POLICY MANAGEMENT APPARATUS, POLICY MANAGEMENT METHOD AND PROGRAM

Abstract

A policy management device (10) according to an embodiment of the present disclosure comprises: an acquisition unit (11) that acquires first and second access control policies; and a conversion unit (12) that converts the first and second access control policies and generates a third access control policy. The first access control policy defines a first condition including one or more elements indicating access attributes, and a first action for access control. The second access control policy defines a second condition which includes one or more elements indicating access attributes and which is different from the first condition, and a second action which is different from the first action. The third access control policy defines a third condition different from both the first and second conditions, and a third action for access control. The third condition includes one or more elements indicating access attributes and the number of the elements is equal to or less than the numbers of the elements in the first and second conditions.

Description

Policy management device, policy management method and non-transitory computer-readable medium

[0001] The present disclosure relates to a policy management apparatus, a policy management method, and a non-transitory computer-readable medium.

[0002] Access control in a network is important to network security and maintaining necessary access.

[0003] For example, Patent Document 1 discloses a policy management device that creates an access control matrix from an access control list to create a minimum access control list with the minimum number of access control rules.

[0004] Japanese Patent Application Laid-Open No. 2007-226495

[0005] An access control policy defines conditions that combine multiple elements that indicate access attributes, and access control actions that correspond to those conditions. In many cases, the conditions of such a policy combine many elements. Furthermore, many such policies can be generated based on various perspectives. Therefore, the generated policies can be very complex overall, making it difficult for users to check the policies, or it can take a lot of time to check them.

[0006] The present disclosure provides a policy management apparatus, a policy management method, and a non-transitory computer-readable medium that can facilitate checking of access control policies.

[0007] A policy management device according to one embodiment includes an acquisition unit for acquiring a first access control policy and a second access control policy, and a conversion unit for converting the first and second access control policies to generate a third access control policy. The first access control policy defines a first condition including one or more elements indicating an access attribute and a first access control action corresponding to the first condition. The second access control policy defines a second condition including one or more elements indicating an access attribute and different from the first condition, and a second action corresponding to the second condition and different from the first action. The third access control policy defines a third condition different from both the first and second conditions and a third access control action corresponding to the third condition. The third condition includes one or more elements indicating an access attribute, and the number of elements is equal to or less than the number of elements in the first condition and is equal to or less than the number of elements in the second condition.

[0008] A policy management method according to one embodiment is executed by a computer to acquire a first access control policy and a second access control policy, and generate a third access control policy by converting the first and second access control policies. The first access control policy defines a first condition including one or more elements indicating an access attribute and a first access control action corresponding to the first condition. The second access control policy defines a second condition including one or more elements indicating an access attribute and different from the first condition, and a second action corresponding to the second condition and different from the first action. The third access control policy defines a third condition different from both the first and second conditions and a third access control action corresponding to the third condition. The third condition includes one or more elements indicating an access attribute, and the number of elements is equal to or less than the number of elements in the first condition and is equal to or less than the number of elements in the second condition.

[0009] According to one embodiment, a non-transitory computer-readable medium stores a program for causing a computer to acquire a first access control policy and a second access control policy and generate a third access control policy by converting the first and second access control policies. The first access control policy defines a first condition including one or more elements indicating an access attribute and a first access control action corresponding to the first condition. The second access control policy defines a second condition including one or more elements indicating an access attribute and different from the first condition, and a second action corresponding to the second condition and different from the first action. The third access control policy defines a third condition different from both the first and second conditions and a third access control action corresponding to the third condition. The third condition includes one or more elements indicating an access attribute, and the number of elements is equal to or less than the number of elements in the first condition and is equal to or less than the number of elements in the second condition.

[0010] This disclosure makes it possible to provide a policy management device, a policy management method, and a non-transitory computer-readable medium that can facilitate checking of access control policies.

[0011] 1 is a block diagram showing an example of a policy management apparatus according to a first embodiment. FIG. 2 is a flowchart showing an example of a representative process of the policy management apparatus according to the first embodiment. FIG. 3 is a block diagram showing an example of a policy management system according to a second embodiment. FIG. 4 is a diagram showing an image when a visualization analysis unit organizes and visualizes an access control policy. FIG. 5 is an example of an access control policy displayed on a display unit. FIG. 6 is an example of an access control policy before processing by a complexity reduction unit. FIG. 7 is an example of an access control policy after processing by a complexity reduction unit. FIG. 8 is an example of information of access rights displayed on a display unit. FIG. 9 is a diagram showing an image when a visualization analysis unit organizes and visualizes information of access rights. FIG. 10 is an example of information of additional access rights displayed on a display unit. FIG. 11 is a flowchart showing an example of a representative process of a policy management system according to a second embodiment. FIG. 12 is a flowchart showing an example of a representative process of a policy management system according to a second embodiment. FIG. 13 is a block diagram showing an example of a hardware configuration of an apparatus according to each embodiment.

[0012] Hereinafter, each embodiment will be described with reference to the drawings. Note that the following description and drawings have been omitted or simplified as appropriate for clarity of explanation. Furthermore, in this disclosure, unless otherwise specified, when multiple items are defined as "at least one of them," the definition may mean any one item or any multiple items (including all items).

[0013] 1 is a block diagram showing an example of a policy management device. The policy management device 10 includes an acquisition unit 11 and a conversion unit 12. Each unit (means) of the policy management device 10 is controlled by a control unit (controller) (not shown). Each unit will be described below.

[0014] [Configuration Description] The acquisition unit 11 acquires a first access control policy and a second access control policy that is different from the first access control policy. The access control policy is a rule that serves as a criterion for determining whether or not access is permitted in a target network. The first access control policy defines a first condition including one or more elements that indicate access attributes and a first access control action corresponding to the first condition. The second access control policy defines a second condition including one or more elements that indicate access attributes and a second access control action corresponding to the second condition. Here, the first condition and the second condition are different conditions. Furthermore, in at least one pair of the first access control policy and the second access control policy, the first action and the second action can be different actions.

[0015] For example, if there is one pair of a first access control policy and a second access control policy, the first action in the first access control policy and the second action in the second access control policy are different actions. Also, if there are multiple (e.g., many) pairs of a first access control policy and a second access control policy, the first action and the second action in at least one pair of the first access control policy and the second access control policy are different actions. In this case, the first action and the second action may be different actions in all pairs of the first access control policy and the second access control policy, or the first action and the second action may be the same action in at least one pair.

[0016] Here, the "element indicating the attribute of the access" in the first and second conditions refers to any element that specifies the nature of the access. Specific examples of the element may include one or more pieces of specific information (values) related to the nature of the access, such as (1) various data of the access source, (2) various data of the access destination, and (3) other data indicating the nature of the access.

[0017] (1) Specific examples of various data (Subject Attributes) of the access source include any one or more of information on the ID (ID) of the access source, information on the user, information on the device from which the access originated, information on the Internet Protocol (IP) address of the access source, information on a port number, a software name (e.g., an application name), and an access authentication method. Here, the information on the ID of the access source includes any one or more of the ID (user ID) of the access source, a user name, a device ID, an application ID, and a user authentication result (authentication history) of the ID of the access source. The information on the user includes any one or more of the user's affiliation (organization), job title, occupation, user location (or the location of the device from which the access originated), the affiliation of the device from which the access originated, and the behavioral anomaly level of the user or the device from which the access originated. The information on the device from which the access originated includes any one or more of the version of the operating system (OS) used by the device from which the access originated and the manufacturer name. The information on the IP address of the access source includes any one or more of the IP address of the access originated, the risk level of the IP address of the access originated, and the like. In the above, the OS version indicates vulnerability in access, and the behavioral anomaly level indicates the possibility of an attack.

[0018] (2) Specific examples of various data (Object Attributes) of the destination include any one or more of information on the ID of the destination, information on the data of the destination, the address of the destination (e.g., IP address or web address), information on the OS used by the destination device, operation type, etc. Information on the ID of the destination includes any one or more of information on the resource ID of the destination, the name of the owner of the resource ID of the destination, etc. Information on the data of the destination includes any one or more of information on the organization of the destination (organization that owns the resource), the type of data (resource) of the destination that is being requested, the creator, the creation date and time, confidentiality, etc. The confidentiality of a resource indicates the expected damage in the event of an attack.

[0019] (3) Specific examples of data indicating the nature of other access include any one or more of the following: the frequency of requests from the access source ID to the resource ID of the access destination; the time period (or time) of access; the session key method; the importance of the resource to the requesting subject; the level of traffic such as bandwidth usage; the degree of network abnormality in the access; the encryption strength of the traffic; and various data related to authentication. The various data related to authentication include any one or more of the following: various authentication methods (including, for example, information on authentication strength), device authentication results, application authentication results, various authentication times, and the number of various authentication failures. The importance of the resource to the requesting subject indicates the usability of access, and bandwidth usage indicates the possibility of performance degradation when controlling multiple accesses. However, the elements listed above are merely examples, and elements indicating access attributes are not limited to these.

[0020] "One or more elements indicating the attributes of access" means that one or more of these elements are present. For example, assume that X, Y, and Z are attributes of access, and assume that X1 and X2 are elements with different values ​​of the same attribute X, Y1 and Y2 are elements with different values ​​of the same attribute Y, and Z1 and Z2 are elements with different values ​​of the same attribute Z. In this case, "one or more elements indicating the attributes of access" corresponds to any set from among "X1," "Y1," "Z1," "X2," "Y2," "Z2," "X1,Y1," "X1,Z1," "Y1,Z1," "X1,Y2," ... "X1,Y1,Z1" ... "X2,Y2,Z2."

