Information processing device, information processing method, and information processing program

Abstract

To properly manage open-source software implemented in specified products or services. [Solution] The information processing device of this disclosure is an information processing device for managing open source software implemented in a predetermined product or service. This information processing device includes a control unit that performs a comparison process to compare a first database which stores information about open source software implemented in a product or service and a second database which stores information about a predetermined software. In the comparison process, the control unit obtains a degree of agreement, which represents the degree of agreement between the implemented software, which is open source software stored in the first database, and the software stored in the second database, and performs a determination process to determine the management status of the implemented software based on the obtained degree of agreement.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program for managing open source software implemented in a predetermined product or service.

Background Art

[0002] In recent years, software development using open source software (OSS) has become popular. For example, in the development of application programs, libraries published as OSS are actively used.

[0003] Therefore, it is important to appropriately manage the OSS implemented in the development of application programs. For example, if the implemented OSS has vulnerabilities, those vulnerabilities will affect the entire application program. And the impact of such vulnerabilities in libraries on application programs changes over time.

[0004] Therefore, Patent Document 1 discloses an evaluation apparatus that appropriately evaluates the risk of source code that changes over time. In this evaluation apparatus, an evaluation value regarding the risk of a library described in the source code is generated, and based on this evaluation value, the risk level of the library and the risk value inherent in the source code are calculated.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] In traditional product and service development, the software implemented in them was managed and operated by the company developing the product or service. In this case, even if a defect was discovered in the software, the company developing the product or service could relatively easily identify its impact. However, with the recent development of applications using open-source software (OSS), multiple open-source software components are now implemented in products and services. When a failure occurs in a product or service due to an open-source software issue, it can become difficult for the company developing the product or service to identify its impact.

[0007] According to the technology described in Patent Document 1, configuration information is generated based on the detected dependencies between libraries. If a dependency is found in the configuration, the dependent library is extracted as a risk factor for the parent library, and the risk value inherent in the source code is calculated. Therefore, it seems possible to appropriately evaluate the risk of the source code. However, in the development of recent applications, software configurations often have multi-level dependencies, such as one OSS depending on another OSS (calling other libraries). Therefore, it is necessary to appropriately manage the reliability of the configuration of software that includes OSS. However, the technology described in Patent Document 1 does not evaluate the reliability of the configuration of software that includes OSS. Thus, there is still room for improvement in technologies for appropriately managing OSS implemented in products and services.

[0008] The purpose of this disclosure is to provide technology for properly managing open-source software implemented in a given product or service. [Means for solving the problem]

[0009] The information processing device disclosed herein is an information processing device for managing open-source software implemented in a predetermined product or service. This information processing device includes a control unit that performs a comparison process for comparing a first database storing information about the open-source software implemented in the product or service and a second database storing information about a predetermined software. In the comparison process, the control unit obtains a degree of agreement representing the degree of agreement between the implemented software, which is the open-source software, stored in the first database and the software stored in the second database, and performs a determination process to determine the management status of the implemented software based on the obtained degree of agreement.

[0010] The above-described information processing device compares a first database, which stores information about open-source software (OSS) implemented in a given product or service, with a second database, which stores information about software that meets a given purpose. By determining the management status of the implemented software based on the degree of agreement between the software contained in each database, the reliability of the configuration of software including OSS can be appropriately managed.

[0011] In the information processing device of this disclosure, the first database may be a predetermined software bill of materials, and the second database may be a database storing information about approved software, which is open-source software that has been preapproved to be implemented in the product or service. Furthermore, the control unit may, in the determination process, perform a process to perform an alert determination on the management status of the implemented software and notify the user of a request for confirmation regarding the use of the implemented software if the degree of agreement differs under predetermined conditions. This makes it possible to confirm whether the approved software is properly implemented in the product or service based on the degree of agreement, thereby enabling the proper management of OSS implemented in the product or service.

[0012] In this case, the control unit may, in the determination process, if the degree of agreement differs because the number of approved software is greater than the number of implemented software, perform an alert determination for a missed detection in the management status of the implemented software, obtain the user's response to the confirmation request notified to the user, and if the implemented software does not contain the open-source software included in the response, determine that a missed detection has occurred in the detection of open-source software in the first database. This makes it possible to determine with greater accuracy missed detection of OSS, which may occur even when using the functions of an OSS detection tool for detecting OSS in the first database, which is a Software Bill of Materials (SBOM).

[0013] Furthermore, in the determination process, if the degree of agreement differs because the number of approved software is less than the number of implemented software, the control unit may make an alert determination of a false positive in the management status of the implemented software. If the software among the implemented software that is not included in the approved software is an indirect use of the approved software, the control unit may determine that the indirect use software has been falsely detected as unapproved source software in the detection of open source software in the first database. The indirect use referred to above is OSS that is indirectly used in the approved software. This makes it possible to more specifically identify false positives of OSS that may occur even when using the functions of an OSS detection tool for detecting OSS in the first database, SBOM. In this case, if the indirect use software is included in a predetermined distribution file, the control unit may notify a warning regarding confirmation of vulnerabilities in the software and / or confirmation of the software's license. Here, the distribution file referred to above is, for example, an exe file of binary data which is an application executable file. This makes it possible to prevent situations in which failures occur due to indirect use of approved software.

