JP2003271832A - Electronic business transaction method and electronic business transaction device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic business transaction method and an electronic business transaction device capable of compensating risk of an enterprise having high security level when performing business transaction between customers having different security levels of computer environment. <P>SOLUTION: In this electronic business transaction method, business transaction between customers is performed using a computer 15. To achieve above mentioned purpose, the computer 15 acquires security evaluation of computer environment for every customer who performs business transaction and has a business transaction stage for performing business transaction between customers in accordance with a difference of security evaluation. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic commerce method and an electronic commerce apparatus, and more particularly to an electronic commerce method and an electronic commerce apparatus for carrying out commerce between customers based on a security evaluation of a computer environment.

[0002]

2. Description of the Related Art In recent years, electronic commerce (Electron Commerce) for conducting commerce on a computer network such as the Internet
ic Commerce) has started. For electronic commerce, BtoC (Business
to Consumer), BtoB (Bu
siness to Business) etc.

For example, BtoB (hereinafter referred to as business transaction between companies) performed between companies is a LAN (Local Area Network).
Alternatively, it has been carried out by connecting mutual corporate networks constructed by using WAN (Wide Area Network) or the like via a computer network such as the Internet.

[0004]

By the way, when connecting a corporate network to the Internet or the like, the security level of the corporate network is set high to prevent unauthorized access and leakage of confidential data to maintain confidentiality. There was a need.

However, when conducting business transactions between companies, if the security level of the company network of the other party is not high, the security of the company network of the other party is broken and the data of the company having a high security level is also leaked. There was a high possibility that it would end up.

[0006] Therefore, there is a problem that when a business transaction is carried out between companies having different security levels of the in-house network, a company having a high security level has a large risk.

The present invention has been made in view of the above points, and when conducting a commercial transaction between customers having different security levels in a computer environment, an electronic commercial transaction method capable of compensating for the risk of a company having a high security level. And an electronic commerce device.

[0008]

In order to solve the above-mentioned problems, the present invention is an electronic commerce method for carrying out commercial transactions between customers using a computer, wherein the computer carries out a commercial transaction for each customer. It is characterized by having a commercial transaction step of obtaining a security evaluation of a computer environment and conducting a commercial transaction between the customers according to the difference in the security evaluation.

In such an electronic commerce method, the security evaluation of the computer environment can be obtained for each customer who conducts the business transaction, and the business transaction between the customers can be performed according to the difference in the security evaluation. It is possible to compensate the risk.

Further, in the present invention, in the commercial transaction step, a commercial transaction condition setting step of acquiring a security evaluation of a computer environment of a customer who conducts a commercial transaction and setting a commercial transaction condition between the customers according to a difference in the acquired security evaluations. And a commercial transaction processing step of performing a commercial transaction between the customers at a commercial transaction price according to the commercial transaction conditions.

In such an electronic commerce method, since the business transaction condition between customers can be set according to the difference in security evaluation and the business transaction between customers can be performed at the commercial transaction price according to the business transaction condition, the security level is high. Corporate risk can be compensated by adjusting the transaction price.

Further, the present invention is characterized in that the commercial transaction condition is a correction rate of a commercial transaction price according to a difference in security evaluation between customers who conduct a commercial transaction.

In such an electronic commerce method, the correction rate of the commerce price can be set as the commerce condition.

In the present invention, the commercial transaction processing step is
While calculating a correction amount based on the correction rate of the commercial transaction price, while adding the correction amount to the commercial transaction price from the customer with a high security evaluation to the customer with a low security evaluation,
It is characterized in that the correction amount is subtracted from a commercial transaction price for a customer having a high security evaluation from a customer having a low security evaluation.

In such an electronic commerce method, the correction amount is calculated based on the correction rate of the commerce price, and the correction amount is added to the commerce price from the customer with high security evaluation to the customer with low security evaluation, while the security evaluation is low. By subtracting the correction amount from the customer transaction price for the customer with a high security evaluation, the customer transaction price can be adjusted according to the difference in security level.

As a result, it is possible to compensate the risk of a company having a high security level by adjusting the transaction price.

In order to solve the above-mentioned problems, the present invention is an electronic commerce device for conducting commercial transactions between customers, wherein a security evaluation of a computer environment is acquired for each customer who conducts commercial transactions, and the difference between the security evaluations is obtained. According to the present invention, there is provided a commercial transaction means for conducting commercial transactions between the customers.

