Program, method, information processing apparatus, and system

Abstract

To take quick measures when there is a problem in use of a service.SOLUTION: A program for causing a computer including a processor and a memory to execute: The program causes the processor to execute a step of acquiring information on a process executed by a user, a step of acquiring information on a service associated with the process based on the acquired process, and a step of determining whether or not the acquired information on the service is a service to be managed.SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present disclosure relates to a program, a method, an information processing device, and a system. [Background technology]

[0002] In recent years, the use of SaaS (Software as a Service) has been expanding. In SaaS, software running on a server is provided to users as a service via a network such as the Internet. Patent Document 1 describes an information processing device and the like that can identify the service being used. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7044451 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, a server receives the results of monitoring the access log by the terminal device, and identifies services that are not managed by the server. However, by processing the information on the server, it is difficult to take prompt action if there is a problem with the use of the service.

[0005] The purpose of this disclosure is to enable quick action to be taken when there is a problem with using the service. [Means for solving the problem]

[0006] The program is executed by a computer having a processor and a memory, and causes the processor to execute the steps of acquiring information about a process executed by a user, acquiring information about a service associated with the process based on the acquired information about the process, and determining whether the acquired information about the service is a service to be managed. [Effects of the Invention]

[0007] According to the present disclosure, if there is a problem with using a service, a quick response can be taken. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a system 1. FIG. [Figure 2] 2 is a block diagram illustrating an example of the configuration of a terminal device 10 shown in FIG. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of a first server 20. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a second server 30. [Figure 5] FIG. 10 is a diagram showing the data structure of a correspondence table 182. [Figure 6] FIG. 10 is a diagram showing the data structure of an account table 183. [Figure 7] FIG. 10 is a diagram illustrating the data structure of a SaaS table 184. [Figure 8] FIG. 10 is a diagram showing the data structure of a determination result table 185. [Figure 9] FIG. 10 is a diagram showing the data structure of a restriction table 186. [Figure 10] 10 is a diagram showing the data structure of an aggregation table 2022 stored in the first server 20. FIG. [Figure 11] FIG. 10 is a schematic diagram showing a process in which an agent application 187 installed in the terminal device 10 monitors a process performed by a user. [Figure 12]10 is a flowchart illustrating an example of the operation of the terminal device 10 when monitoring the user's actions. [Figure 13] 2 is a schematic diagram illustrating an example of a display screen of a display 141 of a terminal device 10. FIG. [Figure 14] FIG. 2 is a block diagram showing the basic hardware configuration of a computer 90. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. The names and functions of the components are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0010] <Summary> An agent application is installed on a terminal device, and an agent realized by the agent application monitors actions performed by a user. The agent identifies the service being used by the user based on the detected actions, and determines whether the identified service is a service to be managed.

[0011] The agent transmits the determination result to the server in accordance with the determination result, and also restricts the operation of the terminal device in accordance with the determination result.

[0012] <1 Overall system configuration> Fig. 1 is a block diagram showing an example of the overall configuration of a system 1. The system 1 shown in Fig. 1 includes, for example, a terminal device 10, a first server 20, and a second server 30. The terminal device 10, the first server 20, and the second server 30 are communicatively connected via, for example, a network 80.

[0013] 1 shows an example in which the system 1 includes two terminal devices 10, but the number of terminal devices 10 included in the system 1 is not limited to two. The number of terminal devices 10 included in the system 1 may be less than three, or may be three or more.

[0014] 1, a collection of multiple devices may be considered as one first server 20. The way in which multiple functions required to realize the first server 20 according to this embodiment are allocated to one or multiple pieces of hardware can be determined appropriately in consideration of the processing capacity of each piece of hardware and / or the specifications required for the first server 20.

[0015] 1, a collection of multiple devices may be treated as one second server 30. The way in which multiple functions required to realize the second server 30 according to this embodiment are allocated to one or multiple pieces of hardware can be determined appropriately in consideration of the processing capacity of each piece of hardware and / or the specifications required for the second server 30.

[0016] 1 is, for example, an information processing device operated by a user. Specifically, for example, the terminal device 10 is an information processing device operated by an employee of a company.

[0017] The terminal device 10 is realized by, for example, a desktop PC, a laptop PC, etc. The terminal device 10 may be, for example, a mobile terminal such as a smartphone or a tablet, etc. The terminal device 10 may be a wearable terminal such as an HMD (Head Mount Display) or a wristwatch-type terminal.

[0018] The terminal device 10 includes a communication IF (Interface) 12, an input device 13, an output device 14, a memory 15, a storage 16, and a processor 19. The input device 13 is a device for receiving input operations from a user (for example, a touch panel, a touch pad, a pointing device such as a mouse, a keyboard, etc.). The output device 14 is a device for presenting information to a user (a display, a speaker, etc.).

[0019] The first server 20 is, for example, an information processing device that manages web services used by employees of a company. The first server 20 is realized by, for example, a computer connected to a network 80. As shown in Fig. 1, the first server 20 includes a communication IF 22, an input / output IF 23, a memory 25, a storage 26, and a processor 29. The input / output IF 23 functions as an input device for receiving input operations from a user and as an interface with an output device for outputting information to the user.

[0020] The second server 30 is, for example, an information processing device that provides web services used by employees of a company. That is, the second server 30 is, for example, an information processing device that provides SaaS (Software as a Service). The second server 30 issues accounts to employees based on, for example, a contract with the company. The employees use the web services via the assigned accounts. The second server 30 is, for example, realized by a computer connected to the network 80. The second server 30 has, for example, a configuration similar to that of the first server 20 in FIG. 1.

[0021] Each information processing device is configured by a computer equipped with an arithmetic unit and a storage device. The basic hardware configuration of the computer and the basic functional configuration of the computer realized by the hardware configuration will be described later. For each of the terminal device 10, the first server 20, and the second server 30, descriptions that overlap with the basic hardware configuration and basic functional configuration of the computer will be omitted.

