Information processing device and information processing method

Abstract

To provide an information processing device and information processing method allowing a service provider to reduce time and effort for inputting answers and to accurately input the answers.SOLUTION: An information processing device includes: a first output unit for outputting a question relating to security of a service to a service provider;, a collection unit for collecting public information relating to the service disclosed to third parties; and a control unit for generating supplementary information relating to the answer to the question in association with the question on the basis of the collected public information, where the first output unit outputs the question and the supplementary information associated with the question to the service provider.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and an information processing method.

Background Art

[0002] Conventionally, a technique (crawling technique) for searching for information (public information) published on a network based on a URL (Uniform Resource Indicator) of a website or the like is known (for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] By the way, when evaluating security risks in using services such as cloud services, there may be cases where questions regarding security are presented to the service provider. In such cases, it may be cumbersome for the service provider to answer, or there may be errors in the content.

[0005] Therefore, the present invention has been made to solve the above-described problems, and an object thereof is to provide an information processing apparatus and an information processing method that can reduce the labor of inputting answers by a service provider and support accurate answers.

Means for Solving the Problems

[0006] The disclosed aspect includes a first output unit that outputs questions regarding the security of the service to the service provider, a collection unit that collects public information regarding the service publicly available to a third party, and a control unit that generates auxiliary information regarding the answer to the question in association with the question based on the collected public information. The first output unit outputs the auxiliary information associated with the question to the service provider together with the question, and is an information processing apparatus.

[0007] The disclosed aspect includes step A of outputting questions regarding the security of the service to the service provider, step B of collecting public information regarding the service publicly available to a third party, and step C of generating auxiliary information regarding the answer to the question in association with the question based on the collected public information publicly available to the third party. Step A includes the step of outputting the auxiliary information associated with the question to the service provider together with the question, and is an information processing method.

Effect of the Invention

[0008] According to the present invention, it is possible to provide an information processing apparatus and an information processing method that can reduce the labor of the service provider for inputting an answer and support an accurate answer.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

[0010] Hereinafter, the embodiments will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

[0011] However, it should be noted that the drawings are schematic, and the ratios of the dimensions etc. may be different from the actual ones. Therefore, specific dimensions etc. should be determined in consideration of the following description. Also, it goes without saying that there may be parts where the relationships or ratios of the dimensions between the drawings are different from each other.

[0012] [Summary of the Disclosure] The information processing apparatus according to the summary of the disclosure includes a first output unit that outputs questions regarding the security of the service to the provider of the service, a collection unit that collects public information regarding the service publicly disclosed to a third party, and a control unit that generates auxiliary information regarding the answer to the question in association with the question based on the collected public information, and the first output unit outputs the auxiliary information associated with the question together with the question to the provider of the service.

[0013] The information processing method according to the summary of the disclosure includes step A of outputting a question regarding the security of the service to the provider of the service, step B of collecting public information regarding the service publicly disclosed to a third party, and step C of generating auxiliary information regarding the answer to the question in association with the question based on the collected public information publicly disclosed to the third party, and step A includes the step of outputting the auxiliary information associated with the question together with the question to the provider of the service.

[0014] In the summary of the disclosure, the information processing apparatus outputs, to the provider of the service, an auxiliary information associated with a question together with the question. According to such a configuration, the provider of the service can answer the question while referring to the auxiliary information, so that the labor for the provider of the service to input an answer can be reduced, or an accurate answer can be supported.

[0015] [Embodiment] (Information Processing System) Hereinafter, the information processing system according to the embodiment will be described. FIG. 1 is a diagram showing an information processing system 100 according to the embodiment.

[0016] As shown in FIG. 1, the information processing system 100 includes an information processing apparatus 10, a providing server 30, a first terminal 40, and a second terminal 50. The information processing apparatus 10, the providing server 30, the first terminal 40, and the second terminal 50 are connected by a network 200. Although not particularly limited, the network 200 may be configured by the Internet. The network 200 may include a local area network, may include a mobile communication network, and may include a VPN (Virtual Private Network).

[0017] The information processing apparatus 10 outputs a question regarding the security of the service to the provider of the service (hereinafter referred to as the service provider). The information processing apparatus 10 may evaluate the security of the service. The information processing apparatus 10 may output an answer to the question obtained from the service provider to the user of the service (hereinafter referred to as the service user). Details of the information processing apparatus 10 will be described later (see FIG. 2).

[0018] The providing server 30 is a server belonging to a service provider that provides services via the network 200. The providing server 30 may provide services related to SaaS (Software as a Service) or the like. The providing server 30 may provide services related to IaaS (Infrastructure as a Service), PaaS (Platform as a Service), or the like. The providing server 30 may provide other cloud services.

[0019] The first terminal 40 is a terminal used by the service provider. The first terminal 40 may have a display unit 41. The display unit 41 may be configured by a display such as a liquid crystal panel, an organic EL (Electroluminescence) panel, or an LED (Light Emitting Diode). For example, the first terminal 40 may be a personal computer, may be a smartphone, or may be a tablet terminal. The first terminal 40 may sometimes be referred to as the service provider.

[0020] The second terminal 50 is a terminal used by a third party different from the service provider. The third party may include service users who use the services provided by the service provider. The second terminal 50 may have a display unit 51. The display unit 51 may be constituted by a display such as a liquid crystal panel, an organic EL panel, or an LED. For example, the second terminal 50 may be a personal computer, a smartphone, or a tablet terminal. The second terminal 50 may sometimes be referred to as a service user.

[0021] (Information processing apparatus) Hereinafter, the information processing apparatus 10 according to the embodiment will be described. FIG. 2 is a diagram showing the information processing apparatus 10 according to the embodiment.

[0022] As shown in FIG. 2, the information processing apparatus 10 includes a transmission unit 11, a reception unit 12, a storage unit 13, and a control unit 14.

[0023] The transmission unit 11 may be constituted by a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, 6G, etc., or a wired communication module compliant with standards such as IEEE802.3.

[0024] The transmission unit 11 may transmit various information to the first terminal 40 (service provider) and the second terminal 50 (service user).

[0025] First, the transmission unit 11 may transmit questions regarding the security of the service to the first terminal 40. The questions may be transmitted in a list form including two or more questions, or may be transmitted as a so-called security check sheet. The transmission of the questions may be read as the output of the questions, or may be read as the transmission of display data for displaying the questions.

[0026] Second, the transmission unit 11 may transmit an answer to a question obtained from a service provider to the second terminal 50. The answer may be transmitted in a list format including two or more answers, or may be transmitted as an answer to a so-called security check sheet. The transmission of the answer may be read as the output of the answer, or may be read as the transmission of display data for displaying the answer.