[0014] Furthermore, in the above-described information processing device, the control unit may, in the determination process, if the degree of agreement differs because the number of approved software is less than the number of implemented software, perform a false detection alert determination regarding the management status of the implemented software. If the software among the implemented software that is not included in the approved software is not an indirect use of the approved software and is not software that was automatically added by a predetermined development tool, the control unit may determine that a false detection has occurred in the detection of open source software in the first database. Software that can be automatically added by the above-described development tool is, for example, runtimes that are automatically added when compiling source code, and software that can be added by a test tool in the development environment. This makes it possible to determine with greater accuracy false detection of OSS, which may occur even when using the functions of an OSS detection tool for detecting OSS in the first database, SBOM. In this case, if the software among the implemented software that is not included in the approved software is software that was automatically added by the development tool, the control unit may notify a warning regarding confirmation of vulnerabilities in the software and / or confirmation of the license of the software. This makes it possible to prevent situations in which failures occur due to software that can be automatically added by a development tool. Furthermore, the control unit may, in the comparison process, obtain the degree of agreement between the approved software and the implementation software paired with the approved software, and in the determination process, if the degree of agreement differs due to different versions of the approved software and the implementation software paired with the approved software, perform an alert determination regarding the version of the management status of the implementation software. If the version of the implementation software is older than the version it was approved for, there is a risk of vulnerabilities in the software or problems with the licenses being used. Therefore, by performing an alert determination as described above, it is possible to prevent situations in which problems occur due to version differences.In this case, the control unit may issue a warning regarding the verification of the versions of the implementation software and the approved software. If the version of the implementation software is newer than the version it was approved for, problems may arise due to the older version of the approved software. Therefore, if the degree of matching differs due to differences in the versions of the approved software and the implementation software paired with it, the control unit may issue a warning not only regarding the verification of the implementation software version but also regarding the verification of the approved software version. This makes it possible to prompt verification of the authenticity of the approved software, vulnerabilities in the approved software, and the licenses used.

[0015] Alternatively, in the information processing device of this disclosure, the first database may be a predetermined software bill of materials, and the second database may be a database storing information about off-the-shelf software, which is open-source software included in an off-the-shelf application. Here, the off-the-shelf application refers to, for example, an application that constitutes a product or service by a third party, and the OSS included in the application is made publicly available via a website or the like. The control unit may, in the comparison process, obtain the degree of agreement regarding the properties of the implemented software and the off-the-shelf software that is paired with the implemented software, and in the determination process, if the degree of agreement differs due to the lack of information regarding the origin of the implemented software, it may perform an alert determination regarding the management status of the implemented software. This makes it possible to suppress situations in which it becomes impossible to manage failures caused by vulnerabilities in the implemented software or problems caused by the version or license of the implemented software due to the lack of information regarding the origin of the implemented software.

[0016] In this case, the control unit may further perform an extraction process in which it randomly extracts multiple implementation software from the first database and stores the extracted software as extracted software; an identification process in which it identifies the off-the-shelf application by comparing the extracted software with a lineup of open-source software used by the off-the-shelf application; and an estimation process in which, for software among the implementation software for which information on its origin is lacking, it estimates the origin of the off-the-shelf software that is paired with the software and included in the identified off-the-shelf application as the origin of the software. This makes it possible to accurately estimate the origin of software among the implementation software for which information on its origin is lacking. Furthermore, in the identification process, the control unit may identify the off-the-shelf application by comparing the name or copyright notice of each software in a lineup in which the dependencies between open-source software are stored as a hierarchical structure with the name or copyright notice of each software included in the extracted software. This makes it possible to identify the off-the-shelf application more efficiently.

[0017] Furthermore, this disclosure can be viewed from the perspective of a computer-based information processing method. Specifically, the information processing method of this disclosure is an information processing method for managing open-source software implemented in a predetermined product or service, wherein the computer performs the following actions: compares a first database storing information about the open-source software implemented in the product or service with a second database storing information about a predetermined software; obtains a degree of agreement representing the degree of agreement between the implementation software, which is the open-source software stored in the first database, and the software stored in the second database; and determines the management status of the implementation software based on the obtained degree of agreement.

[0018] Furthermore, in the above-described information processing method, the first database is a predetermined software bill of materials, and the second database is a database storing information about approved software, which is open-source software that has been pre-approved to be implemented in the product or service, and the computer may further perform the following actions when the degree of agreement differs under predetermined conditions: make an alert determination regarding the management status of the implemented software and notify the user of a request for confirmation regarding the use of the implemented software.

[0019] Furthermore, in the above-described information processing method, the first database is a predetermined software bill of materials, and the second database is a database storing information about off-the-shelf software, which is open-source software included in an off-the-shelf application. The computer may further perform the following actions: obtain the degree of agreement regarding the properties of the implementation software and the off-the-shelf software that is paired with the implementation software; and, if the degree of agreement differs due to a lack of information regarding the origin of the implementation software, perform an alert determination regarding the management status of the implementation software.

[0020] Furthermore, this disclosure can be viewed from the perspective of an information processing program. Specifically, the information processing program of this disclosure is an information processing program for managing open-source software implemented in a predetermined product or service, and causes a computer to perform the following actions: compare a first database storing information about the open-source software implemented in the product or service with a second database storing information about a predetermined software; obtain a degree of agreement representing the degree of agreement between the implementation software, which is the open-source software, stored in the first database and the software stored in the second database; and determine the management status of the implementation software based on the obtained degree of agreement.

