CANDIDATE AUTHORITY DETERMINATION DEVICE, LEAST PRIVILEGE IDENTIFICATION SYSTEM, INFORMATION PROCESSING SYSTEM, AND CANDIDATE AUTHORITY DETERMINATION METHOD

Abstract

To be possible, in an apparatus that automatically discovers a candidate with a minimum authorization to be granted to a program, to automatically derive candidate authorizations in a functional unit without excesses or deficiencies.SOLUTION: A candidate authorization determination apparatus includes a processor. The processor determines candidate authorizations which are all authorizations of a function to be an operation target with a minimum authorization in a target program to be input. When determining the candidate authorizations, the processor uses the following information. Specifically, when determining the candidate authorizations, the processor uses information including a result of calculated ease of becoming the operation target with the minimum authorization of the function, based on information on functions that are the operation targets of the authorization exercised by the program even though the functions are not involved in constructing a system environment extracted from a plurality of existing programs.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a candidate authority determination device, a least privilege identification system, an information processing system, and a candidate authority determination method. [Background technology]

[0002] In software development, setting the minimum privileges necessary and sufficient for program execution, or appropriate privileges equivalent to the minimum privileges, is considered extremely important from the perspective of security, including zero trust, which has been attracting attention in recent years. However, as the software being developed is becoming more complex, manually designing appropriate privileges requires a great deal of man-hours.

[0003] Therefore, technologies have been developed to automatically derive appropriate authority for such programs. For example, Patent Document 1 discloses a technology that derives appropriate authority by disassembling the program to be executed and analyzing the functions that are called internally. Also, Patent Document 2 discloses a technology that derives appropriate authority based on the transition history of the parent-child relationship of processes and the access log of each process.

[0004] However, the techniques described in the above two documents cannot be applied to the permission settings of programs that use black-box functions provided by cloud services, which have become increasingly popular recently, because it is not possible to obtain binary files or logs from black-box systems.

[0005] Patent Document 3 discloses a technology for automating least privilege settings for programs that use black box functions. The technology in Patent Document 3 focuses on the fact that program execution will fail if sufficient privileges are not granted to the program. First, a set of privileges (candidate privileges) that are candidates for least privileges is derived. Next, some of the candidate privileges are granted to the program and the program is executed. The privileges granted to the program are changed based on whether the program execution was successful or not. By repeating this process, a program to which the least privileges have been granted is finally derived.

[0006] The candidate authority derivation method of Patent Document 3 is as follows. First, a program (past program) from which minimum authority has been derived in the past is prepared separately from the target program. Next, the user selects which past program has a high similarity to the target program and whose minimum authority is to be adopted as a candidate for the target program's candidate authority. The program is executed after being granted the authority selected by the user. If execution fails, the authority currently granted to the program is increased by authority classification unit and the program is executed, and this process is repeated. The authority granted to the program at the time when the program is successfully executed is set as the candidate authority. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2012-048609 A [Patent Document 2] JP 2005-128623 A [Patent Document 3] Patent Publication No. 2021-060702 Summary of the Invention [Problem to be solved by the invention]

[0008] However, in the candidate authority derivation method of Patent Technology 3, if the functions that are the target of operation with the minimum authority of the past program selected by the user (functions here are provided by other programs or APIs (Application Programming Interfaces)) do not cover all the functions that are the target of operation with the minimum authority of the target program, it is not possible to extract candidate authorities, and as a result, all authorities that target all functions must be set as candidate authorities.

[0009] For example, consider a case where the functions that are the target of operation of the minimum authority of the target program are the storage function and the logging function, and the function that is the target of operation of the minimum authority of the past program selected by the user is only the storage function. In this case, if the target program is granted the minimum authority of the past program and program execution fails, execution will not be successful even if the authority of the storage function currently granted to the program is increased in authority classification units such as Write and Read and the program is executed. As a result, even if the program is executed by granting all authorities that target the storage function, execution will fail, and it will not be possible to reach the authority that targets the logging function, and candidate authorities cannot be extracted.

[0010] The number of candidate privileges is directly related to the number of times a program is executed to derive the least privileges. If the candidate privileges cannot be narrowed down using the method of patented technology 3 and all privileges are used, the number of times the program is executed increases, and the execution time increases. Furthermore, for programs that use functions provided by cloud services, the monetary cost also increases due to the pay-as-you-go system.

[0011] The present invention has been made in consideration of the above background, and its purpose is to enable a device that automatically discovers candidates for least privileges to be granted to a program to automatically derive candidate privileges on a functional basis, without any excess or deficiency. [Means for solving the problem]

[0012] According to a first aspect of the present invention, there is provided a candidate authority determination device as described below. That is, the candidate authority determination device includes a processor. The processor determines candidate authorities, which are all authorities of functions that are the operation targets of the least authority in an input target program, by using information including a result of calculating the likelihood of a function exercised by a program becoming the operation target of the least authority based on information of a function that is the operation target of the authority exercised by the program despite not being involved in the construction of a system environment extracted from a plurality of existing programs.

[0013] According to a second aspect of the present invention, there is provided a least privilege identification system, which includes the candidate privilege determination device and a device for determining a least privilege of a target program by using an execution result of the target program based on the candidate privileges determined by the candidate privilege determination device.

[0014] According to a third aspect of the present invention, there is provided an information processing system as described below. That is, the information processing system includes a least privilege identifying device and a cloud system. The least privilege identifying device identifies the least privilege of an input target program. The cloud system uploads a target program based on the least privilege identified by the least privilege identifying device. The least privilege identifying device also includes a processor. The processor determines candidate privileges, which are all privileges of functions that are targets of least privilege operation in the input target program, using information including a result of calculating the likelihood of a function becoming a target of least privilege operation based on information of a function that is a target of operation of privileges exercised by a program despite not being involved in the construction of a system environment extracted from a plurality of existing programs. The processor identifies the least privilege of the target program by using an execution result of the target program to which privileges based on the determined candidate privileges are assigned.

[0015] According to a fourth aspect of the present invention, there is provided a candidate authority determination method as described below. The candidate authority determination method is a method performed using a processor. The candidate authority determination method extracts information on functions that are targets of authority operation despite not being involved in the construction of a system environment from a plurality of existing programs, calculates the likelihood of the functions included in the extracted information becoming targets of least-authority operation, and uses the calculation result to determine candidate authorities that are all authorities of the functions that are targets of least-authority operation in an input target program. Effect of the Invention

[0016] According to the present invention, in an apparatus for automatically finding candidates for least privilege to be granted to a program, the candidate privileges can be automatically derived without excess or deficiency on a function-by-function basis. Note that problems, configurations, and effects other than those described above will become apparent from the following description of the embodiment. [Brief description of the drawings]

[0017] [Figure 1] FIG. 1 illustrates an example of a configuration of a cloud execution system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of functions of a least-privilege identification device. [Diagram 3] FIG. 2 is a diagram illustrating an example of a system environment and current authority information. [Figure 4] 11A and 11B are diagrams illustrating an example of other program system environments and authority information. [Diagram 5] FIG. 13 is a diagram illustrating an example of an implicit use service corresponding index derivation process. [Figure 6] FIG. 13 is a diagram showing an example of implicit use service applicable index information. [Figure 7] FIG. 11 is a diagram illustrating an example of an operation target service ranking derivation process. [Figure 8] FIG. 11 is a diagram illustrating an example of operation target service ranking information. [Figure 9] FIG. 11 is a diagram illustrating an example of a system environment characteristic analysis process. [Figure 10] FIG. 11 is a diagram illustrating an example of program use service information. [Figure 11] FIG. 11 is a diagram illustrating an example of system environment characteristic analysis information. [Figure 12] FIG. 11 is a diagram illustrating an example of a candidate authority determination process. [Figure 13] FIG. 13 is a diagram illustrating an example of a progress information screen displayed by the least privilege identifying device during execution of the candidate authority determination process. [Figure 14] FIG. 11 is a diagram illustrating an example of candidate authority information. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0018] In this embodiment, we will describe a system that has a least privilege identification device that uses application code to be constructed on the cloud, a system environment, and a target program including current privilege information as input to determine a set of privileges (candidate privileges) including minimum privileges, and identifies the minimum privileges of the target program.