[0027] The reception unit 12 may be configured by a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, 6G, etc., or may be a wired communication module compliant with standards such as IEEE802.3.

[0028] The reception unit 12 may receive various information from the first terminal 40 (service provider) and the second terminal 50 (service user). The reception unit 12 may communicate with various sites on the network 200.

[0029] First, the reception unit 12 receives an answer to a question regarding the security of the service from the first terminal 40. The reception of the answer may be read as the acquisition of the answer.

[0030] Second, the receiving unit 12 receives public information about services publicly disclosed by a third party from various websites on the network 200, such as the homepage of the service provider. Here, the third party means a person other than the service provider, and may refer to an ordinary person without the permission of the service provider. Also, the public information may be information publicly disclosed externally collected from the Internet. Further, the public information may be the information collected itself, the information obtained by processing them, or the information input via the user interface based on the available information. The reception of the public information may be referred to as the collection of the public information. The collection of the public information may be executed periodically, or may be executed in response to a trigger such as an operator's instruction. The collection of the public information may be referred to as scraping or crawling. Also, the public information may be collected by an API (Application Programming Interface).

[0031] Here, the public information may include at least any one of information posted on a website related to the service, information related to the authentication of the service, and information related to the system used for the provision of the service.

[0032] The information posted on the website related to the service may include information collected from the website related to the service based on the URL (Uniform Resource Locator) information of the website related to the service. The URL information may include the URLs for collecting the terms of use of the service, the privacy policy of the service, the security policy of the service, the information of the security page of the service, the information of the support page of the service, the Cookie policy of the service, the information of the status page of the service, etc., that is, the URLs of the websites where these information are posted. The terms of use of the service may include, in addition to the terms of use, the regulations for dealing with anti-social forces, the master subscription contract or the master service agreement (MSA) applied to the use of the service by the users of the service, etc. The privacy policy of the service may include the privacy policy, the Cookie policy, the regulations regarding external information, confidential information or personal information, etc. The security policy of the service may include the policies or regulations regarding security. The information of the security page of the service may include comprehensive information regarding security. The support page of the service may include information for supporting the use of the service by the users of the service, such as the help page of the service. The status page of the service may include status information such as the operating status of the cloud service.

[0033] The URL information may be stored in the storage unit 13 described later, associated with the service for collecting the information and the type of the information (terms of use of the service, privacy policy of the service, etc.).

[0034] Information regarding service authentication may include authentication information collected from the website of the authentication authority based on the service identification information (such as the name). Also, information regarding service authentication may include authentication information collected from the website of the service provider, etc. Authentication may include authentication information, certification information, or evaluation information related to security, such as ISMS authentication, ISMS cloud security authentication, ISO27001, ISO27017, SOC2, privacy mark, ISMAP, FedRAMP, CSA STAR certification, etc. Information regarding authentication may be associated with the service and stored in the storage unit 13 described later.

[0035] Information regarding the system used for service provision may include system information collected from the website that publishes information regarding the system in which the service is implemented, based on the service identification information (such as the name). System information may include, for example, information regarding the registration date of the domain collected from the domain registration information, information regarding the installation area of the data center, information regarding the IaaS provider, etc.

[0036] Information regarding the system may be associated with the service implemented in the system and stored in the storage unit 13 described later.

[0037] The storage unit 13 is composed of a storage medium such as an SSD (Solid State Drive) or HDD (Hard Disk Drive), and stores various information.

[0038] The storage unit 13 may store questions regarding service security. The storage unit 13 may store the answers to the questions obtained from the service provider, associated with the service and the questions. The storage unit 13 may store the public information collected by scraping or crawling, etc., associated with the service. Also, the storage unit 13 may store the collected public information, associated with the related questions.

[0039] The control unit 14 may include at least one processor. The at least one processor may be constituted by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), one or more Integrated Circuits, one or more Discrete Circuits, and combinations thereof.

[0040] Based on the collected public information, the control unit 14 generates auxiliary information regarding the answer to the question in association with the question. The control unit 14 instructs the transmission unit 11 to output the auxiliary information associated with the question together with the question to the service provider. The output mode (display mode) of the question and the auxiliary information will be described later (see FIGS. 3 to 8). The control unit 14 outputs the auxiliary information associated with the question together with the answer to the question obtained from the service provider to the service user. The output mode (display mode) of the answer and the auxiliary information will be described later (see FIGS. 9 to 12).

[0041] In an embodiment, the transmission unit 11 constitutes a first output unit that outputs questions regarding the security of the service to the service provider. The transmission unit 11 may constitute the first output unit together with the control unit 14.

[0042] In an embodiment, the reception unit 12 may constitute a collection unit that collects public information regarding the service publicly disclosed to a third party. The reception unit 12 may constitute the collection unit together with the control unit 14.

[0043] In an embodiment, the control unit 14 may constitute a control unit that generates auxiliary information regarding the answer to the question in association with the question based on the collected public information.

[0044] In an embodiment, the reception unit 12 may constitute an acquisition unit that acquires the answer to the question input by the service provider. The reception unit 12 may constitute the acquisition unit together with the control unit 14.

[0045] In an embodiment, the transmission unit 11 may constitute a second output unit that outputs an answer to a question acquired from a service provider to a service user. The transmission unit 11 may constitute the second output unit together with the control unit 14.

[0046] (Operation example) Hereinafter, an operation example according to the embodiment will be described. Hereinafter, the information output from the information processing apparatus 10 will be mainly described. In order to facilitate the understanding of the information output from the information processing apparatus 10, the display mode displayed by the information output from the information processing apparatus 10 will be described.

[0047] (Operation example 1) In operation example 1, the display mode 300 of the question and the auxiliary information will be described. The display mode 300 may be a mode displayed on the first terminal 40 (service provider). In operation example 1, a case where the question is a question regarding security and is a question regarding the acquisition status of authentication regarding the service will be exemplified.

[0048] As shown in FIG. 3, the display mode 300 includes an answer area 310 (answer area 310A in FIG. 3), an auxiliary information area 320 (auxiliary information area 320A in FIG. 3), and an icon 331.

[0049] The answer area 310A is an area for inputting a question and an answer to the question. For example, the answer area 310A includes a check box 311, a description field 312, a condition setting item 313, and the like.

[0050] The check box 311 is an interface for answering security-related questions and is a box for inputting whether or not service-related authentication has been obtained. The description field 312 is a field for inputting information regarding the obtained authentication (for example, registration number, expiration date, scope, etc.). The condition setting item 313 is an item for inputting conditions for narrowing down the questions displayed in the answer area 310A. For example, the condition setting item 313 may be a check box for inputting whether to narrow down to only unanswered or unaddressed questions.