[0022] <1.1 Terminal device configuration> Fig. 2 is a block diagram showing an example configuration of the terminal device 10 shown in Fig. 1. As shown in Fig. 2, the terminal device 10 includes a communication unit 120, an input device 13, an output device 14, an audio processing unit 17, a microphone 171, a speaker 172, a camera 160, a position information sensor 150, a storage unit 180, and a control unit 190. The blocks included in the terminal device 10 are electrically connected by, for example, a bus or the like.

[0023] The communication unit 120 performs processing such as modulation and demodulation for the terminal device 10 to communicate with other devices. The communication unit 120 performs transmission processing on the signal generated by the control unit 190 and transmits it to the outside (for example, the first server 20 or the second server 30). The communication unit 120 performs reception processing on the signal received from the outside and outputs it to the control unit 190.

[0024] The input device 13 is a device for inputting instructions or information by a user operating the terminal device 10. The input device 13 is realized, for example, by a touch-sensitive device 131 or the like, which inputs instructions by touching an operation surface. When the terminal device 10 is a PC or the like, the input device 13 may be realized by a reader, keyboard, mouse, or the like. The input device 13 converts instructions input by the user into electrical signals and outputs the electrical signals to the control unit 190. The input device 13 may include, for example, a receiving port that receives electrical signals input from an external input device.

[0025] The output device 14 is a device for presenting information to a user operating the terminal device 10. The output device 14 is realized, for example, by a display 141 or the like. The display 141 displays data according to the control of the control unit 190. The display 141 is realized, for example, by an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display or the like.

[0026] The audio processing unit 17 performs, for example, digital-to-analog conversion processing of an audio signal. The audio processing unit 17 converts a signal provided from the microphone 171 into a digital signal and provides the converted signal to the control unit 190. The audio processing unit 17 also provides the audio signal to the speaker 172. The audio processing unit 17 is realized, for example, by a processor for audio processing. The microphone 171 receives audio input and provides an audio signal corresponding to the audio input to the audio processing unit 17. The speaker 172 converts the audio signal provided from the audio processing unit 17 into audio and outputs the audio to the outside of the terminal device 10.

[0027] The camera 160 is a device that receives light with a light receiving element and outputs the light as an image capturing signal.

[0028] The position information sensor 150 is a sensor that detects the position of the terminal device 10, and is, for example, a GPS (Global Positioning System) module. The GPS module is a receiving device used in a satellite positioning system. In the satellite positioning system, signals are received from at least three or four satellites, and the current position of the terminal device 10 equipped with the GPS module is detected based on the received signals. The position information sensor 150 may detect the current position of the terminal device 10 from the position of the wireless base station to which the terminal device 10 is connected.

[0029] The storage unit 180 is realized by, for example, the memory 15, the storage 16, etc., and stores data and programs used by the terminal device 10. The storage unit 180 stores, for example, user information 181, a correspondence table 182, an account table 183, a SaaS table 184, a judgment result table 185, a restriction table 186, and an agent application 187. The tables and applications stored in the storage unit 180 are not limited to these.

[0030] The user information 181 includes, for example, information about the user who uses the terminal device 10. The information about the user includes, for example, a user ID, the user's name, age, address, date of birth, password, contact information (address), and the like.

[0031] The correspondence table 182 is a table that associates SaaS with processes executed by a user. Details will be described later. The correspondence table 182 is based on, for example, master information stored in the first server 20. For example, when the master information is updated, the correspondence table 182 is kept up to date by downloading the entire master information or the updated parts from the first server 20.

[0032] The account table 183 is a table that stores information about accounts set for users. Details will be described later. The account table 183 is based on, for example, master information stored in the first server 20. For example, when the master information is updated, the account table 183 is kept up to date by downloading the entire master information or the updated parts from the first server 20.

[0033] The SaaS table 184 is a table that stores SaaS to be managed. The SaaS stored in the SaaS table 184 is, for example, SaaS that is not permitted to be used. In other words, the SaaS table 184 is a blacklist. The SaaS stored in the SaaS table 184 may also be, for example, SaaS that is permitted to be used. In other words, the SaaS table 184 may be a whitelist. This will be described in detail later. The SaaS table 184 is based on, for example, master information stored in the first server 20. For example, when the master information is updated, the entire master information or only the updated parts are downloaded from the first server 20, thereby keeping the SaaS table 184 up to date.

[0034] The determination result table 185 is a table that stores the results of determinations made based on the detected processes, as will be described in detail later.

[0035] The restriction table 186 is a table that associates the judgment result with the restriction on the operation of the terminal device 10. Details will be described later. The restriction table 186 is based on, for example, master information stored in the first server 20. For example, when the master information is updated, the restriction table 186 is kept up to date by downloading the entire master information or the updated parts from the first server 20.

[0036] The agent application 187 is an application for managing the use of SaaS by a user. The agent application 187 is installed on the terminal device 10. The agent application 187 runs, for example, in the background of other applications installed on the terminal device 10, and monitors processes executed by the user.

[0037] The control unit 190 is realized by the processor 19 reading a program including the agent application 187 stored in the storage unit 180 and executing instructions included in the program. The control unit 190 controls the operation of the terminal device 10. By operating in accordance with the program, the control unit 190 fulfills the functions of an operation reception unit 191, a transmission / reception unit 192, a presentation control unit 193, a first acquisition unit 194, a second acquisition unit 195, a determination unit 196, and a restriction unit 197.

[0038] The operation reception unit 191 performs processing for receiving instructions or information input from the input device 13. Specifically, for example, the operation reception unit 191 receives instructions or information input from the touch-sensitive device 131 or the like.

[0039] Furthermore, the operation reception unit 191 receives voice instructions input from the microphone 171. Specifically, for example, the operation reception unit 191 receives a voice signal that is input from the microphone 171 and converted into a digital signal by the voice processing unit 17. For example, the operation reception unit 191 analyzes the received voice signal and extracts a predetermined noun, thereby acquiring an instruction from the user.

[0040] The transmitting / receiving unit 192 performs processing for the terminal device 10 to transmit and receive data to and from an external device such as the first server 20 or the second server 30 in accordance with a communication protocol. Specifically, for example, the transmitting / receiving unit 192 transmits information input by the user or instructions from the user to the first server 20 or the second server 30. In addition, the transmitting / receiving unit 192 receives information provided from the first server 20 or the second server 30.

