Information processing device and information processing method

Abstract

To provide an information processing device and information processing method capable of providing information allowing users to easily acquire whether or not organization's security is compromised.SOLUTION: An information processing device includes an acquisition unit for acquiring an access history to a service used by a user belonging to an organization, a control unit for identifying the service used by the user based on the access history, identifying operation information for the identified service based on the access history, and generating a service list including the identified service and the operation information associated with the service, and an output unit for outputting the service list.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an information processing device and an information processing method. [Background technology]

[0002] Conventionally, methods for detecting the use of cloud services have been proposed (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-77271 Summary of the Invention [Problem to be solved by the invention]

[0004] According to the above-mentioned technique, there are cases where the information provided about the service whose usage is detected is insufficient.

[0005] Therefore, the present invention has been made to solve the above-mentioned problems, and has an object to provide an information processing device and an information processing method that are capable of providing information related to detected services. [Means for solving the problem]

[0006] The disclosed aspect is an information processing device including: an acquisition unit that acquires an access history for services used by a user belonging to an organization; a control unit that identifies a service used by the user based on the access history, identifies operation information for the identified service based on the access history, and generates a service list including the identified service and the operation information associated with the service; and an output unit that outputs the service list.

[0007] The disclosed aspect is an information processing method comprising the steps of: acquiring an access history for a service used by a user belonging to an organization; identifying a service used by the user based on the access history; identifying operation information for the identified service based on the access history; generating a list of the services including the identified service and the identified operation information; and outputting the list of services. Effect of the Invention

[0008] According to the present invention, it is possible to provide an information processing device and an information processing method that are capable of providing information for easily grasping information related to a detected service. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an information processing system 100 according to an embodiment. [Diagram 2] FIG. 2 is a diagram showing the information processing device 10 according to the embodiment. [Diagram 3] FIG. 3 is a diagram showing a display mode 300 according to the embodiment. [Figure 4] FIG. 4 is a diagram showing a display mode 300 according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing a display mode 300 according to the embodiment. [Figure 6] FIG. 6 is a diagram showing a display mode 300 according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating an information processing method according to the embodiment. [Figure 8] FIG. 8 is a diagram showing a display mode 300 according to the first modification. [Figure 9] FIG. 9 is a diagram showing a display mode 300 according to the first modification. [Figure 10] FIG. 10 is a diagram showing a display mode 300 according to the second modification. [Figure 11] FIG. 11 is a diagram showing a display mode 300 according to the third modification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

[0011] However, it should be noted that the drawings are schematic and the ratios of the dimensions may differ from the actual ones. Therefore, the specific dimensions should be determined with reference to the following explanation. In addition, the drawings may of course include parts with different dimensional relationships or ratios.

[0012] [Disclosure Summary] The information processing device according to the disclosed overview includes an acquisition unit that acquires an access history for services used by a user belonging to an organization, a control unit that identifies a service used by the user based on the access history, identifies operation information for the identified service based on the access history, and generates a service list including the identified service and the operation information associated with the service, and an output unit that outputs the service list.

[0013] The information processing method according to the disclosure outline includes the steps of obtaining an access history for a service used by a user belonging to an organization, identifying a service used by the user based on the access history, identifying operation information for the identified service based on the access history, generating a list of the services including the identified service and the identified operation information, and outputting the list of services.

[0014] In the summary of the disclosure, an information processing device identifies operation information corresponding to a service based on an access history to the service, and outputs a service list including the identified service and the operation information. With such a configuration, since the service list includes the operation information, it is possible to provide information regarding the detected service in a form that allows the necessity of a response to be determined according to the content of the operation information.

[0015] In the disclosure summary, the organization may be an organization with legal personality or an organization without legal personality. The user may be a person who has an employment relationship with the organization, a person who has a contractual relationship with the organization, or may be read as a member of the organization. Specifically, the user may be an employee of a company.

[0016] [Embodiment] (Information Processing System) An information processing system according to an embodiment will be described below. Fig. 1 is a diagram showing an information processing system 100 according to an embodiment.

[0017] 1, the information processing system 100 includes an information processing device 10, a terminal 20, and a terminal 30. The information processing device 10, the terminal 20, and the terminal 40 are connected by a network 200. Although not particularly limited, the network 200 may be configured by the Internet. The network 200 may include a local area network, a mobile communication network, or a VPN (Virtual Private Network).

[0018] The information processing device 10 processes information about services used by users who belong to an organization. The information processing device 10 will be described in detail later (see FIG. 2).

[0019] The terminal 20 is a terminal used by a user belonging to an organization. For example, the terminal 20 may be a personal computer, a smartphone, or a tablet terminal. The terminal 20 may have a display unit 21. The display unit 21 may be configured with a display such as a liquid crystal panel, an organic EL (Electroluminescence) panel, or an LED (Light Emitting Diode). Although one terminal 20 is illustrated in FIG. 1, a large number of terminals 20 may actually exist. The terminal 20 may be referred to as a user terminal or a first terminal.

