Information processing system, information processing method, and program

Abstract

An information processing system etc. that presents security evaluation results is provided. [Solution] According to one aspect of the present invention, there is provided an information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program, in which in an acquisition step, an evaluation value of representative answer data selected for each category in which answer data is classified is acquired from multiple answer data created by the person to be evaluated, the answer data including the person to be evaluated's answers to questions related to security, and in an index assignment step, an index indicating the level of security measures is assigned to the person to be evaluated for each category based on the evaluation value of the acquired representative answer data.

Description

[Technical field]

[0001] The present invention relates to an information processing system, an information processing method, and a program. [Background technology]

[0002] Patent Document 1 describes a system for evaluating security measures. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-070912 A Summary of the Invention [Problem to be solved by the invention]

[0004] There is a demand for technology that can present the results of security evaluations.

[0005] In view of the above circumstances, the present invention provides an information processing system and the like that presents security evaluation results. [Means for solving the problem]

[0006] According to one aspect of the present invention, there is provided an information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program, in which in an acquisition step, an evaluation value of representative answer data selected for each category in which answer data is classified is acquired from multiple answer data created by the person to be evaluated, the answer data including the person to be evaluated's answers to questions related to security, and in an index assignment step, an index indicating the level of security measures is assigned to the person to be evaluated for each category based on the evaluation value of the acquired representative answer data.

[0007] According to this embodiment, the result of the security evaluation can be presented, so that the security level of the person being evaluated can be confirmed. [Brief description of the drawings]

[0008] [Figure 1] 1 is a configuration diagram illustrating an information processing system 1. [Diagram 2] 2 is a block diagram showing the hardware configuration of the server device 10 and the target person terminal 20.

[0023] FIG. [Diagram 3] FIG. 2 is a block diagram showing the hardware configuration of an evaluator terminal 30 and a user terminal 40. [Figure 4] FIG. 2 is a block diagram showing functions realized by a server device 10 (control unit 11), a subject terminal 20 (control unit 21), an evaluator terminal 30 (control unit 31), and a user terminal 40 (control unit 41). [Diagram 5] FIG. 13 is a schematic diagram showing an example of the concept of representative response data. [Figure 6] 1 is an activity diagram showing an example of the flow of information processing (indexing processing) executed by the information processing system 1. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the drawings. Various characteristic features shown in the following embodiments can be combined with each other.

[0010] Incidentally, a program for realizing the software appearing in one embodiment may be provided as a non-transitory computer-readable recording medium, or may be provided so as to be downloadable from an external server, or may be provided so that the program is launched on an external computer and its functions are realized on a client terminal (so-called cloud computing).

[0011] In addition, in various information processing according to an embodiment, an input and an output according to the input can be realized. Here, as long as an output is obtained as a result of the input, the form of information referenced in such information processing (hereinafter referred to as reference information) is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, or a predetermined function (including a judgment formula such as a regression formula constructed by a statistical method), or may be a trained model that has previously trained the correlation between the input and the output, or may be a large-scale language model that can output a desired result by inputting a prompt.

[0012] In one embodiment, the term "unit" may include, for example, a combination of hardware resources implemented by a circuit in the broad sense and software information processing that can be specifically realized by these hardware resources. In one embodiment, various information is handled, and this information is represented by, for example, physical values ​​of signal values ​​representing voltage and current, high and low signal values ​​as a binary bit collection consisting of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculation can be performed on the circuit in the broad sense.

[0013] Furthermore, a circuit in the broad sense is a circuit realized by at least appropriately combining a circuit, circuitry, a processor, and a memory. The processor may be a general-purpose processor or a dedicated circuit. In other words, it includes an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)), etc.

[0014] 1. Hardware Configuration This section describes the hardware configuration.

[0015] <Information Processing System 1> 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a communication line 2, a server device 10, a plurality of subject terminals 20, at least one evaluator terminal 30, and a plurality of user terminals 40. The server device 10, the subject terminal 20, the evaluator terminal 30, and the user terminal 40 are configured to be able to communicate with each other through the communication line 2. The server device 10, the subject terminal 20, the evaluator terminal 30, and the user terminal 40 may be connected by wire or wirelessly.

[0016] The information processing system 1 constitutes at least a part of a security evaluation system used by, for example, multiple evaluation subjects (a first evaluation subject U1 and a second evaluation subject U2), at least one evaluator U3, and multiple evaluation users (a first evaluation user U4 and a second evaluation user U5). The information processing system 1 mainly performs security evaluation of commercial materials and the like provided by the evaluation subjects, and provides security evaluations. For example, the information processing system 1 mainly provides a security evaluation service by the evaluators. In one embodiment, the information processing system 1 is composed of one or more devices or components. These components will be described below.

[0017] <Server device 10> Fig. 2 is a block diagram showing the hardware configuration of server device 10 and subject terminal 20. As shown in Fig. 2A, server device 10 includes a control unit 11, a storage unit 12, a communication unit 13, and a communication bus 14. Control unit 11, storage unit 12, and communication unit 13 are electrically connected inside server device 10 via communication bus 14.

[0018] <Control unit 11> The control unit 11 performs processing and control of the overall operation related to the server device 10. The control unit 11 is, for example, a central processing unit (CPU). The control unit 11 realizes various functions related to the server device 10 by reading out a predetermined program stored in the storage unit 12. That is, information processing by software stored in the storage unit 12 can be specifically realized by the control unit 11, which is an example of hardware, and executed as each functional unit included in the control unit 11. These will be described in more detail in the next section. Note that the control unit 11 is not limited to being a single unit, and the server device 10 may have multiple control units 11 for each function. Also, the server device 10 may be configured with a combination of these.

[0019] <Storage section 12> The storage unit 12 stores various information defined by the above description. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs and the like related to the server device 10 executed by the control unit 11, or as a memory such as a random access memory (RAM) that stores temporarily required information (arguments, arrays, etc.) related to the program calculations. The storage unit 12 stores various programs, variables, etc. related to the server device 10 executed by the control unit 11.

[0020] <Communications Division 13> The communication unit 13 is preferably a wired communication means such as USB, IEEE1394, Thunderbolt (registered trademark), wired LAN network communication, etc., but may also include wireless LAN network communication, mobile communication such as LTE / 5G, BLUETOOTH (registered trademark) communication, etc. as necessary. In other words, it is more preferable to implement it as a collection of multiple communication means. In other words, the server device 10 may communicate various information from the outside via the communication unit 13 and the network.

[0021] The server device 10 may be in an on-premise form or in a cloud form. The server device 10 in a cloud form may provide the above-mentioned functions and processes in the form of, for example, SaaS (Software as a Service) or cloud computing.

[0022] <Target user terminal 20> The subject terminal 20 is an information processing terminal used by the person whose security is to be evaluated. The "subject to evaluation" includes a business partner organization or its personnel that has any type of business relationship with the evaluation user (especially the person requesting the evaluation), such as the provision of commercial materials (goods or services) (e.g., provision of cloud services) or the outsourcing of business operations. The subject to evaluation is, for example, a business operator such as a service provider, supplier, or outsourced organization to the subject to evaluation. Note that the "business partner organization" includes a first-tier business partner organization that directly receives business from the subject to evaluation, a second-tier business partner organization that receives second-tier business from the first-tier business partner organization, etc.

[0023] Additionally, "organization" includes profit-making corporations (such as companies), non-profit corporations (such as cooperatives and foundations), and public corporations (such as local governments).

[0024] 2B, subject terminal 20 includes control unit 21, storage unit 22, communication unit 23, input unit 24, output unit 25, and communication bus 26. Control unit 21, storage unit 22, communication unit 23, input unit 24, and output unit 25 are electrically connected via communication bus 26 inside subject terminal 20. Description of control unit 21, storage unit 22, and communication unit 23 will be omitted since they are similar to the descriptions of each unit in server device 10.