[0019] <System configuration> First, an example of the configuration of a cloud execution system 1 (information processing system) according to this embodiment is shown with reference to Fig. 1. The cloud execution system 1 includes a least-privilege identifying device 10 used by a user who inputs a target program, and a cloud system 20. The least-privilege identifying device 10 and the cloud system 20 are communicatively connected to each other via a wired or wireless communication network 5, such as the Internet, a LAN (Local Area Network), or a WAN (Wide Area Network).

[0020] The cloud system 20 provides cloud computing services (web services). Specifically, the cloud system 20 is configured with one or more information processing devices, and stores services that can be used by users who use the web services.

[0021] The least privilege identification device 10, for example, includes a calculation device 11 (processor) such as a CPU (Central Processing Unit), a memory 12 such as a RAM (Random Access Memory) or a ROM (Read Only Memory), an external storage device 13 such as a HDD (Hard Disk Drive) or a SSD (Solid State Drive), an input device 14 such as a keyboard, a mouse, or a touch panel, an output device 15 such as a display and a touch panel, and a communication device 16. The cloud system 20 includes a calculation device 21 such as a CPU (Central Processing Unit), a memory 22 such as a RAM (Random Access Memory) or a ROM (Read Only Memory), an external storage device 23 such as a HDD (Hard Disk Drive) or a SSD (Solid State Drive), a communication device 24, etc.

[0022] In the least-privilege identification device 10, data such as a program used to execute a predetermined process is stored in an external storage device 13, for example, and is read into RAM and executed by the calculation device 11. In the cloud system 20, data such as a program used to execute a predetermined process is stored in an external storage device 23, for example, and is read into RAM and executed by the calculation device 21.

[0023] The least privilege identification device 10 automatically identifies necessary and sufficient privileges to be granted to the target program for successful execution of the target program. Since the target program is data for constructing a system on the cloud, the least privilege identification device 10 uploads the target program to the cloud system 20 using the communication network 5. Next, functions constituting the least privilege identification device 10 will be described.

[0024] <Least privilege specific device> 2 is a diagram illustrating an example of functions of the least privilege identification device 10. The least privilege identification device 10 includes, as programs executed by the calculation device 11, an input unit 104, a system environment characteristic analysis unit 1001, a candidate privilege determination unit 1201, a least privilege derivation unit 105, a least privilege violation determination unit 107, an implicitly used service corresponding index derivation unit 501, and an operation target service ranking derivation unit 701.

[0025] The input unit 104 acquires the system environment and current authority information 301, the application code 101, the execution result determination program 103, and the program using service information 901, which are created by the user. These data are input by the user, for example. Note that the program using service information 901 is information that is acquired arbitrarily during processing, and may be omitted.

[0026] The least privilege required by least privilege identifying device 10 is set in system environment and current privilege information 301. However, the required least privilege depends not only on system environment and current privilege information 301, but also on what operation is realized as an application in application code 101. Therefore, data including a set of system environment and current privilege information 301 and application code 101 is referred to as target program 102 for which least privilege is required. Next, each piece of input data (301, 101, 103, 901) will be specifically described.

[0027] <System environment and current permission information> Fig. 3 is a diagram showing an example of the system environment and current authority information. The system environment and current authority information 301 is a program that describes information on services used in system construction and currently granted authority information. As shown in Fig. 3, the system environment and current authority information 301 has an authority setting section 302 and a service setting section 304.

[0028] 3, permission settings for three roles, CodeBuileRole, CloudFormationRole, and CodePipelineRole, are defined in permission setting section 302. In permission description section 303, settings are described that allow two permissions (s3:PutObject, s3:GetObject) for operating S3, a cloud service, and a permission (logs:CreateLogStream) for operating Logs, as settings for CodeBuileRole.

[0029] In the service setting section 304, information on S3, CodeCommit, CodeBuild, and CodePipeline is described as the services used in system construction. Among them, in the authority granting section 305, CodeBuildRole is granted to CodeBuildProject, which is an entity (hereinafter referred to as a resource) that has the function of the service CodeBuild. This enables CodeBuildProject, which is a CodeBuild resource, to perform specific operations on S3 and Logs using the authority in the authority description section 303. Note that certain authority may or may not be set in the authority description section 303 from the time of input in the input section.

[0030] <Other data> The application code 101 is the code of an application to be executed on a system constructed based on the system environment and current authority information 301. In this embodiment, this corresponds to the code of an application to be deployed using a pipeline.

[0031] The execution result determination program 103 is a program that outputs information on whether the execution of the application code 101 was successful or failed. The execution result determination program 103 reflects requirements that the application code should satisfy. In this embodiment, for example, the requirement is that when a file is committed to a repository, execution is automatically successful up to build and deploy as a pipeline function.

[0032] The program use service information 901 is data that can be described if there is a cloud service that is not described in the system environment and current authority information unit 301 but that the user recognizes as being used by the target program 102. This can be used in the system environment characteristic analysis unit 1001, which will be described later, etc.

[0033] Next, a description will be given of multiple other program system environments and authority information 401 and implicitly used services. Multiple other program system environments and authority information 401 is a collection (group) of other program system environments and authority information 411 (i.e., existing programs that are different from the target program 102 and describe information on services and authority information used in system construction).

[0034] The other program system environment and authority information 411 included in the multiple other program system environment and authority information 401 may be, for example, system environment authority information of a program whose minimum authority has been previously identified using the method described in this embodiment. Also, as long as it is valid as system environment and authority information, it may be system environment authority information created by a user or system environment authority information published on the Internet.

[0035] <Other program system environment and permission information> 4 is a diagram showing an example of other program system environment and authority information. Like the system environment and current authority information 301, the other program system environment and authority information 411 has an authority setting section 412 and a service setting section 416. As long as it is valid as system environment and authority information, the authority set in the other program system environment and authority information 411 may or may not be the minimum authority.

[0036] The authorization service setting unit 413 describes to which service the authorization of the authorization setting unit 412 is to be granted. In Fig. 4, the authorization service setting unit 413 describes that authorization is to be granted to Lambda, which is one of the services, and the authorization unit 417 actually grants the role LambdaRole of the authorization setting unit 412 to the resource LambdaFunction of the service Lambda. A service to which authorization is granted, such as Lambda, is referred to as an authorization service.

