JP4011940B2 - Information environment setting system, program and method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an information environment setting system, program, and method for setting its own information environment, and in particular, information that enables an inexperienced person to easily and appropriately set the information environment and reduce the burden during setting. The present invention relates to an environment setting system, a program, and a method.
[0002]
[Prior art]
In recent years, the IT (Information Technology) industry has been remarkably developed due to the spread of the Internet and the like. Along with this, various generations of individual users have installed various application programs (hereinafter referred to as applications) such as mailers and browsers in their computer terminals, and set their own information environment accordingly. ing.
[0003]
Here, the setting of the information environment means performing various settings for each application based on an operation through a user interface or the like. The setting contents include at least a setting value for each setting item, and more preferably include applying a patch (correction program) to a security hole or bug.
[0004]
It is preferable that the setting of the information environment is appropriately performed at least from the viewpoint of smoothly using each application. In addition, it is more preferable to carry out optimization appropriately if possible, and from the viewpoint of taking measures against newly discovered security holes, bugs, and the like.
[0005]
[Problems to be solved by the invention]
However, the setting of the information environment as described above is a burdensome work for individuals who have little experience among individual users, because it is difficult to perform the information environment appropriately even if it is used smoothly.
[0006]
The present invention has been made in consideration of the above circumstances, and provides an information environment setting system, program, and method that can easily and appropriately set an information environment even for those with little experience, and can reduce the burden during setting. Objective.
[0007]
[Means for Solving the Problems]
A first invention is an information environment setting system for executing, in the information environment, setting or response processing related to the request information when request information related to the information environment is generated or inputted. Request storage means for storing the request information in a readable / writable manner, request information in the request storage means, and predetermined information risk Requests for one or more layers to link information in a chain risk Request that information be stored in a readable / writable manner risk Storage means; Said Request risk Request for the last layer in the storage means risk Of information risk More than one layer that links information with a predetermined setting or corresponding process risk Corresponding information is stored so that it can be read / written. And the risk handling information does not include handling application information indicating an application to which the handling is executed. Ru risk Correspondence storage means; Of the corresponding application information included in the risk correspondence information in the risk correspondence storage means, the environment information storage means in which corresponding application information indicating an application executable in the information environment is stored in advance so as to be readable / writable When, Based on the request information generated or input, the request risk Requests in storage means risk Request to select information risk Selection means and the request risk Request selected by the selection means risk Based on information Only those corresponding to the corresponding application information in the environment information storage means are searched. Said risk In the correspondence storage means risk Correspondence information Search for risk response information obtained from the search. select risk Correspondence selection means; risk Selected by correspondence selection means risk An information environment setting system comprising: setting / corresponding execution means for executing the related setting or corresponding processing based on correspondence information.
[0008]
As a result, request storage means, request risk Storage means ,risk Corresponding storage means And environmental information storage means Using the request risk Based on the request information generated or entered by the selection means, the request risk Requests in storage means risk Select information, risk Response selection means is requested risk Request selected by the selection means risk Based on information Risk to search only corresponding application information in environmental information storage means In the correspondence storage means risk Correspondence information Search for risk response information obtained from the search Select and set / corresponding execution means risk Selected by correspondence selection means risk Since the related setting or the corresponding processing is executed based on the correspondence information, even an inexperienced person can easily and appropriately set the information environment, and the burden during setting can be reduced.
[0009]
In addition, although the said 1st invention is a case where whole structure is expressed as "system", not only this but whole structure, each information equipment, or each apparatus is "device", "program", "computer-readable" Needless to say, it may be expressed as “a storage medium” or “method”.
[0010]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Before that, the concept of a policy system used in the present invention will be described.
[0011]
(Concept of policy system)
First, knowledge for appropriately setting is regarded as hierarchized elements and their related information, and knowledge is made into parts. This componentized knowledge system is called a policy system.
[0012]
Next, knowledge of parts in the policy system is provided to individual users by a person or group with deep technical experience publicly or limitedly. Each individual user collects componentized knowledge, uses his function to combine the componentized knowledge, constructs a unique policy system, and makes settings according to this policy system.
[0013]
In addition to an individual user, the application itself has a function of judging its own status and changing its own setting status based on a policy system.
[0014]
Therefore, an information environment user who does not have a skill can perform appropriate setting to some extent by using the policy system.
[0015]
Next, such a policy system will be specifically described.
[0016]
FIG. 7 is a schematic diagram for explaining a policy system according to an embodiment of the present invention. Here, the policy system means a knowledge system for outputting an appropriate “response” to the inputted “request”.
[0017]
In FIG. 7, the “request” of the user 10001 is broken down to “correspondence” by the policy system P-1000 and is implemented in the application 3000. The policy system P-1000 is configured as a combination of two-layer element policies in this example, but is not limited thereto, and may be configured as a combination of three or more layers of element policies.
[0018]
Here, the element policy is a determination element that performs output according to an input, and may be an element that associates an input and an output. Specifically, there are two types of two-layer element policies, an element policy P-2000 for the desired risk layer and an element policy P-3000 for the risk response layer.
