Service providing device, control method of service providing device, and program

Abstract

To appropriately and easily set a provision range of service to a client device, according to a confidential category of conserved data.SOLUTION: A service providing device which provides service to a client device comprises: data storage detection means which detects storage of data to a storage device of the service providing device; confidential category acquisition means which refers to the data detected by the data storage detection means, and acquires a type of confidential information; service provision range acquisition means which refers to the type of the confidential information acquired by the confidential category acquisition means, and acquires a provision range of the service; and service provision range setting means which refers to the provision range of the service acquired by the service provision range acquisition means, and sets the provision range of the service to the client device.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a service providing device that manages confidential information of a network service that operates on a cloud server, a control method for the service providing device, and a program. [Background technology]

[0002] Traditionally, when developers develop network services in a cloud development environment, they often check their operation using an experimental environment (hereafter referred to as a sandbox account) that is different from the normal development environment.

[0003] Sandbox accounts often have security settings that broaden the range of available functions compared to a normal development environment, allowing service users to evaluate functions they have not used before.

[0004] In particular, when using the functions of new network services provided by cloud vendors, service users must configure security settings by trial and error, which can lead to configuration errors and increase the risk of data leakage due to unauthorized access.

[0005] For this reason, sandbox accounts are often operated so that highly confidential data is not stored within the account, so that the impact is minimized even if data within the account is leaked. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2019-96339 Summary of the Invention [Problem to be solved by the invention]

[0007] Sandbox accounts are often used simultaneously by multiple users with different skill levels, increasing the risk of accidentally storing sensitive data.

[0008] Furthermore, as user evaluations progress and the amount of evaluation data used increases, confidentiality, which was initially low, may improve.

[0009] An example of a countermeasure is to monitor data sent and received between a client device used by a user and a cloud environment, and if confidential information is discovered, to take security measures such as blocking communication (Patent Document 1).

[0010] However, depending on the combination of user and type of data, such as machine learning data licensed to a specific user, there may be no confidentiality issues, and simply judging whether or not confidential information is present could hinder appropriate use.

[0011] However, changing the user's security settings every time highly confidential data is saved is a cumbersome process, making it difficult for sandbox account administrators to operate the system manually.

[0012] The present invention has been made in consideration of the above-mentioned problems, and aims to make it possible to appropriately and easily set the scope of services to be provided to client devices according to the confidentiality category of stored data. [Means for solving the problem]

[0013] The present invention is a service providing device that provides a service to a client device, comprising: a data storage detection means that detects the storage of data in a storage device of the service providing device; a confidentiality category acquisition means that references the data detected by the data storage detection means and acquires a type of confidential information; a service provision range acquisition means that references the type of confidential information acquired by the confidentiality category acquisition means and acquires a service provision range; and a service provision range setting means that references the service provision range acquired by the service provision range acquisition means and sets the service provision range for the client device. [Effects of the Invention]

[0014] According to the present invention, it is possible to appropriately and easily set the scope of services to be provided to a client device in accordance with the confidentiality category of stored data. [Brief explanation of the drawings]

[0015] [Figure 1] FIG. 1 is a block diagram illustrating an example of a functional configuration of a first embodiment. [Figure 2] FIG. 2 is a flow diagram of the entire process performed in the first embodiment. [Figure 3] Examples of updating the data disclosure destination definition table, client device management table, data usage definition table, and data usage definition table [Figure 4] FIG. 10 is a block diagram illustrating an example of a functional configuration of a second embodiment. [Figure 5] Flow diagram of the entire process performed in the second embodiment [Figure 6] FIG. 10 is a block diagram showing an example of a functional configuration of a third embodiment. [Figure 7] Flow diagram of the overall process performed in the third embodiment [Figure 8] FIG. 10 is a block diagram showing an example of a functional configuration of a fourth embodiment. [Figure 9] Flow diagram of collection time estimation processing performed in the fourth embodiment [Figure 10] Diagram showing data disclosure destinations with added importance values DETAILED DESCRIPTION OF THE INVENTION

[0016] A preferred embodiment of the present invention will be described below with reference to the accompanying drawings. Note that the embodiment described below shows an example of a specific implementation of the present invention, and is one of the specific embodiments of the configuration described in the claims.

