Policy correcting apparatus, policy correcting method, and program

Abstract

To correct an access control policy without requiring a huge amount of manual work.SOLUTION: A policy correction device includes a correction reason acquisition part for acquiring a correction reason of an access control policy which is a policy of access control, and a policy correction part for changing a learning sample used for generation of the access control policy according to the acquired correction reason, and correcting the access control policy using the changed learning sample.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a policy modification device, a policy modification method, and a program. [Background technology]

[0002] Zero trust prevents threats to information assets by distrusting all access to information assets and verifying their security. Regarding access control, Patent Document 1 discloses a policy generation device that generates an access control policy. The policy generation device acquires relationship data that indicates the relationships between multiple elements related to access control. The policy generation device also acquires score data that defines scores based on the perspective of access risk and scores based on the perspective of access need for the multiple elements related to access control. The policy generation device generates an access control policy using the relationship data and score data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2022 / 244179 Summary of the Invention [Problem to be solved by the invention]

[0004] The policy generation device described in Patent Document 1 can automatically generate access control policies based on risks and needs. However, the generated access control policies may include policies that need to be modified. In such cases, if an administrator were to modify each policy individually, the amount of work would increase as the number of policies that need to be modified increases.

[0005] An exemplary object of the present disclosure is to provide a policy modification device, a policy modification method, and a program that can modify an access control policy without requiring a large amount of manual work. [Means for solving the problem]

[0006] A policy modification method according to a first aspect of the present disclosure includes obtaining a reason for modifying an access control policy, which is an access control policy, changing a learning sample used to generate the access control policy in accordance with the obtained reason for modification, and modifying the access control policy using the changed learning sample.

[0007] A policy modification device according to a second aspect of the present disclosure includes a modification reason acquisition unit that acquires a reason for modification of an access control policy, which is a policy for access control, and a policy modification unit that changes a learning sample used to generate the access control policy according to the acquired modification reason and modifies the access control policy using the changed learning sample.

[0008] A program according to a third aspect of the present disclosure causes a computer to execute a process including acquiring a reason for modifying an access control policy, which is an access control policy, changing a learning sample used to generate the access control policy in accordance with the acquired reason for modification, and modifying the access control policy using the changed learning sample. [Effects of the Invention]

[0009] The policy modifying device, policy modifying method, and program according to the present disclosure can modify an access control policy without requiring a large amount of manual work. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram illustrating a schematic configuration example of a policy modifying device according to the present disclosure. [Figure 2] 1 is a block diagram showing a configuration example of a first policy modifying device according to the present disclosure. [Figure 3] FIG. 10 is a diagram illustrating a specific example of visualization of an access control policy. [Figure 4]FIG. 10 is a diagram illustrating an example of selection of a reason for modifying a policy. [Figure 5] FIG. 2 is a block diagram showing an example of the configuration of a policy modification unit; [Figure 6] FIG. 10 is a diagram illustrating an example of a table used to determine a correction method. [Figure 7] FIG. 10 is a diagram illustrating an example of a learning sample used to generate an access control policy. [Figure 8] FIG. 10 is a diagram illustrating an example of training samples to which a sample has been added. [Figure 9] FIG. 10 is a diagram illustrating an example of a training sample in which sample items have been changed. [Figure 10] FIG. 10 is a diagram illustrating an example of a learning sample whose feature amount has been corrected. [Figure 11] FIG. 10 is a diagram showing another example of learning samples whose feature amounts have been corrected. [Figure 12] 10 is a flowchart showing the operation procedure of the first policy modifying device. [Figure 13] FIG. 2 is a block diagram showing a configuration example of a second policy modifying device according to the present disclosure. [Figure 14] FIG. 10 is a diagram illustrating an example of reference information. [Figure 15] FIG. 10 is a diagram showing another example of reference information. [Figure 16] 10 is a flowchart showing the operation procedure of the second policy modifying device. [Figure 17] FIG. 1 is a block diagram illustrating an example of the configuration of a computer device. DETAILED DESCRIPTION OF THE INVENTION

[0011] Prior to describing the embodiments of the present invention, an outline of the present disclosure will be described. Fig. 1 is a block diagram showing a schematic configuration example of a policy modification device according to the present disclosure. The policy modification device 10 includes a modification reason acquisition unit 11 and a policy modification unit 12.

[0012] The modification reason acquisition unit 11 acquires a modification reason for an access control policy, which is a policy for access control. The policy modification unit 12 changes a learning sample used to generate the access control policy according to the acquired modification reason. Here, the learning sample means data used to generate a trained model used to generate the access control policy when the access control policy is generated by machine learning. The policy modification unit 12 modifies the access control policy using the changed learning sample.

