Information Processing Apparatus, Information Processing Method, and Program

Abstract

An information processing device (10) according to one embodiment of this disclosure comprises: an acquisition unit (11) that acquires a data set for which a plurality of combinations are defined, the combinations being combinations of a plurality of element patterns, each indicating an access attribute, and an access control action corresponding to an element pattern; and a request unit (12) that, if the data set does not cover an action corresponding to one or more anticipated element patterns, asks a user to input an action corresponding to the element pattern not covered by the data set. Due to the foregoing, the invention is able to contribute to thhe accurate determination of an access control action.

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and a non-transitory computer-readable medium. [Background technology]

[0002] Access control in a network is important to network security and maintaining necessary access.

[0003] For example, Cited Document 1 discloses a system for dynamically generating an access control list for a network, which generates the access control list by using a policy enforcement point graph for a plurality of resource descriptions and a network. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Special Publication No. 2018-536363 Summary of the Invention [Problem to be solved by the invention]

[0005] The present disclosure provides an information processing device, an information processing method, and a non-transitory computer-readable medium that can contribute to determining access control actions with high accuracy. [Means for solving the problem]

[0006] An information processing device according to one embodiment includes an acquisition means for acquiring a dataset that defines multiple combinations of element patterns indicating access attributes and access control actions corresponding to the element patterns, and a request means for requesting a user to input an action corresponding to an element pattern that is not covered by the dataset if the dataset does not cover an action corresponding to one or more expected element patterns.

[0007] In one embodiment, an information processing method is executed by a computer to acquire a dataset in which multiple combinations of element patterns indicating access attributes and access control actions corresponding to the element patterns are defined, and if the dataset does not cover actions corresponding to one or more expected element patterns, to request a user to input an action corresponding to an element pattern not covered by the dataset.

[0008] A non-transitory computer-readable medium according to one embodiment stores a program that causes a computer to acquire a dataset that defines multiple combinations of element patterns that indicate access attributes and access control actions corresponding to the element patterns, and, if the dataset does not cover actions corresponding to one or more expected element patterns, request a user to input an action corresponding to an element pattern that is not covered by the dataset. [Effects of the Invention]

[0009] This disclosure makes it possible to provide an information processing device, an information processing method, and a non-transitory computer-readable medium that can contribute to determining access control actions with high accuracy. [Brief explanation of the drawings]

[0010]

Figure 1

Figure 2

Figure 3

Figure 4A

Figure 4B

Figure 4C

Figure 4D

Figure 5

Embodiments for Carrying Out the Invention

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that, for the sake of clarity of explanation, the following description and drawings are appropriately omitted and simplified. Also, in the present disclosure, unless otherwise specified, when "at least any one of" is defined for a plurality of items, the definition may mean any one item or any plurality of items (including all items).

[0012] Embodiment 1 FIG. 1 is a block diagram showing an example of an information processing apparatus. The information processing apparatus 10 includes an acquisition unit 11 and a request unit 12. Each part (each means) of the information processing apparatus 10 is controlled by a control unit (controller) (not shown). Hereinafter, each part will be described.

[0013] The acquisition unit 11 acquires a data set in which a plurality of combinations of a pattern (hereinafter, also simply referred to as a pattern) including a plurality of elements indicating the attributes of access and an access control action corresponding to the pattern are defined. Note that the acquisition unit 11 is composed of an interface for acquiring information from inside or outside the information processing apparatus 10. The acquisition process may be automatically executed by the acquisition unit 11 or may be performed by manual input.

[0014] Here, "element indicating the attribute of access" refers to any element that specifies the nature of the access. Specific examples of elements may include one or more specific pieces of information (values) related to the nature of the access, such as (1) various data from the access source, (2) various data from the access destination, and (3) other data indicating the nature of the access.

[0015] (1) Specific examples of various data of the access source include any one or more of information on the access source ID, information on the user, information on the access source device, information on the access source IP (Internet Protocol) address, information on the port number, software name (for example, application name), access authentication means, etc. Here, information on the access source ID includes any one or more of the access source ID (user ID), user name, device ID, application ID, user authentication result (authentication history) of the access source ID, etc. Information on the user includes any one or more of the user's affiliation (organization), job title, occupation, user location (location of the device that is the access source), etc. Information on the access source device includes any one or more of the OS ( Operating The information about the access source IP address includes one or more of the following: the IP address of the access source, the risk level of the access source IP address, etc.

[0016] (2) Specific examples of various data of the destination include any one or more of the following: information on the destination ID, information on the destination data, the destination IP address, information on the OS used by the destination device, operation type, etc. Information on the destination ID includes any one or more of the destination resource ID, the name of the owner of the destination resource ID, etc. Information on the destination data includes any one or more of the destination organization (organization that owns the resource), the type of destination data (resource) being requested, the creator, the creation date and time, security level, etc.

[0017] (3) Specific examples of data indicating other access properties include any one or more of the request frequency from the access source ID to the resource ID of the access destination, the time zone (or time) of the access, the session key method, the abnormality level, the encryption strength of the traffic, various data related to authentication, etc. Various data related to authentication include any one or more of various authentication methods (including information on authentication strength), device authentication results, application authentication results, various authentication times, the number of failures of various authentications, etc. However, the elements shown above are merely examples, and the elements indicating the attributes of access are not limited to these.

[0018] "A plurality of patterns indicating the attributes of access" means that there are two or more of these elements. For example, assuming that the access attributes are X, Y, and Z, and assuming that the elements with different values of the same attribute X are X1 and X2, the elements with different values of the same attribute Y are Y1 and Y2, and the elements with different values of the same attribute Z are Z1 and Z2. In this case, as the "pattern indicating the attributes of access", any one or more patterns among "X1, Y1", "X1, Z1", "Y1, Z1", "X1, Y2", ··· "X1, Y1, Z1" ··· "X2, Y2, Z2" are included.

[0019] Further, the data set further includes an access control action corresponding to each of these patterns. As this action, two or more different actions are defined. For example, as the action, two or more of authorization, denial, and authorization with conditions (additional authentication request) may be defined. However, the actions shown above are merely examples, and the types of actions are not limited to these.

