Information processing device and information processing method

Abstract

To provide an information processing device and information processing method allowing a service provider to reduce time and effort for inputting answers and to accurately input the answers.SOLUTION: An information processing device includes: a first output unit for outputting a question relating to security of a service to a service provider;, a collection unit for collecting public information relating to the service disclosed to third parties; and a control unit for generating supplementary information relating to the answer to the question in association with the question on the basis of the collected public information, where the first output unit outputs the question and the supplementary information associated with the question to the service provider.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and an information processing method.

Background Art

[0002] Conventionally, a technique (crawling technique) for searching for information (public information) published on a network based on a URL (Uniform Resource Indicator) of a website or the like is known (for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] By the way, when evaluating a security risk in using a service such as a cloud service, there may be a case where a question regarding security is presented to the service provider. In such a case, it may be troublesome for the service provider to answer, or there may be an error in the content.

[0005] Therefore, the present invention has been made to solve the above-described problems, and an object thereof is to provide an information processing apparatus and an information processing method that can reduce the labor of inputting an answer by a service provider and support an accurate answer.

Means for Solving the Problems

[0006] The disclosed aspect is an information processing apparatus including: a first output unit that outputs, to a service provider, questions regarding the security of the service; a collection unit that collects public information regarding the service publicly disclosed to a third party; and a control unit that generates, based on the collected public information, auxiliary information regarding an answer to the question in association with the question. The first output unit outputs, to the service provider, the auxiliary information associated with the question together with the question.

[0007] The disclosed aspect is an information processing method including: step A of outputting, to a service provider, questions regarding the security of the service; step B of collecting public information regarding the service publicly disclosed to a third party; and step C of generating, based on the collected public information publicly disclosed to the third party, auxiliary information regarding an answer to the question in association with the question. Step A includes the step of outputting, to the service provider, the auxiliary information associated with the question together with the question.

Effect of the Invention

[0008] According to the present invention, it is possible to provide an information processing apparatus and an information processing method that can reduce the labor of a service provider for inputting an answer and support an accurate answer.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

[0010] Hereinafter, the embodiment will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

[0011] However, it should be noted that the drawings are schematic, and the ratios of the dimensions etc. may be different from the actual ones. Therefore, specific dimensions etc. should be determined in consideration of the following description. Also, it goes without saying that there may be parts where the relationships or ratios of the dimensions between the drawings are different from each other.

[0012] [Summary of Disclosure] An information processing apparatus according to the summary of the disclosure includes: a first output unit that outputs, to a service provider, questions regarding the security of the service; a collection unit that collects public information regarding the service that has been made public to a third party; and a control unit that generates, based on the collected public information, auxiliary information regarding an answer to the question, in association with the question. The first output unit outputs, to the service provider, the auxiliary information associated with the question together with the question.

[0013] An information processing method according to the summary of the disclosure includes: step A of outputting, to a service provider, questions regarding the security of the service; step B of collecting public information regarding the service that has been made public to a third party; and step C of generating, based on the collected public information that has been made public to the third party, auxiliary information regarding an answer to the question, in association with the question. Step A includes a step of outputting, to the service provider, the auxiliary information associated with the question together with the question.

[0014] In the summary of the disclosure, the information processing apparatus outputs, to the service provider, the auxiliary information associated with the question together with the question. According to such a configuration, the service provider can answer the question while referring to the auxiliary information, so that the labor of the service provider for inputting the answer can be reduced or an accurate answer can be supported.

[0015] [Embodiment] (Information Processing System) Hereinafter, an information processing system according to the embodiment will be described. FIG. 1 is a diagram showing an information processing system 100 according to the embodiment.

[0016] As shown in FIG. 1, the information processing system 100 includes an information processing apparatus 10, a providing server 30, a first terminal 40, and a second terminal 50. The information processing apparatus 10, the providing server 30, the first terminal 40, and the second terminal 50 are connected by a network 200. Although not particularly limited, the network 200 may be configured by the Internet. The network 200 may include a local area network, may include a mobile communication network, and may include a VPN (Virtual Private Network).

[0017] The information processing apparatus 10 outputs a question regarding the security of the service to the provider of the service (hereinafter referred to as the service provider). The information processing apparatus 10 may evaluate the security of the service. The information processing apparatus 10 may output an answer to the question obtained from the service provider to the user of the service (hereinafter referred to as the service user). Details of the information processing apparatus 10 will be described later (see FIG. 2).

[0018] The providing server 30 is a server belonging to a service provider that provides a service via the network 200. The providing server 30 may provide a service related to SaaS (Software as a Service) or the like. The providing server 30 may provide a service related to IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or the like. The providing server 30 may provide other cloud services.

[0019] The first terminal 40 is a terminal used by a service provider. The first terminal 40 may have a display unit 41. The display unit 41 may be configured by a display such as a liquid crystal panel, an organic EL (Electroluminescence) panel, or an LED (Light Emitting Diode). For example, the first terminal 40 may be a personal computer, may be a smartphone, or may be a tablet terminal. The first terminal 40 may sometimes be referred to as a service provider.

[0020] The second terminal 50 is a terminal used by a third party different from the service provider. The third party may include service users who use the services provided by the service provider. The second terminal 50 may have a display unit 51. The display unit 51 may be constituted by a display such as a liquid crystal panel, an organic EL panel, or an LED. For example, the second terminal 50 may be a personal computer, a smartphone, or a tablet terminal. The second terminal 50 may sometimes be referred to as a service user.

[0021] (Information processing apparatus) Hereinafter, the information processing apparatus 10 according to the embodiment will be described. FIG. 2 is a diagram showing the information processing apparatus 10 according to the embodiment.

[0022] As shown in FIG. 2, the information processing apparatus 10 includes a transmission unit 11, a reception unit 12, a storage unit 13, and a control unit 14.

[0023] The transmission unit 11 may be constituted by a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, 6G, etc., or a wired communication module compliant with standards such as IEEE802.3.

[0024] The transmission unit 11 may transmit various information to the first terminal 40 (service provider) and the second terminal 50 (service user).

[0025] First, the transmission unit 11 may transmit questions regarding the security of the service to the first terminal 40. The questions may be transmitted in a list format including two or more questions, or may be transmitted as a so-called security check sheet. The transmission of the questions may be read as the output of the questions, or may be read as the transmission of display data for displaying the questions.

[0026] Second, the transmission unit 11 may transmit to the second terminal 50 an answer to a question obtained from the service provider. The answer may be transmitted in a list format including two or more answers, or may be transmitted as an answer to a so-called security check sheet. The transmission of the answer may be read as the output of the answer, or may be read as the transmission of display data for displaying the answer.