[0041] The presentation control unit 193 controls the output device 14 to present information provided from the first server 20 or the second server 30 to the user. Specifically, for example, the presentation control unit 193 causes the information provided from the first server 20 or the second server 30 to be displayed on the display 141. In addition, the presentation control unit 193 causes the information provided from the first server 20 or the second server 30 to be output from the speaker 172.

[0042] The first acquisition unit 194 acquires information about a process executed by a user operating the terminal device 10. Specifically, for example, the first acquisition unit 194 acquires the name of an application executed by the user's operation and the process name of the application. The first acquisition unit 194 stores the acquired application name, process name, and the date and time when this information was acquired in the storage unit 180 (not shown).

[0043] Furthermore, the first acquisition unit 194 acquires information generated when the user operates the browser. The information generated when the user operates the browser is, for example, the browser usage history, and more specifically, the URLs and page titles of web pages visited by the user operating the browser. The first acquisition unit 194 acquires the information generated when the browser is operated from the browser used in the terminal device 10 at a predetermined timing, for example, at a predetermined cycle such as every five minutes. The first acquisition unit 194 stores the acquired information, the date and time when the information was acquired, the name of the browser that acquired the information, and identification information of the terminal device 10 (for example, a device GUID) in the storage unit 180 (not shown).

[0044] The second acquisition unit 195 acquires information about the SaaS used by the user based on information about the process executed by the user. Specifically, for example, the second acquisition unit 195 compares the URL of the web page visited by the user with the correspondence table 182 and acquires the SaaSID of the SaaS used by the user. In this way, the second acquisition unit 195 identifies the SaaS used by the user.

[0045] The determination unit 196 determines whether the SaaS used by the user is a SaaS to be managed based on the acquired SaaSID. In response to the determination, the determination unit 196 stores the determination result in the determination result table 185. This can be rephrased as, for example, the determination unit 196 stores in the determination result table 185 the process to be managed that has been executed by the user.

[0046] Specifically, for example, the determination unit 196 refers to the SaaS table 184, or refers to the account table 183 and the SaaS table 184, and determines whether the user's use of SaaS is appropriate.

[0047] More specifically, for example, if SaaS table 184 is a blacklist and SaaS whose use is prohibited (SaaS to be managed) is included in SaaS table 184, determination unit 196 determines whether the acquired SaaSID is included in SaaS table 184. If the acquired SaaSID is included in SaaS table 184, determination unit 196 stores in determination result table 185 the fact that the user has used SaaS whose use is not permitted. If the acquired SaaSID is not included in SaaS table 184, determination unit 196 refers to account table 183 and determines whether the user has an account for the acquired SaaSID. If the user has an account for the acquired SaaSID, determination unit 196 does not store information in determination result table 185. If the user does not have an account for the acquired SaaSID, determination unit 196 stores in determination result table 185 the fact that the user used the SaaS using a shadow ID.

[0048] Furthermore, for example, if the SaaS table 184 is a whitelist and the SaaS table 184 includes a SaaS whose use is permitted (a SaaS to be managed), the determination unit 196 determines whether the acquired SaaSID is included in the SaaS table 184. If the acquired SaaSID is not included in the SaaS table 184, the determination unit 196 stores in the determination result table 185 the fact that the user has used a SaaS whose use is not permitted. If the acquired SaaSID is included in the SaaS table 184, the determination unit 196 refers to the account table 183 and determines whether the user has an account for the acquired SaaSID. If the user has an account for the acquired SaaSID, the determination unit 196 does not store information in the determination result table 185. If the user does not have an account for the acquired SaaSID, the determination unit 196 stores in the determination result table 185 the fact that the user used the SaaS using a shadow ID.

[0049] The transmitting / receiving unit 192 transmits the judgment results stored in the judgment result table 185 to the first server 20. Specifically, for example, the transmitting / receiving unit 192 transmits the judgment results stored in the judgment result table 185 to the first server 20 at a predetermined interval.

[0050] The transmitting / receiving unit 192 does not have to transmit all of the judgment results stored in the judgment result table 185 to the first server 20. For example, the transmitting / receiving unit 192 may transmit to the first server 20, from among the judgment results stored in the judgment result table 185, those that satisfy a predetermined condition. Specifically, for example, the transmitting / receiving unit 192 determines whether or not the judgment results stored in the judgment result table 185 satisfy a predetermined condition. The predetermined condition includes, for example, the following: - Blacklisted SaaS was used The number of times the same decision has been made has reached a predetermined value. - The number of times the same decision has been made within a specified period of time has reached a specified value.

[0051] For example, if the determination result stored in the determination result table 185 satisfies at least one of the above conditions or at least one combination of the above conditions, the transmitting / receiving unit 192 transmits the determination result to the first server 20.

[0052] The restriction unit 197 imposes restrictions on the operation of the terminal device 10 based on the determination result of the determination unit 196. That is, the restriction unit 197 imposes restrictions on the operation of the processor of the terminal device 10 based on the determination result of the determination unit 196. Specifically, for example, the restriction unit 197 determines whether the determination result stored in the determination result table 185 satisfies a predetermined condition. The predetermined condition includes, for example, the following: - Blacklisted SaaS was used The number of times the same decision has been made has reached a predetermined value. - The number of times the same decision has been made within a specified period of time has reached a specified value. The user has the required permissions.

[0053] For example, when the judgment results stored in the judgment result table 185 satisfy at least one of the above conditions or at least one combination of the above conditions, the restriction unit 197 imposes a predetermined restriction on the operation of the terminal device 10. The predetermined restriction includes, for example, the following: - Prevent any operations on the terminal device 10 from being accepted - Prohibition of access to specified URLs - Prohibit execution of specified applications -Prohibit access to specified folders - Preventing execution of specified files - Prohibition of certain operations such as reading and writing Stopping running applications

[0054] The determination result and the restrictions on the operation of the terminal device 10 are stored, for example, in the restriction table 186. The restriction unit 197, for example, collates the determination result of the determination unit 196 with the restriction table 186 and determines the restrictions on the operation of the terminal device 10.