[0051] The auxiliary information area 320A is an area where auxiliary information associated with the questions is displayed. As described above, the auxiliary information is generated based on public information. Here, the auxiliary information may be generated based on information posted on a website collected based on URL information, or may be generated based on the collected authentication information. For example, the auxiliary information may include the acquisition status (acquired or not acquired) of service-related authentication. The auxiliary information may also include information regarding the authentication obtained for the service (for example, registration number, expiration date).

[0052] Here, the above-described storage unit 13 may store public information associated with the questions. The above-described storage unit 13 may store the auxiliary information generated from the associated public information in association with the questions associated with the public information. The above-described control unit 14 may output the auxiliary information associated with the questions.

[0053] The icon 331 may be an icon for switching the display / non-display of the auxiliary information (auxiliary information area 320A). For example, when the auxiliary information area 320A is not displayed, the auxiliary information area 320A may be displayed in response to the selection (pressing) of the icon 331. When the auxiliary information area 320A is displayed, the auxiliary information area 320A may be switched to non-display in response to the selection (pressing) of the icon 331.

[0054] (Operation Example 2) In Operation Example 2, the display mode 300 of the question and auxiliary information will be described. The display mode 300 may be a mode displayed on the first terminal 40 (service provider). In Operation Example 2, a case where the question is a question regarding the service contract or regulations will be exemplified.

[0055] As shown in FIG. 4, the display mode 300 includes an answer area 310 (answer area 310B in FIG. 4), an auxiliary information area 320 (auxiliary information area 320B in FIG. 4), and an icon 331.

[0056] The answer area 310B is an area for inputting the question and the answer to the question. The question may be in a form that can be answered with options (yes / no in FIG. 4) indicating whether it corresponds to the question. The options may include an option (non - public in FIG. 4) indicating that the answer to the question is non - public, cannot be answered, or cannot be disclosed to the service user. The answer area 310B may include information (the background color of the character string "answered" in FIG. 4) indicating whether the options have been answered. That is, the background color of the character string "answered" changes and is displayed differently when the question is unanswered and when it has been answered.

[0057] The auxiliary information area 320B is an area where the auxiliary information associated with the question is displayed. As described above, the auxiliary information is generated based on public information (for example, information collected based on URL information). For example, the auxiliary information may include information collected by scraping or crawling as information related to the question (automatically collected information in FIG. 4). The auxiliary information may include information that supplements the collected information, for example, information explaining the reason for the collected information displayed as "automatically collected information" (the above reason in FIG. 4).

[0058] Similar to Operation Example 1, the icon 331 may be an icon for switching the display / non - display of the auxiliary information (auxiliary information area 320B).

[0059] (Operation Example 3) In Operation Example 3, a modification example with respect to Operation Example 1 will be described. In Operation Example 3, the information processing apparatus 10 generates candidates for answers to questions as auxiliary information based on public information. In the following, the differences with respect to Operation Example 1 will be mainly described.

[0060] As shown in FIG. 5, the auxiliary information area 320C includes candidates for answers to questions. The candidates for answers to questions may be displayed in the same format as the answer format of the questions in the answer area 310A.

[0061] In Operation Example 3, the information processing apparatus 10 may input public information into the artificial intelligence and instruct the artificial intelligence to output candidates for answers to questions in the same format as the answers to the questions, and obtain the candidates for answers to questions from the artificial intelligence. For example, the information processing apparatus 10 inputs a question to the artificial intelligence and issues an instruction to create and output candidates for answers to the question based on the collected public information by means of a prompt. Also, at that time, the format of the answer to the question may be inserted into the prompt as a sample, and the artificial intelligence may be instructed to output candidates for answers in the same format. Further, the artificial intelligence may have a learning model that takes the public information as input and outputs an answer to the question. For example, as shown in FIG. 5, the artificial intelligence may create and output candidates for answers regarding the acquisition status of authentication related to the service based on the public information. Specifically, the artificial intelligence may select check boxes corresponding to the authentication acquired by the service based on the public information, create candidates for answers, and output them.

[0062] In Operation Example 3, the above-described storage unit 13 may store the candidates for answers obtained from the artificial intelligence in association with the questions and the answers to the questions. The candidates for answers may be associated with the questions at the time of acquisition of the candidates for answers.

[0063] In Operation Example 3, the display mode 300 may include an icon 321 for reflecting the answer candidates included in the auxiliary information area 320C (in FIG. 5, this proposal is reflected in the answer). The information processing apparatus 10 reflects the answer candidates included in the auxiliary information area 320C in the answer area 310A in response to the selection (press) of the icon 321.

[0064] In such a case, the information processing apparatus 10 may reflect the answer candidates in the answer area 310A with the following options.

[0065] In Option 1, the information processing apparatus 10 may overwrite all of the answers (answers input by the service provider) in the answer area 310A with the answer candidates included in the auxiliary information area 320C. For example, in the state shown in FIG. 5, an answer indicating that ISO / IEC 27001 and SOC2 have been acquired has been input by the service provider, but in response to the selection (press) of the icon 321, after the check for SOC2 is removed, information (registration number, expiration date, scope, etc.) may be added to the description field 312 regarding ISO / IEC 27001.

[0066] In Option 2, the information processing apparatus 10 may overwrite a part of the answers (answers input by the service provider) in the answer area 310A with the answer candidates included in the auxiliary information area 320C. Specifically, when there is a question for which the service provider has not entered an answer, the information processing apparatus 10 may reflect the auxiliary information corresponding to the question as an answer to the question. For example, in the state shown in FIG. 5, an answer indicating that ISO / IEC 27001 and SOC2 have been acquired has been input by the service provider, but in response to the selection (press) of the icon 321, the check for SOC2 remains as it is, and information (registration number, expiration date, scope, etc.) may be added to the description field 312 regarding ISO / IEC 27001.

[0067] In Operation Example 3, the service provider may be able to select which of Option 1 and Option 2 is used to reflect the answer candidates.

[0068] (Operation Example 4) In Operation Example 4, a modification example with respect to Operation Example 2 will be described. In Operation Example 4, the information processing apparatus 10 generates, based on public information, candidates for answers to questions as auxiliary information. In the following, the differences with respect to Operation Example 2 will mainly be described.

[0069] As shown in FIG. 6, the auxiliary information area 320D includes candidates for answers to questions. The candidates for answers to questions may be displayed in the same format as the answer format of the questions in the answer area 310B.

