Information processing system, information processing method, program, and recording medium

Abstract

To identify when software was used even if the software had a defect in the past.SOLUTION: An information processing system generates, by means of a processing unit, history information indicating a modification history of software component information on the basis of the software component information and history timing information, the software component information relating to one or more software components that constitute predetermined software. The history timing information is information that indicates the timing of one or more time points from the time point when the software component information was generated to the time point when the history information was stored. Additionally, the information processing system further identifies, by means of the processing unit and on the basis of defect information stored in a storage unit and the history information, information indicating at least one of a period in which a component corresponding to the defect information was included or the software component information.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to an information processing system, an information processing method, a program, and a recording medium.

Background Art

[0002] The management device described in Patent Document 1 aims to identify locations in the system where abnormalities may occur. The above-described management device stores configuration information indicating the configuration of each component of the system in order to achieve the above object. The management device identifies a first component in which an abnormality has occurred, and performs an operation of identifying a second component common to the identified first component from the stored configuration information. In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information. In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information. In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information. In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information.

[0003] In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information. In the above-described management device, in relation to the above operation, SBOM (Software Bill Of Materials), which is software configuration information, may include, for example, vulnerability information.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the above-described management device, for example, even if the software had a vulnerability in the past, there was a problem that it was impossible to identify when the software was used. However, in the above-described management device, for example, even if the software had a vulnerability in the past, there was a problem that it was impossible to identify when the software was used. However, in the above-described management device, for example, even if the software had a vulnerability in the past, there was a problem that it was impossible to identify when the software was used.

[0006] An object of the present disclosure is to identify when the software was used even if the software had a vulnerability in the past. An information processing system, an information processing method, a program, and a recording medium that can identify when A was used are provided. [Means for Solving the Problems]

[0007] To solve the above problems, an information processing system according to the present disclosure generates history information indicating a change history of software component information (including SBOM) regarding one or more software components constituting predetermined software based on the software component information and history timing information by a processing unit. The history timing information is information indicating the timing of one or more points in time from the generation time of the software component information to the storage time of the history information. [Advantages of the Invention]

[0008] According to the information processing system according to the present disclosure, even if the software had vulnerabilities in the past, it is possible to identify when the software was used. [Brief Description of the Drawings]

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Figure 23

Figure 24

Figure 25

Figure 26

Figure 27

Figure 28

Figure 29

Figure 30

Figure 31

Figure 32

Figure 33

Modes for Carrying Out the Invention

[0010] Embodiments of the information processing system JSS according to the present disclosure will be described.

[0011] 〈Embodiment 1〉 The information processing system JSS of Embodiment 1 will be described.

[0012] 〈Configuration of Embodiment 1〉 〈Configuration of the Information Processing System JSS〉 FIG. 1 shows the configuration of the information processing system JSS of Embodiment 1.

[0013] As shown in FIG. 1, the information processing system JSS of Embodiment 1 includes terminals TM1 to TMm (m is an integer of 1 or more) and a server SV. The terminals TM1 to TMm and the server S V are interconnected via a network NW (for example, the Internet) as shown in FIG. 1. are interconnected with each other.

[0014] The terminals TM1 to TMm are used by users US1 to USm who develop and use, for example, the software SW to be managed by the server SV. For example, the terminal TM1 is used by the user US1, the terminal TM2 is used by the user US2, and so on, and the terminal TMm is used by the

[0015] user USm. The server SV is used by the administrator KA. As shown in FIG. 1, the server SV stores the software SW and also generates and stores history information RJ having configuration information KJ (particularly, the component information included in the software SW (hereinafter, also referred to as "software component information")) and history timing information (for example, time information JJ). The history timing information is timing information to be stored as history information, and more particularly, is the timing information of one or more points in time from the generation point of the software component information to the storage point of the history information RJ (for example, the information including at least the date, hereinafter, also referred to to as "time information JJ" in the description). More specifically, the history timing information can be, for example, the point in time when

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016]

[0016] <0000Hereinafter, for ease of explanation and understanding, for example, a plurality of identical devices may be collectively referred to by one name. For example, terminals TM1 to TMm may be collectively referred to as terminal TM. For example, terminals TM1 to TMm may be collectively referred to as terminal TM.

[0017] <Configuration of Terminal TM> FIG. 2 shows the configuration of terminal TM according to Embodiment 1.

[0018] As shown in FIG. 2, terminal TM according to Embodiment 1 includes an input / output unit NS(TM), a processing unit SY(TM), a storage unit KI(TM), and a communication unit TU(TM). and a communication unit TU(TM).

