Patent Application
20250217497
The present invention relates to an information processing apparatus and an information processing method that support the construction of a computer system, and further relates to a computer-readable recording medium having recorded thereon a program for realizing the apparatus and method.
Many computer systems are connected externally by networks and are constantly exposed to external threats. Companies are thus required to optimize the operation and maintenance of computer systems.
In response to this, Patent Document 1 discloses an apparatus that supports the operation and maintenance of computer systems. The apparatus disclosed in Patent Document 1 visualizes a network in a computer system and models the visualized network. The apparatus disclosed in Patent Document 1 then executes simulation using the modeled network, and thereby performs network path detection and failure diagnosis. Accordingly, operation and maintenance of a computer system by an administrator will be supported in the case where the apparatus disclosed in Patent Document 1 is introduced.
Patent Document 2 discloses an apparatus for automatically creating dataflow information of a computer system. The apparatus disclosed in Patent Document 2 generates job flow diagrams and dataflow information of the computer system, based on JCL (Job Control Language) analysis information, program analysis information, jobnet information, and utility information. With the apparatus disclosed in Patent Document 2, the administrator is able to grasp the overall system, and to easily grasp places that need to be modified in the case of reconstructing the system. Operation and maintenance of a computer system by an administrator will also be supported in the case where the apparatus disclosed in Patent Document 2 is introduced.
In recent years, IT technology has been developing at an accelerated pace, and computer systems are becoming more and more complex. Thus, companies configure a security policy and carry out construction, operation, and maintenance of the computer system in line with the security policy.
However, with the apparatuses disclosed in Patent Documents 1 and 2 described above, security policies are not taken into consideration at all, thus making it impossible to support construction of a computer system that is in line with a security policy.
An example object of the present invention is to provide an information processing apparatus, an information processing method, and a computer-readable recording medium that can support construction of a computer system by presenting a configuration procedure that is in line with a security policy.
In order to achieve the above-described object, an information processing apparatus according to an example aspect of the present invention includes:
In order to achieve the above-described object, an information processing method according to an example aspect of the present invention includes:
In order to achieve the above-described object, a computer readable recording medium according to an example aspect of the present invention is a computer readable recording medium that includes recorded thereon a program,
As described above, according to the present invention, it is possible to support construction of a computer system by presenting a configuration procedure that is in line with a security policy.
Hereinafter, an information processing apparatus, an information processing method, and a program of a first example embodiment will be described with reference to
Initially, a schematic configuration of the information processing apparatus of the first example embodiment will be described using
An information processing apparatus 10 of the first example embodiment illustrated in
The policy analysis unit 11 analyzes the security policy of operation of a target system. The dataflow information analysis unit 12 analyzes dataflow information of the target system.
The operation procedure construction unit 13, first, searches operation procedures registered in advance, using the result of analysis of the security policy, and specifies a corresponding operation procedure. Next, the operation procedure construction unit 13 applies the result of analysis of the dataflow information by the dataflow information analysis unit 12 to the specified operation procedure and constructs an operation procedure of the target system.
In this way, the information processing apparatus 10 constructs an optimal operation procedure for the system from an operation procedure that is in line with a security policy and dataflow information of the target system. The information processing apparatus 10 is thus able to support construction of a computer system, by presenting the user with a configuration procedure that is in line with the security policy.
Next, the configuration and functions of the information processing apparatus 10 of the first example embodiment will be described more specifically. First, as illustrated in
First, security policies are configured in advance by an organization that operates the target system, or the like, and stored in a database or the like. Examples of security policies include “passwords must contain at least 10 alphanumeric characters”, “use RSA keys for encryption”, “retain logs for at least 3 years”, and “use a ledger to manage terminal information”.
A plurality of security policies are configured and categorized in advance by tags. The user of the information processing apparatus 10 is thus able to designate a security policy he or she wants to confirm from among the plurality of security policies. The user designates a security policy by, for example, entering keywords such as “password setting”, “encryption”, and “log retention”.
In the first example embodiment, the policy analysis unit 11 initially receives designation of a security policy by the user. The policy analysis unit 11 then extracts information relating to the security policy designated by the user, from among the plurality of security policies. Specifically, the policy analysis unit 11 receives keywords entered by the user, searches the plurality of security policies, based on the received keywords, and specifies a security policy corresponding to the keywords. The policy analysis unit 11 then extracts information of the designated security policy, such as a tag that is configured and parameters associated with the tag, for example.