In such an electronic commerce device, the security evaluation of the computer environment can be obtained for each customer who conducts a commercial transaction, and the commercial transaction between the customers can be performed according to the difference in the security evaluation. It is possible to compensate the risk.

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an example of an electronic commerce system according to the present invention. Electronic commerce system 1 of FIG.
Is a security inspection device 10 and an electronic commerce device 15
The information providing apparatus 20, the computer environment 30 of the user A, and the computer environment 40 of the user B are connected via a network 50 such as the Internet.

The information providing device 20 is managed by a non-profit information providing organization or the like, and provides, for example, information of problem users with low security evaluation. The computer environments 30 and 40 are, for example, the LAN of the user who requests the security audit from the security service company.

The security inspection device 10 is managed by a security service company that performs a security inspection. The security service company makes a security audit contract with a company or the like having the computer environments 30 and 40, and carries out a security audit of the computer environments 30 and 40 according to the contents of the contract. The electronic commerce device 15 mediates a commercial transaction between users. For example, the electronic commerce device 15 has user A and user B.
Mediate business transactions with.

Next, details of the security inspection device 10 and the electronic commerce device 15 will be described. FIG. 2 is a hardware configuration diagram of an embodiment of the security inspection device and the electronic commerce device according to the present invention. The security inspection device 10 or the electronic commerce device 15 includes an input device 100, a display device 101, a drive device 102, and a recording medium 103 which are connected to each other by a bus B.
And an auxiliary storage device 104, a memory device 105, an arithmetic processing device 106, and an interface device 107.

The input device 100 is composed of a keyboard and a mouse, and is used for inputting various operation instructions. The display device 101 displays various windows and data necessary for operation. The interface device 107 includes, for example, a modem (MODEM), a router (Router), etc., and is used to connect to the network 50.

The security inspection program used by the security inspection apparatus 10 or the electronic commercial transaction program used by the electronic commercial transaction apparatus 15 is provided by a recording medium 103 such as a CD-ROM. The recording medium 103 recording the security inspection program or the electronic commerce program is set in the drive device 102, and the security inspection program or the electronic commerce program is installed in the auxiliary storage device 104 from the recording medium 103 via the drive device 102.

The auxiliary storage device 104 stores the installed security audit program or electronic commerce program, and also stores necessary files and data. For example, the auxiliary storage device 104 stores various tables, which will be described later, necessary for processing the security audit program or the electronic commerce program. The various tables may be managed by a database server provided in addition to the security inspection device 10 or the electronic commerce device 15.

The memory device 105 reads out and stores the security inspection program or the electronic commerce program from the auxiliary storage device 104 when the security inspection device 10 or the electronic commerce device 15 is activated. Processor 1
06 executes a function relating to the security inspection device 10 or the electronic commerce device 15 according to the security inspection program or the electronic commerce program stored in the memory device 105.

FIG. 3 is a functional block diagram of an embodiment of the security inspection device according to the present invention. The security inspection device 10 of FIG. 3 includes an implementation period determination unit 61, a problem user information confirmation unit 62, a security diagnosis unit 63, a security evaluation unit 64, a security evaluation unit 65 for each industry,
Implementation cycle reference table 66, product release time management table 67, security hole information transmission number management table 68, product implementation cycle table 69, server implementation cycle table 70, security diagnosis result table 71, A security evaluation result table 72,
It is configured to have a security evaluation reference table 73 for each industry and a security evaluation result table 74 for each user.

The processing procedure of the security inspection device 10 of FIG. 3 will be described below. FIG. 4 shows a flowchart of an embodiment of the processing of the security inspection device.

In step S10, the implementation cycle determining unit 61
Performs the processing shown in FIG. 5 for determining the security audit implementation cycle. FIG. 5 shows a flowchart of an embodiment of security audit implementation cycle determination processing.

In step S11, the implementation cycle determining unit 61
Collects the product release information and creates the product release time management table 67. FIG. 6 is a block diagram showing an example of the product release time management table. The product release time management table 67 is an operation system (hereinafter referred to as “O”).
S)), a product category representing a product category such as an application, a product name, and a release time of the product are included as data items. The product release time management table 67 is for displaying the release period after the product is released for each product.