[0020] In the embodiment, a case where a service or application is used using a browser that can be displayed on the display unit 21 is illustrated. Unless otherwise specified, the service may be considered to include an application. The service includes a cloud service such as SaaS. A browser extension may be installed in the terminal 20, and an access history for the service may be transmitted from the terminal 20 to the information processing device 10 by the browser extension. The information processing device 10 may acquire the access history by API cooperation using an API (Application Programming Interface) provided by a service such as a cloud service. The information processing device 10 may introduce an agent program into the terminal 20 used by the user or acquire the access history from traffic passing through a gateway, but the means for acquiring the access history are not limited to these. The information processing device 10 of the organization detects the usage status of the service by the user based on the received access history information, and generates data of a list of the services being used. Here, the browser extension is a program for adding a specific function to a web browser, and is also called an add-on, plug-in, or extension. The access history may be called an access log and may be expressed by a markup language such as HTML (Hyper Text Markup Language) or XML (Extensible Markup Language), but is not limited thereto. The access history is information on services and websites accessed from the user's terminal 20 via a browser. The access history includes log data consisting of items such as information on the access source (user ID, IP address, browser name, OS name, etc.), date and time of access, date and time of last access, number of accesses, accessed file name, operation performed by the user, number of bytes sent, number of bytes received, and information on the accessed destination. The information on the accessed destination includes the URL (Universal Resource Indicator), title, and other keyword information of the accessed destination. The access history may also include operation logs such as startup, shutdown, connection to a network, and software installation of the terminal used by the user.The access history may also include a communication log such as the content and time of transmission and reception between the terminal used by the user and the server, etc. The access history may also include a history of the user logging into the network or system, an application log such as application operations, a security log such as security-related operations, a system log such as system operations, a design change log related to design changes to the system, etc., and an error log related to errors that have occurred.

[0021] The terminal 30 is a terminal used by an administrator who manages information about services used by users belonging to an organization, such as an IT department or other management department of an organization. For example, the terminal 30 may be a personal computer, a smartphone, or a tablet terminal. The terminal 30 may have a display unit 31. The display unit 31 may be configured by a display such as a liquid crystal panel, an organic EL panel, or an LED. The terminal 30 may be referred to as an administrator terminal or a second terminal.

[0022] In the embodiment, the display unit 31 displays information about services used by users who belong to an organization, based on display data received from the information processing device 10. Details of the display mode of the display unit 31 will be described later (see FIGS. 3 to 6).

[0023] (Information processing device) The information processing device 10 according to the embodiment will be described below. Fig. 2 is a diagram showing the information processing device 10 according to the embodiment. Note that the information processing device 10 may be installed in a network outside an organization as a cloud service, or may be installed in a network inside an organization to which a user belongs.

[0024] As shown in FIG. 2, the information processing device 10 includes a transmitting unit 11, a receiving unit 12, a storage unit 13, and a control unit .

[0025] The transmitter 11 may be configured by a communication module. The communication module may be a wireless communication module conforming to a standard such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, or 6G, or may be a wired communication module conforming to a standard such as IEEE802.3.

[0026] The transmission unit 11 transmits display data for displaying information about services used by users belonging to an organization to a terminal 30 used by an IT department of the organization or the like. The information about the services may include a service list including services and operation information associated with the services. The service list displays a list of services detected to be used by a user. The service list will be described later in detail (see Figs. 3 to 6).

[0027] In the embodiment, the transmission unit 11 constitutes an output unit that outputs a list of services.

[0028] The receiver 12 may be configured by a communication module. The communication module may be a wireless communication module conforming to a standard such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, or 6G, or may be a wired communication module conforming to a standard such as IEEE802.3.

[0029] The receiving unit 12 receives an access history for services used by a user belonging to an organization from the terminal 20. The receiving unit 12 may receive the access history from a browser extension installed in the browser of the terminal 20. As described above, the access history may be represented by a markup language such as HTML or XML. The receiving unit 12 receives information that can be obtained via a network, such as the access history, and detects the services used by the user based on the obtained information.

[0030] In the embodiment, the receiving unit 12 constitutes an acquiring unit that acquires access histories to services used by users who belong to an organization.

[0031] The storage unit 13 is configured with a storage medium such as a solid state drive (SSD) or a hard disk drive (HDD), and stores various information.

[0032] The storage unit 13 may store the access history received from the terminal 20. The storage unit 13 may store characteristic information of the service in association with the service. For example, the storage unit 13 may store a table (service DB) in which the name of the service is associated with the characteristic information.

[0033] The storage unit 13 may store information on first services that an organization restricts or prohibits users from using. Unless otherwise specified, restriction may be considered to include prohibition. The information on the first service may include at least information that identifies the first service (e.g., the name of the service). The first service is a service that is restricted or prohibited from being used by users based on security concerns or the like, and the list of information on the first service may be referred to as a blacklist.

[0034] The storage unit 13 may store information on second services that are excluded from the service list. The information on the second services may include at least information for identifying the second services (for example, the name of the service). The second services are services that do not need to be displayed in the service list even if their use by a user is permitted by an organization and their use by a user is detected, for reasons such as no or small security concerns, and the list of information on the second services may be referred to as a whitelist.

[0035] The storage unit 13 may store risk assessment information related to the service in association with the service. The risk assessment information may include a numerical value related to the risk assessment. The numerical value related to the risk assessment may be expressed as a score with 100 points as the upper limit.

[0036] The risk assessment information may include first risk assessment information based on non-public information. The first risk assessment information may be generated based on survey results for a service provider. The survey results may include the results of a questionnaire for the provider, and more specifically, may include responses to a security checklist by the provider. A checklist included in the security checklist includes a plurality of questions regarding security measures. The checklist may be formulated by a security assessment provider. The risk assessment may be obtained based on responses to the checklist, or may be calculated by adding up the points assigned to each question or answer option, or the like.

[0037] The risk assessment information may include second risk assessment information based on public information. The second risk assessment information may be generated based on information that can be collected on a network with no restrictions on access, etc. Information that can be collected on a network with no restrictions on access, etc. is an example of public information.

[0038] For example, the web-related collection unit may access a login page related to the service based on a login URL for using the service, and collect web-related information. The web-related information may be information used for evaluating web-related risks. For example, the web information collection unit may collect cookies issued by the server upon access based on the login URL, and may collect HTTP headers added to the response from the server to the access based on the login URL. The web-related collection unit may be configured by the receiving unit 12 and the control unit 14.