[0055] <1.2 Functional configuration of the first server> 3 is a diagram illustrating an example of the functional configuration of the first server 20. As illustrated in FIG. 3, the first server 20 functions as a communication unit 201, a storage unit 202, and a control unit 203.

[0056] The communication unit 201 performs processing for the first server 20 to communicate with external devices.

[0057] The storage unit 202 includes, for example, a user information table 2021, an aggregation table 2022, a correspondence master table 2023, an account master table 2024, a SaaS master table 2025, and a restriction master table 2026. The tables stored in the storage unit 202 are not limited to these.

[0058] The user information table 2021 is a table that stores information about users as employees. The user information table 2021 stores, for example, information about a plurality of users. The user information table 2021 is updated when information about a new user is registered.

[0059] The tallying table 2022 is a table that stores information that tally the judgment results transmitted from the terminal device 10. For example, the human resources department of the company that manages the first server 20 may refer to the tallying table 2022 to evaluate the user.

[0060] The correspondence master table 2023 is a table that stores master information on the correspondence between SaaS and processes executed by a user. The correspondence master table 2023 is updated whenever a new correspondence between SaaS and information related to an operation is registered.

[0061] The account master table 2024 is a table that stores information about accounts set for multiple users. The account master table 2024 is updated whenever a new account is issued.

[0062] The SaaS master table 2025 is a table that stores master information of SaaS to be managed, and is updated whenever a new SaaS is registered.

[0063] The restriction master table 2026 is a table that stores master information of the correspondence between the judgment result and the restrictions on the operation of the terminal device 10. The restriction master table 2026 is updated whenever a new correspondence between the judgment result and the restrictions on the operation of the terminal device 10 is registered.

[0064] The control unit 203 is realized by the processor 29 reading a program stored in the storage unit 202 and executing instructions included in the program. The control unit 203 operates in accordance with the program to perform functions shown as a reception control module 2031, a transmission control module 2032, a counting module 2033, a management module 2034, and a creation module 2035.

[0065] The reception control module 2031 controls the process in which the first server 20 receives a signal from an external device in accordance with a communication protocol.

[0066] The transmission control module 2032 controls the process in which the first server 20 transmits a signal to an external device in accordance with a communication protocol.

[0067] The tallying module 2033 controls the tallying of the determination results transmitted from the terminal device 10. Specifically, for example, the tallying module 2033 updates the tallying table 2022 based on the determination results transmitted from the terminal device 10.

[0068] The management module 2034 manages information stored in the storage unit 202. Specifically, for example, when there is information about a new user, the management module 2034 updates the user information table 2021. Also, for example, when there is a new correspondence between a SaaS and a process executed by a user, the management module 2034 updates the correspondence master table 2023. Also, for example, when a new account is issued, the management module 2034 updates the account master table 2024. Also, for example, when there is a new SaaS, the management module 2034 updates the SaaS master table 2025. Also, for example, when there is a new correspondence between a determination result and an operational restriction on the terminal device 10, the management module 2034 updates the restriction master table 2026.

[0069] The creation module 2035 creates information that lists predetermined information based on information transmitted from the terminal device 10. Specifically, the creation module 2035 identifies the hardware used by the user based on the identification information of the terminal device 10 transmitted from the terminal device 10. The creation module 2035 creates information that lists the hardware and software (applications and SaaS) used by the user.

[0070] <1.3 Functional configuration of the second server> 4 is a diagram illustrating an example of the functional configuration of the second server 30. As illustrated in FIG. 4, the second server 30 functions as a communication unit 301, a storage unit 302, and a control unit 303.

[0071] The communication unit 301 performs processing for the second server 30 to communicate with external devices.

[0072] The storage unit 302 includes, for example, a user information table 3021. The tables stored in the storage unit 302 are not limited to these. For example, a table other than the user information table 3021 may be stored.

[0073] The user information table 3021 is a table that stores information about users of companies that receive services provided by the second server 30, for example.

[0074] The control unit 303 is realized by the processor reading a program stored in the storage unit 302 and executing instructions included in the program. The control unit 303 operates in accordance with the program to perform functions shown as a reception control module 3031, a transmission control module 3032, and a service providing module 3033.

[0075] The reception control module 3031 controls the process in which the second server 30 receives a signal from an external device in accordance with a communication protocol.

[0076] The transmission control module 3032 controls the process in which the second server 30 transmits a signal to an external device in accordance with a communication protocol.

[0077] The service providing module 3033 provides services to users of a company that receives the services provided by the second server 30, for example.

[0078] <2 Data Structure> 5 to 9 are diagrams showing the data structures of tables stored in the terminal device 10. Note that Figs. 5 to 9 are merely examples and do not exclude data that is not listed. Furthermore, even data that is listed in the same table may be stored in separate storage areas in the storage unit 180.

[0079] Fig. 5 is a diagram showing the data structure of correspondence table 182. Correspondence table 182 shown in Fig. 5 is a table having columns such as URL, with SaaSID as a key. Note that correspondence table 182 may also have columns for storing information other than the above.

[0080] The SaaSID is an item that stores an identifier for uniquely identifying the SaaS. The URL is an example of information that indicates that the SaaS has been executed. The "URL" item stores, for example, the URL of the homepage that provides the corresponding SaaS.

[0081] Fig. 6 is a diagram showing the data structure of account table 183. Account table 183 shown in Fig. 6 is a table having columns such as SaaSID, scope of use, and registration start date, with user ID as a key. Note that account table 183 may have columns for storing information other than these, or may not have any of these pieces of information.

[0082] The user ID is an item that stores an identifier for uniquely identifying a user. The usage range is an item that stores the range of functions that a user is permitted to use when using SaaS. The usage range is set, for example, when signing up for an account. The usage range may be changed at a predetermined time, for example, at any time during the contract or when applying for renewal. The registration start date is an item that stores the date on which the account was registered and SaaS use began.