In step S12 following step S11, the implementation cycle determining unit 61 collects the security hole information of the product and creates the security hole information transmission number management table 68. FIG. 7 is a block diagram showing an example of a security hole information transmission number management table. The security hole information transmission number management table 68 has, as data items, a product category, a product name, and an information transmission number indicating the number of security hole information transmitted in a predetermined period. Security hole information transmission number management table 6
8 shows the number of security hole information transmitted in a predetermined period for each product.

In step S13 following step S12, the implementation cycle determination unit 61 reads the release period of each product from the product release time management table 67, and
The information transmission number of security hole information for each product is read from the security hole information transmission number management table 68. Then, the implementation cycle determining unit 61 reads out the remote audit implementation cycle and the on-site implementation cycle from the implementation cycle reference table 66 based on the read release period and the information transmission number of the security hole information.

FIG. 8 is a block diagram showing an example of the implementation cycle reference table. The implementation cycle reference table 66 has, as data items, a product category, a release cycle of the product, a reference of an execution cycle based on the number of information transmissions of security hole information, and a security audit execution cycle. The implementation cycle reference table 66 derives a security audit implementation cycle according to the product release period and the number of transmitted security hole information.

Progressing to step S14 following step S13, the implementation cycle determining unit 61 creates a product-specific implementation cycle table 69 according to the result of step S13. Figure 9
[Fig. 3] shows a configuration diagram of an example of an implementation cycle table for each product.
The product-specific execution cycle table 69 has, as data items, a product category, a product name, and a security audit execution cycle of the product.

For example, assuming that the current time is April 1, 2002, the process for creating the product-specific implementation cycle table 69 will be described. The implementation cycle determination unit 61 acquires the release period “1 year 6 months” of the product “AAA” from the product release time management table 67 of FIG. Implementation cycle determination unit 61
Acquires the information transmission number "120" of the security hole information of the product "AAA" from the security hole information transmission number management table 68 of FIG.

Then, the implementation cycle determining unit 61 sets the release period "1 year and 6 months" and the number of security hole information transmissions "120" from the implementation cycle reference corresponding to the product category "OS" in the implementation cycle reference table 66. By selecting the matching ones, the remote audit execution cycle “1” and the on-site audit execution cycle “2” of the product are derived. By deriving the execution cycle of the remote audit and the execution cycle of the on-site audit for all products, the execution cycle table 69 for each product in FIG. 9 can be created.

In step S15 following step S14, the implementation cycle determination unit 61 acquires information on the server that constitutes the computer environment of the user who performs the security audit, the OS and applications on the server, and the implementation cycle for each product. The remote audit execution cycle and the on-site audit execution cycle of the OS and the application on the server are derived from the table 69, respectively.

In step S16 following step S15, the execution period determination unit 61 compares the remote inspection execution period of the OS and the application on the server with the on-site inspection execution period. Then, the execution cycle determination unit 61 determines the shortest execution cycle of the remote audit and the shortest execution cycle of the on-site audit as the remote audit execution cycle and the on-site audit execution cycle of the server.

For example, the execution cycle table 6 for each product in FIG.
An example of determining the remote audit execution cycle and the on-site audit execution cycle of the server composed of the product "EEE", the product "aaa", and the product "ccc" by using 9 will be briefly described. Referring to the product-specific execution cycle table 69 in FIG. 9, the remote audit execution cycles of the product “EEE”, the product “aaa”, and the product “ccc” are 1, 1 and 1 month. In addition, product "EEE", product "aaa"
And the on-site audit period for product "ccc" is 2, 1 and 1 month.

In this case, the implementation cycle determining unit 61 determines the shortest remote audit implementation cycle of 1 month and the on-site audit implementation cycle of 1 month as the remote audit implementation cycle and the on-site audit implementation cycle of the server.

In step S17 following step S16, the implementation cycle determination unit 61 determines the remote audit implementation cycle and the on-site audit implementation cycle for all servers and creates the server-specific implementation cycle table 70.
FIG. 10 shows a configuration diagram of an example of the implementation cycle table for each server. The server-based implementation cycle table 70 has, as data items, a server name, a product category, a product name used, and a security audit implementation cycle. The server-based implementation cycle table 70 represents, for each server, a remote audit implementation cycle and an on-site audit implementation cycle as security audit implementation cycles.