[0037] Services used for system construction are described in the service setting section 416. In Fig. 4, of the services Lambda, S3, and APIGateway described in the service setting section 416, S3 and APIGateway that do not correspond to authorization services are referred to as environment construction services.

[0038] The operation target service description section 415 in the authority description section 414 describes which services are permitted to perform certain operations with the authority in the authority description section 414. In Fig. 4, it can be seen that the authority s3:GetObject in the authority description section permits certain operations with respect to service S3, and that logs:PutLogEvents, logs:CreateLogGroup, and logs:CreateLogStream permit certain operations with respect to Logs. Services that are the object of authority operations, such as S3 and Logs, are referred to as operation target services.

[0039] The services to be operated include environment construction services such as S3 in Figure 4, that is, services that are clearly specified in the system environment and authority information 411 as being used to construct this environment, and services such as Logs, that are not environment construction services, that is, services that are not clearly specified in the system environment and authority information 411 as being used to construct this environment.

[0040] A service that is an operation target service but is not an environment construction service, such as Logs, in other words, a service that is not defined as a resource in the system environment and authority information 411 but is an operation target of the authority defined in the system environment and authority information 411, is referred to as a provisional implicit use service. Here, when the system environment and authority information 411 has multiple roles, a service that corresponds to the union of the multiple roles is referred to as a provisional implicit use service.

[0041] Among the provisional implicit use services, a service that is not defined as a resource in the system environment and authority information 411 but is subject to least-privilege operations will be referred to as an implicit use service.

[0042] From the definition of the implicitly used service, all authorities that operate the services and implicitly used services described in the service setting section 304 of the system environment and current authority information 301 can be the minimum authority of the target program 102. Therefore, in this embodiment, a process is performed to identify the implicitly used services of the target program 102 and narrow down the number of authorities in the candidate authorities.

[0043] In this process, data is used that is created from information on the authorization service, environment construction service, operation target service, and provisional implicit use service described in other program system environment and authority information 411 included in multiple other program system environment and authority information 401.

[0044] According to this embodiment, it is possible to narrow down candidate authorities by authority on a service basis. Authority on a service basis refers to all authorities to operate a certain service. For example, the authority on a service basis for S3 is s3:*, and when S3 is a storage function, s3:* is all authorities that operate on S3. Here, since the total number of services is smaller than the total number of authorities, it is possible to narrow down the authorities in fewer iterations than narrowing down candidate authorities on an authority basis.

[0045] Moreover, the other programs used to narrow down implicitly used services are only the other program system environment and authority information 411 in the multiple other program system environment and authority information 401, and other application code is not required. In addition, the authority described in the other program system environment and authority information 411 may be the least authority or not. As described above, it becomes easier to collect other programs used to narrow down implicitly used services, and versatility is improved.

[0046] Next, a description will be given of a process for extracting data from a plurality of other program system environments and authority information 401 when performing the process of the present embodiment. In this process, the implicit use service applicable index derivation unit 501 and the operation target service ranking derivation unit 701 are executed by the calculation device 11, as an example.

[0047] The implied use service applicable index derivation unit 501 receives a plurality of other program system environment and authority information 401 as input, and calculates the likelihood of each service becoming an implied use service from the provisional implied use service information of the other program system environment and authority information 411. The implied use service applicable index derivation unit 501 then outputs implied use service applicable index information 601, which is data used by a candidate authority determination unit 1201 (described later) to identify an implied use service, and which is input by the candidate authority determination unit 1201.

[0048] The operation target service ranking derivation unit 701 will be described. Similarly, the operation target service ranking derivation unit 701 receives a plurality of other program system environments and authority information 401 as input, and derives which service is likely to become an operation target service when each service is an authority granting service. The operation target service ranking derivation unit 701 outputs operation target service ranking information 801, which is data used by the candidate authority determination unit 1201 to specify an implicitly used service and is input by the candidate authority determination unit 1201.

[0049] Note that the implicit use service applicable index information 601 and the operation target service ranking information 801 only need to be prepared before the candidate authority determination unit 1201 operates, and it does not matter when they are prepared as long as this condition is satisfied. Therefore, the implicit use service applicable index derivation unit 501 and the operation target service ranking derivation unit 701 may be executed by a device distributed from the least privilege identification device 10. The least privilege identification device 10 may acquire the outputs from the implicit use service applicable index derivation unit 501 and the operation target service ranking derivation unit 701 by an appropriate method (for example, a method using the communication device 16).

[0050] Next, with regard to the above-described processing of this embodiment, a processing for identifying implicitly used services of the target program 102 and determining candidate authorities will be described. In this processing, the system environment characteristic analysis unit 1001 and the candidate authority determination unit 1201 are executed by the arithmetic unit 11.

[0051] The system environment characteristic analysis unit 1001 receives the system environment and current authority information 301 and the program use service information 901 obtained by the input unit 104 , and outputs the authority granting service and environment construction service of the target program 102 as analysis result information 1101 .

[0052] The candidate authority determiner 1201 receives the analysis result information 1101 , the implicitly used service index information 601 , the operation target service ranking information 801 , the system environment and current authority information 301 , the application code 101 , and the execution result determination program 103 .

[0053] The candidate authority determination unit 1201 sets a group of authorities on a service basis created using the analysis result information 1101, the implicit use service applicable index information 601, and the operation target service ranking information 801 in the authority description unit 303 of the system environment and current authority information 301. Then, the candidate authority determination unit 1201 executes an application constructed in the cloud system 20 using the system environment and current authority information 301 and the application code 101 using the execution result determination program 103, derives services that are the operation targets of the least authority without excess or deficiency based on the execution result, determines candidate authorities that are a set of authorities on a service basis related to those services, and outputs the candidate authority information 1401.

[0054] Next, a description will be given of the process of the least privilege derivation unit 105 that identifies the least privilege using the candidate privilege information 1401, and the process of the least privilege violation determination unit 107. In this embodiment, these processes are executed by the calculation device 11.

[0055] The minimum privilege derivation unit 105 derives minimum privileges using any or all of the system environment and current privilege information 301, application code 101, and execution result determination program 103 obtained by the input unit 104, and candidate privilege information 1401, and outputs the minimum privileges to minimum privilege information 106. The minimum privilege information 106 is information in which the minimum privileges of the target program 102 are classified for each role described in the privilege setting unit 302 of the system environment and current privilege information 301 and output.

[0056] The processing of the minimum privilege derivation unit 105 is not particularly limited as long as it can appropriately derive the minimum privilege using the candidate privilege information 1401. For example, the minimum privilege derivation unit 105 may execute the target program 102 to which privileges have been granted to some or all of the functions included in the candidate privileges, and if the execution fails, may derive the minimum privilege of the target program 102 by removing privileges from some of the functions to which privileges have been granted and executing the target program 102 again.

[0057] Least privilege violation determination unit 107 receives as input system environment and current privilege information 301 and least privilege information 106 obtained by input unit 104, compares the privilege information in privilege description unit 303 of system environment and current privilege information 301 with least privilege information 106, and outputs whether or not there is a least privilege violation, and if there is a least privilege violation, which privilege specifically, to determination result information 108. Note that the processing of least privilege violation determination unit 107 is not particularly limited as long as it is possible to determine a least privilege violation.