[0021] And in the above information processing program, the first database is a predetermined software component list, and the second database is a database storing information on approved software, which is open source software pre-approved to be implemented in the product or the service. When the degree of match differs under a predetermined condition in the computer, the computer may further execute an alert determination on the management state of the implemented software and notify the user of a confirmation request regarding the use of the implemented software.

[0022] Also, in the above information processing program, the first database is a predetermined software component list, and the second database is a database storing information on off-the-shelf software, which is open source software included in off-the-shelf applications. The computer may further execute obtaining the degree of match between the implemented software and the properties of the off-the-shelf software paired with the implemented software, and performing an alert determination on the management state of the implemented software when the degree of match differs due to lack of information on the origin of the implemented software.

Advantages of the Invention

[0023] According to the present disclosure, open source software implemented in a predetermined product or service can be appropriately managed.

Brief Description of the Drawings

[0024] [Figure 1] It is a diagram showing a schematic configuration of an information processing system in the first embodiment. [Figure 2] It is a diagram showing in more detail the components of a server and a user terminal included in the information processing system in the first embodiment. [Figure 3] It is a diagram illustrating the flow of operations of the information processing system in the first embodiment. [Figure 4]This diagram illustrates the flow of operation of the information processing system in the second embodiment. [Modes for carrying out the invention]

[0025] Embodiments of this disclosure will be described below with reference to the drawings. The configurations of the following embodiments are illustrative, and this disclosure is not limited to the configurations of these embodiments.

[0026] <First Embodiment> The overview of the information processing system in the first embodiment will be described with reference to Figure 1. Figure 1 is a diagram showing the schematic configuration of the information processing system in this embodiment. The information processing system 100 according to this embodiment includes a network 200, a server 300, a user terminal 400, a first database, and a second database. The information processing system disclosed herein is a system for managing open source software implemented in a predetermined product or service, and the management of such open source software is performed by the server 300. The above-mentioned product is, for example, an automobile, home appliance, medical equipment, etc., and the above-mentioned service is, for example, the provision of online games, etc.

[0027] Here, the first database in this embodiment is a database in which multiple open-source software (OSS) implemented in a product or service are stored as a list along with the dependencies between the OSS, and is a predetermined software bill of materials. This is, for example, an SBOM (Software Bill of Materials) that applies a manufacturing bill of materials (BOM) to software. The data managed in such a database is a software asset management table and software configuration management data. Such a database is managed by the business that develops the product or service. The above SBOM may include the functionality of an OSS detection tool for detecting OSS, for example, a function that scans the source code registered in the SBOM and detects the presence or absence of OSS by matching it with a database that stores information on OSS from around the world.

[0028] Furthermore, the second database in this embodiment is a database that stores information about approved software, which is open-source software (OSS) that has been pre-approved for implementation in a product or service. The approved software is software whose implementation has been verified by the business operator developing the product or service in the project to develop the product or service, and as a result, has been approved for implementation in the product or service.

[0029] Network 200 is, for example, an IP network that enables communication between server 300 and user terminal 400, and between server 300 and the first and second databases. Network 200 can be wireless, wired, or a combination of wireless and wired, as long as it is an IP network. For example, if communication is wireless, user terminal 400 may access a wireless LAN access point (not shown) and communicate with server 300 via LAN or WAN. Furthermore, network 200 is not limited to these examples and may also be, for example, a public switched telephone network, an optical fiber line, an ADSL line, or a satellite communication network.

[0030] Server 300 is connected to user terminals 400 via network 200. Note that in Figure 1, for simplicity of explanation, one server 300 and four user terminals 400 are shown, but it goes without saying that the system is not limited to these. Furthermore, server 300 is connected to the first and second databases.

[0031] Server 300 can be any electronic computer equipment with processing capabilities for computational and processing operations such as data acquisition, generation, and updating. For example, it may be a personal computer, server, mainframe, or other electronic device. In other words, Server 300 can be configured as a computer having a processor such as a CPU or GPU, main memory such as RAM or ROM, and auxiliary storage such as an EPROM, hard disk drive, or removable media. The removable media may be, for example, a USB memory stick or a disk recording medium such as a CD or DVD. The auxiliary storage device stores the operating system (OS), various programs, various tables, etc.

[0032] Furthermore, the server 300 may use SaaS (Software as a Service), PaaS (Platform as a Service), or IaaS (Infrastructure as a Service) via a cloud server as appropriate, without providing dedicated software, hardware, or OS for the information processing system 100 according to this embodiment.

[0033] The user terminal 400 is an electronic device owned by a user of the information processing system 100, and can be any electronic device that has processing capabilities for calculation and processing such as data acquisition, generation, and updating. For example, it may be a mobile terminal, tablet terminal, smartphone, wearable device, personal computer, or other terminal device.

[0034] Next, a detailed explanation of the components of the server 300 and user terminal 400 will be given based on Figure 2. Figure 2 is a diagram showing in more detail the components of the server 300 and user terminal 400 included in the information processing system 100 in the first embodiment.

[0035] The server 300 has a communication unit 301, a storage unit 302, and a control unit 303 as functional units. It loads a program stored in the auxiliary storage device into the working area of ​​the main memory and executes it. Through the execution of the program, each functional unit is controlled, thereby enabling each functional unit to perform its respective function according to its predetermined purpose. However, some or all of the functions may be implemented by hardware circuits such as ASICs or FPGAs.