[0025] <Input section 24> The input unit 24 accepts an operation input made by a user. The operation input is transferred as a command signal to the control unit 21 via the communication bus 26. The control unit 21 may execute a predetermined control or calculation based on the transferred command signal as necessary. The input unit 24 may be included in the housing of the subject terminal 20, or may be externally attached. For example, the input unit 24 may be implemented as a touch panel integrated with the output unit 25. When the input unit 24 is implemented as a touch panel, the user can input a tap operation, a swipe operation, or the like to the input unit 24. As the input unit 24, a switch button, a mouse, a track pad, a QWERTY keyboard, or the like can be adopted instead of a touch panel.

[0026] <Output section 25> The output unit 25 displays a screen of a graphical user interface (GUI) that can be operated by a user. The output unit 25 may be included in the housing of the subject terminal 20, or may be externally attached. Specifically, the output unit 25 may be implemented as a display device such as a CRT display, a liquid crystal display, an organic EL display, or a plasma display. It is preferable that these display devices are implemented by selectively using them according to the type of the subject terminal 20.

[0027] <Evaluator Terminal 30> The evaluator terminal 30 is an information processing terminal used by an evaluator who evaluates the answer of the evaluation target. The evaluator is an organization such as a company that evaluates security (for example, a security evaluation company that evaluates the security of services such as cloud services, software, etc.) or a person in charge thereof. The evaluator evaluates the security of the evaluation target from the evaluator terminal 30 via the information processing system 1, for example.

[0028] Fig. 3 is a block diagram showing the hardware configuration of the evaluator terminal 30 and the user terminal 40. As shown in Fig. 3A, the evaluator terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an input unit 34, an output unit 35, and a communication bus 36. The control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 are electrically connected via the communication bus 36 inside the evaluator terminal 30. The explanation of the control unit 31, the storage unit 32, the communication unit 33, the input unit 34, and the output unit 35 will be omitted because they are the same as the explanation of each unit in the subject terminal 20.

[0029] <User terminal 40> The user terminal 40 is an information processing terminal used by an evaluation user who uses a service (e.g., an evaluation service for answer data, a service for providing a security report, etc.) provided by the information processing system 1. The "evaluation user" includes an evaluation requester, a viewer, etc.

[0030] The "evaluation requester" is an evaluation user who requests an evaluation of the security of the evaluation target, and is, for example, an individual or organization having a business relationship with the evaluation target, or a person in charge of the organization. The evaluation requester includes, for example, an evaluation user who is registered with the security evaluation service by evaluators provided by the information processing system 1.

[0031] The evaluation requester is an organization or individual that requests a transaction with a business partner organization (evaluation target), and receives and uses the merchandise provided by the business partner organization. For example, if the merchandise being traded is a good, the evaluation requester is the purchaser of the item (finished product or parts) manufactured by the business partner organization. Also, for example, if the merchandise being traded is a service, the evaluation requester is the user of the service provided by the business partner organization (for example, a user of a cloud service provided by a cloud service provider). Furthermore, for example, if the merchandise being traded is work (task), the evaluation requester is the company that requests or outsources the work.

[0032] The evaluation requester includes not only an individual or organization that conducts a transaction (use of a service, outsourcing, etc.) with the evaluation target that is the subject of the evaluation, but also an individual or organization that requests an evaluation of a specific service. For example, the evaluation requester may include a company that wants to evaluate the security of a cloud service, etc. that it uses or is considering using, or a company that wants to confirm the evaluation.

[0033] A "viewer" is an individual or organization that uses the results of the security evaluation of the evaluation target conducted at the request of the evaluation requester (for example, referring to the indicators described below). A viewer is, for example, a provider of a commodity to be used, a business partner organization with which a transaction is planned, or an individual or organization that requests an evaluation of the evaluation target as a candidate for these. Viewers may include evaluation users who are registered with the security evaluation service by evaluators provided by the information processing system 1, and other evaluation users who are not registered with the evaluation service (for example, evaluation users who are not registered with the evaluation service but have obtained a web page that displays the evaluation provided by the evaluation service and is accessible from outside the evaluation service, a link to a file containing the evaluation, etc.).

[0034] 4B, user terminal 40 includes a control unit 41, a storage unit 42, a communication unit 43, an input unit 44, an output unit 45, and a communication bus 46. Control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 are electrically connected via communication bus 46 inside user terminal 40. Descriptions of control unit 41, storage unit 42, communication unit 43, input unit 44, and output unit 45 will be omitted because they are similar to the descriptions of the respective units in subject terminal 20.

[0035] 2. Functional configuration In this section, the functional configuration of the present embodiment will be described. Information processing by software stored in the storage unit 12 is specifically realized by the control unit 11, which is an example of hardware, and can be executed as each functional unit included in the control unit 11 (at least one processor included in the information processing system 1).

[0036] FIG. 4 is a block diagram showing functions realized by server device 10 (controller 11), subject terminal 20 (controller 21), evaluator terminal 30 (controller 31), and user terminal 40 (controller 41).

[0037] As shown in Figure 4A, the server device 10 (control unit 11) includes a basic display control unit 111, an answer receiving unit 112, an evaluation receiving unit 113, an acquisition unit 114, an index assignment unit 115, a right assignment unit 116, a search unit 117, a report output unit 118, and an artificial intelligence unit 120.

[0038] As shown in Fig. 4B, subject terminal 20 (control unit 21) includes a display unit 211 and an operation acquisition unit 212. As shown in Fig. 4C, evaluator terminal 30 (control unit 31) includes a display unit 311 and an operation acquisition unit 312. As shown in Fig. 4D, user terminal 40 (control unit 41) includes a display unit 411 and an operation acquisition unit 412.

[0039] <Basic display control unit 111> The basic display control unit 111 is configured to display various information on the subject terminal 20, the evaluator terminal 30, and the user terminal 40. For example, the basic display control unit 111 displays an answer input form in which the person to be evaluated inputs their answers, the answers registered by the person to be evaluated, the evaluation results of the answers by the evaluator, etc. on the display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, or the display unit 411 of the user terminal 40.

[0040] <Answer Reception Section 112> The answer receiving unit 112 is configured to create or update answer data by receiving input of answers to questions from the person to be evaluated. Specifically, the answer receiving unit 112 displays a predetermined answer input form for receiving input of answers to questions about security from the person to be evaluated on the subject terminal 20, and registers the answers input in the answer input form as answer data.

[0041] The answer receiving unit 112 may receive answers to questions about security from the subject of evaluation and a category to be assigned to the answer from the subject terminal 20, and add answer data including the answer and the category to the answer database. Note that a category is assigned to the entire answer data including multiple answers.

[0042] In addition, the answer receiving unit 112 does not necessarily have to receive a category designation from the person to be evaluated. For example, the answer receiving unit 112 may present the person to be evaluated with questions (answer input form) with a category designated in advance, and register answer data in which the previously designated category is assigned to the answer entered in the subject terminal 20.

[0043] The answer data may include question data in addition to the answer data and information indicating the category. If answer data has already been registered for the same question and category, the answer receiving unit 112 replaces the answer included in the answer data with the newly entered answer.

[0044] A category is information indicating the preconditions of the person being evaluated when answering the questions (for example, the product to be answered, the business to be answered, the department to be answered, etc.). In other words, a category is information on the product, business, department, etc. that is the subject of the answer entered by the person being evaluated. The person being evaluated enters answers to the questions about the product, etc. designated as the category.

[0045] The category may be the type of merchandise handled by the person being evaluated, the provider of the merchandise, the type of plan included in the merchandise, the business providing the merchandise, or a combination of these. This allows the same person to answer questions differently depending on the merchandise, etc., and allows different answers to be input and registered depending on the subject, and also allows the indicators described below to be assigned to the person being evaluated for each attribute of the merchandise of the person being evaluated.