[0017] (First embodiment) An image display device according to this embodiment will be described with reference to the block diagram of FIG. 1. The service providing device 100, client device 120, and data storage device 130 are connected to a network such as a LAN or the Internet, and are configured to be able to communicate data with each other. The client device 120 connects to the service providing device 100 and issues a request for cloud service execution, such as data storage, analysis, and reference, using a web browser screen or WebAPI. There may be multiple client devices 120, each assigned a different network address. Examples of the client device 120 include devices such as PCs, tablets, and smartphones. The service providing device 100 receives the request sent from the client device 120 and executes the corresponding process.

[0018] Examples of the service providing device 100 include a PC, a server, and a cloud computing service such as an AWS account provided by AWS Inc. The data storage device 130 is a device that stores data in response to a request from the service providing device 100. Examples of the data storage device 130 include a hard disk, a network storage, a storage service such as S3 provided on the cloud by AWS Inc., and a database service such as DynamoDB.

[0019] Next, a description will be given of the configuration of the service providing device 100. The CPU 101 controls the overall operation of the service providing device 100. The memory 102 provides a working area that the CPU 101 uses when executing various processes.

[0020] Of the components constituting the service providing device 100, each component except for the CPU 101 and the memory 102 may be configured as either hardware or software.

[0021] In this embodiment, the service providing device 100, the client device 120, and the data storage device 130 are described as different devices, but they may be configured as the same device.

[0022] The operation of each of the components constituting the service providing device 100 shown in FIG. 1, excluding the CPU 101 and the memory 102, will be described with reference to the flow chart of FIG. When the service providing device 100 receives a data storage request from the client device 120 to the data storage device 130, the data storage detection unit 103 receives a data storage event (S201). If the data storage device 130 is an S3 service and the data is an S3 object, the data storage event becomes an S3 event. Note that the data storage event includes a resource name, which is an identifier for the data. If the data storage device 130 is an S3 service, the resource name becomes an identifier in a format called ARN.

[0023] Next, the confidentiality category acquisition unit 104 acquires a confidentiality category that expresses the type of confidentiality of the stored data (S202). An example of the confidentiality category acquisition unit 104 is the Macie service from AWS. The Macie service searches data objects stored in S3, and determines whether or not the data objects contain confidential information such as authentication information, financial information, or personal information, and the confidentiality category that indicates the type of confidential data.

[0024] If there is no confidential information (No in S203), the process ends. If there is confidential information (Yes in S203), the data use acquisition unit 105 refers to the data use definition table and acquires the data use corresponding to the resource name (S204). The data use is an identifier that identifies the purpose for which the data is used within the service providing device 100.

[0025] Figure 3(C) is an example of a data usage definition table. The table consists of resource names and the usage of data stored in the resources.

[0026] In this embodiment, the data usage is acquired by referring to a table, but it may also be acquired from metadata such as resource naming rules and attributes assigned to resources.

[0027] Next, the service provision range acquisition unit 106 acquires the service provision range (S205). In this embodiment, the service provision range acquisition unit 106 refers to the data disclosure destination definition table and acquires the disclosure destination using the confidentiality category and the data use as keys.

[0028] 3(A) is an example of a data disclosure destination definition table. The table is composed of the confidentiality category of the data, the data use, and the disclosure destination, which identifies the organization to which the data will be disclosed. For example, if the confidentiality category is employee information and the data use is analysis processing, the data disclosure destinations will be Company A / Development Department, Company A / Evaluation Department, and Company A / Operation Department. Next, the service provision range setting unit 107 references the client device management table and obtains the IP address range of the client device using the obtained organization name as a key.

[0029] 3B is an example of a client device management table. The table is made up of organization names and the IP address ranges of client devices used by the organization with that name.

[0030] After obtaining the IP address, the service provision range setting unit 107 performs a setting to refuse connection with client devices having IP addresses outside the obtained range (S206).

[0031] If the organization name obtained in S205 is Company A / Development Department, Company A / Evaluation Department, or Company A / Operation Department, the IP addresses of client devices of other organizations, such as Company B / Development Department, are set to refuse connections.

[0032] In this embodiment, it is assumed that the setting method uses network settings such as AWS WAF, firewalls such as security groups, and network ACLs. Methods of refusing connections other than by IP address include updating permission settings for users, organizations, and roles assigned to users, but are not limited to these as long as they are settings that deny service use.