[0036] Here, the communication unit 301 is a communication interface for connecting the server 300 to the network 200. The communication unit 301 is comprised of, for example, a network interface board and a wireless communication circuit for wireless communication. The server 300 is connected to user terminals 400, the first database, the second database, and other external devices via the communication unit 301, enabling communication between them.

[0037] The storage unit 302 comprises a main memory and an auxiliary storage device. The main memory is the memory where programs executed by the control unit 303 and data used by said control programs are stored. The auxiliary storage device is the device where programs executed by the control unit 303 and data used by said control programs are stored. The storage unit 302 also stores data transmitted from the user terminal 400, etc. The server 300 acquires data transmitted from the user terminal 400, etc. via the communication unit 301.

[0038] The control unit 303 is a functional unit that manages the control performed by the server 300. The control unit 303 can be implemented by a processing unit such as a CPU. The control unit 303 is further composed of three functional units: a comparison processing unit 3031, a determination processing unit 3032, and a confirmation processing unit 3033. Each functional unit may be implemented by executing a stored program using the CPU.

[0039] The comparison processing unit 3031 performs a comparison process to compare the first database and the second database. At this time, the comparison processing unit 3031 obtains a degree of agreement, which represents the degree of agreement between the open-source software (OSS) implementation software stored in the first database and the approval software stored in the second database. The comparison processing unit 3031 then stores the obtained degree of agreement in the storage unit 302 of the server 300.

[0040] Furthermore, users of the information processing system 100 can input information regarding the above-mentioned implementation software and approval software into the database via the user terminal 400.

[0041] In this embodiment, the user terminal 400 has a communication unit 401, an input / output unit 402, and a storage unit 403 as functional units. The communication unit 401 is a communication interface for connecting the user terminal 400 to the network 200, and is configured to include, for example, a network interface board and a wireless communication circuit for wireless communication. The input / output unit 402 is a functional unit for displaying information transmitted from the outside via the communication unit 401, and for inputting information when transmitting information to the outside via the communication unit 401. The storage unit 403 is configured to include a main memory and an auxiliary memory, similar to the storage unit 302 of the server 300.

[0042] The input / output unit 402 further includes a display unit 4021, an operation input unit 4022, and an image / audio input / output unit 4023. The display unit 4021 has the function of displaying various information and is implemented by, for example, an LCD (Liquid Crystal Display) display, an LED (Light Emitting Diode) display, or an OLED (Organic Light Emitting Diode) display. The operation input unit 4022 has the function of receiving operation input from the user and is specifically implemented by soft keys such as a touch panel or hard keys. The image / audio input / output unit 4023 has the function of receiving image input such as still images and videos and is specifically implemented by a camera using an image sensor such as Charged-Coupled Devices (CCD), Metal-oxide-semiconductor (MOS), or Complementary Metal-Oxide-Semiconductor (CMOS). The image / audio input / output unit 4023 also has the function of receiving audio input and output and is specifically implemented by a microphone or speaker.

[0043] Users of the information processing system 100 can input information about the implementation software and approval software into the database using the user terminal 400 configured in this way. The server 300 may provide the user terminal 400 with an interface for inputting this information. In this case, users of the information processing system 100 can register this information in the database by inputting it into the interface via the user terminal 400.

[0044] The judgment processing unit 3032 executes a judgment process to determine the management status of the implemented software based on the degree of agreement obtained by the comparison processing unit 3031. At this time, if the degree of agreement differs under predetermined conditions during the judgment process, the judgment processing unit 3032 issues an alert for the management status of the implemented software. Specifically, if the degree of agreement differs because the number of approved software is greater than the number of implemented software, the judgment processing unit 3032 issues an alert for a missed detection in the management status of the implemented software. Also, if the degree of agreement differs because the number of approved software is less than the number of implemented software, the judgment processing unit 3032 issues an alert for a false detection in the management status of the implemented software. Details of the processes executed by the judgment processing unit 3032 will be explained later with reference to Figure 3.

[0045] The confirmation processing unit 3033 executes a confirmation process to notify the user of a request for confirmation regarding the use of the implemented software if an alert is detected in the management status of the implemented software during the above determination process. Details of the process executed by the confirmation processing unit 3033 will be explained later based on Figure 3.

[0046] Furthermore, the control unit 303 functions as the control unit according to this disclosure by executing the processing of the comparison processing unit 3031, the determination processing unit 3032, and the confirmation processing unit 3033.

[0047] Here, the operation flow of the information processing system 100 in this embodiment will be described. Figure 3 is a diagram illustrating the operation flow of the information processing system 100 in this embodiment. Figure 3 describes the operation flow between each component in the information processing system 100 in this embodiment, and the processing performed by each component.

[0048] In this embodiment, first, software information relating to the implemented software and approved software is input to the user terminal 400 of a user utilizing the information processing system 100 (S101). Here, the user in this embodiment is, for example, a business user developing a product or service, who can input the above software information to the user terminal 400 using a predetermined interface. The software information is then transmitted from the user terminal 400 to the first database or the second database.

[0049] In the first database, the information entered from the user terminal 400 is acquired (S102) and stored as information related to the implemented software. In the second database, the information entered from the user terminal 400 is acquired (S102) and stored as information related to the approval software.