[0013] In the present disclosure, the policy modification unit 12 modifies the access control policy using the learning sample modified according to the acquired modification reason. In the present disclosure, the modified access control policy is obtained by modifying the learning sample. Therefore, the policy modification device according to the present disclosure can modify the access control policy without requiring a large amount of manual work.

[0014] Hereinafter, embodiments of the present disclosure will be described in detail. In the following description and drawings, for clarity of explanation, appropriate omissions and simplifications have been made. In addition, in each drawing, the same or similar elements are designated by the same reference numerals, and duplicate explanations have been omitted as necessary.

[0015] A first embodiment will be described. Fig. 2 is a block diagram showing a configuration example of a first policy modification device according to the present disclosure. The policy modification device 100 shown in Fig. 2 includes a policy input unit 101, a policy visualization unit 102, a modification reason input unit 103, a policy modification unit 104, and a policy output unit 105. The policy modification device 100 corresponds to the policy modification device 10 shown in Fig. 1.

[0016] The policy modifying device 100 can be physically configured as a device having one or more memories and one or more processors. In the policy modifying device 100, the one or more processors execute processing in accordance with instructions read from one or more memories, thereby realizing at least a part of the functions of each unit of the policy modifying device 100.

[0017] The policy input unit 101 acquires an access control policy to be modified (hereinafter also simply referred to as a policy). The access control policy includes, for example, a combination of attribute information and an access control action for the combination of attribute information. The attribute information includes, for example, an attribute and its attribute value. For example, a user such as an administrator inputs the policy to be modified to the policy input unit 101. The policy to be modified is generated, for example, by a policy generation device not shown in FIG. 2. The policy input to the policy input unit 101 may also be called a draft policy. For example, the policy generation device described in Patent Document 1 can be used to generate the draft policy.

[0018] For example, a policy generation device generates an access control policy using training samples (hereinafter simply referred to as samples). The policy generation device has a trained model generated by learning training data including, for example, a large number of samples. In the policy generation device, the trained model generates an access control policy from the input training samples. The training samples include relational data indicating the relationships between multiple elements related to access control. Here, "elements related to access control" refers to any information related to access control. The elements related to access control include, for example, various data of the access source, a connection port, a destination Internet Protocol (IP) address, the time or time period of access, and the resource ID (identifier) ​​of the accessed resource. The various data of the access source include, for example, the IP address of the access source, a user ID, a device ID, an application ID, a user location, and information about the OS (Operating System) used by the access source device. The "elements related to access control" may be a combination of two or more elements.

[0019] The learning sample also includes score data defining at least one of a score based on the perspective of access risk and a score based on the perspective of access needs. The "score based on the perspective of access risk" is a parameter that indicates the amount of loss or likelihood of fraud if the access is fraudulent or erroneous, i.e., a parameter that works to deny access. On the other hand, the "score based on the perspective of access needs" is a parameter that indicates the amount of benefit obtained through access or the likelihood of the benefit being obtained, i.e., a parameter that works to allow access. The "score based on the perspective of access risk" and the "score based on the perspective of access needs" have opposite characteristics as attributes. As an example, a negative value may be set as the "score based on the perspective of access risk," and a positive value may be set as the "score based on the perspective of access needs." As another example, a value of 0 or close to 0 may be set as the "score based on the perspective of access risk," and a large absolute value may be set as the "score based on the perspective of access needs."

[0020] In generating an access control policy, the policy generation device generates an access control action score for a combination of elements related to access control. For example, if the action score is equal to or greater than a threshold, the policy generation device determines that access is permitted. For example, if the action score is less than the threshold, the policy generation device determines that access is denied. The policy input unit 101 obtains the generated access control policy from the policy generation device. The policy input unit 101 may obtain the action score generated in policy generation in addition to the access control policy.

[0021] The policy acquired by the policy input unit 101 is not necessarily limited to the access control policy generated by the policy generation device. For example, a user may manually modify a part of the access control policy generated by the policy generation device and input the partially modified access control policy as a draft policy to the policy input unit 101.

[0022] The policy visualization unit 102 visualizes the access control policy and presents it to the user. For example, the policy visualization unit 102 displays information indicating whether access is permitted or denied for each combination of attribute values ​​on a display device not shown in FIG. 2. For example, the policy visualization unit 102 visualizes the access control policy using a table in which attribute values ​​of one attribute are arranged vertically and attribute values ​​of another attribute are arranged horizontally. The policy visualization unit 102 may visualize the action score generated in policy generation in addition to the information indicating whether access is permitted or denied.

