Rule generation device, rule generation method, and program

Abstract

This invention provides a rule generation device, a rule generation method, and a program for generating access control rules based on security guidelines. [Solution] The rule generator acquires security guideline text and system information indicating information related to the network system on which access control based on the guidelines defined by the security guideline text should be implemented. Using a generation model, it generates an access control rule set from the security guideline text and system information. The access control rules are rules that manage access related to the network system and can be interpreted by an access control program that implements access control based on the access control rules. The rule generator further performs verification of the access control rule set to determine whether the access control rules are correct.

Description

Technical Field

[0001] The present disclosure generally relates to a rule generation device, a rule generation method, and a program.

Background Art

[0002] To manage computer security in a network system, security guidelines are provided in natural language. Patent Document 1 discloses a technique for detecting inconsistencies in policies described in natural language using a large language model (LLM).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Security guidelines are applied to control network access related to a network system, such as network access from a corporate network to the Internet. However, since a program for implementing access control cannot directly interpret natural language text, it is necessary to create rules that can be interpreted by a program based on security guidelines described in natural language.

[0005] Patent Document 1 does not disclose a technique for generating access control rules that can be interpreted by an access control program from policies described in natural language. An object of the present disclosure is to provide a novel technique for generating access control rules based on security guidelines.

Means for Solving the Problems

[0006] This disclosure provides a rule generating device comprising at least one memory configured to store instructions and at least one processor. At least one processor is configured to execute instructions for generating and verifying access control rules to determine whether the access control rules are correct, by obtaining security guideline text and system information indicating information relating to a network system on which access control is implemented based on the guidelines defined by the security guideline text, and by generating access control rules based on the security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access relating to the network system and are interpretable by an access control engine that implements access control based on the access control rules.

[0007] This disclosure further provides a method for generating rules that is performed by a computer. This method includes the steps of: obtaining a security guideline text and system information indicating information relating to a network system on which access control based on the guidelines defined by the security guideline text should be implemented; generating access control rules based on the security guideline text and system information using a generation model, wherein the access control rules are rules for managing network access related to the network system and are interpretable by an access control engine that implements access control based on the access control rules; and performing validation of the access control rules to determine whether the access control rules are correct.

[0008] The disclosure also further includes a program that causes a computer to perform the following steps: acquiring security guideline text and system information indicating information relating to a network system on which access control based on the guidelines defined by the security guideline text should be implemented; generating access control rules based on the security guideline text and system information using a generation model, wherein the access control rules are rules for managing network access relating to the network system and are interpretable by an access control engine that implements access control based on the access control rules; and performing verification of the access control rules to determine whether the access control rules are correct. [Effects of the Invention]

[0009] This disclosure reveals a novel technique for generating access control rules based on security guidelines. [Brief explanation of the drawing]

[0010] [Figure 1] This diagram shows an overview of the rule generation device. [Figure 2] This is a diagram showing an example of the functional configuration of a rule generator. [Figure 3] This is a block diagram showing an example of a computer hardware configuration for implementing a rule generation device. [Figure 4] This flowchart illustrates an example of the processing flow performed by the rule generator. [Figure 5] This flowchart illustrates an example of the process flow for generating an access control rule set, which is implemented by the generation unit. [Figure 6] This is a diagram showing an example of the structure of an attribute set. [Figure 7] This figure shows an example of a generation prompt. [Figure 8] The figure shows an example of a verification prompt. [Modes for carrying out the invention]

[0011] Embodiments of this disclosure will be described below with reference to the drawings. In each drawing, the same elements are denoted by the same reference numerals, and redundant descriptions will be omitted as necessary. In addition, unless otherwise specified, predetermined information (for example, a predetermined value or a predetermined threshold) is pre-stored in a memory unit accessed by the computer using that information. In this disclosure, the memory unit may be implemented by one or more storage devices such as a Hard Disk Drive (HDD), a Solid-State Drive (SSD), or Random-Access Memory (RAM).

[0012] First Embodiment <Overview> Figure 1 shows an overview of the rule generation device 2000. Note that Figure 1 does not limit the operation of the rule generation device 2000, but merely shows one example of the operations it can perform.

[0013] The rule generator 2000 is configured to generate an access control rule set 60 based on the security guideline text 10 and system information 20. The security guideline text 10 is written in a natural language such as English or Japanese. The security guideline text 10 defines computer security guidelines that apply to a network system called the target system. The security guideline text 10 defines, at a minimum, how network communications in the target system should be managed. The target system is a system that is access-controlled according to the security guidelines defined in the security guideline text 10. The system information 20 is related to the target system and provides details about the target system, such as the structure of the target system.

[0014] The access control rule set 60 is a set of access control rules 62, each defining a rule for managing network access related to the target system. Network access related to the target system can include network access from one node within the target system to another node within the target system, network access from one node within the target system to a node outside the target system, or network access from a node outside the target system to a node within the target system. A node is any type of computer, such as a personal computer (PC), server machine, mobile device (e.g., smartphone or tablet device), or sensor device.