[0083] Fig. 7 is a diagram showing the data structure of SaaS table 184. SaaS table 184 shown in Fig. 7 is a table having columns such as name, provider, version, and support information, with SaaSID as a key. Note that SaaS table 184 may have columns for storing information other than these, or may not have any of these pieces of information.

[0084] The name is an item that stores the name of the SaaS. The provider is an item that stores the entity that provides the SaaS. The "provider" item stores, for example, the name of the company or the address of the website that provides the service. The version is an item that stores the version of the SaaS that is being provided. The support information is an item that stores information about the support provided for the SaaS.

[0085] Fig. 8 is a diagram showing the data structure of determination result table 185. Determination result table 185 shown in Fig. 8 is a table having columns such as software used, usable, and whether or not an account exists, with date and time as a key. Note that determination result table 185 may have columns that store information other than the above, or may not have any of the above information. For example, determination result table 185 may have a column that stores whether the SaaS is on a blacklist.

[0086] The date and time is an item for storing the date and time when use was detected. The software in use is an item for storing information about the SaaS whose use was detected. In the example shown in FIG. 8, the item "software in use" stores the SaaSID of the SaaS whose use was detected. The usable item is an item for storing whether or not the SaaS whose use was detected is licensed for use. The determination unit 196 determines whether or not the SaaS whose use was detected is licensed for use by referring to the SaaS table 184. In the example shown in FIG. 8, if the SaaS is usable, "1" is stored, and if the SaaS is unusable, "0" is stored. The account presence / absence is an item for storing whether or not the user has an account for the SaaS whose use was detected. The determination unit 196 determines whether or not the user has an account for the SaaS whose use was detected by referring to the account table 183. In the example shown in FIG. 8, if the user has an account, "1" is stored, and if the user does not have an account, "0" is stored.

[0087] Fig. 9 is a diagram showing the data structure of the restriction table 186. The restriction table 186 shown in Fig. 9 is a table having columns such as correspondence and priority, with conditions as keys. Note that the restriction table 186 may also have columns for storing information other than these.

[0088] The condition is an item that stores the condition for restricting the operation of the terminal device 10. For example, the following contents are stored in the item "condition". The user has the required permissions and the blacklisted SaaS is used. The number of times the same decision has been made has reached a predetermined value. - The number of times the same decision has been made within a specified period of time has reached a specified value.

[0089] The restriction is an item that stores restrictions imposed on the terminal device 10. The item "restriction" stores, for example, the following: - Prevent any operations on the terminal device 10 from being accepted - Prohibition of access to specified URLs - Prohibit execution of specified applications -Prohibit access to specified folders - Preventing execution of specified files - Prohibition of certain operations such as reading and writing Stopping running applications

[0090] The priority is an item that stores the priority level when adopting a restriction. For example, priority 1 is higher than priorities 2 and 3, and when multiple conditions are met simultaneously, the restriction with the higher priority is adopted. Note that when multiple conditions are met simultaneously, multiple restrictions may be adopted.

[0091] Fig. 10 is a diagram showing the data structure of the aggregation table 2022 stored in the first server 20. Note that Fig. 10 is an example and does not exclude data that is not listed. Furthermore, even data that is listed in the same table may be stored in separate storage areas in the storage unit 202.

[0092] 10 is a table having columns for reported events, number of detections, etc., with user IDs as keys. Note that the aggregation table 2022 may have columns for storing information other than these, or may not have any of these pieces of information.

[0093] The reportable event is an item that stores an event that can be reported. The item "reportable event" can include, for example, the following contents: -Unlicensed SaaS usage was confirmed. - The use of an application that is not permitted for use has been confirmed. - It has been confirmed that you have a shadow ID.

[0094] The number of detections is an item for storing the number of times an event defined as a reportable event has been detected.

[0095] <3 operations> The operation of the agent application 187 when monitoring the SaaS used in the terminal device 10 will be described.

[0096] 11 is a schematic diagram showing a process in which an agent application 187 installed in a terminal device 10 monitors a process by a user. In Fig. 11, a user operates the terminal device 10 on which the agent application 187 is running to use a predetermined SaaS. The terminal device 10 detects the user's use of the SaaS, makes a predetermined determination, and transmits the determination result to the first server 20.

[0097] 12 is a flowchart showing an example of the operation of the terminal device 10 when monitoring the user's actions. In the explanation of FIG. 12, an agent application 187 is installed in the terminal device 10.

[0098] First, a user of the terminal device 10 starts up the terminal device 10. The agent application 187 is set to start up automatically, for example, and is started up by the OS of the terminal device 10 when the terminal device 10 is started up. When the agent application 187 is started up, the control unit 190 may or may not present a message to the user that the agent application 187 is running so that the user can recognize it. The user operates the terminal device 10, for example, to perform a task assigned to the user.

[0099] In step S11, the control unit 190 acquires information about the processing executed by the user. Specifically, for example, the first acquisition unit 194 accesses the browser's log file at a predetermined cycle and acquires the URLs of web pages that the user visited by operating the browser during that cycle. The first acquisition unit 194 stores the acquired URL, the date and time when the URL was acquired, the name of the browser used by the user, and the identification information of the terminal device 10 in the storage unit 180 (not shown). Note that the date and time when the URL was acquired may be the date and time when the user visited the web page related to the URL.

[0100] In step S12, the control unit 190 acquires information about the SaaS used by the user. Specifically, for example, the second acquisition unit 195 compares the URLs of web pages visited by the user during a predetermined period with the correspondence table 182, and acquires the SaaSID of the SaaS used by the user.

[0101] In step S13, the control unit 190 determines whether the user's use of SaaS is appropriate. Specifically, for example, if the SaaS table 184 is a blacklist, the determination unit 196 determines whether the acquired SaaSID is included in the SaaS table 184. If the acquired SaaSID is "SID0001" included in the SaaS table 184, the determination unit 196 stores, for example, the following in the determination result table 185: item "Software in use": SID0001, item "Available for use": 0, and item "Account existence": 0. If the acquired SaaSID (for example, "SID0002") is not included in the SaaS table 184, the determination unit 196 refers to the account table 183 and determines whether the user has an account for the acquired SaaSID. If the user has an account for the acquired SaaSID, the determination unit 196 does not store information in the determination result table 185. If the user does not have an account for the acquired SaaSID, the determination unit 196 stores, for example, the following in the determination result table 185: item "Software in use": SID0002, item "Available for use": 1, and item "Account available": 0.