[0023] FIG. 3 is a diagram showing a specific example of visualization of an access control policy. In this example, the policy visualization unit 102 visualizes a policy that defines whether access is permitted or denied for each combination of each attribute value of attribute A and each attribute value of attribute B. In the example of FIG. 3, the attribute values ​​of attribute A include attribute values ​​a1 to a5. Furthermore, the attribute values ​​of attribute B include attribute values ​​b1 to b5. In FIG. 3, "allow" indicates that access is permitted, and "deny" indicates that access is denied. The policy visualization unit 102 may, for example, use a predetermined color map to change the display color of the square indicating the combination of attribute values ​​according to the action score.

[0024] By referring to the access control policy visualized by the policy visualization unit 102, the user can know which combinations of attribute values ​​are permitted to access and which combinations of attribute values ​​are denied to access. The user determines whether or not the policy needs to be modified based on the visualized access control policy. If it is determined that the policy needs to be modified, the user inputs the reason for modification, i.e., the reason for the policy modification, into the modification reason input unit 103. The modification reason input unit 103 acquires the reason for modification input by the user. The modification reason input unit 103 corresponds to the modification reason acquisition unit 11 shown in FIG. 1.

[0025] FIG. 4 is a diagram showing an example of selection of a reason for policy modification. In this example, the modification reason input unit 103 displays a total of eight modification reason options on the display device, and prompts the user to select a modification reason. The user can select, for example, "change in personnel information accompanying change in project assignment due to personnel transfer" as the modification reason. When the user selects a modification reason, the modification reason input unit 103 acquires the selected modification reason as the reason for policy modification.

[0026] The user inputs the content of the policy modification to the policy modification unit 104. The policy modification unit 104 modifies the access control policy based on the reason for modification acquired by the modification reason input unit 103 and the content of the policy modification. For example, the policy modification unit 104 stores a learning sample used to generate a draft policy. The policy modification unit 104 modifies the learning sample based on the acquired reason for modification and the content of the policy modification. The policy modification unit 104 generates an access control policy using the modified learning sample and modifies the access control policy. Note that the learning sample does not necessarily have to be stored in the policy modification device 100. The learning sample may be stored in an external database accessible from the policy modification device 100. The policy modification unit 104 corresponds to the policy modification unit 12 shown in FIG. 1.

[0027] FIG. 5 is a block diagram showing an example configuration of the policy modification unit 104. The policy modification unit 104 shown in FIG. 5 includes a modification method determination unit 141, a sample modification unit 142, a feature modification unit 143, and a policy generation unit 144. The modification method determination unit 141 determines a modification method for the learning sample according to the acquired reason for modification. The modification method includes, for example, at least one of changing a sample item, adding a learning sample, and adjusting a feature. The modification method determination unit 141 holds, for example, a table that defines the correspondence between the modification reason and the sample modification method. The modification method determination unit 141 refers to the table and determines, as the modification method for the learning sample, a modification method corresponding to the modification reason acquired by the modification reason input unit 103.

[0028] FIG. 6 is a diagram illustrating an example of a table used to determine a correction method. The table defines a correspondence between a correction reason and an operation corresponding to the correction reason, i.e., a correction method. For example, when a correction reason corresponding to "change of personnel information" is acquired as the correction reason, the correction method determination unit 141 determines that the correction method is to change the sample item. When a correction reason corresponding to "add disclosure information" is acquired as the correction reason, the correction method determination unit 141 determines that the correction method is to add a learning sample. When a correction reason corresponding to "strengthen data protection" is acquired as the correction reason, the correction method determination unit 141 determines that the correction method is to adjust the feature quantity of an attribute related to data confidentiality. When a correction reason corresponding to "improvement of business necessity" is acquired as the correction reason, the correction method determination unit 141 determines that the correction method is to adjust the feature quantity of an attribute related to business necessity.

[0029] The sample correction unit 142 corrects the learning samples used for policy generation according to the correction method determined by the correction method determination unit 141. If the correction method determination unit 141 determines that "add sample" is the correction method, the sample correction unit 142 adds a new learning sample to the learning samples used for policy generation. If the correction method determination unit 141 determines that "change sample item" is the correction method, the sample correction unit 142 changes some items in the learning samples used for policy generation.

[0030] The feature correction unit 143 corrects the feature in the learning sample used for policy generation according to the correction method determined by the correction method determination unit 141. For example, when the correction method determination unit 141 determines that "adjustment of feature of attribute related to data confidentiality" is the correction method, the feature correction unit 143 adjusts the feature related to data confidentiality or security strength in the learning sample.