[0019] The input / output unit NS(TM) is used for the user US to change, add, delete, etc. components (for example, shown in FIG. 6) that make up the software SW in order to update the software SW, for example. It is also used to output the configuration of the software SW obtained from the server SV. The input / output unit NS(TM) is, for example, a touch panel, keyboard, mouse, liquid crystal monitor, or printer. components (for example, shown in FIG. 6) that make up the software SW in order to update the software SW, for example. It is also used to output the configuration of the software SW obtained from the server SV. The input / output unit NS(TM) is, for example, a touch panel, keyboard, mouse, liquid crystal monitor, or printer. mouse, liquid crystal monitor, or printer.

[0020] The processing unit SY(TM) performs processing related to, for example, the input for updating the above-described software SW and the output of the configuration of the above-described software SW. The processing unit SY(TM) also executes the software SW obtained by the user US as needed by the user US. The processing unit SY(TM) also executes the software SW obtained by the user US as needed by the user US. The processing unit SY(TM) also executes the software SW obtained by the user US as needed by the user US. .

[0021] The storage unit KI(TM) stores, for example, data necessary for the processing of the processing unit SY(TM). .

[0022] The communication unit TU(TM) performs communication via the network NW. For example, it transmits the updated software SW to the server SV and also obtains the software SW managed by the server SV. It transmits the updated software SW to the server SV and also obtains the software SW managed by the server SV. The software SW is received from the server SV.

[0023] <Server SV Configuration> FIG. 3 shows the configuration of the server SV in the first embodiment.

[0024] As shown in FIG. 3, the server SV of the first embodiment includes an input / output unit NS(SV) and a processing unit It has a SY(SV), a storage unit KI(SV), and a communication unit TU(SV).

[0025] The input / output unit NS (SV) is, for example, related to updating the software SW. It is used to output SW history information RJ (for example, as shown in FIG. 1) and also to Used to enter additional information (e.g., bibliographic information) into the RJ. The input / output unit NS(TM) is, for example, a touch panel, a keyboard, a mouse, a liquid crystal display, As mentioned above, the server SV is connected to the logical In the case where the system is configured autonomously (e.g., a cloud server), the terminal TM of the administrator KA is equipped with The input / output unit NS may be substituted.

[0026] The processing unit SY (SV) outputs the above-mentioned history information RJ, inputs the history information RJ, The processing unit SY(SV) also performs processing related to the history information RJ, if necessary. If necessary, it notifies the user US and manages the software SW license.

[0027] The memory unit KI (SV) stores, for example, data necessary for the processing of the processing unit SY (SV). .

[0028] The communication unit TU (SV) performs communication via the network NW, for example, Receives the updated software SW, and the software SW managed by the server SV is transmitted to the terminal TM.

[0029] 〈Operation of Embodiment 1〉 FIG. 4 is a flowchart showing the operation of the information processing system JSS of Embodiment 1.

[0030] FIG. 5 is a time chart showing the operation of the information processing system JSS of Embodiment 1. Regarding the operation of the information processing system JSS of Embodiment 1, with reference to the flowchart of FIG. 4 and FIG. 5 of the time chart will be described.

[0031] Hereinafter, for ease of explanation and understanding, the following is assumed. (1) Among the users US1 to USm, the users US1 to US3 are involved in the development of the software SW (illustrated in FIG. 4). (2) The initial version of the software SW described above includes one or more components (for example, components A, B, C,, W) (illustrated in FIG. 6). (3) Configuration information KJ0 showing the configuration of the initial version of the software SW (illustrated in FIG. 6), and the time t0 (12:34 on February 3, 2023) when the software SW (initial version) was saved The time information JJ0 (illustrated in FIG. 7) indicating is mutually associated with the history information RJ (illustrated in FIG. 18). is stored in the server SV. shown.

[0032] Step ST11 (at time t1): The terminal TM1 transmits the software SW in which "Component Dadd is added" by the user US1, that is, the configuration information KJ1 (illustrated in FIG. 8), to the server SV. SV.

[0033] Step ST12: The server SV receives the software SW in which "Component Dadd is added", That is, when receiving, that is, when acquiring the configuration information KJ1, for example, the information processing system JS acquires time information JJ1 ([shown in FIG. 9.) indicating the time t1 "13:45 on March 4, 2023" from the clock in S . The server SV further updates the history information RJ by associating the configuration information KJ1 and the time information JJ1 with each other (shown in FIG. 19.).

[0034] Step ST13 (at time t2): The terminal TM2 transmits the software SW, that is, the configuration information KJ2 (shown in FIG. 10.), which has been "changed from part T to part Tchg" by the user US2, to the server SV .

[0035] Step ST14: When the server SV receives the software SW, that is, the configuration information KJ2, which has been "changed from part T to part Tchg", it acquires time information JJ2 (shown in FIG. 11.) indicating the time t2 "14:32 on April 5, 2023". The server SV further updates the history information RJ by associating the configuration information KJ2 and the time information JJ2 with each other (shown in FIG. 20.).