[0039] For example, the evaluation function unit may have a function of calculating a risk assessment of a service based on information collected by the web-related collection unit. Specifically, the evaluation function unit may identify risk items based on the information collected by the web-related collection unit, and calculate a risk assessment based on the identified risk items. The risk assessment may be expressed by the total number of identified risk items and the number of risk items for which measures have been taken. In such a case, the risk assessment may be referred to as a countermeasure coverage rate. The evaluation function unit may calculate a risk assessment for each evaluation item. The evaluation function unit may be configured by the control unit 14.

[0040] Here, the storage unit 13 may store a ledger that registers information about services (hereinafter, registered services). In the ledger, services currently being used by users within the organization are registered by the organization, and individual information about the services and risk assessment information, etc. can be managed. For example, the information about the registered services may include the name of the registered service, characteristic information about the registered service, risk assessment information about the registered service, etc. The ledger may register information about users (hereinafter, registered users) managed by the information processing device 10. The information about the registered users may include the name of the registered user, the email address of the registered user, the type of web browser used by the registered user, the name of the organization and department to which the registered user belongs, etc.

[0041] In the embodiment, the storage unit 13 constitutes a memory unit that stores the feature information in association with the service.

[0042] The control unit 14 may include at least one processor. The at least one processor may be configured by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), one or more integrated circuits, one or more discrete circuits, or a combination thereof.

[0043] In the first operational example, the control unit 14 identifies a service used by the user based on the access history received from the terminal 20. The control unit 14 identifies operation information for the identified service based on the access history received from the terminal 20. For example, the control unit 14 refers to a service DB that stores information that associates service names with service identifiers (e.g., URLs), and identifies the service name that corresponds to the URL identified by the access history.

[0044] The control unit 14 identifies operation information for the identified service by analyzing an access history that can be acquired by a browser extension or the like. The operation information may include the following information. For example, the control unit 14 may determine that a login operation has been performed when it is detected that the URL of the accessed page included in the access log is a login page (e.g., .. / login / , etc.). In addition, the control unit 14 may determine that a login operation has been performed when it is detected that a new authentication cookie has been issued when the login format to the service is password authentication. The control unit 14 may determine that data such as a file has been uploaded when the amount of data transmission is equal to or greater than a threshold, and may determine that data such as a file has been uploaded when access to an upload page is detected.

[0045] In option 1-1, the operation information may include information for logging in to a service (hereinafter, referred to as a login operation). The login operation is information indicating an operation for a user to log in to a service that requires login when using the service.

[0046] In option 1-2, the operation information may include information for uploading data such as a file to a service (hereinafter, file upload). File upload is information indicating an operation by a user to upload data such as a file to a service that allows data upload. The control unit 14 may determine a file upload based on the contents of a request that includes a communication method defined by HTTP (Hyper Text Transfer Protocol). For example, if the request method is POST and the header includes "multipart / form-data", it may be determined to be a file upload.

[0047] In options 1-3, the operation information may include information for downloading data such as a file from a service (hereinafter, file download). The file download is information indicating an operation by a user to download data from a service that allows data download.

[0048] In options 1-4, the operation information may include information that the number of users using the service has increased (hereinafter, "usage increase"). The usage increase may be information indicating that the increase in the number of users using the service in a unit period (e.g., 3 days, 7 days, 1 month, etc.) exceeds a threshold.

[0049] In options 1-5, the operation information may include information that the number of users using the service has decreased (hereinafter, “decrease in usage”). The decrease in usage may be information indicating that the decrease in the number of users using the service in a unit period (e.g., 3 days, 7 days, 1 month, etc.) exceeds a threshold value.

[0050] In options 1-6, the operation information may include information indicating that a service is being used by multiple different users using a specific account (hereinafter, shared account use). In other words, shared account use is information indicating that one account is being shared and used by multiple users. Shared account use may also be information indicating that multiple different users are using a shared account for a service that can be used using a shared account. The control unit 14 may acquire information such as a user's fingerprint from a browser or the like, and determine that a shared account is being used when multiple user fingerprints or the like are simultaneously detected from a specific account.

[0051] In options 1-7, the operation information may include information indicating that the service has been accessed from an IP address other than the designated one (hereinafter, undesignated IP). The undesignated IP may be information indicating that a service for which an accessible IP address is designated has been accessed from an IP address other than the designated one. For example, the designated IP address may be an IP address used in an organization's office or the like, or an IP address assigned to a device managed by the organization. In other words, the undesignated IP may be information indicating that the service has been accessed from a location other than the organization's office or the like, or that the service has been accessed from a location outside the organization. Furthermore, the designated IP address may include multiple IP addresses, or may be specified as a range of IP addresses.

[0052] In options 1-8, the operation information may include registration or modification of information such as an email address, invitation of a new user, and publication of information on the Internet.

[0053] The operation information may include two or more options selected from option 1-1 to option 1-8.

[0054] The control unit 14 generates a service list including services and operation information associated with the services. That is, the control unit 14 generates display data for displaying the service name and operation information related to the service. As described above, the display data for displaying the service list, that is, the display data for displaying the service name and operation information, is transmitted to the terminal 30 by the transmission unit 11.

[0055] In the second operation example, the control unit 14 specifies characteristic information of the specified service. The control unit 14 may specify the characteristic information by acquiring the characteristic information from a server that provides the service. The control unit 14 may specify the characteristic information by referring to the storage unit 13. The characteristic information may include the information shown below. For example, the control unit 14 may specify the service name corresponding to the URL specified by the access history by referring to a service DB that stores information that associates the service name with the URL. The control unit 14 may specify the characteristic information corresponding to the specified service name by referring to a service DB that associates the service name with the characteristic information, and acquire the specified characteristic information. The service DB may be stored in the storage unit 13.

[0056] In option 2-1, the characteristic information may include information indicating that the service supports uploading of data such as files (hereinafter, file upload). The file upload may be information indicating that data upload is possible in the service.