[0050] Next, in the comparison process, the server 300 obtains a degree of agreement, which represents the degree of agreement between the implementation software stored in the first database and the approval software stored in the second database (S103). In this embodiment, the server 300 obtains the degree of agreement as the degree of agreement between the number of implementation software and the number of approval software.

[0051] Then, in S104, the server 300 determines whether the number of implemented software and the number of approved software are different. If the determination in S104 is positive, that is, if the number of implemented software and the number of approved software are different, the server 300 proceeds to processing S105. If the determination in S104 is negative, that is, if the number of implemented software and the number of approved software are the same, the server 300 terminates the execution of this flow.

[0052] If a positive determination is made in S104, then in S105, the server 300 makes an alert determination. In this embodiment, if the above degree of match differs because the number of approved software is greater than the number of implemented software, the server 300 makes an alert determination for a missed detection in the management status of the implemented software. On the other hand, if the above degree of match differs because the number of approved software is less than the number of implemented software, the server 300 makes an alert determination for a false detection in the management status of the implemented software.

[0053] As mentioned above, the first database, SBOM, may include the functionality of an OSS detection tool for detecting open-source software (OSS), such as a function that scans the source code registered in SBOM and matches it with a database that stores information on OSS from around the world to detect the presence or absence of OSS. However, the Disclosing Party has found that even with the use of such OSS detection tool functions, OSS may be missed or falsely detected, making it difficult to properly manage OSS implemented in products and services.

[0054] Therefore, in this embodiment, if the degree of agreement differs because the number of approved software is greater than the number of implemented software, the server 300 notifies the user terminal 400 of the user using the information processing system 100 of a confirmation request (S106). This confirmation request includes, for example, a request for a list of OSS data used by the user using the information processing system 100 in the development of a product or service. The user terminal 400 then acquires information about this confirmation request (S107), and the user's response is entered into the user terminal 400 (S108). When the server 300 acquires information about this response (S109), it performs a secondary determination of the alert determination in the processing of S105 (S110). Specifically, the server 300 compares the list of OSS data included in the response with the implemented software, and if the OSS included in the response is not included in the implemented software detected by the OSS detection tool in the first database, SBOM, it determines that there has been a detection omission in the detection of OSS in the first database. According to this, it is possible to more accurately determine OSS detection omissions that may occur even when using the functions of an OSS detection tool to detect OSS in the first database, SBOM.

[0055] On the other hand, if the degree of agreement differs because the number of approved software is less than the number of implemented software, the server 300 also notifies the user terminal 400 of the user using the information processing system 100 of a confirmation request (S106). This confirmation request is, for example, to confirm whether software among the implemented software that is not included in the approved software is an indirect use of the approved software. The user terminal 400 then obtains information about this confirmation request (S107), and the user's response is entered into the user terminal 400 (S108). When the server 300 obtains information about this response (S109), it performs a secondary determination of the alert determination in the process of S105 (S110).

[0056] In detail, in the processing of S110, if the server 300 determines, based on the above response, that software among the implemented software that is not included in the approved software is an indirect use of the approved software, then the server 300 determines that the indirect use software was erroneously detected as unapproved source software in the detection of OSS in the first database. The above indirect use refers to OSS that is indirectly used in the approved software. This makes it possible to more specifically identify OSS false detections that may occur even when using the functions of the OSS detection tool for detecting OSS in the first database, SBOM.

[0057] In this case, the server 300 may further determine whether the indirectly used software is included in a predetermined distribution file. Here, the distribution file is, for example, an exe file, which is the binary data executable file of an application, and the server 300 can determine this by, for example, comparing it with a list of distribution files stored in a predetermined database. If the indirectly used software is included in the predetermined distribution file, the server 300 notifies the user terminal 400 of the user using the information processing system 100 of a warning regarding the vulnerability of the software and / or the license of the software. In other words, the server 300 notifies the user of the above warning regarding distribution files that may affect the executable file of an application that constitutes a product or service when the source code of the indirectly used software is converted to binary data. This makes it possible to prevent situations in which failures occur due to indirectly used approved software.

[0058] Furthermore, in the processing of S110, if the server 300 determines, based on the above response, that the software among the implemented software that is not included in the approved software is not an indirect use of the approved software, it may determine whether or not the software was automatically added by a predetermined development tool. Here, software that can be automatically added by the above development tool includes, for example, runtimes that are automatically added when compiling source code, things that can be added by a test tool in the development environment, or OSS that can be automatically added by a generation AI, for example. The server 300 can determine the above by comparing these with a list of such software stored in a predetermined database. The server 300 can then determine that if the software among the implemented software that is not included in the approved software is neither an indirect use of the approved software nor software that was automatically added by a predetermined development tool, a false positive has occurred in the detection of OSS in the first database. This makes it possible to determine with greater accuracy false positives of OSS that may occur even when using the functions of an OSS detection tool for detecting OSS in the first database, SBOM. Furthermore, in this case, if the server 300 detects that the implemented software not included in the approved software was automatically added by the development tool, it may notify the user terminal 400 of the user using the information processing system 100 of a warning regarding the vulnerability of the software and / or the license of the software. This makes it possible to prevent situations in which failures occur due to software that may be automatically added by the development tool.