[0015] Each access control rule 62 is generated in a format that can be interpreted by the access control engine. The access control engine is a program that interprets the access control rules 62 to manage network access related to the target system. The access control engine can run on any computer capable of managing network access related to the target system. For example, the access control engine runs on a gateway placed between nodes within the target system and nodes outside the target system. Note that the access control engine can run on two or more computers.

[0016] The rule generation device 2000 generates an access control rule set 60 using the generation model 100. Specifically, the rule generation device 2000 generates a generation prompt 40 using the security guideline text 10 and the system information 20, and provides the generation prompt 40 to the generation model 100. The generation prompt 40 is prompt text representing a request for generating a rule set called rule 52 for managing network access related to the target system based on the security guideline text 10 and the system information 20. The generation model 100 outputs a response 50 including the rule set 52 in response to the generation prompt 40 being input into the generation model 100.

[0017] The generation model 100 refers to any type of generation model configured and pre-trained to process a prompt including a request and output a response including the result of processing the request. For example, the generation model 100 may be, but is not limited to, an LLM.

[0018] The rule generation device 2000 derives an access control rule set 60 based on the response 50. The rule generation device 2000 can either use the rule set 52 as the access control rule set 60 as it is, or modify the rule set 52 to generate the access control rule set 60. In the latter case, for example, the rule generation device 2000 generates the access control rule set 60 by modifying the format of the rule 52 so that it can be interpreted by the access control engine.

[0019] The generation model may potentially generate inherently inaccurate data. Since the access control rule set 60 is generated based on the response 50 generated by the generation model 100, the access control rule set 60 may include one or more incorrect rules. Therefore, the rule generation device 2000 verifies the access control rule set 60 to determine whether each access control rule 62 is correct.

[0020] <Example of effects> According to the rule generation device 2000, an access control rule set 60 for managing network access related to a target system is automatically generated using a generative model based on security guideline text 10 written in natural language. Therefore, a novel technique is provided for generating rules that manage network access based on security guidelines.

[0021] The rule generator 2000 offers several advantages. First, it enables the generation of access control rules with less time and effort than a user could generate such rules manually. Second, it enables the application of security guidelines to access control rules with greater accuracy than a user could achieve manually. Third, the rule generator 2000 can ensure the accuracy of the access control rule set 60 by verifying it. As a result, users can avoid unintentionally applying incorrect access control rules to the target system.

[0022] The rule generator 2000 will be described in more detail below.

[0023] <Example of functional configuration> Figure 2 is a block diagram showing an example of the functional configuration of the rule generation device 2000. In the example shown in Figure 2, the rule generation device 2000 includes an acquisition unit 2020, a generation unit 2040, and a verification unit 2060. The acquisition unit 2020 acquires security guideline text 10 and system information 20. The generation unit 2040 uses the generation model 100 to generate an access control rule set 60 from the security guideline text 10 and system information 20. The verification unit 2060 verifies the access control rule set 60.

[0024] <Example hardware configuration> The rule generator 2000 can be implemented using one or more computers. Each of these computers can be a personal computer (PC), a server machine, a mobile device, or an integrated circuit such as a system-on-chip (SoC). The computers may be dedicated computers designed specifically for the rule generator 2000, or they may be general-purpose computers.

[0025] The rule generator 2000 can be implemented by installing an application on one or more computers. This application is a program that causes the computers to function as the rule generator 2000. In other words, the program implements the functional components of the rule generator 2000.

[0026] Figure 3 is a block diagram showing an example of the hardware configuration of a computer 1000 that implements a rule generation device 2000. As shown in Figure 3, the computer 1000 has a bus 1020, a processor 1040, a memory 1060, a storage device 1080, an input / output (I / O) interface 1100, and a network interface 1120.

[0027] Bus 1020 functions as a data transmission channel, allowing the processor 1040, memory 1060, storage device 1080, input / output interface 1100, and network interface 1120 to exchange data. The processor 1040 may be a CPU (Central Processing Unit), MPU (Microprocessor Unit), GPU (Graphics Processing Unit), FPGA (Field-Programmable Gate Array), or DSP (Digital Signal Processor). Memory 1060 functions as a main memory element such as RAM (Random Access Memory) or ROM (Read-Only Memory). Storage device 1080 functions as an auxiliary storage element such as a hard disk, SSD (Solid-State Drive), or memory card. The input / output interface 1100 connects the computer 1000 to peripheral devices such as a keyboard, mouse, and display. The network interface 1120 connects the computer 1000 to a network, which may be a LAN (Local Area Network) or a WAN (Wide Area Network).

[0028] The storage device 1080 can store the program described above. By the processor 1040 reading and executing this program from the storage device 1080, the computer 1000 can implement the functional components of the rule generation device 2000.