[0057] In option 2-2, the characteristic information may include information indicating that the service supports downloading of data such as files (hereinafter, file download). The file download may be information indicating that the service allows downloading of data.

[0058] In option 2-3, the characteristic information may include information indicating that the service does not support a virtual private line (hereinafter, "VPN (Virtual Private Network) not supported"). "VPN not supported" may be information indicating that the service is available on a line other than a VPN (for example, a public line).

[0059] In option 2-4, the characteristic information may include information indicating that the service is made publicly available to the outside of the organization by a function such as sharing a URL (hereinafter, "publicly available"). Publicly available may be information indicating that the service is accessible from outside the organization, or may be information indicating that the service is accessible to the outside of the organization. Outside the organization may mean outside the organization's network (e.g., intranet).

[0060] In option 2-5, the characteristic information may include information indicating that the service cooperates with other services through API cooperation or the like (hereinafter, external application cooperation). The other services may mean services provided on a network other than the organization's network (e.g., an intranet). The other services may be read as other applications.

[0061] In option 2-6, the characteristic information may include information indicating that the service does not support user authentication such as single sign-on or ID federation (the service does not support authentication methods such as SAML authentication) (hereinafter, "SAML (Security Assertion Markup Language) non-support"). SAML is an example of authentication information for user authentication, and the user authentication may be a method other than SAML.

[0062] In option 2-7, the characteristic information may include information indicating that the service is a communication tool (hereinafter, email transmission). Email transmission is an example of a communication tool, and the communication tool may include email reception, chat transmission, chat reception, a video conference tool, and the like.

[0063] The characteristic information may include two or more options selected from option 2-1 to option 2-7.

[0064] The control unit 14 generates a service list including the services and the feature information of the services. As described above, the transmission unit 11 transmits to the terminal 30 the display data for displaying the service list.

[0065] In the operation example 3, the operation example 1 and the operation example 2 may be combined. That is, the service list may include both the operation information and the feature information.

[0066] In the fourth operational example, the control unit 14 may detect the use of the first service based on the access history. In such a case, the control unit 14 may instruct the transmission unit 11 to output a notification that the use of the first service has been detected. The notification that the use of the first service has been detected may be output separately from the display of the above-mentioned service list. The notification that the use of the first service has been detected may be output as a warning when the use of a first service included in the blacklist is detected.

[0067] In the fifth operation example, the control unit 14 may detect the use of the second service based on the access history and may exclude the second service from the list of services. In other words, the second service included in the whitelist is excluded from the list of services.

[0068] In the sixth operation example, the control unit 14 may identify a third service that requires a response from the organization from among the identified services based on the operation information, and generate a service list in a manner in which the identified third service is visually highlighted. The third service that requires a response from the organization may be a service that is predefined in relation to the operation information. For example, the third service may be identified as a third service in which an operation that is considered to be a security risk and requires a response from a security perspective has been detected. For example, a service in which the operation information is file upload may be identified as the third service.

[0069] The visually emphasized aspect may be such that the color, font, size, or style (bold, italics, underline, etc.) of text related to the third service is different from the color, font, size, or style (bold, italics, underline, etc.) of text other than the third service.

[0070] In the seventh operational example, the control unit 14 may identify a third service that requires a response from the organization from among the identified services based on the characteristic information, and generate a service list in a manner in which the identified third service is visually highlighted. The third service that requires a response from the organization may be a service that is predefined in relation to the characteristic information. For example, a service that has a characteristic that is considered to pose a security risk and requires a response from a security perspective may be identified as the third service. For example, a service whose characteristic information is externally disclosed or linked to an external application may be identified as the third service.

[0071] The visually emphasized aspect may be such that the color, font, size, or style (bold, italics, underline, etc.) of text related to the third service is different from the color, font, size, or style (bold, italics, underline, etc.) of text other than the third service.

[0072] In the operation example 8, the operation examples 6 and 7 may be combined. That is, the control unit 14 may identify a third service that needs to be addressed by the organization from among the identified services based on the operation information and the characteristic information, and generate a service list in a manner in which the identified third service is visually emphasized. The third service that needs to be addressed by the organization may be a service that is predefined in relation to the operation information and the characteristic information. For example, a service whose operation information is file upload and whose characteristic information is external disclosure or external application linkage may be identified as the third service.

[0073] The visually emphasized aspect may be such that the color, font, size, or style (bold, italics, underline, etc.) of text related to the third service is different from the color, font, size, or style (bold, italics, underline, etc.) of text other than the third service.

[0074] In the 9th operation example, the control unit 14 may identify a fourth service associated with the risk assessment information from among the identified services based on the access history (e.g., the name of the service, etc.), and generate a service list in a mode including the risk assessment information for the identified fourth service. The fourth service may include a service associated with the first risk assessment information, not including a service associated with only the second risk assessment information. The fourth service may be a service associated with both the first risk assessment information and the second risk assessment information.

[0075] In operation example 9, if the risk assessment information includes a numerical value related to risk assessment, the control unit 14 may identify a fourth service whose numerical value related to risk assessment is lower than a threshold value, and generate a service list in which the identified fourth service is visually highlighted.

[0076] The numerical value regarding the risk assessment may be a numerical value included in the first risk assessment information, not a numerical value included in the second risk assessment information. The numerical value regarding the risk assessment may be an aggregation result of numerical values ​​included in both the first risk assessment information and the second risk assessment information. The aggregation result may be the sum of the numerical values ​​included in the first risk assessment information and the second risk assessment information, or may be an aggregation result in which a weighting value is applied to the numerical values ​​included in the first risk assessment information and the second risk assessment information. The weighting value of the numerical value included in the first risk assessment information may be greater than the weighting value of the numerical value included in the second risk assessment information.