[0070] In Operation Example 4, the information processing apparatus 10 may input public information into the artificial intelligence, and instruct the artificial intelligence to output candidates for answers to questions in the same format as the answers to questions, and obtain the candidates for answers to questions from the artificial intelligence.

[0071] In Operation Example 4, similar to Operation Example 3, the display mode 300 may include an icon 321 (in FIG. 6, this proposal is reflected in the answer) for reflecting the candidates for answers included in the auxiliary information area 320D. The information processing apparatus 10 reflects the candidates for answers included in the auxiliary information area 320D in the answer area 310B in response to the selection (pressing) of the icon 321. For example, information may be added to the description field 312 regarding question #M-1.

[0072] In Operation Example 4, the above-described storage unit 13 may store the candidates for answers obtained from the artificial intelligence in association with the questions and the answers to the questions. The candidates for answers may be associated with the questions at the time of obtaining the candidates for answers.

[0073] Although not particularly limited, in Operation Example 4, the candidates for answers may be reflected according to Option 2 described in Operation Example 3.

[0074] (Operation Example 5) In Operation Example 5, a modification example with respect to Operation Example 3 will be described. In Operation Example 5, the information processing apparatus 10 may determine whether the answer to the acquired question (the answer input by the service provider) is different from the candidate for the answer to the question. When the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0075] As shown in FIG. 7, the display mode 300 may include a warning 315 (in FIG. 7, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the candidate for the answer to the question. For example, as shown in FIG. 7, when it is answered that SOC2 has been acquired by the service provider, but the candidate for the answer based on the public information indicates that SOC2 has not been acquired, the warning 315 may be output.

[0076] In Operation Example 5, the question is a question regarding the acquisition status of authentication related to the service. The information processing apparatus 10 may generate a candidate for the answer to the question as a selection-type answer selected from among options indicating authentication. The information processing apparatus 10 may determine whether the answer to the question is different from the candidate for the answer to the question by determining whether the selected option is different between the answer to the question and the candidate for the answer to the question. That is, it may be determined whether the answer to the question is different from the candidate for the answer to the question by determining whether the option selected in the answer to the question input by the service provider matches the option selected in the generated candidate for the answer.

[0077] In Operation Example 5, Operation Example 3 is assumed as a premise, but Operation Example 1 may also be assumed as a premise. That is, when the answer to the acquired question (the answer input by the service provider) is different from the answer candidate, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. The answer candidate is identified based on public information, and may be implicitly included in the auxiliary information without being explicitly included in the auxiliary information, or may not be included in the auxiliary information. The answer candidate may be output and acquired using artificial intelligence in the same manner as in Operation Example 3.

[0078] (Operation Example 6) In Operation Example 6, a modification example with respect to Operation Example 4 will be described. In Operation Example 6, the information processing apparatus 10 may determine whether the answer to the acquired question (the answer input by the service provider) is different from the answer candidate for the question. When the answer to the question is different from the answer candidate for the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0079] As shown in FIG. 8, the display mode 300 may include a warning 315 (in FIG. 8, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the answer candidate for the question. For example, as shown in FIG. 8, when the service provider has answered that it does not correspond to the question (no), but the answer candidate based on public information corresponds to the question (yes), the warning 315 may be output.

[0080] In Operation Example 6, Operation Example 4 is assumed, but Operation Example 2 may also be assumed. That is, when the answer to the acquired question (the answer input by the service provider) is different from the answer candidate, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. The answer candidate is identified based on public information, and may be implicitly included in the auxiliary information without being explicitly included in the auxiliary information, or may not be included in the auxiliary information. The answer candidate may be obtained using artificial intelligence as in Operation Example 4.

[0081] (Operation Example 7) In Operation Example 7, the display mode 400 of the answer and the auxiliary information acquired from the service provider will be described. The display mode 400 may be a mode displayed on the second terminal 50 (service user). In Operation Example 7, a case where the question is a question regarding the acquisition status of authentication related to the service will be exemplified.

[0082] As shown in FIG. 9, the display mode 400 includes a first condition setting item 410, a second condition setting item 420, an answer area 430, and an auxiliary information area 440.

[0083] The first condition setting item 410 is an item for inputting conditions for narrowing down the questions displayed in the answer area 430. For example, in the first condition setting item 410, conditions for narrowing down questions by conditions such as the answer status (unresolved, unpublished, conditional) may be selectable.

[0084] The second condition setting item 420 is an item for inputting conditions for narrowing down the questions displayed in the answer area 430. For example, in the second condition setting item 420, conditions for narrowing down questions by conditions such as the level of importance (high, medium, low) may be selectable.

[0085] The answer area 430 is an area for displaying questions and answers to the questions. The answer is an answer to the question acquired from the service provider, and may be an answer input or reflected according to at least any one of the above-described Operation Examples 1 to 6.

[0086] The auxiliary information area 440 is an area where auxiliary information associated with a question is displayed. As described above, the auxiliary information is generated based on public information (here, authentication information). The auxiliary information included in the auxiliary information area 440 may be the same as the auxiliary information included in the auxiliary information area 320A described in Operation Example 1, or may be the same as the auxiliary information included in the auxiliary information area 320C described in Operation Example 3.

[0087] (Operation Example 8) In Operation Example 8, the display mode 400 of the answer and auxiliary information obtained from the service provider will be described. The display mode 400 may be a mode displayed on the second terminal 50 (service user). In Operation Example 8, a case where the question is a question regarding the service contract or regulations will be exemplified.

[0088] As shown in FIG. 10, similar to Operation Example 7, the display mode 400 includes a first condition setting item 410, a second condition setting item 420, an answer area 430, and an auxiliary information area 440. Since the first condition setting item 410, the second condition setting item 420, the answer area 430, and the auxiliary information area 440 are the same as those in Operation Example 7, the details thereof will be omitted. Note that the auxiliary information included in the auxiliary information area 440 may be the same as the auxiliary information included in the auxiliary information area 320B described in Operation Example 2, or may be the same as the auxiliary information included in the auxiliary information area 320D described in Operation Example 4. That is, the auxiliary information included in the auxiliary information area 440 may be obtained by inputting public information into an artificial intelligence and instructing the artificial intelligence to output candidates for answers to the question in the same format as the answer to the question, and may be candidates for answers obtained from the artificial intelligence.

[0089] In Operation Example 8, the display mode 400 may further include a question background area 450. The question background area 450 may include information indicating the background in which the question is set from the perspective of service security. The information indicating the background may be stored in the storage unit 13 in advance in association with the question presented to the service provider.