[0029] The hardware configuration of computer 1000 is not limited to the example shown in Figure 3. For example, as described above, the rule generation device 2000 may be implemented using multiple computers. In this case, these computers may be connected to each other via a network.

[0030] <Processing flow> Figure 4 is a flowchart illustrating an example of the processing flow performed by the rule generation device 2000. The acquisition unit 2020 acquires the security guideline text 10 and system information 20 (S102). The generation unit 2040 generates an access control rule set 60 based on the security guideline text 10 and system information 20 (S104). The verification unit 2060 verifies the access control rule set 60 (S106).

[0031] <Acquisition of Security Guideline Text 10: S102> The acquisition unit 2020 acquires the security guideline text 10 (S102). There are various ways to acquire the security guideline text 10. For example, the security guideline text 10 is pre-stored in a storage unit accessible to the rule generator 2000. In this case, the acquisition unit 2020 acquires the security guideline text 10 from the storage unit. The identifier of the security guideline text 10 (e.g., a file path) may be specified by the user of the rule generator 2000.

[0032] In another example, the security guideline text 10 is sent to the rule generator 2000 from another computer, such as a user terminal operated by a user of the rule generator 2000. In this case, the acquisition unit 2020 receives the security guideline text 10.

[0033] <Acquisition of system information 20: S102> The acquisition unit 2020 acquires system information 20 (S102). An example of how to acquire system information 20 is the same as the example of how to acquire it in the security guideline text 10 described above.

[0034] <Generating access control rule set 60: S104> The generation unit 2040 generates an access control rule set 60 based on the security guideline text 10 and system information 20 (S104). Specifically, the generation unit 2040 generates a generation prompt 40 and provides the generation prompt 40 to the generation model 100 to obtain a response 50 for generating the access control rule set 60.

[0035] Figure 5 is a flowchart showing an example of the process flow for generating the access control rule set 60, which is performed by the generation unit 2040. The generation unit 2040 generates a guideline set 70 based on the security guideline text 10 (S202). The generation unit 2040 generates an attribute set 80 based on the system information 20 (S204). The generation unit 2040 generates a generation prompt 40 based on the guideline set 70 and the attribute set 80 (S206). The generation unit 2040 provides the generation prompt 40 to the generation model 100 and thereby obtains a response 50 (S208). The generation unit 2040 uses the response 50 to obtain the access control rule set 60 (S210).

[0036] <<Generating Guideline Set 70: S202>> The generation unit 2040 generates a guideline set 70 based on the guideline text 10 (S202). The guideline set 70 includes a set of guideline sections 72, each representing a security guideline extracted from the security guideline text 10.

[0037] The generation unit 2040 divides the security guideline text 10 into multiple sections based on the theme of the guideline, treating each of these sections as a guideline section 72. For example, the security of industrial control systems can include many themes such as "network segmentation," "channel protection," "firewall guidelines," and "attack countermeasures."

[0038] <<Generating Attribute Set 80: S204>> The generation unit 2040 generates an attribute set 80 based on the system information 20 (S204). The attribute set 80 includes a set of attribute data 82, which are pairs of attribute names and attribute values.

[0039] Figure 6 shows an example of the structure of attribute set 80. As described above, attribute set 80 contains a set of attribute data 82. In Figure 6, attribute set 80 is represented as a table, and each row of the table corresponds to the respective attribute data 82. The attribute data 82 contains a name 84 and a value 86.

[0040] Attributes related to the target system may include entities related to the target system, characteristics of communications related to the target system, and services related to the target system.

[0041] Entities associated with a target system may include zones or nodes associated with the target system. A zone represents an area of ​​a network, such as an enterprise network, an information and communication technology (ICT) network, or the internet. The value 86 corresponding to the name "zone" 84 can indicate identifiers for one or more zones associated with the target system, such as an address space.

[0042] A node represents a sender, receiver, or intermediate device for data flowing through the target system. The value 86 corresponding to the name “node” 84 can represent the identifier of one or more nodes associated with the target system, such as an Internet Protocol (IP) address or Media Access Control (MAC) address. Note that the identifier of each node may be represented in relation to the identifier of the zone containing the node.

[0043] The characteristics of communications related to the target system may include the protocols and communication types available for communications related to the target system. The value 86 corresponding to the name 84 "protocol" may indicate identifiers, e.g., names, of one or more protocols that may be used for communications related to the target system.

[0044] The communication type associated with the target system represents the type of communication associated with the target system, for example, whether the communication is between the same systems, whether the communication is conducted at the same security level, whether the communication is conducted under the same policy, or whether the communication is unicast. The value 86 corresponding to the name 84 associated with the communication type, such as "same system," can represent a Boolean of 1 or 0, i.e., true or false. In another example, the value 86 could represent the name of a category such as "unicast," "multicast," or "broadcast."