[0036] Step ST15 (at time t3): The terminal TM3 transmits the software SW, that is, the configuration information KJ3 (shown in FIG. 12.), which has been "changed from part U to part Uchg" by the user US3, to the server SV .

[0037] Step ST16: When the server SV receives the software SW, that is, the configuration information KJ3, which has been "changed from part U to part Uchg", it acquires time information JJ3 (shown in FIG. 13.) indicating the time t3 "15:21 on May 6, 2023". The server SV further updates the configuration information ​​​​​​​​​By associating report KJ3 with time information JJ3 with each other, history information RJ is updated (Figure shown in 21.).

[0038] Step ST17 (at time t4): The terminal TM2 transmits the software SW, i.e., the configuration information KJ4 (Figure 1 shown in 4.), which has been changed from "component Tc hg1 to component Tchg2" by the user US2, to the server SV.

[0039] Step ST18: When the server SV receives the software SW, i.e., the configuration information KJ4, which has been changed from "component Tchg1 to component Tchg2", it obtains the time information JJ4 (shown in Figure 15.) indicating "16:10 on June 7, 2023 ". The server SV further updates the history information RJ by associating the configuration information KJ4 with the time information JJ4 with each other (shown in Figure 22.).

[0040] Step ST19 (at time t5): The terminal TM1 transmits the software SW, i.e., the configuration information KJ5 (shown in Figure 16 .), which has been changed from "component W to component Wchg" by the user US1, to the server SV. )

[0041] Step ST20: When the server SV receives the software SW, i.e., the configuration information KJ5, which has been changed from "component W to component Wchg", it obtains the time information JJ5 (shown in Figure 17.) indicating "17:05 on July 8, 2023 ". The server SV further updates the history information RJ by associating the configuration information KJ5 with the time information JJ5 with each other (shown in Figure 23.).

[0042] Note that in the above example, a configuration for transmitting the configuration information KJ to the server SV is described, but ​​​​​, instead, the configuration information of software SW (especially software component information) is the information related to software SW (e.g., folder hierarchy information, program source hierarchy information, etc.). By analyzing this information by the processing unit SY of the server SV, configuration information KJ including hierarchical component information may be constructed. Also, the information related to software may be transmitted from the terminal TM, or may be information read from the storage area of another computer (e.g., cloud server, etc.) through a predetermined path. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM, or may be temporarily stored in an external storage device such as a memory card, and then the external storage device is connected to a computer such as the server SV accessible by the terminal TM and read, and thus it may be stored in the storage unit KI of the server SV. The information related to software SW (e.g., folder hierarchy information, program source hierarchy information, etc.) is analyzed by the processing unit SY of the server SV to construct configuration information KJ including hierarchical component information. The information related to software SW (e.g., folder hierarchy information, program source hierarchy information, etc.) is analyzed by the processing unit SY of the server SV to construct configuration information KJ including hierarchical component information. Also, the information related to software may be transmitted from the terminal TM, or may be information read from the storage area of another computer (e.g., cloud server, etc.) through a predetermined path. Also, the information related to software may be transmitted from the terminal TM, or may be information read from the storage area of another computer (e.g., cloud server, etc.) through a predetermined path. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM. The predetermined path is, for example, through a network or a wired cable (especially, with access permission to the storage area of another computer, etc.) so that it can be read by the processing unit SY of the server SV or the terminal TM.

[0043] <Effect of Embodiment 1> As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. As described above, in the information processing system JSS of Embodiment 1, every time the content of software SW is updated (addition, change, deletion, etc.) by users US1 to US3, the server SV generates history information RJ by associating configuration information KJ and time information JJ with each other. including cases where the software becomes non - open - source or the paid license expires, etc.) Even if it had been, it is possible to identify the history information RJ of when the software SW was used and specify it. Specifically.

[0044] For example, even if the component Tchg1 had a vulnerability, as shown in FIG. 5, the component Tchg1 was used and the usage period SK was between time t2 and time t4, or more specifically, from "14:32 on April 5, 2023" to "16:10 on June 7, 2023". It is possible to specify that it was during this period. Specifically.

[0045] <Modification Example 1 - 1> Information on whether components A - W, etc. included in the software SW have vulnerabilities (hereinafter also referred to as "vulnerability information") may be received from the input of the user US who develops the software SW, for example, from the terminal TM of the user US, and the vulnerability information may be stored in the storage unit KI of the server SV. Alternatively, the vulnerability information may be generated by the processing unit SY of the server SV through independent analysis and stored in the storage unit KI of the server SV. When the vulnerability database in which the vulnerability information of the software SW is stored is publicly available (especially when it is open - source), the processing unit SY of the server SV may access the vulnerability database via the network NW (for example, the Internet) to collect (crawl) and store the vulnerability information. Then, the processing unit SY of the server SV compares the vulnerability information stored in the storage unit KI of the server SV with the configuration information KJ included in the history information RJ (especially information regarding components A - W), and determines the period during which the component corresponding to the vulnerability information was included or the software information (version information Specifically.