Returning to FIG. 4, in step S20, the problem user information confirmation unit 62 confirms the problem user information and performs a security evaluation process according to the problem user information.
Perform processing such as. FIG. 11 shows a flowchart of an example of the problem user information confirmation processing.

In step S21, the problem user information confirmation section 62 periodically confirms the update status of the problem user information. For example, the problem user information includes blacklist information by a non-profit organization, security trouble company information provided by a public institution or public company, and the like.

In step S22 following step S21, the problem user information confirmation unit 62 determines whether the problem user information has been updated. The determination as to whether or not the problem user information has been updated can be made using, for example, the update date of the Web page or the date of sending the mail.

If it is determined that the problem user information has not been updated (NO in S22), problem user information confirmation unit 62 proceeds to step S21. On the other hand, if it is determined that the problem user information has been updated (YES in S22)
S), the problem user information confirmation unit 62 proceeds to step S23.

In step S23, the problem user information confirmation unit 62 confirms the user name and host name (server name) from the problem user information. Progressing to step S24 following step S23, it is determined whether the user name and host name confirmed in step S23 belong to the official contract user. Here, the formal contract user is, for example, a company to which the security service company that manages the security auditing device 10 has made a contract regarding security auditing.

When it is determined that the user is a formal contract user (S2
4), the problem user information confirmation unit 62 proceeds to step S25, and other services of the formal contract user included in the problem user information (for example, security insurance,
The security evaluation is reduced, for example, by one rank while the fee for maintenance etc.) is discounted. On the other hand, when determining that the user is not a formal contract user (NO in S24), the problem user information confirmation unit 62 proceeds to step S26 and lowers the security evaluation by, for example, one rank.

Returning to FIG. 4, in step S30, the security diagnosis unit 63 issues a special feature, for example, "Computer & Network LAN" (Ohm Co., Ltd.), December 2001, "Improve Security Level! Unauthorized Access Edition".
Security diagnosis processing is performed by the publicly known security diagnosis method described in 1. The security diagnosis unit 63 stores the result of the security diagnosis processing in the security diagnosis result table 71.

After step S30, the security evaluation section 64 proceeds to step S40, and the security evaluation unit 64, for example, features "Increase the level of security! Unauthorized access" in the December 2001 issue of "Computer & Network LAN" (Ohm Co.). N + I NETWORK GUIDE "
(Soft Bang Publishing Co., Ltd.) 2001 1
Security evaluation processing for each server is performed by the publicly known security evaluation method described in the special issue “Security Management” in the February issue. Security evaluation unit 64
Stores the result of the security evaluation process in the security evaluation result table 72.

In step S50 following step S40, the industry-specific security evaluation section 65 performs security evaluation for each user based on the industry-specific security evaluation reference table 73. FIG. 12 is a block diagram of an example of a security evaluation standard table for each industry. The industry-specific security evaluation standard table 73 has an inspection standard and an evaluation rank as data items. The industry-specific security evaluation standard table 73 is for determining the security evaluation rank of the user from the security evaluation rank of each server.

FIG. 12A is an example of a security evaluation standard table of a user who places importance on trust in the public, such as a bank or a ministry. Further, FIG. 12B is an example of a security evaluation reference table of general users other than users who place importance on trust in the public such as banks and ministries. The industry-specific security evaluation unit 65 reads the security evaluation rank of the server constituting the computer environment of one user from the security evaluation result table 72, and determines the security evaluation rank for each user according to the security evaluation reference table 73 for each industry. .

For example, of the servers constituting the computer environment of one user, less than 5% of servers have security evaluation rank C and 8 servers have security evaluation rank A.
If it is 0% or more, the user who uses the security evaluation reference table for each industry shown in FIG. 12B has the security evaluation rank A.

On the other hand, if there is at least one server of security evaluation rank C among the servers constituting the computer environment of one user, the user who uses the security evaluation reference table for each industry shown in FIG. Rank C. As described above, by providing the security evaluation reference table 73 for each industry, it is possible to flexibly and dynamically perform a security audit according to the needs and background of the user.

The industry-specific security evaluation unit 65 stores the result of security evaluation for each user in the security evaluation result table 74 for each user. FIG. 13 is a block diagram showing an example of a security evaluation result table for each user.
The security evaluation result table 74 for each user has a user name, a business type, and an evaluation rank as data items. Security evaluation result table 74 for each user
Is for indicating the security evaluation rank for each user.