[0020] The dataset defines multiple combinations of patterns indicating the above-described access attributes and access control actions respectively corresponding to those patterns. For example, as patterns indicating access attributes, there are "X1, Y1", "X1, Z1", "Y1, Z1", and as actions respectively corresponding to each pattern, there are "Approval", "Denial", "Approval". In this case, in the dataset, these combinations are defined as "X1, Y1 ⇒ Approval", "X1, Z1 ⇒ Denial", "Y1, Z1 ⇒ Approval".

[0021] When the dataset acquired by the acquisition unit 11 does not cover actions corresponding to one or more assumed patterns, the request unit 12 requests the user to input one or more actions corresponding to the patterns of elements not covered by the dataset. Here, the "one or more assumed patterns" may be one or more patterns that can theoretically be taken for each defined element. Or, depending on the conditions on the system, they may be one or more realistic patterns included among the patterns that can theoretically be taken.

[0022] As the above "one or more assumed patterns", for example, specific patterns preset for reasons such as frequent occurrence or importance in access control can be considered. Here, when the number of patterns equal to or above a predetermined threshold or ratio among one or more specific patterns is not covered by the data set, the request unit 12 may request the user to input an action corresponding to the uncovered pattern. For example, when even one of the specific patterns is not covered by the data set, the request unit 12 can request the user to input an action corresponding to the uncovered pattern. As another example, different weightings may be preset for a plurality of specific patterns. In this case, the request unit 12 calculates at least one of a numerical value calculated based on the weighting of the patterns covered by the data set or a numerical value calculated based on the weighting of the patterns not covered by the data set among the plurality of specific patterns. Then, using at least one of those numerical values, it is possible to determine whether to request the user to input an action corresponding to the pattern not covered by the data set.

[0023] Also, the above "one or more assumed patterns" may be all the assumed patterns. Here, "all the assumed patterns" may be all the patterns that can theoretically be taken for each defined element, or all the patterns that can realistically be taken, limited from all those patterns according to the conditions on the system.

[0024] Also, the "uncovered pattern" means that the action corresponding to the pattern is not determined, or for that action, the constraint conditions described later in Embodiment 2 are not defined.

[0025] At this time, the request unit 12 may determine that the data set does not cover the actions corresponding to one or more assumed patterns by comparing the data set with one or more assumed patterns. Alternatively, another processing unit of the information processing apparatus 10 may execute the determination by comparing the two. In the determination, it is analyzed whether there is a pattern not defined in the data set among one or more assumed patterns. Based on the determination result, the request unit 12 requests the user to input an action. The action to be input is one of two or more different actions.

[0026] Note that even if the data set does not cover the actions corresponding to one or more assumed patterns as a result of the comparison, if a predetermined condition is satisfied, the request unit 12 does not have to request the user to input an action. As an example, there is a case where all of the uncovered assumed patterns can be covered by similar patterns. For example, when defining actions for the above-mentioned access attributes X (X1 or X2), Y (Y1 or Y2), and Z (Z1 or Z2), if actions for two patterns of "X1, Y1, Z1" and "X2, Y2, Z2" are defined, even if the other six patterns composed of X, Y, and Z are not directly covered, actions corresponding to the closer pattern among the two patterns can be defined. More practical conditions will be described later in Embodiment 2.

[0027] Furthermore, the number of actions for which the request unit 12 requests input and the number of times of requesting input are any numbers of 1 or more. This detail will also be described later in Embodiment 2.

[0028] The request unit 12 can visualize and output a request for an action input from the user by using an interface that the information processing apparatus 10 has or is connected to, as a method of requesting the user for an action input. For example, the request unit 12 can display intended information on a screen which is an interface, or can print the intended information on a printing device which is an interface.

[0029] FIG. 2 is a flowchart showing an example of a typical process of the information processing apparatus 10, and the process of the information processing apparatus 10 is explained by this flowchart. First, the acquisition unit 11 of the information processing apparatus 10 acquires a data set in which a plurality of combinations of a plurality of patterns indicating access attributes and access control actions corresponding to the patterns are defined (step S11; acquisition step). Next, when the data set does not cover actions corresponding to one or more assumed patterns, the request unit 12 requests the user to input an action corresponding to a pattern not covered by the data set (step S12; request step). In this way, by having the user input an action corresponding to a pattern not covered by the data set, it becomes possible to accurately determine an access control action for an arbitrary pattern using not only the data set but also information on the combination of the pattern and the action.

[0030] Embodiment 2 Hereinafter, embodiments of the present invention will be described with reference to the drawings. In Embodiment 2, a specific example of the information processing apparatus 10 described in Embodiment 1 is disclosed.

[0031] FIG. 3 is a block diagram showing an example of an access control system 20 that executes access control determination on a zero-trust network. The access control system 20 includes a policy generation system 21, a determination unit 22, a data store 23, and an enforcer 24. Details of each unit will be described below.

[0032] The policy generation system 21 corresponds to a specific example of the information processing apparatus 10 according to Embodiment 1. The policy generation system 21 generates an access control policy for access control based on the input intention (knowledge necessary for policy generation) and determination samples (corresponding to the dataset in Embodiment 1), and outputs the generated access control policy to the determination unit 22. Details of this policy generation system 21 will be described later.

[0033] Here, the access control policy is defined as a combination of a plurality of patterns indicating access attributes and access control actions corresponding to the one or more patterns. As a specific example, when the combination of elements is (department of the accessing user: Department A, job type: developer, authentication method: two-factor authentication, organization owning the resource: Department A, type of resource: design document), the access control policy defines the corresponding action as "authorized".

[0034] When an access control query (request) is made, the determination unit 22 uses the access control policy acquired from the policy generation system 21 to determine an access control action based on the elements related to the request. The elements related to the request mean the same elements as those indicating the access attributes described in Embodiment 1.

[0035] Specifically, the determination unit 22 receives, as elements related to the request, (i) information on elements indicating the attributes of the access included in the request, and (ii) information on other background attributes. As an example of the information in (i), the ID of the access source, the IP address of the access source, the resource ID of the access destination, the operation type, the session key, etc. are assumed, but the information on the elements included in the request is not limited to this. Also, as an example of the information in (ii), the user name of the ID of the access source, the user's affiliation, job title or occupation, the manufacturer name of the device, the user location, the user authentication result, the risk level of the IP address of the access source, the owner name of the resource ID of the access destination, the type and creation date / time of the data at the access destination, the encryption strength, the request frequency from the ID of the access source to the resource ID of the access destination, the time of access, various authentication methods, the device authentication result, the application authentication result, the times of various authentications, the number of failures of various authentications, etc. are assumed, but the information on the elements included in the background attribute information is not limited to this.

[0036] The determination unit 22 compares the elements related to the request with combinations of a plurality of elements defined in the access control policy, and identifies combinations of elements defined in the access control policy that satisfy the conditions of the elements related to the request. Then, the action defined corresponding to each such combination is determined as the action for the request, and the action information is output.

[0037] The actions that can be taken in Embodiment 2 are authorization, additional authentication request, denial, etc., but are not limited thereto. For example, as an action, transfer of access to a server that performs more detailed checks, a request for approval to an administrator, etc. can also be considered. This action constitutes a totally ordered set that satisfies the reflexive law, transitive law, antisymmetric law, and complete law. Also, in this embodiment, a totally ordered set indicating the degree of influence on the action is defined for the pattern. Here, the direction towards "authorization" or "denial" is defined as the "order of degree of influence", and the information indicating how much it moves towards "authorization" or "denial" is defined as the "magnitude of degree of influence".

[0038] The above-described determination unit 22 can be realized by any means such as a proxy server for access control, an application gateway, or attribute-based encryption.

[0039] The data store 23 is a storage (storage unit) that stores information on background attributes used by the above-mentioned determination unit 22. The access control system 20 stores automatically collected data in the data store 23. When an access control request is made, the determination unit 22 refers to the data store 23 to obtain information on background attributes corresponding to the request.

[0040] The enforcer 24 is an access control device that, upon receiving an access control request, outputs information on elements related to the request to the determination unit 22. The enforcer 24 then obtains information on the action determined by the determination unit 22 and executes access control for the request based on the action information. If access is authorized, the enforcer 24 forwards the packet related to the access to the resource (access destination), while if access is denied, the enforcer 24 discards the packet related to the access. In this way, the access control system 20 executes access control based on the generated access control policy.

[0041] Next, we will explain the details of the policy generation system 21. As shown in Fig. 3, the policy generation system 21 includes a judgment sample acquisition unit 211, an intention acquisition unit 212, a policy generation unit 213, a parameter storage unit 214, and an additional information request unit 215. Each unit will be explained below.

[0042] The determination sample acquisition unit 211 acquires a determination sample and outputs the determination sample to the policy generation unit 213. The determination sample includes a plurality of sample policies defined by a user (or an existing automation method). The sample policy is defined as a correspondence relationship between a pattern of a plurality of elements indicating access attributes (hereinafter also referred to as a sample pattern) and an access control action for the sample pattern. However, as another correspondence relationship, a correspondence relationship between one element and an access control action for the element may be defined in the sample policy.

[0043] Here, the plurality of sample policies may be defined from different viewpoints for each individual policy. For example, from the viewpoint based on the security function, elements such as the encryption strength of traffic, the OS version of the device at the access source, the application authentication result, the authentication strength of the user, the creator of the resource, and the type of the resource may be set. Also, from the viewpoint based on the department structure of the organization in access (such as affiliation and position), elements such as the position of the user, the affiliation (for example, the project in charge), the creator of the resource, the type of the resource, and the user location may be set. In this way, different viewpoints may have different elements or the same elements. A specific example of the sample policy is something like "user's affiliation, position, authentication means, device location, OS, type of the required access destination data (request data), application name ⇒ approval / denial".

[0044] Also, a sample policy may have some of its elements expressed in a form that cannot be uniquely identified (i.e., "anonymized"). For example, the user's department in a sample policy is expressed as "Personnel Department", "Development Department", etc. when not anonymized, while it is expressed as "Department A", "Department B", etc. when anonymized. Such anonymization is performed, for example, to protect the organization's confidential information when presenting the sample policy to people or systems outside the organization. Or, it is also assumed that such anonymization is done because the elements of the underlying data were not uniquely identified (e.g., the readability of the underlying data was low) when originally generating the sample policy.

[0045] The determination sample acquisition unit 211 may output the acquired determination sample directly to the policy generation unit 213. Or, the determination sample acquisition unit 211 may further acquire data indicating ideal access control for a specific pattern and output that data to the policy generation unit 213 as well. The number of patterns included in this data can be, for example, several to several tens of patterns, but is not limited to this. This makes it possible to further improve the accuracy of the policy generated by the policy generation unit 213.

[0046] The intention acquisition unit 212 acquires the intention that is assumed to be used by the decision maker when determining an action based on one or more elements. The intention means the knowledge necessary for policy generation as described above, and more specifically, includes a pattern of one or more elements indicating the attributes of the access.

[0047] The intention acquisition unit 212 may acquire, as the intention, an intention in which at least one of the order and magnitude of the influence on the action is further defined corresponding to a pattern of one or more elements. Also, as will be described later, this intention allows for definition in an ambiguous form. The intention acquisition unit 212 can acquire this combination any number of times, one or more.

[0048] Examples of patterns of elements of 1 or more include sets of "user affiliation, type of requested data, or organization owning the resource", sets of "OS, software name, or application name", individual "authentication means", "degree of abnormality", etc. For example, in access control, the type of data or the organization owning the resource for which access is to be authorized is considered to vary depending on the user's affiliation. Therefore, "user affiliation, type of requested data, or organization owning the resource" may be defined as an intended element. Similarly, in access control, the security level of access can change depending on the combination of the OS and software or application of the access source, the authentication means, and the degree of abnormality (that is, the authorization or denial of access can change). Therefore, "OS, software name, or application name", "authentication means", and "degree of abnormality" may be defined as intended elements.

[0049] Also, the information on the degree of influence that affects an action is information indicating in which direction and to what extent the action moves in either the "authorized" or "denied" direction. As described above, the directionality towards "authorized" or "denied" is defined as the "order of degree of influence", and the information indicating to what extent it moves in the "authorized" or "denied" direction is defined as the "magnitude of degree of influence". For example, arranging the "magnitude of degree of influence" in descending order results in the "order of degree of influence". This information on the degree of influence does not need to indicate the action itself to be executed.

[0050] Here, the intention acquisition unit 212 may acquire data such as quantitatively expressed numerical values as the influence of the intention, or may acquire qualitative (ambiguous) information. A specific example of the latter is information indicating that, with respect to the direction of the action toward "authorization," "User's Department: Development Department, Requested Data: Design Data" is greater than "User's Department: Development Department, Requested Data: Personnel Data." This information can be defined because, in general, it is natural for a user belonging to the development department to request data related to product development (e.g., design data), and it is considered appropriate to authorize access control related to such data. On the other hand, even if a user belongs to the development department, if the user is developing a personnel system, it may be appropriate to authorize access to personnel data for development purposes. Therefore, the influence is qualitative information indicating a general trend, rather than quantitative information indicating whether to actually authorize or deny access. The magnitude of the influence may be expressed in three or more stages (e.g., "high influence," "slightly high influence," and "low influence," in descending order of influence) instead of two stages.

[0051] When the intention acquisition unit 212 acquires such qualitative impact information, it may convert the impact information into a numerical value in which the order and magnitude of the impact are defined, and then output the information to the policy generation unit 213. For example, when assigning a positive score as the direction of "approval," the intention acquisition unit 212 may assign an impact value of "1" to "user's affiliation: development department, requested data: design data" and an impact value of "0" to "user's affiliation: development department, requested data: personnel data," because it is easier to "approve" the action for the former than for "user's affiliation: development department, requested data: personnel data."

[0052] The intention acquisition unit 212 outputs the acquired intention information to the policy generation unit 213 as described above.

[0053] The policy generation unit 213 acquires a determination sample from the determination sample acquisition unit 211 and acquires intention information from the intention acquisition unit 212. Then, the determination sample and the extracted intention information are input into a model for generating an access control policy (hereinafter referred to as a policy generation model), and by causing the policy generation model to perform machine learning, the policy generation model can output an access control action along the input intention, and an access control policy is generated and output. The access control policy is defined by a combination of one or more element patterns indicating access attributes and an action. The element pattern included in the access control policy may be a pattern including a sample pattern defined by a sample policy and an element pattern defined by intention information.

[0054] Based on the acquired intention, the policy generation model can imitate the method by which an administrator or the like of the access control target network determines a sample policy, and can specifically determine a pattern of a combination of elements and a combination of actions that were not clearly defined in the sample policy (for example, were outside the scope or were ignored because they did not substantially affect the determination of access control). Here, the policy generation model can automatically adjust the combination of elements based on the intention, the order and magnitude of the corresponding influence degree, and set appropriate values.

[0055] Specifically, the policy generation model can generate an access control policy so that information on the influence degree (order and magnitude) corresponding to the element pattern acquired from the intention acquisition unit 212 is saved. That is, the quantitative action in the fourth pattern defined by the access control policy can be made consistent with the qualitative influence degree information acquired from the intention acquisition unit 212. And, as an example, the generated access control policy may be such that the anonymized part in the sample policy is uniquely identified.

[0056] The policy generation unit 213 shown above can be realized by any means such as probability logic, fuzzy logic, linear regression, support vector machine, decision tree, neural network, monotonic regression, monotonic decision tree, monotonic neural network, etc.

[0057] Also, instead of the access control policy, the policy generation unit 213 may generate some algorithm (for example, a program). This program outputs an action corresponding to a pattern when a pattern of a plurality of elements indicating the attributes of a predetermined (for example, requested) access is input. The policy generation unit 213 outputs the program to the determination unit 22, and the determination unit 22 determines an action related to the request using the program.

[0058] Furthermore, the policy generation unit 213 derives patterns of one or more assumed elements using the intention information acquired from the intention acquisition unit 212. Then, it is determined whether or not all of the one or more assumed patterns are covered in the determination samples acquired from the determination sample acquisition unit 211. If not all of the one or more assumed patterns are covered in the determination samples, the policy generation unit 213 outputs information on the one or more uncovered patterns, together with the determination samples and intention information acquired so far, to the additional information request unit 215 as an instruction to execute processing. In response to this output, the additional information request unit 215 executes an input request to the user as described later.

[0059] Note that the "one or more assumed patterns" may be specific patterns preset for reasons such as frequent occurrence or importance during access control, or may be all assumed patterns. Since the details are as described in Embodiment 1, the description is omitted.

[0060] If all of one or more expected patterns are covered in the judgment sample, policy generation unit 213 does not output a processing execution instruction to additional information request unit 215. Therefore, additional information request unit 215 does not execute the processing described below. Even if all of one or more expected patterns are not covered in the judgment sample, policy generation unit 213 does not need to output a processing execution instruction to additional information request unit 215 in the following cases, for example. (A) In the access control policy that can be generated based on the information obtained up to now, the number of uncovered patterns or the ratio of the number of uncovered patterns to the number of one or more expected patterns is less than a predetermined threshold. (B) If the reliability of the access control policy that can be generated based on the information obtained up to now is equal to or greater than a predetermined threshold. Here, "information acquired up to now" refers to the judgment samples acquired by the judgment sample acquisition unit 211, the intention information acquired from the intention acquisition unit 212, and the actions determined by the input requests up to now and the information on the corresponding patterns. Also, the reliability of an access control policy refers to the probability (accuracy) that the access control policy can determine the correct action for one or more expected patterns.

[0061] The condition (A) can also be interpreted as "in the access control policy that can be generated based on the information acquired up to now, the number of covered patterns, or the ratio of the number of covered patterns to the number of possible patterns (one or more) is equal to or greater than a predetermined threshold." Also, in (A), the number of patterns for which constraint conditions are not determined (or the number of patterns for which constraint conditions are determined) may be used instead of the number of uncovered patterns (or the number of covered patterns). Constraint conditions will be explained later.

[0062] In addition, the policy generation unit 213 is requested for input as a result of the processing by the additional information request unit 215, and can also acquire the additional information (action information) input by the user and the information on the pattern of the corresponding element. The policy generation unit 213 inputs this information together with the determination samples and intention information acquired so far into the model for access control policy generation, causing the policy generation model to perform machine learning. Thereby, the policy generation unit 213 can improve the accuracy of the generated policy. Also, since the policy generation unit 213 can use the newly input additional information each time an input request is made, the accuracy of the generated policy can be improved each time.

[0063] Furthermore, the policy generation unit 213 can generate an access control policy such that the total order set associated with the pattern and the total order set associated with the action are order-isomorphic (monotonic). That is, the policy generation unit 213 can generate an access control policy such that when the pattern changes in the direction of "approval" or "denial", the corresponding action changes in the direction of "approval" or "denial".

[0064] The parameter storage unit 214 stores the parameters necessary for the policy generation unit 213 to generate an access control policy. The policy generation unit 213 acquires the parameters from the parameter storage unit 214 when generating an access control policy.

[0065] The additional information requesting unit 215 corresponds to the requesting unit 12 in the first embodiment. The additional information requesting unit 215 acquires, from the policy generating unit 213, an instruction to execute processing, information on the judgment samples and intentions acquired up to now, and information on patterns not covered in the judgment samples. The additional information requesting unit 215 can determine that an uncovered pattern is a pattern requiring additional information, and inquire of the user about an action corresponding to that pattern (generate a query). Here, the additional information requesting unit 215 requests the user to input an action as additional information by displaying an input for the requested action on a screen to which the policy generating system 21 is connected. Information on the input action is input from the judgment sample acquiring unit 211 and acquired by the policy generating unit 213 and the additional information requesting unit 215.

[0066] When there are multiple element patterns that are not covered by the judgment sample, the additional information requesting unit 215 may request input of an action for only one of those patterns, or may request input of actions for multiple patterns. When requesting input of actions for multiple patterns, the additional information requesting unit 215 may request input of actions for multiple patterns in a single input request, or may sequentially request input of actions for multiple patterns through multiple input requests in different chronological orders. In this case, the number of element patterns for which action input is requested in a single input request may be one or multiple.

[0067] When there are a plurality (N) of patterns not covered by the judgment sample, the additional information request unit 215 can identify one or more (less than N) patterns of elements not covered by the judgment sample, for which it is particularly advantageous to identify an action, as targets for which an input of an action is requested. The patterns identified as targets for which an action is requested are those for which the policy generation unit 213 can generate a highly accurate policy by determining a corresponding action.

[0068] For example, the additional information request unit 215 can determine the importance of action determination for each of a plurality of uncovered patterns, and at least request the user to input an action corresponding to the pattern of the most important element. Alternatively, the additional information request unit 215 may request the user to input an action corresponding to one or more patterns among the determined patterns whose importance is equal to or higher than a predetermined threshold value. The additional information request unit 215 can determine the level of importance according to the following criteria.

[0069] As an example, assume that in the patterns of the first and second elements not covered by the determination sample, when the action corresponding to the pattern of the first element is determined, the constraint condition of the action of the pattern of the second element is determined, but the reverse is not true. In this case, the additional information request unit 215 determines that the pattern of the first element has a higher importance than the pattern of the second element.

[0070] Here, the determination of the constraint condition of the action of the pattern of the second element may indicate that the action of the pattern of the second element is determined, or may indicate that the probability of the action of the pattern of the second element being determined is defined. For example, assume that when the action corresponding to the pattern of the first element is not determined, it is unknown which of "approval, additional authentication request, denial" the action corresponding to the pattern of the second element will be. Here, when the action corresponding to the pattern of the first element is determined, as an example of the constraint condition, a case is assumed where the probability that the action corresponding to the pattern of the second element is "approval" is 80%, the probability that it is "additional authentication request" is 10%, and the probability that it is "denial" is 10%.

[0071] The additional information request section 215 determines the importance by analyzing the degree of determination of the constraint conditions of the actions of other patterns when each action is finalized for one or more patterns of elements not covered by the determination sample. Then, for the pattern of the element with the highest importance or the pattern of the element within a predetermined rank from the top in terms of importance, the input of its action can be requested from the user. Examples of the definition of a pattern with high importance are assumed as follows. (C) When the content of the action corresponding to a certain pattern is finalized by an input request, based on the available information, the pattern of the element with higher importance is defined as the pattern for which the number of patterns for which the action is finalized (newly covered) among the patterns not covered so far increases. Here, "available information" refers to the determination sample acquired by the determination sample acquisition section 211, and the information on the action finalized by the current input request (if it is the second or subsequent input request, also the information on the actions and corresponding patterns finalized in the previous input requests). Also, "patterns not covered so far" means, when requesting additional information in the first input request, the patterns not covered by the determination sample acquired by the determination sample acquisition section 211. When requesting additional information in the second or subsequent input requests, it means the patterns not covered by the acquired determination sample and the information on the actions input by the user and the corresponding patterns in the previous input requests before the previous input request.

[0072] Figure 4A is a schematic diagram for explaining the method for (A). The horizontal axis in Figure 4A represents state A (e.g., OS information) set with one or more elements, and the vertical axis represents state B (e.g., user affiliation and data of the access destination) set with one or more elements different from state A. Figure 4A is a graph showing the determination status of actions for one or more assumed patterns (in this example, all assumed patterns). Specifically, when states A and B are in (1) the denial region, the action is determined as "denial", and when states A and B are in (2) the approval region, the action is determined as "approval". And when states A and B are in (3) the uncertain region, the action is not determined.

[0073] In Figure 4A, (i), (ii), and (iii) are assumed as patterns for requesting input of an action with the next input request. (i) is the pattern of states A1 and B1, (ii) is the pattern of states A2 and B2, and (iii) is the pattern of states A3 and B3. When the additional information request unit 215 adopts (A) as the definition of a pattern with high importance, it analyzes which pattern will cover more newly covered patterns when the action is determined as "approval" for (i) to (iii).

[0074] Figures 4B to 4D show the transitions of the (2) approval region and the (3) uncertain region when the action is determined as "approval" for each of (i) to (iii). Comparing Figures 4B to 4D, as shown in Figure 4B, when the action is determined for the pattern of (i), the (2) approval region expands the most, and conversely, the (3) uncertain region becomes narrower. Therefore, the additional information request unit 215 determines that the pattern of (i) has the largest number of newly covered patterns and determines that its importance is the highest. Therefore, the additional information request unit 215 requests the user to input the action for the pattern of states A1 and B1 of (i).

[0075] In this example, two types of sets, state A and state B, are assumed as states. However, for N types of sets (N: natural number) represented in N dimensions, the additional information request unit 215 can execute the same process.

[0076] Note that in (C), instead of the number of newly covered patterns, the ratio of the number of newly covered patterns to the assumed number of patterns of 1 or more may be used. Also, in (C), instead of the number of newly covered patterns, the number of patterns for which constraint conditions are newly determined may be used.

[0077] Furthermore, as another example of the definition of a pattern with high importance, the following is also assumed. (D) When the content of the action corresponding to a certain pattern is determined by an input request, the higher the reliability of the access control policy generated by the policy generation unit 213 using the determination sample, the action input by the input request, and the pattern corresponding thereto, the higher the importance of the pattern. Here, the reliability of the access control policy means the probability (accuracy) that the access control policy can determine the correct action for one or more assumed patterns. Note that when the reliability of the access control policy is equal to or higher than a predetermined threshold when a certain pattern is determined, the additional information request unit 215 may increase the importance of that pattern compared to patterns for which this is not the case. Such a threshold can be set to one or more.

[0078] In addition, the additional information request unit 215 can change the pattern corresponding to the action for which input is requested in the second input request (e.g., the second time and later) in time series according to the content of the action input by the user in the first input request in time series (e.g., the first time). This is because, since the pattern and action determined by the first input request are different, the pattern with a higher importance level may be different at the time of the second input request. The additional information request unit 215 requests input of an action for the pattern of the most important element or the pattern of elements within a predetermined rank from the top in terms of importance at each input request time point.

[0079] As described above, when it is possible to change the pattern corresponding to the action for which input is requested in the second input request according to the content of the action input by the user in the first input request, as another example of the definition of a pattern with a high importance level, the following is also assumed. (E) When the content of the action corresponding to the pattern of a certain element is determined by an input request, the pattern of the element with a higher importance level is set such that the number of input requests for the actions required in the future decreases so that the reliability of the access control policy defined in (D) becomes equal to or higher than a predetermined threshold value. The reliability of the access control policy is as described above. If the predetermined threshold value is 100%, in (E), the pattern of the element for which the number of input requests required to determine actions for all assumed patterns of 1 or more is minimized is regarded as the pattern of the element with the highest importance level. Note that in (E), the number of action patterns determined in one input request may be a determined number (e.g., 1).

[0080] The additional information request unit 215 can specify the importance level for (D) and (E) using the method of Bayesian estimation.

[0081] Furthermore, the additional information request unit 215 can present information regarding the reliability of the access control policy that the policy generation unit 213 can generate to the user based on the information that can be obtained so far. The "information regarding reliability" may mean, for example, the reliability of the access control policy that the policy generation unit 213 can generate in the current state, or it may mean how many additional information (inputs of actions) are required for the reliability to reach a predetermined threshold value or more.

[0082] In addition, the additional information request unit 215 may present information to the user that serves as a guideline on whether to input an action in response to the input request by displaying the presentation to the user and the input request on the same screen. That is, when the user determines from the presentation information that the access control policy that can be generated at the current time has sufficient reliability, even if an input request is made regarding a pattern not covered by the access control policy, there is no need to execute the input of the action related to the input request. In this case, the user outputs an instruction to the access control system 20 to generate an access control policy using the information acquired so far. In response to this instruction, the policy generation unit 213 generates an access control policy using the information acquired so far. The details are as described above.

[0083] The policy generation of the policy generation system 21 shown above is performed before the access control determination by the determination unit 22 is started. Thereby, the determination unit 22 can accurately perform the access control determination using the generated policy.

[0084] In recent years, with the development of zero-trust network technology, the importance of access control in the network has increased. The zero-trust network can be applied, for example, in local 5G (5th Generation) used in companies, local governments, etc.

[0085] A zero-trust network calculates a security score for access from all devices and determines whether to permit that access. This can prevent a threat that has penetrated the network from accessing important files and prevent the spread of damage. Also, the zero-trust network does not simply block access from outside the network, but can permit trusted access by making a determination based on the above-mentioned score calculation. Therefore, it is possible to achieve both network security and availability.

[0086] In such a zero-trust network, the network's policy engine determines whether to permit or deny access by integrating various types of information based on perspectives such as risk, needs, and trust. In order to accurately determine whether to permit or deny access, it is necessary to generate detailed policies. Also, in order to accurately reflect environmental changes in the policies even when the network environment (multiple elements related to access control) changes, the policies to be generated are preferably dynamic. As a result, the policies to be generated become complex, and the issue becomes how to define or generate such policies.

[0087] For example, when an administrator of an access control target network generates a policy, although the administrator has a lot of knowledge from a specific perspective (e.g., security functions, department structure, etc.), he or she may not have much knowledge from other perspectives. Therefore, the accuracy of the generated policy may deteriorate, and it may not be possible to accurately determine access control actions in various situations. A method of having multiple administrators each generate a policy and then generating an integrated policy from those policies can be considered, but even in that case, the integrated policy may not cover all of the various situations, and a definition omission may occur where actions cannot be accurately determined. For example, as described above, a situation where an incomplete definition occurs in a part of the policy (a part is anonymized) falls under such circumstances. If a person tries to review the definition to solve this problem, it is assumed that it will take a great deal of time and effort.

[0088] In contrast, in Embodiment 2, when the additional information request unit 215 determines that the sample policy does not cover all of the patterns assumed by the intended information, the additional information request unit 215 can request the user to input an action corresponding to the uncovered pattern. Therefore, it becomes possible to accurately determine (refine the granularity of) the access control policy without the user having to take the trouble to review it. For example, when a security-based sample policy and a performance-based sample policy are input to the determination sample acquisition unit 211 as sample policies, the policy generation system 21 can generate an access control policy that optimizes the trade-off between security and performance more. Also, because the intended information is used to determine the input request, the user can grasp the patterns that are not currently covered by the sample policy by means of the input request just by inputting his or her access control intention.

[0089] In addition, when there are multiple patterns of elements not covered by the sample policy, the additional information request unit 215 can determine the importance of action determination in the pattern of each uncovered element, and at least request the user to input an action corresponding to the pattern of the most important element. Thereby, the policy generation system 21 can improve the accuracy of the access control policy more highly in one input request.

[0090] Also, in the patterns of the first and second elements not covered by the sample policy, when the action corresponding to the pattern of the first element is determined, the constraint conditions for the action of the pattern of the second element are determined, but when the reverse is not true, the additional information request unit 215 may determine that the pattern of the first element is more important than the pattern of the second element. Thereby, the policy generation system 21 can determine the importance of the pattern that affects other patterns more highly, and by making it easier to request an input for that action, improve the accuracy of the access control policy more highly in one input request.

[0091] In addition, the additional information request unit 215 may determine the importance of the pattern of the uncovered element based on at least any one of the number of patterns of elements covered by the sample policy, the ratio of the number of patterns of covered elements to the assumed number of one or more patterns of elements, or the reliability of the access control policy generated using the sample policy, the actions obtained by the input request to the user, and the patterns of the elements corresponding thereto. Thereby, the policy generation system 21 can determine the importance of the pattern that can surely improve the accuracy of the access control policy more highly, and by making it easier to request an input for that action, improve the accuracy of the access control policy more highly in one input request.

[0092] In addition, when it is possible for the additional information request unit 215 to sequentially request the user to input actions corresponding to patterns of elements not covered by the sample policy a plurality of times, according to the content of the action input by the user in response to the first request, it is possible to change the pattern of the element corresponding to the action for which input is requested in the second request after the first request. Thereby, since the policy generation system 21 can dynamically change the content of the input request according to the situation, it can contribute to improving the accuracy of the access control policy.

[0093] In addition, when it is possible for the additional information request unit 215 to sequentially request the user to input actions corresponding to patterns of elements not covered by the sample policy a plurality of times, based on the number of times of input requests for actions necessary for the reliability of the access control policy generated using the sample policy, the actions obtained by the input request to the user, and the patterns of the elements corresponding thereto to be equal to or higher than a predetermined threshold, the importance of the patterns of the uncovered elements may be determined. Thereby, since the policy generation system 21 can generate a highly reliable access control policy with fewer additional information requests, the cost required for policy generation can be reduced.

[0094] In addition, a total order set indicating the degree of influence on the action may be defined for the pattern of the element, and the action may also be defined by a total order set. The policy generation unit 213 can generate an access control policy such that the total order set associated with the pattern of the element and the total order set associated with the action are order-isomorphic. Thereby, the policy generation system 21 can make the action determined by the access control policy reflect the content of the action defined by the sample policy or the intention information.

[0095] In addition, the additional information request unit 215 may present to the user information regarding the reliability of the access control policy generated using the sample policy, the actions obtained by requesting input from the user, and the patterns of the corresponding elements. Thereby, the policy generation system 21 can cause the user to determine whether the access control policy that can be generated at the current time has sufficient reliability. Therefore, it is useful for the convenience of the user.

[0096] Note that the present invention is not limited to the above-described embodiments, and can be appropriately modified without departing from the gist thereof.

[0097] For example, the determination unit 22 can perform the following changes. As described above, the determination unit 22 uses the access control policy to determine the access control action when a request is made. Here, the determination unit 22 does not necessarily execute the process of referring to the data store 23 to obtain the background attributes corresponding to the request every time it receives a request. Before receiving the request, the determination unit 22 corrects the variables regarding the background attributes of the access control policy obtained from the policy generation unit 213 so that the current background attributes are reflected. Thereby, the determination unit 22 generates a temporary access control policy. As a result, as long as the current background attributes are not changed, the determination unit 22 does not need to refer to the data store 23 when receiving a request and determining an action, and only needs to refer to the elements in the request. In this way, by performing the two-stage operation, the determination unit 22 can determine an action more quickly when receiving a request. In addition, since the processing executed in one request can be reduced, the hardware of the control device on which the determination unit 22 is mounted can be made low-cost. Note that the policy generation system 21 may execute the generation of the temporary access control policy instead of the determination unit 22.

[0098] Here, the determination unit 22 may use only elements related to the attributes of the packet header included in the request (for example, at least one of the IP addresses of the access source or the access destination, the port number) as data to be input into the temporary access control policy. As a result, a general firewall, packet filter, SDN (Software Defined Network) switch, or V-LAN (Virtual Local Area Network) can be used as the enforcer 24 (access control device) for the control device on which the determination unit 22 is mounted. Therefore, the device related to the determination unit 22 can be configured with inexpensive devices.

[0099] In the above-described embodiments, this disclosure has been described in terms of the hardware configuration, but this disclosure is not limited thereto. This disclosure can also be realized by causing a processor in a computer to execute a computer program for the processes (steps) of the policy generation device or policy generation system described in the above embodiments.

[0100] FIG. 5 is a block diagram showing a hardware configuration example of an information processing apparatus (signal processing apparatus) in which the processes of the above-described embodiments are executed. Referring to FIG. 5, this information processing apparatus 90 includes a signal processing circuit 91, a processor 92, and a memory 93.

[0101] The signal processing circuit 91 is a circuit for processing signals in accordance with the control of the processor 92. Note that the signal processing circuit 91 may include a communication circuit that receives signals from a transmission device.

[0102] Processor 92 is connected to (coupled with) memory 93, and reads and executes software (computer program) from memory 93 to perform the processing of the device described in the above embodiments. As an example of processor 92, one of a CPU (Central Processing Unit), MPU (Micro Processing Unit), FPGA (Field-Programmable Gate Array), DSP (Demand-Side Platform), and ASIC (Application Specific Integrated Circuit) may be used, or a plurality of them may be used in parallel.

[0103] Memory 93 is composed of a volatile memory, a non-volatile memory, or a combination thereof. Memory 93 is not limited to one, and a plurality of them may be provided. Note that the volatile memory may be, for example, a RAM (Random Access Memory) such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The non-volatile memory may be, for example, a ROM (Random Only Memory) such as a PROM (Programmable Random Only Memory) or an EPROM (Erasable Programmable Read Only Memory), a flash memory, or an SSD (Solid State Drive).

[0104] Memory 93 is used to store one or more instructions. Here, the one or more instructions are stored in memory 93 as a software module group. Processor 92 can perform the processing described in the above embodiments by reading and executing these software module groups from memory 93.

[0105] Note that in addition to the memory 93 provided outside the processor 92, the memory 93 may also include a memory built into the processor 92. Further, the memory 93 may include a storage disposed apart from the processor constituting the processor 92. In this case, the processor 92 can access the memory 93 via an I / O (Input / Output) interface.

[0106] As described above, one or more processors included in each device in the above-described embodiments execute one or more programs including instruction groups for causing a computer to perform the algorithms described with reference to the drawings. By this processing, the signal processing methods described in each embodiment can be realized.

[0107] When the program is loaded into a computer, it includes an instruction group (or software code) for causing the computer to perform one or more functions described in the embodiment. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disk (DVD), Blu-ray (registered trademark) disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The program may be transmitted on a transient computer-readable medium or a communication medium. By way of example and not limitation, the transient computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0108] Although the present disclosure has been described with reference to the embodiments above, the present disclosure is not limited thereto. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the disclosure.

Description of Reference Numerals

[0109] 10 Information processing apparatus 11 Acquisition unit 12 Request unit 20 Access control system 21 Policy generation system 22 Determination unit 23 Data store 24 Enforcer 211 Determination sample acquisition unit 212 Intention acquisition unit 213 Policy generation unit 214 Parameter storage unit 215 Additional information request unit

Claims

1. An acquisition means for acquiring a dataset in which a plurality of combinations of a pattern of a plurality of elements indicating an attribute of access and an action of access control corresponding to the pattern of the elements are defined; A request means for requesting a user to input an action corresponding to a pattern of an element not covered by the dataset when the dataset does not cover an action corresponding to one or more patterns of elements that are preset patterns; An information processing apparatus comprising: Information processing apparatus.

2. When there are a plurality of patterns of elements not covered by the dataset, the request means determines the importance of action determination in the pattern of each uncovered element, and at least the pattern of the element with the highest importance. Request the user to input the corresponding action. The information processing apparatus according to claim 1.

3. When the action corresponding to the pattern of the first element is determined in the patterns of the first and second elements not covered by the dataset, the request means determines the action of the pattern of the second element. When the constraint conditions are determined but not vice versa, it is determined that the pattern of the first element has a higher importance than the pattern of the second element. The information processing apparatus according to claim 2.

4. The request means is based on at least any one of the number of element patterns covered by the dataset, the ratio of the number of covered element patterns to the number of preset patterns of elements, or the dataset, the action obtained by a user input request, and the pattern of the element corresponding thereto, or the reliability of the access control policy generated using the action obtained by the user input request and the pattern of the element corresponding thereto. Determine the importance. The information processing apparatus according to claim 3.

5. When the request means can sequentially request the user to input an action corresponding to a pattern of an element not covered by the dataset a plurality of times, according to the content of the action input by the user in response to the first request, It is possible to change the pattern of the element corresponding to the action for which input is requested in the second request after the first request. The information processing apparatus according to claim 2 or 3.

6. When the requesting means can sequentially request the user to input actions corresponding to patterns of elements not covered by the dataset a plurality of times, the importance is determined based on the number of times of input requests for actions necessary for the reliability of the access control policy generated using the dataset, the actions obtained by the input requests to the user, and the patterns of elements corresponding thereto to be equal to or higher than a predetermined threshold value. The information processing apparatus according to claim 5. **Claim 7** Further comprising generation means for generating an access control policy using the dataset, the action input by the user, and the pattern of elements corresponding thereto. A total order set indicating the degree of influence on the action is defined for the pattern of the element, and the action is also defined by a total order set. The generation means generates the access control policy so that the total order set associated with the pattern of the element and the total order set associated with the action are order-isomorphic. The information processing apparatus according to any one of claims 1 to 6. **Claim 8** The requesting means presents information regarding the reliability of the access control policy generated using the dataset, the action obtained by the input request to the user, and the pattern of elements corresponding thereto to the user. The information processing apparatus according to any one of claims 1 to 7. **Claim 9** Obtain a dataset in which a plurality of combinations of patterns of a plurality of elements indicating access attributes and access control actions corresponding to the patterns of the elements are defined. When the dataset does not cover the action corresponding to one or more patterns of elements and corresponds to a preset pattern, request the user to input an action corresponding to the pattern of the element not covered by the dataset. An information processing method executed by a computer. **Claim 10** Obtain a dataset in which a plurality of combinations of patterns of a plurality of elements indicating access attributes and access control actions corresponding to the patterns of the elements are defined. When the dataset does not cover the action corresponding to one or more patterns of elements and corresponds to a preset pattern, request the user to input an action corresponding to the pattern of the element not covered by the dataset. A program that causes a computer to execute something.

Images