[0021] As described above, the first condition and the second condition are different conditions. More specifically, this means that at least one or more elements of the first condition and the second condition are different. This means that when the first condition and the second condition are compared, at least one of the following applies: (i) at least one or more elements included in one condition are not included in the other condition; or (ii) at least one or more elements included in one condition have different values ​​for the same access attribute in the other condition.

[0022] For example, as described above, if X, Y, and Z are attributes of access, and two different values ​​of elements are assumed for each of X, Y, and Z, and "X1, Y1" is assumed as the first condition, the second condition can be any set among the above sets except for "X1, Y1." As a first example, the second condition may be "X2, Y1," which relates to the same attribute X as "X1" in the first condition, but has a different value "X2" instead of "X1." As a second example, the second condition may be "Y1, Z1," which relates to an attribute Z that is different from "X1" in the first condition and has "Z1" instead of "X1." Furthermore, as a third example, the second condition may be "X2, Y1, Z1," which further includes "Z1," a value for attribute Z not included in the first condition, and has "X2" instead of "X1." As a fourth example, the second condition may be "X2" that does not include "Y1" in the first condition and includes "X2" instead of "X1". The first example is an example of (ii), the second example is an example of (i), and the third and fourth examples are examples of (i) and (ii). The first and second conditions are defined as above.

[0023] In addition, in an access control policy, the access control action defined for a condition can be two or more different types of actions. For example, two or more types of actions may be defined from among permission, prohibition, and conditional permission (additional authentication request). However, the actions shown above are merely examples, and the types of actions are not limited to these.

[0024] For example, if "X1, Y1" is defined as the first condition of a first access control policy and the first action of access control corresponding to that condition is defined as "permit," the first access control policy is defined as "X1, Y1 ⇒ permit." If "X2, Y1" is defined as the second condition of a second access control policy and the second action of access control corresponding to that condition is defined as "prohibit," the second access control policy is defined as "X2, Y1 ⇒ prohibit."

[0025] The acquisition unit 11 is configured with an interface that acquires information from inside or outside the policy management device 10. The acquisition process may be performed automatically by the acquisition unit 11 or by manual input. When the first and second access control policies are acquired from inside the policy management device 10, the first and second access control policies may be generated by the policy management device 10 or may be generated by another device.

[0026] The conversion unit 12 converts the first and second access control policies to generate a third access control policy that is different from both the first and second access control policies. The third access control policy defines a third condition including one or more elements indicating an access attribute and a third access control action corresponding to the third condition. Here, the third condition is a condition in which the number of elements indicating the access attribute is equal to or less than the number of elements in the first condition and equal to or less than the number of elements in the second condition, and is different from both the first and second conditions.

[0027] For example, if the first condition of the first access control policy is defined as "X1, Y1" and the second condition of the second access control policy is defined as "X2, Y1," the third condition of the third access control policy will be as follows: The third condition may be "Y1," which is the first and second conditions excluding the element related to the access attribute "X," or it may be "X3, Y1." Here, the element "X3" is a group of the element "X1" of the first condition and the element "X2" of the second condition, both related to the same access attribute "X," and the element "X3" includes the elements "X1" and "X2." In other words, the element "X3" is a superordinate concept of the elements "X1" and "X2." Furthermore, when the element "Y3" is defined as an element superordinate to the element "Y1," the third condition may be "Y3" or "X3, Y3."

[0028] As another example, if the first condition is defined as "X1, Y1" and the second condition is defined as "X2, Y1, Z1," the third condition may be, for example, any of "Y1," "Y3," "X3, Y1," or "X3, Y3." In this case, an element related to the access attribute "Z" that is not included in the first condition but is included in the second condition can be excluded from the third condition.

[0029] As yet another example, if the first condition is defined as "X1, Y1" and the second condition is defined as "Y2, Z1," the third condition may be, for example, "Y4," or "X1, Y4," or "Y4, Z1." The element "Y4" is a grouping of the element "Y1" of the first condition and the element "Y2" of the second condition, which relate to the same access attribute "Y," and the element "Y4" includes the elements "Y1" and "Y2."

[0030] As described above, the third condition differs from both the first condition and the second condition in at least one of its constituent elements. This detailed definition is as described in (i) and (ii) above. The number of elements in the third condition is equal to or less than the number of elements in the first condition and equal to or less than the number of elements in the second condition. For example, if the number of elements in the first condition is 1 and the number of elements in the second condition is 1, the number of elements in the third condition is 1. Furthermore, if the number of elements in one of the first or second conditions is 1 and the other of the first or second conditions is multiple, the number of elements in the third condition is 1. Furthermore, if the number of elements in the first condition is multiple and the number of elements in the second condition is multiple, the number of elements in the third condition is equal to or less than the number of elements in the first condition or the second condition, whichever has the fewer elements (if the number of elements in the first condition is the same as the number of elements in the second condition, the number of elements in the third condition is equal to or less than the number of elements in the first condition).

[0031] Furthermore, the conversion unit 12 may set the third action in the third access control policy to be the same as either the first action in the first access control policy or the second action in the second access control policy. Conversely, the conversion unit 12 does not adopt the other action as the third action. However, if there are three or more types of access control actions, the conversion unit 12 may adopt, as the third action, not only the first or second action, but also an action different from both the first and second actions.

[0032] As a specific example, assume that the first access control policy is defined as "X1, Y1 ⇒ permit" and the second access control policy is defined as "X2, Y1 ⇒ prohibit." The access control action can be either "permit" or "prohibit." In this case, as an example, the conversion unit 12 may define the third access control policy as "X3, Y1 ⇒ permit" or "X3, Y1 ⇒ prohibit." The former indicates a case where the first action is adopted as the third action, and the latter indicates a case where the second action is adopted as the third action.

[0033] However, if another action can be taken between the first action and the second action, the conversion unit 12 may adopt the other action as the third action. For example, if the first action is "permit," the second action is "prohibit," and there is an action of "conditional permit" between "permit" and "prohibit," the conversion unit 12 can define, in addition to the above example, "X3, Y1 ⇒ conditional permit" as the third access control policy.

[0034] As a further possible variation, when two or more different actions exist between the first action and the second action, the conversion unit 12 may select any one of the two or more different actions as the third action. Here, the conversion unit 12 may compare the first condition and the second condition as described above, and determine the third action so that it more closely matches the action associated with the condition selected as the priority condition, compared with the action associated with the condition not selected as the priority condition. For example, when the first action is the first of four levels, the second action is the fourth of four levels, and the first condition is the priority condition, the conversion unit 12 may determine the third action to be the first or second of the four levels.

[0035] In the above case, the conversion unit 12 may determine the third action, for example, as follows. The conversion unit 12 compares the first condition with the second condition and selects, as the priority condition, the condition with the fewest elements, the condition with the greatest number of cases applicable in actual access control, or the condition with the highest probability of being applicable in actual access control. The conversion unit 12 performs calculations related to the priority condition, for example, by referring to a storage unit that stores information on all elements used in actual access control. Then, the conversion unit 12 may adopt the action related to the priority case as the third action. This can be performed when any number of actions can be present as access control actions.

[0036] The first access control policy may define a first score based on the risk or need of access under a first condition, and the second access control policy may define a second score based on the risk or need of access under a second condition. In this case, the conversion unit 12 can determine the third action using at least one of the first score and the second score. Details of this processing example will be described in embodiment 2.

[0037] 2 is a flowchart showing an example of a typical process of the policy management device 10, and this flowchart will be used to explain the process of the policy management device 10. Note that the details of each process have been described above, and therefore will not be explained again.

[0038] First, the acquisition unit 11 of the policy management device 10 acquires a first access control policy and a second access control policy (step S11: acquisition step). The first access control policy defines a first condition and a first access control action corresponding to the first condition. The second access control policy defines a second condition different from the first condition and a second action corresponding to the second condition and different from the first action.

[0039] Next, the conversion unit 12 converts the first and second access control policies to generate a third access control policy (step S12: conversion step). Here, the third access control policy has a third condition that is different from both the first and second conditions, in that the number of elements indicating access attributes is equal to or less than the number of elements in the first condition and equal to or less than the number of elements in the second condition. The third access control policy also defines a third access control action corresponding to the third condition.

[0040] [Explanation of Effect] As described above, the conversion unit 12 can convert (in other words, integrate) the first and second access control policies into a single third access control policy. At this time, the number of elements (i.e., complexity) of the third condition in the third access control policy is not greater than those of the first and second conditions. Therefore, rather than referring to the first and second access control policies before conversion, the user can easily check the access control policy by referring to the single third access control policy, which has a complexity equal to or less than those of these access control policies.

[0041] [Description of Modification] The conversion unit 12 can generate a single access control policy by the same process as described above using three or more access control policies acquired by the acquisition unit 11. For example, assume that the acquisition unit 11 has acquired three access control policies, namely, access control policies A, B, and C. Here, the conditions defined in access control policies A, B, and C each include one or more elements indicating access attributes, and are different from each other. Furthermore, among the actions defined in access control policies A, B, and C, at least one action in the access control policy may be different from the actions in the other two access control policies.

[0042] At this time, the conversion unit 12 generates access control policy D (third access control policy) using the access control policies A and B (first and second access control policies) by the above-described method. Then, the conversion unit 12 generates access control policy E using access control policy D and access control policy C acquired by the acquisition unit 11 by the above-described method. This allows the conversion unit 12 to generate a single access control policy E. However, when generating the single access control policy E, the conversion unit 12 does not need to perform a process of first integrating two of the access control policies A, B, and C. The conversion unit 12 may generate access control policy E by integrating the three types of access control policies A, B, and C by using a method similar to the above-described method, based on the conditions and actions defined in each of the access control policies A, B, and C.