[0058] The above-described functions of the least-privilege identification device 10 and the cloud system 20 are realized, for example, by their hardware or by their computing devices (11, 21) reading and executing each program stored in the memory (11, 21) or the external storage device (13, 23). In addition, these programs are stored in, for example, a storage device such as a secondary storage device, a non-volatile semiconductor memory, a hard disk drive, or an SSD, or a non-transitory data storage medium readable by each information processing device, such as an IC card, an SD card, or a DVD.

[0059] <Processing explanation> Next, the processing performed in the cloud execution system 1 will be specifically described with reference to flowcharts and the like. The processing will be mainly described with reference to the processing of the implicit use service applicable index derivation unit 501, the operation target service ranking derivation unit 701, the system environment characteristic analysis unit 1001, and the candidate authority determination unit 1201. In this embodiment, these processing are executed by the calculation device 11.

[0060] <Implicit use service index derivation process> 5 is a diagram showing an example of an implicit use service applicable index derivation process performed by the implicit use service applicable index derivation unit 501. In the implicit use service applicable index derivation process S1, first, the implicit use service applicable index derivation unit 501 acquires a plurality of other program system environments and authority information 401 (S502). Next, the implicit use service applicable index derivation unit 501 acquires an authority granting service, an operation target service, and an environment construction service for each role described in the authority setting unit 412 of each other program system environment and authority information 411 in the plurality of other program system environments and authority information 401 acquired in S502 (S503). Here, an example of the process of S503 will be specifically described based on the other program system environment and authority information 411 shown in FIG.

[0061] In the process of S503, for LambdaRole of the authority setting unit 412, the implicit use service corresponding index derivation unit 501 may obtain the authorization service Lambda from the description "lambda.amazonaws.com" of the authorization service setting unit 413, or may obtain the authorization service Lambda from the Lambda resource LambdaFunction, which has been granted LambdaRole by the authorization unit 417. When performing the latter process, a list of keys (Role, Roles, ServiceRole, etc.) to which a role is granted may be stored, and the location where the role is set may be searched from the list, or a search may be performed by a role name such as LambdaRole.

[0062] For the environment construction service, the implicit use service corresponding index derivation unit 501 refers to the authorization resource other than the resource LambdaFunction having the authorization unit 413 of LambdaRole in the service setting unit 416. The implicit use service corresponding index derivation unit 501 acquires the service set in the authorization resource other than the resource setting unit 418 from the resource type (the resource type described in the part corresponding to the key "Type") of the authorization resource other than the resource setting unit 418. By the above process, of the services Lambda, S3, and APIGateway, S3 and APIGateway, which are not authorization services, are acquired as the environment construction service.

[0063] For the service to be operated, the implicit use service applicable index derivation unit 501 acquires S3 and Logs from the authority description unit 414 of LambdaRole. At this time, the service to be operated may be acquired from the operation target service description unit 415 of the authority description unit 414. Also, data (a table in this explanation) describing the correspondence between the authority and the service to be operated on the authority may be held, and the service to be operated on the authority may be acquired by referring to this data.

[0064] Here, in the latter case, the correspondence between the service and the authority for that service can be flexibly determined. For example, it is possible to divide the authority belonging to ec2:* into the authority for Amazon EC2, the authority for Amazon VPC, etc., and set the authority for each service without being bound by the form of "service name:*". In that case, however, the same service classification must be used for the authorization service and the environment construction service. For example, in the case where the authority belonging to ec2:* is divided into the authority for Amazon EC2, the authority for Amazon VPC, etc., and the resource type of the resource described in the service setting section 416 is AWS::EC2::VPC, it is necessary to obtain Amazon VPC for the authorization service or the environment construction service. Therefore, a correspondence table between the resource type and the service is also required as necessary.

[0065] In this way, Lambda can be obtained from LambdaRole as the authorization service, S3 and APIGateway as the environment construction service, and S3 and Logs as the operation target service. When multiple roles are set in the authority setting unit 412 of the other program system environment and authority information 411, the implicit use service corresponding index derivation unit 501 obtains the authorization service, environment construction service, and operation target service for each role. This set of the authorization service, environment construction service, and operation target service is regarded as one data, and data is obtained and held for each role in the other program system environment and authority information 411. Note that, if any one of the authorization service, environment construction service, and operation target service is empty, that is, if no service is assigned to any of them, the data is not recorded and is deleted.

[0066] Next, from a data group in which the combination of the authorization service, environment construction service, and operation target service obtained in S503 is one piece of data, the implicit use service corresponding index derivation unit 501 derives the rate at which each service appears as a provisional implicit use service and the rate at which each service appears as an operation target service (S504).

[0067] For example, in the example of LambdaRole in the authority setting unit 412 in Fig. 4, S3 and Logs appear as operation target services. In addition, since S3 belongs to the environment construction service but Logs does not belong to the environment construction service, it is found that Logs is a provisional implicit use service. In this case, the implicit use service corresponding index derivation unit 501 increments the operation target service occurrence count of S3 and the operation target service occurrence count of Logs by 1, respectively. In addition, it increments the provisional implicit use service occurrence count of Logs by 1.

[0068] The implicit use service corresponding index derivation unit 501 performs such processing for each data, and records the number of occurrences of the operation target service and the number of occurrences of the tentatively used service for each service. After that, the operation target service occurrence ratio of each service is derived by dividing the number of occurrences of the operation target service of the service for which the ratio is to be calculated by the total number of data. In addition, the tentatively used service occurrence ratio of each service is derived by dividing the number of occurrences of the tentatively used service of the service for which the ratio is to be calculated by the number of occurrences of the operation target service.

[0069] Next, the implicit use service applicable index derivation unit 501 derives the implicit use service applicable index of each service using the various occurrence counts acquired in S504, and outputs it as implicit use service applicable index information 601 (S505). By using not only the provisional implicit use service occurrence rate but also the operation target service occurrence rate to derive the implicit use service applicable index, it is possible to prevent the implicit use service applicable index of a service that appears only once as an operation target service in all data and appears as a provisional implicit use service in that data from becoming high.

[0070] Here, an example of the implicitly used service applicable index information 601 will be described. FIG. 6 is a diagram showing an example of the implicitly used service applicable index information. The implicitly used service applicable index information 601 has a service name 602 and an implicitly used service applicable index 603 which is an implicitly used service applicable index of each service of the service name 602. For example, in FIG. 6, the implicitly used service applicable index of Logs is 1.0. Here, the implicitly used service applicable index 601 in FIG. 6 is normalized by multiplying the tentative implicitly used service occurrence ratio and the operation target service occurrence ratio of each service. However, the method of deriving the implicitly used service applicable index 601 is not limited to the above method, and it may be created by a function with the operation target service occurrence ratio and the tentative implicitly used service occurrence ratio as arguments.

[0071] <Operation target service ranking derivation process> 7 is a diagram showing an example of an operation target service ranking derivation process performed by the operation target service ranking derivation unit 701. In the operation target service ranking derivation process S2, first, the operation target service ranking derivation unit 701 acquires a plurality of other program system environment and authority information 401 (S702).

[0072] Next, the operation target service ranking derivation unit 701 obtains the authority granting service, operation target service, and environment construction service for each role described in the authority setting unit 412 of each other program system environment and authority information 411 in the multiple other program system environments and authority information 401 obtained in S702 (S703).