[0077] In an embodiment, the control unit 14 is configured to identify a service used by a user based on an access history, identify operation information for the identified service based on the access history, and generate a service list including the identified service and the operation information associated with the service.

[0078] (Display mode) Display modes according to the embodiment will be described below. Fig. 3 to Fig. 6 are diagrams showing display modes according to the embodiment. As described above, the display mode may be a mode displayed on the display unit 31 of the terminal 30. The display mode may be a mode displayed based on display data transmitted from the information processing device 10.

[0079] As shown in FIG. 3, the display aspect 300 may include a list of services 310 and action buttons 320.

[0080] The service list 310 may include the name, the detection operations, and the characteristics of the service.

[0081] The name is an example of the name of a service detected (identified) based on the access history.

[0082] The detected operation is an example of operation information for a service detected (specified) based on the access history. The operation information may be one or more pieces of operation information selected from the above-mentioned options 1-1 to 1-8. In FIG. 3, examples include login operation, file upload, increased use, non-designated IP, decreased use, and shared account use.

[0083] The service feature is an example of feature information of a service detected (identified) based on the access history. The feature information may be one or more pieces of feature information selected from the above-mentioned options 2-1 to 2-7. The service list 310 may include check boxes 311 for selecting a service included in the service list 310.

[0084] That is, the service list 310 is an example of a service list including services and operation information associated with the services. The service list may be considered as a service list including services and feature information possessed by the services. Here, the service list does not need to include all detected (identified) services, and may include only a part of the detected (identified) services.

[0085] Action button 320 is a button for designating an operation for a service checked by check box 311. Details of action button 320 will be described later (see FIG. 6).

[0086] As shown in FIG. 4, the service list 310 may include the number of detected users / 30 days, the number of detected users / 7 days, the number of accesses / 30 days, the number of accesses / 7 days, domain, the number of bytes sent, and the number of bytes received.

[0087] The number of detected users / 30 days is the number of users who used the service in a 30 day period. The number of detected users / 7 days is the number of users who used the service in a 7 day period. 30 days and 7 days are examples, and the period for counting the number of users can be set arbitrarily, as long as it is an indicator of the number of users who used the service within a certain period. The number of detected users can be determined based on the access history (e.g., identification information of a user who logs in to a browser extension).

[0088] The number of accesses / 30 days is the number of accesses to a service in a 30 day period. The number of accesses / 7 days is the number of accesses to a service in a 7 day period, and may be any indicator showing the number of users who used a service within a certain period. 30 days and 7 days are examples, and the period for counting the number of accesses can be set arbitrarily. The number of accesses can be determined based on the access history.

[0089] The domain is a domain that indicates the location of the service. The domain may be replaced by an IP address or may be associated with an IP address.

[0090] The number of transmitted bytes is the size of data transmitted to the service in any collection period (e.g., 7 days, 30 days, etc.). The size of the data may be expressed in bytes, K bytes, or M bytes.

[0091] The number of received bytes is the size of data received from the service in any collection period (e.g., 7 days, 30 days, etc.). The size of the data may be expressed in bytes, K bytes, or M bytes.

[0092] As shown in FIG. 5, the service inventory 310 may include security ratings and web ratings.

[0093] The security evaluation may be risk evaluation information generated based on the results of an investigation into the security of a service provider. The security evaluation is an example of first risk evaluation information based on non-public information. The security evaluation may be a score calculated based on the answers to a security checklist entered by the service provider.

[0094] The web rating may be a risk rating generated based on information that can be collected on a network (e.g., the web) with no access restrictions. The web rating is an example of second risk rating information based on public information. The web rating may be a score calculated based on public information such as a website related to the service.

[0095] 6, in response to selection (e.g., clicking) of action button 320, a list of operations (in FIG. 6, "Request evaluation disclosure," "Add to exclusion list," "Move to ledger," etc.) for the service checked by checkbox 311 may be displayed. When an operation is selected from the list of operations, the selected operation is executed for the service checked by checkbox 311.

[0096] Although not particularly limited, "request evaluation disclosure" may be an operation of requesting the service provider or the risk assessment company managing the risk assessment information to disclose risk assessment information stored in the information processing device 10 for the service checked by the checkbox 311. The risk assessment information requested to be disclosed may be at least one of the first risk assessment information and the second risk assessment information. "add to exclusion list" may be an operation of adding the service checked by the checkbox 311 to a whitelist. "move to ledger" may be an operation of moving the service checked by the checkbox 311 to the ledger.

[0097] The display mode shown in Fig. 3 is an example of the above-mentioned Operational Example 1 to Operational Example 3. Here, when the use of a first service included in the blacklist is detected, a notification that the use of the first service has been detected may be output in addition to the service list 310 (Operational Example 4). A second service included in the whitelist may be excluded from the service list 310 (Operational Example 4). Furthermore, a third service (for example, service "BBBB" shown in Fig. 3) identified based on at least one of the operation information and the characteristic information may be displayed in a visually emphasized manner in the service list 310 (Operational Examples 6 to 8).

[0098] The display mode shown in Fig. 5 is an example of the above-mentioned operation example 9. Here, for example, in the case where the threshold is 80, a fourth service (for example, service "AAAA" shown in Fig. 5) whose risk assessment value is lower than the threshold may be displayed in a visually emphasized manner in the service list 310.

[0099] (Information processing method) The information processing method according to the embodiment will be described below. Fig. 7 is a diagram showing the information processing method according to the embodiment.

[0100] 7, in step S10, a user of the terminal 20 executes an operation on a service. For example, a browser extension installed in a browser acquires an access history for the service.

[0101] In step S11, the terminal 20 transmits an access history to the information processing device 10. For example, a browser extension installed in a browser transmits an access history to a service to the information processing device 10.

[0102] In step S12, the information processing device 10 stores the access history received from the terminal 20.