[0043] The conditions of the access control policy E generated in this way include one or more elements indicating access attributes, and are different from any of the conditions defined in the access control policies A, B, and C. Furthermore, the number of elements indicating access attributes in the conditions of the access control policy E is equal to or less than the number of elements in the conditions of the access control policies A, B, and C that has the smallest number of elements. The actions of the access control policy E may be different from the actions in at least one of the access control policies A, B, and C. Therefore, rather than referring to the access control policies A, B, and C before conversion, the user can easily check the access control policy by referring to the single access control policy E, which has a similar or lower level of complexity to these control policies.

[0044] In the following, in the second embodiment, a specific example of the policy management device 10 described in the first embodiment will be disclosed. However, the specific example of the policy management device 10 described in the first embodiment is not limited to the following. Furthermore, the configuration and processing described below are merely examples, and are not limited to these.

[0045] In the second embodiment, the types of actions that can be taken are either permission or prohibition. However, the types of actions that can be taken are not limited to these and can include a request for additional authentication, a request for manual permission, transfer to a detailed analysis engine, etc. Other possible actions include transferring access to a server that performs more detailed checks, requesting approval from an administrator, etc. These actions may form a totally ordered set that satisfies the reflexive law, the transitive law, the antisymmetric law, and the exact law.

[0046] 3 is a block diagram showing an example of a policy management system 20 that can generate and improve an access control policy to be applied to a network system N that is the target of access control. In this example, the network system N constitutes a zero-trust network. The policy management system 20 includes an information storage unit 21, a policy generation unit 22, a visualization analysis unit 23, a complexity reduction unit 26, a display unit 24, an input unit 25, a policy application unit 27, and an access log storage unit 28. Each unit will be described in detail below.

[0047] The information storage unit 21 stores information used by the policy generation unit 22 to generate a policy, which will be described later. The information storage unit 21 may be connected to, for example, an input unit 25, which will be described later, so that information can be input from the input unit 25.

[0048] The information storage unit 21 stores a combination of one or more elements (hereinafter referred to as a target combination) that indicates access attributes that change over time, which are the target of policy generation, and information for policy generation. The information for policy generation includes, for example, a judgment sample. The judgment sample includes multiple sample policies defined by a user (or an existing automation method). The sample policy defines multiple correspondences between combinations of multiple elements (hereinafter referred to as combination samples) that indicate access attributes and access control actions for the combination samples. As described above, actions are uniquely defined, such as permit or prohibit, so the judgment sample defines quantitative information for policy generation. Note that a sample policy may define a correspondence between only one element and an access control action for that element. The fewer sample policies required for policy generation, the less effort is required for policy design.

[0049] Here, the multiple sample policies may be defined from different perspectives for each policy. For example, as a perspective based on security functions, elements such as the encryption strength of the traffic, the OS version of the access source device, the application authentication result, the user authentication strength, the resource creator, and the resource type may be set. Furthermore, as a perspective based on the organizational department structure (affiliation, position, etc.) for access, elements such as the user's position, affiliation (e.g., project in charge), the resource creator, the resource type, the user location, and the location of the access source device may be set. In this way, different perspectives may have different elements or the same elements. A specific example of a sample policy is "affiliation of the access source device, device location ⇒ allow / prohibit."

[0050] Furthermore, some elements of a sample policy may be expressed in a form that does not uniquely identify them (i.e., "anonymized"). For example, the user's affiliation in a sample policy may be expressed as "Human Resources Department" or "Development Department" in a non-anonymized state, but may be expressed as "Department A" or "Department B" in an anonymized state. Such anonymization may be performed, for example, to protect confidential information of an organization when the sample policy is presented to people or systems outside the organization. Alternatively, such anonymization may be performed because elements of the underlying data were not uniquely identified when the sample policy was originally generated (e.g., the underlying data was poorly readable).

[0051] The information storage unit 21 may output the stored judgment sample as is to the policy generation unit 22. Alternatively, the information storage unit 21 may further store data indicating ideal access control for a specific combination, and output this data as a judgment sample to the policy generation unit 22. The number of combinations included in this data may be, for example, several to several tens of patterns, but is not limited to this. This makes it possible to further improve the accuracy of the policy generated by the policy generation unit 22.

[0052] The information storage unit 21 can also store modification information regarding modification of the access control policy, which the user inputs via the input unit 25 after making a decision with reference to the display unit 24 (described later). The policy generation unit 22 can acquire the modification information. The judgment samples stored in the information storage unit 21 may also be changed by the user as appropriate.

[0053] The information storage unit 21 also stores, for multiple elements related to access control, relationship data indicating the relationships between the multiple elements and score data in which scores are defined based on the perspective of access needs or risks. Here, the "relationship data indicating the relationships between multiple elements" indicates the relationship between different individual elements, the relationship between a combination of elements and a single element, or the relationship between different combinations of elements. The relationship data is, for example, inclusion relationships or logical relationships defined in binary.

[0054] Here, "score data" refers to data in which a score is set as a real value. The "score based on the perspective of access needs" is a parameter that indicates the amount of profit to be gained from the access and the likelihood of profit being gained, i.e., a parameter that works to permit access. On the other hand, the "score based on the perspective of access risk" is a parameter that indicates the amount of loss if the access is fraudulent or erroneous and the likelihood of fraud occurring, i.e., a parameter that works to prohibit access. Therefore, the two parameters have opposite values ​​as attributes. For example, a negative value may be set as the "score based on the perspective of access risk" and a positive value may be set as the "score based on the perspective of access needs." In this case, a score when the access need is high is set higher than a score when the access need is low. However, as another example, a value of 0 or close to 0 may be set as the "score based on the perspective of access risk," and a large absolute value may be set as the "score based on the perspective of access needs." In the following description, the score based on the perspective of access needs is used as the permission value, but similar calculations are possible using the score based on the perspective of access risk.

[0055] Furthermore, the information storage unit 21 may store an intention that a decision maker is expected to use when deciding on an action based on one or more factors. The intention means knowledge necessary for policy generation, and more specifically, includes a combination of one or more factors that indicate attributes of access.

[0056] The information storage unit 21 may store an intention in which at least one of the order and magnitude of the influence on an action is defined corresponding to a combination of one or more elements. As will be described later, this intention may be defined in an ambiguous format. The information storage unit 21 can store any number of such combinations, one or more.

[0057] Examples of combinations of one or more elements include a set of "the location of the access source device, the type of requested data, or the organization owning the resource," a set of "the OS, software name, or application name," and individual elements such as "the affiliation of the access source device" and "the abnormality level." For example, in access control, the type of data or the organization owning the resource to which access is permitted may differ depending on the affiliation (or location) of the access source device. Therefore, "the affiliation of the user, the type of requested data, or the organization owning the resource" may be defined as an element of intent. Similarly, in access control, the security level of access may change (i.e., whether access is permitted or prohibited may change) depending on the combination of the OS and software or application of the access source, the authentication method, and the abnormality level. Therefore, "the OS, software name, or application name," "authentication method," and "the abnormality level" may be defined as elements of intent.

[0058] Furthermore, the information on the degree of impact that affects an action is information that indicates to what extent the action will move in either the "permitted" or "prohibited" direction. As described above, the direction toward "permitted" or "prohibited" is defined as the "order of impact," and information that indicates to what extent the action will move toward "permitted" or "prohibited" is defined as the "magnitude of impact." For example, the "magnitude of impact" is arranged in descending order to form the "order of impact." This information on impact does not necessarily indicate the action that should be executed.

[0059] Here, the information storage unit 21 may store data such as a numerical value that is quantitatively expressed as the degree of influence on the intention, or may store qualitative (vague) information. A specific example of the latter is information that indicates that, in terms of the direction (positive direction) of the action toward "permission," "location of the access source device: A, requested data: resource A" is greater than "location of the access source device: A, requested data: resource B."

[0060] As another example, for parameters such as the newness of the OS version of the access source, the low level of abnormal behavior of the device of the access source, and the degree of disclosure (low confidentiality) of the type of resource accessed, the influence may be set so that the larger the value, the greater the tendency toward an action toward "allow." Also, for a user who is authorized by the access authority created by the owner of the resource ID of the accessed resource (resource owner), the influence may be set so that the action on that resource tends toward "allow." Note that, although the above example describes the tendency toward an action toward "allow" (positive direction), the direction toward an action toward "prohibit" (negative direction) can also be defined in a similar manner.

[0061] In this way, the impact is qualitative information that indicates a general trend, as opposed to quantitative information that indicates whether to actually permit or prohibit. The magnitude of the impact may be expressed in three or more stages (for example, the impact may be expressed in descending order as "high impact," "slightly high impact," and "low impact"). The qualitative information can be determined, for example, by the user who makes the access control decision.

[0062] When the information storage unit 21 stores such qualitative impact information, the impact information may be converted into a numerical value in which the order and magnitude of the impact are defined, and then output to the policy generation unit 22. For example, when assigning a positive score as the direction of "permission," the information storage unit 21 may assign an impact value of "1" to "User's department: Development department, requested data: design data" and an impact value of "0" to "User's department: Development department, requested data: personnel data," because it is easier to "permit" an action for the former than for "User's department: Development department, requested data: personnel data."

[0063] The information storage unit 21 also stores a table indicating the correspondence between ID information related to access and elements indicating attributes of the access. The ID information related to access includes, for example, information related to the ID of the access source (e.g., user ID, device ID, application ID, etc.) and information related to the ID of the access destination (e.g., resource ID of the access destination, name of the owner of the resource ID of the access destination, etc.), but is not limited to this. As an example, the table stored in the information storage unit 21 may associate user IDs with information on elements indicating at least one of the user's affiliation (organization), position, or job type.