[0019]
The element policy P-2000 of the request risk layer outputs a risk associated with the request for each type of request input from the user 10001 or the application 3000.
[0020]
The risk response layer element policy P-3000 outputs a response to the risk to the application 3000 or 3000a for each type of risk output from the desired risk layer element policy P-2000.
[0021]
FIG. 8 is a schematic diagram showing a configuration example of an element policy of a desired risk layer. As shown in FIG. 8, the element policies P-2011 to 2012, P-2021 and P-2031 to 32 of the desired risk layer associate “request” with “risk”.
[0022]
Here, the association between “request” and “risk” is not limited to one-to-one correspondence. For example, as shown in element policy P-2011-2012, a plurality of “risks” are related to the same “request”. There is also a case. This is shown in the examples of element policies P-2010 and P-2030. Similarly, as shown in the element policies P-2011, P-2021, and P-2031, the same “risk” may be associated with a plurality of “requests”.
[0023]
On the other hand, FIG. 9 is a schematic diagram showing a configuration example of an element policy of a corresponding risk layer. As shown in FIG. 9, the element policies P-3011-3012, P-3021 and P-3031 of the corresponding risk layer associate “risk” with “correspondence”.
[0024]
Here, the association between the “risk” and the “response” is not limited to the one-to-one correspondence as in the above-described desired risk layer, and there may be a plurality of “responses” related to the same “risk”. The same “response” may be related to multiple “risks”.
[0025]
FIG. 10 is a schematic diagram showing a policy system composed of element policies of the request risk layer and the risk response layer as described above for each request. This policy system has five element policies P-2011, P-2012, P-2021, P-2031, P-2032 of the desired risk layer and four element policies P- of the risk response layer under the user 10001. This is configured when nine element policies including 3011 and element policies P-3012, P-3021 and P-3031 are prepared.
[0026]
The policy system P-4010 relating to the demand 1 indicates that “corresponding”, “corresponding”, “corresponding” are output with respect to the input “request 1”.
The policy system P-4020 relating to the demand 2 indicates that “correspondence” and “correspondence” are output with respect to the input “request 2”.
The policy system P-4030 regarding the request 3 indicates that “response” and “response” are output for the input “request 3”.
[0027]
Next, specific examples of the above-mentioned “request” and “each element policy” will be described.
FIG. 11 is a schematic diagram showing an example of a request. Requests P-0110, P-0120, and P-0130 provide a request ID that uniquely identifies the request, a request name that briefly describes the content of the request, a provider that provides the request, and the request A provision date which is a date when the person starts providing, and a status indicating the status of the request.
[0028]
The status includes “active duty” indicating that it can be used, and “retired” indicating that it has become unusable because it has become old. This is also the case with the element policies of each layer.
[0029]
FIG. 12 is a schematic diagram showing an example of an element policy of a desired risk layer. The element policies P-2110, P-2120, and P-2130 of the request risk layer are the subject request ID that is the request ID of the input request, the risk ID that identifies the risk, and the risk name that directly represents the risk content And a provider that is a provider of this element policy, a provision date that is a date when the provider starts providing this element policy, a status that indicates the status of this element policy, and the like.
[0030]
FIG. 13 and FIG. 14 are schematic diagrams showing examples of element policies of the risk handling layer. The element policies P-3110, P-3120, P-3130, and P-3140 of the risk response layer are the subject risk ID that is the risk ID of the input risk, the response ID that uniquely identifies the response, and the content of the response , The provider that is the provider of this element policy, the provision date that is the date that the provider started providing this element policy, the status that represents the status of this element policy, and the type of correspondence Security level indicating the importance of each response to adjust when the corresponding item matches and the value is different, and the content of the response Etc.
[0031]
In the example of FIGS. 11 to 14, for example, when the request P-0130 of FIG. 11 is input, the element policy P-2120 of the request risk layer of FIG. 12 is related, and the elements of the risk corresponding layer of FIGS. Policies P-3110, P-3120, and P-3140 are relevant. The outputs of the element policies P-3110, P-3120, and P-3140 are contents below the “corresponding type” as shown in FIG. 13 and FIG.
[0032]
The request ID, the risk ID, and the corresponding ID described in FIGS. 11 to 14 are attached so as to be unique in the world. For example, as in the case where the request ID is 002934-134.2322.12.9, the provider's IP address and its serial number may be used. Here, the provider takes care not to duplicate the ID within its own IP address.
[0033]
As shown in FIG. 15, the “request” that causes “response” to be output is not limited to being input from the user 10001, but may be generated from an application having a state change or the like.
[0034]
Now, an embodiment of the present invention using the above policy system will be described with reference to the drawings.