[0045] Services associated with the target system may include attributes of the service related to the target system, such as the service protocol (layer 4, application layer, etc.), the presence of encryption or authentication services, whether the service is required, whether the service is critical (from a security needs perspective), and the type of service. The value 86 corresponding to the service can represent a service protocol such as "TCP" or "UDP", an application protocol such as "ssh" or "rlogin", a boolean value indicating the presence of the service, "Yes", "No", or other values ​​indicating how critical the service is, or a name such as "REMOTE LOGIN" indicating the type of service.

[0046] System information 20 contains information that can be used to generate an attribute set 80. For example, system information 20 may include system model information 22, data flow information 24, and protocol information 26. System model information 22 includes the structure of the target system, such as a list of zones related to the target system, connections between zones, and a list of nodes contained in each zone. System model information 22 may also indicate the characteristics of each node, such as the node type, the security level assigned to the node, or the security policy applied to the node.

[0047] Data flow information 24 includes examples of data flows related to the target system, namely, data flows within the target system, data flows from within the target system to outside the target system, and data flows from outside the target system to within the target system. A data flow may be represented by a source node and a destination node pair. Additional information such as the protocol, source port, and destination port may also be used to represent a data flow.

[0048] Protocol information 26 includes a list of protocols that may be used for communication related to the target system. Protocol information 26 may also indicate the allowed source, allowed destination, or both of the following protocols. Allowed sources and destinations may be represented by nodes, zones, or both. A source node is a node that accesses a destination node. A source zone is the network area where the source node is located. A destination zone is the network area where the destination node is located.

[0049] The generation unit 2040 generates an attribute set 80 based on the system model information 22, data flow information 24, and protocol information 26. Specifically, the generation unit 2040 can generate attribute data 82 related to entities based on the system model information 22. The generation unit 2040 extracts zone identifiers from the system model information 22 and generates an attribute 82 having the name "zone" 84 and a value 86 containing a list of extracted zones. Similarly, the generation unit 2040 extracts node identifiers from the system model information 22 and generates an attribute 82 having the name "node" 84 and a value 86 containing a list of extracted nodes.

[0050] The generation unit 2040 extracts protocol identifiers from protocol information 26 and generates an attribute 82 having the name "protocol" 84 and a value 86 that includes a list of extracted protocols.

[0051] Communication type attribute data is extracted from system information 20 based on the source and destination nodes and zones present in system information 20. For example, the communication attribute "same system" may be extracted based on whether the source node and destination node are devices of the same type, such as "OFFICE-PC". In that case, the attribute value will be "1" or "Yes", and otherwise it will be "0" or "No". Similarly, each node may have a security level assigned to it. This allows the communication type "security level" to be extracted from the security levels of the nodes present in system information 20. In the same way, the communication attribute "same policy" is extracted.

[0052] Service type attribute data is extracted from system information 20 based on information about the service protocol (layer 4 and application). The protocol information 26 present in system information 20 allows for the extraction of the "service.encryption" and "service.authentication" attributes based on the service protocol type knowledge within protocol information 26. For example, when using protocols such as "TLS" and the application protocol "SSH," authentication and encryption are ON by default. Therefore, the values ​​for service.encryption and service.authentication are assigned to "1" or "Yes." Service attributes such as "critical" and "essential" are assigned by system administration to each "resource," i.e., the destination node in system information 20. This allows for the extraction of the "service.critical" and "service.critical" attributes from the values ​​assigned in system information 20.

[0053] It should be noted that in some implementations, the system information 20 can directly include the attribute set 80. In this case, the generation unit 2040 can obtain the attribute set 80 from the system information 20, so the generation unit 2040 does not need to generate the attribute set 80 from the system information 20.

[0054] <<Generating generation prompt 40: S206>> The generation unit 2040 generates a generation prompt 40 based on the guideline set 70 and the attribute set 80 (S206). The generation prompt 40 may include a request for each guideline section 72 to generate rules for managing network access by applying the guidelines represented by the guideline section 72 to the specific situations represented by the attribute set 80. For this purpose, the generation prompt 40 may include an attribute set 80 and a set of subprompts 42. The subprompts 42 are generated for each guideline section 72 and include the corresponding guideline section 72 and one or more request texts.

[0055] Figure 7 shows an example of a generation prompt 40. In the example shown in Figure 7, the subprompt 42 shows the content of guideline section 72, associated with the title "Facts:". The subprompt 42 also contains three request texts: "Extract Meaning", "Extract Attribute Conditions", and "Generate Rule Script". Meaning represents what the corresponding fact (i.e., the corresponding guideline section 72) means. Attribute conditions represent evaluation conditions for attributes and values, which, if matched by the request, can apply an assigned decision. For example, if such a rule is described in the guideline "Allow only encrypted communications", the attribute condition might be written as IF(service.encryption==TRUE): return ALLOW; else return DENY, where the IF(...) statement includes an attribute condition corresponding to the presence of an encrypted service, which, if matched by the request, can result in an ALLOW decision. The generation prompt can ask to extract attribute conditions from the "Meaning" derived from the guideline in a similar manner to that shown in the example above. A rule script is a program implemented by the access control engine to control network access. To obtain a rule 52 that can be interpreted by the access control engine, the generation prompt 40 can also specify the format of the rule script that can be interpreted by the access control engine.