[0046] Specifically. Specifically. Specifically. information indicating at least any one of the configuration information KJ (hereinafter also referred to as "vulnerability target information") The process of identifying (hereinafter also referred to as such) may be executed.

[0047] Although vulnerability information has been described for ease of explanation and understanding, it is not limited to this. Any information regarding defects in the software SW stored in the storage unit KI of the server SV (in particular, parts A to W included in the software SW) (hereinafter also referred to as "defect information") may be used. That is, the processing unit SY of the server SV compares the defect information stored in the storage unit KI of the server SV with the configuration information KJ included in the history information RJ (in particular, information regarding parts A to W) (for example, vulnerability information, malfunction information, license-related defect information, etc. as described above) and executes a process of identifying (generating) information indicating at least any one of the period or version in which the part corresponding to the defect information was included in the history information RJ and the configuration information KJ (hereinafter also referred to as "defect applicable information"). Note that the "storage" of defect information includes storage in any of the primary storage device (main memory), secondary storage device, cache memory, etc. included in the storage unit KI, and may be, for example, storage by a registration process in response to a registration operation by the user US or the administrator KA, or temporary storage when acquired and referred to from an external database or the like .[[]]END]] .[[]]END]] .[[]]END]] .[[]]END]] .[[]]END]] .[[]]END]] .[[]]END]] .[[]]END]]

[0048] <Effect of Modification Example 1-1> With the configuration of Modification Example 1-1, the software SW has had defects in the past (for example, including vulnerabilities, bugs, malfunctions such as crashes, and license-related defects caused by the license side of parts that have received a license grant (for example, use outside the scope defined by the license, open .[[]]END]] .[[]]END]] including cases where the source software becomes non-open source or the paid license expires, etc. Even if it had ( ), the defect-corresponding information can be specified by the processing of the processing unit SY of the server SV. This becomes possible.

[0049] <Modification Example 1-2> In addition, the processing unit SY of the server SV, for example, as in Embodiment 1, based on the defect-corresponding designation operation after the administrator KA or the like has confirmed the history information RJ, designates at least any one of the period or version in which the part corresponding to the defect information is included in the history information RJ, or the configuration information KJ. Based on the defect-corresponding designation process, or based on the processing of the processing unit SY as in the above Modification Example 1-1, in response to the defect-corresponding information such as the period having a defect such as a vulnerability being specified (generated), for example, to the terminals TM1 to TMm, "During the usage period SK (shown in FIG. 6), the software SW included the defective part Tchg1." A notice to this effect (that is, a notice regarding the usage period SK during which the part including the defect was used) or "Prohibit the use of the software SW including the part Tchg1." A notice to this effect (that is, a notice regarding the prohibition of the use of the software including the part including the defect), "Recommend the use of the software SW including the part Tchg2 that has no vulnerability." A notice to this effect (that is, a notice regarding the recommendation of the use of the software including the part not including the defect) may be transmitted to the terminals TM1 to TMm. After the administrator KA etc. has confirmed the history information RJ, the part corresponding to the defect information in the history information RJ is specified by the defect-corresponding designation operation. At least any one of the period or version in which the part corresponding to the defect information is included in the history information RJ, or the configuration information KJ. Based on the defect-corresponding designation process, or based on the processing of the processing unit SY as in the above Modification Example 1-1, When the defect-corresponding information such as the period having a defect such as a vulnerability is specified (generated), for the terminals TM1 to TMm, for example, "During the usage period SK (shown in FIG. 6), the software SW included the defective part Tchg1." A notice to this effect (that is, a notice regarding the usage period SK during which the part including the defect was used) or "Prohibit the use of the software SW including the part Tchg1." A notice to this effect (that is, a notice regarding the prohibition of the use of the software including the part including the defect), "Recommend the use of the software SW including the part Tchg2 that has no vulnerability." A notice to this effect (that is, a notice regarding the recommendation of the use of the software including the part not including the defect) May be transmitted to the terminals TM1 to TMm.

[0050] <Effect of Modification Example 1-2> With the configuration of Modification Example 1-2, by transmitting a notice regarding the software part having the specified defect to the terminal TM of the user US, the user US can smoothly recognize the defect. This becomes possible. This becomes possible.

[0051] <Variation 1-3> In addition, the processing unit SY of the server SV is a software component unit or a software SW For at least one of the units, importance information indicating the importance of each unit ("Indicating the degree of impact") Even if the "impact degree" (which may be called "impact degree") is associated and stored in the storage unit KI of the server SV, good.