(One embodiment of the present invention)
FIG. 1 is a schematic diagram showing a network connection configuration to which an information environment setting system according to an embodiment of the present invention is applied. A user environment 10000 which is an information environment of the user 10001 is connected to the Internet 90000 via the provider device 20000. On the other hand, a vendor apparatus 30000 used for a vendor that develops and sells applications, etc., and a security countermeasure group apparatus 40000 used for an organization related to security measures (eg, CERT; Computer Emergency Response Team Coordination, etc.) also appropriately pass through the provider apparatus 20000. Connected to the Internet 90000. That is, the user environment 10000, the provider 20000, the vendor apparatus 30000, and the security countermeasure group apparatus 40000 are in a state where they can communicate with each other.
[0035]
Here, the provider device 20000, the vendor device 30000, and the security countermeasure group device 40000 can change the “request” and each element policy, which are the constituent elements of the above-described policy system, by the operation based on the policy of the operator, as shown in FIG. As shown as “request list”, “risk list”, and “correspondence list” in FIG. 16 (c), the information is disclosed on a homepage or the like and provided to the user environment 10000 and the provider device 20000.
[0036]
The user environment 10000, the provider device 20000, and the like download and obtain necessary “requests” and element policies from the homepage shown in FIG. And record it in a DB or the like. This download operation can be executed by clicking a download button (not shown). Each element in each list may be configured to be selectively downloaded by, for example, a check operation.
[0037]
FIG. 2 is a schematic diagram showing the overall configuration of the user environment 10000 in the present embodiment. The user environment 10000 includes a policy engine 1000 and an agent 2000 in addition to some applications 3000.
[0038]
When the “request” is input from the user 10001 or the application 3000, the policy engine 1000 breaks down the “request” to “response” based on the policy system, and outputs the obtained “response” to the agent 2000. It is a program to do.
[0039]
The agent 2000 is a program for changing the setting of an application or the like for the “correspondence” output from the policy engine 1000.
[0040]
In this way, the policy engine 1000, the agent 2000, and the application 3000 can communicate with each other.
[0041]
FIG. 3 is a functional block diagram showing a configuration example of the policy engine 1000. The policy engine 1000 includes a user interface 1800 that provides a graphical interface to the user 10001, an I / F unit 1600 that is an input / output interface, and a new introduction of an element policy that is input from the I / F unit 1600. A policy management unit 1200 that manages deletion, editing, and the like, and an engine 1400 that derives “response” from “request” by combining element policies managed by the policy management unit 1200 are provided.
[0042]
Note that the user interface 1800 and the I / F unit 1600 can communicate with each other, and the I / F unit 1600, the policy management unit 1200, and the engine 1400 can also communicate with each other.
[0043]
FIG. 4 is a functional block diagram showing an example of the engine 1400 and its peripheral configuration. The engine 1400 obtains “response” from “request” while referring to the request risk layer DB 1450, risk response layer DB 1460, and environment information DB 1470 in the policy management unit 1200. Specifically, the request risk engine 1410 The risk response engine 1420 and the integrated adjustment unit 1430 are provided.
[0044]
Here, the request risk engine 1410 uses the “request ID” based on the “request” input from the user interface 1800 or the application 3000 via the I / F unit 1600 and the element policy in the request risk layer DB 1450. The “risk ID” related to is output to the risk handling engine 1420.
[0045]
Based on the “risk ID” output from the request risk engine 1420 and the element policy in the risk response layer DB 1460, the risk response engine 1420 sends “response” information related to the “risk ID” to the integrated adjustment unit 1430. It has a function of confirming that this “correspondence” information can be implemented in the user environment 10001 according to the contents of the environment information DB 1470.
[0046]
When the risk handling engine 1420 outputs a plurality of correspondences indicating different setting values for the same setting item, the integrated adjustment unit 1430 is based on the security level (importance or priority etc.) prepared by the application vendor, etc. This is for narrowing down to one set value and outputting the obtained “correspondence” to the agent 2000 via the I / F unit.
[0047]
For example, P-3120 and P-3140 in FIGS. 13 and 14 show examples of “correspondence” in which different setting values are designated for the same setting item. In this case, the integrated adjustment unit 1430 selects the element policy P-3140 having a higher security level.
[0048]
The I / F unit 1600 can communicate with the request risk engine 1410 and the integrated adjustment unit 1430 and can also communicate with the outside, and communicates with the agent 2000, the application 3000, the user interface 1800, and the like. .
[0049]
On the other hand, FIG. 5 is a functional block diagram showing a configuration example of the policy management unit. The policy management unit 1200 includes a request risk layer DB 1450, a risk response layer DB 1460, an environment information DB 1470, an element policy management unit 1210, and an environment management unit 1230.
[0050]
Here, the request risk layer DB 1450 is controlled so as to be readable / writable from the element policy management unit 1210 and stores “request” and “element policy of the request risk layer”.
The element policy management unit 1210 adds information to the element policy of the request, the requested risk layer and / or the risk response layer acquired from a homepage such as the security countermeasure group apparatus 40000 and the vendor apparatus 30000.
FIG. 17 shows an example in which information is added to the request P-0120a in the request risk layer DB 1450 and the element policy P-2110a of the request risk layer. In this example, information on usage status is added. This is used by setting the usage status value to “invalid” when the individual user 10001 does not wish to use the acquired element policy. For example, when the status of the acquired element policy is “retired”, the usage status is automatically set to “invalid” by the element policy management unit 1210.