[0102] Furthermore, for example, if SaaS table 184 is a whitelist, determination unit 196 determines whether the acquired SaaSID is included in SaaS table 184. If the acquired SaaSID (for example, "SID0003") is not included in SaaS table 184, determination unit 196 stores, for example, the following in determination result table 185: item "Software in use": SID0003, item "Available for use": 0, and item "Account held": 0. If the acquired SaaSID is "SID0004" included in SaaS table 184, determination unit 196 refers to account table 183 and determines whether the user has an account for the acquired SaaSID. If the user has an account for the acquired SaaSID, determination unit 196 does not store information in determination result table 185. If the user does not have an account for the acquired SaaSID, the determination unit 196 stores, for example, the following in the determination result table 185: item "Software in use": SID0004, item "Available for use": 1, and item "Account existence": 0.

[0103] In step S14, the control unit 190 determines whether or not to transmit the determination result stored in the determination result table 185 to the first server 20. Specifically, for example, the transmitting / receiving unit 192 determines whether or not the determination result stored in the determination result table 185 satisfies a predetermined condition. If the determination result satisfies the predetermined condition, the transmitting / receiving unit 192 shifts the processing to step S15. If the determination result does not satisfy the predetermined condition, the transmitting / receiving unit 192 shifts the processing to step S16.

[0104] In step S15, the transmitting / receiving unit 192 transmits to the first server 20 the determination result that the condition is satisfied.

[0105] In step S16, the control unit 190 determines whether or not to impose restrictions on the operation of the terminal device 10. Specifically, for example, the restriction unit 197 determines whether or not the judgment result stored in the judgment result table 185 satisfies a predetermined condition. If the judgment result satisfies the predetermined condition, the restriction unit 197 shifts the processing to step S17. If the judgment result does not satisfy the predetermined condition, the restriction unit 197 shifts the processing to step S11.

[0106] In step S17, the restriction unit 197 imposes a predetermined restriction on the operation of the terminal device 10. Specifically, for example, the restriction unit 197 compares the judgment result stored in the judgment result table 185 with the restriction table 186, determines a restriction on the operation of the terminal device 10, and imposes the determined restriction on the terminal device 10.

[0107] More specifically, for example, if a user has the authority to access highly confidential information but uses a blacklisted SaaS, the restriction unit 197 controls the terminal device 10 so as not to accept any operations. For example, if the number of times that a SaaS whose use is not permitted reaches N, the restriction unit 197 prohibits access to the site that provides the SaaS. For example, if the number of times that a SaaS whose use is not permitted reaches N within a predetermined period, the restriction unit 197 prohibits access to the site that provides the SaaS. For example, if the number of times that a specific SaaS is used with a shadow ID reaches N, the restriction unit 197 prohibits access to the site that provides the SaaS. For example, if the number of times that a specific SaaS is used with a shadow ID reaches N within a predetermined period, the restriction unit 197 prohibits access to the site that provides the SaaS.

[0108] In step S18, the presentation control unit 193 presents to the user that the operation of the terminal device 10 has been restricted.

[0109] Fig. 13 is a schematic diagram illustrating an example of a display screen of the display 141 of the terminal device 10. Fig. 13 illustrates an example in which processing on the terminal device 10 is stopped due to the use of SaaS for which use is not permitted. The screen illustrated in Fig. 13 displays a first area 1411 for notifying the user that restrictions have been imposed on the operation of the terminal device 10. The presentation control unit 193 may display, in the first area 1411, processing for removing the restrictions imposed on the terminal device 10.

[0110] <Summary> As described above, in the above embodiment, the first acquisition unit 194 acquires information about a process executed by a user. The second acquisition unit 195 acquires information about a service associated with the process based on the acquired information about the process. The determination unit 196 determines whether the acquired information about the service is a service to be managed. This enables the terminal device 10 to quickly determine whether there is a problem with the user's use of the service.

[0111] Therefore, according to the above embodiment, the terminal device 10 can take prompt action when there is a problem in using the service. Furthermore, edge computing reduces the cost of operating the first server 20. Furthermore, even if communication between the terminal device 10 and the network is interrupted, the terminal device 10 can monitor the processing performed by the user.

[0112] Furthermore, in the above embodiment, the first acquisition unit 194 acquires information related to the process at a preset cycle. The second acquisition unit 195 acquires information related to the service associated with the process based on the information acquired during the cycle. This reduces the frequency with which the terminal device 10 acquires information related to the process, but makes it possible to effectively monitor the operation of the terminal device 10 while suppressing power consumption.

[0113] In the above embodiment, the determination unit 196 determines whether or not the user has an account based on information about the service. This allows the terminal device 10 to determine whether or not the user has an account for the service that the user is using. In other words, the terminal device 10 can determine whether or not the user has a shadow ID.

[0114] In the above embodiment, the determination unit 196 determines whether or not the user has an account by referring to a pre-stored account list (account table 183). This enables the determination unit 196 to accurately determine whether or not the user has an account for the service that the user is using.

[0115] In the above embodiment, when the determination result satisfies a predetermined condition, the transmitter / receiver 192 transmits the determination result that satisfies the condition to an external device. The SaaS whose use is managed may have different levels of management. Some prohibited SaaS may become problematic if habitual use is permitted. Under such circumstances, transmitting information to the first server 20 every time a non-recommended SaaS is used increases the power consumption of the terminal device 10. Furthermore, events that do not need to be aggregated may accumulate in the first server 20, resulting in a waste of storage resources. In this embodiment, by transmitting a determination result that satisfies a predetermined condition to the first server 20, it is possible to reduce the power consumption of the terminal device 10 and avoid wasting storage resources of the first server 20.