[0059] In addition, in processing S103, the server 300 may obtain the degree of matching between the versions of the approved software and the implementation software that is paired with the approved software as the degree of matching described above.

[0060] In this case, if the degree of match in processing S105 differs due to a difference in versions between the approved software and the implementation software paired with the approved software, the server 300 performs a version-related alert on the management status of the implementation software and notifies the user terminal 400 of the user using the information processing system 100 of a request for confirmation (S106), thereby prompting the user to confirm the version of the implementation software. If the version of the implementation software is older than the version it was approved for, there is a risk of vulnerabilities in the software or problems with the licenses being used. Therefore, by prompting the user to confirm the version of the implementation software as described above, it is possible to prevent problems from occurring due to version differences. Furthermore, in this case, the server 300 may also notify the user terminal 400 of the user using the information processing system 100 of a warning regarding confirmation of the version of the approved software. If the version of the implementation software is newer than the version it was approved for, problems may occur due to the older version of the approved software. Therefore, by prompting the user to verify the version of the approved software as described above, it becomes possible to encourage verification of the authenticity of the approved software, as well as vulnerabilities in the approved software and the licenses being used. As shown in this example, the server 300 may not only perform processing for detection omissions, false positives, and version verification of the implemented software, but also perform processing to prompt verification of the authenticity of the approved software itself if there is a difference in the degree of matching between the implemented software and the approved software.

[0061] Furthermore, if the implemented software contains snippets or if the implemented software contains software associated with multiple licenses, the server 300 may notify the user terminal 400 of a user using the information processing system 100 of a request for confirmation regarding the use of OSS. Here, if the implemented software contains snippets, a situation may arise where those snippets have vulnerabilities. Therefore, by prompting the user to check the snippets included in the implemented software as described above, it is possible to prevent situations in which problems arise due to such snippets. Also, if the implemented software contains software associated with multiple licenses, a violation of the compatibility of those licenses may occur. Therefore, by prompting the user to check as described above, it is possible to prevent situations in which problems arise due to licenses.

[0062] According to the information processing system 100 described above, open-source software implemented in a given product or service can be properly managed.

[0063] <Second Embodiment> The information processing system 100 in the second embodiment will be described with reference to Figure 4. In this embodiment, the implemented software stored in the first database and the off-the-shelf software stored in the second database are compared, and a determination process is executed based on the comparison result.

[0064] Here, the first database in this embodiment is a database that stores a list of multiple open-source software (OSS) implemented in a product or service, along with the dependencies between said open-source software (OSS), as described in the first embodiment above, and is a predetermined software bill of materials.

[0065] Furthermore, the second database in this embodiment is a database that stores information about off-the-shelf software, which is open-source software (OSS) included in an off-the-shelf application. The off-the-shelf application mentioned above is, for example, an application that constitutes a product or service by a third party, and the OSS included in the application is made publicly available via a website or the like.

[0066] Figure 4 illustrates the flow of operation of the information processing system 100 in this embodiment. Figure 4 explains the flow of operation between each component in the information processing system 100 in this embodiment, and the processing performed by each component.

[0067] In the example shown in Figure 4, first, software information regarding the implemented software is input to the user terminal 400 of the user utilizing the information processing system 100 (S201). Then, the software information is transmitted from the user terminal 400 to the first database.

[0068] In this case, the first database receives the information entered from the user terminal 400 (S202), and stores it as information about the implemented software.

[0069] Next, in the comparison process, the server 300 obtains the degree of agreement regarding the properties of the implemented software stored in the first database and the off-the-shelf software stored in the second database that is paired with the implemented software (S203). The above-mentioned software properties may include information about the source in addition to the name, attributes, size, etc. of the software.

[0070] Here, the first database, SBOM, is configured to display implemented software as a list along with its dependencies on open-source software to users of the information processing system 100, thereby also displaying the properties of the implemented software to the user. However, at this time, information may be missing in the properties of the implemented software, for example, if the implemented software is registered in the first database with insufficient information. The Discloser has found that in such cases, if information regarding the origin of the implemented software is missing, it becomes impossible to properly manage failures caused by vulnerabilities in the implemented software or problems caused by the version or license of the implemented software.

[0071] Therefore, in S204, server 300 determines whether the degree of agreement differs due to the lack of information regarding the origin of the implemented software. If the determination in S204 is positive, that is, if the degree of agreement differs due to the lack of information regarding the origin of the implemented software, server 300 proceeds to processing S205. If the determination in S204 is negative, server 300 terminates the execution of this flow.

[0072] If a positive result is obtained in S204, then in S205, the server 300 performs an alert determination regarding the management status of the implemented software.

[0073] Next, in S206, the server 300 performs an estimation process to estimate the origin of the implemented software for which information about its origin is missing. Specifically, for implemented software for which information about its origin is missing, the server 300 estimates the origin of the off-the-shelf software that is paired with the said software as the origin of the said software.

[0074] Furthermore, in such a processing flow, in order to accurately estimate the origin of implementation software for which information on the origin is lacking, it is necessary to accurately identify the off-the-shelf software that is paired with the implementation software.

[0075] Therefore, in this embodiment, a process is performed in advance to identify the off-the-shelf application that contains the pair of off-the-shelf software described above. As a result, the second database contains information about the off-the-shelf software included in the identified off-the-shelf application.