[0051]
The risk handling layer DB 1460 is controlled to be readable / writable from the element policy management unit 1210, and stores the element policy of the risk handling layer.
[0052]
FIG. 18 shows an example in which information is added to the element policies P-3110a and P-3120a in the risk corresponding layer DB 1460. In this example, a user setting priority is added in addition to the usage status described above. This is used when it is desired to set a unique priority order instead of a security level determined every time a setting value is provided for each setting item provided by the vendor as a priority order when settings conflict.
[0053]
The environment information DB 1470 is controlled so as to be readable / writable by the environment management unit 1230, and stores environment information of the user 10001.
FIG. 19 shows an example of environment information in the environment information DB 1470. Here, applications that the risk response engine 1420 selects from the element policies of the risk response layer DB 1460 are described in advance.
[0054]
The element policy management unit 1210 is controlled from the user interface 1800 via the I / F unit 1600, and manages each request and each element policy using the request risk layer DB 1450 and the risk corresponding layer DB 1460 in a readable / writable manner. Is.
[0055]
For example, the element policy management unit 1210 generates a new “request”, “request policy element policy” or “risk response layer element” from a network or computer-readable storage medium connected to the user environment 10000 by user editing operation. When the “element policy” is read, the “request”, “request policy element policy” or “risk response layer element policy” is written to the corresponding request risk layer DB 1450 and risk response layer DB 1460.
[0056]
Similarly, the “request”, “request risk layer element policy” or “risk response layer element policy” is read / written by the user's editing operation in the request risk layer DB 1450 and the risk response layer DB 1460. Has a function to change and / or delete.
[0057]
The environment management unit 1230 is controlled from the user interface 1800 via the I / F unit 1600, and manages the environment information of the user 10001 using the environment information DB 1470 so that it can be read / written.
[0058]
FIG. 6 is a functional block diagram showing a configuration example of agents and applications. The agent 2000 includes an I / F unit 2100 that is a reception port of “correspondence” information from the engine 1400, and a setting information translation unit that translates the “correspondence” information received from the I / F unit 2100 into a command group that can actually be executed. 2200, a response execution unit 2300 that executes setting or response to the application 3000 while referring to the environment information DB 1470 based on information of the setting information translation unit 2200, and history information (eg, from request input to response execution) , Request ID, risk ID, correspondence ID, execution date and time) is recorded by the correspondence execution unit 2300.
[0059]
The application 3000 includes an I / F unit 3100 that is a reception port of information from the agent 2000, an application core unit 3200 that is a main part of the application 3000, a user interface 3500 that is a graphical interface to the user, A request event generation unit 3300 that generates a “request” event for the engine 1400 and an application setting management unit 3400 that manages application settings.
[0060]
The application core unit 3200 can communicate with the I / F unit 3100, the user interface 3500, the request event generation unit 3300, and the application setting management unit 3400.
[0061]
Note that the user environment 10000 and the devices 20000, 30000, and 40000 as described above can be realized by a hardware configuration and / or a software configuration, respectively, but when implemented using a software configuration, corresponding functions are realized. Is installed in advance in a computer of the user environment 10000 and each device 20000 to 40000 from a storage medium or network.
[0062]
Next, the operation of the network to which the information environment setting system configured as described above is applied will be described.
(Operation example)
Now, the security countermeasure group device 40000 or the like, when a member of the group having high creditworthiness and specialized knowledge determines that a countermeasure is required as a standard for the “request”, the “request” is operated by the operation of the member. The list of standard request risk layers associated with this “request” is organized and disclosed. At this time, the request ID and the risk ID are attached so as not to overlap with the previous ID.
[0063]
In addition, the security countermeasure group device 40000 or the like prompts the vendor or provider to create an element policy for the “request” list or the element list of the desired risk layer by the operation of the members. Also, change the status of “request” and element policy that became outdated and inappropriate to “retired” and disclose them.
[0064]
The vendor device 30000 or the like provides a risk response layer element list based on the list of the security countermeasure group device 40000 by the operation of the vendor. As described above, the corresponding ID is assigned so as not to overlap with the previous ID. The provider device 20000 may add a unique element policy by an operation according to the provider's unique policy. In this case as well, corresponding IDs are assigned so as not to overlap.
[0065]
The user 10001 obtains “request” and element policy from the sites of CERT 40000, the vendor apparatus 30000, and the provider 20000 via the Internet 90000 or the like according to his / her own policy.
[0066]
The provider 20000 may collect “requests” and element policies in accordance with the policy of the provider 20000 and distribute them to the user 10001 at the time of contract. The “request” or element policy provider may distribute the information on a CD-ROM or floppy (registered trademark) disk without going through the Internet 90000.
[0067]
The user 10001 describes and stores an information environment indicating an application or the like to be managed using the policy engine 1000 and the agent 2000 in the environment information DB 1470 as shown in FIG.