[0031] 7 is a diagram showing an example of a learning sample used to generate an access control policy. In this example, the learning sample includes attributes of affiliation, data confidentiality level, and data sharing range. The learning sample shown in FIG. 7 can be used to generate an access control policy to be input to the policy input unit 101.

[0032] FIG. 8 is a diagram illustrating an example of a learning sample to which a sample has been added by the sample correction unit 142. For example, assume that "reflecting outsourcer information due to information sharing with an outsourcer" is acquired as the reason for correction. In this case, the correction method determination unit 141 determines adding a sample as the correction method. For example, a database (not shown) stores candidate samples to be added. The sample correction unit 142 acquires a sample corresponding to the acquired reason for correction from the database. For example, the sample correction unit 142 acquires a sample from the database whose affiliation attribute value is "outsourcer," whose data confidentiality attribute value is "4," and whose data sharing range attribute value is "within team." The sample correction unit 142 adds the acquired sample to the learning sample illustrated in FIG. 7. The sample correction unit 142 may prompt the user to input attribute values ​​of the sample to be added, and add a sample including the attribute values ​​input by the user to the learning sample.

[0033] FIG. 9 is a diagram illustrating an example of a learning sample whose sample items have been modified by the sample modification unit 142. For example, assume that "Personnel information change due to user information change" is acquired as the reason for modification. In this case, the modification method determination unit 141 determines sample modification as the modification method. The sample modification unit 142 prompts the user to input attribute values ​​to be modified. The user inputs the modified attribute values ​​for each attribute to be modified. For example, the user inputs "Business Division" as the modified attribute value for affiliation, "3" as the modified attribute value for data confidentiality, and "Within Team" as the modified attribute value for data sharing scope. In this case, as shown in FIG. 9, the sample modification unit 142 changes the attribute value for affiliation from "R&D" to "Business Division," the attribute value for data confidentiality from "1" to "3," and the attribute value for data sharing scope from "Within Team."

[0034] Fig. 10 is a diagram showing an example of a learning sample whose features have been modified by the feature modifying unit 143. In this example, the data confidentiality value has been modified to a value 1.5 times the data confidentiality value in the learning sample shown in Fig. 7. In this case, the influence of the data confidentiality on the generated access control policy becomes higher than the influence before the modification.

[0035] Fig. 11 is a diagram showing another example of a learning sample whose features have been modified by the feature modifying unit 143. In this example, the data confidentiality value has been modified to a value that is 0.75 times the data confidentiality value in the learning sample shown in Fig. 7. In this case, the influence of the data confidentiality on the generated access control policy is lower than the influence before the modification.

[0036] The feature adjustment is performed, for example, according to the following procedure. For example, when a user wants to modify a policy so that access control for a specific combination of attribute values ​​is changed, the user inputs the combination and the changed access control action to the feature correction unit 143. For example, suppose that the user wants to modify the combination of attribute value a1 and attribute value b5 in the access control policy shown in FIG. 3 from "allow" to "deny." In this case, the user inputs the attribute value a1, the attribute value b5, and the changed access control action "deny" to the feature correction unit 143.

[0037] The feature correction unit 143 changes the values ​​of the feature values ​​in the sample and generates an access control policy using the sample with the changed feature values. The feature correction unit 143 determines whether the access control action for the combination of attribute values ​​input by the user in the generated access control policy has changed to the action input by the user. The feature correction unit 143 changes the feature values ​​until the access control action changes. If the access control action changes, the feature correction unit 143 corrects the feature values ​​of the learning sample to the feature values ​​at that time.

[0038] The policy generation unit 144 receives as input samples corrected by the sample correction unit 142 and samples whose features have been corrected by the feature correction unit 143. The policy generation unit 144 retrains the trained model using the input samples. The policy generation unit 144 also generates an access control policy using the retrained trained model. The data input to the trained model in generating the access control policy may be the same as the samples used to retrain the trained model, or a subset thereof. Alternatively, the data input to the trained model may be the same as the samples used to generate the access control policy input to the policy input unit 101. The samples used by the policy generation unit 144 to generate the access control policy have undergone at least one of sample item correction, sample addition, and feature adjustment. Therefore, the retrained trained model changes from the trained model before retraining. Since the access control policy is generated using the retrained trained model, the policy generation unit 144 generates an access control policy that is modified from the original policy acquired by the policy input unit 101.

[0039] Next, the operation procedure will be explained. Fig. 12 is a flowchart showing the operation procedure of the policy modifying device 100. The operation procedure of the policy modifying device 100 corresponds to a policy modification method. A user inputs an access control policy to the policy modifying device 100. In the policy modifying device 100, the policy input unit 101 acquires the access control policy input by the user (step A1). For example, in step A1, the policy input unit 101 acquires the access control policy generated by a policy generating device (not shown) using a learning sample.

