermined period, the notification unit does not notify the response method or changes a notification destination of the response method for the number of times exceeding the predetermined threshold number. The access management device according to any one of claims 1 to 3.

8. the identification unit calculates a security risk associated with a measure to change the access attributes for at least the part of the access attributes to be changed in the first set, and identifies the measure by using the security risk. The access management device according to any one of claims 1 to 3.

9. the notification unit changes a notification destination of the response method according to the security risk in the response method identified by the identification unit. The access control device according to claim 8.

10. the notification unit notifies the user of the security risk in the response method identified by the identification unit together with the response method. The access control device according to claim 8.

11. the identification unit calculates a cost to a user involved in an action to change the access attributes for at least the part of the access attributes to be changed in the first set, and identifies the action method by using the cost. The access management device according to any one of claims 1 to 3.

12. the notification unit notifies the user of the cost of the response method identified by the identification unit together with the response method. The access management device according to claim 11.

13. the identification unit calculates an evaluation value for at least some of the access attributes to be changed in the first set, the evaluation value being a combination of a security risk associated with the action to change the access attributes and a cost associated with the action to change the access attributes, and identifies the action method by using the evaluation value. The access management device according to any one of claims 1 to 3.

14. The notification unit notifies the user of the response method identified by the identification unit, the notification relating to the security risk and the cost, together with the response method. The access management device according to claim 13.

15. when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; A computer-implemented method of access control.

16. when access to a first set, which is a combination of a plurality of access attributes, is denied as a result of determining whether or not access is permitted using an access determination engine, determining whether or not access is permitted for one or more second sets, which are obtained by changing at least a portion of the access attributes in the first set, using the access determination engine, thereby identifying a method of dealing with the first set for granting access; notifying the identified method of response; A program that causes a computer to do something.

Images