[0116] Specifically, when a predetermined determination is made a preset number of times, the transmitting / receiving unit 192 transmits the determination result to the external device. Also, when a determination that the user does not have an account is made a preset number of times, the transmitting / receiving unit 192 transmits the determination result to the external device.

[0117] In the above embodiment, the limiting unit 197 limits the operation of the processor based on the determination result, which enables the terminal device 10 to immediately deal with any problem in the user's use of the service.

[0118] In the above embodiment, the terminal device 10 transmits information identifying the hardware used by the user to the first server 20. The first server 20 stores information about the software used by the user in advance, and creates a list of the hardware and software used by the user based on the information identifying the hardware. This enables the first server 20 to reduce the burden of managing the hardware and software used by employees.

[0119] <Modification> In the above embodiment, when the operation of the terminal device 10 is restricted because the user's use of a service is inappropriate, an example is described in which the user is notified of the restriction, as shown in FIG. 13 . The information presented to the user is not limited to the restriction on the operation of the terminal device 10. The presentation control unit 193 may also present to the user that the user's use of the service is inappropriate. Furthermore, the presentation control unit 193 may present to the user a grace period until the condition for transmitting determination information to the first server 20 is met, or until the condition for restricting the operation of the terminal device 10 is met.

[0120] In the above embodiment, the browser usage history is used as information about the processing performed by the user. However, the application name and process name of the application executed by the user may be used as information about the processing performed by the user. In this case, for example, the correspondence table 182 associates SaaS with the application name and process name of the application executed by the user. The second acquisition unit 195 compares the acquired application name and process name with the correspondence table 182 and acquires the SaaSID of the SaaS used by the user. In this way, the second acquisition unit 195 identifies the SaaS used by the user.

[0121] In the above embodiment, the determination unit 196 recognizes the existence of a shadow ID. However, the control unit 190 may perform the function of the identification unit 198 that identifies a shadow ID. When the determination unit 196 recognizes the existence of a shadow ID, the identification unit 198 accesses the second server 30 and acquires information about the account through which the user is using the SaaS. This enables the identification unit 198 to identify the user's shadow ID. When the identification unit 198 identifies the shadow ID, the transmission / reception unit 192 transmits the identified shadow ID to the first server 20.

[0122] Furthermore, in the above embodiment, an example has been described in which the use of SaaS is monitored, but the use of an application may also be monitored by an agent executed on the terminal device 10. In this case, the terminal device 10 stores, for example, a table that stores applications whose use needs to be managed or processes whose use needs to be managed. The restriction unit 197 compares the acquired information with the table and determines whether the application or process used by the user is appropriate. The restriction unit 197 stores the determination result in the determination result table 185.

[0123] <4 Basic computer hardware configuration> 14 is a block diagram showing the basic hardware configuration of a computer 90. The computer 90 includes at least a processor 91, a main memory device 92, an auxiliary memory device 93, and a communication IF (interface) 99. These are electrically connected to each other by a bus.

[0124] The processor 91 is hardware for executing an instruction set written in a program, and is composed of an arithmetic unit, registers, peripheral circuits, and the like.

[0125] The main storage device 92 is used to temporarily store programs, data to be processed by the programs, etc. For example, it is a volatile memory such as a DRAM (Dynamic Random Access Memory).

[0126] The auxiliary storage device 93 is a storage device for saving data and programs, such as a flash memory, a hard disk drive (HDD), a magneto-optical disk, a CD-ROM, a DVD-ROM, or a semiconductor memory.

[0127] The communication IF 99 is an interface for inputting and outputting signals for communicating with other computers via a network using wired or wireless communication standards. The network is composed of the Internet, a LAN, various mobile communication systems constructed by wireless base stations, etc. For example, the network includes 3G, 4G, and 5G mobile communication systems, LTE (Long Term Evolution), and wireless networks (e.g., Wi-Fi (registered trademark)) that can connect to the Internet via a predetermined access point. In the case of a wireless connection, communication protocols include, for example, Z-Wave (registered trademark), ZigBee (registered trademark), and Bluetooth (registered trademark). In the case of a wired connection, the network also includes a direct connection using a USB (Universal Serial Bus) cable, etc.

[0128] It should be noted that the computer 90 can be virtually realized by distributing all or part of each hardware configuration across multiple computers 90 and interconnecting them via a network. In this way, the computer 90 is a concept that includes not only a computer 90 housed in a single housing or case, but also a virtualized computer system.

[0129] <Basic functional configuration of computer 90> A description will be given of the functional configuration of a computer realized by the basic hardware configuration of a computer 90 shown in Fig. 10. The computer includes at least the functional units of a control unit, a storage unit, and a communication unit.

[0130] The functional units of the computer 90 can also be realized by distributing all or part of the functional units among multiple computers 90 interconnected via a network. The computer 90 is a concept that includes not only a single computer 90 but also a virtualized computer system.

[0131] The control unit is realized by the processor 91 reading various programs stored in the auxiliary storage device 93, expanding them in the main storage device 92, and executing processing in accordance with the programs. The control unit can realize functional units that perform various types of information processing depending on the type of program. In this way, the computer is realized as an information processing device that processes information.

[0132] The storage unit is realized by a main storage device 92 and an auxiliary storage device 93. The storage unit stores data, various programs, and various databases. Furthermore, the processor 91 can allocate a storage area corresponding to the storage unit in the main storage device 92 or the auxiliary storage device 93 in accordance with the programs. Furthermore, the control unit can cause the processor 91 to execute processes for adding, updating, and deleting data stored in the storage unit in accordance with the various programs.

[0133] A database refers to a relational database, which manages data sets called tables, which are structured by rows and columns, by relating them to each other. In a database, a table is called a table, a column in a table is called a column, and a row in a table is called a record. In a relational database, relationships between tables can be set and associated. Usually, each table has a column set as a key for uniquely identifying a record, but setting a key to a column is not essential. The control unit can cause the processor 91 to add, delete, or update records in a specific table stored in the storage unit according to various programs.