[0027] The reception unit 12 may be configured by a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, 6G, etc., or may be a wired communication module compliant with standards such as IEEE802.3.

[0028] The reception unit 12 may receive various information from the first terminal 40 (service provider) and the second terminal 50 (service user). The reception unit 12 may communicate with various sites on the network 200.

[0029] First, the reception unit 12 receives from the first terminal 40 an answer to a question regarding the security of the service. The reception of the answer may be read as the acquisition of the answer.

[0030] Second, the receiving unit 12 receives public information about services publicly disclosed by a third party from various websites on the network 200, such as the homepage of the service provider. Here, the third party means a person other than the service provider, and may refer to an ordinary person without permission from the service provider. Also, the public information may be information publicly disclosed externally collected from the Internet. Further, the public information may be the information collected itself, the information obtained by processing them, or the information input via the user interface based on the available information. The reception of the public information may be referred to as the collection of the public information. The collection of the public information may be executed periodically or may be executed in response to a trigger such as an operator's instruction. The collection of the public information may be referred to as scraping or crawling. Also, the public information may be collected by an API (Application Programming Interface).

[0031] Here, the public information may include at least any one of information posted on a website related to the service, information related to service authentication, and information related to the system used for service provision.

[0032] The information published on the website related to the service may include information collected from the website related to the service based on the URL (Uniform Resource Locator) information of the website related to the service. The URL information may include the URLs for collecting the terms of use of the service, the privacy policy of the service, the security policy of the service, the information on the security page of the service, the information on the support page of the service, the Cookie policy of the service, the information on the status page of the service, etc., that is, the URLs of the websites where these information are published. The terms of use of the service may include, in addition to the terms of use, the regulations for dealing with anti-social forces, the master subscription contract or the master service agreement (MSA) applied to the use of the service by the users of the service, etc. The privacy policy of the service may include the privacy policy, the Cookie policy, the regulations regarding external information, confidential information or personal information, etc. The security policy of the service may include the policies or regulations regarding security. The information on the security page of the service may include comprehensive information regarding security. The support page of the service may include information for supporting the use of the service by the users of the service, such as the help page of the service. The status page of the service may include status information such as the operating status of the cloud service.

[0033] The URL information may be stored in the storage unit 13 described later, associated with the service for collecting the information and the type of information (terms of use of the service, privacy policy of the service, etc.).

[0034] Information regarding service authentication may include authentication information collected from the website of the authentication authority based on the service identification information (such as name). Also, information regarding service authentication may include authentication information collected from the website of the service provider, etc. Authentication may include security-related authentication information, certification information, or evaluation information such as ISMS authentication, ISMS cloud security authentication, ISO27001, ISO27017, SOC2, privacy mark, ISMAP, FedRAMP, CSA STAR authentication, etc. Information regarding authentication may be associated with the service and stored in the storage unit 13 described later.

[0035] Information regarding the system used for service provision may include system information collected from the website that publishes information regarding the system in which the service is implemented, based on the service identification information (such as name). System information may include, for example, information regarding the registration date of the domain collected from the domain registration information, information regarding the installation area of the data center, information regarding the IaaS provider, etc.

[0036] Information regarding the system may be associated with the service implemented in the system and stored in the storage unit 13 described later.

[0037] The storage unit 13 is composed of a storage medium such as an SSD (Solid State Drive) or HDD (Hard Disk Drive) and stores various information.

[0038] The storage unit 13 may store questions regarding service security. The storage unit 13 may store the answers to the questions obtained from the service provider, in association with the service and the questions. The storage unit 13 may store the public information collected by scraping or crawling, etc., in association with the service. Also, the storage unit 13 may store the collected public information, in association with the related questions.

[0039] The control unit 14 may include at least one processor. The at least one processor may be composed of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), one or more Integrated Circuits, one or more Discrete Circuits, and combinations thereof.

[0040] Based on the collected public information, the control unit 14 generates auxiliary information regarding the answer to the question in association with the question. The control unit 14 instructs the transmission unit 11 to output the auxiliary information associated with the question together with the question to the service provider. The output mode (display mode) of the question and the auxiliary information will be described later (see FIGS. 3 to 8). The control unit 14 outputs the auxiliary information associated with the question together with the answer to the question obtained from the service provider to the service user. The output mode (display mode) of the answer and the auxiliary information will be described later (see FIGS. 9 to 12).

[0041] In an embodiment, the transmission unit 11 constitutes a first output unit that outputs questions regarding the security of the service to the service provider. The transmission unit 11 may constitute the first output unit together with the control unit 14.

[0042] In an embodiment, the reception unit 12 may constitute a collection unit that collects public information regarding the service publicly disclosed to a third party. The reception unit 12 may constitute the collection unit together with the control unit 14.

[0043] In an embodiment, the control unit 14 may constitute a control unit that generates auxiliary information regarding the answer to the question in association with the question based on the collected public information.

[0044] In an embodiment, the reception unit 12 may constitute an acquisition unit that acquires the answer to the question input by the service provider. The reception unit 12 may constitute the acquisition unit together with the control unit 14.

[0045] In an embodiment, the transmission unit 11 may constitute a second output unit that outputs, to a service user, an answer to a question acquired from a service provider. The transmission unit 11 may constitute the second output unit together with the control unit 14.

[0046] (Operation example) Hereinafter, an operation example according to the embodiment will be described. Hereinafter, the information output from the information processing apparatus 10 will be mainly described. In order to facilitate the understanding of the information output from the information processing apparatus 10, the display mode displayed by the information output from the information processing apparatus 10 will be described.

[0047] (Operation example 1) In operation example 1, the display mode 300 of the question and the auxiliary information will be described. The display mode 300 may be a mode displayed on the first terminal 40 (service provider). In operation example 1, a case where the question is a question regarding security and is a question regarding the acquisition status of authentication regarding the service will be exemplified.

[0048] As shown in FIG. 3, the display mode 300 includes an answer area 310 (answer area 310A in FIG. 3), an auxiliary information area 320 (auxiliary information area 320A in FIG. 3), and an icon 331.

[0049] The answer area 310A is an area for inputting a question and an answer to the question. For example, the answer area 310A includes a check box 311, a description field 312, a condition setting item 313, and the like.

