Information processing system, information processing method, and program

Abstract

Provided is a more useful information processing system or the like related to security investigation. 【Solution means】According to one aspect of the present invention, there is provided an information processing system including at least one processor, the processor being configured to execute the following steps by reading a program. In an acquisition step, an answer to a security-related investigation by a first entity is acquired. In a registration step, a disclosure condition for disclosing the answer to a second entity is registered. In a first reception step, a disclosure request for requesting disclosure of the answer from the second entity is received. In a determination step, it is determined whether or not the disclosure condition is satisfied based on the information included in the disclosure request. In a first output step, when the disclosure condition is satisfied, the answer is output to the second entity.

Description

Technical Field

[0001] The present invention relates to an information processing system, an information processing method, and a program.

Background Art

[0002] Patent Document 1 describes a risk investigation support system including: a management unit that manages a correspondence relationship between a first user entity and a first target entity, and manages a risk investigation regarding security measures for the first target entity in association with the first target entity; and a control unit that provides the updated risk investigation to the first user entity associated with the first target entity when the risk investigation is updated.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] An information processing system or the like regarding risk investigation is required.

[0005] In view of the above circumstances, the present invention aims to provide a more useful information processing system or the like regarding security investigation.

Means for Solving the Problems

[0006] According to one aspect of the present invention, there is provided an information processing system including at least one processor. The processor is configured to execute the following steps by reading a program. In an acquisition step, an answer to an investigation regarding security by a first entity is acquired. In a registration step, a disclosure condition for disclosing the answer to a second entity is registered. In a first reception step, a disclosure request for requesting disclosure of the answer from the second entity is received. In a determination step, it is determined whether the disclosure condition is satisfied based on the information included in the disclosure request. In a first output step, when the disclosure condition is satisfied, the answer is output to the second entity. Thus, an information processing system is provided.

[0007] According to such an aspect, a more useful system or the like regarding a security investigation can be provided.

Brief Description of Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Mode for Carrying Out the Invention

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Various characteristic matters shown in the embodiments described below can be combined with each other.

[0010] By the way, a program for realizing software appearing in one embodiment may be provided as a non-transitory computer-readable medium readable by a computer, may be provided so as to be downloadable from an external server, or may be provided so that the program is started on an external computer and its function is realized on a client terminal (so-called cloud computing).

[0011] Also, in various information processes according to one embodiment, an input and an output corresponding to the input can be realized. Here, as long as an output is obtained as a result of the input, the mode of information (hereinafter referred to as reference information) referred to in such information processing is not limited. The reference information may be, for example, rule-based information such as a database, a lookup table, a predetermined function (including a judgment formula such as a regression formula constructed by a statistical method), a learned model in which the correlation between the input and the output is learned in advance, or a generative AI such as a large language model or a vision language model capable of outputting a desired result by inputting a prompt.

[0012] In addition, in one embodiment, the "unit" may include, for example, hardware resources implemented by a circuit in a broad sense and information processing of software that can be specifically realized by these hardware resources. Also, in one embodiment, various types of information are handled, and these information are represented, for example, by physical values of signal values representing voltage and current, the high and low of signal values as a set of binary bits composed of 0 or 1, or quantum superposition (so-called quantum bits), and communication and operations can be executed on a circuit in a broad sense.

[0013] Furthermore, a circuit in a broad sense is a circuit realized by appropriately combining at least a circuit, circuitry, a processor, and a memory, etc. Also, the processor may be a general-purpose processor or a dedicated circuit. That is, it includes application specific integrated circuits (ASICs), programmable logic devices (e.g., simple programmable logic devices (SPLDs), complex programmable logic devices (CPLDs), and field programmable gate arrays (FPGAs)), etc.

[0014] 1. Hardware Configuration In this section, the hardware configuration will be described.

[0015] <Information Processing System 1> FIG. 1 is a configuration diagram showing an information processing system 1. The information processing system 1 includes a server 2, an information processing device 3, an information processing device 4, and an information processing device 5. The server 2, the information processing device 3, the information processing device 4, and the information processing device 5 are configured to be communicable through a telecommunication line (network). In an exemplary aspect, the information processing device 3 can function as a terminal of a first entity. The information processing device 4 can function as a terminal of a second entity. The information processing device 5 can function as a terminal of an administrator entity. Here, the system exemplified in the information processing system 1 is composed of one or more devices or components. Therefore, it should be noted that even the server 2 alone, or the server 2 and the information processing device 3, or the server 2 and the information processing device 4, or the server 2 and the information processing device 5, is included in the information processing system 1. More specifically, the information processing system 1 may include an element selected from the group consisting of the server 2, the information processing device 3, the information processing device 4, and the information processing device 5. Even if an unselected element is not included in the information processing system 1, it may be electrically connected to the selected element as an external element. Hereinafter, these components will be described.

[0016] The information processing system 1 constitutes at least a part of a system related to investigations such as security utilized by a plurality of first entities and a plurality of second entities. The information processing system 1 mainly performs functions such as aggregating and providing responses to investigations regarding the first entities (investigations related to security, other investigations related to business materials such as organizations and services, etc.), analyzing the responses, and providing evaluation results. The investigation targets for the investigations regarding the first entities include not only the business materials provided by the first entities but also the first entities themselves. The business materials provided by the first entities include all forms of transaction relationships such as the provision of goods or services (for example, the provision of cloud services), the outsourcing of operations, etc. The first entity itself, when the first entity is an organization, refers to the organization itself of the first entity, and security investigations include the security investigation of the organization itself. In one embodiment, the information processing system 1 consists of one or more devices or components. These components will be described below.

[0017] <Server 2> FIG. 2 is a block diagram showing the hardware configuration of the server 2. The server 2 includes a communication unit 21, a storage unit 22, and a control unit 23, and these components are electrically connected via a communication bus 20 inside the server 2. Each component will be further described.

[0018] The communication unit 21 is composed of a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n / ac / ax, LTE, 5G, 6G, etc., or a wired communication module compliant with standards such as IEEE802.3. The communication unit 21 is configured to be able to transmit various electrical signals from the server 2 to external components. Also, the communication unit 21 is configured to be able to receive various electrical signals from external components to the server 2. More preferably, the communication unit 21 has a network communication function, and thereby, various information may be communicably implemented between the server 2 and external devices via the network.

[0019] The storage unit 22 stores various information defined by the foregoing description. This can be implemented, for example, as a storage device such as a Solid State Drive (SSD) that stores various programs and the like related to the server 2 executed by the control unit 23, or as a memory such as a Random Access Memory (RAM) that stores temporarily necessary information (arguments, arrays, etc.) related to the calculation of programs. The storage unit 22 stores various programs, variables, and the like related to the server 2 executed by the control unit 23.

[0020] The control unit 23 performs processing and control of the overall operation related to the server 2. The control unit 23 is, for example, a Central Processing Unit (CPU) not shown in the figure. The control unit 23 realizes various functions related to the server 2 by reading a predetermined program stored in the storage unit 22. That is, the information processing by software stored in the storage unit 22 is specifically realized by the control unit 23, which is an example of hardware, so that each step related to each function described later can be executed. These will be described in more detail in the next section. Note that the control unit 23 is not limited to being single, and may be implemented to have a plurality of control units 23 for each function, or a combination thereof.

[0021] <Information processing device 3> The information processing device 3 is an information processing device used by the first entity. The first entity is an organization such as a company or its person in charge who answers inquiries regarding security and the like. The first entity answers inquiries regarding security, for example, from the information processing device 3 via the information processing system 1.

[0022] In addition, the first entity includes a trading partner organization or its person in charge that conducts transactions such as providing commercial products to a second entity (for example, the requester of a security investigation). The first entity is, for example, an operator such as a service provider, a supplier, or an outsourcing organization. Note that the "trading partner organization" includes a primary trading partner organization that directly conducts transactions with the second entity, an Nth-level trading partner organization that receives Nth-level transactions from the primary trading partner organization, and the like. That is, the trading partner organization means a primary trading partner organization or an Nth-level trading partner organization (N>1) as viewed from the originating organization (the second entity), and the primary trading partner organization and the Nth-level trading partner organization in one transaction object constitute a supply chain for the transaction object. In addition, the trading partner organization may include individual business owners who receive transactions. In addition, the "organization" includes for-profit corporations (for example, companies, etc.), non-profit corporations (for example, cooperatives, foundations, etc.), public corporations (for example, local governments, etc.), and the like.

[0023] FIG. 3 is a block diagram showing the hardware configuration of the information processing apparatus 3 and the information processing apparatus 4. The information processing apparatus 3 includes a communication unit 31, a storage unit 32, a control unit 33, a display unit 34, and an input unit 35, and these components are electrically connected via a communication bus 30 inside the information processing apparatus 3. Each component will be further described. The descriptions of the communication unit 31, the storage unit 32, and the control unit 33 are omitted because they are the same as the descriptions of the respective units in the server 2.

[0024] The display unit 34 may be included in the housing of the information processing apparatus 3 or may be externally attached. The display unit 34 displays a screen of a graphical user interface (GUI) operable by the user. For example, it is preferable to selectively use display devices such as a CRT display, a liquid crystal display, an organic EL display, and a plasma display according to the type of the information processing apparatus 3.

[0025] The display unit 34 displays the screen indicated by the screen data transmitted from the server 2. The display unit 34 displays a system screen related to the information processing system 1 indicated by the screen data transmitted from the server 2.

[0026] The input unit 35 may be included in the housing of the information processing apparatus 3 or may be externally attached. For example, the input unit 35 may be integrated with the display unit 34 and implemented as a touch panel. With a touch panel, the user can input tap operations, swipe operations, etc. Of course, instead of a touch panel, a switch button, a mouse, a QWERTY keyboard, etc. may be adopted. That is, the input unit 35 receives the operation input made by the user. The input is transferred as a command signal to the control unit 33 via the communication bus 30, and the control unit 33 can execute predetermined control and calculations as necessary.

[0027] <Information Processing Apparatus 4> The information processing apparatus 4 includes a communication unit 41, a storage unit 42, a control unit 43, a display unit 44, and an input unit 45, and these components are electrically connected via a communication bus 40 inside the information processing apparatus 4. Each component will be further described. The descriptions of the communication unit 41, the storage unit 42, and the control unit 43 are omitted because they are the same as the descriptions of the respective units in the server 2. The descriptions of the display unit 44 and the input unit 45 are omitted because they are the same as the descriptions of the respective units in the information processing apparatus 3.