[0033] (Second embodiment) In the first embodiment, the security settings are changed after a determination is made based on the confidentiality category of the data and the use of the data.

[0034] However, when a large amount of data is stored, it can take time to determine the confidentiality category, and delays in changing the necessary security settings could result in a period of time during which unauthorized access to confidential data is permitted.

[0035] In this embodiment, when data is saved, connections from all client devices 120 are temporarily denied, shortening the time during which unauthorized access is permitted until appropriate security settings are updated.

[0036] This embodiment will be described with reference to the block diagram of FIG.

[0037] 5 differs from FIG. 1 in that it includes a temporary shutdown execution unit 401 that transitions to a state in which connections from client devices 120 other than those for management purposes are refused (hereinafter referred to as all connection refusal mode), and a temporary shutdown release unit 402 that returns from the all connection refusal mode.

[0038] The rest of the configuration is the same as in FIG. 1, so the explanation will be omitted.

[0039] Next, the operation of this embodiment will be described with reference to the flow chart of FIG.

[0040] The processing other than S501 and S502 is the same as that shown in Fig. 4 of the first embodiment, and therefore will not be described here. When the data save detection unit 103 receives a data save event, the temporary shutdown execution unit 401 updates the security settings to reject connections from IP addresses of client devices 120 other than those used for system management (S501).

[0041] In this embodiment, it is assumed that a definition specifying a value with a higher rule application priority than other definitions is added to the network ACL settings, which are AWS network settings, but other methods are also possible.

[0042] After the service provision range setting unit 107 performs settings corresponding to the confidentiality category and data use in S206, the temporary shutdown release unit 402 releases the all connection refusal mode (S502). In this embodiment, it is assumed that the network ACL definition added by the temporary shutdown execution unit 401 is deleted, but other methods may also be used.

[0043] (Third embodiment) In the first embodiment, the data use acquisition unit 105 refers to a data use definition table prepared in advance to acquire the use of data.

[0044] In this embodiment, when data is saved, a data usage definition table is automatically created and updated, preventing discrepancies between the actual data usage and the table values, and ensuring that security settings are performed correctly.

[0045] This embodiment will be described with reference to the block diagram of FIG.

[0046] 6 differs from FIG. 1 in that a data usage update unit 601 is provided.

[0047] The rest of the configuration is the same as in FIG. 1, so the explanation will be omitted.

[0048] Next, the operation of this embodiment will be described with reference to the flow chart of FIG.

[0049] The processing other than S701 is the same as in Fig. 4 of the first embodiment, and therefore description thereof will be omitted. After the data save detection unit 103 receives a data save event in S201, the data use update unit 601 acquires the metadata of the data and updates the data use definition table with that value (S701). If the event is for a new resource, a row is added to the table, and if the event is for an existing resource, the value of the data use in the corresponding row is updated.

[0050] Figure 3(D) shows an example of adding a row to the data usage definition table. In this example, a new resource name "arn:aws:s3:::analyze-data-new" and a data usage for analysis processing have been added.

[0051] If the data is an S3 object, data attribute information called object metadata can be specified when saving the data. When the user specifies a data usage value as object metadata data, the data save detection unit 103 can notify the data usage update unit 601 of the resource name and the data usage value as a data save event.

[0052] (Fourth embodiment) In the first embodiment, security settings are made to select the client device 120 that can connect to the service providing device 100 based on the confidentiality category of the stored data.

[0053] In this embodiment, security settings can be made based not only on the confidentiality category of the data but also on the importance of the confidential information stored in the data.

[0054] This embodiment will be described with reference to the block diagram of FIG.

[0055] 8 differs from FIG. 1 in that a data importance determination unit 801 is provided.

[0056] The rest of the process is the same as in Fig. 1, so a description thereof will be omitted. Next, the operation of this embodiment will be described using the flow diagram of Fig. 9. The processes other than S901 are the same as in Fig. 4 of the first embodiment, so a description thereof will be omitted.

[0057] If confidential data is found in the stored data in S203, the data importance determination unit 801 determines the importance of the confidentiality and outputs it as a score.

[0058] For example, AWS Macie described in the first embodiment scores the importance of confidential data based on the nature and frequency of occurrence of the data.