[0064] Furthermore, the information storage unit 21 stores information on a threshold value of the permission value for distinguishing between "permitted" and "prohibited" actions defined in each access control policy at the stage of generating the access control policy by the policy generation unit 22. Furthermore, this threshold value is also used in the processing of the complexity reduction unit 26 to determine whether to invert the "permitted" or "prohibited" status of an action in a certain access control policy.

[0065] In addition, the information storage unit 21 further stores a predetermined numerical value (threshold value) used in the processing of the complexity reduction unit 26 to determine whether to reverse the "allow" or "prohibit" status of an action of a certain access control policy.

[0066] Furthermore, the information storage unit 21 can also store all the access control policies once determined by the complexity reduction unit 26 .

[0067] The policy generation unit 22 acquires information for policy generation, such as a target combination, a judgment sample, and an intention, from the information storage unit 21. As described above, the judgment sample is information that reflects a quantitative intention for generating a policy. On the other hand, the information for policy generation may include, as intention information, qualitative information such as the positive or negative effect that any attribute information has on the decision to take an action.

[0068] The policy generation unit 22 inputs this information into a model for generating access control policies (hereinafter referred to as the policy generation model). The policy generation model has undergone machine learning in advance so as to generate an access control policy based on the input. As a result, the policy generation model generates an access control policy in which access control actions are defined in accordance with the direction indicated by the input information, and outputs the policy to the visualization analysis unit 23. The access control policy is defined by the conditions of a combination of one or more elements indicating access attributes (combination to be generated) and the corresponding action. The combination of elements included in the access control policy may be a combination sample defined by information for policy generation and an additional judgment sample. In addition, the action of the access control policy here is either a value of "allow" or "prohibit."

[0069] Based on the input information, the policy generation model can mimic the method used by an administrator or the like of the network system N to determine a sample policy, and can determine in detail as an access control policy a pattern of combinations of elements and combinations of actions that were not clearly defined in the sample policy (for example, were ignored because they were out of range or did not have a substantial impact on the access control decision). Here, the policy generation model can automatically adjust the order and magnitude of the impact levels corresponding to the intended combination of elements to set appropriate values.

[0070] For example, the policy generation model can generate an access control policy so as to preserve impact information (e.g., order and magnitude) corresponding to a combination of elements obtained from the information storage unit 21. In other words, the policy generation model can generate an access control policy so that quantitative actions corresponding to the conditions (combinations to be generated) defined in the access control policy are consistent with the qualitative impact information obtained from the information storage unit 21. As an example, the generated access control policy may uniquely identify anonymized portions in the sample policy.

[0071] Furthermore, when generating an access control policy, the policy generation model calculates a score (permission value) based on the access needs perspective for the conditions defined in the access control policy, based on the score data stored in the information storage unit 21. This permission value is calculated for each access control policy. Here, if the permission value of a certain access control policy is equal to or greater than a threshold, the policy generation model sets the action of that access control policy to "permit," while if the permission value of a certain access control policy is less than the threshold, the policy generation model sets the action of that access control policy to "prohibit."

[0072] Furthermore, when the policy generation model acquires access control policy modification information from the information storage unit 21, it can also modify the access control policy to be generated in accordance with the modification information.

[0073] The policy generation unit 22 described above can be realized by any means, such as a linear model, a support vector machine, a neural network, a decision tree, an ensemble decision tree, a Bayesian model, a non-negative weighted linear model, a monotonic neural network, or a monotonic decision tree.

[0074] The visualization analysis unit 23 visualizes the access control policy generated by the policy generation model so that the user to whom the policy is presented can understand the content of the policy. The visualization analysis unit 23 displays this visualized access control policy together with its permission value on the display unit 24.

[0075] The display unit 24 is an interface that displays the access control policy generated by the policy generation unit 22 or the access control policy whose complexity has been reduced by the complexity reduction unit 26, organized by the visualization analysis unit 23 so as to be easily understandable by the user. The display unit 24 has display functions such as a GUI (Graphical User Interface) and a CLI (Command Line Interface). Furthermore, the display unit 24 may have an interface such as a computer (e.g., a management cloud server) that allows the user to manage access control. The input unit 25 is an interface such as a keyboard, buttons, or a mouse that allows the user of the policy management system 20 to input data.

[0076] FIG. 4A illustrates an example of how the visualization analysis unit 23 organizes and visualizes access control policies. In FIG. 4A , the access control policy defines the affiliation of the access source and the access destination that the affiliation is permitted to access. Specifically, R&D department 1 has access authority to the R&D department server, design and development department 1 has access authority to the R&D department server and customer information 1, and design and development department 2 has access authority to customer information 1. Furthermore, sales department 1 has access authority to customer information 1, and human resources department 1 has access authority to human resources information 1. Furthermore, additional conditions for permitting these accesses include authentication by PW (password) and the fact that the file being accessed is not personal information. In this case, the visualization analysis unit 23 visualizes the access control policy so that, for example, the following content is presented in natural language on the display unit 24: "Access source belongs to the R&D department, PW authentication, access destination is the department management server, not personal information ⇒ permitted."

[0077] 4B is an example of an access control policy displayed on the display unit 24. In FIG. 4B, all access control policies that permit actions are displayed as a "list of permission policies," and all access control policies that prohibit actions are displayed as a "list of prohibition policies." The visualization analysis unit 23 classifies and lists the access control policies in this way depending on whether the action is permitted or prohibited, making it easier for the user to view the access control policies.

[0078] 4B shows an example of an access control policy in which an action is permitted: "Permitted if the access source is a person belonging to the R&D department, a supervisor, PW authentication, the access destination is a department management server, is not personal information, and network traffic is within average +200%" (AC1). Also, an example of an access control policy in which an action is prohibited: "Prohibited if the access source is a person belonging to the R&D department, a supervisor, PW authentication, the access destination is a department management server, personal information, and network traffic is within average +200%" (PC1). In other words, in this example, whether the action is permitted or prohibited depends on whether the information is personal information or not.

[0079] If the user needs to modify the access control policy displayed on the display unit 24, the user can modify the policy by inputting the modification content using the input unit 25. For example, the user can change the action in the access control policy by changing "permit" in AC1 to "prohibit." However, the modification of the access control policy is not limited to this, and one or more arbitrary elements in the conditions of the access control policy may be added, changed, or deleted.

[0080] For an access control policy that has been modified by the user, the visualization analysis unit 23 outputs the modified access control policy to the complexity reduction unit 26. On the other hand, for an access control policy that has not been modified, the visualization analysis unit 23 outputs the unmodified access control policy to the complexity reduction unit 26. In this way, the visualization analysis unit 23 outputs all access control policies generated by the policy generation unit 22 to the complexity reduction unit 26. However, in response to a user operation of the input unit 25, the visualization analysis unit 23 may output all access control policies generated by the policy generation unit 22 to the policy application unit 27 instead of the complexity reduction unit 26.

[0081] Furthermore, the visualization analysis unit 23 references the access log stored in the access log storage unit 28 (described later) to obtain information on the access rights that will be granted to each entity involved in the access when the confirmed access control policy is applied to the network system N. The access right information includes detailed access content and the results of access control. The detailed access content includes, for example, information on the device, user, and network status related to the access, and may particularly include ID information related to the access (information on the ID of the access source and information on the ID of the access destination). The visualization analysis unit 23 presents the obtained access right information to the user by converting it into a visualized format and displaying it on the display unit 24. This presentation process will be described later.

[0082] The complexity reduction unit 26 corresponds to the conversion unit 12 in the first embodiment, and (A) executes a process of reducing the complexity of a plurality of access control policies output from the visualization analysis unit 23, and outputs the processed access control policies to the visualization analysis unit 23. The complexity reduction unit 26 also (B) executes a process of reducing the complexity of the access authority information output from the visualization analysis unit 23, and outputs the processed access control policies to the visualization analysis unit 23. Details of (A) and (B) will be described below.

[0083] Regarding the process (A), the complexity reduction unit 26 executes a process to reduce the overall complexity of the multiple access control policies output from the visualization analysis unit 23. Specifically, the complexity reduction unit 26 executes a process to integrate two or more access control policies (hereinafter also referred to as pre-processing access control policies) into one access control policy (hereinafter also referred to as post-processing access control policy). Here, the following relationship exists between the conditions defined in any pre-processing access control policy and the conditions defined in the post-processing access control policy. - The third condition defined in the third access control policy after processing excludes one or more elements in at least one of the conditions of the first access control policy or the second access control policy before processing, or - The third condition defined in the third access control policy after processing includes an element that is a group of one or more elements that relate to the same access attribute but have different values ​​in the first condition of the first access control policy before processing and the second condition of the second access control policy before processing. In other words, the third condition has a reduced level of complexity compared to at least one of the first condition and the second condition.

[0084] Here, the first access control policy defines a first condition and a first action corresponding to that condition. The second access control policy defines a second condition different from the first condition and a second action corresponding to the second condition and different from the first action. In this example, one of the first action or the second action is "permitted" and the other is "prohibited." The third access control policy defines a third condition and a third action corresponding to that condition. This third condition is different from both the first and second conditions, in that the number of elements indicating the access attribute is less than or equal to the number of elements in the first condition and less than or equal to the number of elements in the second condition.

[0085] In this example, the complexity reduction unit 26 generates the third access control policy using at least the difference between the threshold of the permission value for distinguishing between "permit" and "prohibit" actions and the permission value in the first or second access control policy. This threshold is stored in the information storage unit 21 and functions as a threshold for distinguishing between the first action and the third action, or between the second action and the third action.