[0050] The check box 311 is an interface for answering security-related questions and is a box for inputting whether or not service-related authentication has been obtained. The description field 312 is a field for inputting information regarding the obtained authentication (e.g., registration number, expiration date, scope, etc.). The condition setting item 313 is an item for inputting conditions for narrowing down the questions displayed in the answer area 310A. For example, the condition setting item 313 may be a check box for inputting whether to narrow down to only unanswered and unaddressed questions.

[0051] The auxiliary information area 320A is an area where auxiliary information associated with a question is displayed. As described above, the auxiliary information is generated based on public information. Here, the auxiliary information may be generated based on information posted on a website collected based on URL information, or may be generated based on the collected authentication information. For example, the auxiliary information may include the acquisition status (acquired or not acquired) of service-related authentication. The auxiliary information may also include information regarding the authentication obtained for the service (e.g., registration number, expiration date).

[0052] Here, the above-described storage unit 13 may store public information associated with a question. The above-described storage unit 13 may store the auxiliary information generated from the associated public information in association with the question associated with the public information. The above-described control unit 14 may output the auxiliary information associated with the question.

[0053] The icon 331 may be an icon for switching the display / non-display of the auxiliary information (auxiliary information area 320A). For example, when the auxiliary information area 320A is not displayed, the auxiliary information area 320A may be displayed in response to the selection (pressing) of the icon 331. When the auxiliary information area 320A is displayed, the auxiliary information area 320A may be switched to non-display in response to the selection (pressing) of the icon 331.

[0054] (Operation Example 2) In Operation Example 2, the display mode 300 of the question and auxiliary information will be described. The display mode 300 may be a mode displayed on the first terminal 40 (service provider). In Operation Example 2, a case where the question is a question regarding the service contract or regulations will be exemplified.

[0055] As shown in FIG. 4, the display mode 300 includes an answer area 310 (in FIG. 4, answer area 310B), an auxiliary information area 320 (in FIG. 4, auxiliary information area 320B), and an icon 331.

[0056] The answer area 310B is an area for inputting the question and the answer to the question. The question may be in a form that can be answered with options (in FIG. 4, yes / no) indicating whether it corresponds to the question. The options may include an option (in FIG. 4, non - public) indicating that the answer to the question is non - public, cannot be answered, or cannot be disclosed to the service user. The answer area 310B may include information (in FIG. 4, the background color of the "answered" string) indicating whether the option has been answered. That is, when the question is unanswered and when it has been answered, the background color of the "answered" string changes and is displayed differently.

[0057] The auxiliary information area 320B is an area where the auxiliary information associated with the question is displayed. As described above, the auxiliary information is generated based on public information (for example, information collected based on URL information). For example, the auxiliary information may include information collected by scraping or crawling as information related to the question (in FIG. 4, automatically collected information). The auxiliary information may include information that supplements the collected information, for example, information explaining the reason for the collected information displayed as "automatically collected information" (in FIG. 4, the above reason).

[0058] Similar to Operation Example 1, the icon 331 may be an icon for switching the display / non - display of the auxiliary information (auxiliary information area 320B).

[0059] (Operation Example 3) In Operation Example 3, a modification example with respect to Operation Example 1 will be described. In Operation Example 3, the information processing apparatus 10 generates candidates for answers to questions as auxiliary information based on publicly available information. In the following, the differences with respect to Operation Example 1 will mainly be described.

[0060] As shown in FIG. 5, the auxiliary information area 320C includes candidates for answers to questions. The candidates for answers to questions may be displayed in the same format as the answer format of the questions in the answer area 310A.

[0061] In Operation Example 3, the information processing apparatus 10 may input publicly available information into the artificial intelligence, and instruct the artificial intelligence to output candidates for answers to questions in the same format as the answers to questions, and obtain candidates for answers to questions from the artificial intelligence. For example, the information processing apparatus 10 inputs a question to the artificial intelligence and, based on the collected publicly available information, issues an instruction to create and output candidates for answers to the question by means of a prompt. Also, at that time, the format of the answer to the question may be inserted into the prompt as a sample, and the artificial intelligence may be instructed to output candidates for answers in the same format. Also, the artificial intelligence may have a learning model that takes publicly available information as input and outputs answers to questions. For example, as shown in FIG. 5, the artificial intelligence may create and output candidates for answers regarding the acquisition status of authentication related to a service based on publicly available information. Specifically, the artificial intelligence may select check boxes corresponding to the authentication acquired by the service based on publicly available information, create candidates for answers, and output them.

[0062] In Operation Example 3, the above-described storage unit 13 may store the candidates for answers obtained from the artificial intelligence in association with the questions and the answers to the questions. The candidates for answers may be associated with the questions at the time of acquisition of the candidates for answers.

[0063] In Operation Example 3, the display mode 300 may include an icon 321 for reflecting the answer candidates included in the auxiliary information area 320C (in FIG. 5, this proposal is reflected in the answer). The information processing apparatus 10 reflects the answer candidates included in the auxiliary information area 320C in the answer area 310A in response to the selection (press) of the icon 321.

[0064] In such a case, the information processing apparatus 10 may reflect the answer candidates in the answer area 310A with the following options.

[0065] In Option 1, the information processing apparatus 10 may overwrite all of the answers (answers input by the service provider) in the answer area 310A with the answer candidates included in the auxiliary information area 320C. For example, in the state shown in FIG. 5, an answer indicating that ISO / IEC 27001 and SOC2 have been acquired has been input by the service provider, but in response to the selection (press) of the icon 321, after the check for SOC2 is removed, information (registration number, expiration date, scope, etc.) may be added to the description field 312 regarding ISO / IEC 27001.

[0066] In Option 2, the information processing apparatus 10 may overwrite a part of the answers (answers input by the service provider) in the answer area 310A with the answer candidates included in the auxiliary information area 320C. Specifically, when there is a question for which the service provider has not input an answer, the information processing apparatus 10 may reflect the auxiliary information corresponding to the question as an answer to the question. For example, in the state shown in FIG. 5, an answer indicating that ISO / IEC 27001 and SOC2 have been acquired has been input by the service provider, but in response to the selection (press) of the icon 321, the check for SOC2 remains as it is, and information (registration number, expiration date, scope, etc.) may be added to the description field 312 regarding ISO / IEC 27001.

[0067] In Operation Example 3, the service provider may be able to select which of Option 1 and Option 2 is used to reflect the answer candidates.

[0068] (Operation Example 4) In Operation Example 4, a modification example with respect to Operation Example 2 will be described. In Operation Example 4, the information processing apparatus 10 generates, based on public information, candidates for answers to questions as auxiliary information. In the following, the differences with respect to Operation Example 2 will mainly be described.