[0068]
As shown in FIG. 17, information is added to the “request” and each element policy acquired in the user environment 10000 by the element policy management unit 1210. Thereafter, the element policy of the “request” and the desired risk layer is stored in the request risk layer DB 1450, and the element policy of the risk response layer is stored in the risk response layer DB 1460.
[0069]
The element policy management unit 1210 edits (adds, deletes, updates, etc.) each element policy in the desired risk layer DB 1450 and the risk corresponding layer DB 1460 by a user operation via the user interface 1800.
[0070]
Similarly, the environment management unit 1230 edits (adds, deletes, updates, etc.) environment information in the environment information DB 1470 by a user operation via the user interface 1800.
[0071]
(Request from users)
Next, with respect to the “request” input from the user 10001, an operation for executing “response” is performed on each user request and each element policy in FIGS. 11 to 14 and the environment information file f 1 in FIG. 19 in the user environment 10000. The case where it is stored will be described as an example.
That is, in engine 1400, it is assumed that “request” P-0130 in FIG. 11 is input via I / F unit 1600 by the operation of user 10001 via user interface 1800. The inputted “request” P-0130 is passed to the request risk engine 1410.
[0072]
The request risk engine 1410 confirms whether or not this “request” P-0130 exists in the request risk layer DB 1450, and if it exists, the request ID: A087 of this “request” P-0130 is used as a search key. The requested risk layer DB 1450 is searched as shown in FIG. As a result of the search, the element policy P-2120 including A087 matches the subject request ID, so the risk ID: B027 of this element policy P-2120 is passed to the risk handling engine 1420.
[0073]
The risk response engine 1420 searches the risk response layer DB 1460 as shown in FIGS. 13 and 14 using the risk ID B027 as a search key. At this time, only those whose element policy “corresponding application” in the risk corresponding layer DB 1460 corresponds to the contents of the environment information file f1 are searched.
[0074]
As a result of the search, the element policies P-3120 and P-3140 including B027 in the subject risk ID and the browser br2 in the corresponding application match. Therefore, the “correspondence” information of the element policies P-3120 and P-3140 is integrated. It passes to the adjustment unit 1430.
[0075]
In this example, “Security level: 37 Compatible application: Browser br2, Setting value: Edit. Setting. Privacy and security. Cookie = Enable cookie, Setting. Privacy and security. Cookie = Warn before saving cookie. ”And“ Security level: 43 Supported application: Browser br2, Setting value: Edit. Setting. Privacy and security. Cookie = Enable cookie only on original website, Setting. Privacy and security. Cookie = Save cookie Pass "warn before".
[0076]
The integrated adjustment unit 1430 checks whether or not different setting values are set for the same setting item in the “response” information from the risk response engine 1420. In this example, since different setting values are set for the same setting item, the higher security level, that is, the “correspondence” of the security level 43 is given priority over the “correspondence” of the security level 37.
[0077]
This “correspondence” is passed to the agent 2000 via the I / F unit 1600. That is, “Security level: 43 Applicable application: Browser br2, Setting value: Edit. Setting. Privacy and security. Cookie = Enable cookie only on original website, Setting. Privacy and security. Cookie = Before saving cookie Is warned to the agent 2000.
[0078]
Upon receiving the “correspondence” information via the I / F unit 2100, the agent 2000 passes this “correspondence” information to the setting information translation unit 2200.
[0079]
The setting information translation unit 2200 translates this “correspondence” information into an instruction according to the I / F unit 3100 of each application, and sends the obtained instruction to the correspondence execution unit 2300.
[0080]
Upon receiving the instruction, the corresponding execution unit 2300 executes the instruction for the application 3000 based on the environment information from the environment information DB 1470. In this case, an instruction is given to the browser br2.
[0081]
The application 3000 of the browser br2 passes this command to the application setting management unit 3400 via the I / F unit 3100 and the application core unit.
[0082]
The application setting management unit 3400 changes the setting according to the command. In this case, the setting of the application 3000 is changed to “Edit.Settings.Privacy and security.Cookie = Enable cookie only on the original website, Settings.Privacy and security.Cookie = Warn before saving cookies” Is done.
[0083]
(Request from application (1))
Next, with respect to the “request” input from the application 3000, each request and each element policy shown in FIG. 15 and the environment information file f1 shown in FIG. A case where the application 3000 is the mailer M1 will be described as an example.
Now, the user 10001 activates the application 3000 as the mailer M1 in order to send and receive mail. The request event generation unit 3300 of the mailer M1 generates a “mailer activation” event (“request” P-0210 in FIG. 15), and passes this event to the engine 1400 via the I / F unit 1600 (not shown).
[0084]
Engine 1400 uses this event as an input for “request” P-0210, and passes “request” P-0210 to request risk engine 1410.
[0085]
Thereafter, as described above, the request risk engine 1410 confirms the existence of the “request” P-0210, and searches the request risk layer DB 1450 using the request ID: A073 of the “request” P-0210 as a search key. As a result of the search, in the example of FIG. 15, the element policy P-2110 matches, so the risk ID: B025 of this element policy P-2110 is passed to the risk handling engine 1420.