FIG. 14 is a functional block diagram of an embodiment of the electronic commerce device according to the present invention. The electronic commerce device 15 of FIG. 14 includes a security evaluation rank acquisition unit 80, a commerce unit 81, and a security evaluation result table 8 for each user.
2 and a commercial transaction price correction table 83.

The processing procedure of the electronic commerce device 15 of FIG. 14 will be described below. FIG. 15 shows a flowchart of an embodiment of processing of the electronic commerce device.

In step S60, the security evaluation rank acquisition unit 80 acquires the security evaluation rank for each user from the security evaluation result table 74 for each user of the security inspection apparatus 10 and stores it in the security evaluation result table 82 for each user.

In step S70, the commercial transaction section 81 performs the electronic commercial transaction processing as shown in FIG. 16 in consideration of the security evaluation rank. FIG. 16 shows a flowchart of an embodiment of the electronic commerce process in consideration of the security evaluation rank. Here, an example of the electronic commerce process performed by company X with security evaluation rank B and company Y with security evaluation rank C will be described.

In step S71, the commercial transaction section 81 reads the security evaluation rank B of company X and the security evaluation rank C of company Y from the security evaluation result table 82 for each user. Then, the commercial transaction unit 81 refers to the commercial transaction price correction table 83 and determines the correction rate of the X company and the correction rate of the Y company according to the security evaluation rank B of the X company and the security evaluation rank C of the Y company. .

FIG. 17 is a block diagram showing an example of the correction table of the commercial transaction price. The transaction price correction table 83 is
It has a security evaluation rank and a correction factor as data items. The commercial transaction price correction table 83 is for displaying the correction rate for each security evaluation rank. For example, in the case of the commercial transaction price correction table 83 in FIG. 17, the correction rate for company X is -3% and the correction rate for company Y is -5%.

Proceeding to step S72 following step S71, the commercial transaction section 81 performs processing for the company X and the company Y to confirm the security evaluation ranks of the other. In step S73 following step S72, the commercial transaction unit 81 determines whether or not there is a difference between the security evaluation rank of company X and the evaluation rank of company Y read in step S71.

If it is determined that there is a difference between the security evaluation rank of company X and the evaluation rank of company Y (Y in S73).
ES), the commercial transaction unit 81 proceeds to step S75. In this embodiment, the security evaluation rank of company X is B, and the security evaluation rank of company Y is C. Therefore, there is a difference between the security evaluation rank of company X and the evaluation rank of company Y in step S73. It is determined that there is. If it is determined that there is no difference between the security evaluation rank of company X and the evaluation rank of company Y (NO in S73), the commercial transaction unit 81 proceeds to step S74.

In step S74, the commercial transaction section 81 determines that X
Since there is no difference between the security evaluation rank of the company and the security evaluation rank of the company Y, the security risk labor ratio is set to 0% and the process proceeds to step S76. Further, in step S75, the commercial transaction unit 81 calculates the difference between the correction rate of the X company and the correction rate of the Y company as the security risk step rate with respect to the commercial transaction price of the commercial transaction performed between the X company and the Y company. .
In this embodiment, the correction rate of company X is -3%, and the correction rate of company Y is -5%. Therefore, + 2% is calculated as the security risk step rate.

Then, the commercial transaction section 81 sets the calculated security risk rate as the security risk rate of a company having a higher security evaluation rank, and proceeds to step S76. For example, in the present embodiment, company X sets a security risk labor ratio of + 2% for company Y.

In step S76, the commercial transaction section 81 determines that X
Company to Y company. If it is determined that the sales are from X company to Y company (YES in S76),
The commercial transaction unit 81 proceeds to step S77 and notifies the company Y by adding a security risk fee to the normal commercial transaction price. Therefore, Company X can sell the product at the commercial transaction price in which the security risk fee is added to the normal commercial transaction price.

On the other hand, when it is determined that the sale is from Y company to X company (NO in S76), the commercial transaction section 81 proceeds to step S78 and subtracts the security fee from the normal commercial transaction price to notify X company. Therefore, Company X can purchase the product at the commercial transaction price obtained by subtracting the security risk fee from the normal commercial transaction price. The security risk fee is calculated by using the security risk labor ratio.