[0069] As shown in FIG. 6, the auxiliary information area 320D includes candidates for answers to questions. The candidates for answers to questions may be displayed in the same format as the answer format of the questions in the answer area 310B.

[0070] In Operation Example 4, the information processing apparatus 10 may input public information into the artificial intelligence, and instruct the artificial intelligence to output candidates for answers to questions in the same format as the answers to questions, and obtain candidates for answers to questions from the artificial intelligence.

[0071] In Operation Example 4, similar to Operation Example 3, the display mode 300 may include an icon 321 (in FIG. 6, this proposal is reflected in the answer) for reflecting the candidates for answers included in the auxiliary information area 320D. The information processing apparatus 10 reflects the candidates for answers included in the auxiliary information area 320D in the answer area 310B in response to the selection (pressing) of the icon 321. For example, information may be added to the description column 312 regarding question #M-1.

[0072] In Operation Example 4, the above-described storage unit 13 may store the candidates for answers obtained from the artificial intelligence in association with the questions and the answers to the questions. The candidates for answers may be associated with the questions at the time of obtaining the candidates for answers.

[0073] Although not particularly limited, in Operation Example 4, the candidates for answers may be reflected according to Option 2 described in Operation Example 3.

[0074] (Operation Example 5) In Operation Example 5, a modification example with respect to Operation Example 3 will be described. In Operation Example 5, the information processing apparatus 10 may determine whether the answer to the acquired question (the answer input by the service provider) is different from the candidate for the answer to the question. When the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0075] As shown in FIG. 7, the display mode 300 may include a warning 315 (in FIG. 7, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the candidate for the answer to the question. For example, as shown in FIG. 7, when it is answered that SOC2 has been acquired by the service provider, but in the candidate for the answer based on the public information, SOC2 has not been acquired, the warning 315 may be output.

[0076] In Operation Example 5, the question is a question regarding the acquisition status of authentication related to the service. The information processing apparatus 10 may generate a candidate for the answer to the question as a selection-type answer selected from among options indicating authentication. The information processing apparatus 10 may determine whether the answer to the question is different from the candidate for the answer to the question by determining whether the selected option is different between the answer to the question and the candidate for the answer to the question. That is, it may be determined whether the answer to the question is different from the candidate for the answer to the question by determining whether the option selected in the answer to the question input by the service provider matches the option selected in the generated candidate for the answer.

[0077] In Operation Example 5, Operation Example 3 is assumed, but Operation Example 1 may also be assumed. That is, when the answer to the acquired question (the answer input by the service provider) is different from the answer candidate, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. The answer candidate is specified based on public information, and may be implicitly included in the auxiliary information without being explicitly included in the auxiliary information, or may not be included in the auxiliary information. The answer candidate may be output and acquired using artificial intelligence as in Operation Example 3.

[0078] (Operation Example 6) In Operation Example 6, a modification example with respect to Operation Example 4 will be described. In Operation Example 6, the information processing apparatus 10 may determine whether the answer to the acquired question (the answer input by the service provider) is different from the answer candidate for the question. When the answer to the question is different from the answer candidate for the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0079] As shown in FIG. 8, the display mode 300 may include a warning 315 (in FIG. 8, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the answer candidate for the question. For example, as shown in FIG. 8, when the service provider has answered that it does not correspond to the question (no), but the answer candidate based on public information corresponds to the question (yes), the warning 315 may be output.

[0080] In Operation Example 6, Operation Example 4 is assumed, but Operation Example 2 may also be assumed. That is, when the answer to the acquired question (the answer input by the service provider) is different from the answer candidate, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. The answer candidate is identified based on public information, and may be implicitly included in the auxiliary information without being explicitly included in the auxiliary information, or may not be included in the auxiliary information. The answer candidate may be obtained using artificial intelligence as in Operation Example 4.

[0081] (Operation Example 7) In Operation Example 7, the display mode 400 of the answer and auxiliary information acquired from the service provider will be described. The display mode 400 may be a mode displayed on the second terminal 50 (service user). In Operation Example 7, a case where the question is a question regarding the acquisition status of service-related authentication will be exemplified.

[0082] As shown in FIG. 9, the display mode 400 includes a first condition setting item 410, a second condition setting item 420, an answer area 430, and an auxiliary information area 440.

[0083] The first condition setting item 410 is an item for inputting conditions for narrowing down the questions displayed in the answer area 430. For example, in the first condition setting item 410, conditions for narrowing down questions by conditions such as the answer status (unresolved, unpublished, conditional) may be selectable.

[0084] The second condition setting item 420 is an item for inputting conditions for narrowing down the questions displayed in the answer area 430. For example, in the second condition setting item 420, conditions for narrowing down questions by conditions such as the level of importance (high, medium, low) may be selectable.

[0085] The answer area 430 is an area for displaying questions and answers to the questions. The answer is an answer to the question acquired from the service provider, and may be an answer input or reflected according to at least any one of the above-described Operation Examples 1 to 6.

[0086] The auxiliary information area 440 is an area where auxiliary information associated with a question is displayed. As described above, the auxiliary information is generated based on public information (here, authentication information). The auxiliary information included in the auxiliary information area 440 may be the same as the auxiliary information included in the auxiliary information area 320A described in Operation Example 1, or may be the same as the auxiliary information included in the auxiliary information area 320C described in Operation Example 3.

[0087] (Operation Example 8) In Operation Example 8, the display mode 400 of the answer and auxiliary information obtained from the service provider will be described. The display mode 400 may be a mode displayed on the second terminal 50 (service user). In Operation Example 8, a case where the question is a question regarding the service contract or regulations will be exemplified.

[0088] As shown in FIG. 10, similar to Operation Example 7, the display mode 400 includes a first condition setting item 410, a second condition setting item 420, an answer area 430, and an auxiliary information area 440. Since the first condition setting item 410, the second condition setting item 420, the answer area 430, and the auxiliary information area 440 are the same as those in Operation Example 7, the details thereof will be omitted. Note that the auxiliary information included in the auxiliary information area 440 may be the same as the auxiliary information included in the auxiliary information area 320B described in Operation Example 2, or may be the same as the auxiliary information included in the auxiliary information area 320D described in Operation Example 4. That is, the auxiliary information included in the auxiliary information area 440 may be obtained by inputting public information into an artificial intelligence and instructing the artificial intelligence to output candidates for answers to the question in the same format as the answer to the question, and may be candidates for answers obtained from the artificial intelligence.

[0089] In Operation Example 8, the display mode 400 may further include a question background area 450. The question background area 450 may include information indicating the background in which the question is set from the perspective of service security. The information indicating the background may be stored in the storage unit 13 in advance in association with the question presented to the service provider.