[0028] The information processing apparatus 4 is an information processing apparatus used by a second entity that uses services provided by the information processing system 1 (for example, a service for aggregating answer data for questions and questionnaires, an investigation service for security related to organizations and services, etc., an evaluation / analysis service for security, etc., a service for creating and providing security reports, etc.). The "second entity" includes viewers of answers to security investigations, requesters of security investigations, evaluation users, etc.

[0029] A "viewer" is an individual or organization that utilizes the security evaluation results regarding a first entity, which are conducted at the request of oneself or another second entity. A viewer is, for example, a provider of a commercial product such as a service to be utilized, a trading partner organization with which there is a planned transaction, or an individual or organization that requests the investigation results regarding the first entity as these candidates. The viewers may include evaluation users (who may also be called service users) registered for the services provided by the information processing system 1 (for example, the security evaluation service by the evaluator), and other evaluation users who are not registered for the evaluation service (for example, evaluation users who are not registered for the evaluation service but have obtained a link to a web page displaying the evaluation provided by the evaluation service, a file including the evaluation, etc., which can be accessed from outside the evaluation service, and who may also be called other service users).

[0030] A "security investigation requester" is an evaluation user who requests a security evaluation regarding a first entity, and is, for example, an individual, an organization, or a person in charge of the organization that has a trading relationship with the first entity. The security investigation requesters include, for example, evaluation users registered for the security evaluation service by the evaluator provided by the information processing system 1.

[0031] The second entity is an organization or individual that requests a transaction from a trading partner organization (the first entity), and receives and utilizes commercial products such as services and operations provided by the trading partner organization. For example, when the commercial product being traded is an item, the second entity may be a purchaser of the item (finished product or part) manufactured by the trading partner organization. Also, for example, when the commercial product being traded is a service, the second entity may be a user of the service provided by the trading partner organization (for example, a user of the cloud service provided by a cloud service provider). Furthermore, for example, when the commercial product being traded is an operation (work), the second entity may be the contractor or the consignor of the operation.

[0032] The second entity includes, in addition to individuals or organizations that conduct transactions (such as service usage, outsourcing, etc.) subject to evaluation with the first entity, individuals or organizations that seek evaluations regarding specific commercial materials or organizations. For example, the second entity may include enterprises that want to evaluate the security of cloud services, etc., that they are using or considering using, and enterprises that want to confirm such evaluations.

[0033] <Information processing device 5> The information processing device 5 is an information processing device used by the administrator entity. The information processing device 5 includes a communication unit 51, a storage unit 52, a control unit 53, a display unit 54, and an input unit 55, and these components are electrically connected via a communication bus 50 inside the information processing device 5. Each component will be further described. Since the descriptions of the communication unit 51, the storage unit 52, and the control unit 53 are the same as those of the respective parts in the server 2, they are omitted. Since the descriptions of the display unit 54 and the input unit 55 are the same as those of the respective parts in the information processing device 3, they are omitted.

[0034] The "administrator entity" in the information processing system 1 is an entity responsible for the management and operation of the entire system. The administrator entity performs system settings, monitoring, provision of evaluation services, etc. The evaluation services mainly perform security evaluations regarding the first entity, provision of security evaluations, etc. The administrator entity can evaluate the responses from the first entity. The administrator entity includes organizations such as enterprises that conduct security evaluations (for example, security evaluation enterprises that conduct security evaluations of services such as cloud services and software) or their responsible persons. The administrator entity can, for example, evaluate the security-related responses of the first entity from the information processing device 5 via the information processing system 1.

[0035] The control unit 23 receives inputs such as characters and sentences used for evaluation from the information processing device 5. Note that the evaluation is typically performed on response data for which answers have been provided to all questions. Response data with unanswered questions (questions for which no answers have been registered) is not subject to evaluation, and the control unit 23 does not necessarily need to accept the evaluation. Also, even for response data that includes unanswered questions (questions for which no answers have been registered), only the answered questions may be partially subject to evaluation.

[0036] 2. Functional Configuration In this section, the functional configuration of this embodiment will be described. Information processing by software stored in the storage unit 22 is specifically realized by the control unit 23, which is an example of hardware, and can be executed as each functional unit included in the control unit 23 (at least one processor included in the information processing system 1).

[0037] FIG. 4 is a block diagram showing the functions realized by the server 2 (control unit 23), the information processing device 3 (control unit 33), and the information processing device 4 (control unit 43).

[0038] As shown in FIG. 4A, it is a block diagram showing the functions realized by the control unit 23. The control unit 23 includes an acquisition unit 231, a registration unit 232, a reception unit 233, a determination unit 234, an output unit 235, a collection unit 236, an estimation unit 237, a management unit 238, a display control unit 239, a transmission unit 240, a notification unit 241, and an artificial intelligence unit 242.

[0039] As shown in FIG. 4B, the information processing device 3 (control unit 33) includes a display unit 331 and an operation acquisition unit 332. As shown in FIG. 4C, the information processing device 4 (control unit 43) includes a display unit 431 and an operation acquisition unit 432. As shown in FIG. 4D, the information processing device 5 (control unit 53) includes a display unit 531 and an operation acquisition unit 532.

[0040] <Acquisition Unit 231> The acquisition unit 231 is configured to be able to acquire various types of information from an external source. The acquisition unit 231 can acquire relevant information from information sources on the Internet, databases, and the like. Further, the acquisition unit 231 is configured to be able to acquire various types of information by reading out various types of information stored in at least a part of the storage area, which is at least a part of the storage unit 22, and writing the read-out information into the work area, which is at least a part of the storage unit 22. For example, the acquisition unit 231 acquires an answer to an investigation regarding security by a first entity.

[0041] The acquisition unit 231 is configured to create or update answer data by acquiring an input of an answer to a question item from the first entity. Specifically, the control unit 23 causes the display unit 331 to display a predetermined answer input form for receiving an input of an answer to a question item regarding security from the first entity, and registers the answer input in the answer input form as answer data.

[0042] The acquisition unit 231 may receive, from the operation acquisition unit 332, an answer to a question item regarding the security of the first entity and a designation of a category assigned to the answer, and add answer data including the answer and the category to the answer database. Note that the category is assigned to the entire answer data including a plurality of answers.

[0043] Further, the acquisition unit 231 does not necessarily have to acquire a category designation from the first entity. For example, the acquisition unit 231 may present a question item (answer input form) with a category designated in advance to the first entity, and register answer data in which a category designated in advance is assigned to the answer input in the operation acquisition unit 332.

[0044] The answer data may include data of the question item in addition to the data of the answer and the information indicating the category. Further, when answer data has already been registered for the same question item and category, the acquisition unit 231 replaces the answer included in the answer data with the newly input answer.

[0045] A category is information indicating the preconditions of the first entity in answering a question item (for example, the survey target for the answer, the business for the answer, the department for the answer, etc.). In other words, a category is information such as the survey target, target business, target department, etc. of the answer input by the first entity. The first entity inputs an answer to the question item regarding the survey target, etc. specified as the category.

[0046] The category may be the type of survey target (the first entity itself, the merchandise of the first entity, etc.), the type of merchandise that is the survey target handled by the first entity, the provider of the merchandise, the type of plan included in the merchandise, the business that provides the merchandise, or a combination thereof. Thereby, even for the same first entity, when the answer to the question item may differ depending on the survey target, etc., different answers can be input and registered depending on the target, and the disclosure conditions can be assigned to the first entity for each attribute of the survey target of the first entity.

[0047] <The first entity> The "first entity" includes a trading partner organization or its person in charge that provides merchandise, etc. to a second entity (for example, a viewer of the answer or a requester of the survey). The first entity is, for example, a business operator such as a service provider, a supplier, an outsourcing organization, etc. to the second entity. Note that the "trading partner organization" includes a primary trading partner organization that directly receives a transaction from the first entity, a secondary trading partner organization that receives a secondary transaction from the primary trading partner organization, etc.

[0048] In addition, the "organization" includes for-profit corporations (for example, companies, etc.), non-profit corporations (for example, cooperatives, foundations, etc.), public corporations (for example, local public entities, etc.).

[0049] The first entity that provides a service inputs an answer according to service attributes such as, for example, the type of the target service (e.g., AI (Artificial Intelligence) service, recruitment process outsourcing (RPO) service, etc.), the destination of the service (e.g., attributes of the second entity such as the organization name of the second entity), the type of plan (option) included in the service, the business name providing the service, the department name, etc. That is, the first entity that provides a plurality of services and plans inputs an answer for each of these service attributes, and the acquisition unit 231 may register answer data for each service attribute. The input answer is stored as answer data in association with the service attribute (category).

[0050] The "service" provided by the first entity includes services provided through the Internet such as SaaS, IaaS (Infrastructure as a Service), PaaS (Platform as a Service), cloud services, etc. In this case, the "first entity" includes cloud service providers, etc. Also, the "service" provided by the first entity may be a service provided to a trading partner, a customer, or the like.

[0051] The "type of service" may be read as the service name and represents the type, name, etc. of the service that the answer targets. For example, when the first entity provides service A and service B, at least one of "service A" and "service B" may be given as the type of service in the answer data. The "type of plan included in the service" is, for example, one or more types of contract plans set for the same service (e.g., service A) such as "standard plan", "premium plan", etc. A plurality of plans set for the same service differ from each other in, for example, available functions, usage period, usage fee, etc. Also, even for the same service, different types of categories may be given depending on the destination of the service, etc.

[0052] The category may be configured as a combination (hierarchical structure) of a main category and a subcategory. For example, the type of service may be set as the main category, and the service destination may be set as the subcategory.

[0053] The acquisition unit 231 acquires, for example, a response to an investigation from a first entity registered in advance as user information in the information processing system 1. The acquisition unit 231 refers to the types of services and plans provided by the first entity, visually presents them to the first entity as candidates for the "type of service" or "type of plan included in the service", and may accept a selection from among the candidates for the "type of service" or "type of plan included in the service". Further, the acquisition unit 231 may present a second entity registered in the registration information of the first entity as a candidate for the "service destination", which is a type of category. The "registered second entity" includes, for example, an organization that has provided a report or a statement regarding the first entity in the information processing system 1 in the past, an organization registered by the service provider, and the like.