[0059] In S205, the service provision range acquisition unit 106 acquires the disclosure destination using the importance value as a key in addition to the confidentiality category and data use as in the first embodiment, which is different from the first embodiment.

[0060] Figure 10(A) is an example of a data disclosure definition table with an added importance value. If the confidentiality category is employee information and the data use is analytical processing, a different value is defined as the disclosure range. If the importance is 50 or higher, the data will be disclosed only to Company A's operations department; if the importance is less than 50, the data will be disclosed to Company A's development department, Company A's evaluation department, and Company A's operations department.

[0061] FIG. 10(B) is an example of a data disclosure destination definition table in which data disclosure destinations with added importance values ​​are defined by the communication method used for disclosure, rather than by the name of the communication destination organization. If the confidentiality category is employee information and the data use is analytical processing, a different value is defined as the disclosure range. If the importance is 50 or higher, notification is only performed via the HTTPS protocol. If the importance is less than 50, communication via email transmission and telephone notification protocols, which have low communication reliability, is also permitted. Note that in the case of AWS configuration, the service provision range setting unit 107 can be configured to block the HTTPS protocol using a firewall or network ACL, as in the first embodiment. Furthermore, email transmission and telephone notification can be blocked by disabling the service endpoints of the email service (SES) and the telephony service (CONNECT).

[0062] (Other embodiments) The present invention can also be realized by executing the following process: software (programs) that realize the functions of the above-described embodiments are supplied to a system or device via a network or various storage media, and the computer (or CPU, MPU, etc.) of the system or device reads and executes the programs.

Claims

1. A service providing device that provides a service to a client device, a data storage detection means for detecting storage of data in a storage device of the service providing device; a confidentiality category acquisition means for acquiring a type of confidential information by referring to the data detected by the data storage detection means; a service provision range acquisition means for acquiring a service provision range by referring to the type of confidential information acquired by the confidentiality category acquisition means; a service provision range setting means for setting a service provision range for the client device by referring to the service provision range acquired by the service provision range acquisition means; A service providing device comprising:

2. The data storage device further includes a data usage acquisition unit that acquires the usage of the data detected by the data storage detection unit, The service providing device according to claim 1, characterized in that the service provision range acquisition means acquires the service provision range by referring to the type of confidential information acquired by the confidential category acquisition means and the use of the data acquired by the data use acquisition means.

3. a temporary cut-off execution means for temporarily cutting off the provision of the service when the data storage detection means detects data storage; a temporary cutoff cancellation means for canceling the cutoff by the temporary cutoff execution means after the service provision range setting means has set the service provision range; The service providing device according to claim 1 , further comprising:

4. a data usage update unit that updates the usage of the data acquired by the data usage acquisition unit when the data storage detection unit detects that the data is stored; The service providing device according to claim 2, further comprising:

5. The data storage detection means further includes a data importance determination means for obtaining the importance of confidential information when the data storage detection means detects that the data has been stored, The service providing device according to claim 1, characterized in that the service provision range acquisition means acquires the service provision range by referring to the type of confidential information acquired by the confidential category acquisition means and the data importance acquired by the data importance determination means.

6. 2. The service providing device according to claim 1, wherein the range set by said service providing range setting means is a network address or a network setting method.

7. A method for controlling a service providing device that provides a service to a client device, comprising: a data storage detection step in which data storage detection means detects storage of data in a storage device of the service providing device; a confidentiality category acquisition step in which confidentiality category acquisition means refers to the data detected in the data storage detection step and acquires the type of confidential information; a service provision range acquisition step in which a service provision range acquisition means acquires a service provision range by referring to the type of confidential information acquired in the confidential category acquisition step; a service provision range setting step in which a service provision range setting means refers to the service provision range acquired in the service provision range acquisition step and sets the service provision range for the client device; A method for controlling a service providing device, comprising:

8. Computer, A service providing device that provides a service to a client device, a data storage detection means for detecting storage of data in a storage device of the service providing device; a confidentiality category acquisition means for acquiring a type of confidential information by referring to the data detected by the data storage detection means; a service provision range acquisition means for acquiring a service provision range by referring to the type of confidential information acquired by the confidentiality category acquisition means; a service provision range setting means for setting a service provision range for the client device by referring to the service provision range acquired by the service provision range acquisition means; A computer program for causing a computer to function as a service providing device, comprising:

Images