[0052] The importance information (impact information) is, for example, at least one of the user US and the administrator KA. The input operation is accepted from either one of the servers, and the software components are stored in the storage unit KI of the server SV. And / or an arbitrary importance may be set for each software SW, and / or The processing unit SY of the server SV refers to the importance condition information indicating the conditions for setting each importance. In this case, a setting process for setting the importance level may be performed based on the conditions for setting each importance level. For example, it can be at least one of the following six: (1) At least one of the target software SW or software parts (hereinafter referred to as Whether or not the software components are connected to the Internet (i.e., (conditions based on relevant information), (2) Whether the target software component, etc. is connected to an area where access is restricted (i.e., conditions based on access restriction information), (3) The software components, etc. in question contain important data information (e.g., confidential information, customer information, etc.) Whether or not it contains important data (e.g., personal information, credit card information, etc.) (Conditions based on data) (4) The software components, etc. in question are subject to the software environment (test environment, development environment, Whether the purpose is for a production environment (i.e., conditions based on software environment information) subject) (5) Whether the target software component or the like has access rights to other resources (computers, databases, networks work, etc.) (i.e., conditions based on access right information) (6) What level is the threat level of the defects (especially vulnerabilities) associated with the software component itself (i.e., conditions based on defect threat level information)

[0053] And, importance information indicating the importance corresponding to the changed software component or the like (especially, the software component or the like in which the difference of the change specified in Embodiment 2 described later is larger than the reference) is compared with the reference information, and the processing unit SY performs a determination process of determining that the importance is higher than the reference, and only when it is determined that the importance is higher than the reference, a notification (for example, a notification informing that a software component or the like with high importance has been changed, etc.) including information regarding the importance of the changed software component or the like may be transmitted (i.e., the necessity of the notification may be determined based on the importance). At this time, one or more reference information is stored in the storage unit KI of the server SV, and when two or more comparison results are obtained (for example, when the importance is set in 4 levels of Critical, High, Medium, and Low according to the conditions, if there is 1 reference, there are two comparison results of Critical or higher and High or lower, or two comparison results of High or higher and Medium or lower, etc., and if there are 3 references, each weight from Critical to Low becomes 4 comparison results, etc.), notification destination information corresponding to each comparison result may be set. That is, the notification destination information includes destination information (for example, e-mail address, etc.), and for example, if there is 1 reference, the changed software ware component When the importance of air components etc. is Critical, send a notification based on the destination information indicating the mailing list of all group members and when it is High or lower, it may be possible to send a notification based on the destination information indicating only one specific responsible person . In other words, depending on the comparison result , different notification destinations (for example, a mailing list or only one responsible person) or different notification ranges (for example , a mailing list and one responsible person or only one responsible person) may be used to send the above-mentioned notification .

[0054] Alternatively, instead of this, or in addition to this, compare the importance information indicating the importance corresponding to the software components etc. specified as the defect-related information with the reference information, and perform a determination process in the processing unit SY to determine that the importance is higher than the reference , and only when it is determined that the importance is higher than the reference , it may be possible to send the notification described in Modification Example 1-2 (that is, it may be possible to determine the necessity of the above-mentioned notification based on the importance ). At this time, store one or more reference information in the storage unit KI of the server SV , and when two or more comparison results are obtained, set the notification destination information according to each comparison result . That is, the notification destination information includes destination information (for example, an email address etc.), and for example, if there is one reference , when the importance of the modified software components etc. is Critical, send a notification based on the destination information indicating the mailing list of all group members , and when it is High or lower, it may be possible to send a notification based on the destination information indicating only one specific responsible person . In other words, depending on the comparison result , different notification destinations (for example, a mailing list or only one responsible person) or different notification ranges (for example , a mailing list and one responsible person or only one responsible person) may be used to send the above-mentioned notification . . It may be.

[0055] 〈Effects of Modification Examples 1-3〉 Due to the configurations of Modification Examples 1-3, when the software update frequency is high, it is possible to efficiently respond by checking the importance (influence degree) of the modified software components, etc. (or software components for which defects have been identified, etc.). In particular, when notifications are made, it is possible to suppress the number of notifications by limiting them to cases where a predetermined importance (importance higher than the reference is shown).

[0056] 〈Embodiment 2〉 The information processing system JSS of Embodiment 2 will be described.

[0057] 〈Configuration of Embodiment 2〉 The information processing system JSS of Embodiment 2 has the same configuration as the information processing system JSS of Embodiment 1 (illustrated in FIGS. 1, 2, and 3).