[0054] In addition, the acquisition unit 231 may accept input (specification) of a plurality of categories for one response data. That is, the acquisition unit 231 may assign a plurality of categories to one response data. For example, in the case of a response common to a plurality of services, a plurality of service names are assigned to the response data as categories.

[0055] Furthermore, for response data that does not depend on a category (that is, is not classified into a specific category and does not apply to any service, plan, destination, etc.), the acquisition unit 231 may not accept input (specification) of a category. Also, the acquisition unit 231 may accept designation (input) of an "uncategorized category" for response data that does not depend on a category. For example, the acquisition unit 231 may accept designation (input) of a "common" category as the uncategorized category.

[0056] The response data includes the first entity's responses to multiple questions regarding the security of the first entity. A "question" is an item that requests a response from the first entity, and may include, for example, matters regarding the security of the first entity itself, the security of the item or service under investigation provided by the first entity, etc. Further, the "question" may include matters regarding the security of other organizations included in the first entity's supply chain. The "other organizations" include, for example, the first entity's trading partner organizations such as the organizations to which the first entity outsources its operations (including subcontractors, sub-subcontractors, sub-sub-subcontractors, etc.). The question may include a so-called security checklist.

[0057] The questions may include, for example, the status or investigation of obtaining security certifications, service levels, scope of responsibility, security measures within the first entity, handling of data regarding the second entity, handling of data managed by the first entity, confirmation of service development, maintenance, or operation policies (such as account management, etc.) (items that request a response from the first entity), etc.

[0058] "Answer data" is composed of the answers of a first entity to a plurality of questions regarding the security of the service, and is information that is the target for an evaluator to check and evaluate the content, etc. The answer data may be evaluated only once or multiple times. That is, the evaluation of the answer data may include an initial evaluation (so-called review), an intermediate evaluation, a final evaluation, etc. The initial evaluation and the intermediate evaluation are surveys in which another evaluation is performed after the evaluation. The answer data may be corrected by the first entity based on the initial evaluation or the intermediate evaluation. The multiple evaluations may be performed by the same evaluator belonging to the administrator entity or by another evaluator (so-called reviewer, etc.). In the final evaluation, an evaluation used in a report or a statement provided to a second entity is created. Also, when the answer data is corrected, updated, etc. by the first entity, it may be evaluated again by the evaluator. The evaluation result of the answer data by the evaluator is used as part of a report or a statement or as reference information.

[0059] The answer to each question item included in the answer data is the answer input by the first entity to the answer input form for each question item presented in the answer input form and registered in the answer database. The answer to one question item may be hierarchical.

[0060] Also, the acquisition unit 231 may acquire the input of an answer through an interface other than the answer input form (for example, the upload of a data file in which an answer is described by the first entity, etc.), and register this answer in the answer database as answer data.

[0061] When the acquisition unit 231 updates the representative response data specified by the first entity described later by input from the first entity, among the response data registered by the first entity, response data other than the representative response data included in the same category as the representative response data (hereinafter, "dependent response data") may be updated in accordance with the update content of the representative response data. As a result, since the representative response data for determining the index can be used as master data and the dependent response data can be automatically updated by updating the representative response data, the management of the response data of the first entity becomes easier.

[0062] "Update in accordance with the update content of the representative response data" includes, for example, in the dependent response data, replacing or updating the response to the question item that is the same as or similar to the response updated in the representative response data with the response of the representative response data.

[0063] The acquisition unit 231 is configured to acquire an evaluation from the administrator entity for the registered (created or updated) response data. The acquisition unit 231, for example, registers the surveyed response data together with the response in a response database or the like. The response at least includes an evaluation value indicating the level of security measures (few problems such as vulnerabilities).

[0064] "Evaluation" is an act of checking for deficiencies or contradictions in the response included in the response data, creating pointed-out matters (comments) for the content of the response, appraising the content of the response, scoring the response based on a predetermined standard, etc. As described above, the evaluation may be performed by a plurality of evaluators belonging to the administrator entity, or the evaluation of the registered response data may be requested from the first administrator entity to another second administrator entity. In that case, the acquisition unit 231 may acquire an investigation from the second administrator entity after the evaluation by the first administrator entity.

[0065] For example, when the evaluation is performed in two stages, in the initial evaluation (review), confirmation of deficiencies and contradictions, creation of pointed-out matters, etc. are carried out. Subsequently, for the response data after the initial evaluation, based on a predetermined standard, evaluations such as assessment and scoring of the content (response), creation of comments for the entire response data, etc. are performed as the final evaluation, and a report or statement (e.g., a security report) including the results is created. The report or statement is created by the final investigator or the evaluation unit of the control unit 23. The evaluation unit is configured to generate part or all of the report or statement based on the input response data. The response of the response data may be included in the report or statement as part or reference information of the report or statement. The report or statement is transmitted to the information processing apparatus 4 of the second entity that requested the report or statement.

[0066] The acquisition unit 231 acquires an input such as characters and sentences used in the investigation from the first entity. Note that the investigation is typically performed on response data in which answers have been given to all questions. Response data with unanswered questions (questions for which no answer has been registered) may not be the subject of the investigation, and the acquisition by the acquisition unit 231 may not be performed. Also, even for response data that includes unanswered questions (questions for which no answer has been registered), only the answered questions may be partially the subject of the investigation.

[0067] <Registration unit 232> The registration unit 232 is configured to register information acquired from an external source or an internal system in a format appropriate for the system. The registration unit 232 receives information received from a user or information acquired from an external database and stores it in the storage unit 22. The registration unit 232 registers the disclosure conditions for disclosing the response to the second entity. The disclosure conditions are conditions for determining whether to disclose the response.

[0068] <List> The disclosure conditions may include a list for determining whether to disclose an answer. The list may be, for example, a list (e.g., a blacklist) that includes entries for determining that the disclosure conditions are not met when they match the information included in the disclosure request, or a list (e.g., a whitelist) that includes entries for determining that the disclosure conditions are met when they match the information included in the disclosure request. Here, an entry is something registered in the list as an element serving as a criterion for determining whether to disclose. An entry includes terms, identification information, conditions, scores, etc. that serve as criteria for determining whether to disclose. The list may be a list that includes evaluation criteria for evaluating the information included in the disclosure request or a list for making judgments regarding future transactions and disclosures based on feedback obtained as actual results used in the past. Also, the registration unit 232 may register a list for each first entity or for each commodity (e.g., service) provided by the first entity.

[0069] A list that includes entries for determining that the disclosure conditions are not met is, for example, a list that includes entries regarding past illegal acts or entries regarding legal disclosure restrictions. For example, the registration unit 232 may register terms related to the industry type associated with the first entity as entries. In such a manner, the control unit 23 can determine not to disclose to a competing company of the first entity. Also, the registration unit 232 may register information regarding the source domain and email address of past nuisance emails of the first entity as an entry. Also, the registration unit 232 may register information such as company names, email addresses, names, and department names that restrict disclosure as entries, for example.

[0070] A list for determining that the disclosure conditions are not met may include, for example, the name of an organization that may disclose an answer or the identification information of a second entity to which the first entity has permitted disclosure in the past as an entry.

[0071] When the first entity provides a plurality of services, different disclosure conditions may be set for each of the plurality of services. That is, the registration unit 232 can register the disclosure conditions received from the first entity for each investigation target regarding the first entity. When disclosure conditions are set for each investigation target, the determination unit 234 determines whether the disclosure conditions are satisfied for each investigation target.

[0072] The control unit 23 can limit the first entity for which the registration unit 232 can set disclosure conditions. The registration unit 232 accepts the disclosure conditions when the first entity meets a predetermined criterion. For example, the control unit 23 may enable the first entity that meets a predetermined criterion to set disclosure conditions. When there is a disclosure request from the second entity, setting disclosure conditions and being automatically disclosed when the disclosure conditions are satisfied is highly beneficial to the first entity. Thus, in such a manner, the first entity can be urged to meet a predetermined criterion.

[0073] The predetermined criterion may be determined based on information regarding the first entity. For example, it is based on at least one of the update status of the response by the first entity, the security compliance of the first entity, or the reliability score of the first entity. For example, the predetermined criterion may be whether the operator has updated the master data within a predetermined period, whether the scoring is above a certain level, whether the operator has obtained badge authentication, etc. The update status of the response by the first entity includes, for example, the frequency of response updates and the elapsed time after the response update. Also, the update status of the response may include the sufficiency of the response content. The criteria regarding the response update deadline and sufficiency may be arbitrarily set by the first entity.

[0074] The security compliance of the first entity is a concept indicating whether the services provided by the first entity meet certain security standards and requirements. For example, specifically, it evaluates whether the services or the organization providing the services have taken measures against external risks and threats, and whether the organizations and individuals using the services or conducting transactions with the organization can use them safely. For example, security compliance includes information about the risks to which the service provider is exposed and the measures taken against them (e.g., data leakage prevention, service disruption countermeasures). When the service is a cloud service, security compliance includes information about the risks related to internal systems and infrastructure, and the connection parts to the outside (APIs and networks), as well as the vulnerability countermeasures and security policies against those risks. Security compliance may be indicated by scoring. Scoring is an evaluation value (security score) indicating the level of security measures (the number of problems in security measures, more or fewer). Scoring numerically represents the security state of the service or system, and may also numerically represent the vulnerability of the system and the ability to respond to incidents. For example, the control unit 23 receives an evaluation of the response data from the administrator entity, and registers the evaluated response data together with the evaluation result in a response database or the like.

[0075] The reliability score of the first entity is an indicator that numerically represents the reliability of the first entity or the services provided by the first entity according to numerical values or evaluation criteria. The control unit 23 may evaluate the reliability based on, for example, past transaction histories, or may evaluate the reliability based on credit information, financial status, etc. provided by external institutions. Further, the control unit 23 may evaluate the reliability using, as indicators, the acquisition status of domestic and foreign certification systems and the evaluations of external credit investigation companies.