[0103] In FIG. 7, for the sake of simplicity, a case is illustrated in which the access history is acquired from one terminal 20, but in reality, the access history may be acquired from a large number of terminals 20.

[0104] In step S20, the terminal 30 transmits a request to the information processing device 10 to display the display form 300. As described above, the display form 300 may include a service list 310.

[0105] In step S21, the information processing device 10 generates display data for displaying the display aspect 300, and transmits the generated display data to the terminal 30.

[0106] In step S22, the terminal 30 displays the display format 300 based on the display data.

[0107] (Action and Effects) In the embodiment, the information processing device 10 identifies operation information corresponding to a service based on the access history to the service, and then outputs a service list 310 including the identified service and operation information (for example, Operation Example 1 and Operation Example 3). With such a configuration, the service list 310 can identify services that an organization such as a company does not permit to be used, and since the service list 310 includes operation information, information on the detected service can be provided in a form that allows the necessity of taking measures such as suspending the use of a service or application or deleting an account to be determined from the viewpoint of security according to the content of the operation information. This makes it easier for a management department such as an IT department of an organization to manage the services and accounts used by the organization, and makes it possible to avoid security risks.

[0108] In the embodiment, the information processing device 10 may identify characteristic information corresponding to a service based on the access history to the service, and then output the service list 310 including the identified service and the characteristic information (for example, Operation Example 2 and Operation Example 3). According to such a configuration, since the service list 310 includes the characteristic information, it is possible to provide information on the detected service in a form that allows the necessity of a response to be determined from the viewpoint of security, etc., depending on the content of the characteristic information.

[0109] In the embodiment, when the information processing device 10 detects the use of the first service included in the blacklist, the information processing device 10 may output a notification that the use of the first service has been detected (Operation Example 4). With such a configuration, the administrator can easily grasp the use of an inappropriate service and can quickly take measures such as suspending the use of the service.

[0110] In the embodiment, even if the information processing device 10 detects the use of a second service included in the whitelist, the information processing device 10 may exclude the second service from the service list 310 (Operation Example 5). With such a configuration, it is possible to exclude unnecessary information from the service list 310, improve the visibility of the service list, and easily identify services that the administrator should check in the service list 310.

[0111] In the embodiment, the information processing device 10 may identify a third service based on at least one of the operation information and the feature information, and generate the service list 310 in such a manner that the identified third service is visually emphasized (Operation Examples 6 to 8). With such a configuration, the administrator can easily identify a third service that needs to be addressed in the organization.

[0112] In the embodiment, the information processing device 10 may identify a fourth service associated with the risk assessment information based on the access history, and generate the service list 310 in a manner including the risk assessment information for the identified fourth service (Operation Example 9). With such a configuration, since the service list 310 includes the risk assessment information, the administrator can easily identify a third service that requires a response in the organization.

[0113] In the embodiment, the information processing device 10 may identify a fourth service whose risk assessment-related value is lower than a threshold value, and generate the service list 310 in such a manner that the identified fourth service is visually highlighted (Operation Example 9). With such a configuration, the administrator can easily identify a fourth service that requires a response in the organization.

[0114] [Change Example 1] Modification 1 of the embodiment will be described below. Differences from the embodiment will be mainly described below.

[0115] In the first modification, a variation of the display mode 300 will be described.

[0116] First, the display format 300 may include information regarding an overview of the results detected by the information processing device 10 based on the access history. The overview of the results may include the information shown in FIG.

[0117] The summary of the results in the display format 300 may include the number of users detected by the information processing device 10 based on the access history (the number of detected users in FIG. 8).

[0118] The summary of the results may include the number of accesses detected by the information processing device 10 based on the access history (the number of detected accesses in FIG. 8).

[0119] The summary of the results may include the number of services detected by the information processing device 10 based on the access history (the number of detected services in FIG. 8).

[0120] The summary of the results may include a breakdown of the services detected by the information processing device 10 based on the access history. The breakdown may be represented by a doughnut-shaped pie chart. However, the form of the graph is not limited to a doughnut-shaped pie chart.

[0121] The registered services are services managed in the service DB of the information processing device 10. In addition to the number of registered services, the number of registered services that are registered in the organization's ledger may be displayed. Other websites may be websites other than the service accessed by the user. Unknown services may be services whose contents could not be identified. Others may be services that do not fall under any of the registered services, other websites, and unknown services.

[0122] Display mode 300 may include the total number of services detected to be accessed by the user (yy items shown in FIG. 8). Display mode 300 may also include the number of services for each item constituting the breakdown (xx items shown in FIG. 8). Furthermore, a condition for displaying the breakdown of services (50 or more accesses in FIG. 8) may be set.

[0123] Second, the display aspect 300 may include a list of detected services (hereinafter, detected service list).

[0124] 9, the detection service list 330 may include the name, number of people detected / 30 days, number of accesses / 30 days, last detection date, availability, confidentiality, investigation record, etc. The name, number of people detected / 30 days, number of accesses / 30 days, and last detection date are the same as those described above, so details thereof will be omitted.

[0125] Availability is information indicating whether or not it is important for a service whether the user can safely access the service. In the availability column, information such as "important" is displayed for services for which availability is important, and no information may be displayed for services for which availability is not important.

[0126] Confidentiality is information indicating whether or not it is important for a service that only authorized users can access the service. In the confidentiality column, information such as "important" is displayed for a service for which confidentiality is important, and no information may be displayed for a service for which confidentiality is not important.

[0127] The investigation track record is information indicating whether or not there is an investigation track record relating to risk assessment information. The investigation track record may be an investigation track record relating to first risk assessment information based on non-public information. The investigation track record may be an investigation track record relating to both first risk assessment information based on non-public information and second risk assessment information based on public information. The investigation track record column displays information such as "yes" for services that have an investigation track record, and no information may be displayed for services that have an investigation track record.

[0128] Although not limited thereto, the detection service list 330 may be incorporated into the service list 310 described above.

[0129] [Change Example 2] Modification 2 of the embodiment will be described below. Differences from the embodiment will be mainly described below.

[0130] In the second modification, the narrowing down of services included in the service list 310 will be described.

[0131] 10, display mode 300 includes service list 310 and filter 340 used to narrow down services included in service list 310. Although not particularly limited, items selectable in filter 340 may include items included in service list 310 as operation information or feature information. Items selectable in filter 340 may be arbitrarily set by an administrator. In addition, filter 340 displays the name of the item used for narrowing down and the number of services that correspond to that item among the services included in service list 310.

[0132] For example, when a login operation is selected in the filter 340 in the state shown in the upper part of Fig. 10, the information processing device 10 excludes services in the service list 310 for which a login operation has not been detected as operation information (not corresponding to a login operation) and narrows down the list to include services for which a login operation has been detected (corresponding to a login operation), as shown in the lower part of Fig. 10, and updates the display of the service list 310. Also, for example, a history of security-related incidents (unauthorized access, information leakage, etc.) may be stored in the service DB in association with the service name, and by selecting "with incident history" as an item in the filter 340, it may be possible to narrow down the list to services with an incident history.

[0133] [Change Example 3] The third modification of the embodiment will be described below. Differences from the embodiment will be mainly described below.

[0134] In the third modification, a variation of the display mode 300 will be described. The display mode 300 may include a user list 350.

[0135] As shown in FIG. 11, the user list 350 may include email addresses, NG services, number of detected services, last detected date, user registration, browser, and the like.

[0136] The email address is an example of information for identifying a user. The email address may be replaced with the user's name or the like.

[0137] The NG service is information indicating whether or not there is a service that should be checked by the organization. For a user who has a service that should be checked by the organization, the icon 360 may be displayed. For example, the icon 360 may be displayed when the user's access to the NG service is detected, and may not be displayed when the user's access to the NG service is not detected. The service that should be checked by the organization may be the first service included in the blacklist (Operation Example 4), the third service that requires a response by the organization (Operation Examples 6 to 8), or the fourth service (Operation Example 9) whose risk assessment-related numerical value is lower than a threshold value.

[0138] The last detected date is the date on which the user's access to the service was last detected. The last detected date may include hours, minutes, seconds, etc.

[0139] User registration is information indicating whether or not a user is registered in the ledger of the information processing device 10. For example, "registered" may indicate that a user is registered in the ledger, and "invited" may indicate that registration in the ledger is being requested.

[0140] The browser is information that indicates the type of web browser used by the user.

[0141] Here, when the icon 360 is selected in the NG service field, the information processing device 10 may display detailed information about the service that should be confirmed by the organization. The detailed information about the service may be the service list 310 described in the embodiment.

[0142] [Other embodiments] Although the present invention has been described by the above-mentioned embodiment, the description and drawings forming a part of this disclosure should not be understood as limiting the present invention. From this disclosure, various alternative embodiments, examples and operating techniques will become apparent to those skilled in the art.

[0143] In the above disclosure, receiving an access history may be interchangeably interpreted as obtaining an access history. Outputting the service list 310 may be interchangeably interpreted as displaying the service list 310 or transmitting display data for displaying the service list 310.

[0144] In the above disclosure, a case has been exemplified in which the generation of display data for displaying the display aspect 300 is executed by the information processing device 10. However, the above disclosure is not limited to this. For example, the generation of the display data may be executed by an application on the terminal 30. In such a case, information required for generating the display data may be transmitted from the information processing device 10 to the terminal 30.

[0145] Although not specifically mentioned in the above disclosure, the display may include a display in physical reality, a display in augmented reality such as AR (Artificial Reality), a display in virtual reality such as VR (Virtual Reality), or a display in a virtual space such as the Metaverse.

[0146] In the above disclosure, the information processing device 10 transmits, to the terminal 30, display data for displaying the display aspect 300. In such a case, the transmission of the display data may be considered as an example of outputting the display aspect 300 (for example, the service list 310).

[0147] Although not specifically mentioned in the above disclosure, the information processing device 10 may have a display unit that displays the display mode 300. The display unit may be configured with a display such as a liquid crystal panel, an organic EL panel, or an LED. In such a case, the display of the display mode 300 may be considered as an example of the output of the display mode 300 (for example, the service list 310).

[0148] Although not specifically mentioned in the embodiment, a program may be provided that causes a computer to execute each process performed by the information processing device 10 and the terminal 30. The program may also be recorded in a computer-readable medium. Using the computer-readable medium, it is possible to install the program in the computer. Here, the computer-readable medium on which the program is recorded may be a non-transient recording medium. The non-transient recording medium is not particularly limited, and may be, for example, a recording medium such as a CD-ROM or a DVD-ROM.

[0149] Alternatively, a chip may be provided that is configured by a memory that stores programs for executing the processes performed by the information processing device 10 and the terminal 30, and a processor that executes the programs stored in the memory.

[0150] [Note] A first feature is an information processing device comprising: an acquisition unit that acquires an access history for services used by a user belonging to an organization; a control unit that identifies a service used by the user based on the access history, identifies operation information for the identified service based on the access history, and generates a service list including the identified service and the operation information associated with the service; and an output unit that outputs the service list.

[0151] A second feature is the information processing device of the first feature, wherein the operation information includes at least one of information for logging in to the service, information for uploading data to the service, information for downloading data from the service, information for an increase in the number of users using the service, information for a decrease in the number of users using the service, information indicating that the service is being used by multiple users using a shared account, and information indicating that the service has been accessed from an IP address other than a designated IP address.

[0152] A third feature is an information processing device according to the first or second feature, wherein the control unit identifies feature information possessed by the identified service, and the control unit generates the service list including the identified feature information.

[0153] A fourth feature is the information processing device of the third feature, further comprising a memory unit that stores the feature information in association with a service, and the control unit identifies the feature information by referring to the memory unit.

[0154] A fifth feature is an information processing device according to the third or fourth feature, wherein the feature information includes at least one of information indicating that the service supports file uploading, information indicating that the service supports file downloading, information indicating that the service does not support virtual private lines, information indicating that the service is made available outside the organization, information indicating that the service links with other services, information indicating that the service does not support user authentication, and information indicating that the service is a communication tool.

[0155] A sixth feature is an information processing device that, in at least one of the first to fifth features, includes a memory unit that stores information about a first service whose use is restricted by the organization, the control unit detects use of the first service based on the access history, and the output unit outputs a notification that use of the first service has been detected.

[0156] A seventh feature is an information processing device that, in at least one of the first to sixth features, includes a memory unit that stores information about a second service that is excluded from the service list, and the control unit excludes the second service from the service list even if it detects use of the second service based on the access history.

[0157] An eighth feature is an information processing device in which, in at least one of the first to seventh features, the control unit identifies a third service that requires an action by the organization from the identified services based on the operation information, and generates the service list in a manner in which the identified third service is visually highlighted.

[0158] A ninth feature is an information processing device in which, in at least one of the first to eighth features, the control unit identifies a third service that requires an address by the organization from the identified services based on the feature information, and generates the service list in a manner in which the identified third service is visually highlighted.

[0159] A tenth feature is an information processing device that, in at least one of the first to ninth features, is provided with a memory unit that stores risk assessment information regarding the service in association with the service, and the control unit identifies a fourth service from the identified services that is associated with the risk assessment information based on the access history, and generates the service list in a manner that includes the risk assessment information for the identified fourth service.

[0160] An eleventh feature is the information processing device of the tenth feature, wherein the risk assessment information includes a numerical value related to risk assessment, and the control unit identifies the fourth service for which the numerical value related to the risk assessment is lower than a threshold value, and generates the service list in a manner in which the identified fourth service is visually highlighted.

[0161] A twelfth feature is an information processing device in accordance with the tenth or eleventh feature, wherein the risk assessment information includes first risk assessment information based on non-public information and second risk assessment information based on public information.

[0162] A thirteenth feature is an information processing method including the steps of: acquiring an access history for a service used by a user belonging to an organization; identifying a service used by the user based on the access history; identifying operation information for the identified service based on the access history; generating a list of the services including the identified service and the identified operation information; and outputting the list of services. [Explanation of symbols]

[0163] 10...information processing device, 11...transmission unit, 12...reception unit, 13...storage unit, 14...control unit, 20...terminal, 30...terminal, 100...information processing system, 200...network

Claims

1. an acquisition unit for acquiring access histories for services used by users belonging to an organization; a control unit that identifies a service used by the user based on the access history, identifies operation information for the identified service based on the access history, and generates a service list including the identified service and the operation information associated with the service; and an output unit that outputs the list of services.

2. 2. The information processing device of claim 1, wherein the operation information includes at least one of information for logging in to the service, information for uploading data to the service, information for downloading data from the service, information indicating an increase in the number of users using the service, information indicating a decrease in the number of users using the service, information indicating that the service is being used by multiple users using a shared account, and information indicating that the service has been accessed from an IP address other than a specified IP address.

3. The control unit identifies characteristic information of the identified service, The information processing device according to claim 1 , wherein the control unit generates the service list including the identified feature information.

4. a storage unit that stores the feature information in association with a service; The information processing device according to claim 3 , wherein the control unit identifies the feature information by referring to the storage unit.

5. 4. The information processing device of claim 3, wherein the characteristic information includes at least one of information indicating that the service supports file uploading, information indicating that the service supports file downloading, information indicating that the service does not support virtual private lines, information indicating that the service is made available outside the organization, information indicating that the service works in conjunction with other services, information indicating that the service does not support user authentication, and information indicating that the service is a communication tool.

6. a storage unit for storing information on a first service the use of which is restricted in the organization; The control unit detects use of the first service based on the access history, The information processing device according to claim 1 , wherein the output unit outputs a notification that the use of the first service has been detected.

7. a storage unit that stores information on a second service that is excluded from the service list; The information processing device according to claim 1 , wherein the control unit is further configured to exclude the second service from the list of services even when the control unit detects use of the second service based on the access history.

8. 2. The information processing device according to claim 1, wherein the control unit identifies a third service that requires action by the organization from among the identified services based on the operation information, and generates the service list in a manner in which the identified third service is visually highlighted.

9. 4. The information processing device according to claim 3, wherein the control unit identifies a third service that requires action by the organization from among the identified services based on the characteristic information, and generates the service list in a manner in which the identified third service is visually highlighted.

10. a storage unit that stores risk assessment information regarding the service in association with the service; The information processing device of claim 1, wherein the control unit refers to the memory unit, identifies a fourth service from the identified services that is associated with the risk assessment information, and generates the service list in a manner that includes the risk assessment information for the identified fourth service.

11. The risk assessment information includes a numerical value related to a risk assessment, The information processing device according to claim 10 , wherein the control unit identifies the fourth service having a numerical value related to the risk assessment that is lower than a threshold, and generates the service list in a manner in which the identified fourth service is visually emphasized.

12. The information processing apparatus according to claim 10 , wherein the risk assessment information includes first risk assessment information based on non-public information and second risk assessment information based on public information.

13. acquiring an access history for a service used by a user belonging to an organization; Identifying a service used by the user based on the access history; identifying operation information for the identified service based on the access history; generating a list of the services including the identified services and the identified operation information; and outputting the list of services.

Images