In the first example embodiment, the dataflow information analysis unit 12 extracts, from dataflow information of the target system, information related to the information extracted as analysis of the security policy by the policy analysis unit 11.
Specifically, dataflow information is information for constructing dataflow diagrams. Dataflow diagrams represent the flow of data in a system as a graph and are used in order to design and analyze the structure of the system. Dataflow diagrams are hierarchically generated according to the use purpose of the system. Dataflow diagrams are, for example, generated by using a technology disclosed in the following reference. Dataflow diagrams may also be created manually.
Reference: Shun MIYAZAKI and Junpei KAMIMURA, “Automation of Security Vulnerability Analysis by Auto-generated DFD”, IEICE Technical Report, vol. 121, no. 275, ICSS2021-48, pp. 13-18, November 2021
A plurality of dataflow diagrams are created, similarly to the security policies, and the dataflow diagrams are categorized by tags. Similarly, the dataflow information is also categorized by tags. Thus, the dataflow information analysis unit 12, first, specifies dataflow information to be analyzed, using the tag output by the policy analysis unit 11. The policy analysis unit 11 then extracts, from the specified dataflow information, information such as location, operation, process, and tag, as a result of analysis of the dataflow information.
In the first example embodiment, the operation procedure database 20 registers and stores an operation procedure for each tag. An example of an operation procedure is “add “/sys/log/auth.log rotate 52” to end of/etc/logrotate.conf file of A server” for a tag “log retention”. Another example of an operation procedure is “create cron.conf file containing “0 30/etc/inet/ntpd-b NTPserver” on A server and execute command “crontab cron.conf” on A server” for a tag “time synchronization configuration”.
In the first example embodiment, the operation procedure construction unit 13 searches the operation procedure database 20, using the information extracted from the security policies, and specifies a corresponding operation procedure. Specifically, the operation procedure construction unit 13 searches the operation procedure database 20, using the tag output by the policy analysis unit 11. An operation procedure that corresponds to the tag is thereby specified.
Next, the operation procedure construction unit 13 integrates the specified operation procedure and the information extracted from the dataflow information to construct a final operation procedure of the target system. Specifically, the operation procedure construction unit 13 integrates a device name such as a specific server name extracted from the dataflow information into the operation procedure retrieved from the operation procedure database 20. Thereafter, the operation procedure construction unit 13 outputs the resultant operation procedure.
Here, a specific example of processing in the information processing apparatus 10 will be described, using
In the example in
Also, in the example in
Furthermore, in the example in
Next, the operation procedure construction unit 13 adds “[node]: AAA server” and “[Directory]: /sys/log” from the information extracted from the dataflow information to the specified operation procedure. The operation procedure construction unit 13 then outputs “[Target]: AAA server”, “[Configuration file directory]: /etc/”, “[Retention directory]: /sys/log”, “[Configuration file]: logrotate.conf”, and “[Add/Correct]: rotate 52” as an operation procedure of the target system.
In the example in
Also, in the example in
Furthermore, in the example in
Next, the operation procedure construction unit 13 adds “[node]: BBB server” from the information extracted from the dataflow information to the specified operation procedure. The operation procedure construction unit 13 then outputs “[Target]: BBB server”, “[Configuration file directory]: /etc/inet”, “[Configuration file]: ”, “[Add/Correct]: 0 30 ***/etc/inet/ntpd-b NTPserver” and “Run command: “crontab cron.conf”” as an operation procedure of the target system.
Next, operations of the information processing apparatus 10 of the first example embodiment will be described using
As illustrated in
Next, the policy analysis unit 11 analyzes the security policy designated by the user, by extracting information relating to the designated security policy from among a plurality of security policies set in advance (step A2). Examples of extracted information include a tag assigned to the security policy and parameters associated with the tag.
Next, the dataflow information analysis unit 12 analyzes dataflow information, by extracting information related to the information extracted in step A2 from dataflow information of the target system (step A3). Specifically, the dataflow information analysis unit 12 specifies dataflow information to be analyzed, using the tag extracted in step A2, and extracts information such as location, operation, process, and tag from the specified dataflow information.