[0086]
In the risk handling engine 1420, the risk ID B025 is used as a search key, and the risk handling layer DB 1460 is searched in the same manner as described above. Therefore, the “correspondence” information of the element policy P-3110 is passed to the integrated adjustment unit 1430.
[0087]
In this example, “Correspondence type: Version confirmation and message, Message: There is a serious security hole in the version of this mailer M1. Please access the following URL and apply the patch. Patch source URL: http: //venderv1.com/ ".
[0088]
The integrated adjustment unit 1430 checks whether or not different setting values are set for the same setting item in the “response” information from the risk response engine 1420. In this example, since different setting values are not set for the same setting item, the integrated adjustment processing is not performed, and the “correspondence” information is passed to the agent 2000 as it is.
[0089]
Upon receiving the “correspondence” information via the I / F unit 2100, the agent 2000 passes this “correspondence” information to the setting information translation unit 2200.
[0090]
The setting information translation unit 2200 translates this “correspondence” information into an instruction according to the I / F unit 3100 of each application, and sends the obtained instruction to the correspondence execution unit 2300.
[0091]
Upon receiving the instruction, the corresponding execution unit 2300 executes the instruction for the application 3000 based on the environment information from the environment information DB 1470. In this case, as shown in FIG. 20, the warning window W1 is opened, “There is a serious security hole in this mailer M1 version. Please access the following URL and apply the patch. “http://venderv1.com/” is displayed. Here, information such as “Do you want to end: End / continue” may be added. In this example, the message is displayed without changing the setting of the application 3000, but processing other than such setting is also included in the “correspondence”. Further, the agent 2000 may process the “response” to the extent that this message is issued.
[0092]
Further, not only “mailer activation”, but if a “request” event occurs from the application 3000 during the operation of the application 3000, “correspondence” is executed on the application 3000 based on the “request” as described above. As described above, as a case where an event occurs during the operation of the application 3000, for example, a case where a “request” event occurs periodically based on time information can be considered. As described with reference to FIG. 10 and the like, there is a case where “correspondence” is performed from one “request” to a plurality of applications.
[0093]
(Request from application (2))
Subsequently, in the same manner, each request and each element policy in FIG. 21 are stored in the request risk layer DB 1450 and the risk response layer DB 1460 with respect to “request” input from the application 3000. “Checker 2002 version 2002 (hereinafter referred to as virus checker 2002)” is registered in the environment information DB 1470, and the virus checker 2002 is an application having the structure shown in FIG. 6 as an example.
Here, an application called a virus checker 2002 has a function in which the application core unit 3200 performs a pattern check on at least a malicious tag incorporated in an HTML mail.
[0094]
Now, assume that the user 10001 operates the mailer M1, which is the application 3000, and confirms reception of an e-mail addressed to him / herself.
[0095]
For example, the user 10001 presses the “Receive” button of the user interface 3000 provided by the mailer M1. Information that the user 10001 presses the “receive” button is passed to the application core unit 3200.
[0096]
The application core unit 3200 connects to the mail server and downloads the email in the user 10001 mailbox to the user environment 10000.
[0097]
Thereafter, the request event generation unit 3300 generates an event “download request from the mail server” (“request” P-0260 in FIG. 21), and sends this event via the I / F unit 1600 (not shown). To the engine 1400.
[0098]
The engine 1400 receives this request P-0260 at the I / F unit 1600 and passes it to the request risk engine 1410. The request risk engine 1410 refers to the request risk layer DB 1450 and searches for an element policy of the request risk layer in which the request ID: A077 of the “request” P-0260 matches the subject request ID.
[0099]
As a result of the search, the element policy P-2160 is hit, so the risk ID: B090 of the element policy P-2160 is passed to the risk handling engine 1420.
[0100]
The risk response engine 1420 refers to the risk response layer DB 1460 and searches for the element policy of the risk response layer in which the risk ID: B090 of the element policy P-2160 matches the subject request ID.
[0101]
As a result of the search, the element policy P-3160 is hit, so the “correspondence” information of the element policy P-3160 is passed to the integrated adjustment unit 1430.
[0102]
In this example, “Correspondence type: Execution Security level: 48 Corresponding application: Virus checker 2002 version 2002 Setting value: Check whether a malicious pattern is incorporated in the text when receiving mail” is passed.
[0103]
Further, since there is no competing “correspondence” information, the integrated adjustment unit 1430 passes this “correspondence” information to the agent 2000 as it is.
[0104]
In the setting information translation unit 2200, the agent 2000 translates this “correspondence” information into an understandable instruction of “virus checker 2002 version 2002”, which is a “corresponding application”, and sends the obtained instruction to the correspondence execution unit 2300.
[0105]
Upon receiving the command, the corresponding execution unit 2300 executes this command with respect to the virus checker 2002 that is a corresponding application.
[0106]
When the virus checker 2002 receives an instruction from the I / F unit 3100, the virus checker 2002 causes the application core unit 3200 to operate according to the instruction. Here, “check if a malicious pattern is incorporated” is performed on the downloaded e-mail.