[0040] The policy visualization unit 102 visualizes the access control policy acquired in step A1 (step A2). The user refers to the visualized access control policy and determines whether or not the policy needs to be modified. If the user determines that the policy needs to be modified, the user inputs the reason for modification and the content of the modification to the policy modification device 100. In the policy modification device 100, the modification reason input unit 103 acquires the modification reason input by the user (step A3). The modification reason input unit 103 outputs the acquired modification reason to the policy modification unit 104.

[0041] The policy modification unit 104 modifies the learning sample used to generate the access control policy according to the modification reason (step A4). In step A4, the modification method determination unit 141 of the policy modification unit 104 determines a modification method for the learning sample according to the modification method. The sample modification unit 142 changes the sample items or adds samples according to the determined modification method. Alternatively or additionally, the feature modification unit 143 modifies the features included in the learning sample according to the determined modification method.

[0042] The policy modification unit 104 modifies the access control policy using the learning sample modified in step A4 (step A5). In step A5, the policy generation unit 144 of the policy modification unit 104 generates an access control policy using the learning sample in which at least one of a sample item change, a sample addition, or a feature modification has been performed, and modifies the access control policy.

[0043] The policy visualization unit 102 visualizes the access control policy modified in step A5. The user determines whether further modification of the access control policy is necessary. If the user determines that further modification is necessary, the user inputs the reason for modification to the policy modification device 100. The policy modification device 100 repeats steps A2 to A5 until it determines that further modification is not necessary. If the user determines that further modification is not necessary, the policy output unit 105 outputs the access control policy (step A6). The output access control policy is used in an access control device (not shown) that performs access control using the access control policy.

[0044] In this embodiment, when a user modifies an access control policy, the user inputs the reason for the modification to the policy modification device 100. The modification method determination unit 141 of the policy modification unit 104 determines a method for modifying the training samples according to the input reason for the modification. The sample modification unit 142 performs at least one of changing sample items in the training samples and adding training samples according to the determined modification method. The feature modification unit 143 adjusts features in the training samples according to the determined modification method. The policy generation unit 144 modifies the access control policy by generating an access control policy using the training samples on which at least one of changing sample items, adding training samples, and adjusting features has been performed.

[0045] In this embodiment, for example, if the reason for the modification is a change in personnel information due to a change in user information, the sample modification unit 142 modifies the sample items in the training sample. In this case, the policy generation unit 144 retrains the trained model using the training sample with the modified sample items, and generates an access control policy using the retrained trained model. In this way, an access control policy that conforms to the modified personnel information is obtained. Furthermore, if the reason for the modification is information sharing with a new information disclosure destination, the sample modification unit 142 adds information about the new information disclosure destination to the training sample. In this case, the policy generation unit 144 retrains the trained model using the training sample to which the information about the new information disclosure destination has been added, and generates an access control policy using the retrained trained model. In this way, an access control policy that permits access to the new information disclosure destination is obtained.

[0046] If the reason for the modification is to strengthen data protection, the feature modification unit 143 adjusts the feature related to security strength. In this case, the policy generation unit 144 re-trains the trained model using training samples in which the feature related to security strength has been adjusted, and generates an access control policy using the re-trained trained model. In this way, an access control policy with strengthened data protection is obtained. If the reason for the modification is to improve user convenience by expanding the data sharing range, the feature modification unit 143 adjusts the feature related to the data disclosure range. In this case, the policy generation unit 144 re-trains the trained model using training samples in which the feature related to the data disclosure range has been adjusted, and generates an access control policy using the re-trained trained model. In this way, an access control policy with an expanded data sharing range is obtained.

[0047] In this embodiment, the policy modification device 100 modifies a learning sample according to the modification reason input by the user, and generates an access control policy using the modified learning sample. In this embodiment, the policy modification device 100 can modify many policies at once based on the modification reason. Therefore, in this embodiment, the user does not need to manually modify each access control policy one by one, and can modify the access control policy without requiring a huge amount of manual work.

[0048] Next, a second embodiment will be described. Fig. 13 is a block diagram showing an example configuration of a second policy modifying device according to the present disclosure. The policy modifying device 100a shown in Fig. 13 includes a reference information display unit 106 in addition to the configuration of the policy modifying device 100 shown in Fig. 2. The reference information display unit 106 calculates the degree of influence of an attribute value or attribute on access control based on an access control policy. The reference information display unit 106 calculates the degree of influence of an attribute value or attribute on access control based on, for example, the access control policy acquired by the policy input unit 101. The reference information display unit 106 displays the degree of influence of the attribute value or attribute on access control as reference information or auxiliary information on a display device.