[0073] In this embodiment, the processes of S702 and S703 are the same as those of S502 and S503. Therefore, the following modification may be made. That is, the operation target service ranking derivation unit 701 and the implicit use service applicable index derivation unit 501 may be configured such that one of the operation target service ranking derivation unit 701 and the implicit use service applicable index derivation unit 501 omits the process of acquiring the authorization service, the operation target service, and the environment construction service, and performs the processes of S504 and thereafter and S704 and thereafter using a data group in which a set of the authorization service, the operation target service, and the environment construction service acquired by the other is one data item as an input.

[0074] Next, using the data group created in S703, the operation target service ranking derivation unit 701 derives the ranking of services that are likely to become operation target services when a certain service is an authorization service, and outputs it to the operation target service ranking information 801 (S704).

[0075] Fig. 8 is a diagram showing an example of operation target service ranking information. Operation target service ranking information 801 has authorization service names 802 and operation target service rankings 803 which are rankings of services that are likely to be operation targets when each service is an authorization service. In the example of Fig. 8, it can be seen that when CodeBuild is the authorization service, Logs is most likely to be an operation target service, followed by S3.

[0076] In the example of the operation target service ranking information 801 in Fig. 8, for example, the operation target service ranking 803 when the authorization service is CodeBuild is a list of services arranged in descending order of frequency of appearance as an operation target service in the data group created in S703 in which CodeBuild is the authorization service. However, the method of deriving the operation target service ranking information 801 is not limited to the above, and any method may be used as long as it can be derived from the data group created in S703.

[0077] For example, the number of times each service appears as a service to be operated may be divided into the number of times it appears as a provisionally implicitly used service and the number of times it appears as a non-provisional implicitly used service, and a ranking may be created based on the numerical values ​​derived by multiplying each of these by the implicitly used service index 601.

[0078] Also, for example, if there are multiple services in all the data that do not appear as operation target services for a certain authorization service, the ranking of those services may be lowered below the services that appear as operation target services, and further, among the services that do not appear as operation target services for the authorization service, a ranking may be created by, for example, ranking them according to the number of times they appear as operation target services, regardless of the authorization service they are.

[0079] Similarly, in the ranking of services that do not appear as authorization services in all data, the services may be ranked according to the number of times they appear as authorization services, regardless of the authorization service.

[0080] <System environment characteristic analysis processing> 9 is a diagram showing an example of a system environment characteristic analysis process performed by the system environment characteristic analysis unit 1001. The system environment characteristic analysis unit 1001 can use program use service information 901 as one of its inputs. First, the program use service information 901 will be described.

[0081] (Program Service Information) 10 is a diagram showing an example of program use service information. Program use service information 901 includes program use services 902. A program use service refers to a service that is not described in service setting section 304 of system environment and current authority information 301 and that the user is aware of as an environment construction service.

[0082] Some environment construction services are not described in the system environment and current authority information 301 because they have already been constructed in the cloud system 20. For example, even if the application code 101 uses an S3 bucket, if the S3 bucket has already been constructed in the cloud system 20, the S3 bucket may not be described in the service setting section 304 of the system environment and current authority information 301.

[0083] In this case, if the authority to operate S3 is included in the least privileges, S3 will be identified as an implicitly used service by the candidate authority determination unit 1201 since it is not described in the system environment and current authority information 301. However, if the user recognizes that S3 will be used as an environment construction service before inputting to the input unit 104, it is inefficient for the candidate authority determination unit 1201 to perform processing to identify S3 as an implicitly used service. Here, by using the program use service information 901, the service that the user recognizes as an environment construction service can be reflected in the identification of the candidate authorities, thereby eliminating the above-mentioned example phenomenon.

[0084] As described above, there are cases where a service that the user recognizes as an environment construction service is not included in the services described in the service setting section 304 of the system environment and current authority information 301, and the program using service information 901 is used. However, it is not essential to input the program using service information 901 in the input section 104. In the example of Fig. 10, Lambda and API Gateway are described as program using services.

[0085] Returning to the explanation of Fig. 9, in the system environment characteristic analysis process S3, first, the system environment characteristic analysis unit 1001 acquires the system environment and current authority information 301 and the program use service information 901 (S1002).

[0086] Next, from the system environment and current authority information 301 acquired in S1002, the system environment characteristic analysis unit 1001 acquires and holds (S1003) the authorization service and the environment construction service of the system environment and current authority information 301. The method of acquiring the authorization service and the environment construction service is similar to the contents described in S503 and S703.

[0087] Finally, the system environment characteristic analysis unit 1001 adds the services described in the program usage service information 901 to the authorization service and environment construction service acquired in S1003, and outputs the authorization service and the environment construction service to the analysis result information (system environment characteristic analysis information 1101) (S1004).

[0088] Here, the system environment characteristic analysis information 1101 will be described. Fig. 11 is a diagram showing an example of the system environment characteristic analysis information. The system environment characteristic analysis information 1101 has a service name 1102 and a service type 1103 of each service. Either an authorization service or an environment construction service is described in the service type 1103. For example, it can be seen from Fig. 11 that CodeCommit has been acquired as an environment construction service.

[0089] Next, the process performed by the candidate authority determination unit 1201 will be described. The candidate authority determination process S4 of this embodiment makes it possible to derive the candidate authority without excess or deficiency as the authority on a service basis. Specifically, this means that the minimum authority of the target program 102 can extract the service to be operated without excess or deficiency, and the extracted service can be set as a candidate authority for the authority on a service basis to be operated.

[0090] <Candidate authority determination process> 12 is a diagram showing an example of the candidate authority determination process. In the candidate authority determination process S4, first, the candidate authority determination unit 1201 acquires the analysis result information 1101, the implicit use service corresponding index information 601, the operation target service ranking information 801, the target program 102 acquired by the input unit 104, and the execution result judgment program 103 (S1202).

[0091] Next, from the various information acquired in S1202, the candidate authority determination unit 1201 retains as provisional candidate authorities all authorities of the services to be operated that correspond to the union of the authority granting services and environment construction services described in the analysis result information 1101, and the services whose implicit use service applicable index described in the implicit use service applicable index information 601 is equal to or greater than a certain threshold value (S1203).

[0092] For example, in the analysis result information 1101 of FIG. 11, the provisional candidate authority lists CodeBuild, CodePipeline, and CloudFormation as authorization services, and S3, CodeCommit, Lambda, and APIGateway as environment construction services. Therefore, the service-based authorities of a total of seven services listed in the service name 1102 of the analysis result information 1101 are held as provisional candidate authorities. In addition, for example, the threshold value of the implicit use service applicable index in S1203 is set to 0.4. In this case, the service-based authorities of Logs and S3 from the implicit use service applicable index information 601 are added to the provisional candidate authorities in S1203 of FIG. 6. Therefore, the service-based authorities of these two services are added to the provisional candidate authorities, and the union of the authorities is taken. In this case, the provisional candidate permissions after completion of S1203 processing will be service-level permissions for a total of eight services: codebuild:*, codepipeline:*, cloudformation:*, s3:*, codecommit:*, lambda:*, apigateway:*, and logs:*.