[0058] 〈Operation of Embodiment 2〉 The information processing system JSS of Embodiment 2 basically operates in the same manner as the information processing system JSS of Embodiment 1 (illustrated in FIGS. 4 and 5).

[0059] On the other hand, the information processing system JSS of Embodiment 2 stores history information RJ (illustrated in FIGS. 18 to 23) composed of time information JJ and configuration information KJ, which is different from the information processing system JSS of Embodiment 1, or, in addition, as shown in FIG. 24, stores history information RJ composed of time information JJ and difference information S J. That is, comparison result information (hereinafter also referred to as "difference information") indicating the result (difference) of comparing the software component information stored at two points in time with each other is generated. Note that the difference information SJ is obtained, for example, by receiving an input from the terminal TM and It may be stored in the storage unit KI of the server SV, and / or by the processing unit SY of the server SV, the tree-shaped configuration information KJ (that is, the configuration information KJ indicating the relationship between software components), matrix-shaped configuration information KJ, or any of the configuration information KJ in the form of mutual relationship is compared (for example, character comparison by searching based on characters, or image comparison by image analysis based on images, etc.), and the result of the comparison may be stored in the storage unit KI of the server SV as difference information.

[0060] In the history information RJ, as shown in FIG. 24, the time information JJ and the difference information SJ are linked to each other. For example, the time information JJ1 at time t1 and the difference information SJ1 at time t1 are linked to each other.

[0061] The difference information SJ of Embodiment 2 instead of the configuration information KJ of Embodiment 1 indicates the difference between the software SW before and after the software SW is updated, that is, the difference between the configuration information KJ.

[0062] For example, the difference information SJ1 is the result of comparing the tree-shaped configuration information KJ0 (illustrated in FIG. 25) at time t0 indicated by the time information JJ0 and the tree-shaped configuration information KJ1 (illustrated in the lower part of FIG. 25) at time t1 indicated by the time information JJ1, that is the difference "addition of component Dadd" (illustrated in FIGS. 24 and 25).

[0063] The difference information SJ1 is also the matrix-shaped configuration information (hierarchy) KJ0(KS) (illustrated in the upper part of FIG. 26) at time t0 indicated by the time information JJ0 and the matrix-shaped configuration information (hierarchy) KJ1(KS) (illustrated in the lower part of FIG. 26) at time t1 indicated by the time information JJ1 is shown in (Fig. 24 and Fig. 26 show the difference "addition of component Dadd")

[0064] The difference information SJ1 further includes the mutual relationship between components at time t0 indicated by the time information JJ0 configuration information (relationship) KJ0(KK) (shown in Fig. 27) indicating the relationship (e.g., parent - child relationship), and the difference "addition of component Dadd" (shown in Fig. 24, Fig. 26, and Fig. 27) between the configuration information (relationship) KJ1(KK) (shown in the lower part of Fig. 27) indicating the mutual relationship between components at time t1 indicated by the time information JJ1 and the configuration information (relationship) KJ0(KK) (shown in the upper part of Fig. 27). is shown in (Fig. 24, Fig. 26, and Fig. 27 show the difference "addition of component Dadd").

[0065] <Effect of Embodiment 2> As described above, in the information processing system JSS of Embodiment 2, instead of the history information RJ in which the configuration information KJ and the time information JJ in Embodiment 1 are mutually linked, history information RJ in which the difference information SJ and the time information JJ are mutually linked is generated. Thus, even if the software SW had vulnerabilities in the past, it is possible to identify when the software SW was used, in the same way as in Embodiment 1.

[0066] <Modification Example 2 - 1> Although the above - mentioned difference information describes component names, instead of or in addition to this, a difference value corresponding to the amount of the difference may be associated. The difference value may be, for example, a value based on the number of differences, or the difference value may be a value obtained by multiplying the weighting coefficient set for each component by the number of differences.

[0067] <Effect of Modification Example 2 - 1> With the configuration of Modification Example 2 - 1, by associating a difference value corresponding to the amount of the difference instead of or in addition to the component name as the difference information, not only the structural differences of the software but also more ​It becomes possible to recognize quantitative changes. As a result, for example, "check whether the difference amount after the change exceeds the reference value, and if it does, check whether there is a malfunction" and other operations become possible.

[0068] 〈Modification 2-2〉 Also, result condition information indicating conditions related to the comparison result may be set, and based on the comparison result information (difference value) and the result condition information (for example, a reference value is set and the difference value exceeds the reference difference value or the like), a notification indicating that the conditions are met may be sent to the terminal TM.

[0069] 〈Effect of Modification 2-2〉 With the configuration of Modification 2-2, by sending a notification regarding a software component having a difference amount equal to or greater than a predetermined reference to the terminal TM of the user US, the user US can smoothly recognize changes to the software SW (particularly, changes with a large difference amount). (In particular, changes with a large difference amount).