[0046] The person to be evaluated who provides the service inputs answers according to, for example, the type of the target service (e.g., AI (Artificial Intelligence) service, RPO (Recruitment Process Outsourcing) service, etc.), the destination of the service (e.g., attributes of the person requesting the evaluation, such as the name of the organization requesting the evaluation), the type of plan (option) included in the service, the name of the business providing the service, the name of the department, etc. In other words, the person to be evaluated who provides multiple services or plans may input answers for each of these service attributes, and the answer receiving unit 112 may register answer data for each service attribute. The input answers are stored as answer data in association with the service attribute (category).

[0047] The "services" provided by the assessee include services provided via the Internet, such as SaaS, IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and cloud services, and in this case, the "assessee" includes cloud service providers, etc. In addition, the "services" provided by the assessee may be services provided to business partners, customers, etc.

[0048] The "type of service" may be read as the service name, and indicates the type, name, etc. of the service that the answer is about. For example, if the person being evaluated provides service A and service B, at least one of "service A" and "service B" may be assigned to the answer data as the type of service. The "type of plan included in the service" is the type of one or more contract plans set for the same service (e.g., service A), such as a "standard plan" and a "premium plan." Multiple plans set for the same service differ from each other, for example, in available functions, usage period, usage fee, etc. Furthermore, even for the same service, different types of categories may be assigned depending on the service provider, etc.

[0049] The categories may be configured as a combination (hierarchical structure) of a main category and a sub-category. For example, a type of service may be set as a main category, and a destination of the service may be set as a sub-category.

[0050] The answer receiving unit 112 may, for example, refer to the types of services and plans provided that are registered in advance as user information by the person to be evaluated in the information processing system 1, present these to the subject terminal 20 as candidates for "type of service" or "type of plan included in service," which is a type of category, and accept a selection of a category from the subject terminal 20. The answer receiving unit 112 may also present evaluation users registered in the registration information of the person to be evaluated as candidates for "service recipient," which is a type of category. The "registered evaluation users" include, for example, organizations that have provided reports or documents related to the person to be evaluated in the information processing system 1 in the past, organizations registered by the service provider, and the like.

[0051] Furthermore, the answer receiving unit 112 may receive input (designation) of multiple categories for one answer data. That is, the answer receiving unit 112 may assign multiple categories to one answer data. For example, in the case of an answer that is common to multiple services, multiple service names are assigned to the answer data as categories.

[0052] Furthermore, the answer accepting unit 112 may not accept the input (designation) of a category for answer data that does not depend on a category (i.e., is not classified into a specific category and applies to any service, plan, destination, etc.). The answer accepting unit 112 may also accept the designation (input) of an "unclassified category" for answer data that does not depend on a category. For example, the answer accepting unit 112 may accept the designation (input) of the "common" category as the unclassified category.

[0053] The response data includes the responses of the subject to a number of questions regarding the security of the subject. The "questions" are questions to which the subject is required to respond, and may include, for example, questions regarding the security of the subject himself / herself, the security of the products (goods or services) provided by the subject. The "questions" may also include questions regarding the security of other organizations in the supply chain of the subject. The "other organizations" include, for example, business partners of the subject, such as organizations to which the subject outsources its operations (including contractors, subcontractors, sub-subcontractors, etc.). The questions may include a so-called security checklist.

[0054] Questions may include, for example, questions confirming (and requesting responses from) the security certification status or evaluation, service level, scope of responsibility, security measures within the evaluation subject, handling of data related to the evaluation requester, handling of data managed by the evaluation subject, and service development, maintenance, or operation policies (e.g., account management).

[0055] The "answer data" is composed of the answers of the subject of evaluation to each of a number of questions regarding the security of the service, and is information that is the subject of the evaluator's check of the contents and evaluation. The answer data may be evaluated only once or multiple times. In other words, the evaluation of the answer data may include an initial evaluation (so-called review), an interim evaluation, a final evaluation, etc. The initial evaluation and the interim evaluation are evaluations in which a further evaluation is performed after the evaluation. The answer data may be corrected by the subject of evaluation based on the initial evaluation or the interim evaluation. The multiple evaluations may be performed by the same evaluator or by different evaluators (so-called reviewers, etc.). In the final evaluation, an evaluation is created that is used in a report or report provided to the evaluation user. In addition, the answer data may be evaluated by the evaluator again when the subject of evaluation has made corrections, updates, etc. The result of the evaluator's evaluation of the answer data is used as part of the report or report or as reference information.

[0056] The answers to each question included in the answer data are the answers entered by the subject of evaluation into the answer input form for each question presented in the answer input form, and are registered in the answer database. The answers to one question may be hierarchical.

[0057] In addition, the answer receiving unit 112 may receive answer input via an interface other than the answer input form (for example, uploading of a data file containing the answer by the subject of evaluation) and register this answer as answer data in the answer database.

[0058] When updating the representative answer data designated by the person to be evaluated (described later) by the input of the person to be evaluated, the answer receiving unit 112 may update answer data other than the representative answer data (hereinafter, "dependent answer data") that is included in the same category as the representative answer data among the answer data registered by the person to be evaluated, in accordance with the updated contents of the representative answer data. This makes it possible to automatically update the dependent answer data by updating to the representative answer data, using the representative answer data that determines the index as master data, and thus facilitating management of the answer data of the person to be evaluated.

[0059] "Updating to match the updates in the representative response data" includes, for example, replacing or updating answers to questions in the dependent response data that are identical or similar to answers updated in the representative response data with answers from the representative response data.

[0060] <Evaluation Reception Department 113> The evaluation receiving unit 113 is configured to receive, from an evaluator, an evaluation of the answer data registered (created or updated) by the answer receiving unit 112. The evaluation receiving unit 113 registers, for example, the evaluated answer data together with the evaluation result in an answer database or the like. The evaluation result includes at least an evaluation value indicating the level of security measures (few problems such as vulnerabilities).

[0061] "Evaluation" refers to the act of checking for deficiencies or inconsistencies in the answers included in the answer data, making comments on the content of the answers, assessing the content of the answers, scoring the answers based on a predetermined standard, etc. As described above, the evaluation may be performed by multiple evaluators, or a first evaluator may request a second evaluator to evaluate the registered answer data. In that case, the evaluation receiving unit 113 may receive an evaluation from the second evaluator after the evaluation by the first evaluator.

[0062] For example, when evaluation is performed in two stages, in the initial evaluation (review), confirmation of the presence or absence of deficiencies or inconsistencies, creation of points of indication, etc. are performed. Next, for the response data after the initial evaluation, evaluation such as assessment and scoring of the contents (response) and creation of comments on the entire response data is performed as a final evaluation based on a predetermined standard, and a report or report (e.g., a security report) including the results is created. The report or report is created by a final evaluator or an evaluation unit possessed by the control unit 11. The evaluation unit is configured to generate a part or the whole of the report or report based on the input response data. The evaluation result of the response data may be included in the report or report as a part of the report or report or as reference information. The report or report is transmitted to the user terminal 40 of the evaluation requester who requested the report or report.

[0063] The evaluation receiving unit 113 receives input of characters, sentences, etc. used for evaluation from the evaluator terminal 30. Evaluation is typically performed on answer data in which all questions have been answered. Answer data that has unanswered questions (questions for which answers are not registered) is not subject to evaluation, and evaluations may not be accepted by the evaluation receiving unit 113. Even if answer data includes unanswered questions (questions for which answers are not registered), only the answered questions may be partially subject to evaluation.

[0064] <Acquisition part 114> The acquiring unit 114 is configured to acquire an evaluation value of representative answer data selected for each category into which answer data is classified from a plurality of answer data created by the person to be evaluated (answer data registered by the answer accepting unit 112). The representative answer data is answer data that is referred to in order to calculate an index for each category.