[0134] The communication unit is realized by the communication IF 99. The communication unit realizes the function of communicating with other computers 90 via a network. The communication unit can receive information transmitted from other computers 90 and input the information to the control unit. The control unit can cause the processor 91 to execute information processing on the received information in accordance with various programs. In addition, the communication unit can transmit information output from the control unit to other computers 90.

[0135] The functions performed by the components described herein may be implemented in circuitry or processing circuitry, including general-purpose processors, application-specific processors, integrated circuits, ASICs (Application Specific Integrated Circuits), a CPU (a Central Processing Unit), conventional circuits, and / or combinations thereof, programmed to perform the described functions. A processor includes transistors and other circuits and is considered to be circuitry or processing circuitry. A processor may also be a programmed processor that executes programs stored in memory. In this specification, a circuitry, unit, or means is hardware that is programmed to realize or performs the described functions, which may be any hardware disclosed herein or any hardware known to be programmed to realize or perform the described functions. If the hardware is a processor considered to be a type of circuitry, the circuitry, means, or unit is a combination of the hardware and software used to configure the hardware and / or processor.

[0136] Although several embodiments of the present disclosure have been described above, these embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are intended to be included in the scope of the inventions and their equivalents as defined in the claims, as well as in the scope and spirit of the inventions.

[0137] <Additional Notes> The matters described in the above embodiments will be supplemented below. (Appendix 1) A program to be executed by a computer having a processor and a memory, the program causing the processor to execute the steps of acquiring information regarding a process executed by a user, acquiring information regarding a service associated with the process based on the acquired information, and determining whether the acquired information regarding the service is a service to be managed. (Appendix 2) A program described in Appendix 1, in which in the step of acquiring information about a process, the information is acquired at a predetermined interval, and in the step of acquiring information about a service, information about a service associated with the process is acquired based on the information acquired during the interval. (Appendix 3) The program according to (Appendix 1) or (Appendix 2), which causes a processor to execute a step of determining whether a user has an account based on information about the service. (Appendix 4) The program according to claim 3, wherein in the step of determining whether the user has an account, a pre-stored account list is referenced to determine whether the user has an account. (Appendix 5) The program according to any one of (Supplementary Note 1) to (Supplementary Note 4), which causes a processor to execute a step of transmitting the determination result that satisfies a predetermined condition to an external device when the determination result satisfies the condition. (Appendix 6) The program according to any one of (Supplementary Note 1) to (Supplementary Note 4), which causes a processor to execute a step of transmitting a judgment result to an external device when a predetermined judgment has been made a preset number of times. (Appendix 7) The program according to claim 3, which causes a processor to execute a step of transmitting a determination result to an external device when a determination that the user does not have an account is made a preset number of times. (Appendix 8) A program according to any one of (Appendix 1) to (Appendix 7) that causes a processor to execute a step of restricting the operation of the processor based on the determination result. (Appendix 9) A method executed by a computer having a processor and a memory, wherein the processor executes all of the steps performed in any of the inventions according to (Appendix 1) to (Appendix 8). (Appendix 10) An information processing device comprising a processor and a memory, wherein the processor executes all of the steps executed in any of the inventions according to (Appendix 1) to (Appendix 8). (Appendix 11) A system comprising a plurality of terminal devices and at least one server, each of which comprises a means for detecting a process executed by a user, a means for acquiring information relating to a service associated with the process based on the detected process, and a means for determining whether the acquired information relating to the service is a service to be managed. (Appendix 12) The terminal device transmits information identifying the hardware used by the user to the server, and the server pre-stores information regarding the software used by the user and has a means for creating a list of the hardware and software used by the user based on the information identifying the hardware (Supplementary Note 11). [Explanation of symbols]

[0138] 1. System 10...Terminal device 120…Communications Department 13...Input device 131...Touch-sensitive devices 14...Output device 15...Memory 16…Storage 19...Processor 20...First server 22...Communication IF 23...Input / output interface 25…Memory 26…Storage 29...Processor 30...Second server

Claims

1. A program to be executed by a computer including a processor and a memory, the program causing the processor to: obtaining information about an operation performed by a user; obtaining information about a service associated with the process based on the obtained information; a step of determining whether the acquired information about the service is a service to be managed; A program that executes the following.

2. In the step of acquiring information about the processing, the information is acquired at a predetermined cycle; 2. The program according to claim 1, wherein in the step of acquiring information about the service, information about the service associated with the process is acquired based on information acquired during the period.

3. 2. The program according to claim 1, further comprising causing the processor to execute a step of determining whether the user has an account based on information about the service.

4. 4. The program according to claim 3, wherein in the step of determining whether the user has an account, a pre-stored account list is referenced to determine whether the user has an account.

5. 2. The program according to claim 1, further comprising the step of causing the processor to execute a step of transmitting the judgment result that satisfies a predetermined condition to an external device when the judgment result satisfies the predetermined condition.

6. 2. The program according to claim 1, further comprising causing the processor to execute a step of transmitting a result of a predetermined determination to an external device when the predetermined determination has been made a preset number of times.

7. 4. The program according to claim 3, further comprising the step of causing the processor to execute a step of transmitting a determination result to an external device when the determination that the user does not have an account is made a preset number of times.

8. 2. The program according to claim 1, further comprising the step of causing the processor to execute a step of restricting the operation of the processor based on the result of the determination.

9. A method implemented on a computer having a processor and a memory, wherein the processor performs all of the steps performed in the invention according to any one of claims 1 to 8.

10. 10. An information processing device comprising a processor and a memory, wherein the processor executes all of the steps executed in any one of the inventions according to claims 1 to 8.

11. A system including a plurality of terminal devices and at least one server, The terminal device means for detecting an action performed by a user; means for acquiring information about a service associated with the detected process based on the process; means for determining whether the acquired information relating to the service is a service to be managed; A system comprising:

12. the terminal device transmits information identifying the hardware used by the user to the server; 12. The system according to claim 11, wherein the server pre-stores information regarding software used by the user, and includes means for creating a list of the hardware and software used by the user based on the information identifying the hardware.

Images