[0056] The generation prompt 40 does not necessarily include the thumb prompt 42. In some implementations, the generation prompt 40 may include a request text in addition to the guideline set 70 and the attribute set 80, the request text representing a request to generate rules for managing network access having the meaning of the corresponding guideline section 72, using the attribute set 80 for each guideline section 72.

[0057] The generation unit 2040 retrieves a rule 52 for each guideline section 72 (in other words, for each subprompt 42). The rule 52 may include the requested semantics, attribute conditions, and rule script using the request text. The rule 52 may also, in fact, include the corresponding guideline section 72.

[0058] <<Retrieve access control rule 60: S210>> The generation unit 2040 obtains an access control rule set 60 using the response 50 (S210). An access control rule 62 is obtained for each guideline section 72. An access control rule 62 can have the same structure as rule 52 and therefore can include facts, meanings, attribute conditions, and rule scripts. In some implementations, the rule 52 included in the response 50 may be used as an access control rule 62 as is. In this case, the generation unit 2040 extracts the rule 52 from the response 50 and uses the set of these rule 52 as the access control rule set 60.

[0059] In other implementations, the generation unit 2040 generates the access control rule set 60 by modifying the rule 52 included in the response 50. For example, the generation unit 2040 modifies the format of the rule 52 so that it can be interpreted by the access control engine.

[0060] <<Use two or more generative models 100>> In some implementations, the generation unit 2040 can use two or more generative models 100 that are different from each other. These generative models 100 may differ in one or more embodiments, such as their structure, the learning method used to train them, or the learning samples used during their training.

[0061] The generation unit 2040 provides a generation prompt 40 to each of the generation models 100, thereby obtaining a response 50 from each generation model 100. The generation unit 2040 then generates an access control rule set 60 based on these multiple responses 50.

[0062] There are various ways to generate an access control rule set 60 based on multiple responses 50. For example, the generation unit 2040 determines, for each guideline section 72, a rule script agreed upon by majority vote from among multiple rules 52 derived from the multiple responses 50.

[0063] The generation unit 2040 obtains five responses R1 to R5. For guideline section S1, responses R1 to R3 include rule script r1, and responses R4 and R5 include rule script r2. In this case, the generation unit 2040 selects rule script r1 as the rule script to be included in the access control rule 62 for guideline section S1.

[0064] Regarding the meaning included in access control rule 62, the generation unit 2040 can arbitrarily (for example, randomly) select one of the rules 52 from which the rule script included in access control rule 62 was selected. Then, the generation unit 2040 includes the meaning of the selected rule 52 in access control rule 62. In the example above, one of responses R1 to R3 would be selected. The same applies to attribute conditions.

[0065] In another example, the generation unit 2040 divides the rules 52 into one or more groups based on the similarity of the rule scripts, for each guideline section 72. In this case, the generation unit 2040 selects the group with the most members and generates access control rules 62 based on the rules 52 within the selected group. For example, the generation unit 2040 randomly selects one of the rules 52 from the selected group and uses the selected rule 52 as the access control rule 62.

[0066] <Verification of Access Control Rule Set 60: S106> The verification unit 2060 verifies the access control rule set 60 (S106). In some implementations, the verification unit 2060 uses a verification model to verify the access control rule set 60. Specifically, the verification unit 2060 generates a verification prompt 120, which is prompt text representing a request to verify each access control rule 62. The verification unit 2060 then provides the verification prompt 120 to the verification model, causing the verification model to verify the access control rule set 60. The verification unit 2060 may use the generation model 100 as the verification model, or it may use another generation model as the verification model.

[0067] To verify each access control rule 62 as described above, the verification unit 2060 generates a subprompt 122 for each access control rule 62 that represents a request to determine whether the access control rule 62 is correct, based on the facts (i.e., the corresponding guideline section 72), meaning, attribute conditions, and rule script indicated by the access control rule 62.

[0068] Figure 8 shows an example of a validation prompt 120. In the example shown in Figure 8, the sub-prompt 122 includes the corresponding access control rule 62. Furthermore, the sub-prompt 122 includes four request texts: “Determine if the rule is correct,” “Compare facts and meaning for decision,” “Compare meaning and attribute conditions for decision,” and “Compare attribute conditions and rule script for decision.”

[0069] The verification unit 2060 provides a verification prompt 120 to the verification model. In response to the insertion of the verification prompt 120 into the verification model, the verification model outputs a verification response which may include the labels "correct" or "incorrect" for each access control rule 62. Specifically, based on each subprompt 122, the verification model can determine whether the corresponding access control rule 62 is correct by comparing facts with meaning, meaning with attribute conditions, and attribute conditions with rule scripts.

[0070] Access control rule 62 may be determined to be incorrect if the facts do not match the meaning, if the meaning does not match the attribute condition, or if the attribute condition does not match the rule script. Conversely, access control rule 62 may be determined to be correct if the facts match the meaning, if the meaning matches the attribute condition, or if the attribute condition matches the rule script.

[0071] The validation response preferably includes the basis for the validation of access control rule 62, which has been validated as incorrect. Suppose access control rule 62 is validated as incorrect because its attribute conditions do not match the rule script. In this case, the basis for the validation can indicate which part of the attribute conditions does not match which part of the rule script.

[0072] If justification is required for verification, the SUM prompt 122 will also include additional request text such as, "If it is determined that the rule is incorrect, provide the justification for the decision."

[0073] <<Improvements to access control rules before verification>> In some implementations, the verification unit 2060 can improve the access control rules 62 before they are verified. For example, the verification unit 2060 can detect syntax errors in the rule script for each access control rule 62. If a syntax error is detected in the access control rule 62, the verification unit 2060 can modify the access control rule 62 to remove the detected syntax error from the rule script of the access control rule 62.

[0074] Instead of removing syntax errors from the access control rule 62 before providing it to the validation model, the validation unit 2060 may request the validation model to validate the access control rule 62 after removing syntax errors from it. For example, the request text may include "Determine whether the rule is correct after removing syntax errors from the rule script." In this case, it is preferable that the request text also includes a request for providing a corrected rule script, such as "Provide a corrected rule script with syntax errors removed."

[0075] In another example, the verification unit 2060 performs vulnerability detection on each access control rule 62 and removes any detected vulnerabilities from the access control rule 62. For example, the verification unit 2060 can check whether insecure code exists or whether an insecure library with exploitable vulnerabilities is being used in the access control rule, and if found, it can request the regeneration of secure code by prompting the use of a secure library or secure code syntax.

[0076] <Evaluation of Generative Model 100> Furthermore, the verification unit 2060 can evaluate the reliability of the generation model 100 based on the verification results of the access control rule set 60. For this evaluation, the verification unit 2060 uses one or more access control rules 62 that have been verified to be correct.

[0077] Specifically, the verification unit 2060 modifies a portion of the rule script of the access control rule 62, which has been verified as correct, thereby obtaining a modified rule that has been intentionally rendered incorrect. The verification unit 2060 then requests the generative model 100 to determine whether the modified rule is correct.

[0078] In this situation, generative model 100 should determine that the modified rule is incorrect because it was intentionally made incorrect. Therefore, generative model 100 is considered reliable if it correctly identifies the modified rule it has input into it as incorrect. Conversely, generative model 100 is considered unreliable if it incorrectly identifies the modified rule it has input into it as correct.

[0079] There are various specific methods for evaluating the generative model 100 using the modified rules. For example, the validation unit 2060 inputs two or more modified rules into the generative model 100 and counts the number of correct answers output by the generative model 100. Note that the correct answers are those that indicate the modified rules are incorrect.

[0080] In some implementations, the validation unit 2060 determines whether the generative model 100 is reliable based on the number of correct answers. For example, the validation unit 2060 calculates the ratio of correct answers to the total number of answers and compares this ratio with a predefined threshold. If the ratio is greater than or equal to the predefined threshold, the validation unit 2060 determines that the generative model 100 is reliable. Conversely, if the ratio is less than the predefined threshold, the validation unit 2060 determines that the generative model 100 is unreliable.

[0081] The number of modified rules used to evaluate the generative model 100 may be predefined. In this case, the verification unit 2060 can compare the number of correct answers with a predefined threshold, rather than the ratio mentioned above, to determine whether the generative model 100 is reliable.

[0082] In some implementations, the validation unit 2060 uses the number of correct answers to calculate a score called a reliability score, which represents the reliability of the generative model 100. For example, the validation unit 2060 calculates the reliability score as the ratio of the number of correct answers to the total number of answers. If the number of modified rules used to evaluate the generative model 100 is predefined, the validation unit 2060 can use the number of correct answers as the reliability score.

[0083] Various changes can be applied to the rule script. For example, the validation unit 2060 can change the value of an attribute included in the rule script, for instance, changing "corporate network" to "internet". In another example, the validation unit 2060 can change how network access defined in the rule script is handled, for example, changing "deny" to "allow". In yet another example, the validation unit 2060 can change the operator used in the rule script, for example, changing "==" to "!".

[0084] <About the model> The generative model 100 may be either a conventional pre-trained generative model or a generative model specifically trained for use with the rule generator 2000. In the latter case, the generative model 100 is trained using training samples, each of which includes a generative prompt 40 and its corresponding ground truth response. The ground truth response is the expected output from the generative model 100 when the corresponding generative prompt 40 is input.

[0085] Alternatively, the generative model 100 can be obtained by fine-tuning a conventional pre-trained model. In this case, the generative model 100 can be obtained by training a conventional generative model using the training samples described above.

[0086] The same applies to the validation model. Specifically, the validation model may be either a conventional pre-trained generative model or a generative model specifically trained for use with the rule generator 2000. In the latter case, the validation model is trained using training samples, each containing a validation prompt 120 and its corresponding ground truth response. This ground truth response is the output expected from the validation model when the corresponding validation prompt 120 is input.

[0087] Alternatively, a validation model can be obtained by fine-tuning a conventional pre-trained model. In this case, the validation model can be obtained by training a conventional generative model using the training samples described above.

[0088] Programs may be stored in and provided to a computer using any type of non-temporary computer-readable medium. Non-temporary computer-readable medium includes any type of tangible storage medium. Examples of non-temporary computer-readable medium include magnetic storage media (e.g., floppy disks, magnetic tapes, and hard disk drives), magneto-optical storage media (e.g., magneto-optical disks), CD-ROMs (compact disc read-only memory), CD-Rs (compact disc recordable), CD-R / Ws (compact disc rewritable), and semiconductor memory (e.g., mask ROMs, PROMs (programmable ROMs), EPROMs (erasable PROMs), flash ROMs, and RAMs (random access memory)). Programs may also be provided to a computer using any type of temporary computer-readable medium. Embodiments of temporary computer-readable medium include electrical signals, optical signals, and electromagnetic waves. Temporary computer-readable medium can provide programs to a computer via wired communication lines (e.g., electric wires and optical fibers) or wireless communication lines.

[0089] While the present disclosure has been described above with reference to embodiments, the present disclosure is not limited to the embodiments described above. Various modifications that will be understood by those skilled in the art can be made to the structure and details of the present disclosure within the scope of the present invention.

[0090] The embodiments disclosed above, in whole or in part, may be described as follows, but are not limited to those described above. <Note> (Note 1) A rule generator, At least one memory configured to store instructions, It comprises at least one processor configured to execute instructions, and the instructions are, To obtain security guideline text and system information that shows information related to network systems that implement access control based on the guidelines defined in the security guideline text, This involves generating access control rules based on security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access related to network systems, and are interpretable by an access control engine that implements access control based on the access control rules. A rule generator is a command that performs verification of access control rules in order to determine whether the access control rules are correct. (Note 2) The security guideline text includes two or more guidelines. The generation of access control rules is The security guideline text will be divided into two or more guideline sections, each representing one of the guidelines contained within the security guideline text. To generate a generation prompt that includes two or more guideline sections and a request to generate rules for each security guideline section to manage network access related to the network system based on the security guideline section, This involves providing a generation prompt to a generative model and obtaining a response from the generative model that includes rules for managing network access related to the network system, This includes obtaining access control rules based on the rules included in the response. The rule generation device according to claim 1. (Note 3) System information indicates one or more entities related to the network system. The generation of access control rules includes generating a generation prompt which includes two or more guideline sections, two or more entities related to a network system, and a request to generate rules for each security guideline section for managing network access related to the network system based on the guideline sections and the two or more entities related to the network system. The rule generating device according to claim 2. (Note 4) The generation of access control rules is This involves providing a generation prompt to two or more generative models and thereby obtaining a response from each generative model, This includes selecting one of the rules corresponding to the security guideline section included in each response, to be used as the rule to retrieve the access control rule corresponding to that security guideline section, for each security guideline section, The rule generating device according to claim 2. (Note 5) The rules included in the response include the guideline section and the meaning of the guideline section. The validation of access control rules includes determining whether an access control rule is correct by comparing the guideline section corresponding to the access control rule with the meaning corresponding to the access control rule. The rule generating device according to claim 2. (Note 6) At least one processor is configured to execute instructions to further improve access control rules by removing syntax errors, vulnerabilities, or both from the access control rules before validating them. The rule generation device according to claim 1. (Note 7) At least one processor is configured to execute instructions for further evaluating the reliability of the generative model. The reliability of generative models is evaluated as follows: Modifying some of the access control rules that were verified to be correct, thereby rendering the access control rules incorrect, The generative model is made to determine whether the modified access control rules are correct, This includes evaluating the reliability of the generative model based on the result of determining whether the modified access control rules are correct, The rule generation device according to claim 1. (Note 8) The evaluation of generative models is as follows: For two or more modified access control rules, the generative model is made to determine whether each modified access control rule is correct, Count the number of decisions that indicate the modified access control rules are incorrect, This further includes evaluating the reliability of the generative model based on the number of decisions that indicate the modified access control rules are incorrect, The rule generating device according to claim 7. (Note 9) A method for generating rules that is executed by a computer, The steps include obtaining a security guideline text and system information that indicates information related to a network system in which access control based on the guidelines defined in the security guideline text is implemented, A generation step comprising generating access control rules based on security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access related to a network system and are interpretable by an access control engine that implements access control based on the access control rules, and A method that includes the step of performing validation of access control rules to determine whether the access control rules are correct. (Note 10) A program, for a computer, To obtain security guideline text and system information that indicates information related to network systems where access control based on the guidelines defined in the security guideline text is implemented, This involves generating access control rules based on security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access related to network systems, and are interpretable by an access control engine that implements access control based on the access control rules. A program that performs access control rule verification to determine whether the access control rule is correct.