[0090] (Operation Example 9) In Operation Example 9, a modification example with respect to Operation Example 7 will be described. In Operation Example 9, the information processing apparatus 10 may determine whether an answer to the acquired question (an answer input by the service provider) is different from a candidate for the answer to the question. When the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question.

[0091] As shown in FIG. 11, the display mode 400 may include a warning 431 (in FIG. 11, it seems to be different from the automatically collected information) prompting the service provider to confirm the answer to the question when the answer to the question is different from the candidate for the answer to the question. For example, as shown in FIG. 11, when it is answered that SOC2 has been acquired by the service provider, but in the candidate for the answer based on the public information, SOC2 has not been acquired, the warning 431 may be output.

[0092] In Operation Example 9, the candidate for the answer is identified based on the public information, and may be explicitly included in the auxiliary information, may be implicitly included in the auxiliary information, or may not be included in the auxiliary information. The candidate for the answer may be obtained using artificial intelligence in the same manner as in Operation Example 4.

[0093] In Operation Example 9, a case assuming Operation Example 7 has been exemplified, but Operation Example 9 may be applied to Operation Example 8.

[0094] (Operation Example 10) In Operation Example 10, a modification example with respect to Operation Example 9 will be described. In Operation Example 10, when the answer to the question is different from the candidate for the answer to the question, the information processing apparatus 10 outputs information regarding the difference between the answer to the question and the candidate for the answer to the question (hereinafter, difference information) to the service user.

[0095] As shown in FIG. 12, the display mode 400 may include difference information 460. The difference information 460 may be displayed in a pop-up format. The difference information 460 may include information that can compare the difference between the answer to a question (in FIG. 12, the provider's answer) and the answer candidate (in FIG. 12, the automatically collected information).

[0096] Furthermore, the difference between the answer to a question and the answer candidate (SOC2 in FIG. 12) may be displayed in a manner that is emphasized with respect to other information. The emphasis of the difference may include an emphasis where the color of the difference character string is different from others, an emphasis where the background color of the difference character string is different from others, or an emphasis where the font type or size of the difference character string is different from others. The emphasis of the difference may be performed on the answer to the question (in FIG. 12, the provider's answer), on the answer candidate (in FIG. 12, the automatically collected information), or on both the answer to the question and the answer candidate.

[0097] In Operation Example 10, it was described as a modified example of Operation Example 9 based on Operation Example 7, but Operation Example 10 may also be applied to Operation Example 9 based on Operation Example 8.

[0098] (Artificial Intelligence) In the following, the details of the artificial intelligence described in Operation Example 2, Operation Example 3, etc. will be described. The artificial intelligence unit constituting the artificial intelligence may be built in the information processing apparatus 10 (for example, the control unit 14), or may be provided outside the information processing apparatus 10.

[0099] The answer generation model included in the artificial intelligence unit is a learning model that is learned to input public information and output answer candidates. That is, the answer generation model is a learning model that learns public information and the corresponding answer candidates as teacher data.

[0100] The answer generation model may be generative AI including a large language model. In this case, the control unit 14 inputs public information into the answer generation model, inputs a prompt including an answer generation instruction into the answer generation model, and causes the answer generation model to output answer candidates. Further, the control unit 14 may input, for example, a prompt in which one or more samples of public information and one or more samples of corresponding answer candidates are inserted into the answer generation model.

[0101] The artificial intelligence unit is configured to receive an input from each functional unit and return an instructed output. Note that the artificial intelligence used by the server device in each functional unit may be common or may be individually prepared for each functional unit.

[0102] The artificial intelligence unit is an AI (Artificial Intelligence) including a language model such as a Transformer (including GPT (Generative Pretrained Transformer, GPT-1, GPT-2, GPT-3), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer)), a Recurrent Neural Network (RNN), etc., and may include generative AI.

[0103] The language model is an example of a learning model by a machine learning algorithm. Specific algorithms for machine learning include the nearest neighbor method, the naive Bayes method, decision trees, support vector machines, deep learning (deep neural networks) using neural networks, etc. The artificial intelligence unit can appropriately apply the above algorithms.

[0104] The artificial intelligence unit may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or semi-supervised learning. In supervised learning, machine learning is performed using teacher data (learning data). The teacher data is composed of a pair of input data for learning and output data (correct data). Also, the language model may be a general-purpose model that can be used generally for a wide range of tasks, not just trained for a specific task.

[0105] The learning model included in the artificial intelligence unit can perform additional learning. For example, the artificial intelligence unit learns whether the proposed answer candidate has been reflected in the answer by the user. That is, the artificial intelligence unit performs additional learning and fine-tuning using a teacher data set labeled with the actual reflection result as feedback on the answer candidate created and presented by the learning model. As a result, the correction content output from the learning model is optimized and presented to the user.

[0106] The artificial intelligence unit may be a general-purpose natural language processing learning model such as a large language model (LLM) that has learned a large amount of data as artificial intelligence. Such general-purpose learning models include language models that can handle various tasks without fine-tuning by methods such as one-shot learning and few-shot learning. Also, the general-purpose learning model may be configured to be able to handle various tasks by zero-shot learning. The artificial intelligence used in each functional unit of the control unit may be a separate learning model or a common general-purpose learning model.

[0107] In the embodiment, although the server device performs various storage and control, a plurality of external devices may be used instead of the server device. That is, various information and programs may be distributed and stored in a plurality of external devices using blockchain technology or the like. In particular, the artificial intelligence unit may be an external configuration of the server device. In that case, the artificial intelligence unit, which is an external configuration, is configured to receive an input from each functional unit of the server device and return an instructed output to the server device.

[0108] (Information Processing Method) Hereinafter, the information processing method according to the embodiment will be described. FIG. 13 is a diagram showing the information processing method according to the embodiment.

[0109] As shown in FIG. 13, in step S10, the information processing apparatus 10 collects public information. As described above, the public information may include at least any one of information posted on a website related to the service, information related to service authentication, and information related to the system used for service provision.

[0110] In step S20, the information processing apparatus 10 transmits a question to the first terminal 40. The information processing apparatus 10 transmits, together with the question, auxiliary information associated with the question to the first terminal 40.

[0111] In step S21, the first terminal 40 displays the information in display mode A based on the information received from the information processing apparatus 10. Display mode A is the display mode illustrated in operation examples 1 to 6 (FIGS. 3 to 8).

[0112] In step S22, the information processing apparatus 10 receives, from the first terminal 40, an answer input or reflected by the service provider.

[0113] In step S23, the information processing apparatus 10 stores the answer input or reflected by the service provider.