[0076] The registration unit 232 can register the disclosure conditions including information regarding the update status of the response. By including information regarding the update status in the disclosure conditions, the determination unit 234 can make a determination based on the information regarding the update status. In such a manner, it is possible to prevent the response for which time has elapsed since the update from being automatically disclosed.

[0077] <Reception unit 233> The reception unit 233 is configured to be able to receive information from the information processing device 3 or the information processing device 4 or other devices. Further, the reception unit 233 is configured to be able to receive various information by reading out various information stored in the storage area which is at least a part of the storage unit 22 and writing the read-out information into the work area which is at least a part of the storage unit 22. The storage area is, for example, an area implemented as a storage device such as an SSD in the storage unit 22. The work area is, for example, an area implemented as a memory such as a RAM. As a first reception step, the reception unit 233 receives a disclosure request for requesting the disclosure of a response from a second entity.

[0078] <Disclosure request> The disclosure request is for requesting the disclosure of a response from a second entity. The disclosure request may be for requesting a response including an evaluation result. The disclosure request includes information regarding the second entity, the reason (request background) for requesting the disclosure of the response, and the like. FIG. 5 is a diagram showing a request form F which is an example of a request form for receiving a disclosure request. The request form F includes an area F1, areas F2 to F9, and an object F10. The area F1 is an area for displaying information indicating that it is a disclosure request.

[0079] Regions F2 to F6 are examples of information regarding the second entity. Region F2 is a region for receiving the organization name of the second entity. Region F3 is a region for receiving information about the organization such as the department name of the second entity. Region F4 is a region for receiving information about the organization of the second entity, and may include information about the website of the organization related to the second entity. Region F5 is a region for receiving information about the person in charge of the organization related to the second entity. Region F6 is a region for receiving information about the contact details (such as email address) of the person in charge of the organization related to the second entity. The organization name of the second entity, the contact details of the person in charge, etc. can be used as identification information of the second entity.

[0080] Region F7 is a region for receiving information about the background for which the second entity requests disclosure. The background for requesting disclosure of the answer includes, for example, an explanation of the reason for the request, the purpose of using the service of the first entity, and information indicating that the service of the first entity is about to be introduced. The information about the background for the request may be selected from the presented options, or free-form text may be received from the second entity. The information about the background for the request may also accept the upload of materials that can clarify the background for the request.

[0081] Area F8 is an area for receiving the name of the person in charge at the window of the first entity. The first entity may be, for example, a vendor of the merchandise to be investigated. Area F9 is an area for receiving the contact information of the person in charge at the window of the first entity. The information about the first entity entered in Area F8 and Area F9 can be used as information indicating that the second entity is considering introducing a service. Object F10 is an object for receiving the confirmation of the input to the request form. When the operation acquisition unit 432 receives the input to the request form F by the second entity and the pressing on the object F10, the input information is transmitted to the control unit 23. The reception unit 233 receives the input to the request form F received by the operation acquisition unit 432 as a disclosure request.

[0082] The information indicating that the second entity is trying to introduce the service of the first entity may be, in addition to the name of the person in charge of the vendor providing the service to the second entity and the contact information of the person in charge of the vendor shown in Area F8 and Area F9, materials indicating that the introduction is being considered, etc. As the first reception step, the reception unit 233 receives, as a disclosure request, materials indicating that the second entity is considering introducing the investigation target regarding the first entity. The reception unit 233 may receive, as materials indicating that the second entity is considering the introduction and use of the service of the first entity, a quotation from the first entity to the second entity. Here, the materials indicating that the introduction is being considered may be the answer to the security-related investigation by the first entity and a quotation from a different first entity to the second entity. That is, the answer to the security-related investigation may be made by the service provider, and the estimator may be submitted to the second entity from the vendor.

[0083] <Judgment unit 234> The determination unit 234 is configured to be able to determine whether various types of information and data meet predetermined criteria and conditions. The determination unit 234 determines whether the disclosure conditions are met based on the information included in the disclosure request.

[0084] The determination unit 234 compares the information included in the disclosure request with the registered disclosure conditions to determine whether the disclosure conditions are met. The determination unit 234 analyzes the information included in the disclosure request, extracts elements for comparison with the disclosure conditions from the content of the disclosure request, and compares and determines the extracted elements with the disclosure conditions. For example, when the disclosure conditions include information on an organization name not to be disclosed, the determination unit 234 extracts information related to the organization name from the disclosure request, compares it with the disclosure conditions, and makes a determination. Also, when the disclosure conditions include information on an industry type not to be disclosed, the determination unit 234 extracts information related to the industry type from the disclosure request, compares it with the disclosure conditions, and makes a determination.

[0085] In addition, the determination unit 234 can analyze the collected public information to determine whether the disclosure conditions are met. The determination unit 234 may make a determination as to whether the disclosure conditions are met not only based on the information included in the disclosure request but also based on the information that can be collected based on the information included in the disclosure request.

[0086] Here, the public information is information publicly available on a website or the like accessible via the Internet. The types of websites or the like for obtaining the public information of the second entity are not limited as long as they include at least information related to the second entity, and include official websites, unofficial websites, and other websites. Also, websites or the like include, in addition to websites, social networking services, online databases, open data formats (CSV and JSON), PDF files of academic papers, geographic information system (GIS) data, data provided by APIs, and the like. The public information includes not only information in a form directly displayed on a website but also information accessible via a specific platform or service (for example, a database or a repository).

[0087] The official website is a website opened by the organization itself related to the second entity. For example, it includes corporate websites, IR websites, product websites (product or service websites), brand websites, promotion websites, owned media websites, campaign websites, e-commerce websites, member-only websites, recruitment websites, landing pages, etc. The unofficial website is a website opened by an organization different from the organization related to the second entity (external institution). For example, it includes industry information introduction websites, news websites, economic information providing websites, commercial database websites, etc. The unofficial website includes both free viewing pages and paid viewing pages. The public information of the second entity may include, for example, the type of service provided (service category), the number of service users, the founding year, etc.

[0088] The determination unit 234 may compare the information included in the disclosure request (for example, the organization name) and the information estimated from the information collected based on the information included in the disclosure request (for example, the URL of the organization's website) with the disclosure conditions, and determine whether the disclosure conditions are satisfied. For example, the determination unit 234 estimates the industry type of the second entity from the information included in the disclosure request, compares it with a blacklist including entries related to the industry type, and determines whether it is the industry type included in the blacklist. That is, the list includes entries related to industry types that are determined not to satisfy the disclosure conditions when they match the information included in the disclosure request. The determination unit 234 compares the estimated industry type of the second entity with the list and determines whether the disclosure conditions are satisfied. In such a manner, the determination unit 234 can be made to determine not to disclose to the second entity in the same industry as the first entity providing the service.

[0089] Based on the information indicating that the second entity is attempting to introduce the service of the first entity, the determination unit 234 can determine whether the disclosure conditions are met. For example, the determination unit 234 may analyze the information of the vendor's person in charge included in the disclosure request and the information of the estimate for service introduction attached as supporting documents to determine whether the disclosure conditions are met.

[0090] The determination unit 234 may also determine whether the disclosure conditions are met based on the text information included in the disclosure request. For example, when only a predetermined character string such as "test" is input in the area for receiving the text information, or when it is considered an unintended disclosure request or when it is not possible to obtain the information of the second entity, the determination unit 234 may determine that it is not a valid request and that the disclosure conditions are not met. Also, when the organization name, person in charge name, or email address does not exist, the determination unit 234 may determine that the disclosure conditions are not met.

[0091] The determination unit 234 may determine whether or not the disclosure conditions are satisfied using a disclosure approval determination model. The disclosure approval determination model may be a learning model (machine learning or fine-tuning) that is trained to take as input the information included in the disclosure request and the disclosure conditions and output a determination as to whether or not the disclosure conditions are satisfied. For example, the disclosure approval determination model may be a learning model that is trained using, as teacher data, the information included in the disclosure request, the publicly available information, the disclosure conditions, and a determination as to whether or not the corresponding disclosure conditions are satisfied. The determination unit 234 inputs the information included in the disclosure request, the publicly available information, and the disclosure conditions into the disclosure approval determination model of the artificial intelligence unit 242 and causes the model to output a determination as to whether or not the disclosure conditions are satisfied. Also, the disclosure approval determination model may be a generative AI including a large language model. In this case, the determination unit 234 inputs into the disclosure approval determination model an instruction to determine disclosure approval based on the information included in the disclosure request and a prompt in which the information included in the disclosure request and the disclosure conditions are inserted, and causes the disclosure approval determination model to output the disclosure approval. Also, the determination unit 234 acquires publicly available information based on the information included in the disclosure request, inputs into the disclosure approval determination model an instruction to determine disclosure approval based on the information included in the disclosure request, the publicly available information, and the disclosure conditions, and a prompt in which the information included in the disclosure request and the disclosure conditions are inserted, and causes the disclosure approval determination model to output the disclosure approval.

[0092] The determination unit 234 may be configured to make a determination based on the disclosure conditions when the first entity satisfies a predetermined criterion. Only when the first entity satisfies the predetermined criterion is it the subject of automatic approval, and when the first entity does not satisfy the predetermined criterion, the transmission unit 240 transmits a permission request asking the first entity for permission to disclose an answer.

[0093] <Output unit 235> The output unit 235 is configured to be able to output various kinds of information and data to the information processing device 3 or the information processing device 4. The output unit 235 is configured to be able to output various data and information in various formats. As a first output step, when the disclosure conditions are satisfied, the output unit 235 outputs the answer to the second entity. As a first output step, when the permission from the first entity is received, the output unit 235 outputs the answer to the second entity. Even when it is determined that the disclosure conditions are not satisfied, if the permission from the first entity is received, the output unit 235 outputs the answer to the second entity as a first output step.

[0094] As a second output step, the output unit 235 outputs the history information to the first entity or the administrator entity. The output of such history information may be called a footprint function.

[0095] <Collection unit 236> The collection unit 236 is configured to be able to collect necessary information from external data sources and systems. The collection unit 236 can efficiently collect relevant data by using databases and online sources on the Internet. The collection unit 236 collects public information about the second entity using the identification information of the second entity via the network.