[0086] Here, the complexity reduction unit 26 may generate a third access control policy in which, with at least the difference and the complexity of the third condition as variables, the loss function F is a minimum value, where F is a monotonically increasing function of the difference and the complexity. The complexity C of the third condition may be expressed, for example, as follows, but is not limited to this: Complexity C of the third condition = Constant N × f(I) (1) f(I) is a function of the number I of independent conditions in the third condition, and I refers to the number of values ​​that each element in the third condition can take. For example, if each element of the third condition is defined as (department, position, authentication method, type of information, traffic anomaly level), I is determined as follows: I = (number of departments × number of position levels × number of authentication methods × number of types of information × number of traffic anomaly level patterns) (2) And, f(I) is an arbitrary function that monotonically increases according to the value of I, and may be defined, for example, as follows: f(I) = log(I) (3)

[0087] The loss function F is defined, for example, as follows: F = D + C (4) Here, D is the difference between the threshold value of the permission value and the permission value in the first or second access control policy, and C is as defined in (1). However, the loss function F is not limited to this, and may be any other function as long as it has at least the difference D and the complexity C as variables and is a function that monotonically increases with respect to the difference D and the complexity C. For example, F may be expressed as the multiplication of D and C. The complexity reduction unit 26 generates the third access control policy by setting the third condition of the third access control policy so that the loss function F shown above is minimized. In other words, even if the action of the first or second access control policy is changed by the generated third access control policy, the complexity reduction unit 26 can reduce the complexity of the access control policy while suppressing the impact of the change on network control.

[0088] 5A shows an example of an access control policy before processing by the complexity reduction unit 26. The permission policy A shows an access control policy that "permits access when the access source is a supervisor belonging to the R&D department, has password authentication, the access destination is a department management server, is not personal information, the file creation date is within one month, the access time is 13:00-15:00, and the network traffic is within +200% of the average." The prohibition policy B shows an access control policy that "permits access when the access source is a supervisor belonging to the R&D department, has password authentication, the access destination is a department management server, is personal information, the file creation date is within one month, the access time is 13:00-15:00, and the network traffic is within +200% of the average." Furthermore, prohibition policy C shows an access control policy that prohibits access when "the access source is a supervisor belonging to the R&D department, has password authentication, the access destination is the department management server, is not personal information, the file was created more than one month ago, the access time is 15:00-17:00, and the network traffic is within average +200%." ​​The permission value of permission policy A is 0.7, the permission value of prohibition policy B is 0.3, and the permission value of prohibition policy C is 0.48. The threshold value that distinguishes between "allow" and "prohibit" actions of the access control policies is "0.5."

[0089] The complexity reduction unit 26 determines whether any two of the three access control policies can be integrated into one access control policy based on the permission policy A, the prohibition policy B, and the prohibition policy C. In this example, the complexity reduction unit 26 determines whether the permission policy A can be integrated with either the prohibition policy B or the prohibition policy C.

[0090] The complexity reduction unit 26 calculates the difference between the permission value and the threshold for each of prohibition policy B and prohibition policy C. In this example, the difference between the permission value of prohibition policy B and the threshold is 0.2, and the difference between the permission value of prohibition policy C and the threshold is 0.02. The complexity reduction unit 26 determines whether any of these differences is equal to or less than a predetermined numerical value.

[0091] For example, if the predetermined numerical value is 0.05, the difference between the permission value and the threshold value in prohibition policy B exceeds the predetermined numerical value, while the difference between the permission value and the threshold value in prohibition policy C is equal to or less than the predetermined numerical value. Therefore, the complexity reduction unit 26 determines that even if the action in prohibition policy C is changed from "prohibited" to "permitted," the change will have little effect on network control, and decides to merge prohibition policy C with permission policy A.

[0092] When integrating the permission policy A and the prohibition policy C, the complexity reduction unit 26 determines which elements in the conditions of each policy can be excluded and excludes those elements. However, if there are one or more elements that relate to the same access attribute but have different values ​​between the permission policy A and the prohibition policy C, the complexity reduction unit 26 may group those elements.

[0093] 5A, the complexity reduction unit 26 determines that the elements of the file creation date and the access time zone are different between the permission policy A and the prohibition policy C. Then, the complexity reduction unit 26 defines the conditions of the permission policy A and the prohibition policy C, excluding the elements of "file creation date" and "access time zone", as the conditions of the access control policy to be integrated. In addition, the action of the access control policy to be integrated is defined as "Allow."

[0094] Furthermore, the complexity reduction unit 26 determines that the elements of "file creation date" and "access time zone" are not important in the conditions of the access control policy, based on the fact that the elements of "file creation date" and "access time zone" were excluded in the integration process of the permission policy A and the prohibition policy C. Therefore, the complexity reduction unit 26 also executes a process to exclude these elements from the prohibition policy B.

[0095] 5B is an example of an access control policy after processing by the complexity reduction unit 26. Permission policy A' is a policy that combines permission policy A and prohibition policy C, and is an access control policy that permits access when "the access source is a person who belongs to the R&D department, is a supervisor, has password authentication, the access destination is a department management server, is not personal information, and network traffic is within average +200%." ​​Prohibition policy B' is a policy with reduced complexity of prohibition policy B, and is an access control policy that permits access when "the access source is a person who belongs to the R&D department, has password authentication, the access destination is a department management server, is personal information, and network traffic is within average +200%." ​​As described above, the conditions of these access control policies exclude the elements of "file creation date" and "access time zone."

[0096] However, the complexity reduction unit 26 may include an element obtained by grouping the permission policy A and the prohibition policy C based on the fact that the access time zone elements of the permission policy A and the prohibition policy C are "13:00-15:00" and "15:00-17:00," respectively, in the conditions of the permission policy A'. For example, the complexity reduction unit 26 may further include an access time zone "afternoon" or "within regular working hours" in the conditions of the permission policy A' as an element obtained by grouping the permission policy A and the prohibition policy C. Even in this case, the integrated permission policy A' has a reduced complexity because the number of independent conditions is reduced compared to the permission policy A and the prohibition policy C. In this case, the access time zone element "afternoon" or "within regular working hours" is further included in the conditions of the prohibition policy B'. Furthermore, the complexity reduction unit 26 may further exclude elements other than the "file creation date" and the "access time zone" in the permission policy A and the prohibition policy C based on the information stored in the information storage unit 21.

[0097] Note that, after generating permission policy A' by converting permission policy A and prohibition policy C, the complexity reduction unit 26 may change the threshold of the permission value so that the action of prohibition policy B remains "prohibited" while the action of prohibition policy C is determined to be "permitted." In the above example, the permission value of prohibition policy C is 0.48 and the permission value of prohibition policy B is 0.3, so the complexity reduction unit 26 can change the threshold of the permission value to a value equal to or less than 0.48 and greater than 0.3.

[0098] The complexity reduction unit 26 outputs the permission policy A' and prohibition policy B' thus generated to the visualization analysis unit 23. The visualization analysis unit 23 converts these access control policies into a visualized format and displays them on the display unit 24. If the user needs to modify the access control policies displayed on the display unit 24, the user can modify the contents by inputting the modifications via the input unit 25. The details are the same as when modifying the access control policies output from the policy generation unit 22.

[0099] When an access control policy is modified by the user, the visualization analysis unit 23 outputs the access control policy, including the unmodified access control policy, to the complexity reduction unit 26 again. The complexity reduction unit 26 then executes the above-described complexity reduction process again. As a result, even if the access control policy has become more complex due to the user's modification of the access control policy, the complexity reduction unit 26 can simplify the access control policy again. The complexity reduction unit 26 then outputs the processed access control policy to the visualization analysis unit 23, which converts the access control policy into a visualized format and displays it on the display unit 24. As a result, the access control policy is repeatedly displayed on the display unit 24, and the input unit 25 can accept modification input until the user determines that the access control policy is appropriate and no longer modifies it.

[0100] The user may input additional judgment samples to the policy management system 20 via the input unit 25 based on the display result of the access control policy on the display unit 24. This allows the policy generation unit 22 to use the additional judgment samples acquired from the information storage unit 21 to generate an access control policy that is more suited to the situation the next time or later an access control policy is generated.

[0101] If the access control policies displayed on the display unit 24 are not to be modified, the user operates the input unit 25 to output all of the access control policies generated by the complexity reduction unit 26 to the policy application unit 27. The contents of all of these access control policies are also stored in the information storage unit 21 as confirmed access control policies.

[0102] The policy application unit 27 applies all access control policies output from the visualization analysis unit 23 to the network system N. In this example, the policy application unit 27 applies the access control policies to the actual network system N. However, the policy application unit 27 may also apply the access control policies to a simulator of the network system N. The application mode of this access control policy can be alternatively selected by a selection screen displayed on the display unit 24 and the user operating the input unit 25. The network system N stores an access log, which is the result of application of the access control policy, in the access log storage unit 28.

[0103] The access log contains information about the access rights granted to each entity involved in the access when the access control policy is applied to the network system N. The access right information includes detailed access content and the results of access control. The detailed access content includes information about the device, user, and network status related to the access, and particularly ID information related to the access (information about the ID of the access source and information about the ID of the access destination). The access right information indicates points where the access control policy applied by the policy application unit 27 is insufficient in access control in the actual network system N. The visualization analysis unit 23 presents the access right information obtained from the access log storage unit 28 to the user by converting it into a visualized format and displaying it on the display unit 24. Note that the access right information may change depending on the status of the network system N.

[0104] 6A is an example of access authority information displayed on the display unit 24. In FIG. 6A, the access authority information AU1 shows the time of access 1, the access source user ID (Alice) and device name, and the access destination address "web04-nec.com / RDinfo / xxx-PJ." This address is located at a lower level than the R&D department server address "web04-nec.com / RDinfo." The access authority information AU1 also includes the access source user's authentication history, personnel information (job title and occupation), and network abnormality level information. Other access authority information can also be listed and displayed.