According to the present invention, when a company having a high security level and a company having a low security level are engaged in electronic commerce, by adjusting the commerce price so that the company having a high security level is advantageous, the security level is high. It is possible to compensate a company for the risk of data leakage.

In the electronic commerce system 1 of FIG. 1,
Although the security inspection device 10 and the electronic commerce device 15 are separately provided, the function of the security inspection device 10 may be provided in the electronic commerce device 10.

FIG. 18 is a block diagram showing another example of the electronic commerce system according to the present invention. The electronic commerce system 2 of FIG. 18 is different from the electronic commerce system 1 of FIG. 1 in that the security inspection device 10 and the electronic commerce device 15 of FIG. 1 are combined to form an electronic commerce device 17. Since the details other than the electronic commerce device 17 have been described above, the description thereof will be omitted.

The electronic commerce device 17 is constructed, for example, as shown in FIG. FIG. 19 is a functional block diagram of another embodiment of the electronic commerce device according to the present invention. The electronic commerce device 17 of FIG. 19 includes an execution cycle determination unit 61, a problem user information confirmation unit 62, a security diagnosis unit 63, a security evaluation unit 64, an industry-specific security evaluation unit 65, and an execution cycle reference table 66. A product release time management table 67, a security hole information transmission number management table 68, a product-specific execution cycle table 69, a server-specific execution cycle table 70, a security diagnosis result table 71, and a security evaluation result table 72. , A security evaluation standard table 73 by industry, a security evaluation result table 74 by user, and a commercial transaction section 81
And a commercial transaction price correction table 83.

Since the electronic commerce device 17 has the security evaluation result table 74 for each user, the security evaluation rank acquisition unit 80 and the security evaluation result table 82 for each user are not provided. The details of each functional block and the table that constitute the electronic commerce device 17 have been described above, and thus the description thereof will be omitted.

As described above, by using the electronic commerce systems 1 and 2 according to the present invention, a security audit for each customer is performed, and by using the result of the security audit, it is possible to perform electronic commerce in consideration of the difference in security level. Become.

The present invention is conceivable as the following additional configurations. (Supplementary Note 1) An electronic commerce method for performing a commercial transaction between customers using a computer, wherein the computer acquires a security evaluation of a computer environment for each customer making a commercial transaction, and the computer environment is evaluated according to a difference in the security evaluation. An electronic commerce method characterized by having a commercial transaction stage of performing commercial transactions between customers. (Supplementary Note 2) In the commercial transaction step, a commercial transaction condition setting step of acquiring a security evaluation of a computer environment of a customer who conducts a commercial transaction and setting a commercial transaction condition between the customers according to a difference in the acquired security evaluations; And a commercial transaction processing step of performing a commercial transaction between the customers at a commercial transaction price according to the above item. (Supplementary Note 3) The electronic commercial transaction method according to Supplementary Note 2, wherein the commercial transaction condition is a correction rate of a commercial transaction price according to a difference in security evaluation between customers who conduct a commercial transaction. (Supplementary Note 4) In the commercial transaction processing step, a corrected amount is calculated based on the correction rate of the commercial transaction price, and the corrected amount is added to the commercial transaction price from a customer with a high security evaluation to a customer with a low security evaluation, while the security evaluation is low. 4. The electronic commerce method according to appendix 3, wherein the correction amount is subtracted from the commerce price of the customer who has a high security evaluation. (Supplementary Note 5) An electronic commerce device for performing a commercial transaction between customers, comprising: a commercial transaction means for acquiring a security evaluation of a computer environment for each customer performing the commercial transaction and performing a commercial transaction between the customers according to the difference in the security evaluation. An electronic commerce device characterized by having. (Supplementary Note 6) An electronic commerce program for causing a computer to obtain a security evaluation of a computer environment for each customer who conducts a commercial transaction and execute a commercial transaction procedure for performing a commercial transaction between the customers according to the difference in the security evaluation. (Supplementary Note 7) An electronic commerce program for acquiring a security evaluation of a computer environment for each customer who conducts a commercial transaction and executing a commercial transaction procedure for performing a commercial transaction between the customers according to the difference in the security evaluation is recorded on a computer. Computer-readable recording medium.