[0096] <Estimation unit 237> The estimation unit 237 is configured to be able to estimate information about the second entity based on various types of information and data. For example, the estimation unit 237 analyzes the information included in the disclosure request and the publicly available information to estimate the industry type of the second entity. The estimation unit 237 may estimate the industry type of the second entity using an industry type estimation model. The industry type estimation model may be a learning model (machine learning or fine-tuning) that is learned to take the information included in the disclosure request and the publicly available information as inputs and output the industry type of the second entity. For example, the industry type estimation model is a learning model that is learned using the information included in the disclosure request and the publicly available information and the corresponding industry type of the second entity as teacher data. The estimation unit 237 inputs the information included in the disclosure request and the publicly available information into the industry type estimation model of the artificial intelligence unit 242 to output the industry type of the second entity. Also, the industry type estimation model may be a generative AI including a large language model. In this case, the estimation unit 237 inputs a prompt in which an instruction to estimate the industry type based on the information included in the disclosure request and the information included in the disclosure request are inserted into the industry type estimation model to output the industry type to the industry type estimation model. Also, the estimation unit 237 acquires publicly available information based on the information included in the disclosure request, inputs a prompt in which an instruction to estimate the industry type based on the information included in the disclosure request and the publicly available information and the information included in the disclosure request are inserted into the industry type estimation model to output the industry type to the industry type estimation model. The estimation unit 237 may generate a prompt for giving an instruction to estimate the industry type to the industry type estimation model and input the prompt into the industry type estimation model.

[0097] <Management unit 238> The management unit 238 can record and store various types of information and data in association with each other. As a first management step, the management unit 238 records the answer and the information regarding the update status of the answer in association with each other.

[0098] As a second management step, the management unit 238 records history information including a request history regarding a disclosure request for a second entity or an output history regarding an output of a response to the second entity. The history information includes identification information of the second entity and information regarding the date and time of the disclosure request or the output of the response. The request history regarding the disclosure request and the output history regarding the output of the response may both include the number of requests and the number of outputs.

[0099] <Display control unit 239> The display control unit 239 controls to display visual information such as a screen, an image including a still image or a moving image, an icon, and a message (text) on the display unit 34. The control unit 23 may generate only rendering information for displaying visual information on the display unit 34 and transmit this to the information processing device 3, thereby causing the information processing device 3 to generate visual information and controlling the display unit 34 to display the visual information. Also, the display unit 34 may generate visual information and transmit this to the information processing device 3, thereby controlling the display unit 34 to display the visual information. The display control unit 239 executes processing for displaying a system screen regarding the information processing system 1 on each terminal. The display control unit 239 performs processing such as generating and transmitting an HTML (Hyper Text Markup Language) file, for example, to display a web page showing the system screen on the display unit 34. Note that the display control unit 239 may perform processing such as generating and transmitting display data for an application for using the information processing system 1. For example, the display control unit 239 can display various visual information on the display unit 34.

[0100] The display control unit 239 is configured to display various information on the information processing device 3 and the information processing device 4. For example, the display control unit 239 displays a disclosure request form, a service search screen, a response, etc. on the display unit 331 of the information processing device 3 and the display unit 431 of the information processing device 4. The display control unit 239 can display a response to the second entity.

[0101] The display control unit 239 causes a screen related to the investigation target regarding the first entity to be displayed to the second entity. On the screen, a first object and a second object are displayed in association with the investigation target. The first object is configured to be able to receive an investigation request regarding the security of the investigation target, and the second object is configured to be able to receive a disclosure request.

[0102] <Transmission unit 240> The transmission unit 240 is configured to be able to transmit the generated information and data to a specified destination. When the transmission unit 240 receives an investigation request from the second entity, it transmits a permission request for the investigation request to the first entity corresponding to the investigation target. When the control unit 23 receives a disclosure request from the second entity, according to a predetermined criterion, the transmission unit 240 can transmit a permission request for requesting permission for disclosure of the answer to the first entity.

[0103] When it is determined in the determination unit 234 that the disclosure conditions are not satisfied based on the disclosure request, the transmission unit 240 transmits a permission request for disclosure of the answer to the first entity.

[0104] <Notification unit 241> When there is a new disclosure request or output of an answer, the notification unit 241 notifies the first entity or the administrator entity of the history information.

[0105] <Artificial intelligence unit 242> The artificial intelligence unit 242 is configured to receive an input from each functional unit and return an instructed output. Note that the artificial intelligence used by the server 2 in each functional unit may be common or may be prepared individually for each functional unit.

[0106] The artificial intelligence unit 242 may be an external component of server 2. In that case, the artificial intelligence unit 242, which is an external component, may be provided by, for example, an artificial intelligence service server, receive inputs from each functional unit of server 2, receive requests to execute artificial intelligence services, and be configured to return the output indicated as the processing result to server 2. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that executes language processing tasks using a language model. The artificial intelligence service server may be constructed by an LLM. The artificial intelligence service server may receive inputs of prompts by text, images, voices, etc., and generate and respond with answers to the prompts.

[0107] The artificial intelligence unit 242 is an AI (Artificial Intelligence) equipped with a learning model such as a language model of a Transformer (including GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), BART (Bidirectional and Auto-regressive Transformer), etc.) or a Recurrent Neural Network (RNN), and may include a generative AI including a large language model. The large language model is a type of generative AI and includes models provided by services such as GPT of OpenAI, Gemini of Google, and Azure AI Studio of Microsoft. In addition, the artificial intelligence unit 242 can include any machine learning model, deep learning model, artificial intelligence model, etc.

[0108] A language model is an example of a learning model by a machine learning algorithm. Specific algorithms for machine learning include the nearest neighbor method, the naive Bayes method, decision trees, support vector machines, deep learning (deep neural networks) using neural networks, etc. The artificial intelligence unit 242 can appropriately apply the above algorithms.

[0109] The artificial intelligence unit 242 may have a trained model constructed by a learning method such as supervised learning, unsupervised learning, or semi-supervised learning. In supervised learning, machine learning is performed using teacher data (learning data). The teacher data is composed of a pair of input data for learning and output data (correct data). Also, the language model may be not only trained for a specific task but also a general-purpose model that can be generally used for a wide range of tasks.

[0110] The artificial intelligence unit 242 may be a general-purpose natural language processing learning model such as a large language model (LLM) that has learned a vast amount of data as artificial intelligence. The LLM is a learning model that has previously learned a large amount of data (e.g., (i) web content on the Internet or (ii) data stored in a predetermined database) composed of text data, etc., and can execute various language processing tasks by being given a task, and can perform a wide range of natural language processing tasks such as grasping the pattern and context of a sentence, answering questions, and generating sentences according to the given prompt. Such a general-purpose learning model includes a language model that can handle various tasks without fine-tuning by One-shot Learning, Few-shot Learning, etc. Also, the general-purpose learning model may be configured to be able to handle various tasks by Zero-shot Learning. The artificial intelligence used in each functional unit of the control unit 23 may be separate learning models or a common general-purpose learning model.

[0111] The learning models included in the artificial intelligence unit 242 (such as the representative answer data creation model and the learning models used in each functional unit) can perform additional learning as transfer learning or fine-tuning. For example, each time new data registration or the like occurs, the artificial intelligence unit 242 may use these as new teacher data to perform additional learning for fine-tuning. Thereby, the accuracy of the information output from the learning model is improved.

[0112] The learning model included in the artificial intelligence unit 242 may be a learning model (distillation model) obtained by knowledge distillation using the original learning model. In knowledge distillation, a pre-trained model such as a large language model is used as the teacher model, and the parameters of the student model (distillation model) are adjusted so that the loss (Soft Target Loss) of the output of the student model with respect to the output (Soft Target) of the teacher model is reduced, thereby learning the student model, and the student model becomes the distillation model. Also, the learning of the student model may be performed so that the loss (Hard Target Loss) of the output of the student model with respect to the correct label (Hard Target) of the teacher data (the combination of the input data and output data of the learning model) is reduced. The distillation model has performance similar to that of the original learning model (teacher model), but has fewer parameters and a smaller processing load. Therefore, by using the distillation model, the cost of the information processing system 1 can be reduced.

[0113] For example, the learning model used in each functional unit may be a distillation model learned using the combination of input data and output data in a large language model as teacher data. Also, when the information processing system 1 is introduced, a large language model is used as the learning model used in each functional unit, and when teacher data by the large language model is accumulated, the distillation model obtained by knowledge distillation using the teacher data may be used as the learning model used in each functional unit.

[0114] <Display unit> The display unit 331 of the information processing apparatus 3, the display unit 431 of the information processing apparatus 4, and the display unit 531 of the information processing apparatus 5 each display the screen indicated by the screen data transmitted from the server 2.

[0115] <Operation acquisition unit> The operation acquisition unit 332 of the information processing apparatus 3 receives an operation by a first entity that uses the information processing apparatus 3. The operation acquisition unit 432 of the information processing apparatus 4 receives an operation by a second entity that uses the information processing apparatus 4. The operation acquisition unit 532 of the information processing apparatus 5 receives an operation by an administrator entity that uses the information processing apparatus 5.

[0116] 3. Information processing flow In this section, the flow of the information processing method executed by the information processing system 1 will be described. As shown below, the information processing method includes each step executed by the information processing system. The program of the present embodiment causes a computer to execute each step of the information processing system. Note that the order of the processes can be appropriately changed, a plurality of processes can be executed simultaneously, or some processes can be omitted.

[0117] 3.1 Overview

[0118] Conventionally, when the control unit 23 receives a request regarding the disclosure of an answer from a second entity, the control unit 23 requests the first entity for permission to disclose, and when the first entity promises to disclose the answer to the second entity, the answer was disclosed to the second entity. However, in such a mode, there has been a problem that it takes time until the answer is disclosed to the second entity that transmitted the disclosure request.

[0119] FIG. 6 is a diagram showing an outline of the processing executed by the information processing system 1. In such processing, first, the acquisition unit 231 acquires an answer to an investigation regarding security by the first entity (step S001). Subsequently, the registration unit 232 registers disclosure conditions for disclosing the answer to the second entity (step S002). Subsequently, the reception unit 233 receives, as a first reception step, a disclosure request for requesting disclosure of the answer from the second entity (step S003). Subsequently, the determination unit 234 determines whether or not the disclosure conditions are satisfied based on the information included in the disclosure request (step S004). Subsequently, the output unit 235 outputs, as a first output step, the answer to the second entity when the disclosure conditions are satisfied (step S005).