[0093] In this way, in S1203, services that are likely to be the target of operation as implicit use services when the service becomes an authorized service for many services are added to the candidate authorities all at once by using the implicit use service applicable index information 601. In the example of S1203 described above, logs is added as a candidate for the implicit use service of the target program 102 in FIG. 3, in the sense that it is a service that is likely to be an implicit use service for many services.

[0094] Next, the candidate authority determination unit 1201 sets the provisional candidate authority derived in S1203 in the system environment and current authority information 301, executes the application constructed in the cloud system 20 by the target program 102 in the execution result determination program 103, and obtains whether the execution was successful or unsuccessful (S1204).

[0095] In the assignment of provisional candidate permissions in S1204, for example, provisional candidate permissions are described in the permission description section 303 of each of CodeBuildRole, CodePipelineRole, and CloudFormationRole in Fig. 3. At this time, the permissions assigned to the permission description section 303 of the system environment and current permission information 301 at the time of input to the input section 104 are deleted from the permission description section 303 at the time of setting the permissions in S1204.

[0096] If the program execution is successful in S1204, it is found that the provisional candidate authority derived in S1203 includes the minimum authority of the target program 102. Therefore, the process proceeds to S1206 in which the service-by-service authority of the service that is not the operation target of the minimum authority is deleted. On the other hand, if the program execution fails in S1204, the provisional candidate authority derived in S1203 does not include the minimum authority of the target program 102, so it is necessary to increase the provisional candidate authority. Therefore, the candidate authority determination unit 1201 adds the service-by-service authority of the service that is higher in the operation target service ranking for the authority grant service described in the analysis result information 1101 in the operation target service ranking information 801 to the provisional candidate authority derived in S1203 (S1205).

[0097] For example, since CodeBuild, CodePipeline, and CloudFormation are authorization services according to the analysis result information 1101 in Fig. 11, in the operation target service ranking information 801 in Fig. 8, the candidate authority decision unit 1201 refers to the ranking when each of these three services is an authorization service. At this time, since Logs and S3 rank first in the operation target ranking of each service, the service-by-service authorities of these two services are added to the provisional candidate authorities derived in S1203 to be set as provisional candidate authorities.

[0098] The candidate authority determination unit 1201 updates the provisional candidate authority in S1205 and then performs the process of S1204 again. Note that if the provisional candidate authority is the same in the process of S1204 immediately before and the process of S1204 following, S1204 may not be executed and S1205 may be repeated again to reduce the number of times the program is executed.

[0099] Also, in S1205, the candidate authority determination unit 1201 adds, as a service-by-service authority, the service next in rank to the operation target service ranking added in the immediately preceding S1205. For example, if the candidate authority determination unit 1201 has added the service-by-service authority of the first-ranked service in the operation target service ranking information 801 in Fig. 8 to the provisional candidate authorities in the immediately preceding S1205, then in the subsequent S1205, the candidate authority determination unit 1201 adds the service-by-service authority of the second-ranked or lower service in the operation target service ranking information 801 in Fig. 8 to the provisional candidate authorities.

[0100] In addition, in the addition of provisional candidate authority using the operation target service ranking information 801 in S1205, it does not matter how many service-based authorities of the services in the operation target service ranking information 801 are added. In S1205, service-based authorities of a plurality of services may be added together starting from the highest-ranked ones. In this way, the candidate authority determination unit 1201 repeats adding provisional candidate authorities in S1205 and executing the execution result determination program 103 in S1204 until the execution of the execution result determination program 103 is successful in S1204. Then, when the execution of the execution result determination program 103 is successful in S1204, it is found that the provisional candidate authority at that time includes the minimum authority of the target program 102.

[0101] In the example of this embodiment, it is assumed that the execution of the execution result determination program 103 in S1204 is successful when the first three operation target service ranking information 801 in Fig. 8 are added to the provisional candidate authorities in S1205. At this time, the provisional candidate authorities are the provisional candidate authorities in S1203 to which ecr:* and iam:* have been added.

[0102] In S1205, the candidate authority determination unit 1201 uses the operation target service ranking information 801 to add, to the candidate authorities, the service-by-service authority of a service that is likely to be an operation target for a specific service when that service becomes an authorized service. Then, in S1203, the service-by-service authority candidates of a service that is not an implicit use service and is an operation target of the least authority are added to the provisional candidate authorities. Therefore, in S1205, the authority for operating a service that is a candidate for an implicit use service of the target program 102 among the services that are likely to be an operation target for a specific service when that service becomes an authorized service is added to the candidate authorities.

[0103] In the example of S1205 mentioned earlier, IAM is added in the sense that it is likely to be an operation target service for CodePipeline and CloudFormation and may be a candidate for an implicit use service of least privilege in the system environment and current permission information 301, while ECR is added in the sense that it is likely to be an operation target service for CodeBuild and may be a candidate for an implicit use service of least privilege in the system environment and current permission information 301.

[0104] At the time when the execution result determination program 103 is successfully executed in S1204, the service-by-service authority of the service including the service that is the operation target of the least privilege of the target program 102 can be extracted. However, the provisional candidate authority may also include the service-by-service authority of the service that is not the operation target of the least privilege.

[0105] Therefore, in the process from S1206 in S4 onwards, a process is performed to delete the service-by-service authority of the service that is not the operation target of the minimum authority from the provisional candidate authority. This process makes the services that are the operation targets of the candidate authority and the services that are the operation targets of the minimum authority of the target program 102 match, making it possible to extract the right amount of candidate authority on a service-by-service basis.

[0106] S1206 is a process of repeating the processes from S1207 to S1210. S1206 (loop 1) is repeated until it is verified whether or not all services that are operation targets of the provisional candidate authority at the time of successful execution of the execution result determination program 103 in S1204 are operation targets of the minimum authority of the target program 102.

[0107] The process repeated in S1206 will be described in detail. First, the candidate authority determination unit 1201 deletes authority for each service of a certain number of services from the provisional candidate authorities (S1207). For example, it is assumed that ecr:* and iam:* are deleted from the examples of provisional candidate authorities at the time of successful execution of the execution result determination program 103 in S1204.

[0108] Next, the candidate authority determination unit 1201 sets the provisional candidate authority derived in the previous S1207 in the system environment and current authority information 301, executes the application constructed in the cloud system 20 by the target program 102 in the execution result determination program 103, and obtains whether the execution was successful or unsuccessful (S1208).

[0109] If the execution of the execution result judgment program 103 in S1208 is successful, it is found that the service that is the operation target of the service-based authority deleted in the immediately preceding S1207 is not the operation target of the minimum authority of the target program 102. Therefore, the service-based authority deleted in S1207 is left deleted from the provisional candidate authorities.

[0110] If the execution of the execution result judgment program 103 fails in S1208, any of the services targeted by the service-based authority deleted in the immediately preceding S1207 will be the target of operation of the minimum authority of the target program 102. Therefore, the candidate authority determination unit 1201 re-adds all of the service-based authorities deleted in the immediately preceding S1207 to the provisional candidate authorities (S1209).

[0111] Here, if execution of the execution result determination program 103 fails in S1208 and the service-based authority deleted in the immediately preceding S1207 targets one service, it is understood that the service targeted by the deleted service-based authority is the target of operation by the minimum authority of the target program 102. However, if the service-based authority deleted in the immediately preceding S1207 targets multiple services, it is unclear which service of the deleted service-based authority is the target of operation by the minimum authority of the target program 102.

[0112] Therefore, the candidate authority determination unit 1201 first determines whether the service-by-service authority deleted in S1207 operates on a plurality of services (S1210). If it is determined that there are a plurality of services, the candidate authority determination unit 1201 performs processing of S1211 to verify which service is the operation target of the least authority of the target program 102 among the services that are the operation targets of the service-by-service authority deleted in S1207.

[0113] The process of S1211 is a repetition of the processes of S1212 to S1214. S1211 (loop 2) is repeated for all services that are operation targets of the service-based authority deleted in the process of S1207 until it is verified whether they are operation targets of the minimum authority of the target program 102.

[0114] The process repeated in S1211 will be described in detail below. First, the candidate authority determination unit 1201 deletes one of the service authorities deleted in S1207 from the provisional candidate authorities (S1212).

[0115] For example, suppose that ecr:* and iam:* are deleted in S1207 and the execution of the execution result determination program 103 in S1208 fails. In that case, in S1212, the service-based authority of either ecr:* or iam:* is deleted from the provisional candidate authorities. For example, suppose that ecr:* is deleted.

[0116] Next, the candidate authority determination unit 1201 sets the provisional candidate authority derived in the previous S1212 in the system environment and current authority information 301, executes the application constructed in the cloud system 20 by the target program 102 in the execution result determination program 103, and obtains whether the execution was successful or unsuccessful (S1213).

[0117] If the execution result judgment program 103 is successful in S1213, it is found that the service targeted by the service-by-service authority deleted in the immediately preceding S1212 is not a target of operation by the minimum authority of the target program 102.

[0118] On the other hand, if the execution fails, the service that is the operation target of the service-based authority deleted in the immediately preceding S1212 will be the operation target of the minimum authority of the target program 102. Therefore, in this case, the candidate authority determination unit 1201 re-adds the service-based authority deleted in the immediately preceding S1212 to the provisional candidate authorities (S1214).

[0119] For example, suppose that ecr:* and iam:* are deleted in S1207 and the execution of the execution result determination program 103 in S1208 fails, and then ecr:* is deleted from the provisional candidate authority in S1212 and the execution of the execution result determination program 103 in S1213 is successful. At this time, it is understood that the reason why the execution of the execution result determination program 103 failed in the immediately preceding S1208 is because the IAM is the operation target of the least privilege of the target program 102. In such a case, it is possible to add iam:* to the provisional candidate authority and return to S1206 without repeating the processing of S1211 for iam:*.

[0120] After the process of S1206 is completed, the candidate right determination section 1201 outputs the candidate rights at the time of completion of S1206 to the candidate right information 1401 (S1215).

[0121] As in the above-described example, the candidate authority determiner 1201 performs processing. Then, the arithmetic device 11 may output data related to the processing of the candidate authority determiner 1201 to, for example, the screen of the display device 15. Next, an example of a screen display mode will be described.

[0122] 13 is a diagram showing an example of a progress information screen displayed by the least privilege identifying device during execution of the candidate privilege determination process. A candidate privilege identifying screen 1301 has a current number of services to be operated 1302, candidate privilege status details 1303, and a program execution count 1306. Of these, the candidate privilege status details 1303 has a candidate service 1304 and a candidate service state 1305.

[0123] For example, in the case of FIG. 13, currently, codebuild:*, codepipeline:*, cloudformation:*, s3:*, codecommit:*, lambda:*, apigateway:*, logs:*, and iam:* are assigned to the system environment and current authority information 301, and the target program 102 is being executed. Among these, lambda:*, apigateway:*, logs:*, and iam:* have been determined to be service-level authorities for the services that are the operation targets of the minimum authority of the target program 102 in the process of the candidate authority determination process so far. Also, ecr:* has been determined to not be a service-level authority for the services that are the operation targets of the minimum authority of the target program 102 in the process of the candidate authority determination process so far, and has been deleted. As for the other services, it is not yet determined whether they are the operation targets of the minimum authority of the target program 102.

[0124] Next, an example of candidate authority information 1401 determined by the candidate authority determination unit 1201 will be described. FIG. 14 is a diagram showing an example of candidate authority information output by the candidate authority determination unit 1201. The candidate authority information 1401 has candidate authorities 1402. For example, in FIG. 14, it is known that codebuild:*, cloudformation:*, s3:*, codecommit:*, lambda:*, apigateway:*, logs:*, and iam:* are candidate authorities. By the process from S1206 onwards in the candidate authority determination process S4, the services that are the operation targets of these candidate authorities match the services that are the operation targets of the minimum authority of the target program 102. Therefore, the candidate authorities are derived on a service-by-service basis without excess or deficiency.

[0125] In this embodiment, a candidate authority determination unit 1201 determines a set of authorities (candidate authorities) including minimum authorities by inputting an application code 101 to be constructed on the cloud, a target program 102 including a system environment and current authority information 301, and identifies implicitly used services.

[0126] As described above, the least privilege derivation unit 105 derives the least privilege of the target program 102 by an appropriate method using the candidate privilege information 1401, and the least privilege violation determination unit 107 determines a least privilege violation by an appropriate method. Here, as one example, the least privilege derivation unit 105 may execute the target program 102 to which some or all of the candidate privileges have been assigned, and change the assigned privileges based on the execution result and execute the target program 102 repeatedly, thereby deriving the least privilege of the target program 102.

[0127] When identifying an implicitly used service, the candidate authority determination unit 1201 uses implicitly used service index information 601 created using a breakdown of functions (referred to as services) of multiple programs and APIs (Application Programming Interfaces) provided by the cloud that are not listed in the program derived from the system environment and authority information 401 of multiple other programs and that are the target of authority operations, and information (operation target service ranking information 801) regarding the ranking of which services are most often the target of operation by services to which authority is granted, derived from the system environment and authority information 401 of multiple other programs.

[0128] Then, the candidate authority determination unit 1201 increases the authority granted to the target program 102 for each service that is the target of the authority operation until the execution of the target program 102 is successful. Furthermore, when the execution of the target program 102 is successful in the candidate authority determination process S4, the candidate authority determination unit 1201 appropriately deletes, for each service, the authority that does not become the minimum authority, and determines the candidate authority.

[0129] The implicit use service index is derived based on the rate at which the service appears in the system environment and authority information 401 of multiple programs as a service that is not an environment construction service and is a target of authority manipulation (provisional implicit use service), and the rate at which the service appears as a service that is a target of authority manipulation (operation target service) set in the system environment and authority information 401 of multiple programs. The operation target service ranking is derived based on the rate of services that are operation targets among services that are granted authority in the system environment and authority information 401 of multiple programs.

[0130] Therefore, according to this embodiment, it is possible to automatically derive candidate authorities on a function basis (service basis) without excess or deficiency. By narrowing down the candidate authorities, it is possible to suppress costs. In addition, since only the system environment and authority information of multiple programs are used to create the implicit use service index and the operation target service ranking, versatility is increased compared to the case where multiple programs (a set of system and authority information and application code) for which the minimum authority is determined are used.

[0131] Although the embodiment has been described above, the present invention is not limited to the above embodiment and includes various modifications. For example, it is possible to add, delete, or replace a part of the configuration of the embodiment with another configuration.

[0132] In the present embodiment, the least privilege identifying device 10 has been described, but a candidate authority determination device for determining a candidate authority may be provided in which the processing related to the least privilege derivation unit 105 and the least privilege violation determination unit 107 is omitted from the least privilege identifying device 10. That is, a candidate authority determination device may be provided that includes a processor, and the processor executes the candidate authority determination unit 1201 to determine candidate authorities that are all authorities of the functions that are the operation targets of the least privilege. Note that the implicit use service applicable index and the operation target service ranking may be determined by this candidate authority determination device in the same manner as described above using the system environment and authority information 401 of multiple programs. On the other hand, they may be determined by another distributed device, and the results may be input to this candidate authority determination device.

[0133] The candidate authorities determined by the candidate authority determination device may be output to an appropriate device for identifying least privilege (as an example, a device that executes the least privilege derivation unit 105, executes the target program 102 to which some or all of the candidate authorities have been granted in the same manner as described above, changes the granted authorities based on the execution result, and repeatedly executes the target program 102 to determine the least privilege of the target program 102). That is, a least privilege identification system may be provided that includes the candidate authority determination device and a device that identifies the least privilege of the target program by using the execution result of the target program based on the candidate authorities determined by the candidate authority determination device. Furthermore, the least privilege identification system may be a system that performs processing related to the least privilege violation determination unit 107.

[0134] The least privilege identification device 10 and the candidate privilege determination device may include an interface for inputting and outputting data using a non-transitory storage medium. Data may be input and output via the interface. As an example of the storage medium, a portable non-transitory data storage medium may be used. [Explanation of symbols]

[0135] 1. Cloud execution system, 10 Least Privilege Specific Devices; 20 Cloud systems, 104 input section, 501 Implied Use Service Applicable Index Derivation Section; 701 Operation target service ranking derivation unit, 1001 System Environment Characteristic Analysis Department, 1201 Candidate Authority Determination Division; 102 Target Programs, 301 System environment and current authority information, 601 Implied Use Service Applicable Index Information; 801 Ranking information of the service to be operated.

Claims

1. A processor; A memory for storing data when the processor processes the data; Equipped with The processor, Obtain provisional candidate authorities including the authority of the function to be obtained by using the rate at which functions that are the object of authority manipulation appear in a plurality of existing programs and the rate at which functions that are the object of authority manipulation but are not related to the construction of a system environment appear; increasing the authorities included in the provisional candidate authorities by function units that are targets of operation of the authorities, using information on a ranking of functions that are likely to be targets of operation of the functions to be granted, which is obtained from the plurality of existing programs, until execution of a target program to which the authorities included in the provisional candidate authorities are granted is successful; When the execution of the target program is successful, a candidate authority is determined to be all the authorities of the functions that are the targets of the least privilege operation in the target program by deleting authorities that are not the least privilege included in the tentative candidate authority on a function-by-function basis. A candidate authority determination device comprising:

2. The candidate authority determination device according to claim 1, The processor, The provisional candidate authority is acquired based on the authority of a function corresponding to the union of a function to which authority is granted in the target program, a function to construct a system environment in the target program, and a ratio of occurrence of functions that are the object of authority operation in a plurality of existing programs, and a ratio of occurrence of functions that are the object of authority operation but are not involved in constructing a system environment; A candidate authority determination device comprising:

3. The candidate authority determination device according to claim 1, The processor, determining the candidate authority including the deleted authority when the deletion causes the execution of the target program to fail and the deleted authority is one authority; A candidate authority determination device comprising:

4. The candidate authority determination device according to claim 1, The processor, When the execution of the target program fails due to the deletion and there are a plurality of deleted authorities, one authority is deleted from the target program to which the deleted authority was added, and the target program is executed, and when the execution of the target program fails, the candidate authority including the deleted authority is determined. A candidate authority determination device comprising:

5. A candidate authority determination device according to claim 1 ; and a device for identifying a minimum authority of a target program by using an execution result of the target program based on the candidate authority determined by the candidate authority determination device. A least privilege identification system.

6. A least privilege identification device that identifies the least privilege of a target program to be input; a cloud system to which a target program based on the least privilege identified by the least privilege identifying device is uploaded; Equipped with The least privilege specific device, A processor; A memory for storing data when the processor processes the data; Equipped with The processor, Obtain provisional candidate authorities including the authority of the function to be obtained by using the rate at which functions that are the object of authority manipulation appear in a plurality of existing programs and the rate at which functions that are the object of authority manipulation but are not related to the construction of a system environment appear; increasing the authorities included in the provisional candidate authorities by function units that are targets of operation of the authorities, using information on a ranking of functions that are likely to be targets of operation of the functions to be granted, which is obtained from the plurality of existing programs, until execution of a target program to which the authorities included in the provisional candidate authorities are granted is successful; When the execution of the target program is successful, by deleting, on a function-by-function basis, the powers included in the tentative candidate powers that are not the least privileges, a candidate power is determined that is all the powers of the functions that are the targets of the least privilege operation in the target program; Identifying the minimum privileges of the target program using the execution result of the target program to which privileges based on the determined candidate privileges have been granted; An information processing system comprising:

7. The information processing system according to claim 6, The processor, The provisional candidate authority is acquired based on the authority of a function corresponding to the union of a function to which authority is granted in the target program, a function to construct a system environment in the target program, and a ratio of occurrence of functions that are the object of authority operation in a plurality of existing programs, and a ratio of occurrence of functions that are the object of authority operation but are not involved in constructing a system environment; An information processing system comprising:

8. An information processing system according to claim 6, The processor, determining the candidate authority including the deleted authority when the deletion causes the execution of the target program to fail and the deleted authority is one authority; An information processing system comprising:

9. An information processing system according to claim 6, The processor, When the execution of the target program fails due to the deletion and there are a plurality of deleted authorities, one authority is deleted from the target program to which the deleted authority was added, and the target program is executed, and when the execution of the target program fails, the candidate authority including the deleted authority is determined. An information processing system comprising:

10. A method for determining a candidate authority performed by a processor using a memory, comprising: The processor acquires provisional candidate authorities including the authority of the function to be acquired by using a ratio of appearance of a function that is an object of the authority operation and a ratio of appearance of a function that is an object of the authority operation and is not related to the construction of a system environment in a plurality of existing programs; the processor increases the authorities included in the provisional candidate authorities on a function-by-function basis by using information on a ranking of functions likely to be targets of operation for the function to be granted the authority, the information being obtained from the plurality of existing programs, until execution of a target program to which the authority included in the provisional candidate authorities is granted is successful; When the execution of the target program is successful, the processor determines candidate privileges that are all privileges of functions that are targets of least privilege operation in the target program by deleting privileges that are not the least privileges included in the tentative candidate privileges on a function-by-function basis. A method for determining a candidate authority.

11. A method for determining candidate authorities as claimed in claim 10, comprising: The processor, determining the candidate authority including the deleted authority when the deletion causes the execution of the target program to fail and the deleted authority is one authority; A method for determining a candidate authority.

12. A method for determining candidate authorities as claimed in claim 10, comprising: The processor, When the execution of the target program fails due to the deletion and there are a plurality of deleted authorities, one authority is deleted from the target program to which the deleted authority was added, and the target program is executed, and when the execution of the target program fails, the candidate authority including the deleted authority is determined. A method for determining a candidate authority.

Images