[0075]

As described above, according to the present invention, the security evaluation of the computer environment can be obtained for each customer who conducts a commercial transaction, and the commercial transaction between the customers can be performed according to the difference in the security evaluation. It is possible to compensate the risk of high-value companies.

[0076]

[Brief description of drawings]

FIG. 1 is a configuration diagram of an example of an electronic commerce system according to the present invention.

FIG. 2 is a hardware configuration diagram of an embodiment of a security inspection device and an electronic commerce device according to the present invention.

FIG. 3 is a functional configuration diagram of an embodiment of a security inspection device according to the present invention.

FIG. 4 is a flowchart of an example of processing of a security inspection device.

FIG. 5 is a flowchart of an embodiment of security audit implementation cycle determination processing.

FIG. 6 is a configuration diagram of an example of a product release time management table.

FIG. 7 is a configuration diagram of an example of a security hole information transmission number management table.

FIG. 8 is a configuration diagram of an example of an implementation cycle reference table.

FIG. 9 is a block diagram of an example of an implementation cycle table for each product.

FIG. 10 is a block diagram of an example of an implementation cycle table for each server.

FIG. 11 is a flowchart of an example of a problem user information confirmation process.

FIG. 12 is a configuration diagram of an example of a security evaluation standard table for each industry.

FIG. 13 is a block diagram of an example of a security evaluation result table for each user.

FIG. 14 is a functional configuration diagram of an embodiment of an electronic commerce device according to the present invention.

FIG. 15 is a flowchart of an example of processing of the electronic commerce device.

FIG. 16 is a flowchart of an example of electronic commerce processing in consideration of a security evaluation rank.

FIG. 17 is a block diagram of an example of a commercial transaction price correction table.

FIG. 18 is a block diagram of another example of the electronic commerce system according to the present invention.

FIG. 19 is a functional configuration diagram of another embodiment of the electronic commerce device according to the present invention.

[Explanation of symbols]

1 Security audit system 10 Security inspection device 15 Electronic Commerce Equipment 20 Information providing device 30,40 computer environment 50 network 61 Implementation cycle determination unit 62 Problem User Information Confirmation Section 63 Security Diagnosis Department 64 Security Evaluation Department 65 Industry Security Evaluation Department 66 Implementation cycle reference table 67 Product Release Timing Management Table 68 Security hole information transmission number management table 69 Implementation cycle table for each product 70 Implementation cycle table for each server 71 Security diagnosis result table 72 Security evaluation result table 73 Security Evaluation Criteria Table by Industry 74 Security Evaluation Result Table by User 80 Security Evaluation Rank Acquisition Department 81 Commerce Department 82 Security Evaluation Result Table by User 83 Commerce Price Correction Table 100 input device 101 display device 102 Drive device 103 recording medium 104 auxiliary storage 105 memory device 106 arithmetic processing unit 107 Interface device B bus

Claims (5)

[Claims] 1. An electronic commerce method for performing a commercial transaction between customers using a computer, wherein the computer acquires a security evaluation of a computer environment for each customer making a commercial transaction, and according to the difference in the security evaluation. An electronic commerce method comprising a commercial transaction step of performing a commercial transaction between the customers. 2. A commercial transaction condition setting step of acquiring a security evaluation of a computer environment of a customer who conducts a commercial transaction and setting a commercial transaction condition between the customers according to a difference in the acquired security evaluations, the commercial transaction step: 2. The electronic commerce method according to claim 1, further comprising: a commercial transaction processing step of performing a commercial transaction between the customers at a commercial transaction price according to a condition. 3. The electronic commercial transaction method according to claim 2, wherein the commercial transaction condition is a correction rate of a commercial transaction price according to a difference in security evaluation between customers who conduct a commercial transaction. 4. The commercial transaction processing step calculates a correction amount based on a correction rate of a commercial transaction price, and adds the correction amount to a commercial transaction price from a customer with a high security evaluation to a customer with a low security evaluation, while 4. The electronic commerce method according to claim 3, wherein the correction amount is subtracted from a commerce price for a customer having a high security evaluation from a customer having a low security. 5. An electronic commerce device for conducting commerce between customers, wherein a commerce means for obtaining a security evaluation of a computer environment for each customer making a commerce and performing a commerce between the customers according to the difference in the security evaluation. An electronic commerce device comprising: