Information processing device

Abstract

To provide an information processor that, when an incident occurs, quickly identifies a software component causing the incident and a responsible organization, and quickly implements a countermeasure against the incident.SOLUTION: An information processor includes: an alert acquisition unit that acquires alert information; a component extraction unit that extracts a software component that requires a countermeasure based on the alert information; a notification destination determination unit that determines notification information including information about an organization that can take a countermeasure against the software component; an accuracy setting unit that sets accuracy of the notification information; and a notification unit that notifies, when the accuracy is greater than or equal to a predetermined threshold, the organization of the software component.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing apparatus, and more particularly to an information processing apparatus that, when an alert occurs, is able to identify the software component that caused the alert and quickly take measures. [Background technology]

[0002] As the IoT advances, connecting all kinds of things to the Internet, ensuring the security of IoT devices has become one of the most important social issues. In particular, when IoT devices are automobiles such as connected cars and self-driving cars, security attacks on automobiles can threaten human safety, and there is a demand for technology that can minimize such safety damage.

[0003] For this reason, in recent years, automotive SOCs (Vehicle Security Operation Centers (VSOCs)) have been considered to manage security during operation after a vehicle is shipped. In a VSOC, when an alert indicating an incident occurs, the company must respond in-house, including correcting the software component that caused the incident. To identify and correct the cause, it is necessary to share information with responsible organizations such as the development department and suppliers, and request appropriate investigations and responses.

[0004] However, selecting the responsible organization for each software and accurately sharing the information that organization needs takes a significant amount of time and effort. Furthermore, the number of connected cars is increasing, and the number of vehicles monitored by VSOCs is becoming larger. Furthermore, the methods of attacking automobiles are expected to become more diverse. In such an environment, when a new alert is detected, analysis takes time, increasing the workload of operators and analysts.

[0005] Patent Document 1 discloses a system that receives reports of problems, such as bug reports, for software, and sends the reports of the problems to registered software developers from the corresponding developer organization. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2016-173844 Summary of the Invention [Problem to be solved by the invention]

[0007] However, the technology disclosed in Patent Document 1 cannot handle the correction of report contents, confirmation of accuracy, or handling of feedback information from report recipients, and so the workload of operators and analysts is not sufficiently reduced.

[0008] The present invention has been made in consideration of the above points, and aims to provide an information processing device that, when an incident occurs, can quickly identify the software component or responsible organization that caused the incident and quickly implement incident countermeasures. [Means for solving the problem]

[0009] An example of an information processing device according to the present invention includes an alert acquisition unit that acquires alert information, a component extraction unit that extracts software components that require countermeasures based on the alert information, a notification destination determination unit that determines organizations that can take countermeasures for the software components and decides notification information to notify the organizations, a reliability setting unit that sets the reliability of the notification information, and a notification unit that notifies the organizations of the software components if the reliability is equal to or greater than a predetermined threshold. [Effects of the Invention]

[0010] According to the present invention, when an incident occurs, it becomes possible to quickly identify the software component that caused the incident and the organization responsible, and to quickly implement measures to deal with the incident. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. Furthermore, problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a functional block diagram showing the functional configuration of an information processing apparatus according to an embodiment of the present invention. [Figure 2] FIG. 1 is a diagram showing an overview of the entire process that an information processing apparatus according to an embodiment of the present invention executes in cooperation with an external entity when it receives an alert. [Figure 3] FIG. 10 is a diagram showing a process in which a mapping unit generates a mapped alert. [Figure 4] FIG. 10 is a diagram showing a process in which a component extraction unit generates a component-extracted alert. [Figure 5] FIG. 10 is a diagram showing a process in which a notification destination determination unit generates notification information. [Figure 6] FIG. 10 is a diagram showing a process in which a reliability setting unit generates reliability setting notification information. [Figure 7] FIG. 10 is a diagram showing a processing flow that a notification unit performs on certainty-set notification information. [Figure 8] FIG. 10 is a diagram showing a process in which a DB update unit updates each database. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, the present invention will be described in detail using examples with reference to the drawings.

[0013] First, a functional configuration of an information processing device 1 according to an embodiment of the present invention will be described. Note that the information processing device 1 may be, for example, a computer equipped with a memory and a processor as a hardware configuration, or may be a cloud implemented on a server.

[0014] The information processing device 1 includes an alert acquisition unit 11, a mapping unit 12, a component extraction unit 13, a notification destination determination unit 14, a reliability setting unit 15, a notification unit 16, a feedback reflection unit 17, a DB (database) update unit 18, and a storage unit 100. The storage unit 100 also stores an alert threat DB 101, a countermeasure DB 102, a countermeasure software DB 103, a responsible organization DB 104, and a feedback DB 105. Details of these functional units and databases will be described later.

[0015] The information processing device 1 is also connected to multiple external entities 3 via a communication path 2 connected to a communication interface (not shown) of the information processing device 1. The communication path 2 may physically include multiple communication buses, and the standards of each communication bus may be the same or different. The external entity 3 receives messages from the information processing device 1 via the communication path 2 and transmits messages to the information processing device 1 via the communication path 2. In this embodiment, the term "external entity" refers to an external / internal system including a SIEM, which exchanges information with the information processing device 1, as described below, and an external / internal organization including a PSIRT analyst, etc.

[0016] The functional block diagram shown in Fig. 1 is an example, and the units and names of the functions are not limited to this. For example, the functions realized by the component extractor 13 in this embodiment may be realized by other functional units shown in Fig. 1, or may be realized by functional units not shown in Fig. 1. Furthermore, the alert acquirer 11 may have the above-mentioned communication interface function.

[0017] 2 is a diagram illustrating an overview of the overall processing that an information processing device according to an embodiment of the present invention executes in cooperation with an external entity when it receives an alert. Here, an alert is a warning indicating the occurrence or possibility of an incident, and an incident refers to some kind of trouble that occurs in an electronic device, such as an electronic device installed in a vehicle malfunctioning or not starting up. In the diagram, dotted arrows represent information references to databases, which are data collections stored in hardware such as memory or software on the cloud, and solid arrows represent information transmissions.

[0018] 2 is a process executed by the CPU while each functional unit of the information processing device 1 refers to each database in the storage unit 100. Here, among the databases, information in the alert threat DB 101, countermeasure DB 102, countermeasure software DB 103, and responsible organization DB 104 has been generated in advance by the PSIRT analyst 32.

[0019] The aforementioned PSIRT is an abbreviation for Product Security Incident Response Team, and refers to an organization that improves the security level and responds to incidents in products and services manufactured and developed in-house. In other words, PSIRT has a detailed understanding of errors that may occur in products (devices, software components, etc.) that have the potential to cause incidents, as well as countermeasures for such errors, and is able to organize and build this information in a database.

[0020] The PSIRT analyst 32 can create each of the above-mentioned databases by appropriately referring to the detailed design (specification) 19 of each product, the SBOM (Software Bill of Materials) 20 that shows the specifications of the software components, the results 21 of the risk assessment performed on each product, and the rules 22 for generating alerts.

[0021] Next, we will explain the processing that is performed while referencing these databases. When an alert is issued from any device, etc., the alert is sent from SIEM 31, which is one of the external entities 3, to the alert acquisition unit 11 of the information processing device 1. Here, SIEM is an abbreviation for Security Information and Event Management, and refers to a security product that centrally manages and analyzes logs from all IT devices, including network products and security products, and detects threats that could lead to incidents.

[0022] When the alert acquisition unit 11 acquires an alert, it is transferred to the mapping unit 12. The mapping unit 12 performs mapping by assigning a threat ID and a countermeasure ID to the alert by referring to the alert threat DB 101 and the countermeasure DB 102. The mapping result is transferred to the component extraction unit 13.

[0023] Upon receiving the mapping result, the component extraction unit 13 refers to the countermeasure software DB 103 and extracts software components related to the countermeasure ID. The extraction result is transferred to the notification destination determination unit 14.

[0024] The notification destination determination unit 14 refers to the responsible organization DB 104 to determine an organization that can implement measures for the extracted software component, and also determines the information to be notified to that organization. Then, notification information is generated that includes the organization selected as a result of the determination and the content of the notification. The notification information is transferred to the accuracy setting unit 15.

[0025] The accuracy setting unit 15 sets an accuracy for the received notification information by referring to the feedback DB 105. Here, accuracy refers to the likelihood that the notification destination and notification content included in the notification information correctly correspond to the alert acquired by the alert acquisition unit 11. The notification information with the accuracy set is transferred to the notification unit 16.

[0026] The notification unit 16 compares the accuracy of the received notification information with a predetermined threshold. If the accuracy is equal to or greater than the predetermined threshold, it forwards the information to the organization that is the notification destination. If the accuracy is less than the predetermined threshold, it sends the information to an analyst 33, which is one of the external entities 3. Here, the analyst 33 is an expert (a specialized analysis organization) that typically monitors, detects, analyzes, and responds to cybersecurity incidents 24 hours a day, 365 days a year. The analyst 33 analyzes notification information with low accuracy, and if it determines that the notification information corresponds correctly to the alert, it approves the notification information and sends it to the notification unit 16. If the notification information does not correspond correctly to the alert, it changes or modifies it to information that corresponds correctly to the alert and sends it to the notification unit 16.

[0027] The notification unit 16 then transmits the approved / changed notification information received from the analyst 33 as notification information to the notification destination 34. If the notification information received from the analyst 33 is changed, the notification unit 16 transfers the change information to the DB update unit 18.

[0028] When the notification destination 34 receives the notification information from the notification unit 16, it makes a final decision as to whether the notification information correctly corresponds to the alert. Then, it sends the result of this decision to the feedback reflection unit 17.

[0029] The feedback reflecting unit 17 transfers the feedback information received from the notification destination 34 to the notification unit 16 and the DB update unit 18. This feedback accurately indicates whether the notification information sent by the notification unit 16 to the notification destination 34 correctly corresponds to the alert.

[0030] The notification unit 16 receives the feedback information and modifies the notification information. The DB update unit 18 stores the received modification information and feedback information in the feedback DB 105.

[0031] Next, the processing executed by each functional unit will be described in further detail with reference to FIGS.

[0032] 3 is a diagram showing details of the process in which the mapping unit 12 generates a mapped alert. The alert threat DB 101 is a database that stores information on threats related to issued alerts (modules targeted by attack, protected assets targeted by attack, source of attack, reason for attack, threat events). The countermeasure DB 102 is a database that stores information on threats related to issued alerts (modules targeted by attack, protected assets targeted by attack, source of attack, reason for attack, threat events). 101 It is a database that stores a list of countermeasures to be taken for each threat stored in the database.

[0033] First, it is assumed that the alert transferred from the alert acquisition unit 11 has an alert type of IVI-Navi-Error123 and has an alert ID of A123.

[0034] The mapping unit 12 searches for a threat related to the received alert by referring to the alert threat DB 101. In this embodiment, it is found from the alert threat DB 101 shown in Fig. 3 that the received alert is related to a threat with a threat ID: T1, which is an intentional misoperation of a function of a car navigation system in an IVI (In-Vehicle Infotainment system) caused by a NW (Network) 1.

[0035] Then, the countermeasures to be implemented for the threat ID: T1 are searched for by referring to the countermeasure DB 102. In this embodiment, it is found that two types of countermeasures, each assigned with countermeasure IDs: M1 and M2, are set for the threat ID: T1.

[0036] Based on the above processing, the mapping unit 12 generates a mapped alert by assigning a threat ID and a countermeasure ID to the alert, and transfers it to the component extraction unit 13.

[0037] 4 is a diagram showing the process of generating a component-extracted alert, which is performed by the component extraction unit 13 upon receiving a mapped alert from the mapping unit 12. The countermeasure software DB 103 stores software components corresponding to each countermeasure stored in the countermeasure DB 102. In other words, it stores software components that can execute the countermeasure.

[0038] The component extraction unit 13 that receives the mapped alert searches for a software component corresponding to the countermeasure ID assigned to the mapped alert, with reference to the countermeasure software DB 103. In this embodiment, it is found that the software component SW1 corresponds to the countermeasure content assigned countermeasure ID: M1, and the software component SW2 corresponds to the countermeasure content assigned countermeasure ID: M2.

[0039] The component extractor 13 then adds component information to the mapped alert to generate a component-extracted alert, and transfers the generated component-extracted alert to the notification destination determiner 14.

[0040] FIG. 5 is a diagram showing the process of generating notification information, which is performed by the notification destination determination unit 14 upon receiving a component extraction alert from the component extraction unit 13. The responsible organization DB 104 stores organizations associated with each software component stored in the countermeasure software DB 103. In the case of a company, an organization associated with a software component may be, for example, the department that developed the software component or the department responsible for maintenance. In the case of another company, an organization associated with the software component may be, for example, the responsible department within the company. The number of such organizations is not limited to one; there may be multiple organizations, for example, when a software component is jointly developed or when development and maintenance are performed by different organizations. The responsible organization DB 104 also stores the content of information to be notified to each organization. As with the above, there may be multiple notification contents depending on the role of the organization, etc.

[0041] The notification destination determination unit 14 searches for organizations related to each software component by referring to the responsible organization DB 104. In this embodiment, it is found that the notification content shown in the figure should be notified to organizations O1 and O2 for software component SW1, and to organization O3 for software component SW2.

[0042] Through the above process, the notification destination determination unit 14 generates notification information by adding the notification destination and notification content to the alert content. Note that, as shown in Fig. 5, alerts having the same alert type may be combined into one notification. The generated notification information is transferred to the accuracy setting unit 15.

[0043] FIG. 6 is a diagram showing the process of generating notification information with accuracy set, which is performed by the accuracy setting unit 15 upon receiving notification information from the notification destination determination unit 14. The feedback DB 105 is a database that stores change information and feedback information obtained through a series of processes that have been performed up to that point. All alert information having a notification number includes an alert type, a countermeasure ID, an extracted software component, a notification destination, and notification content. Once a series of processes is performed, feedback is obtained from the analyst 33 or the notification destination 34, as explained in the process overview of FIG. 2. In other words, feedback on whether the notification information generated by the notification unit 16 was ultimately correct is stored.

[0044] The accuracy setting unit 15 sets the accuracy of the notification information by referring to this feedback DB 105. Specifically, in the case of notification information No. 45 in FIG. 6, when the threat ID is 1, the countermeasure ID is M1, and the extracted software component is SW1, one of the notification destinations was set to O1. In this case, 12 similar notifications are stored in the feedback DB 105, and it indicates that in 10 of those, or 83%, the notification destination was O1 and was correct. Similarly, with regard to the notification destination being O2, it indicates that in 8 of the 12, or 66%, the notification destination was O2 and was correct. In other words, this indicates that in 4 of the 12 cases, O2 was incorrect as the notification destination.

[0045] Similarly, the notification content is compared with the feedback stored in the feedback DB 105, and the degree to which the notification content was correct is set as a degree of accuracy. In this way, the accuracy setting unit 15 generates accuracy-set notification information. The generated accuracy-set notification information is transferred to the notification unit 16.

[0046] FIG. 7 is a diagram showing the process performed by the notification unit 16 when it receives the accuracy setting notification information from the accuracy setting unit 15. As shown in FIG.

[0047] The notification unit 16, which has received the notification information with accuracy set, determines the accuracy of the notification destination and notification content included in the notification information. Here, the notification unit 16 stores a threshold value for accuracy, and if the accuracy of either the notification destination or the notification content is below the threshold, it determines that there is a relatively high possibility that the notification destination or the notification content is incorrect, and sends the notification information to an analyst (analysis organization) 33 for detailed analysis. If the accuracy is above the threshold, it determines that detailed analysis is not necessary, and sends the notification information directly to the notification destination (organization that can take measures) 34. The threshold value for accuracy can be set as appropriate, for example, to 75% for accuracy and 5 for the number of feedbacks. This threshold value may differ for each alert type and may be updated daily.

[0048] In this way, in this embodiment, by setting a degree of certainty in the notification information, if the degree of certainty of the notification information is relatively high, detailed analysis by an analyst can be omitted and the information can be sent directly to the notification recipient, allowing the content of the alert to be shared quickly and significantly reducing the time it takes to implement countermeasures for the alert.

[0049] When the accuracy of the notification information is low and the notification information is sent to the analyst 33, the analyst 33 analyzes the notification information in detail, and if there are any parts that need to be changed, returns change information including the changes to the notification unit 16. Upon receiving the change information, the notification unit 16 corrects the notification information based on the change information and sends it to the notification destination 34. At the same time, the change information is sent to the DB update unit 18.

[0050] The notification destination 34 that has received the notification information makes a final decision as to whether the notification information is correct or not, and transmits the result as feedback information to the feedback reflection unit 17. The feedback reflection unit 17 generates final feedback information based on the received feedback information, and transmits the generated feedback information to the notification unit 16 and the DB update unit 18.

[0051] The notification unit 16 may not only notify the notification destination 34 of the above notification information, but also information about the software component included in the notification information and the notification source of the countermeasure information. The notification destination 34 can use this information to improve the accuracy of analysis.

[0052] The DB update unit 18 stores the received change information and feedback information in the feedback DB 105. The reason for storing both the change information and the feedback information is that the change information is the content of changes made by the analyst 33's analysis, and the feedback information is the final feedback from the notification destination 34. Therefore, by clarifying the differences between them, the analyst can 33 This is because it is expected to improve analytical accuracy.

[0053] In this way, according to this embodiment, the database is updated based on the final feedback received from the destination for the notification information that was initially generated, which is expected to improve the accuracy of the initial information generated when an alert is issued.

[0054] 8 is a diagram showing the process of updating each database performed by the DB update unit 18. The DB update unit 18 compares the final feedback information received from the notification destination 34 with the information stored in the database before processing, and generates a proposal for the database to be updated and its contents.

[0055] In this embodiment, for example, with regard to the notification information of notification No. 45 shown in Fig. 7 etc., the countermeasure software DB 103 at the time of generating the notification information stored that software component SW2 corresponded to countermeasure ID: M2, but this was determined to be an error for software component SW3, and this change is included as a proposal. Furthermore, with the update of the countermeasure software DB 103, the responsible organization DB 104 also includes as a proposal a change to the responsible organization and notification content corresponding to software component SW3.

[0056] The DB update unit 18 sends the DB update proposal obtained by the above process to the PSIRT analyst 35, requesting its approval or further changes. The update proposal returned from the PSIRT analyst 35 is then used as the final proposal to update each database.

[0057] In this way, each database is updated based on the feedback information obtained, which makes it possible to improve the accuracy of notification information generation, reduce the amount of notification information that requires detailed analysis by analysts, and is expected to shorten the time it takes to share information and implement countermeasures.

[0058] According to the embodiment of the present invention described above, the following advantageous effects are achieved. (1) An information processing device according to one embodiment of the present invention includes an alert acquisition unit that acquires alert information, a component extraction unit that extracts software components that require countermeasures based on the alert information, a notification destination determination unit that determines organizations that can take countermeasures for the software components and determines notification information to notify the organizations, a reliability setting unit that sets the reliability of the notification information, and a notification unit that notifies the organizations of the software components if the reliability is equal to or greater than a predetermined threshold.

[0059] With the above configuration, when an incident occurs, it becomes possible to quickly identify the software component that caused the incident and the organization responsible, and to quickly implement measures to deal with the incident.

[0060] (2) A mapping unit is further provided that assigns threat information indicating information about threats related to the alert information and countermeasure information corresponding to the threat information to the alert information, and the component extraction unit extracts software components based on the assignment results of the mapping unit. This allows more information to be used when extracting software components, which is expected to improve the accuracy of software component extraction.

[0061] (3) When the accuracy of the notification information is less than a threshold, the notification unit notifies the analysis organization of the notification information, and when change information is received from the analysis organization, notifies the organization of the software component and countermeasure information based on the change information. This allows the analysis organization to analyze notification information with low accuracy, thereby avoiding the problem of sending low-accuracy information to the notification destination organization and taking extra time for analysis within the organization.

[0062] (4) If the accuracy of the notification information is equal to or greater than a threshold, the notification unit notifies the organization of the software component and the countermeasure information without notifying the analysis organization of the notification information. This allows information with a relatively high accuracy to be sent to the notification destination organization quickly, thereby reducing the time required to implement countermeasures.

[0063] (5) The system further includes a feedback reflection unit that updates the notification information based on feedback information received from the organization. This allows the notification information to reflect the correct information finally determined by the organization to which the notification is sent, which is expected to improve the accuracy of subsequent analyses.

[0064] (6) An alert threat database that stores a correspondence between types of alert information and threat information indicating information on threats related to the type, a countermeasure database that stores a correspondence between threat information and countermeasures, a countermeasure software database that stores a correspondence between countermeasures and software components, a responsible organization database that stores a correspondence between responsible organizations and pairs of countermeasures and software components, and a feedback database that stores feedback information and change information on notification information. By providing these components, it is expected that the convenience of the present invention will be improved.

[0065] (7) A DB update unit is further provided that updates the alert threat database, countermeasure database, countermeasure software database, responsible organization database, and feedback database based on feedback information and change information. This ensures that the information in each database is updated to the correct information, which is expected to improve the accuracy of each process.

[0066] (8) The Notification Department notifies the organization of the software component and the organization that sent the countermeasure information. This allows the organization that receives the notification information to refer to the information about the organization that sent the notification and analyze the notification information more appropriately.

[0067] The present invention is not limited to the above-described embodiments, and various modifications are possible. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to embodiments including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment. It is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to delete part of the configuration of each embodiment, or to add or replace other configurations. [Explanation of symbols]

[0068] 1 Information processing device, 3 External entity, 11 Alert acquisition unit, 12 Mapping unit, 13 Component extraction unit, 14 Notification destination determination unit, 15 Accuracy setting unit, 16 Notification unit, 17 Feedback reflection unit, 18 DB update unit, 34 Notification destination, 101 Alert threat DB, 102 Countermeasure DB, 103 Countermeasure software DB, 104 Responsible organization DB, 105 Feedback DB

Claims

1. an alert acquisition unit that acquires alert information; a component extraction unit that extracts software components that require countermeasures based on the alert information; a notification destination determination unit that determines an organization that can take the countermeasure for the software component and determines notification information to be notified to the organization; an accuracy setting unit that sets the accuracy of the notification information; a notification unit that notifies the organization of the software component when the certainty is equal to or greater than a predetermined threshold; a mapping unit that assigns, to the alert information, threat information indicating information about a threat related to the alert information and countermeasure information corresponding to the threat information, the component extraction unit extracts the software components based on the assignment result of the mapping unit; 1. An information processing device comprising:

2. 2. The information processing device according to claim 1, the notification unit notifies the analysis organization of the notification information when the accuracy of the notification information is less than the threshold, and when change information is received from the analysis organization, notifies the organization of the software component and the countermeasure information based on the change information.

1. An information processing device comprising:

3. 3. The information processing device according to claim 2, when the accuracy of the notification information is equal to or greater than the threshold, the notification unit notifies the organization of the software component and the countermeasure information without notifying the analysis organization of the notification information; 1. An information processing device comprising:

4. an alert acquisition unit that acquires alert information; a component extraction unit that extracts software components that require countermeasures based on the alert information; a notification destination determination unit that determines an organization that can take the countermeasure for the software component and determines notification information to be notified to the organization; an accuracy setting unit that sets the accuracy of the notification information; a notification unit that notifies the organization of the software component when the certainty is equal to or greater than a predetermined threshold; a feedback reflecting unit that updates the notification information based on feedback information acquired from the organization, 1. An information processing device comprising:

5. 5. The information processing device according to claim 4, an alert threat database that stores the type of alert information and threat information indicating information on threats related to the type in association with each other; a countermeasure database that stores the threat information and the countermeasures in association with each other; a countermeasure software database that stores the countermeasures and the software components in association with each other; a responsible organization database that stores a responsible organization in association with each pair of the countermeasure and the software component; a feedback database that stores the feedback information and change information of the notification information.

1. An information processing device comprising:

6. 6. The information processing device according to claim 5, An information processing device further comprising a database update unit that updates the alert threat database, the countermeasure database, the countermeasure software database, the responsible organization database, and the feedback database based on the feedback information and the change information.

7. 2. The information processing device according to claim 1, the notification unit notifies the organization of information about the software component and the organization that has notified the countermeasure information.

1. An information processing device comprising:

Images