[0120] Summarizing the above, an information processing system according to an embodiment includes at least one processor. The processor includes the following components by reading a program. An acquisition unit 231 acquires an answer to an investigation regarding security by a first entity. A registration unit 232 registers disclosure conditions for disclosing the answer to a second entity. A reception unit 233 receives, as a first reception step, a disclosure request for requesting disclosure of the answer from the second entity. A determination unit 234 determines whether the disclosure conditions are satisfied based on the information included in the disclosure request. An output unit 235 outputs, as a first output step, the answer to the second entity when the disclosure conditions are satisfied. When it is determined that the disclosure conditions are satisfied based on the information included in the disclosure request, the output unit 235 can output the answer to the second entity without obtaining permission from the first entity each time. In such a manner, it is possible to provide a more beneficial information processing system or the like regarding disclosure of an answer to an investigation regarding security. Thereby, for the first entity, when a disclosure request is received, the trouble of obtaining permission each time can be saved. Also, for the second entity, the lead time from when the disclosure request is made until the answer is output is shortened. Further, a determination is made based on the set disclosure conditions, and by not disclosing the answer to the second entity that does not satisfy the disclosure conditions, the sense of security of the first entity can be ensured.

[0121] 3.2 Specific Example Hereinafter, an example of the processing flow executed by the information processing system 1 will be described with reference to FIGS. 7 to 9. The example of the flow may be included within the scope defined in the above-mentioned overview. Note that the information processing may include any exception processing not shown. The exception processing includes interruption of the information processing and omission of each process. The selection or input performed in the information processing may be based on an operation by the user or may be automatically performed without depending on the user's operation.

[0122] The first embodiment shows an example of the information processing flow when a request form issued by an administrator entity is posted on a web page such as a service site of a first entity. The first embodiment enables requests from users other than evaluation service users, and may be called a response sharing function. The second embodiment shows an example of the information processing flow when an evaluation service user receives a disclosure request in the process of subscribing to the evaluation service provided by the information processing system 1.

[0123] <First Embodiment> FIG. 7 is an activity diagram showing an example of the information processing flow of the first embodiment executed by the information processing system 1. Hereinafter, the description will be made along each activity of this activity diagram.

[0124] First, the acquisition unit 231 acquires the response to the security-related investigation by the first entity (activity A101).

[0125] Subsequently, it is determined whether the first entity meets a predetermined criterion (activity A102). Here, the predetermined criterion is based on at least one of the update status of the response by the first entity, the security compliance of the first entity, or the reliability score of the first entity. If the first entity meets the predetermined criterion, the process proceeds to activity A103. If the first entity does not meet the predetermined criterion, the process proceeds to activity A108.

[0126] Subsequently, when the first entity meets the predetermined criterion, the registration unit 232 accepts the disclosure condition (activity A103). Subsequently, the registration unit 232 registers the disclosure condition (for example, the condition for automatically approving the disclosure of the response (automatic approval condition)) for disclosing the response to the second entity.

[0127] The registration unit 232 may accept a list as a disclosure condition. The list is a list including entries that are determined not to satisfy the disclosure condition when they match the information included in the disclosure request, or a list including entries that are determined to satisfy the disclosure condition when they match the information included in the disclosure request.

[0128] Subsequently, as a first reception step, the reception unit 233 receives a disclosure request for requesting disclosure of an answer from a second entity (activity A104). The disclosure request includes identification information of the second entity. For example, the reception unit 233 causes the display unit 431 to display a request form F, and the operation acquisition unit 432 receives an input to the request form F by the second entity. The reception unit 233 receives the input to the request form F received by the operation acquisition unit 432.

[0129] Subsequently, the collection unit 236 collects public information regarding the second entity using the identification information of the second entity via a network (activity A105).

[0130] Subsequently, the control unit 23 analyzes the disclosure request and the public information (activity A106). For example, the estimation unit 237 can analyze the information included in the disclosure request and the public information to estimate the industry type of the second entity. Here, only the information included in the disclosure request may be analyzed.

[0131] Subsequently, the determination unit 234 determines whether to satisfy a disclosure condition (for example, an automatic approval condition) based on the information included in the disclosure request (activity A107). When the public information is collected, the determination unit 234 may analyze the collected public information and determine whether to satisfy the disclosure condition. The determination unit 234 may compare the information included in the disclosure request with the list and determine whether to satisfy the disclosure condition.

[0132] For example, the list includes entries related to industries that are determined not to meet the disclosure conditions when they match the information included in the disclosure request. Further, the estimation unit 237 analyzes the information included in the disclosure request and the publicly available information to estimate the industry of the second entity. The determination unit 234 may compare the estimated industry of the second entity with the list to determine whether the disclosure conditions are met.

[0133] In activity A107, when the determination unit 234 determines, based on the disclosure request, that the disclosure conditions are not met, the transmission unit 240 may transmit a request for permission to disclose the answer to the first entity (activity A109).

[0134] Subsequently, the reception unit 233 receives the permission from the first entity (activity A110).

[0135] In activity A107, when the determination unit 234 determines, based on the disclosure request, that the disclosure conditions are met, subsequently, the reception unit 233 receives the user registration of the second entity (activity A111).

[0136] Subsequently, as a first output step, the output unit 235 outputs an answer to the second entity (activity A112). The output unit 235 may display a download link for the answer to the second entity. The second entity can download the answer by performing an operation instruction on the download link. Further, the output unit 235 may display the answer to the second entity. Additionally, the output unit 235 may transmit a file containing the answer data and the download link to the second entity by email.

[0137] In addition to the answer to the security investigation by the first entity obtained in the acquisition step, the output unit 235 may output an evaluation of the answer, the category attached to the answer, and the like.

[0138] When the output unit 235 outputs a response to the second entity as the first output step, the ticket previously assigned to the first entity may be consumed. That is, when the reception unit 233 receives a disclosure request from a request form posted on a web page such as a service site of the first entity, and the output unit 235 outputs a response to the second entity, the ticket previously assigned to the first entity is consumed. For example, the control unit 23 assigns a ticket to the first entity in advance. The control unit 23 manages the tickets assigned to the first entity in the management unit, and the output unit 235 checks the tickets held by the first entity when outputting a response and consumes a predetermined number of tickets for one output. The consumption of the ticket is performed at the timing when the output process is normally completed. After the ticket is consumed, the remaining number of tickets of the first entity decreases, and the information is updated on the database.

[0139] Subsequently, as the second management step, the management unit 238 records history information including a request history regarding a disclosure request by the second entity or an output history regarding the output of a response to the second entity. The history information includes identification information of the second entity and information regarding the date and time of the disclosure request or the output of the response (Activity A113).

[0140] Subsequently, the output unit 235 outputs the history information to the first entity or the administrator entity as the second output step (Activity A114). For example, the display control unit 239 may display the history information to the first entity or the administrator entity. Further, the output unit 235 may output the log data of the history information and store it in the storage unit 22. Further, the output unit 235 may output a report regarding the history information to the first entity or the administrator entity. Thereby, while reducing the trouble of the first entity to permit / approve each time a disclosure request is made, the first entity or the administrator entity can grasp from which entity the request was made, etc.

[0141] Here, in activity A114, when there is an output of a new disclosure request or response, the notification unit 241 may notify the first entity or the administrator entity of the history information. In such a manner, the first entity or the administrator entity can grasp from which second entity and when there has been an output of a disclosure request or response. By the notification unit 241 notifying the first entity or the administrator entity at the timing when there is an output of a new disclosure request or response, the first entity or the administrator entity can grasp the history information in a timely manner.

[0142] In addition, in activity A102, when the first entity does not meet a predetermined criterion, subsequently, the reception unit 233 receives, as a first reception step, a disclosure request for requesting disclosure of a response from the second entity (activity A108). Subsequently, when it is determined in the determination unit 234 that the disclosure conditions are not met based on the disclosure request, the transmission unit 240 transmits a request for permission to disclose the response to the first entity (activity A109). In other words, the determination unit 234 makes a determination based on the disclosure conditions when the first entity meets the predetermined criterion. When the first entity does not meet the predetermined criterion, a request for permission to disclose the response is transmitted to the first entity to seek permission to disclose the response. The output unit 235 outputs the response to the second entity as a first output step when it is determined that the disclosure conditions are met or when permission from the first entity is received.

[0143] In the above embodiment, it is described that in activity A107, the determination unit 234 determines that the disclosure conditions are not met, and in activity A108, the transmission unit 240 transmits a request for permission to disclose the response to the first entity. However, when the determination unit 234 determines that the disclosure conditions are not met in activity A107, the transmission unit 240 may transmit to the first entity that the response will not be disclosed.

[0144] <Second Embodiment> FIG. 8 is an activity diagram showing another example of the flow of information processing according to the second embodiment executed by the information processing system 1. Hereinafter, the description will be made along each activity of this activity diagram. The second embodiment shows an example of the flow of information processing when the evaluation service user receives a disclosure request on the lead wire of the evaluation service provided by the information processing system 1. That is, in the second embodiment, the second entity is the evaluation service user.

[0145] First, the acquisition unit 231 acquires the response to the security-related investigation by the first entity (activity A201).

[0146] Subsequently, the management unit 238 records, as the first management step, the response and the information related to the update status of the response in association with each other (activity A202).

[0147] Subsequently, the registration unit 232 registers the disclosure conditions including the information related to the update status of the response (activity A203). The disclosure conditions including the information related to the update status may be, for example, automatically disclosed within a predetermined period after the response is updated, but after a predetermined period has elapsed since the update, the fact that the predetermined period has elapsed is displayed to the second entity, and disclosure is made after obtaining approval.

[0148] Subsequently, the reception unit 233 receives the login of the second entity (activity A204). The reception unit 233 receives the identification information of the second entity, collates it with the user information registered in the information processing system 1, and determines whether the login is possible. When it is determined that the login is possible, the second entity can log in to the information processing system 1.

[0149] Subsequently, the display control unit 239 displays a screen related to the investigation target regarding the first entity to the second entity (activity A205).