[0114] In step S30, the information processing apparatus 10 transmits the answer result to the second terminal 50. The answer result includes the answer input or reflected by the service provider. The information processing apparatus 10 transmits the auxiliary information associated with the question to the second terminal 50 together with the answer result.

[0115] In step S31, the second terminal 50 displays the information in the display mode B based on the information received from the information processing apparatus 10. The display mode B is the display mode exemplified in operation examples 7 to 10 (FIGS. 9 to 12).

[0116] (Function and Effect) In the embodiment, the information processing apparatus 10 outputs the auxiliary information associated with the question to the service provider (the first terminal 40) together with the question. According to such a configuration, the service provider can answer the question while referring to the auxiliary information, so that the labor of the service provider for inputting the answer can be reduced, or an accurate answer can be supported.

[0117] In the embodiment, the information processing apparatus 10 may generate a candidate for an answer to the question as auxiliary information based on the public information. According to such a configuration, it becomes easy for the service provider to input an answer.

[0118] In the embodiment, the information processing apparatus 10 may reflect the auxiliary information corresponding to the question for which no answer has been input by the service provider as the answer to the question. According to such a configuration, the labor of the service provider for inputting the answer can be further reduced.

[0119] In the embodiment, when the answer to the recorded question is different from the candidate for the answer to the question, the information processing apparatus 10 may output a warning prompting the service provider to confirm the answer to the question. According to such a configuration, it is possible to suppress an input error or omission of the answer by the service provider.

[0120] In an embodiment, the information processing apparatus 10 may output, to a service user (the second terminal 50), auxiliary information associated with a question together with an answer to the question obtained from a service provider. According to such a configuration, the service user can easily determine the validity of the answer by the service provider by referring to the auxiliary information.

[0121] In an embodiment, when the answer to a question is different from a candidate for the answer to the question, the information processing apparatus 10 may output, to the user of the service, information regarding the difference between the answer to the question and the candidate for the answer to the question. The service user can easily determine whether the answer by the service provider is correct by referring to the information regarding the difference.

[0122] [Modification Example 1] Hereinafter, Modification Example 1 of the embodiment will be described. Hereinafter, the differences from the embodiment will be mainly described.

[0123] In Modification Example 1, the information processing apparatus 10 may classify information obtained from public information (hereinafter, service-related information) into categories related to the service.

[0124] The categories include at least any one of a category related to service agreement changes (hereinafter, agreement changes), a category related to service function changes (hereinafter, function changes), a category related to service failures (hereinafter, failure information), a category related to service incidents (hereinafter, incidents), and a category related to service operations (hereinafter, operation information).

[0125] The process of classifying service-related information into categories may include the following processes. The collection destination URLs and APIs for each category may be specified for each service and stored in the storage unit 13 described above in association with the service. For one category, a plurality of URLs and APIs may be specified. For example, for the category of service agreement changes of a certain service, the URL of the terms of use and the URL of the privacy policy may be specified and stored in the storage unit 13 described above in association with a certain service. The control unit 14 collects information through the specified URLs and APIs, and when there is an update or addition of information, the updated or added information is displayed in the column of the category associated with the URL or API.

[0126] Although not particularly limited, the service-related information may include information other than the information obtained from public information. Such information may be obtained from information that has not been made public to a third party (for example, information that is privately managed by a service user or a service provider). The privately managed information may include the name of the user (individual, department, etc.) of the service managed by the service user or the service provider, the purpose of the service managed by the service user or the service provider, the usage status of the services prohibited for the service user, the investigation status of the service, and the like.

[0127] The information processing apparatus 10 may output service-related information. For example, the information processing apparatus 10 may transmit the service-related information to the second terminal 50 (for example, the terminal used by the service user). Note that the information processing apparatus 10 may transmit the service-related information to the first terminal 40 (service provider).

[0128] Here, when outputting the service-related information, the information processing apparatus 10 may output the information classified into categories in different modes according to the categories. In the following, in order to facilitate the understanding of the information output from the information processing apparatus 10, the display modes displayed by the information output from the information processing apparatus 10 will be described.

[0129] As shown in FIG. 14, the display mode 500 of service-related information includes a usage summary column 510 and a news column 520.

[0130] The usage summary column 510 includes the department using the service (in FIG. 14, the using department), the purpose of using the service (in FIG. 14, the usage purpose), etc. The usage summary column 510 may include information permitted to be used in the service by the service user (for example, customer information such as company information, person-in-charge information, sales information, etc.), may include the magnitude of the impact associated with the suspension of the service, and may include the emergency contact regarding the service.

[0131] The news column 520 includes information classified into categories in different modes according to the categories. Here, the different modes may include modes where the colors of the character strings indicating the categories (in FIG. 14, model change, failure information, incident, operation information, regulation change) are different, modes where the background colors of the character strings indicating the categories are different, and modes where the font types or sizes of the character strings indicating the categories are different.

[0132] Under such a premise, the information processing apparatus 10 may output information classified into the category regarding the change of the service regulations in a mode capable of comparing the acquired changed information with the previously acquired unchanged information.

[0133] As shown in FIG. 15, the news column 520 of the display mode 500 may include a difference comparison column 521. The difference comparison column 521 includes the changed information (in FIG. 15, After ···) and the unchanged information (in FIG. 15, Before ···) arranged side by side. Here, the changed information and the unchanged information may be displayed in a mode where the changed parts are emphasized. The emphasis of the changed parts may include emphasis where the color of the character string of the changed part is different from others, emphasis where the background color of the character string of the changed part is different from others, and emphasis where the font type or size of the character string of the changed part is different from others.

[0134] In Modification Example 1, the transmission unit 11 constitutes a third output unit that outputs the information classified into categories in different modes according to the categories. The transmission unit 11 constitutes a third output unit that outputs the acquired changed information and the previously acquired unchanged information in a comparable mode for the information classified into the category related to the service agreement change. The transmission unit 11 may constitute the third output unit together with the control unit 14. Thereby, when there is a change in the service agreement, the change content can be easily grasped. Note that the agreement may include, in addition to the service use agreement, the service privacy policy, the service security policy, the service Cookie policy, etc., and may include a plurality of agreements and policies.

[0135] For categories other than the category related to the service agreement change (for example, failure information, etc.), the transmission unit 11 may output URL information corresponding to the public information in which the information (for example, failure information) is posted. The display mode 500 may include the URL information in association with a category (for example, failure information).

[0136] The control unit 14 may input the information posted in the public information into the artificial intelligence and output the summary text of the information to the artificial intelligence. For example, the control unit 14 may input the failure information into the artificial intelligence and output the summary text of the failure information to the artificial intelligence. The display mode 500 may include the summary text output (acquired) from the artificial intelligence. In such a case, the artificial intelligence may include a learning model that takes the public information and the corresponding URL information as inputs and outputs the summary text of the posted information. According to such a configuration, when there is failure information or the like of a cloud service or the like used by the service user, the service user can easily access the website on which the failure information or the like is posted, and can easily grasp the content of the failure by the output of the summary text. In particular, it is particularly effective when a security-important event such as a failure or an incident occurs.

[0137] Although not particularly mentioned in Modification Example 1, the information processing apparatus 10 may output the usage status of the NG service, the investigation status of the service, etc.

[0138] The NG service may be a service that restricts or prohibits use by users in the organization. The storage unit 13 may store information on the NG service. The restriction may be considered to include prohibition. The information on the NG service may include at least information for identifying the service (for example, the name of the service). The NG service is a service whose use by users is restricted or prohibited based on security concerns or the like, and the list of information on the NG service may be referred to as a blacklist. When the service user is an organization, the information processing apparatus 10 may acquire the access history of the services used by the users belonging to the organization, and when access to the NG service is detected, output information on the NG service (such as the name of the service) for which the access has been detected.

[0139] The investigation status of the service may be the status of a process of collecting responses to security-related questions from the service provider (investigation regarding the security of the service). For example, the investigation status of the service may include statuses such as "request sent" (requesting a security investigation from the service provider), "confirmation by the other party" (confirming whether the service provider will receive the investigation), "response" (reviewing the response from the service provider), and "completed" (the investigation is completed). In the example shown in FIG. 14 or FIG. 15, the status of the security investigation regarding Service A may be included in the display mode 500. The investigation status may be input by the person in charge of the investigation (for example, an entity that substitutes for security investigation and collection of responses to questions) via the user interface and stored in the information processing apparatus 10.

[0140] (Information Processing Method) Hereinafter, the information processing method according to Modification Example 1 will be described. FIG. 16 is a diagram showing the information processing method according to Modification Example 1.

[0141] As shown in FIG. 16, in step S40, the information processing apparatus 10 collects public information. As described above, the public information may include at least any one of information posted on a website related to the service, information related to service authentication, and information related to the system used for service provision.

[0142] In step S41, the information processing apparatus 10 acquires service-related information from the public information. The information processing apparatus 10 classifies the service-related information into categories.

[0143] In step S42, the information processing apparatus 10 transmits the classification result to the second terminal 50. The classification result includes the information classified into categories.

[0144] In step S43, the second terminal 50 displays the information in the display mode C based on the information received from the information processing apparatus 10. The display mode C is the display mode exemplified in FIGS. 14 to 15 described above.

[0145] In FIG. 15, the case where the classification result is transmitted to the second terminal 50 (for example, a service user) is exemplified, but the classification result may be transmitted to the first terminal 40 (service provider).

[0146] (Function and Effect) In Modification Example 1, the information processing apparatus 10 may classify the information (service-related information) acquired from the public information into categories. According to such a configuration, the information acquired from the public information can be appropriately managed.

[0147] In Modification Example 1, the information processing apparatus 10 may output the information classified into categories in different modes according to the categories. According to such a configuration, users such as service users can easily grasp the service-related information based on the information classified into categories.

[0148] In Modification Example 1, the information processing apparatus 10 may present information classified into categories related to service contract changes in a manner that allows comparison between the acquired changed information and the previously acquired unchanged information. According to such a configuration, a user such as a service user can easily compare the information before and after the service contract change regarding the service contract change.

[0149] [Other Embodiments] Although the present invention has been described with reference to the above-described embodiments, the discussions and drawings forming a part of this disclosure should not be construed as limiting the present invention. Various alternative embodiments, examples, and operation techniques will be apparent to those skilled in the art from this disclosure.

[0150] In the above-described disclosure, as a method for collecting public information, a case of collecting by scraping or crawling has been described. However, the above-described disclosure is not limited to this. The public information may be manually input by an operator. In such a case, the collection unit may include an interface used by the operator for information input.

[0151] In the above-described disclosure, an example has been given of a case where the display control of the display mode is executed by the information processing apparatus 10. However, the above-described disclosure is not limited to this. For example, the display control of Display Mode A or Display Mode C may be executed by an application on the first terminal 40, and the display control of Display Control B or Display Mode C may be executed by an application on the second terminal 50.

[0152] Although not particularly mentioned in the above-described disclosure, the display may include a display in physical reality, a display in augmented reality such as AR (Artificial Reality), a display in virtual reality such as VR (Virtual Reality), or a display in a virtual space such as a metaverse.

[0153] Although not particularly mentioned in the above disclosure, the information processing apparatus 10 may have a display unit that displays at least one of the above-described display modes A, B, and C. The display unit may be configured by a display such as a liquid crystal panel, an organic EL panel, or an LED.

[0154] Although not particularly mentioned in the above disclosure, a program may be provided that causes a computer to execute each process performed by the information processing apparatus 10, the first terminal 40, and the second terminal 50. Further, the program may be recorded on a computer-readable medium. By using a computer-readable medium, it is possible to install the program on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transitory recording medium. The non-transitory recording medium is not particularly limited, and may be, for example, a recording medium such as a CD-ROM or a DVD-ROM.

[0155] Alternatively, a chip may be provided that includes a memory that stores a program for executing each process performed by the information processing apparatus 10, the first terminal 40, and the second terminal 50, and a processor that executes the program stored in the memory.

[0156] [Appendix] The above disclosure may be expressed as follows.

[0157] A first feature is an information processing apparatus that includes: a first output unit that outputs a question regarding the security of the service to a provider of the service; a collection unit that collects public information regarding the service that has been made public to a third party; and a control unit that generates auxiliary information regarding an answer to the question in association with the question based on the collected public information, and the first output unit outputs the auxiliary information associated with the question together with the question to the provider of the service.

[0158] The second feature is that, in the first feature, the control unit is an information processing apparatus that generates candidates for answers to the questions as the auxiliary information based on the public information.

[0159] The third feature is that, in the second feature, the control unit inputs the public information into an artificial intelligence and instructs the artificial intelligence to output candidates for answers to the questions in the same format as the answers to the questions, and acquires the candidates for answers to the questions from the artificial intelligence. The information processing apparatus is as described above.

[0160] The fourth feature is that, in the second or third feature, an acquisition unit that acquires the answers to the questions input by the provider of the service is provided, and the control unit reflects the auxiliary information corresponding to the questions for which no answer has been input by the provider of the service as the answers to the questions. The information processing apparatus is as described above.