[0107]
As described above, according to the present embodiment, the request risk engine 1410 selects an element policy in the request risk layer DB 1450 based on a “request” generated by the application 3000 or input by a user operation, and the risk response engine 1420. Selects the element policy in the link corresponding layer DB 1460 based on the element policy of the desired risk layer, and the agent 2000 executes the related setting or the corresponding processing based on the element policy of the link corresponding layer. Even those who are poor can easily and appropriately set the information environment, and can reduce the burden of setting.
[0108]
In addition, if an appropriate “request” and element policy are stored in the policy engine, applications make appropriate settings and execute operations based on the determination of the policy engine without causing the user 10001 to be aware of them. I can do things.
[0109]
Accordingly, even individuals without skills can set the personal information environment appropriately to some extent, and therefore the network security can be maintained at a certain level or higher.
[0110]
Further, the element policy of the requested risk layer is provided by, for example, a security countermeasure group device, and the element policy of the link correspondence layer is provided by, for example, a vendor. Policy) can be created, and it can be expected to construct a system policy of excellent quality as a whole.
[0111]
Even if a plurality of “correspondences” compete, as shown in FIGS. 13 and 14, the adjustment is made based on the security level recommended by the vendor, so that the reliability of the setting process can be improved.
[0112]
In addition, as shown in FIG. 18, when the user setting priority set by the user is used, the priority between the “responses” can be adjusted with a priority different from the security level recommended by the vendor. A user-friendly system can be constructed.
[0113]
Further, unnecessary processing is omitted by referring to the information environment file f1 in the environment information DB 1470, so that processing efficiency can be improved.
[0114]
In the above-described embodiment, the case where the three-layer structure of “request”, “risk”, and “response” is used has been described. However, the structure is not limited to three layers, and may have a structure of four or more layers. For example, in the case of e-shopping by electronic commerce, a plurality of requests (ID input → product number input → delivery desired date / time input → credit card number input, etc.) can be set in one process. Layer risk (card number eavesdropping → unauthorized use, etc.) can be set, and a plurality of layers can be set in the same manner for handling.
[0115]
In the above embodiment, the case where the chain of “request”, “risk”, and “response” is used has been described. However, the center is not limited to the risk, and any link (combination) information may be used. For example, the center may be “accelerated” and a chain of “request (translation)”, “acceleration”, “response (setting for high-speed translation)” may be used, and any other link information can be applied. Needless to say.
[0116]
In the above-described embodiment, the case where “information environment setting” is set to “various settings of each application” has been described. However, the present invention is not limited to this, and when the system size of an individual user is large, “information environment The concept of “setting” may include “further setting various settings of each information device connected to the computer terminal”. Even if extended in this way, if the setting of the information device can be written from the agent 2000, the present invention can be similarly implemented to obtain the same effect.
[0117]
The method described in each of the above embodiments is a program that can be executed by a computer, such as a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magneto-optical disk ( MO), and can be stored and distributed in a storage medium such as a semiconductor memory.
[0118]
In addition, as long as the storage medium can store a program and can be read by a computer, the storage format may be any form.
[0119]
In addition, an OS (operating system) operating on the computer based on an instruction of a program installed in the computer from the storage medium, MW (middleware) such as database management software, network software, and the like implement the present embodiment. A part of each process may be executed.
[0120]
Further, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN, the Internet, or the like is downloaded and stored or temporarily stored.
[0121]
Further, the number of storage media is not limited to one, and the case where the processing in the present embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the media configuration may be any configuration.
[0122]
The computer according to the present invention executes each process according to the present embodiment based on a program stored in a storage medium, and includes a single device such as a personal computer or a system in which a plurality of devices are connected to a network. Any configuration may be used.
[0123]
In addition, the computer in the present invention is not limited to a personal computer, but includes an arithmetic processing device, a microcomputer, and the like included in an information processing device, and is a generic term for devices and devices that can realize the functions of the present invention by a program. .
[0124]
Note that the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the invention at the stage of implementation. In addition, the embodiments may be appropriately combined as much as possible, and in that case, combined effects can be obtained. Furthermore, the above embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, when an invention is extracted by omitting some constituent elements from all the constituent elements shown in the embodiment, when the extracted invention is implemented, the omitted part is appropriately supplemented by a well-known common technique. It is what is said.
[0125]
In addition, the present invention can be implemented with various modifications without departing from the gist thereof.
[0126]
【The invention's effect】
As described above, according to the present invention, even an inexperienced person can easily and appropriately set the information environment, and the burden at the time of setting can be reduced.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing a network connection configuration to which an information environment setting system according to an embodiment of the present invention is applied.
FIG. 2 is a schematic diagram showing an overall configuration of a user environment according to the embodiment;
FIG. 3 is a functional block diagram showing a configuration example of a policy engine in the embodiment;
FIG. 4 is a functional block diagram showing an example of an engine and its peripheral configuration in the embodiment.