[0150] Here, on the screen, a first object and a second object are displayed in association with the object to be investigated. The first object is configured to be able to receive an investigation request regarding the security of the object to be investigated, and the second object is configured to be able to receive a disclosure request.

[0151] Subsequently, as a first reception step, the reception unit 233 receives a disclosure request for requesting disclosure of an answer from a second entity (activity A206).

[0152] Subsequently, the determination unit 234 determines whether or not the disclosure conditions are satisfied based on the information included in the disclosure request (activity A207). If it is determined that the disclosure conditions are satisfied, the control unit 23 proceeds to the process of activity A210. If it is determined that the disclosure conditions are not satisfied regarding that a predetermined period has not elapsed since the update of the answer among the disclosure conditions, the control unit 23 proceeds to the process of activity A208.

[0153] Note that in activity A207, if the information included in the disclosure request of the second entity does not satisfy the disclosure conditions (for example, if it is an organization listed in the blacklist), instead of proceeding to activity A208, the control unit 23 may display a message indicating that the answer cannot be disclosed without displaying an alert and end the process.

[0154] Subsequently, if the determination unit 234 determines that the answer has not been updated within a predetermined period, the display control unit 239 displays an alert to the second entity (activity A208).

[0155] Subsequently, the reception unit 233 receives confirmation of the alert from the second entity (activity A209). In such a manner, the second entity can view the answer after confirming that time has elapsed since the update.

[0156] Subsequently, the output unit 235 outputs the answer to the second entity (Activity A210). As a first output step, when the output unit 235 outputs the answer to the second entity, the ticket previously assigned to the second entity is consumed. That is, when the reception unit 233 receives a disclosure request from the evaluation service user on the lead of the evaluation service provided by the information processing system 1, the ticket previously assigned to the second entity is consumed. For example, the control unit 23 assigns a ticket to the second entity in advance. The control unit 23 manages the ticket assigned to the second entity in the management unit. When outputting the answer, the output unit 235 checks the ticket held by the first entity and consumes a predetermined ticket for one output. The consumption of the ticket is performed at the timing when the output process is completed normally. After the ticket is consumed, the remaining number of tickets of the first entity decreases, and the information is updated on the database.

[0157] In the above embodiment, in Activity A207, the determination unit 234 determines whether the information regarding the update status of the answer satisfies the disclosure condition, but disclosure conditions other than the information regarding the update status of the answer may be set. In that case, including the disclosure conditions other than the information regarding the update status of the answer, when it is determined that the disclosure conditions are satisfied, the control unit 23 proceeds to the process of Activity A210. When it is determined that the disclosure conditions other than the information regarding the update status of the answer are satisfied, but the disclosure conditions regarding the information regarding the update status of the answer are not satisfied, the control unit 23 proceeds to the process of Activity A208.

[0158] In the above embodiment, in Activity A208, when a predetermined period has elapsed since the update of the answer, an alert is displayed to the second entity. However, the notification unit 241 may notify an alert informing the first entity that there is a disclosure request for an answer for which a predetermined period has elapsed. The first entity can determine whether to disclose the answer as it is after checking the alert. When the first entity determines that it is better to update the answer, it can update the answer and then grant permission for disclosure. In such a manner, the first entity can be prompted to update the answer.

[0159] FIG. 9 is a diagram showing a screen G1 which is an example of a screen for receiving an investigation request. In the activity A205, the display control unit 239 may display information regarding the update status of the answer together with an object for receiving a disclosure request, as in the screen G1. The screen G1 includes a region G11, a region G12, a region G13, a region G14, a region G15, a region G16, an object G17, a region G18, an object G19, and a region G20. The region G11 is a region for receiving input of search conditions. The region G12 is a region for receiving an instruction to perform a search with the search conditions input in the region G11. The regions G13 to G16 are regions for displaying information regarding services that match the search conditions. The information regarding the service is, for example, the service name. The object G17 is an object for receiving an investigation request. When the operation acquisition unit 432 acquires an operation instruction for the object G17, the display control unit 239 may cause the display unit 431 to display an input form for the investigation request. The reception unit 233 may receive an investigation request via the input form for the investigation request. The region G18 is a region for displaying the predicted delivery date from when the investigation request is received until the answer is disclosed. In the case of service A, it is displayed in the region G18 that the predicted delivery date is about one week. The object G19 is an object for receiving a disclosure request for the answer. When the operation acquisition unit 432 acquires an operation instruction for the object G19, the display control unit 239 may cause the display unit 431 to display an input form for the disclosure request. The reception unit 233 may receive a disclosure request via the input form for the disclosure request. The display control unit 239 may cause the object G19 to display "View now". In such a manner, it is possible to convey to the second entity that it can be "Viewed now". The region G20 is a region for displaying the update timing of the disclosed answer when the disclosure of the answer is received by the object G19. In the case of service A, it is displayed in the region G20 that the update timing was two months ago.

[0160] When the second entity searches for a service on screen G1, information about services A to D that match the search conditions is displayed. That is, when the operation acquisition unit 432 acquires the input to area G11 and the operation instruction for area G12, the reception unit 233 receives a search instruction based on the search conditions input to area G11. The display control unit 239 displays screen G1 including areas G13 to G20 as the search result. Screen G1 can accept requests for disclosure of investigation requests or responses regarding each of services A to D. The second entity can request an investigation request after confirming the estimated delivery dates of services A to D. Note that for service C, an operation instruction to object G19 cannot be received. As displayed as "No investigation results" in the area G18 corresponding to service C, service C has no investigation results and thus has no investigable results that can be disclosed. Also, if there is a past response, the second entity can request disclosure of the response. For example, the second entity can also select whether to request an investigation request or request viewing of the response after confirming the estimated delivery date of the investigation request and the update time of the response. If the second entity requests an investigation request to obtain the latest response and wants to "view immediately" the past response, the second entity may make both the request for the investigation request and the request for disclosure of the response.

[0161] On screen G1, when the reception unit 233 receives a request for an investigation request from the second entity as the first reception step, subsequently, when the transmission unit 240 receives the investigation request by the first object, the transmission unit 240 sends a permission request for the investigation request to the first entity corresponding to the investigation target. On the other hand, on screen G1, when the reception unit 233 receives a disclosure request for requesting the disclosure of an answer from the second entity as the first reception step, subsequently, when the determination unit 234 receives the disclosure request by the second object, the determination unit 234 determines based on the disclosure conditions for the investigation target. The output unit 235 can output an answer to the second entity as the first output step when the disclosure conditions are satisfied. In this way, the reception unit 233 may receive a disclosure request even on the lead for receiving an investigation request from the second entity. If there is an investigation result with the same content as the investigation request, the second entity can immediately view the answer. The first entity can reduce the trouble of repeating the answer with the same content.

[0162] In the above embodiment, both the object for receiving the disclosure request and the object for receiving the investigation request are displayed on screen G1. However, if there is an answer updated within a predetermined period, the display control unit 239 may display the object for receiving the disclosure request, and if there is no answer updated within a predetermined period, the display control unit 239 may display the object for receiving the investigation request.

[0163] 4. Operations Summarizing the operations of this embodiment, it is as follows. That is, in such a manner, a more beneficial system or the like regarding security investigation can be provided. When the first entity sets the disclosure conditions, after the reception unit 233 receives the disclosure request from the second entity, the determination unit 234 determines the disclosure conditions, and if the disclosure conditions are satisfied, a system or the like for disclosing the answer to the second entity can be provided.

[0164] The embodiments of the present invention have been described above. However, the present invention is not limited thereto and can be appropriately modified without departing from the technical idea of the invention.

[0165] 5. Others In the above embodiment, the server 2 performs various storage and control. However, instead of the server 2, a plurality of external devices may be used. That is, various information and programs may be distributed and stored in a plurality of external devices using blockchain technology or the like. In particular, the artificial intelligence unit 242 may be an external configuration of the server 2. In that case, the artificial intelligence unit 242 as an external configuration is provided by, for example, an artificial intelligence service server, receives an input from each functional unit of the server 2, receives a request to execute an artificial intelligence service, and is configured to return an output instructed as a processing result to the server 2. The artificial intelligence service server may be a server that provides a service using a language model as a learning model, or a server that executes a language processing task using a language model. The artificial intelligence service server may be constructed by an LLM. The artificial intelligence service server receives an input of a prompt by text, image, voice, etc., and generates and responds with an answer to the prompt.

[0166] The aspect of this embodiment is not limited to the information processing system 1, and may be an information processing method or a program. The information processing method includes each step executed by the information processing system 1. The program causes a computer to execute each step of the information processing system 1.

[0167] It may also be provided in each of the aspects described below.

[0168] (1) An information processing system comprising at least one processor, wherein the processor is configured to execute the following steps by reading a program. In the acquisition step, an answer to an investigation regarding security by a first entity is acquired. In the registration step, disclosure conditions for disclosing the answer to a second entity are registered. In the first reception step, a disclosure request for requesting disclosure of the answer is received from the second entity. In the determination step, based on the information included in the disclosure request, it is determined whether the disclosure conditions are satisfied. In the first output step, when the disclosure conditions are satisfied, the answer is output to the second entity.

[0169] (2) In the information processing system according to (1) above, in the registration step, a list is registered as the disclosure conditions. Here, the list is a list including an entry that determines that the disclosure conditions are not satisfied when it matches the information included in the disclosure request, or a list including an entry that determines that the disclosure conditions are satisfied when it matches the information included in the disclosure request. In the determination step, the information included in the disclosure request is compared with the list to determine whether the disclosure conditions are satisfied.

[0170] (3) In the information processing system according to (1) or (2) above, the disclosure request includes identification information of the second entity. Further, in the collection step, public information regarding the second entity is collected via a network using the identification information of the second entity. In the determination step, the collected public information is analyzed to determine whether the disclosure conditions are satisfied.

[0171] (4) In the information processing system according to (3) above, in the registration step, as the disclosure condition, a list is registered, where the list includes entries related to industries that are determined not to meet the disclosure condition when they match the information included in the disclosure request. Further, in the estimation step, the information included in the disclosure request and the public information are analyzed to estimate the industry of the second entity. In the determination step, the industry of the second entity estimated is compared with the list to determine whether the disclosure condition is met. An information processing system.