[0065] For example, when multiple pieces of answer data created by the person to be evaluated are classified into the categories of "Service A" and "Service B" (in other words, one of these categories is specified for each piece of answer data), the acquisition unit 114 acquires an evaluation value of representative answer data in the category of "Service A" and an evaluation value of representative answer data in the category of "Service B". That is, the acquisition unit 114 acquires an evaluation value of answer data selected or designated as representative answer data from multiple pieces of answer data classified into the same category (e.g., "Service A"). Similarly, the acquisition unit 114 acquires an evaluation value of answer data selected or designated as representative answer data for each category for other answer data classified into other categories. By acquiring an evaluation value of representative answer data for each category in this way, an index can be assigned for each category with different characteristics, tendencies, etc., and therefore a more appropriate index can be assigned to the person to be evaluated.

[0066] Note that multiple pieces of answer data classified into one category (for example, "Service A") are data whose question contents or answer contents are different from one another, and as a result, whose evaluation values ​​are also different from one another.

[0067] Furthermore, when a category includes a main category and a subcategory, the acquiring unit 114 may acquire the evaluation value of the representative answer data from a plurality of answer data having the same main category but different subcategories, may acquire the evaluation value of the representative answer data from a plurality of answer data having the same subcategory but different main categories, or may acquire the evaluation value of the representative answer data from a plurality of answer data having both the same main category and subcategory. Furthermore, the acquiring unit 114 may receive, for example, an input of a category for which the evaluation value of the representative answer data is to be acquired from the subject terminal 20.

[0068] The acquiring unit 114 may select the answer data with the lowest evaluation value as the representative answer data from among the answer data classified into the same category. This allows the index assigning unit 115 described later to assign an index to the person to be evaluated based on the answer with the lowest evaluation.

[0069] The acquiring unit 114 may set the answer data designated by the subject of evaluation as the representative answer data for each category. This enables the subject of evaluation to adjust the criteria for the index assigned by the index assigning unit 115 described later.

[0070] The answer data specified by the person to be evaluated may be selected by the subject terminal 20 from among registered answer data, or may be answer data newly created as representative answer data based on registered answer data. In this case, the newly created answer data may be created by the person to be evaluated, or may be created by a representative answer data creation model included in the artificial intelligence unit 120. The representative answer data creation model is a learning model that is trained so that it can input multiple answer data and output representative answer data.

[0071] The representative answer data may be data used as a base for answers when the person to be evaluated inputs different answers for each subcategory (e.g., the service provider) in the same category (e.g., the same service provider). The person to be evaluated may create answer data for each subcategory by modifying all or part of the answers in the representative answer data based on the representative answer data according to the service provider, etc.

[0072] FIG. 5 is a schematic diagram showing an example of the concept of representative answer data. As shown in FIG. 5, when multiple answer data associated with a certain evaluation subject are classified into the categories of "service A" and "service B", representative answer data is selected from each answer data. In the example of FIG. 5, "answer data A1" is selected as the representative answer data for service A, and "answer data B1" is selected as the representative answer data for service B. In addition, when the representative answer data "answer data A1" is updated, other answer data of service A ("answer data A2" and "answer data A3") may be automatically updated as dependent answer data in accordance with the update of "answer data A1". In other words, the answer of the dependent answer data corresponding to the answer updated as the representative answer data may be automatically updated. The same applies to the answer data of service B.

[0073] The acquiring unit 114 may also acquire evaluation values ​​of multiple representative answer data for each category. For example, the acquiring unit 114 may accept a selection of multiple representative answer data from the subject terminal 20, or may select multiple representative answer data based on a specific criterion (e.g., the three lowest evaluation values) from among answer data classified into the same category.

[0074] <Index assignment unit 115> The index assigning unit 115 is configured to assign an index indicating the level of security measures to the evaluation subject for each category, based on the evaluation value of the representative response data acquired by the acquiring unit 114.

[0075] The index assigned by the index assigning unit 115 is created for each category for which the evaluation value of the representative response data has been acquired by the acquiring unit 114. For example, if evaluation values ​​of representative response data are acquired from two categories, "Service A" and "Service B," the index assigning unit 115 assigns an index for "Service A" and an index for "Service B" to the person being evaluated.

[0076] An "index" is information such as a numerical value, a keyword, or a code that indicates the level of security measures. The index for each category assigned to the person being evaluated is, for example, registered in the evaluation subject database as part of the registration information of the person being evaluated. The index may also be interpreted as a grade or rank, and is displayed on the user terminal 40 or the like in the form of, for example, a numerical value, a symbol, a keyword, or an image (e.g., a medal, a badge, etc.) indicating the size of the index, attached to information about the person being evaluated (information representing the person being evaluated, information representing the products of the person being evaluated, or information created by the person being evaluated).

[0077] The indicators are displayed, for example, together with information on the person being evaluated or the products provided by the person being evaluated, on information presentation screens such as the search results by the search unit 117 described below, the detection results of services such as IT services used by the evaluation user on the evaluation service of the information processing system 1, and service registers of IT services managed by the evaluation user.

[0078] The index may be published by the person to whom the evaluation is given on a service external to the information processing system 1 (for example, a website managed by an external server, the person to be evaluated's own website, a social networking service (SNS), etc.). The index published on the external service is also displayed on the terminals of external users (i.e., users other than the evaluation user) who do not use the service provided by the information processing system 1 or who are not registered with the service.

[0079] In this way, by disclosing the indices of the evaluation target to external users, the external users can easily and appropriately check the level of the security measures of the evaluation target (the level of security risk). That is, the evaluation result of the response data (evaluation value of the level of security measures) itself differs depending on the category such as the service, business, destination, and the presence or absence of options, even for the same evaluation target. Therefore, when the evaluation target selects the evaluation value to be disclosed to the outside from the evaluation values ​​of multiple categories, the evaluation target may be arbitrarily involved, and the criteria for selecting the evaluation value to be disclosed may differ depending on the evaluation target, so that there is a risk of misunderstanding or confusion on the security measures level of the evaluation target by external users. In contrast, by disclosing indices for external users based on unified criteria for each category, external users can appropriately check the security measures level of the evaluation target as described above.

[0080] The index assignment unit 115 converts the evaluation value of the representative response data into an index using reference information such as a function, a conditional expression, a table, or a statistical process prepared in advance. The "level" represented by the index increases according to the evaluation value. The "level" may also be a ranking among all the subjects of evaluation.

[0081] The index assigning unit 115 may assign an index to an evaluation subject based on a relative relationship between the evaluation value of the representative answer data of the evaluation subject and the evaluation values ​​of representative answer data of other evaluation subjects. This allows the result of evaluating the level of security measures based on a relative evaluation (ranking) to be assigned as an index. For example, the index assigning unit 115 may assign an index directly or indirectly indicating this to an evaluation subject who satisfies a condition, such as an evaluation value ranking in the top 5% or within the top 100. The index assigning unit 115 may also assign an index based on a relative relationship (ranking) of a numerical value (e.g., level) converted from an evaluation value.

[0082] The "evaluation values ​​of the evaluation subjects" compared (ranked) by the index assignment unit 115 may be evaluation values ​​of the same or similar categories. The category similarity criterion is a threshold value of the difference in the feature amounts of two categories (for example, the distance of vectors obtained by vectorizing the categories), and for example, two categories whose difference in the feature amounts is less than the threshold value (for example, the cosine similarity is equal to or greater than the threshold value) are determined to be similar to each other. The vectorization is performed, for example, by natural language processing using morphological analysis or by quantification using a known method such as encoding. The feature amounts of the categories may be obtained by referring to a table in which feature amounts are defined for each keyword. Furthermore, the similarity of the categories may be determined by referring to a table in which similar categories are defined in advance.