[0161] The fifth feature is that, in at least any one of the second to fourth features, an acquisition unit that acquires the answers to the questions input by the provider of the service is provided, the control unit determines whether the acquired answers to the questions are different from the candidates for answers to the questions, and when the answers to the questions are different from the candidates for answers to the questions, the first output unit outputs a warning prompting the provider of the service to confirm the answers to the questions. The information processing apparatus is as described above.

[0162] The sixth feature is that, in the fifth feature, the questions include questions regarding the acquisition status of authentication related to the service, the answers to the questions include selection-type answers that select the authentication acquired for the service from among the options indicating the authentication, the control unit generates candidates for answers to the questions as selection-type answers that select from among the options indicating the authentication, and determines whether the answers to the questions are different from the candidates for answers to the questions by determining whether the selected options are different between the answers to the questions and the candidates for answers to the questions. The information processing apparatus is as described above.

[0163] The seventh feature is that in at least any one of the first to sixth features, it includes a second output unit that outputs, to the user of the service, the answer to the question obtained from the service provider, and the second output unit outputs, to the user of the service, the auxiliary information associated with the question together with the answer to the question obtained from the service provider. It is an information processing apparatus.

[0164] The eighth feature is that in the seventh feature, the control unit determines whether the answer to the question obtained from the service provider is different from the candidate for the answer to the question, and when the answer to the question is different from the candidate for the answer to the question, the second output unit outputs, to the user of the service, information regarding the difference between the answer to the question and the candidate for the answer to the question. It is an information processing apparatus.

[0165] The ninth feature is that in at least any one of the first to eighth features, the public information includes at least any one of information posted on a website related to the service, information related to the authentication of the service, and information related to the system used for providing the service. It is an information processing apparatus.

[0166] The tenth feature is that in at least any one of the first to ninth features, the control unit classifies the information obtained from the public information into categories related to the service. It is an information processing apparatus.

[0167] The eleventh feature is that in the tenth feature, the category includes at least any one of a category related to the change of the service regulations, a category related to the change of the service functions, a category related to the service failures, a category related to the service incidents, and a category related to the operation of the service. It is an information processing apparatus.

[0168] The 12th feature is an information processing apparatus including, in the 10th feature or the 11th feature, a third output unit that outputs the information classified into the category in different manners according to the category.

[0169] The 13th feature is an information processing apparatus including, in the 11th feature or the 12th feature that cites the 11th feature, a third output unit that outputs, in a manner capable of comparing the acquired information after the change and the information before the change acquired in the past, the information classified into the category related to the service contract change.

[0170] The 14th feature is an information processing method including: step A of outputting, to a service provider, a question regarding the security of the service; step B of collecting public information regarding the service made public to a third party; and step C of generating, based on the collected public information made public to the third party, auxiliary information regarding an answer to the question in association with the question, wherein step A includes a step of outputting, to the service provider, the auxiliary information associated with the question together with the question.

Explanation of Signs

[0171] 10…Information processing apparatus, 11…Transmission unit, 12…Receiving unit, 13…Storage unit, 14…Control unit, 30…Providing server, 40…First terminal, 50…Second terminal, 100…Information processing system, 200…Network

Claims

1. a first output unit that outputs a question about the security of the service to a service provider; A collection unit that collects public information regarding the service that is made public to a third party; a control unit that generates auxiliary information regarding an answer to the question based on the collected public information and associates the auxiliary information with the question; The first output unit outputs the auxiliary information associated with the question together with the question to a provider of the service.

2. The information processing device according to claim 1 , wherein the control unit generates answer candidates to the question as the auxiliary information based on the public information.

3. The information processing device according to claim 2 , wherein the control unit inputs the public information into an artificial intelligence and instructs the artificial intelligence to output candidate answers to the question in a format similar to the answer to the question, and obtains candidate answers to the question from the artificial intelligence.

4. an acquisition unit that acquires an answer to the question input by the service provider, The information processing device according to claim 2 , wherein the control unit reflects the auxiliary information corresponding to the question to which an answer has not been input by the service provider as an answer to the question.

5. an acquisition unit that acquires an answer to the question input by the service provider, The control unit determines whether or not the acquired answer to the question is different from a candidate answer to the question; The information processing device according to claim 2 , wherein the first output unit outputs a warning to the service provider to prompt the provider to confirm the answer to the question when the answer to the question differs from a candidate answer to the question.

6. The questions include questions about the status of certification for the service, the answer to the question includes a multiple-choice answer for selecting the authentication obtained for the service from among options indicating the authentication; 6. The information processing device of claim 5, wherein the control unit generates candidate answers to the question as multiple-choice answers to be selected from options indicating the authentication, and determines whether the answer to the question differs from the candidate answers to the question by determining whether the selected options differ between the answer to the question and the candidate answers to the question.

7. a second output unit that outputs an answer to the question acquired from the service provider to the service user; The information processing device according to claim 1 , wherein the second output unit outputs, to a user of the service, the auxiliary information associated with the question together with an answer to the question acquired from a provider of the service.

8. the control unit determines whether an answer to the question acquired from the service provider is different from a candidate answer to the question; 8. The information processing device according to claim 7, wherein, when the answer to the question differs from the candidate answers to the question, the second output unit outputs, to a user of the service, information regarding a difference between the answer to the question and the candidate answers to the question.

9. The information processing device according to claim 1 , wherein the public information includes at least one of information posted on a website related to the service, information related to authentication of the service, and information related to a system used to provide the service.

10. The information processing device according to claim 1 , wherein the control unit classifies the information acquired from the public information into categories related to the service.

11. The information processing device according to claim 10 , wherein the categories include at least one of a category relating to changes in terms of the service, a category relating to changes in functions of the service, a category relating to failures of the service, a category relating to incidents of the service, and a category relating to operation of the service.

12. The information processing device according to claim 10 , further comprising a third output unit configured to output the information classified into the categories in a different manner depending on the category.

13. 12. The information processing device according to claim 11, further comprising a third output unit that outputs, for the information classified into a category relating to changes to terms of the service, the acquired changed information and the previously acquired pre-change information in a manner that allows for comparison.

14. A step A of outputting a question regarding security of the service to a service provider; A step B of collecting public information about the service disclosed to a third party; and a step C of generating auxiliary information regarding an answer to the question based on the collected public information disclosed to the third party in association with the question, The information processing method, wherein the step A includes a step of outputting the auxiliary information associated with the question together with the question to a provider of the service.

Images