[0070] 〈Embodiment 3〉 The information processing system JSS of Embodiment 3 will be described.

[0071] 〈Configuration of Embodiment 3〉 The information processing system JSS of Embodiment 3 has the same configuration as the information processing system JSS of Embodiment 1 (illustrated in FIGS. 1, 2, and 3).

[0072] 〈Operation of Embodiment 3〉 In the information processing system JSS of Embodiment 3, the input / output units NS(TM )(illustrated in FIG. 2) of the terminals TM1 to TMm display the configuration of the software SW in the form of configuration information KJ1 to KJ4 (illustrated in FIGS. 28 to 31) instead of, or in addition to, the configuration information KJ (for example, the configuration information KJ0 (illustrated in FIG. 6) of Embodiment 1).

[0073] In the configuration information KJ11, the software SW is configured as shown in FIG. The parts A to W may be displayed separately as a main routine and a subroutine.

[0074] In the configuration information KJ12, as shown in FIG. 29, the software SW is configured. The number of times that the parts A to W are used in the software SW may be added and displayed.

[0075] In the configuration information KJ13, as shown in FIG. 30, the software SW is configured. Parts A to W are divided into parts with subroutines and parts without subroutines. It may be shown.

[0076] In the configuration information KJ14, the software SW is configured as shown in FIG. Among parts A to W, the required times T(A), T( B), T(C), T(D), and the parts that make up parts A, B, C, and D (for example, The components S and T that make up the process may be displayed in chronological order.

[0077] Effects of the Third Embodiment As described above, the information processing system JSS of the third embodiment is the same as the information processing system of the first embodiment. Instead of or in addition to the display format in the system JSS, configuration information KJ11 to configuration information KJ 14. As a result, the software SW is displayed in the same manner as in the first embodiment. Even if the software SW has a defect, it is impossible to identify when it was used. The information processing system JSS of the first embodiment further includes configuration information KJ11 to configuration The display of information KJ14 has better visibility, making it easier to identify the above. This becomes possible.

[0078] 〈Hardware Configuration of Embodiments 1 to 3〉 FIG. 32 shows the hardware configuration of the information processing system JSS of Embodiments 1 to 3. .

[0079] To perform the functions described above, the information processing system JSS of Embodiments 1 to 3 includes a processing circuit SYO as shown in FIG. 32, and further includes an input circuit NYU and an output circuit SY U as necessary.

[0080] The processing circuit SYO is dedicated hardware. The processing circuit SYO mainly realizes the functions of the processing unit SY(TM) of the terminal TM and the processing unit SY(SV) of the server SV (illustrated in FIGS. 2 and 3).

[0081] The processing circuit SYO is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit) , an FPGA (Field Programmable Gate Array), or a combination thereof.

[0082] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processing circuit SYO, for example, between the outside of the terminal TM and the server SV.

[0083] 〈Hardware Configuration Based on Software Realization of Embodiments 1 to 3〉 FIG. 33 shows the hardware configuration based on the software realization of the information processing system JSS of Embodiments 1 to 3.

[0084] As shown in FIG. 32, the information processing system JSS of Embodiments 1 to 3 includes a processor P RO and a memory circuit KIO, and optionally further includes an input circuit NYU and an output circuit SYU .

[0085] The processor PRO is a CPU (Central Processing Unit, central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, DSP( Digital Signal Processing), which is also called). The processor PRO mainly realizes the functions of the processing unit SY(TM) of the terminal TM and the processing unit SY(SV) of the server SV .

[0086] The processor PRO realizes the above-described functions by software, firmware, or a combination of software and firmware. The software and firmware are described as a program PRG and stored in the memory circuit KIO .

[0087] The processor PRO reads and executes the above-described program PRG from the memory circuit KIO to realize the above-described functions. The above-described program PRG mainly causes a computer to execute the procedures and methods of the processing unit SY(TM) of the terminal TM and the processing unit SY(SV) of the server SV . It can also be said that it is a thing .

[0088] Here, the memory circuit KIO is, for example, a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Me such as ROM (Read-Only Memory), RAM (Random Access Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), etc. volatile or non-volatile semiconductor memories, as well as magnetic disks, flexible disks optical disks, compact disks, mini-disks, DVDs (Digital Versatile Discs) and the like.

[0089] Among the functions of the input / output unit NS(TM) to the communication unit TU(TM) of the terminal TM and the input / output unit NS( SV) to the communication unit TU(SV) of the server SV, some of the functions are realized by the processing circuit SYO (shown in FIG. 32). ), while on the other hand, some other functions may be realized by the processor PRO (shown in FIG. 33). It is also possible.