[0076] Then, in order to perform the specific processing described above, the server 300 first randomly extracts multiple implementation software from the first database and performs an extraction process to store the extracted software as extracted software.

[0077] Then, in a specific process, the server 300 identifies the off-the-shelf application by comparing the extraction software described above with the lineup of OSS used by the off-the-shelf application, which is an application that constitutes any product or service by a third party.

[0078] More specifically, in the identification process described above, the server 300 identifies off-the-shelf applications by comparing the names or copyright notices of each software in a lineup of OSS used by the off-the-shelf applications, where the dependencies between the OSS are stored as a hierarchical structure, with the names or copyright notices of each software included in the extracted software. For example, the server 300 can identify an application as an off-the-shelf application if it has a lineup of OSS whose names or copyright notices exactly match those of each software included in the extracted software. Alternatively, the server 300 may identify an application as an off-the-shelf application if it has a lineup of OSS whose names or copyright notices more than half match those of each software included in the extracted software.

[0079] On the other hand, if the software name or copyright notice does not allow for the identification of a commercially available application, the server 300 may, in the identification process described above, identify the commercially available application by comparing the versions and license notices of each software in the lineup, where the dependencies between the OSS used by the commercially available application are stored as a hierarchical structure, with the versions and license notices of each software included in the extracted software.

[0080] Furthermore, in the above-mentioned specific processing, the server 300 may identify off-the-shelf applications by combining the name or copyright notice, version, and license information of each software. In addition, the server 300 may use a pre-trained model that has been built in advance to identify off-the-shelf applications. Here, the pre-trained model is, for example, a neural network model generated by deep learning, and has an input layer that accepts the above-mentioned software name, copyright notice, version, and license information as input, an intermediate layer (hidden layer) that extracts features from this data input to the input layer, and an output layer that outputs the identification result based on the features as an answer. Such a pre-trained model is constructed, for example, by performing supervised learning using training data, which is a pair of information about the case and a classification label indicating whether or not it is identified as an off-the-shelf application, for case data used to identify off-the-shelf applications. Specifically, the pair of features and labels is given to the neural network, and the weights of the connections between neurons are tuned so that the output of the neural network is the same as the label. In this way, a pre-trained model for learning the features of the training data and estimating results from input is inductively acquired.

[0081] As mentioned above, off-the-shelf applications are, for example, applications that constitute products or services from third parties, and the open-source software (OSS) included in such applications is publicly available via websites, etc. Therefore, the properties of the OSS included in off-the-shelf applications can be considered relatively reliable.

[0082] Furthermore, in the estimation process described above, for implementation software for which information about the origin is lacking, the origin of the implementation software for which information about the origin is lacking can be estimated with high accuracy by estimating the origin of the off-the-shelf software that is paired with the implementation software and is included in the off-the-shelf application thus identified as the off-the-shelf software.

[0083] The information processing system 100 described above can also be used to properly manage open-source software implemented in a given product or service.

[0084] <Other variations> The embodiments described above are merely examples, and this disclosure may be modified as appropriate without departing from its essence. For example, the processes and means described in this disclosure can be freely combined and implemented as long as no technical inconsistencies arise.

[0085] Furthermore, processes described as being performed by a single device may be divided and executed by multiple devices. For example, the verification processing unit 3033 may be formed in a separate arithmetic processing unit from the server 300. In this case, the separate arithmetic processing unit is configured to cooperate suitably with the server 300. Also, processes described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is implemented can be flexibly changed.

[0086] The present disclosure can also be realized by supplying a computer program implementing the functions described in the embodiments above to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer by a non-temporary computer-readable storage medium that can be connected to the computer's system bus, or it may be provided to the computer via a network. Non-temporary computer-readable storage mediums include, for example, any type of disk such as magnetic disks (floppy disks, hard disk drives (HDDs), etc.), optical disks (CD-ROMs, DVDs, Blu-ray discs, etc.), read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards, flash memory, optical cards, and any type of medium suitable for storing electronic instructions. [Explanation of Symbols]

[0087] 100... Information Processing Systems 200 Network 300 servers 301... Communications Department 302...Storage section 303... Control Unit 400...User terminals

Claims

1. An information processing device for managing open-source software implemented in a specified product or service, The system includes a control unit that performs a comparison process for comparing a first database, which stores information about the open-source software implemented in the product or service, with a second database, which stores information about a predetermined software. The control unit, In the comparison process, a degree of agreement is obtained that represents the degree of agreement between the open-source software implementation software stored in the first database and the software stored in the second database. Based on the obtained degree of agreement, a determination process is executed to determine the management status of the implementation software. Information processing device.

2. The first database is a predetermined software bill of materials, The second database is a database that stores information about approved software, which is open-source software that has been preapproved to be implemented in the product or service, The control unit, In the aforementioned determination process, if the degree of agreement differs under predetermined conditions, an alert determination is made regarding the management status of the implemented software. Further, the process of notifying the user of a request for confirmation regarding the use of the aforementioned implemented software is performed. The information processing apparatus according to claim 1.

3. The control unit, In the aforementioned determination process, if the degree of agreement differs because the number of approved software is greater than the number of implemented software, an alert determination of a missed detection is made in the management status of the implemented software. The system obtains the user's response to the confirmation request notified to the user, and if the implementation software does not include the open-source software included in the response, it is determined that a detection error has occurred in the detection of open-source software in the first database. The information processing apparatus according to claim 2.

4. The control unit, In the determination process, if the degree of agreement differs because the number of approved software is less than the number of implemented software, an alert determination of false detection is made regarding the management status of the implemented software. If any of the implementation software not included in the approved software is an indirect use of the approved software, the software of the indirect use is determined to have been incorrectly detected as unapproved source software in the detection of open source software in the first database. The information processing apparatus according to claim 2.

5. The control unit, If the software of the indirectly used product is included in a designated distribution file, a warning regarding the vulnerability of the software, and / or the license of the software will be issued. The information processing apparatus according to claim 4.

6. The control unit, In the determination process, if the degree of agreement differs because the number of approved software is less than the number of implemented software, an alert determination of false detection is made regarding the management status of the implemented software. If the software included in the implementation software that is not included in the approved software is not an indirect use of the approved software and is not software that was automatically added by a predetermined development tool, then it is determined that a false positive has occurred in the detection of open-source software in the first database. The information processing apparatus according to claim 2.

7. The control unit, If any of the implementation software not included in the approved software is software automatically added by the development tool, a warning regarding the vulnerability of said software, and / or the license of said software will be issued. The information processing apparatus according to claim 6.

8. The control unit, In the comparison process, the degree of agreement between the approval software and the implementation software paired with the approval software is obtained. In the determination process, if the degree of agreement differs due to different versions of the approval software and the implementation software paired with the approval software, an alert determination regarding the version is made in the management state of the implementation software. The information processing apparatus according to claim 2.

9. The control unit, The system notifies a warning regarding the verification of the versions of the implementation software and the approved software. The information processing apparatus according to claim 8.

10. The first database is a predetermined software bill of materials, The second database is a database that stores information about off-the-shelf software, which is open-source software included in off-the-shelf applications, The control unit, In the comparison process described above, the degree of agreement is obtained for the properties of the implemented software and the off-the-shelf software that is paired with the implemented software. In the aforementioned determination process, if the degree of agreement differs due to a lack of information regarding the origin of the implemented software, an alert determination is made regarding the management status of the implemented software. The information processing apparatus according to claim 1.

11. The control unit, An extraction process that randomly extracts multiple implementation software from the first database and stores the extracted software as extracted software, A process to identify the off-the-shelf application by comparing the extraction software with the lineup of open-source software used by the off-the-shelf application, With respect to the software among the implemented software for which information regarding its origin is lacking, the following estimation process is performed to estimate the origin of the off-the-shelf software that is paired with the software and is included in the identified off-the-shelf application: The information processing apparatus according to claim 10.

12. The control unit, In the aforementioned identification process, with respect to the open-source software used by the off-the-shelf application, the off-the-shelf application is identified by comparing the name or copyright notice of each software in a lineup where the dependencies between the open-source software are stored as a hierarchical structure with the name or copyright notice of each software included in the extracted software. The information processing apparatus according to claim 11.

13. An information processing method for managing open-source software implemented in a specified product or service, Computers Comparing a first database storing information about the open-source software implemented in the product or service with a second database storing information about a predetermined software, Obtaining a degree of agreement that represents the degree of agreement between the open-source software implementation software stored in the first database and the software stored in the second database, Based on the obtained degree of agreement, the management status of the implementation software is determined, An information processing method that performs the following.

14. The first database is a predetermined software bill of materials, The second database is a database that stores information about approved software, which is open-source software that has been preapproved to be implemented in the product or service, The aforementioned computer, If the degree of agreement differs under predetermined conditions, an alert is issued regarding the management status of the implemented software. To further notify the user of a request for confirmation regarding the use of the aforementioned implemented software, The information processing method according to claim 13.

15. The first database is a predetermined software bill of materials, The second database is a database that stores information about off-the-shelf software, which is open-source software included in off-the-shelf applications, The aforementioned computer, Obtaining the degree of agreement with respect to the properties of the implemented software and the off-the-shelf software that is paired with the implemented software, If the degree of agreement differs due to a lack of information regarding the origin of the implemented software, an alert is issued regarding the management status of the implemented software. The information processing method according to claim 13.

16. An information processing program that manages open-source software implemented in a specified product or service, On the computer, Comparing a first database storing information about the open-source software implemented in the product or service with a second database storing information about a predetermined software, Obtaining a degree of agreement that represents the degree of agreement between the open-source software implementation software stored in the first database and the software stored in the second database, Based on the obtained degree of agreement, the management status of the implementation software is determined, An information processing program that executes [something].

17. The first database is a predetermined software bill of materials, The second database is a database that stores information about approved software, which is open-source software that has been preapproved to be implemented in the product or service, To the aforementioned computer, If the degree of agreement differs under predetermined conditions, an alert is issued regarding the management status of the implemented software. To notify the user of a request for confirmation regarding the use of the aforementioned implemented software, and to further perform the following: The information processing program according to claim 16.

18. The first database is a predetermined software bill of materials, The second database is a database that stores information about off-the-shelf software, which is open-source software included in off-the-shelf applications, To the aforementioned computer, Obtaining the degree of agreement with respect to the properties of the implemented software and the off-the-shelf software that is paired with the implemented software, If the degree of agreement differs due to a lack of information regarding the origin of the implemented software, an alert is issued regarding the management status of the implemented software, and the following is further performed: The information processing program according to claim 16.

Images