[0091] The elements described in Annexes 2 through 8 that are dependent on Annex 1 (e.g., structure and function) are also dependent on Annexes 9 and 10 in the same way as Annexes 2 through 8. Some or all of the elements described in any Annex may apply to various hardware, software, storage media for software, systems, and methods. [Explanation of Symbols]

[0092] 10. Security Guidelines Text 20 System Information 22 System Model Information 24 Data Flow Information 26 Protocol Information 40 Generation prompt 42 Thumb Prompt 50 responses 52 Rules 60 Access Control Rule Sets 62 Access Control Rules 70 Guideline Sets 72 Guideline Section 80 Attribute Set 82 Attribute Data 84 Name 86 values 100 Generative Models 120 Verification prompt 122 Subprompt 1000 computers 1020 Bus 1040 processor 1060 memory 1080 storage device 1100 Input / Output Interface 1120 Network Interface 2000 Rule Generator 2020 Acquisition Department 2040 Generation part 2060 Verification Department

Claims

1. A rule generator, At least one memory configured to store instructions, The system comprises at least one processor configured to execute instructions, the instructions being: To obtain a security guideline text and system information indicating information related to a network system that implements access control based on the guidelines defined in the security guideline text, The process involves generating access control rules based on the security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access related to the network system, and are interpretable by an access control engine that implements access control based on the access control rules. A rule generator, which is an instruction to perform verification of the access control rule in order to determine whether the access control rule is correct.

2. The aforementioned security guideline text includes two or more guidelines, The generation of the aforementioned access control rules is The security guideline text is divided into two or more guideline sections, each showing one of the guidelines contained in the security guideline text. To generate a generation prompt that includes two or more guideline sections and a request to generate rules for each security guideline section for managing network access related to the network system based on the security guideline section, Providing the generation prompt to the generation model and obtaining a response from the generation model that includes the rules for managing network access related to the network system, This includes obtaining the access control rule based on the rule included in the response, The rule generation device according to claim 1.

3. The system information indicates one or more entities related to the network system, The generation of the access control rules includes generating a generation prompt which includes two or more guideline sections, two or more entities related to the network system, and a request to generate a rule for each security guideline section for managing network access related to the network system based on the guideline sections and the two or more entities related to the network system. The rule generation device according to claim 2.

4. The generation of the aforementioned access control rules is The generation prompt is provided to two or more generation models, thereby obtaining the response from each generation model. This includes selecting one of the rules corresponding to the security guideline section included in each response as a rule to be used to obtain the access control rule corresponding to that security guideline section, for each security guideline section, The rule generation device according to claim 2.

5. The rule included in the response includes the guideline section and the meaning of the guideline section, The verification of the access control rule includes determining whether the access control rule is correct by comparing the guideline section corresponding to the access control rule with the meaning corresponding to the access control rule. The rule generation device according to claim 2.

6. The at least one processor is configured to execute the instructions for further improving the access control rule by removing syntax errors, vulnerabilities, or both from the access control rule before verifying the access control rule. The rule generation device according to claim 1.

7. The at least one processor is configured to execute the instructions for further evaluating the reliability of the generation model, The reliability evaluation of the generative model is Modifying a portion of the access control rule that has been verified as correct to make the access control rule incorrect, The generation model is made to determine whether the modified access control rule is correct, The process includes evaluating the reliability of the generative model based on the result of the determination of whether the modified access control rule is correct, The rule generation device according to claim 1.

8. The evaluation of the aforementioned generative model is, The generative model is made to determine whether each modified access control rule is correct for two or more modified access control rules. Counting the number of decisions indicating that the modified access control rule is incorrect, The reliability of the generative model is further evaluated based on the number of decisions indicating that the modified access control rule is incorrect. The rule generation device according to claim 7.

9. A method for generating rules that is executed by a computer, The steps include obtaining a security guideline text and system information indicating information related to a network system in which access control based on the guidelines defined in the security guideline text is implemented, A generation step of generating access control rules based on the security guideline text and the system information using a generation model, wherein the access control rules are rules for managing network access related to the network system and are interpretable by an access control engine that performs access control based on the access control rules; A method comprising the step of performing verification of the access control rule in order to determine whether the access control rule is correct.

10. A program, for a computer, To obtain a security guideline text and system information indicating information related to a network system in which access control based on the guidelines defined in the security guideline text is implemented, The process involves generating access control rules based on the security guideline text and system information using a generative model, wherein the access control rules are rules for managing network access related to the network system, and are interpretable by an access control engine that implements access control based on the access control rules. A program that performs verification of the access control rules in order to determine whether the access control rules are correct.

Images