[0090] As described above, the functions of the input / output unit NS(TM) to the communication unit TU(TM) of the terminal TM and the input / output unit NS(SV) to the communication unit TU(SV) of the server SV can be realized by hardware, software, firmware, or a combination thereof.

[0091] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processor PRO, for example, between the outside of the terminal TM and the server SV.

[0092] <Exemplification of Configuration> The information processing system, information processing system method, program, and recording medium according to the present disclosure have, for example, the following configuration.

[0093] [Item 1] By the processing unit, Based on the software component information and history timing information regarding one or more software components that constitute predetermined software, history information indicating the change history of the software component information ​ Generate The history timing information indicates the timing of one or more points in time from the generation time of the software component information to the storage of the history information. Information processing system. [Item 2] Furthermore, by the processing unit Based on the defect information stored in the storage unit and the history information, identify information indicating at least any one of the period during which the component corresponding to the defect was included or the software component information. , The information processing system according to Item 1. [Item 3] Furthermore, by the processing unit Send at least any one of a notice regarding the usage period during which the component including the defect was used, a notice regarding the prohibition of using the software including the component including the defect, or a notice regarding the recommendation of using the software including the component not including the defect to a predetermined terminal. The information processing system according to Item 2. [Item 4] Furthermore, by the processing unit Based on the importance information set at least in either component unit or software component information unit, determine whether to send the notice. The information processing system according to Item 3. [Item 5] Generate comparison result information indicating the result of comparing software component information stored at two points in time with each other. The information processing system according to any one of Items 1 to 4. [Item 6] Based on the comparison result information and the result condition information indicating the conditions related to the result, send a notice indicating that the conditions are met to a predetermined terminal. The information processing system according to Item 5. ​​​​​[Item 7] The comparison result is difference value information based on the difference between software component information, and the condition includes that the difference value indicated by the difference value information exceeds a reference difference value, The information processing system according to Item 6. [Item 8] The software component information is obtained by analyzing hierarchical information included in information related to software and is The information processing system according to any one of Items 1 to 7. [Item 9] The information related to software is information read from the storage area of another computer and is The information processing system according to Item 8. [Item 10] Based on software component information and history timing information related to one or more software components constituting predetermined software by a processing unit, history information indicating a change history of the software component information is generated, and the history timing information is information indicating timings of one or more timings from the generation time of the software component information to the storage time of the history information, an information processing method. [Item 10] Based on software component information and history timing information related to one or more software components constituting predetermined software by a processing unit, history information indicating a change history of the software component information is generated, and the history timing information is information indicating timings of one or more timings from the generation time of the software component information to the storage time of the history information, a program.

Description of Signs

[0094] JSS Information Processing System TM terminal SV server US user KA administrator NW network SW software RJ history information KJ configuration information JJ time information

Claims

1. The processing unit, Based on software component information and history timing information regarding one or more software components that constitute predetermined software, Generates history information indicating a change history of the software component information, The history timing information is information indicating the timing of one or more points in time from the generation time of the software component information to the storage time of the history information, An information processing system.

2. The processing unit further, Based on the defect information stored in the storage unit and the history information, identifies information indicating at least any one of the period during which the component corresponding to the defect was included or the software component information, The information processing system according to claim 1.

3. The processing unit further, 、 Sends at least any one of a notification regarding the usage period during which the component including the defect was used, a notification regarding the prohibition of using the software including the component including the defect, or a notification regarding the recommendation of using the software including the component not including the defect to a predetermined terminal, The information processing system according to claim 2.

4. The processing unit further, Based on the importance information set in at least any one of the component unit or the software component information unit, determines whether to send the notification, The information processing system according to claim 3.

5. Generates comparison result information indicating the result of comparing software component information stored at two points in time with each other, The information processing system according to claim 1.

6. Based on the comparison result information and result condition information indicating conditions related to the result, sends a notification indicating that the conditions are met to a predetermined terminal, The information processing system according to claim 5.

7. The comparison result is difference value information based on the difference between software component information, and the condition includes that the difference value indicated by the difference value information exceeds a reference difference value, The information processing system according to claim 6.

8. The software component information is obtained by analyzing hierarchical information included in information regarding software, The information processing system according to any one of claims 1 to 7.

9. The information regarding the software is information read from the storage area of another computer, The information processing system according to claim 8.

10. The processing unit, ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ Software component information regarding one or more software components that make up a predetermined software Based on the software component information and history timing information, history information indicating the change history of the software component information is generated, The history timing information is information indicating the timing of one or more points in time from the generation time of the software component information to the storage time of the history information, Information processing method.

11. By a processing unit, Based on the software component information regarding one or more software components that make up a predetermined software and the history timing information, history information indicating the change history of the software component information is generated, The history timing information is information indicating the timing of one or more points in time from the generation time of the software component information to the storage time of the history information, Program. ​ ​ ​

Images