[0090] (Operation Example 9) In Operation Example 9, a modification example with respect to Operation Example 7 will be described. In Operation Example 9, the information processing apparatus 10 may determine whether an answer to the acquired question (an answer input by the service provider) is different from a candidate for the answer to the question. When the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0091] As shown in FIG. 11, the display mode 400 may include a warning 431 (in FIG. 11, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the candidate for the answer to the question. For example, as shown in FIG. 11, when it is answered that SOC2 has been acquired by the service provider, but the candidate for the answer based on the public information indicates that SOC2 has not been acquired, the warning 431 may be output.

[0092] In Operation Example 9, the candidate for the answer is specified based on the public information, and may be explicitly included in the auxiliary information, may be implicitly included in the auxiliary information, or may not be included in the auxiliary information. The candidate for the answer may be obtained using artificial intelligence as in Operation Example 4.

[0093] In Operation Example 9, a case assuming Operation Example 7 is illustrated, but Operation Example 9 may be applied to Operation Example 8.

[0094] (Operation Example 10) In Operation Example 10, a modification example with respect to Operation Example 9 will be described. In Operation Example 10, when the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 outputs information regarding the difference between the answer to the question and the candidate for the answer to the question (hereinafter, difference information) to the service user.

[0095] As shown in FIG. 12, the display mode 400 may include difference information 460. The difference information 460 may be displayed in a pop-up format. The difference information 460 may include information that can compare the difference between the answer to a question (in FIG. 12, the answer of the provider) and the answer candidate (in FIG. 12, the automatically collected information).

[0096] Furthermore, the difference between the answer to a question and the answer candidate (SOC2 in FIG. 12) may be displayed in a manner that is emphasized with respect to other information. The emphasis of the difference may include an emphasis where the color of the character string of the difference is different from others, an emphasis where the background color of the character string of the difference is different from others, and an emphasis where the font type or size of the character string of the difference is different from others. The emphasis of the difference may be performed on the answer to the question (in FIG. 12, the answer of the provider), may be performed on the answer candidate (in FIG. 12, the automatically collected information), or may be performed on both the answer to the question and the answer candidate.

[0097] In Operation Example 10, although it was described as a modification example of Operation Example 9 on the premise of Operation Example 7, Operation Example 10 may be applied to Operation Example 9 on the premise of Operation Example 8.

[0098] (Artificial Intelligence) Hereinafter, the details of the artificial intelligence described in Operation Example 2, Operation Example 3, etc. will be described. The artificial intelligence unit constituting the artificial intelligence may be built in the information processing apparatus 10 (for example, the control unit 14), or may be provided outside the information processing apparatus 10.

[0099] The answer generation model included in the artificial intelligence unit is a learning model that is learned to take public information as input and output answer candidates. That is, the answer generation model is a learning model that learns public information and the corresponding answer candidates as teacher data.

[0100] The answer generation model may be generative AI including a large language model. In this case, the control unit 14 inputs public information into the answer generation model, inputs a prompt including an instruction to generate an answer into the answer generation model, and causes the answer generation model to output answer candidates. Further, the control unit 14 may input, for example, a prompt into which one or more samples of public information and one or more samples of corresponding answer candidates are inserted, into the answer generation model.

[0101] The artificial intelligence unit is configured to receive an input from each functional unit and return an instructed output. Note that the artificial intelligence used by the server device in each functional unit may be common or may be individually prepared for each functional unit.

[0102] The artificial intelligence unit is an AI (Artificial Intelligence) equipped with a language model such as a Transformer (including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer)), a Recurrent Neural Network (RNN), etc., and may include generative AI.

[0103] The language model is an example of a learning model by a machine learning algorithm. Specific algorithms for machine learning include the nearest neighbor method, the naive Bayes method, decision trees, support vector machines, deep learning (deep neural networks) using neural networks, etc. The artificial intelligence unit can appropriately apply the above algorithms.

[0104] The artificial intelligence unit may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or semi-supervised learning. In supervised learning, machine learning is performed using teacher data (learning data). The teacher data is composed of a pair of input data for learning and output data (correct data). Also, the language model may be a general-purpose model that can be used generally for a wide range of tasks, not just trained for a specific task.

[0105] The learning model included in the artificial intelligence unit is capable of performing additional learning. For example, the artificial intelligence unit learns whether the proposed answer candidate has been reflected in the answer by the user. That is, the artificial intelligence unit performs additional learning and fine-tuning using a teacher data set labeled with the actual reflection result as feedback on the answer candidate created and presented by the learning model. As a result, the correction content output from the learning model is optimized and presented to the user.

[0106] The artificial intelligence unit may be a general-purpose natural language processing learning model such as a large language model (LLM) that has learned a large amount of data as artificial intelligence. Such general-purpose learning models include language models that can handle various tasks without fine-tuning by One-shot Learning, Few-shot Learning, etc. Also, the general-purpose learning model may be configured to be able to handle various tasks by Zero-shot Learning. The artificial intelligence used in each functional unit of the control unit may be a separate learning model or a common general-purpose learning model.

[0107] In the embodiment, although the server device performs various storage and control, a plurality of external devices may be used instead of the server device. That is, various information and programs may be distributed and stored in a plurality of external devices using blockchain technology or the like. In particular, the artificial intelligence unit may be an external configuration of the server device. In that case, the artificial intelligence unit, which is an external configuration, is configured to receive an input from each functional unit of the server device and return an instructed output to the server device.

[0108] (Information Processing Method) Hereinafter, the information processing method according to the embodiment will be described. FIG. 13 is a diagram showing the information processing method according to the embodiment.

[0109] As shown in FIG. 13, in step S10, the information processing apparatus 10 collects public information. As described above, the public information may include at least any one of information posted on a website related to the service, information related to service authentication, and information related to a system used for service provision.

[0110] In step S20, the information processing apparatus 10 transmits a question to the first terminal 40. The information processing apparatus 10 transmits, together with the question, auxiliary information associated with the question to the first terminal 40.

[0111] In step S21, the first terminal 40 displays information in display mode A based on the information received from the information processing apparatus 10. The display mode A is the display mode exemplified in operation examples 1 to 6 (FIGS. 3 to 8).

[0112] In step S22, the information processing apparatus 10 receives, from the first terminal 40, an answer input or reflected by the service provider.

[0113] In step S23, the information processing apparatus 10 stores the answer input or reflected by the service provider.