[0172] (5) In the information processing system according to (1) or (4) above, in the first reception step, as the disclosure request, a document indicating that the second entity is considering introducing an investigation target related to the first entity is received. In the determination step, the document is analyzed to determine whether the disclosure condition is met. An information processing system.

[0173] (6) In the information processing system according to any one of (1) to (5) above, in the registration step, for each investigation target related to the first entity, the disclosure condition received from the first entity is registered. In the determination step, for each investigation target, it is determined whether the disclosure condition is met. An information processing system.

[0174] (7) In the information processing system according to any one of (1) to (6) above, in the registration step, when the first entity satisfies a predetermined criterion, the disclosure condition is accepted, where the predetermined criterion is based on at least one of the update status of the response by the first entity, or the security compliance of the first entity, or the reliability score of the first entity. In the determination step, when the first entity satisfies the predetermined criterion, a determination is made based on the disclosure condition. When the first entity does not satisfy the predetermined criterion, a permission request for requesting permission to disclose the response is sent to the first entity. In the first output step, when it is determined that the disclosure condition is satisfied, or when permission is received from the first entity, the response is output to the second entity.

[0175] (8) In the information processing system according to any one of (1) to (7) above, further, in the first management step, the response and information regarding the update status of the response are recorded in association with each other. In the registration step, the disclosure condition including the information regarding the update status is registered.

[0176] (9) In the information processing system according to any one of (1) to (8) above, in the first output step, when it is determined in the determination step that the response has not been updated within a predetermined period, an alert is displayed to the second entity, and then the response is output to the second entity.

[0177] (10) In the information processing system according to any one of (1) to (9) above, further, in the display control step, a screen related to the investigation target regarding the first entity is displayed to the second entity. Here, on the screen, a first object and a second object are displayed in association with the investigation target. The first object is configured to be able to receive an investigation request regarding the security of the investigation target, and the second object is configured to be able to receive the disclosure request. Further, in the transmission step, when the first object receives the investigation request, a permission request for the investigation request is transmitted to the first entity corresponding to the investigation target. In the determination step, when the second object receives the disclosure request, it is determined based on the disclosure conditions regarding the investigation target. An information processing system.

[0178] (11) In the information processing system according to any one of (1) to (10) above, further, in the second management step, history information including a request history regarding the disclosure request by the second entity or an output history regarding the output of the answer to the second entity is recorded. Here, the history information includes identification information of the second entity and information regarding the date and time of the disclosure request or the output of the answer. Further, in the second output step, the history information is output to the first entity or the administrator entity. An information processing system.

[0179] (12) In the information processing system according to (11) above, further, in the notification step, when there is a new disclosure request or an output of the answer, the history information is notified to the first entity or the administrator entity. An information processing system.

[0180] (13) In the information processing system according to any one of (1) to (12) above, further, in the transmission step, when it is determined in the determination step that the disclosure condition is not satisfied based on the disclosure request, a request for permission to disclose the answer is transmitted to the first entity, and in the first output step, when permission is received from the first entity, the answer is output to the second entity. An information processing system.

[0181] (14) An information processing method comprising each step executed by the information processing system according to any one of (1) to (13) above.

[0182] (15) A program for causing a computer to execute each step of the information processing system according to any one of (1) to (13) above. Of course, this is not an exhaustive list.

[0183] Finally, although various embodiments according to the present disclosure have been described, these are presented as examples and are not intended to limit the scope of the invention. The novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the gist of the invention. The embodiments and their modifications are included in the scope and gist of the invention and are also included in the invention described in the claims and its equivalent scope.

Explanation of reference numerals

[0184] 1: Information processing system 2: Server 20: Communication bus 21: Communication unit 22: Storage unit 23: Control unit 231: Acquisition unit 232: Registration unit 233: Reception unit 234: Determination unit 235: Output unit 236: Collection unit 237: Presumption Unit 238: Management Unit 239: Display Control Unit 240: Transmission Unit 241: Notification Unit 242: Artificial Intelligence Unit 3: Information Processing Device 30: Communication Bus 31: Communication Unit 32: Memory Unit 33: Control Unit 331: Display Unit 332: Operation Acquisition Unit 34: Display Unit 35: Input Unit 4: Information Processing Device 40: Communication Bus 41: Communication Unit 42: Memory Unit 43: Control Unit 431: Display Unit 432: Operation Acquisition Unit 44: Display Unit 45: Input Unit 5: Information Processing Device 50: Communication Bus 51: Communication Unit 52: Memory Unit 53: Control Unit 531: Display Unit 532: Operation Acquisition Unit 54: Display Unit 55: Input Unit F: Request Form F1: Area F2: Area F3: Area F4: Area F5: Area F6: Area F7: Area F8: Area F9: Area F10: Object G1: Screen G11: Area G12: Area G13: Area G14: Region G15: Region G16: Region G17: Object G18: Region G19: Object G20: Region

Claims

1. An information processing system, comprising at least one processor, wherein the processor is configured to execute the following steps by reading a program: In an acquisition step, an answer to an investigation regarding security by a first entity is acquired; In a registration step, a disclosure condition for determining whether to disclose to a second entity is registered; In a first reception step, a disclosure request for requesting disclosure of the answer from the second entity is received, the disclosure request including at least information regarding the second entity; In a determination step, based on the information included in the disclosure request and the disclosure condition, it is determined whether the information included in the disclosure request satisfies the disclosure condition; In a first output step, when it is determined that the disclosure condition is satisfied, the answer is output to the second entity. An information processing system.

2. In the information processing system according to Claim 1, the disclosure condition includes a list including an entry for determining the information included in the disclosure request, and in the determination step, based on the information included in the disclosure request and the list, it is determined whether the information included in the disclosure request satisfies the disclosure condition. An information processing system.

3. In the information processing system according to Claim 1, in the registration step, as the disclosure condition, a list is registered, where the list is a list including an entry for determining that the disclosure condition is not satisfied when it matches the information included in the disclosure request, or a list including an entry for determining that the disclosure condition is satisfied when it matches the information included in the disclosure request, and in the determination step, the information included in the disclosure request is compared with the list to determine whether the disclosure condition is satisfied. An information processing system.

4. In the information processing system according to Claim 1, the disclosure request includes identification information of the second entity, and further, in a collection step, public information regarding the second entity is collected via a network using the identification information of the second entity, and in the determination step, the collected public information is analyzed to determine whether the disclosure condition is satisfied. An information processing system.

5. An information processing system, comprising... comprising at least one processor, the processor is configured to execute the following steps by reading a program, in an acquisition step, acquire a response to an investigation on security by a first entity, in a registration step, register a list as a disclosure condition for disclosing the response to a second entity, where the list includes entries related to industries that are determined not to meet the disclosure condition when they match the information included in a disclosure request, in a first reception step, receive the disclosure request for requesting disclosure of the response from the second entity, where the disclosure request includes identification information of the second entity, in a collection step, collect public information about the second entity via a network using the identification information of the second entity, in an estimation step, analyze the information included in the disclosure request and the public information to estimate the industry of the second entity, in a determination step, compare the estimated industry of the second entity with the list to determine whether the disclosure condition is met, in a first output step, output the response to the second entity if the disclosure condition is met, an information processing system.

6. In the information processing system according to claim 1, in the first reception step, receive, as the disclosure request, a document indicating that the second entity is considering introducing an investigation target related to the first entity, in the determination step, analyze the document to determine whether the disclosure condition is met, an information processing system.

7. In the information processing system according to claim 1, in the registration step, register the disclosure condition received from the first entity for each investigation target related to the first entity, in the determination step, determine whether the disclosure condition is met for each investigation target, an information processing system.

8. In the information processing system according to claim 1, In the registration step, when the first entity meets a predetermined criterion, the disclosure condition is accepted, where the predetermined criterion is based on at least one of the update status of the response by the first entity, or the security compliance of the first entity, or the reliability score of the first entity. In the determination step, when the first entity meets the predetermined criterion, a determination is made based on the disclosure condition. When the first entity does not meet the predetermined criterion, a permission request for requesting permission to disclose the response is sent to the first entity. In the first output step, when it is determined that the disclosure condition is met, or when permission is received from the first entity, the response is output to the second entity. An information processing system.

9. In the information processing system according to claim 1, further, in the first management step, the response and information regarding the update status of the response are recorded in association with each other. In the registration step, the disclosure condition including the information regarding the update status is registered. An information processing system.

10. In the information processing system according to claim 1, in the first output step, when it is determined in the determination step that the response has not been updated within a predetermined period, an alert is displayed to the second entity, and then the response is output to the second entity. An information processing system.

11. In the information processing system according to claim 1, further, in the display control step, a screen regarding the investigation target related to the first entity is displayed to the second entity, where on the screen, a first object and a second object are displayed in association with the investigation target. The first object is configured to be able to receive an investigation request regarding the security of the investigation target, and the second object is configured to be able to receive the disclosure request. Furthermore, in the transmission step, when the first object receives the investigation request, a permission request for the investigation request is sent to the first entity corresponding to the investigation target. In the determination step, when the second object receives the disclosure request, an information processing system that determines the subject of investigation based on the disclosure conditions.

12. In the information processing system according to claim 1, Further, in the second management step, history information including a request history regarding the disclosure request by the second entity or an output history regarding the output of the response to the second entity is recorded. Here, the history information includes identification information of the second entity and information regarding the date and time of the disclosure request or the output of the response. Further, in the second output step, an information processing system that outputs the history information to the first entity or the administrator entity.

13. In the information processing system according to claim 12, Further, in the notification step, when there is a new disclosure request or output of the response, an information processing system that notifies the first entity or the administrator entity of the history information.

14. In the information processing system according to claim 1, Further, in the transmission step, when it is determined in the determination step that the disclosure conditions are not satisfied based on the disclosure request, a request for permission to disclose the response is transmitted to the first entity. In the first output step, when permission is received from the first entity, an information processing system that outputs the response to the second entity.

15. An information processing method comprising: each step executed by the information processing system according to any one of claims 1 to 14.

16. A program for causing a computer to execute each step of the information processing system according to any one of claims 1 to 14. ​

Images