[0105] If the user needs to modify the access permission information displayed on the display unit 24, the user can modify the information by inputting the modification content using the input unit 25. For example, the user can change the access permission information by changing "permitted" in AU1 to "prohibited." However, the modification of the access permission information is not limited to this, and may also include adding, changing, or deleting elements in the conditions of the access permission information.

[0106] When the access authority information is modified by the user, the visualization analysis unit 23 reflects the modification and then outputs the modified access authority information to the complexity reduction unit 26. On the other hand, when the access authority information is not modified, the visualization analysis unit 23 outputs the unmodified access authority information to the complexity reduction unit 26.

[0107] The complexity reduction unit 26 simplifies the access authority information by converting it, which is output from the visualization analysis unit 23. Specifically, the complexity reduction unit 26 extracts ID information related to the access included in the access authority information. Then, by referring to the extracted ID information related to the access and the table stored in the information storage unit 21, the complexity reduction unit 26 identifies an element indicating an attribute of the access corresponding to the extracted ID information related to the access.

[0108] For example, for the access authority information AU1 shown in FIG. 6A , the complexity reduction unit 26 identifies that the user ID "Alice" has a job title of "chief" and a job type of "R&D department" by referring to the table. Then, the complexity reduction unit 26 identifies other user IDs that match at least one element of the identified job title or job type by referring to the table. In this example, the complexity reduction unit 26 identifies "Bob" and "Charlie" in addition to "Alice" as user IDs with a job title of "chief" and a job type of "R&D department." At this time, the complexity reduction unit 26 determines that "Bob" and "Charlie," in addition to "Alice," should also be permitted to access the access destination to which "Alice" is permitted access. Furthermore, the complexity reduction unit 26 references information related to the ID of the access destination stored in the information storage unit 21. As a result, the complexity reduction unit 26 determines that "Alice," "Bob," and "Charlie" should be permitted to access not only the access destinations that "Alice" is permitted to access, but also the entire R&D department server (address "web04-nec.com / RDinfo"). In this way, the complexity reduction unit 26 can group user IDs that have similar properties under specific conditions.

[0109] In this way, the complexity reduction unit 26 can execute the setting of permission or prohibition of access even for user IDs that have one or more elements identical to a user ID for which access is permitted or prohibited in the access permission information. Furthermore, it is also possible to expand the targets (access destination addresses) for which access should be permitted or prohibited as necessary. Therefore, the complexity reduction unit 26 can simplify the access permission information. The complexity reduction unit 26 outputs the simplified access permission information to the visualization analysis unit 23.

[0110] FIG. 6B illustrates an example of how the visualization analysis unit 23 organizes and visualizes the access permission information output from the complexity reduction unit 26. In FIG. 6B, the output access permission information defines user IDs and resource IDs to which the user IDs are permitted access. Specifically, as described above, the user IDs "Alice," "Bob," and "Charlie" of Group A have access permission to the resource ID "web04-nec.com / RDinfo," which is the R&D department server. Meanwhile, the user IDs "David," "Eve," and "Frank" have access permission to different resource IDs "web01-nec.com / employee" and "web04-nec.com / budget." Furthermore, the access permission information includes information on the device and IP address from which "Alice" and "Bob" access the resource, indicating the associated circumstances. Based on this information, the visualization analysis unit 23 visualizes the access authority information so that the content including the user ID of the access source, the ID of the access destination, and information indicating the accompanying circumstances is presented in natural language on the display unit 24.

[0111] FIG. 6C shows an example of additional access authority information presented on the display unit 24. In FIG. 6C, additional access authority information AD1 is displayed to further grant access authority to "web04-nec.com / RDinfo" to user IDs "Alice," "Bob," and "Charlie" who make up group A. Also displayed is additional access authority information AD2 to further grant access authority to "web01-nec.com / employee" and "web04-nec.com / budget" to user IDs "David," "Eve," and "Frank" who make up group B. Although not shown, the additional access authority information AD1 may also reflect the information indicating the incidental status shown in FIG. 6B. Access authority information other than that shown in FIG. 6C may also be listed and displayed. Furthermore, the additional access authority information displayed on the display unit 24 may not be ID-based information, but may be information indicating the corresponding elements.

[0112] The user refers to the information shown in FIG. 6C and, if any corrections are necessary, inputs the corrections using the input unit 25. In this case, the corrected information on the additional access rights is output to the complexity reduction unit 26, which then performs the above-described simplification process again on the output information on the additional access rights. The complexity reduction unit 26 then outputs the information on the additional access rights that has been subjected to the re-simplification process to the visualization analysis unit 23, which then converts the information into a visualized format and displays it on the display unit 24. As a result, the information on the additional access rights is repeatedly displayed on the display unit 24, and the input unit 25 can accept correction inputs, until the user determines that the information on the additional access rights is appropriate and no longer makes any corrections.

[0113] If there is no need to modify the information on the additional access rights displayed on the display unit 24, the user operates the input unit 25. In response to this operation, the visualization analysis unit 23 reflects the information on all additional access rights displayed on the display unit 24 in the contents of all access control policies stored in the information storage unit 21. In detail, the visualization analysis unit 23 converts the information on the additional access rights into information on the corresponding element by referring to the table stored in the information storage unit 21. Then, the converted information is reflected in the contents of the access control policies.

[0114] 7A to 7C are flowcharts showing an example of a typical process of the policy management system 20, and these flowcharts will be used to explain the process of the policy management system 20. Note that the details of each process are as described above, and therefore will not be explained here.

[0115] First, the policy generation unit 22 acquires information for generating an access control policy, such as a combination to be generated, a judgment sample, and an intention, from the information storage unit 21 (step S21: acquisition step).The policy generation unit 22 then generates an access control policy by inputting the information for generating an access control policy into a policy generation model (step S22: generation step).

[0116] The visualization analysis unit 23 visualizes all access control policies generated by the policy generation model and displays them on the display unit 24 (step S23: display step). The user checks the access control policies displayed on the display unit 24 and determines whether any modifications have been made to the policies. The visualization analysis unit 23 determines whether any modifications have been made by the user via the input unit 25 (step S24: determination step). If any modifications have been made (Yes in step S24), the visualization analysis unit 23 displays the modified access control policies on the display unit 24 again (step S23) and performs the determination in step S24 again.

[0117] If there are no modifications to the access control policies displayed on the display unit 24 (No in step S24), the visualization analysis unit 23 outputs all of the displayed access control policies to the complexity reduction unit 26. The complexity reduction unit 26 reduces the complexity of the access control policies (step S25: complexity reduction step).

[0118] The visualization analysis unit 23 displays the access control policy with reduced complexity on the display unit 24 (step S26: display step). The user checks the access control policy displayed on the display unit 24 and determines whether any modifications have been made to the policy. The visualization analysis unit 23 determines whether any modifications have been made by the user via the input unit 25 (step S27: determination step). If any modifications have been made (Yes in step S27), the visualization analysis unit 23 outputs the modified access control policy to the complexity reduction unit 26. The policy management system 20 performs the processes from step S25 onwards again.

[0119] If there are no modifications to the access control policies displayed on the display unit 24 (No in step S27), the visualization analysis unit 23 outputs all of the displayed access control policies to the policy application unit 27. The policy application unit 27 applies these access control policies to the network system N (step S28: application step). Information on the access authority resulting from the application is stored in the access log storage unit 28.

[0120] The visualization analysis unit 23 visualizes the access authority information acquired from the access log storage unit 28 and displays it on the display unit 24 (step S29: display step). The user checks the access authority information displayed on the display unit 24 and determines whether any modifications have been made to the content. The visualization analysis unit 23 determines whether any modifications have been made by the user via the input unit 25 (step S30: determination step). If any modifications have been made (Yes in step S30), the visualization analysis unit 23 displays the modified access control policy again on the display unit 24 (step S29) and performs the determination in step S30 again.

[0121] If there is no modification to the access authority information displayed on the display unit 24 (No in step S30), the visualization analysis unit 23 outputs all displayed access authority information to the complexity reduction unit 26. The complexity reduction unit 26 simplifies the access authority information (step S31). The visualization analysis unit 23 displays the simplified access authority information on the display unit 24 (step S32: display step). The user checks the access authority information displayed on the display unit 24 and determines whether the content has been modified. The visualization analysis unit 23 determines whether the user has made a modification via the input unit 25 (step S33: determination step). If there is a modification (Yes in step S33), the visualization analysis unit 23 outputs the modified access authority information to the complexity reduction unit 26. The policy management system 20 executes the processes from step S31 onwards again.

[0122] If there is no modification to the access right information displayed on the display unit 24 (No in step S33), the visualization analysis unit 23 reflects the information of all additional access rights displayed on the display unit 24 in the contents of all access control policies stored in the information storage unit 21 (step S34).

[0123] [Description of Effect] In recent years, the advancement of zero trust network technology has increased the importance of access control in such networks. Zero trust networks can be applied to, for example, local 5G (5th Generation) used by companies, local governments, etc.

[0124] A zero trust network calculates a security score for access from all devices and determines whether to allow that access. This prevents threats from accessing important files even if they infiltrate the network, preventing the spread of damage. Furthermore, a zero trust network does not simply block access from outside the network, but instead makes a decision based on the above-mentioned score calculation to allow trusted access. This allows for both network security and availability.

[0125] In such a zero trust network, the network's policy engine determines whether to allow or deny access by integrating various information based on perspectives such as risk, needs, and trust, making it possible to generate access control policies that are superior to those created by humans. However, automatically generated access control policies often contain complex conditions for allowing or denying access. This can make it difficult for administrators to determine whether the generated access control policies should be applied to the network or to modify them as needed.

[0126] In contrast, the policy management system 20 in the second embodiment can reduce the complexity of the access control policy generated by the policy generation unit 22 in the complexity reduction unit 26 (specifically, integrate multiple access control policies). As a result, even a complex access control policy generated automatically can be converted into a policy whose validity can be judged by a human. Furthermore, the access control policy with reduced complexity is visualized and presented to the user. This allows the user to judge the validity of the contents of the access control policy and whether it can be applied to the network. Then, by applying the access control policy to the network, security risks can be reduced as described above.

[0127] Furthermore, the complexity reduction unit 26 can reduce the complexity of the third condition defined in the third access control policy after the complexity reduction process by comparing it with at least one of the first condition in the first access control policy before the process and the second condition in the second access control policy before the process, thereby enhancing the effect of reducing the complexity of the access control policy.

[0128] Furthermore, the complexity reduction unit 26 can generate the third access control policy by using at least the difference between the threshold of the permission value that distinguishes whether the action of the access control policy is "permit" or "prohibit" and the permission value of the first or second access control policy before processing. This allows the policy management system 20 to perform processing based on the index of the permission value, thereby suppressing the difference in access control when applied to a network between the access control policy generated by processing and the access control policy before processing.

[0129] Here, the complexity reduction unit 26 uses at least the difference and the complexity of the third condition of the third access control policy as variables, and generates an access control policy that minimizes a loss function that monotonically increases with respect to the difference and the complexity. This allows the policy management system 20 to simultaneously suppress the difference in access control between the access control policy generated by the processing and the access control policy before the processing when applied to a network, and reduce the complexity of the access control policy.

[0130] However, the complexity reduction unit 26 can also generate the third access control policy by a complexity reduction process that does not use a loss function. For example, assume that the difference between the permission value and the threshold in the first access control policy before processing exceeds a predetermined value, and the difference between the permission value and the threshold in the second access control policy before processing is equal to or less than a predetermined value. In this case, the complexity reduction unit 26 can set the first action in the first access control policy as the action of the third access control policy. The complexity reduction unit 26 sets a third condition, including one or more elements common to the first condition in the first access control policy and the second condition in the second access control policy, as the condition of the third access control policy. In this way, if the impact of setting the second action in the second access control policy to the same action as the first action in the first access control policy is small, the complexity reduction unit 26 generates the third access control policy in this manner. This reduces the complexity of the access control policy.

[0131] The display unit 24 presents the third access control policy generated by the complexity reduction unit 26 to the user, and the input unit 25 can accept input for modifying the policy, thereby enabling the user to improve the accuracy of the access control policy.

[0132] Furthermore, the display unit 24 presents to the user information on access rights that can be obtained when the third access control policy generated by the complexity reduction unit 26 is applied to the network system N, and the input unit 25 can accept input for modifying the access right information. This allows the user to improve the accuracy of the finally generated access control policy by modifying the access right information.

[0133] The complexity reduction unit 26 can also simplify the acquired access authority information by converting it, which makes it easier for the user to check the access authority information and modify it as necessary.

[0134] Furthermore, the visualization analysis unit 23 can reflect the simplified access authority information in the third access control policy generated by the complexity reduction unit 26. This allows the content of the finally generated access control policy to be able to resolve problems that arise in actual operation and that were not covered by the content of the access control policy generated by the policy generation unit 22. Furthermore, because the content of the finally generated access control policy has reduced complexity, it is also possible for the user to easily determine whether or not to operate it.

[0135] [Explanation of a Modification] In step S23 of FIG. 7A , the visualization analysis unit 23 may display on the display unit 24 only those access control policies generated by the policy generation unit 22 for which the difference between the permission value associated with the policy and the permission value threshold is equal to or less than a predetermined value. Alternatively, the visualization analysis unit 23 may display on the display unit 24 access control policies for which the difference between the permission value associated with the policy and the permission value threshold is equal to or less than a predetermined value, preferentially over other access control policies. Presenting with priority means presenting the access control policy to be preferentially presented to the user in a manner that makes it easier to recognize than other access control policies. As an example, the access control policy to be preferentially presented may be displayed larger than other access control policies or displayed at the top of the screen of the display unit 24, making it easier to see. Alternatively, the access control policy to be preferentially presented may be notified to the user not only on the screen but also by audio.

[0136] At this time, the visualization analysis unit 23 can also display the permission value of the access control policy to be preferentially presented and the threshold value for the permission value on the display unit 24. In this way, the policy management system 20 prompts the user to pay attention to access control policies in which the access control action would be correct whether it was "permit" or "prohibit" (i.e., on either side of the threshold). This allows the complexity reduction unit 26 to notify the user in advance of potential points for modification in the access control policy to be generated later. However, the user may modify the displayed access control policy by operating the input unit 25 when the access control policy to be preferentially presented is presented. The above processing can more reliably improve the accuracy of the access control policy generated by the complexity reduction unit 26.

[0137] Furthermore, in at least one of steps S23, S26, S29, and S32 of FIGS. 7A to 7C, the visualization analysis unit 23 may display a search screen on the display unit 24 to make it easier for the user to check information on access control policies or access permissions that include desired conditions. Via this search screen, the user can at least specify one or more arbitrary elements or specify an action (permit or prohibit) in the information on access control policies or access permissions via the input unit 25. The visualization analysis unit 23 displays information on access control policies or access permissions that meet the specified search conditions on the display unit 24. This reduces the time required for the user to check and, if necessary, modify the information on access control policies or access permissions.

[0138] Furthermore, when a correction from the user is received in at least one of S24, S27, S30, or S33 of Figures 7A to 7C, the visualization analysis unit 23 may analyze the corrections made in the access control policy or access permission information. The visualization analysis unit 23 then determines whether there are any similar parts to the analyzed corrections in the access control policy or access permission information that has been output to the visualization analysis unit 23 and has not been corrected. If one or more similar parts are found, the visualization analysis unit 23 may also make corrections to those parts similar to the content corrected by the user. Alternatively, the visualization analysis unit 23 may suggest on the display unit 24 whether or not to make the same correction to that part as the content corrected by the user. If the user instructs the input unit 25 to accept the suggestion, the visualization analysis unit 23 makes the same correction to that part as the content corrected by the user.

[0139] For example, assume that in step S24 of FIG. 7A , a user modifies the value of an element in a condition of one access control policy output from the policy generation unit 22 from "Chief" to "Section Chief." In this case, if the element value "Chief" exists in the condition of another access control policy, the visualization analysis unit 23 can suggest on the display unit 24 whether to also modify that element value to "Section Chief." In this way, the visualization analysis unit 23 can estimate areas that are likely to have the same problem as the modified area, and can collectively modify or suggest such modifications. This reduces the time the user spends on modifications.

[0140] In the second embodiment, there may be three or more types of actions that can be taken as access control. In this case, the threshold value of the permission value is set corresponding to the type of action. When N types of actions (N is 3 or more) are set, N-1 threshold values ​​of the permission value are set. In this case, in the process of step S25 in FIG. 7, the complexity reduction unit 26 can generate a third access control policy by integrating, for example, a first access control policy and a second access control policy that can take two different types of actions with a certain threshold in between. The details of the generation process are as described above.

[0141] Furthermore, the present disclosure is not limited to the above-described embodiments and can be modified as appropriate without departing from the spirit of the present disclosure. For example, the policy management device 10 in the first embodiment is not limited to a device in which each component is provided in a single device housing, but may have a configuration in which each component is distributed across multiple housings. Furthermore, the policy management system 20 in the second embodiment may be provided as a single device, or as a distributed system in which components are distributed across multiple devices.

[0142] The conversion unit 12 in the first embodiment can be realized by a rule-based algorithm. However, the conversion unit 12 may also be realized by a pre-trained AI (Artificial Intelligence) model. This AI model is trained by inputting training data including, for example, multiple sets of first and second access control policies and a third (single) access control policy that serves as a correct label. The third access control policy in the training data has the relationship with the first and second access control policies as described in the first embodiment and has a complexity equal to or less than that of the first and second access control policies. Through this training, the conversion unit 12 can realize the processing described in the first embodiment.

[0143] The complexity reduction unit 26 in the second embodiment can also reduce the complexity of the access control policy not only by a rule-based algorithm such as a permission value or a loss function, but also by a pre-trained AI model similar to that described above. Furthermore, the complexity reduction unit 26 can also simplify the access authority information output from the visualization analysis unit 23 not only by a rule-based algorithm, but also by a pre-trained AI model. This AI model is trained by inputting training data including multiple sets of access authority information and simplified access authority information that serves as a correct label, for example.

[0144] In the above-described embodiments, this disclosure has been described as a hardware configuration, but this disclosure is not limited to this. This disclosure can also be realized by having a processor in a computer execute a computer program to perform the processes (steps) of the policy management device or policy management system described in the above-described embodiments.

[0145] 8 is a block diagram showing an example of the hardware configuration of an information processing device 90 for executing the processes of the above-described embodiments. Referring to FIG. 8, the information processing device 90 includes a signal processing circuit 91, a processor 92, and a memory 93.

[0146] The signal processing circuit 91 is a circuit for processing signals in accordance with the control of the processor 92. The signal processing circuit 91 may include a communication circuit for receiving signals from a transmitting device.

[0147] The processor 92 is connected (coupled) to the memory 93, and performs the processing of the device described in the above embodiment by reading and executing software (computer programs) from the memory 93. As an example of the processor 92, one of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), an FPGA (Field-Programmable Gate Array), a DSP (Demand-Side Platform), and an ASIC (Application Specific Integrated Circuit) may be used, or a plurality of these may be used in parallel.

[0148] The memory 93 may be a volatile memory, a nonvolatile memory, or a combination thereof. The memory 93 is not limited to one, and may be provided in multiple units. The volatile memory may be, for example, a random access memory (RAM) such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). The nonvolatile memory may be, for example, a read only memory (ROM) such as a programmable random only memory (PROM) or an erasable programmable read only memory (EPROM), a flash memory, or a solid state drive (SSD).

[0149] The memory 93 is used to store one or more instructions. Here, the one or more instructions are stored as a group of software modules in the memory 93. The processor 92 can perform the processes described in the above embodiments by reading and executing the group of software modules from the memory 93.

[0150] The memory 93 may include a memory provided outside the processor 92, as well as a memory built into the processor 92. The memory 93 may also include a storage device located away from the processors constituting the processor 92. In this case, the processor 92 can access the memory 93 via an I / O (Input / Output) interface.

[0151] As described above, one or more processors included in each device in the above-described embodiments execute one or more programs including instructions for causing a computer to execute the algorithms described using the drawings. This processing enables the information processing described in each embodiment to be realized.

[0152] The program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disk (DVD), Blu-ray disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0153] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Supplementary Note 1) A policy management device comprising: an acquisition means for acquiring a first access control policy and a second access control policy; and a conversion means for generating a third access control policy by converting the first and second access control policies, wherein the first access control policy defines a first condition including one or more elements indicating an access attribute, and a first action of access control corresponding to the first condition; the second access control policy defines a second condition including one or more elements indicating an access attribute, and different from the first condition, and a second action corresponding to the second condition and different from the first action; the third access control policy defines a third condition different from both the first and second conditions, and a third action of access control corresponding to the third condition; and the third condition includes one or more elements indicating an access attribute, and the number of the elements is equal to or less than the number of the elements in the first condition, and the number of the elements is equal to or less than the number of the elements in the second condition. (Supplementary Note 2) The policy management device according to Supplementary Note 1, wherein the conversion means generates the third access control policy so that the third condition does at least one of excluding one or more of the elements in at least one of the first condition or the second condition, or including an element that is a group of one or more elements that relate to the same access attribute but have different values ​​in the first condition and the second condition.(Supplementary Note 3) The policy management device according to Supplementary Note 1 or 2, wherein the first access control policy defines a first score based on a perspective of access risk or need under the first condition, and the second access control policy defines a second score based on a perspective of access risk or need under the second condition, and the conversion means generates the third access control policy by using at least a difference between the first score or the second score and a score threshold based on a perspective of access risk or need for separating the first action from the third action or for separating the second action from the third action. (Supplementary Note 4) The policy management device according to Supplementary Note 3, wherein the conversion means uses at least the difference and the complexity of the third condition as variables, and generates the third access control policy such that a loss function that monotonically increases with respect to the difference and the complexity becomes a minimum value. (Supplementary Note 5) The policy management device according to any one of Supplements 1 to 4, further comprising: a first presentation means for presenting the third access control policy to a user and accepting an input for modifying the third access control policy. (Supplementary Note 6) The policy management device according to any one of Supplements 1 to 5, further comprising: a second presentation means for presenting to a user information on access rights that will be granted to each entity involved in access when the third access control policy is applied to a network system that is to be access-controlled, and accepting a modification of the information on access rights. (Supplementary Note 7) The policy management device according to any one of Supplements 1 to 6, wherein the acquisition means acquires information on access rights that will be granted to each entity involved in access when the third access control policy is applied to a network system that is to be access-controlled, and the conversion means simplifies the information on access rights by converting it. (Supplementary Note 8) The policy management device according to Supplementary Note 7, further comprising: a reflection means for reflecting the simplified information on access rights in the third access control policy.(Supplementary Note 9) The policy management device according to any one of Supplementary Notes 1 to 8, wherein the first access control policy defines a first score based on the perspective of access risk or need under the first condition, and the second access control policy defines a second score based on the perspective of access risk or need under the second condition, and when a difference between the first score or the second score and a threshold score based on the perspective of access risk or need for separating the first action from the third action or for separating the second action from the third action is equal to or less than a predetermined numerical value, the conversion means presents the first or second access control policy related to the difference to a user. (Supplementary Note 10) A policy management method executed by a computer, comprising: obtaining a first access control policy and a second access control policy; and generating a third access control policy by converting the first and second access control policies; wherein the first access control policy defines a first condition including one or more elements indicating an access attribute, and a first access control action corresponding to the first condition; the second access control policy defines a second condition including one or more elements indicating an access attribute, and different from the first condition, and a second action corresponding to the second condition and different from the first action; the third access control policy defines a third condition different from both the first and second conditions, and a third access control action corresponding to the third condition; and the third condition includes one or more elements indicating an access attribute, and the number of elements is equal to or less than the number of elements in the first condition, and the number of elements is equal to or less than the number of elements in the second condition.(Supplementary Note 11) A non-transitory computer-readable medium storing a program that causes a computer to execute the following: obtain a first access control policy and a second access control policy; generate a third access control policy by converting the first and second access control policies; the first access control policy defines a first condition including one or more elements that indicate an access attribute, and a first action of access control corresponding to the first condition; the second access control policy defines a second condition including one or more elements that indicate an access attribute, and different from the first condition, and a second action that corresponds to the second condition and different from the first action; the third access control policy defines a third condition that is different from both the first and second conditions, and a third action of access control corresponding to the third condition; and the third condition includes one or more elements that indicate an access attribute, and the number of the elements is equal to or less than the number of the elements in the first condition, and the number of the elements is equal to or less than the number of the elements in the second condition.

[0154] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the disclosure.

[0155] REFERENCE SIGNS LIST 10 Policy management device 11 Acquisition unit 12 Conversion unit 20 Policy management system 21 Information storage unit 22 Policy generation unit 23 Visualization analysis unit 24 Display unit 25 Input unit 26 Complexity reduction unit 27 Policy application unit 28 Access log storage unit N Network system

Claims

1. an acquisition means for acquiring a first access control policy and a second access control policy; a conversion means for converting the first and second access control policies to generate a third access control policy, the first access control policy defines a first condition including one or more elements indicating an attribute of access and a first action of access control corresponding to the first condition; the second access control policy includes one or more elements indicating an attribute of access, and defines a second condition different from the first condition and a second action corresponding to the second condition and different from the first action; the third access control policy defines a third condition different from both the first and second conditions, and a third action of access control corresponding to the third condition; The third condition includes one or more elements indicating an attribute of access, and the number of the elements is equal to or less than the number of the elements in the first condition, and the number of the elements is equal to or less than the number of the elements in the second condition. Policy management device.

2. the conversion means generates the third access control policy so that at least one of the following is performed: one or more of the elements in at least one of the first condition and the second condition are excluded in the third condition; or an element is included in which one or more of the elements related to the same access attribute but have different values ​​in the first condition and the second condition are grouped together. The policy management apparatus according to claim 1 .

3. A first score based on a viewpoint of a risk or a need of access under the first condition is defined in the first access control policy, and a second score based on a viewpoint of a risk or a need of access under the second condition is defined in the second access control policy; the conversion means generates the third access control policy by using at least a difference between a threshold score based on a perspective of a risk or need of access for separating the first action from the third action or separating the second action from the third action, and the first score or the second score.

3. The policy management device according to claim 1 or 2.

4. the conversion means generates the third access control policy such that a loss function that is monotonically increasing with respect to the difference and the complexity is a minimum value, using at least the difference and the complexity as variables. The policy management apparatus according to claim 3 .

5. The third access control policy may be provided to a user via a first presentation means for presenting the third access control policy to a user and receiving an input for modifying the third access control policy.

3. The policy management device according to claim 1 or 2.

6. The third access control policy is applied to a network system that is an access control target. The third access control policy is applied to the network system that is an access control target. The third access control policy is applied to the network system that is an access control target.

3. The policy management device according to claim 1 or 2.

7. the acquiring means acquires information on an access right granted to each entity involved in access when the third access control policy is applied to a network system that is an access control target; the conversion means converts and simplifies the information of the access authority; 3. The policy management device according to claim 1 or 2.

8. The access control system further includes a reflecting unit for reflecting the simplified access authority information in the third access control policy. The policy management apparatus according to claim 7.

9. A first score based on a viewpoint of a risk or a need of access under the first condition is defined in the first access control policy, and a second score based on a viewpoint of a risk or a need of access under the second condition is defined in the second access control policy; when a difference between a score threshold based on a viewpoint of access risk or need for separating the first action from the third action or separating the second action from the third action and the first score or the second score is equal to or smaller than a predetermined numerical value, the conversion means causes a user to be presented with the first or second access control policy related to the difference; 3. The policy management device according to claim 1 or 2.

10. Obtaining a first access control policy and a second access control policy; generating a third access control policy by transforming the first and second access control policies; the first access control policy defines a first condition including one or more elements indicating an attribute of access and a first action of access control corresponding to the first condition; the second access control policy includes one or more elements indicating an attribute of access, and defines a second condition different from the first condition and a second action corresponding to the second condition and different from the first action; the third access control policy defines a third condition different from both the first and second conditions, and a third action of access control corresponding to the third condition; The third condition includes one or more elements indicating an attribute of access, and the number of the elements is equal to or less than the number of the elements in the first condition, and the number of the elements is equal to or less than the number of the elements in the second condition. The policy management method that the computer implements.

11. Obtaining a first access control policy and a second access control policy; generating a third access control policy by transforming the first and second access control policies; the first access control policy defines a first condition including one or more elements indicating an attribute of access and a first action of access control corresponding to the first condition; the second access control policy includes one or more elements indicating an attribute of access, and defines a second condition different from the first condition and a second action corresponding to the second condition and different from the first action; the third access control policy defines a third condition different from both the first and second conditions, and a third action of access control corresponding to the third condition; The third condition includes one or more elements indicating an attribute of access, and the number of the elements is equal to or less than the number of the elements in the first condition, and the number of the elements is equal to or less than the number of the elements in the second condition. A program that causes a computer to do something.