[0114] In step S30, the information processing apparatus 10 transmits the answer result to the second terminal 50. The answer result includes the answer input or reflected by the service provider. The information processing apparatus 10 transmits the auxiliary information associated with the question to the second terminal 50 together with the answer result.

[0115] In step S31, the second terminal 50 displays the information in the display mode B based on the information received from the information processing apparatus 10. The display mode B is the display mode exemplified in operation examples 7 to 10 (FIGS. 9 to 12).

[0116] (Function and effect) In the embodiment, the information processing apparatus 10 outputs, to the service provider (the first terminal 40), the auxiliary information associated with the question together with the question. According to such a configuration, the service provider can answer the question while referring to the auxiliary information, so that the labor of the service provider for inputting the answer can be reduced, or an accurate answer can be supported.

[0117] In the embodiment, the information processing apparatus 10 may generate, as auxiliary information, candidates for answers to the questions based on the public information. According to such a configuration, it becomes easy for the service provider to input an answer.

[0118] In the embodiment, the information processing apparatus 10 may reflect, as an answer to the question, the auxiliary information corresponding to the question for which no answer has been input by the service provider. According to such a configuration, the labor of the service provider for inputting an answer can be further reduced.

[0119] In the embodiment, when the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. According to such a configuration, it is possible to suppress input errors or omissions in the answer input by the service provider.

[0120] In an embodiment, the information processing apparatus 10 may output, to a service user (the second terminal 50), auxiliary information associated with a question together with an answer to the question obtained from a service provider. According to such a configuration, the service user can easily determine the validity of the answer by the service provider by referring to the auxiliary information.

[0121] In an embodiment, when the answer to a question is different from a candidate for the answer to the question, the information processing apparatus 10 may output, to the user of the service, information regarding the difference between the answer to the question and the candidate for the answer to the question. The service user can easily determine whether the answer by the service provider is correct by referring to the information regarding the difference.

[0122] [Modification Example 1] Hereinafter, Modification Example 1 of the embodiment will be described. Hereinafter, the differences from the embodiment will be mainly described.

[0123] In Modification Example 1, the information processing apparatus 10 may classify information obtained from public information (hereinafter, service-related information) into categories related to the service.

[0124] The categories include at least any one of a category related to a change in the service agreement (hereinafter, agreement change), a category related to a change in the service function (hereinafter, function change), a category related to a service failure (hereinafter, failure information), a category related to a service incident (hereinafter, incident), and a category related to the service operation (hereinafter, operation information).

[0125] The process of classifying service-related information into categories may include the following processes. The URL or API of the collection destination for each category may be specified for each service and stored in the above-described storage unit 13 in association with the service. For a single category, a plurality of URLs or APIs may be specified. For example, for the category of service agreement changes of a certain service, the URL of the terms of use and the URL of the privacy policy may be specified and stored in the above-described storage unit 13 in association with a certain service. The control unit 14 collects information through the specified URL or API, and when there is an update or addition of information, the updated or added information is displayed in the column of the category associated with the URL or API.

[0126] Although not particularly limited, the service-related information may include information other than the information obtained from public information. Such information may be obtained from information not publicly disclosed (for example, information privately managed by service users or service providers). The information privately managed may include the names of users (individuals, departments, etc.) of the service managed by service users or service providers, the purpose of the service managed by service users or service providers, the usage status of services prohibited by service users (NG services), the investigation status of services, and the like.

[0127] The information processing apparatus 10 may output service-related information. For example, the information processing apparatus 10 may transmit service-related information to the second terminal 50 (for example, a terminal used by a service user). Note that the information processing apparatus 10 may also transmit service-related information to the first terminal 40 (service provider).

[0128] Here, when outputting service-related information, the information processing apparatus 10 may output the information classified into categories in different modes according to the categories. In the following, in order to facilitate the understanding of the information output from the information processing apparatus 10, the display modes displayed by the information output from the information processing apparatus 10 will be described.

[0129] As shown in FIG. 14, the display mode 500 of service-related information includes a usage summary column 510 and a news column 520.

[0130] The usage summary column 510 includes the department using the service (in FIG. 14, the using department), the purpose of using the service (in FIG. 14, the usage purpose), etc. The usage summary column 510 may include information permitted to be used in the service by the service user (for example, customer information such as company information, person in charge information, sales information, etc.), may include the magnitude of the impact associated with the suspension of the service, and may include the emergency contact information regarding the service.

[0131] The news column 520 includes information classified into categories in different manners according to the categories. Here, the different manners may include manners in which the colors of the character strings indicating the categories (in FIG. 14, model change, failure information, incident, operation information, regulation change) are different, manners in which the background colors of the character strings indicating the categories are different, and manners in which the types or sizes of the fonts of the character strings indicating the categories are different.

[0132] Under such a premise, the information processing apparatus 10 may output the information classified into the category regarding the change of the service regulations in a manner that enables comparison between the acquired changed information and the previously acquired unchanged information.

[0133] As shown in FIG. 15, the news column 520 of the display mode 500 may include a difference comparison column 521. The difference comparison column 521 includes the changed information (in FIG. 15, After ···) and the unchanged information (in FIG. 15, Before ···) arranged side by side. Here, the changed information and the unchanged information may be displayed in a manner that emphasizes the changed portions. The emphasis on the changed portions may include emphasis in which the color of the character string of the changed portion is different from others, emphasis in which the background color of the character string of the changed portion is different from others, and emphasis in which the type or size of the font of the character string of the changed portion is different from others.

[0134] In Modification Example 1, the transmission unit 11 constitutes a third output unit that outputs information classified into categories in different manners according to the categories. The transmission unit 11 constitutes a third output unit that outputs information classified into the category related to the service agreement change in a manner that enables comparison between the acquired changed information and the previously acquired unchanged information. The transmission unit 11 may constitute the third output unit together with the control unit 14. Thereby, when there is a change in the service agreement, the content of the change can be easily grasped. Note that the agreement may include, in addition to the service usage agreement, the service privacy policy, the service security policy, the service Cookie policy, etc., and may include a plurality of agreements and policies.

[0135] For categories other than the category related to the service agreement change (for example, failure information, etc.), the transmission unit 11 may output URL information corresponding to the public information in which the information (for example, failure information) is published. The display mode 500 may include the URL information in association with a category (for example, failure information).

[0136] The control unit 14 may input the information published in the public information into the artificial intelligence and output the summary text of the information to the artificial intelligence. For example, the control unit 14 may input the failure information into the artificial intelligence and output the summary text of the failure information to the artificial intelligence. The display mode 500 may include the summary text output (acquired) from the artificial intelligence. In such a case, the artificial intelligence may include a learning model that takes the public information and the corresponding URL information as inputs and outputs the summary text of the published information. According to such a configuration, when there is failure information or the like in the cloud service or the like used by the service user, the service user can easily access the website on which the failure information or the like is published, and can easily grasp the content of the failure by the output of the summary text. In particular, it is particularly effective when a security-critical event such as a failure or an incident occurs.

[0137] Although not particularly mentioned in Modification Example 1, the information processing apparatus 10 may output the usage status of the NG service, the investigation status of the service, etc.

[0138] The NG service may be a service that restricts or prohibits use by users in an organization. The storage unit 13 may store information on the NG service. The restriction may be considered to include prohibition. The information on the NG service may include at least information for identifying the service (for example, the name of the service). The NG service is a service whose use by users is restricted or prohibited based on security concerns or the like, and the list of information on the NG service may be referred to as a blacklist. When the service user is an organization, the information processing apparatus 10 may acquire the access history of the services used by the users belonging to the organization, and when access to the NG service is detected, output information on the NG service (such as the name of the service) for which the access has been detected.

[0139] The investigation status of the service may be the status of a process of collecting answers from the service provider to questions regarding security (investigation regarding the security of the service). For example, the investigation status of the service may include statuses such as "request sent" (requesting the service provider for an investigation regarding security), "confirmation by the other party" (confirming whether the service provider will receive the investigation), "answer" (reviewing the answer from the service provider), and "completed" (the investigation is completed). In the example shown in FIG. 14 or FIG. 15, the investigation status (status) regarding the security of service A may be included in the display mode 500. The investigation status may be input by the person in charge of the investigation (for example, an entity that substitutes for security investigation and collection of answers to questions) via the user interface and stored in the information processing apparatus 10.

[0140] (Information Processing Method) Hereinafter, the information processing method according to Modification Example 1 will be described. FIG. 16 is a diagram showing the information processing method according to Modification Example 1.

[0141] As shown in FIG. 16, in step S40, the information processing apparatus 10 collects public information. As described above, the public information may include at least any one of information posted on a website related to the service, information related to service authentication, and information related to the system used for service provision.

[0142] In step S41, the information processing apparatus 10 acquires service-related information from the public information. The information processing apparatus 10 classifies the service-related information into categories.

[0143] In step S42, the information processing apparatus 10 transmits the classification result to the second terminal 50. The classification result includes the information classified into categories.

[0144] In step S43, the second terminal 50 displays the information in the display mode C based on the information received from the information processing apparatus 10. The display mode C is the display mode exemplified in FIGS. 14 to 15 described above.

[0145] In FIG. 15, the case where the classification result is transmitted to the second terminal 50 (for example, a service user) is exemplified, but the classification result may be transmitted to the first terminal 40 (service provider).

[0146] (Function and Effect) In Modification Example 1, the information processing apparatus 10 may classify the information (service-related information) acquired from the public information into categories. According to such a configuration, the information acquired from the public information can be appropriately managed.

[0147] In Modification Example 1, the information processing apparatus 10 may output the information classified into categories in different modes according to the categories. According to such a configuration, users such as service users can easily grasp the service-related information based on the information classified into categories.

[0148] In Modification Example 1, the information processing apparatus 10 may present information classified into categories related to changes in service terms in a manner that enables comparison between the acquired changed information and the previously acquired unchanged information. According to such a configuration, a user such as a service user can easily compare the information before and after the change regarding the change in service terms.

[0149] [Other Embodiments] Although the present invention has been described with reference to the above-described embodiments, the discussions and drawings that form a part of this disclosure should not be construed as limiting the present invention. Various alternative embodiments, examples, and operation techniques will be apparent to those skilled in the art from this disclosure.

[0150] In the above disclosure, as a method for collecting public information, a case of collecting by scraping or crawling has been described. However, the above disclosure is not limited to this. The public information may be manually input by an operator. In such a case, the collection unit may include an interface used by the operator for information input.

[0151] In the above disclosure, an example of a case where the display control of the display mode is executed by the information processing apparatus 10 has been illustrated. However, the above disclosure is not limited to this. For example, the display control of Display Mode A or Display Mode C may be executed by an application on the first terminal 40, and the display control of Display Control B or Display Mode C may be executed by an application on the second terminal 50.

[0152] Although not particularly mentioned in the above disclosure, the display may include a display in the physical reality, a display in an extended reality such as AR (Artificial Reality), a display in a virtual reality such as VR (Virtual Reality), or a display in a virtual space such as a metaverse.

[0153] Although not particularly mentioned in the above disclosure, the information processing apparatus 10 may have a display unit that displays at least any one of the above-described display modes A, B, and C. The display unit may be configured by a display such as a liquid crystal panel, an organic EL panel, or an LED.

[0154] Although not particularly mentioned in the above disclosure, a program may be provided that causes a computer to execute each process performed by the information processing apparatus 10, the first terminal 40, and the second terminal 50. Further, the program may be recorded on a computer-readable medium. By using a computer-readable medium, it is possible to install the program on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transitory recording medium. The non-transitory recording medium is not particularly limited, but may be, for example, a recording medium such as a CD-ROM or a DVD-ROM.

[0155] Alternatively, a chip may be provided that includes a memory that stores a program for executing each process performed by the information processing apparatus 10, the first terminal 40, and the second terminal 50, and a processor that executes the program stored in the memory.

[0156] [Supplementary Note] The above disclosure may be expressed as follows.

[0157] A first feature is an information processing apparatus that includes a first output unit that outputs a question regarding the security of the service to a service provider, a collection unit that collects public information regarding the service that has been made public to a third party, and a control unit that generates auxiliary information regarding an answer to the question in association with the question based on the collected public information, and the first output unit outputs the auxiliary information associated with the question together with the question to the service provider.

[0158] The second feature is that, in the first feature, the control unit is an information processing apparatus that generates candidates for answers to the questions as the auxiliary information based on the public information.

[0159] The third feature is that, in the second feature, the control unit inputs the public information into an artificial intelligence, instructs the artificial intelligence to output candidates for answers to the questions in the same format as the answers to the questions, and obtains the candidates for answers to the questions from the artificial intelligence. The information processing apparatus is as described above.

[0160] The fourth feature is that, in the second or third feature, an acquisition unit is provided that acquires the answers to the questions input by the provider of the service. The control unit reflects the auxiliary information corresponding to the questions for which no answer has been input by the provider of the service as the answers to the questions. The information processing apparatus is as described above.

[0161] The fifth feature is that, in at least any one of the second to fourth features, an acquisition unit is provided that acquires the answers to the questions input by the provider of the service. The control unit determines whether the acquired answers to the questions are different from the candidates for answers to the questions. When the answers to the questions are different from the candidates for answers to the questions, the first output unit outputs a warning prompting the provider of the service to confirm the answers to the questions. The information processing apparatus is as described above.

[0162] The sixth feature is that, in the fifth feature, the questions include questions regarding the acquisition status of authentication related to the service. The answers to the questions include a selection-type answer that selects the authentication acquired for the service from among the options indicating the authentication. The control unit generates candidates for answers to the questions as a selection-type answer that selects from among the options indicating the authentication. By determining whether the selected option is different between the answer to the question and the candidate for the answer to the question, it is determined whether the answer to the question is different from the candidate for the answer to the question. The information processing apparatus is as described above.

[0163] The seventh feature is that in at least any one of the first to sixth features, it includes a second output unit that outputs, to the user of the service, the answer to the question obtained from the service provider, and the second output unit outputs, to the user of the service, the auxiliary information associated with the question together with the answer to the question obtained from the service provider. It is an information processing apparatus.

[0164] The eighth feature is that in the seventh feature, the control unit determines whether the answer to the question obtained from the service provider is different from the candidate for the answer to the question, and when the answer to the question is different from the candidate for the answer to the question, the second output unit outputs, to the user of the service, information regarding the difference between the answer to the question and the candidate for the answer to the question. It is an information processing apparatus.

[0165] The ninth feature is that in at least any one of the first to eighth features, the public information includes at least any one of information posted on a website related to the service, information related to the authentication of the service, and information related to the system used for providing the service. It is an information processing apparatus.

[0166] The tenth feature is that in at least any one of the first to ninth features, the control unit classifies the information obtained from the public information into categories related to the service. It is an information processing apparatus.

[0167] The eleventh feature is that in the tenth feature, the category includes at least any one of a category related to a change in the service agreement, a category related to a change in the service function, a category related to a service failure, a category related to a service incident, and a category related to the operation of the service. It is an information processing apparatus.

[0168] The 12th feature is an information processing apparatus including, in the 10th feature or the 11th feature, a third output unit that outputs the information classified into the category in different manners according to the category.

[0169] The 13th feature is an information processing apparatus including, in the 11th feature or the 12th feature that cites the 11th feature, a third output unit that outputs the information classified into the category regarding the service contract change in a manner capable of comparing the acquired changed information with the previously acquired unchanged information.

[0170] The 14th feature is an information processing method including: step A of outputting a question regarding the security of the service to a service provider; step B of collecting public information regarding the service publicly disclosed to a third party; and step C of generating auxiliary information regarding an answer to the question in association with the question based on the collected public information publicly disclosed to the third party, wherein step A includes a step of outputting, to the service provider, the auxiliary information associated with the question together with the question.

Explanation of Reference Numerals

[0171] 10…Information processing apparatus, 11…Transmission unit, 12…Reception unit, 13…Storage unit, 14…Control unit, 30…Providing server, 40…First terminal, 50…Second terminal, 100…Information processing system, 200…Network

Claims

1. A first output unit that outputs questions regarding the security of the service to the provider of the service; A collection unit that collects public information regarding the service that has been made public to a third party; A control unit that generates auxiliary information regarding an answer to the question in association with the question based on the collected public information, and The first output unit outputs, to the provider of the service, the auxiliary information associated with the question together with the question. An information processing apparatus.

2. The control unit generates, as the auxiliary information, candidates for answers to the questions based on the public information. The information processing apparatus according to claim 1.

3. The control unit inputs the public information to an artificial intelligence and instructs the artificial intelligence to output candidates for answers to the questions in the same format as the answers to the questions, and obtains the candidates for answers to the questions from the artificial intelligence. The information processing apparatus according to claim 2.

4. A acquisition unit that acquires an answer to the question input by the provider of the service, and The control unit reflects the auxiliary information corresponding to the question for which no answer has been input by the provider of the service as an answer to the question. The information processing apparatus according to claim 2.

5. A acquisition unit that acquires an answer to the question input by the provider of the service, and The control unit determines whether the acquired answer to the question is different from the candidate for the answer to the question, and The first output unit outputs a warning prompting the provider of the service to confirm the answer to the question when the answer to the question is different from the candidate for the answer to the question. The information processing apparatus according to claim 2.

6. The question includes a question regarding the acquisition status of authentication regarding the service, and The answer to the question includes a selection-type answer that selects the authentication obtained for the service from among the options indicating the authentication. The control unit generates, as a selection-type answer, candidates for the answer to the question by selecting from among the options indicating the authentication, and determines whether the answer to the question is different from the candidates for the answer to the question by determining whether the selected option is different between the answer to the question and the candidates for the answer to the question. The information processing apparatus according to claim 5.

7. It includes a second output unit that outputs, to the user of the service, the answer to the question obtained from the provider of the service. The second output unit outputs, to the user of the service, the auxiliary information associated with the question together with the answer to the question obtained from the provider of the service. The information processing apparatus according to claim 1.

8. The control unit determines whether the answer to the question obtained from the provider of the service is different from the candidates for the answer to the question. The second output unit outputs, to the user of the service, information regarding the difference between the answer to the question and the candidates for the answer to the question when the answer to the question is different from the candidates for the answer to the question. The information processing apparatus according to claim 7.

9. The public information includes at least any one of information posted on a website related to the service, information related to the authentication of the service, and information related to the system used for providing the service. The information processing apparatus according to claim 1.

10. The control unit classifies the information obtained from the public information into categories related to the service. The information processing apparatus according to claim 1.

11. The information processing apparatus according to claim 10, wherein the category includes at least one of a category related to a change in the service agreement, a category related to a change in the service function, a category related to a service failure, a category related to a service incident, and a category related to the operation of the service.

12. The information processing apparatus according to claim 10, further comprising a third output unit that outputs the information classified into the category in different manners according to the category.

13. The information processing apparatus according to claim 11, further comprising a third output unit that outputs, in a manner capable of comparing the obtained changed information with the previously obtained unchanged information, the information classified into the category related to a change in the service agreement.

14. Step A of outputting a question regarding the security of the service to a service provider; Step B of collecting public information regarding the service made public to a third party; Step C of generating auxiliary information regarding an answer to the question, in association with the question, based on the collected public information made public to the third party, and The information processing method, wherein step A includes a step of outputting, to the service provider, the auxiliary information associated with the question together with the question.

Images