[0049] The reference information display unit 106 calculates the degree of influence of an attribute value or attribute on access control, for example, based on the action score generated by the policy generation device. For example, the value range of the action score is from 0 to 1. The closer the action score is to 0, the higher the probability of access denial, and the closer the action score is to 1, the higher the probability of access permission. The reference information display unit 106 may calculate the degree of influence of an attribute value or attribute on access control, for example, by setting access control allow to 1 and access control deny to 0.

[0050] The reference information display unit 106 calculates, for example, a statistical value of the action score or a combination of multiple statistical values ​​for each attribute value or for each attribute, as a measure of the influence. For example, the reference information display unit 106 calculates, for example, for each attribute value, the average value, standard deviation or variance, maximum value, minimum value, or difference between the maximum and maximum values ​​of the action scores as a measure of the influence. Alternatively, the reference information display unit 106 may calculate, for each attribute, the average value, standard deviation or variance, maximum value, minimum value, or difference between the maximum and maximum values ​​of the action scores as a measure of the influence. The reference information display unit 106 displays the calculated measure of the influence on a display device as reference information.

[0051] FIG. 14 is a diagram illustrating an example of reference information. For example, the reference information display unit 106 calculates the average value of the action score for each attribute value of the attribute src.zone.type as a measure of influence. In the example illustrated in FIG. 14, the attribute src.zone.type includes attribute values ​​ANY, ICS_DMZ, CORPORATE_NW, NW_MNG_NW, ICS_NW, and INTERNET. For example, when a user requests display of reference information for the attribute src.zone.type, the reference information display unit 106 displays the average value of the action score for each attribute value illustrated in FIG. 14 on the display as reference information. By referring to the reference information, the user can know the attribute values ​​in the attribute src.zone.type that have a high influence on access control.

[0052] FIG. 15 is a diagram showing another example of reference information. For example, for attribute A, the reference information display unit 106 calculates the average value of the action scores for each of the multiple attribute values ​​of attribute A. For attribute A, the reference information display unit 106 calculates the difference between the maximum and minimum of the average values ​​of the action scores calculated for each attribute value as a measure of the influence of attribute A. Similarly, for other attributes B to D, the reference information display unit 106 calculates the difference between the maximum and minimum of the average values ​​of the action scores calculated for each attribute value as a measure of the influence of each attribute. For example, when a user requests that a comparison of the influence measures between multiple attributes be displayed as reference information, the reference information display unit 106 displays the influence measures for each attribute shown in FIG. 15 on the display as reference information.

[0053] Next, the operation procedure will be explained. Fig. 16 is a flowchart showing the operation procedure of the policy modifying device 100a. A user inputs an access control policy to the policy modifying device 100. In the policy modifying device 100, the policy input unit 101 acquires the access control policy input by the user (step B1). The policy visualization unit 102 visualizes the access control policy acquired in step B1 (step B2). Steps B1 and B2 may be similar to steps A1 and A2 shown in Fig. 12.

[0054] The reference information display unit 106 generates reference information based on the access control policy acquired in step B1, and displays the generated reference information on the display device (step B3). In step B3, the reference information display unit 106 may, for example, calculate statistics of action scores for each attribute value, and generate the statistical values ​​of action scores for each attribute value as reference information. The reference information display unit 106 may also calculate statistics of action scores for each attribute, and generate the statistical values ​​of action scores for each attribute as reference information.

[0055] The user refers to the visualized access control policy and the reference information and determines whether or not the policy needs to be modified. If the user determines that the policy needs to be modified, the user inputs the reason for modification and the content of the modification to the policy modification device 100. In the policy modification device 100, the modification reason input unit 103 acquires the modification reason input by the user (step B4). The modification reason input unit 103 outputs the acquired modification reason to the policy modification unit 104.

[0056] The policy modification unit 104 modifies the learning sample used to generate the access control policy according to the reason for modification (step B5). The policy modification unit 104 modifies the access control policy using the learning sample modified in step B5 (step B6). Steps B4 to B6 may be similar to steps A3 to A5 shown in FIG. 12.

[0057] The policy visualization unit 102 visualizes the modified access control policy in step B6. The user determines whether further modification of the access control policy is necessary. If the user determines that further modification is necessary, the user inputs the reason for modification to the policy modification device 100. The policy modification device 100 repeats steps B2 to B6 until it determines that further modification is not necessary. If the user determines that further modification is not necessary, the policy output unit 105 outputs the access control policy (step B7). The output access control policy is used in an access control device (not shown) that performs access control using the access control policy.