[0083] When the acquiring unit 114 acquires evaluation values ​​of multiple representative answer data for one category, the index assigning unit 115 may assign an index to the evaluation subject based on the level of security measures obtained by statistical processing of the evaluation values ​​of the multiple representative answer data acquired by the acquiring unit 114. This allows the level of security measures to be determined statistically, improving the reliability of the index. Examples of statistical processing of multiple evaluation values ​​include extraction of maximum values, extraction of minimum values, and calculation of average values ​​or medians.

[0084] The index assigning unit 115 may assign an index to the person to be evaluated based on the evaluation value of the representative answer data acquired by the acquiring unit 114 and other evaluation information on the person to be evaluated. This improves the reliability of the index because the index is determined based on evaluations other than the evaluation value of the answer data.

[0085] "Other evaluation information" includes, for example, information about the person being evaluated that is registered in a database of people being evaluated (registered information), information provided by the person being evaluated (provided information), and public information about the person being evaluated on the network.

[0086] The registration information of the evaluation target referred to as the evaluation information includes, for example, the results of vulnerability detection by a security check program (a program for scanning vulnerability information), etc. The information provided by the evaluation target includes, for example, the presence or absence of evidence of security measures (for example, an authentication certificate) and the contents thereof, etc.

[0087] The vulnerability detection result may include a vulnerability triage level that is output based on the result of scanning software including OSS (Open Source Software) and systems (including cloud computing services) for the presence or absence of vulnerabilities and their types. The triage level may be expressed, for example, in a number of levels, and a higher level of vulnerability may indicate a relatively higher need for taking measures.

[0088] "Public information" is information that is publicly available on websites accessible via the Internet. The types of websites from which the public information of the subject of assessment is obtained are not limited as long as they contain at least information about the subject of assessment (organization), and include official websites, unofficial websites, and other websites.

[0089] An official website is a website established by an organization related to the person being evaluated, and examples of such websites include corporate websites, investor relations websites, commercial websites (product websites or service websites), brand websites, promotional websites, owned media websites, campaign websites, e-commerce websites, membership websites, recruitment websites, and landing pages. An unofficial website is a website established by an organization (external institution) different from the organization related to the person being evaluated, and examples of such websites include industry information sites, news sites, economic information sites, and commercial database sites. Unofficial websites include both free and paid viewing pages. Public information about the person being evaluated may include, for example, the types of services provided (service categories), the number of users of the services, and the year of establishment.

[0090] The index assigning unit 115 may assign an index indicating a stepwise level to the evaluation subject based on the level of the security measure. This makes it easier to understand and manage the level of the security measure of the evaluation subject. For example, the index assigning unit 115 may assign stepwise indexes such as gold rank (gold medal index), silver rank (silver medal index), and bronze rank (bronze medal index) to the evaluation subject in descending order of the level of the security measure.

[0091] The tiered index (rank) may be defined according to the range of the level (or the evaluation value of the representative response data). For example, the index assigning unit 115 may define a level of 9 or higher out of 10 as gold rank, and a level of 7 or higher but less than 9 as silver rank, etc. The tiered index may also be defined according to the ranking of the level (or the evaluation value of the representative response data) in the same category. For example, the index assigning unit 115 may define a level ranking of 10th or higher among the registered evaluation subjects as gold rank, and a level ranking of 20th or higher as silver rank, etc.

[0092] The index assigning unit 115 may assign an index indicating that the security countermeasure level is a predetermined level or higher only to those evaluation subjects who have a security countermeasure level or higher. This allows only evaluation subjects who have a high level of security countermeasures to be assigned an index, making it easier to grasp those evaluation subjects who have a high level. For example, the index assigning unit 115 may assign an index (gold medal) only to evaluation subjects who have the above-mentioned gold rank, and not assign an index to evaluation subjects who have a lower level.

[0093] The index assigning unit 115 may periodically update the index assigned to the evaluation target, and generate image data representing the index, including the date of assignment or expiration of the index. This allows the evaluation target to encourage the evaluation target to continuously improve the level of security measures, and allows the evaluation user to check the freshness and up-to-dateness of the index.

[0094] The period for updating the index by the index assigning unit 115 may be, for example, one year, one month, etc. At the time of updating, the acquisition unit 114 acquires the evaluation value of the latest representative answer data again, and the index assigning unit 115 assigns an index to the person to be evaluated based on this evaluation value. The image data of the index also displays the most recent update date and time as the expiration date of the index. The index assigning unit 115 may, for example, create image data of a medal on which the date of assignment or the expiration date of the index is written. Information regarding the person to be evaluated to whom an index has been assigned is displayed on the user terminal 40 or the like with an image of the medal assigned.

[0095] The index assigning unit 115 may assign an auxiliary index indicating the degree of improvement of security measures to the evaluation target based on the amount of change in the evaluation value of the representative response data acquired by the acquiring unit 114. This allows the evaluation user to objectively grasp the level of the security measures, as well as the evaluation target's attitude toward security measures. Also, the evaluation target can appeal to the evaluation user about his or her attitude.

[0096] The index assigning unit 115 may assign to the evaluation subject an auxiliary index indicating the lead time until the response based on the time from when the evaluation subject is requested to respond to the questions to when the evaluation subject completes the creation of the response data. This allows the evaluation user to objectively grasp the level of the security measures, as well as the response speed when the evaluation subject is requested to conduct a security investigation. Also, the evaluation subject can appeal to the evaluation user about the response speed.

[0097] The "time from when the person to be evaluated is requested to answer questions to when the person to be evaluated completes creating the answer data" is, for example, the time from when the questions (answer input form) are sent to the subject terminal 20 upon request from the person requesting the evaluation to when the answers to all questions are entered in the subject terminal 20 and the answers are registered as answer data by the answer receiving unit 112.

[0098] <Rights Granting Department 116> The right granting unit 116 is configured to grant various rights (privileges) to the evaluation subject depending on the presence or absence or type of index granted by the index granting unit 115.

[0099] The right granting unit 116 may grant rights to the evaluation target according to the contract status in the rating service of the answer data of the evaluation target to which the index is assigned.

[0100] The "answer data evaluation service" is a service provided by information processing system 1 that accepts input into an answer input form, provides feedback (evaluation) on the answers entered into the answer input form, and provides evaluated answers to evaluation users.

[0101] The "contract status in the evaluation service" is, for example, whether or not there is a contract for the evaluation service, or the type of plan contracted for the evaluation service. A plurality of types of plans are prepared according to, for example, the contents of the service provided (available functions), the usage fee, etc. The types of plans may include a free plan. In this case, the paid plan may include, for example, services such as providing registered answer data (sharing of evaluation reports) to evaluation users (i.e., viewers) who are not registered in the evaluation service or external users, and assistance in creating answer data using an input assistance function such as AI. In addition, the "contract status" may include the amount charged according to the use of the service in a plan contracted on a pay-as-you-go basis. The right granting unit 116 may grant rights to, for example, evaluation subjects who have contracted a predetermined plan (for example, a plan with a monthly usage fee of a predetermined amount or more) or evaluation subjects who have been charged a predetermined amount or more.

[0102] The validity period (usable period) of the right granted according to the index may be, for example, the same period as the validity period of the index, or the period obtained by adding a grace period to the validity period. In addition, when the right is granted to the subject of evaluation according to the contract status, the validity period of the right may be the same period as the contract period, or the period obtained by adding a grace period to the contract period.

[0103] The right granting unit 116 may grant the evaluation subject the right to acquire image data representing the assigned index, depending on the contract status of the evaluation service for the answer data of the evaluation subject. This allows the evaluation subject who has a specific contract to appeal to the evaluation user or an external user about the high level of security measures by presenting the image data of the index to the evaluation user or an external user.

[0104] The "right to obtain image data" is, for example, the right to download data of an image showing an indicator (e.g., a medal) to the subject terminal 20, etc. The subject of evaluation can display the downloaded image data on the subject's service site, a website presenting security measures (policies), etc. These websites may be provided by an external server of the information processing system 1, for example, which can be viewed by external users. This enables the subject of evaluation to appeal to the outside world about the level of his or her own security measures.

[0105] In addition, the right granting unit 116 may grant the right to obtain image data of genuine indices to persons to be evaluated who have subscribed to a specific plan (e.g., a paid plan), and may grant the right to obtain image data of indices to which a watermark has been added to persons to be evaluated who have subscribed to a plan other than the specific plan (e.g., a free plan).

[0106] The right granting unit 116 may grant a ticket to an evaluation target who has been granted a predetermined index, which allows the evaluation target to request a security investigation of a business partner organization with which the evaluation target has a business relationship. This can increase the evaluation target's motivation to improve the level of his / her own security measures. The "predetermined index" is an index (e.g., gold rank) indicating that the level of security measures is equal to or higher than a preset value.

[0107] A "security investigation of a business partner organization" is implemented as an evaluation service of the information processing system 1, and includes, for example, sending an answer input form to the business partner organization, an evaluation by an evaluator of the answers entered by the business partner organization, and providing the evaluation to the person being evaluated (transaction organization). The ticket granted by the right granting unit 116 is consumed, for example, when the person being evaluated requests a security investigation. Note that a request for a security investigation from a business partner organization may usually be made for a fee (for example, a charge for the evaluation service of the information processing system 1).

[0108] The allocation and use of tickets is performed, for example, in the following procedure. First, in a ticket stock management step, a stock of tickets is allocated to evaluation subjects (specific subjects) who meet certain conditions (e.g., evaluation subjects who have been assigned a specific index). Next, in an investigation request step, a request for a security investigation is sent to a business partner organization selected by the specific subject, and the stock of tickets for the specific subject is reduced based on receipt of the investigation request or a response to the request. Tickets may be usable not only for investigation requests, but also for viewing investigation results, and the stock of tickets may be reduced based on the sending of a viewing request from the specific subject, receipt of investigation results, viewing, etc.

[0109] The right granting unit 116 may grant an award right or an event participation right to an evaluation target who has been granted a predetermined index. An evaluation target who has been granted an award right will be awarded for their efforts in security measures at an event or the like. An evaluation target who has been granted an event participation right will be sent an invitation letter, application link, etc. to a specific event (for example, an event that only evaluation targets who have been granted a predetermined index can participate in). This can increase the evaluation target's motivation to improve security.

[0110] The right granting unit 116 may grant an improvement support right to an evaluation target to which a predetermined index has been granted. The evaluation target to which the improvement support right has been granted can receive, for example, a plan for improving security measures, a special seminar by an expert, etc., according to the rank of the index.

[0111] The right granting unit 116 may grant a fee discount right to an evaluation target who has been granted a predetermined index. An evaluation target who has been granted a fee discount right can receive discounts on various fees (monthly usage fees, individual service usage, etc.) in the evaluation service of the information processing system 1, for example. In addition, a discount on cyber insurance premiums may be implemented for an evaluation target who has been granted a fee discount right.

[0112] The right granting unit 116 may receive input from the evaluator, such as setting criteria for evaluation targets (recipients of distribution) to which rights are to be granted, and selection of recipients of distribution. The right granting unit 116 may also receive input from the evaluator of privilege information, such as links to events, seminars, and the like, and ticket information, and register the privilege information in a database. Furthermore, the right granting unit 116 may transmit a message including the privilege information registered in the database to the recipient terminal 20 of the recipient of distribution. As a result, the privilege information is displayed on the recipient terminal 20.

[0113] <Search section 117> The search unit 117 is configured to perform a search on the evaluation targets registered in the evaluation target database.

[0114] The search unit 117 searches for the person to be evaluated based on, for example, a search query received from the user terminal 40, and displays the search results of the person to be evaluated, including the indexes assigned to the person to be evaluated, on the user terminal 40. The search query includes, for example, the name of the product, the evaluation result (evaluation value) of the security measures, the name of the person to be evaluated, and the like.

[0115] The search unit 117 may search for information on the subject of evaluation registered in the evaluation subject database, and may execute a search using the index given to the subject of evaluation as a narrowing condition. This enables the evaluation user to search for and select the subject of evaluation with which to conduct a transaction based on the index.

[0116] Furthermore, the search unit 117 may narrow down the search results by, for example, the type of product and by the index. For example, the search unit 117 may receive the type of product, index, etc., which are the narrowing down conditions, from the user terminal 40. In this case, the search unit 117 narrows down the search results by using the index of the category corresponding to the type of product.

[0117] The search unit 117 may search for products provided by the evaluation target registered in the evaluation target database, and may preferentially display in the search results products of the evaluation target to which a predetermined index has been assigned in the category corresponding to the product. This makes it easier for the evaluation user to select a desired product (goods or service) based on the level of security measures of the evaluation target.

[0118] For example, the search unit 117 may display products of an evaluated person to whom a specified index (e.g., gold rank) has been assigned higher in the search results than products of other evaluated people to whom that index has not been assigned.

[0119] <Report Output Section 118> The report output unit 118 is configured to output a report or a report created based on the evaluation received by the evaluation receiving unit 113 to the user terminal 40. The report or report includes at least the whole or part of the answer data entered by the person to be evaluated and the evaluation results by the evaluator (e.g., evaluation value, comments, etc.).

[0120] <Artificial Intelligence Department 120> The artificial intelligence unit 120 is configured to receive input from each functional unit and return the instructed output. The artificial intelligence used by the server device 10 in each functional unit may be a common one, or may be prepared individually for each functional unit.

[0121] The artificial intelligence unit 120 may be an AI (Artificial Intelligence) equipped with a learning model such as a transformer including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), or a language model such as a recurrent neural network (RNN), and may include a generative AI including a large-scale language model. The large-scale language model is a type of generative AI and includes models provided by services such as OpenAI's GPT, Google's Gemini, and Microsoft's Azure AI Studio. In addition, the artificial intelligence unit 120 may include any machine learning model, deep learning model, artificial intelligence model, etc.

[0122] The language model is an example of a learning model based on a machine learning algorithm. Specific examples of machine learning algorithms include nearest neighbor methods, naive Bayes methods, decision trees, support vector machines, and deep learning using neural networks. The artificial intelligence unit 120 can apply the above algorithms as appropriate.

[0123] The artificial intelligence unit 120 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or self-supervised learning. In supervised learning, machine learning is performed using training data (training data). The training data is composed of a pair of input data for learning and output data (correct answer data). In addition, the language model may not only be one trained for a specific task, but also a general-purpose model that can be used for a wide range of tasks.

[0124] The artificial intelligence unit 120 may be a general-purpose natural language processing learning model such as a large language model (LLM) that has learned a huge amount of data as an artificial intelligence. The LLM is a learning model that has learned a large amount of large data (for example, (i) web content on the Internet, or (ii) data stored in a specified database) composed of text data and the like in advance, and can execute various language processing tasks by giving tasks. According to a given prompt, it can perform a wide range of natural language processing tasks such as grasping sentence patterns and contexts, answering questions, and generating sentences. Such a general-purpose learning model includes a language model that can handle various tasks without fine tuning by One-shot Learning, Few-shot Learning, etc. In addition, the general-purpose learning model may be configured to be able to handle various tasks by Zero-shot Learning as well. The artificial intelligence used in each functional unit of the control unit 11 may be a separate learning model, or a common general-purpose learning model.

[0125] The learning model included in the artificial intelligence unit 120 (the learning model used in each functional unit, such as the representative response data creation model) can perform additional learning as transfer learning or fine tuning. For example, each time new data is registered, the artificial intelligence unit 120 may perform additional learning and fine tuning using the new data as new teacher data. This improves the accuracy of the information output from the learning model.

[0126] The learning model included in the artificial intelligence unit 120 may be a learning model (distilled model) obtained by knowledge distillation using an original learning model. In knowledge distillation, a learned model such as a large-scale language model is used as a teacher model, and the parameters of the student model are adjusted so that the output loss (Soft Target Loss) of the student model (distilled model) relative to the output (Soft Target) of the teacher model is reduced, thereby learning the student model, and the student model becomes a distilled model. In addition, the student model may be learned so that the output loss (Hard Target Loss) of the student model relative to the correct label (Hard Target) of the teacher data (combination of input data and output data of the learning model) is reduced. Compared to the original learning model (teacher model), the distilled model has a smaller number of parameters and a smaller processing load while having performance close to that of the learning model. Therefore, by using the distilled model, the cost of the information processing system 1 can be reduced.

[0127] For example, the learning model used in each functional unit may be a distilled model trained using a combination of input data and output data in a large-scale language model as training data. Furthermore, when the information processing system 1 is introduced, a large-scale language model may be used as the learning model used in each functional unit, and when training data from the large-scale language model is accumulated, a distilled model obtained by knowledge distillation using the training data may be used as the learning model used in each functional unit.

[0128] <Display> The display unit 211 of the subject terminal 20, the display unit 311 of the evaluator terminal 30, and the display unit 411 of the user terminal 40 each display a screen indicated by the screen data transmitted from the server device 10.

[0129] <Operation acquisition section> The operation acquisition unit 212 of the subject terminal 20 accepts operations by the subject to be evaluated who uses the subject terminal 20. The operation acquisition unit 312 of the evaluator terminal 30 accepts operations by the evaluator who uses the evaluator terminal 30. The operation acquisition unit 412 of the user terminal 40 accepts operations by the evaluation user who uses the user terminal 40.

[0130] 3. Information processing method This section describes an information processing method of the server device 10. This information processing method is executed by a computer, with each unit of the server device 10 acting as each step.

[0131] This information processing includes an acquisition step and an index assignment step. In the acquisition step, an evaluation value of representative answer data selected for each category in which answer data is classified is acquired from a plurality of answer data created by the evaluation subject. In the index assignment step, an index indicating a level of security measures is assigned to the evaluation subject for each category based on the evaluation value of the acquired representative answer data.

[0132] 6 is an activity diagram showing an example of the flow of information processing (indexing processing) executed by the information processing system 1. The information processing will be described below along with each activity in this activity diagram.

[0133] The index assignment process starts with the selection of representative answer data by the person to be evaluated. The person to be evaluated selects and inputs representative answer data for each category from among the answer data on the person to be evaluated terminal 20 (activity A101). The selection of representative answer data may be performed by the server device 10 based on a predetermined rule. The server device 10 acquires an evaluation value of the selected representative answer data from the answer database (activity A102).

[0134] Next, the server device 10 determines an index for each category based on the evaluation value of the acquired representative response data (activity A103). Furthermore, the server device 10 assigns the determined index to the evaluation target and registers it in the evaluation target database (activity A104). As a result, the target terminal 20 displays information related to the index (for example, display of the assigned index, display of benefits based on the index, etc.) (activity A105).

[0135] 4. Effect The operation of this embodiment can be summarized as follows: That is, the result of the security evaluation can be presented, and therefore the security level of the person to be evaluated can be confirmed.

[0136] Although the embodiment of the present invention has been described above, the present invention is not limited to this, and can be modified as appropriate without departing from the technical concept of the invention.

[0137] 5.Other In the above embodiment, the server device 10 performs various storage and control, but multiple external devices may be used instead of the server device 10. That is, various information and programs may be distributed and stored in multiple external devices using block chain technology or the like. In particular, the artificial intelligence unit 120 may be an external configuration of the server device 10. In that case, the artificial intelligence unit 120, which is an external configuration, is provided by, for example, an artificial intelligence service server, and is configured to receive input from each functional unit of the server device 10, receive a request to execute an artificial intelligence service, and return an instructed output as a processing result to the server device 10. The artificial intelligence service server may be a server that provides a service using a language model as a learning model, or may be a server that executes a language processing task using a language model. The artificial intelligence service server may be constructed by LLM. The artificial intelligence service server receives input of a prompt by text, image, voice, etc., and generates and responds to the prompt.

[0138] The control unit 11 does not necessarily have to include the right granting unit 116 and the search unit 117. In other words, the information processing system 1 does not necessarily have to grant rights based on the index to the evaluation subject. In addition, the information processing system 1 does not necessarily have to have a search function for the evaluation subject.

[0139] The aspect of the present embodiment is not limited to the information processing system 1, and may be an information processing method or a program. The information processing method includes each step executed by the information processing system 1. The program causes a computer to execute each step of the information processing system 1.

[0140] An aspect of this embodiment may be an index assignment method including a step in which an index evaluator assigns an index indicating the level of security measures to the person being evaluated for each category based on the evaluation value of representative answer data selected for each category in which answer data is classified from multiple answer data created by the person being evaluated.

[0141] It may be provided in any of the following ways:

[0142] (1) An information processing system comprising at least one processor, the processor being configured to execute each of the following steps by reading a program: in an acquisition step, an evaluation value of representative answer data selected for each category into which the answer data is classified is acquired from a plurality of answer data created by the person to be evaluated, the answer data including the answers of the person to be evaluated to questions regarding security of the person to be evaluated; and in an index assignment step, an index indicating a level of security measures is assigned to the person to be evaluated for each category based on the evaluation value of the acquired representative answer data.

[0143] (2) In the information processing system described in (1) above, the category is the type of product handled by the person being evaluated, the recipient of the product, the type of plan included in the product, the business that provides the product, or a combination of these.

[0144] (3) In the information processing system described in (1) or (2) above, in the acquisition step, the evaluation values ​​of multiple representative answer data are acquired for each category, and in the index assignment step, the index is assigned to the person to be evaluated based on the level obtained by statistical processing of the evaluation values ​​of the acquired multiple representative answer data.

[0145] (4) In the information processing system described in any one of (1) to (3) above, in the obtaining step, the answer data having the lowest evaluation value is selected as the representative answer data from among the answer data classified into the same category.

[0146] (5) In the information processing system according to any one of (1) to (4) above, the processor is configured to further execute the following steps: in the answer receiving step, the answer data is created or updated by receiving answers to the questions from the person being evaluated; in the acquisition step, the answer data designated by the person being evaluated is set as the representative answer data for each category; and in the answer receiving step, when updating the representative answer data, the answer data other than the representative answer data that is included in the same category as the representative answer data is updated to match the update content of the representative answer data.

[0147] (6) In the information processing system described in any one of (1) to (5) above, in the index assignment step, the index is assigned to the person to be evaluated based on a relative relationship between the evaluation value of the representative answer data of the person to be evaluated and the evaluation values ​​of the representative answer data of other people to be evaluated.

[0148] (7) An information processing system according to any one of (1) to (6) above, wherein in the index assignment step, the index indicating that the level is above a predetermined level is assigned only to the person to be evaluated whose level is above a predetermined level.

[0149] (8) An information processing system according to any one of (1) to (7) above, wherein in the index assignment step, the index indicating the level in stages is assigned to the person to be evaluated based on the level.

[0150] (9) In an information processing system described in any one of (1) to (8) above, in the index assignment step, the index is assigned to the person being evaluated based on the evaluation value of the acquired representative response data and other evaluation information for the person being evaluated.

[0151] (10) In an information processing system according to any one of (1) to (9) above, in the index assignment step, an auxiliary index indicating the degree of improvement of security measures is assigned to the person being evaluated based on the amount of change in the evaluation value of the acquired representative response data.