Next, the operation procedure construction unit 13 searches the operation procedure database 20, using the information extracted from the security policies by the analysis in step A2, and specifies a corresponding operation procedure (step A4). Specifically, the operation procedure construction unit 13 searches the operation procedure database 20, using the tag extracted in step A2. An operation procedure that corresponds to the tag is thereby specified.
Next, the operation procedure construction unit 13 integrates the operation procedure specified in step A4 and the information extracted in step A3 to construct an operation procedure of the target system (step A5). Specifically, the operation procedure construction unit 13 constructs an operation procedure of the target system, by integrating a device name such as a specific server name extracted from the dataflow information into the operation procedure retrieved by step A4.
The operation procedure construction unit 13 outputs the constructed operation procedure to an external display device or to a terminal device of the user. The user is thereby able to confirm the constructed operation procedure.
As described above, in the first example embodiment, an operation procedure of the target system is constructed, by integrating an operation procedure that is in line with a security policy with dataflow information of the target system. The user is thus able to easily construct a computer system that is in line with the security policy, by confirming the constructed operation procedure.
A program of the first example embodiment may be any program that causes a computer to execute steps A1 to A5 illustrated in
The program of the first example embodiment may be executed by a computer system constructed from a plurality of computers. In this case, for example, the computers may each function as one of the policy analysis unit 11, the dataflow information analysis unit 12, and the operation procedure construction unit 13.
Next, an information processing apparatus, an information processing method, and a program of a second example embodiment will be described with reference to the drawings.
First, a configuration of the information processing apparatus of to the second example embodiment will be described using
An information processing apparatus 30 of the second example embodiment illustrated in
However, the second example embodiment differs from the first example embodiment in terms of the function of the operation procedure construction unit 13. In the second example embodiment, the operation procedure construction unit 13, first, determines an operation policy of the target system, using information extracted from the security policies.
The operation procedure construction unit 13 then searches operation procedures registered in advance, using the determined operation policy, and specifies an operation procedure corresponding to a designated security policy. The operation procedure construction unit 13 then also integrates the determined operation policy in addition to the operation procedure and the information extracted from the dataflow information to construct an operation procedure of the target system. The following description focuses on the differences from the first example embodiment.
As illustrated in
The operation policy database 40 registers and stores an operation policy for each tag. Also, the operational policy includes information indicating the level of security required by the system. Specific examples of operation policies will be described using
In the example in
The operation procedure construction unit 13, first, searches the operation policy database 40, using information extracted from the security policies, specifically, the tag “log retention” output by the policy analysis unit 11, and determines an operation policy of the target system.
In the second example embodiment, each operation procedure stored in the operation procedure database 20 is linked to one of the operation policies. Operation procedures may be linked to operation policies by the above-described tags, or by assigning an identifier of the corresponding operation policy to each operation procedure. Furthermore, as illustrated in the example in
In this way, the operation procedures are linked to operation policies, and thus the operation procedure construction unit 13, upon determining an operation policy, searches the operation procedure database 20, using the determined operation policy, and specifies an operation procedure linked to the determined operation policy.
The operation procedure construction unit 13 then integrates a device name such as a specific server name extracted from the dataflow information into the operation procedure retrieved from the operation procedure database 20, and also integrates the operation policy used in the search to construct a final operation procedure. Thereafter, the operation procedure construction unit 13 outputs the resultant operation procedure as illustrated in
In the second example embodiment, the policy analysis unit 11 is also able to receive designation of a security level by the user, in addition to designation of a security policy by the user. In this case, the policy analysis unit 11 notifies the operation procedure construction unit 13 of the received security level, and the operation procedure construction unit 13 determines an operation policy corresponding to the notified security level. Also, the operation procedure construction unit 13 outputs the operation policy and operation procedure corresponding to the notified security level.
Next, operations of the information processing apparatus 30 of the second example embodiment will be described using
As illustrated in
Next, the policy analysis unit 11 analyzes the security policy designated by the user, by extracting information relating to the designated security policy from among a plurality of security policies set in advance (step B2). Step B2 is similar to step A2 illustrated in
Next, the dataflow information analysis unit 12 analyzes dataflow information, by extracting information related to the information extracted in step B2 from dataflow information of the target system (step B3). Step B3 is similar to step A3 illustrated in
Next, the operation procedure construction unit 13 determines an operation policy of the target system, using information extracted from the security policies by the analysis in step B2 (step B4). Specifically, in step B4, the operation procedure construction unit 13 searches the operation policy database 40, using the tag extracted in step B2 and determines an operation policy of the target system.
Next, the operation procedure construction unit 13 searches the operation procedure database 20, using the operation policy determined in step B4, and specifies, for each security level, an operation procedure linked to the determined operation policy (step B5). The operation procedures thus specified are operation procedures corresponding to the security policy designated in step B1.
Next, the operation procedure construction unit 13 integrates the operation policy determined in step B4, the operation procedure for each security level specified in step B5, and the information extracted in step A3 to construct operation procedures for the target system (step B6). Specifically, the operation procedure construction unit 13 integrates a device name such as a specific server name extracted from the dataflow information into the operation procedure for each security level, and further adds the operation policy determined in step B4 to construct operation procedures of the target system.
The operation procedure construction unit 13 outputs the constructed operation procedures to an external display device or to a terminal device of the user. The user is thereby able to confirm the constructed operation procedures.
As described above, in the second example embodiment, an operation procedure of the target system is constructed, by integrating an operation policy that is in line with a security policy, an operation procedure corresponding thereto, and dataflow information of the target system. The user is thus able to easily construct a computer system that is in line with the security policy, by confirming the constructed operation procedure. Also, in the second example embodiment, since an operation procedure is constructed for each security level, the user is able to easily adapt the computer system to the required security level.
A program of the second example embodiment may be any program that causes a computer to execute steps B1 to B7 illustrated in
The program of the second example embodiment may be executed by a computer system constructed from a plurality of computers. In this case, for example, the computers may each function as one of the policy analysis unit 11, the dataflow information analysis unit 12, and the operation procedure construction unit 13.
Using
As illustrated in
The computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to the CPU 111, or in place of the CPU 111. In this case, the GPU or the FPGA can execute the program according to the example embodiment.
The CPU 111 deploys the program according to the example embodiment, which is composed of a code group stored in the storage device 113 to the main memory 112, and carries out various types of calculation by executing the codes in a predetermined order. The main memory 112 is typically a volatile storage device, such as a DRAM (dynamic random-access memory).
Also, the program according to the example embodiment is provided in a state where it is stored in a computer-readable recording medium 120. Note that the program according to the first and second example embodiment may be distributed over the Internet connected via the communication interface 117.
Also, specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device, such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and an input device 118, such as a keyboard and a mouse.
The display controller 115 is connected to a display device 119, and controls display on the display device 119.
The data reader/writer 116 mediates data transmission between the CPU 111 and the recording medium 120, reads out the program from the recording medium 120, and writes the result of processing in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.
Specific examples of the recording medium 120 include: a general-purpose semiconductor storage device, such as CF (CompactFlash®) and SD (Secure Digital); a magnetic recording medium, such as a flexible disk; and an optical recording medium, such as a CD-ROM (Compact Disk Read Only Memory).
Note that the information processing apparatus according to the example embodiment can also be realized by using items of hardware such as electronic circuit correspond to the components rather than the computer in which the program is installed. Furthermore, a part of the information processing apparatus may be realized by the program, and the remaining part of the information processing apparatus may be realized by hardware.
A part or an entirety of the above-described example embodiment can be represented by (Supplementary Note 1) to (Supplementary Note 12) described below but is not limited to the description below.
An information processing apparatus includes:
The information processing apparatus according to supplementary note 1,
The information processing apparatus according to supplementary note 2,
The information processing apparatus according to supplementary note 3,
An information processing method comprising:
The information processing method according to supplementary note 5,
The information processing method according to supplementary note 6,
The information processing method according to supplementary note 7,
A computer-readable recording medium including a program recorded thereon, the program including instructions that cause a computer to carry out:
The computer-readable recording medium of supplementary note 9,
The computer-readable recording medium according to supplementary note 10,
The computer-readable recording medium according to supplementary note 11,
Although the invention of the present application has been described above with reference to the example embodiment, the invention of the present application is not limited to the above-described example embodiment. Various changes that can be understood by a person skilled in the art within the scope of the invention of the present application can be made to the configuration and the details of the invention of the present application.
As described above, according to the present invention, it is possible to support construction of a computer system by presenting a configuration procedure that is in line with a security policy. The present invention is useful in various fields where computer systems with robust security are required.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2022/015928 | 3/30/2022 | WO |