[0058] In this embodiment, the reference information display unit 106 provides the user with the degree of influence of attribute values ​​or attributes in the access control policy on access control actions as auxiliary information for policy modification. By referring to the reference information, the user can know whether the attribute values ​​or attributes in the access control policy are biased toward allow or biased toward deny. In this embodiment, the user can use such reference information to determine which attribute values ​​or attributes to focus on when modifying the policy. In this embodiment, the policy modifying device 100a can assist the user in determining the parts to modify and selecting the reason for the modification through the display of the reference information, thereby improving user convenience.

[0059] In the above description, an example has been described in which the policy visualization unit 102 visualizes the access control policy, and then the reference information display unit 106 displays the reference information. However, this embodiment is not limited to this. For example, the policy visualization unit 102 may visualize the access control policy after the reference information display unit 106 displays the reference information on a display. In this case, the user can refer to the reference information to examine the influence of the attribute value or attribute on access control, and then refer to the visualized access control policy. For example, the user may specify the range in which the access control policy is visualized in the policy visualization unit 102, depending on the reference information.

[0060] Next, we will explain the physical configuration of the policy modification device 100. Fig. 17 is a block diagram showing an example of the configuration of a computer device that can be used as the policy modification device 100. The computer device 500 has a processor 510 such as a CPU (Central Processing Unit), a storage unit 520, a ROM (Read Only Memory) 530, a RAM (Random Access Memory) 540, a communication interface (IF: Interface) 550, and a user interface 560.

[0061] The communication interface 550 is an interface for connecting the computer device 500 to a communication network via wired communication means or wireless communication means, etc. The user interface 560 includes a display unit such as a display, and an input unit such as a keyboard, a mouse, and a touch panel.

[0062] The storage unit 520 is an auxiliary storage device that can store various types of data. The storage unit 520 does not necessarily have to be a part of the computer device 500, but may be an external storage device or a cloud storage connected to the computer device 500 via a network.

[0063] The ROM 530 is a non-volatile storage device. For example, a semiconductor storage device such as a flash memory with a relatively small capacity is used for the ROM 530. The programs executed by the CPU 510 can be stored in the storage unit 520 or the ROM 530. The storage unit 520 or the ROM 530 stores various programs that realize the functions of each unit of the policy modifying device 100.

[0064] The program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include RAM, ROM, flash memory, solid-state drive (SSD) or other memory technology, compact discs (CDs), digital versatile discs (DVDs), Blu-ray discs or other optical disc storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices. The program may also be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0065] The RAM 540 is a volatile storage device. Various semiconductor memory devices such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) are used for the RAM 540. The RAM 540 can be used as an internal buffer for temporarily storing data, etc. The CPU 510 loads a program stored in the storage unit 520 or the ROM 530 into the RAM 540 and executes it. The CPU 510 executes the program, thereby realizing the functions of each unit in the policy modification device 100. The CPU 510 may have an internal buffer for temporarily storing data, etc.

[0066] In the present disclosure, the policy modifying device 100 does not necessarily have to be configured as a single device, but may be configured using a plurality of physically separated devices.

[0067] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Each embodiment can be combined with other embodiments as appropriate.

[0068] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0069] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0070] [Appendix 1] Obtain a reason for modifying the access control policy, which is an access control policy; modifying a learning sample used to generate an access control policy in accordance with the acquired modification reason; A policy modification method for modifying the access control policy using the modified training sample.

[0071] [Appendix 2] The policy modification method according to claim 1, further comprising visualizing the access control policy.

[0072] [Appendix 3] determining a method for correcting the learning sample according to the acquired reason for correction; modifying the training samples by performing at least one of changing sample items in the training samples, adding the training samples, and adjusting feature quantities in the training samples according to the determined modification method; 3. The policy modification method according to claim 1, further comprising: modifying the access control policy by generating the access control policy using the modified training sample.

[0073] [Appendix 4] 4. The policy modification method according to any one of Supplementary Notes 1 to 3, wherein the access control policy includes a combination of attribute information and an access control action for the combination of attribute information.

[0074] [Appendix 5] The policy modification method according to claim 4, further comprising displaying an attribute value in the access control policy or an influence of the attribute on the action as reference information.

[0075] [Appendix 6] A policy modification method according to claim 5, wherein in generating the access control policy, the action is determined based on an action score, and the influence of the attribute value or attribute on the action is calculated based on the action score.

[0076] [Appendix 7] a modification reason acquisition unit that acquires a modification reason for an access control policy that is an access control policy; a policy modification unit that modifies a learning sample used to generate an access control policy according to the acquired reason for modification, and modifies the access control policy using the modified learning sample.