[0152] (11) In the information processing system described in any one of (1) to (10) above, in the index assignment step, an auxiliary index indicating a lead time until an answer is assigned to the person to be evaluated based on the time from when the person to be evaluated is requested to answer the questions to when the person to be evaluated completes creation of the answer data.

[0153] (12) In the information processing system described in any one of (1) to (11) above, in the index assignment step, the index assigned to the person being evaluated is periodically updated, and image data representing the index, including the assignment date or expiration date of the index, is generated.

[0154] (13) In the information processing system described in any one of (1) to (12) above, the processor is configured to further execute the following step, in which in the right granting step, the right to acquire image data representing the assigned index is granted to the person to be evaluated, depending on the contract status of the evaluation service for the answer data of the person to be evaluated.

[0155] (14) In the information processing system described in any one of (1) to (13) above, the processor is configured to further execute the following step, in which in the entitlement granting step, a ticket is granted to the person to be evaluated who has been assigned a specific indicator, enabling the person to request a security investigation of a business partner organization with which the person to be evaluated has a business relationship.

[0156] (15) In the information processing system described in any one of (1) to (14) above, the processor is configured to further execute the following step, in which in the search step, information of the person to be evaluated registered in a database is searched for, and a search is performed using the index as a narrowing down condition.

[0157] (16) In the information processing system described in any one of (1) to (15) above, the processor is configured to further execute the following step, in which in the search step, products offered by the person being evaluated who is registered in a database are searched for, and the products of the person being evaluated to which a predetermined index has been assigned are preferentially displayed in the search result.

[0158] (17) An information processing method comprising steps executed by an information processing system according to any one of (1) to (16) above.

[0159] (18) A program for causing a computer to execute each step of the information processing system described in any one of (1) to (16) above. Of course, this is not the case.

[0160] Finally, although various embodiments according to the present disclosure have been described, these are presented as examples and are not intended to limit the scope of the invention. The novel embodiment can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. The embodiments and their modifications are included within the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims. [Explanation of symbols]

[0161] 1: Information processing system 2: Communication lines 10: Server device 11: Control section 12: Storage section 13: Communications Department 14: Communication bus 20: Target device 21: Control section 22: Storage section 23: Communications Department 24: Input section 25: Output section 26: Communication bus 30: Evaluator terminal 31: Control section 32: Storage section 33: Communications Department 34: Input section 35: Output section 36: Communication bus 40: User terminal 41: Control section 42: Storage section 43: Communications Department 44: Input section 45: Output section 46: Communication bus 111: Basic display control unit 112: Answer Reception Department 113: Evaluation Reception Department 114: Acquisition Department 115: Indexing section 116: Rights Granting Department 117: Search section 118: Report output section 120: Artificial Intelligence Department 211:Display section 212: Operation acquisition section 311: Display section 312: Operation acquisition section 411:Display section 412: Operation acquisition section

Claims

1. An information processing system, At least one processor; The processor is configured to execute the following steps by reading the program: In the acquisition step, the evaluation values ​​of a plurality of representative answer data are acquired from a plurality of answer data created by the evaluation subject, the representative answer data being selected for each category into which the answer data is classified based on a criterion for the evaluation value of the answer data or a designation from the evaluation subject, wherein the answer data includes the evaluation subject's answers to questions regarding security of the evaluation subject, In the index assignment step, an index indicating the level of security measures is assigned to the person being evaluated for each category based on the level of security measures obtained by statistical processing of the evaluation values ​​of the acquired representative response data.

2. 2. The information processing system according to claim 1, An information processing system in which the category is the type of merchandise handled by the person being evaluated, the recipient of the merchandise, the type of plan included in the merchandise, the business that provides the merchandise, or a combination thereof.

3. 2. The information processing system according to claim 1, In the obtaining step, the answer data having the lowest evaluation value is selected as the representative answer data from among the answer data classified into the same category.

4. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the answer receiving step, the answer data is created or updated by receiving an input of an answer to the question from the person to be evaluated; In the obtaining step, the answer data designated by the evaluation subject is set as the representative answer data for each of the categories; In the answer receiving step, when the representative answer data is updated, the answer data other than the representative answer data that is included in the same category as the representative answer data is updated to match the updated contents of the representative answer data.

5. An information processing system, comprising: At least one processor; The processor is configured to execute the following steps by reading the program: In the acquisition step, the evaluation value of representative answer data is acquired from a plurality of answer data created by the evaluation subject, the representative answer data being selected for each category into which the answer data is classified based on a criterion for the evaluation value of the answer data or a designation from the evaluation subject, wherein the answer data includes the evaluation subject's answers to questions regarding security of the evaluation subject, In the index assignment step, an index indicating the level of security measures is assigned to the person being evaluated for each category based on the relative relationship between the evaluation value of the representative answer data of the person being evaluated and the evaluation values ​​of the representative answer data of other people being evaluated, in an information processing system.

6. 2. The information processing system according to claim 1, In the index assignment step, the index indicating that the level is equal to or higher than a predetermined level is assigned to only the person to be evaluated whose level is equal to or higher than a predetermined level.

7. 2. The information processing system according to claim 1, In the index assignment step, an index indicating the level in stages is assigned to the person to be evaluated based on the level, in the information processing system.

8. An information processing system, At least one processor; The processor is configured to execute the following steps by reading the program: In the acquisition step, the evaluation value of representative answer data is acquired from a plurality of answer data created by the evaluation subject, the representative answer data being selected for each category into which the answer data is classified based on a criterion for the evaluation value of the answer data or a designation from the evaluation subject, wherein the answer data includes the evaluation subject's answers to questions regarding security of the evaluation subject, In the index assignment step, an information processing system assigns an index indicating the level of security measures to the person being evaluated for each category based on the evaluation value of the acquired representative response data and other evaluation information for the person being evaluated.

9. An information processing system, At least one processor; The processor is configured to execute the following steps by reading the program: In the acquisition step, the evaluation value of representative answer data is acquired from a plurality of answer data created by the evaluation subject, the representative answer data being selected for each category into which the answer data is classified based on a criterion for the evaluation value of the answer data or a designation from the evaluation subject, wherein the answer data includes the evaluation subject's answers to questions regarding security of the evaluation subject, In the index assignment step, an index indicating a level of security measures is assigned to the evaluation subject for each category based on the amount of change in the evaluation value of the acquired representative response data, in the information processing system.

10. 2. The information processing system according to claim 1, In the index assignment step, an auxiliary index indicating the lead time until the answer is assigned to the person to be evaluated is assigned to the person to be evaluated based on the time from when the person to be evaluated is asked to answer the questions to when the person to be evaluated completes creating the answer data.

11. 2. The information processing system according to claim 1, In the index assignment step, the information processing system periodically updates the index assigned to the person being evaluated and generates image data representing the index, including the assignment date or expiration date of the index.

12. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the right granting step, the information processing system grants the person to be evaluated the right to acquire image data representing the assigned index depending on the contract status of the person to be evaluated in the evaluation service for the answer data of the person to be evaluated.

13. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the rights granting step, the information processing system grants the person to be evaluated who has been assigned a specified index a ticket that enables the person to request a security investigation from a business partner organization with which the person to be evaluated has a business relationship.

14. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the search step, the information processing system searches information about the person to be evaluated registered in a database, and executes a search using the index as a narrowing down condition.

15. 2. The information processing system according to claim 1, The processor is further configured to perform the steps of: In the search step, the information processing system searches for products offered by the person being evaluated who is registered in a database, and prioritizes the products of the person being evaluated who have been assigned a predetermined index in the search results.

16. 1. An information processing method, comprising: An information processing method comprising the steps executed by the information processing system according to any one of claims 1 to 15.

17. A program, A program for causing a computer to execute each step of the information processing system according to any one of claims 1 to 15.

Images