[0077] [Appendix 8] 8. The policy modifying device according to claim 7, further comprising a policy visualization unit that visualizes the access control policy.

[0078] [Appendix 9] The policy modification unit a correction method determination unit that determines a method for correcting the learning sample in accordance with the acquired correction reason; a sample modification unit that performs at least one of changing sample items in the training samples and adding training samples according to the determined modification method; a feature correction unit that adjusts the features of the training samples in accordance with the determined correction method; and a policy generation unit that generates the access control policy using the changed learning sample, thereby modifying the access control policy.

[0079] [Appendix 10] 10. The policy modifying device according to any one of appendices 7 to 9, wherein the access control policy includes a combination of attribute information and an access control action for the combination of attribute information.

[0080] [Appendix 11] 11. The policy modifying device according to claim 10, further comprising a reference information display unit that displays an attribute value in the access control policy or an influence of the attribute on the action as reference information.

[0081] [Appendix 12] A policy modification device as described in Appendix 11, wherein in generating the access control policy, the action is determined based on an action score, and the reference information display unit calculates the influence of the attribute value or attribute on the action based on the action score.

[0082] [Appendix 13] Obtain a reason for modifying the access control policy, which is an access control policy; modifying a learning sample used to generate an access control policy in accordance with the acquired modification reason; a program causing a computer to execute a process including modifying the access control policy using the changed training sample;

[0083] Some or all of the elements (e.g., configurations and functions) described in Supplementary Notes 2 to 6 that are dependent on Supplementary Note 1 may also be dependent on Supplementary Note 13 in the same dependency relationship as Supplementary Notes 2 to 6. Some or all of the elements described in any Supplementary Note may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0084] 10: Policy modification device 11: Correction reason acquisition section 12: Policy modification section 100: Policy modification device 101: Policy input section 102: Policy visualization department 103: Correction reason input section 104: Policy Modification Section 105: Policy output unit 106: Reference information display section 141: Correction method determination section 142: Sample correction section 143: Feature correction unit 144: Policy generation unit

Claims

1. Obtain a reason for modifying the access control policy, which is an access control policy; modifying a learning sample used to generate an access control policy in accordance with the acquired modification reason; A policy modification method for modifying the access control policy using the modified training sample.

2. The policy modification method according to claim 1 , further comprising the step of visualizing the access control policy.

3. determining a method for correcting the learning sample according to the acquired reason for correction; modifying the training samples by performing at least one of changing sample items in the training samples, adding the training samples, and adjusting feature quantities in the training samples according to the determined modification method; The policy modification method according to claim 1 , further comprising the step of modifying the access control policy by generating the access control policy using the modified learning sample.

4. 3. The policy modification method according to claim 1, wherein the access control policy includes a combination of attribute information and an access control action for the combination of attribute information.

5. 5. The policy modification method according to claim 4, further comprising displaying, as reference information, an attribute value in the access control policy or a degree of influence of the attribute on the action.

6. 6. The policy modification method according to claim 5, wherein in generating the access control policy, the action is determined based on an action score, and the degree of influence of the attribute value or attribute on the action is calculated based on the action score.

7. a modification reason acquisition unit that acquires a modification reason for an access control policy that is an access control policy; a policy modification unit that modifies a learning sample used to generate an access control policy according to the acquired reason for modification, and modifies the access control policy using the modified learning sample.

8. 8. The policy modifying device according to claim 7, further comprising a policy visualization unit that visualizes the access control policy.

9. The policy modification unit a correction method determination unit that determines a method for correcting the learning sample in accordance with the acquired correction reason; a sample modification unit that performs at least one of changing sample items in the training samples and adding training samples according to the determined modification method; a feature correction unit that adjusts the features of the training samples in accordance with the determined correction method; 9. The policy modifying device according to claim 7, further comprising: a policy generating unit that modifies the access control policy by generating the access control policy using the changed learning sample.

10. 9. The policy modifying device according to claim 7, wherein the access control policy includes a combination of attribute information and an access control action for the combination of attribute information.

11. 11. The policy modifying device according to claim 10, further comprising a reference information display unit that displays, as reference information, an attribute value in the access control policy or an influence of the attribute on the action.

12. 12. The policy modification device according to claim 11, wherein in generating the access control policy, the action is determined based on an action score, and the reference information display unit calculates the influence of the attribute value or attribute on the action based on the action score.

13. Obtain a reason for modifying the access control policy, which is an access control policy; modifying a learning sample used to generate an access control policy in accordance with the acquired modification reason; a program causing a computer to execute a process including modifying the access control policy using the changed training sample;

Images