FIG. 5 is a functional block diagram showing a configuration example of a policy management unit in the embodiment;
FIG. 6 is a functional block diagram showing a configuration example of agents and applications in the embodiment;
FIG. 7 is a schematic diagram for explaining a policy system in the embodiment;
FIG. 8 is a schematic diagram showing a configuration example of an element policy of a desired risk layer in the same embodiment
FIG. 9 is a schematic diagram showing a configuration example of an element policy of a corresponding risk layer in the same embodiment
FIG. 10 is a schematic diagram showing a policy system for each request in the embodiment;
FIG. 11 is a schematic diagram showing an example of a request in the embodiment
FIG. 12 is a schematic diagram showing an example of an element policy for a desired risk layer in the embodiment;
FIG. 13 is a schematic diagram showing an example of an element policy for a risk response layer in the embodiment;
FIG. 14 is a schematic diagram showing an example of an element policy for a risk response layer in the embodiment;
FIG. 15 is a schematic diagram showing an example from request to response in the embodiment;
FIG. 16 is a schematic diagram for explaining provision of a request or the like in the embodiment;
FIG. 17 is a schematic diagram showing an example in which information is added to an element policy of a request and request risk layer in the embodiment;
FIG. 18 is a schematic diagram showing an example in which information is added to the element policy of the risk handling layer in the embodiment;
FIG. 19 is a schematic diagram showing an example of environment information in the environment information DB 1470 according to the embodiment;
FIG. 20 is a schematic view showing an example of a warning window in the embodiment.
FIG. 21 is a schematic diagram showing an example from request to response in the embodiment;
[Explanation of symbols]
1000: Policy engine
1200 ... policy management department
1210: Element policy management unit
1230 ... Environmental Management Department
1400: Policy engine
1410 ... Request risk engine
1420 ... Risk response engine
1430: Integrated adjustment unit
1450 ... Request risk layer DB
1460 ... Risk-response layer DB
1470 ... Environmental Information DB
1480 ... Log DB
1600, 2100, 3100 ... I / F section
1800, 3500 ... User interface
2000 ... Agent
2200 ... Setting information translator
2300 ... corresponding execution part
3000 ... Application
3200 ... Application core section
3300 ... Request event generator
3400: Application setting management unit
10,000 ... User environment
20000 ... provider
30000: Vendor equipment
40000 ... Security measures group device
90000 ... Internet

Claims (6)

An information environment setting system for executing setting or response processing related to the request information in the information environment when request information related to its own information environment is generated or inputted.
Request storage means for storing a plurality of request information in a readable / writable manner;
Request risk storage means in which one or more layers of request risk information in which the request information in the request storage means and the predetermined risk information are linked in a linked manner are stored in a readable / writable manner;
The desire and risk information needs risk information of the last layer and a predetermined setting or the corresponding process is one or more layers of risk associated information that associates a chain reaction is read / writable stores in the risk storage means, the risk correspondence information, and risk correspondence storage unit that includes corresponding application information indicating the corresponding execution destination application,
Of the corresponding application information included in the risk correspondence information in the risk correspondence storage means, the environment information storage means in which corresponding application information indicating an application executable in the information environment is stored in advance so as to be readable / writable When,
Based on the occurrence or input requested information, and requests risk selection means for selecting the requested risk information in the request risk storage means,
Based on the desire risk information selected by the request risk selection means searches the risk correspondence information in the risk correspondence storage means to search for only those corresponding to the corresponding application information in the environment information storage unit, A risk handling selection means for selecting the risk handling information obtained by the search ;
Setting / corresponding execution means for executing the related setting or handling processing based on the risk handling information selected by the risk handling selecting means;
An information environment setting system characterized by comprising: The information environment setting system according to claim 1,
When new request information is read from a network or computer-readable storage medium connected to the information environment setting system body, request information writing means for writing the request information to the request storage means;
When new request risk information is read from the network or storage medium, request risk writing means for writing the request risk information to the request risk storage means;
When new risk response information is read from the network or storage medium, risk response writing means for writing the risk response information to the risk response storage means;
An information environment setting system characterized by comprising: An application program used in the information environment setting system according to claim 1 or 2,
A computer of the information environment setting system;
Means for executing predetermined application processing;
Means for generating related request information based on an internal variation during execution of the application process;
Means for generating related request information based on a predetermined user input at the time of starting or executing the application process;
Means for sending the generated request information to the request risk selection means;
Application program to function as. A desire storage means in which a plurality of demands information is read / writable stores, desire information and predetermined risk information and a chain to one or more layers of desire risk information associating the read / write in the request storage unit capable and demand risk memory means to be stored, the demand risk final layer risk information with a predetermined setting or the corresponding process in linkage to one or more layers of risk correspondence information that associates requests risk information in the storage means read / writable state is stored, the risk management information, includes the risk correspondence storage unit that includes corresponding application information indicating the corresponding execution destination application, the risk correspondence information in said risk correspondence storage means Among the corresponding application information, the corresponding application information indicating the applications that can be executed in the information environment is recorded in advance so as to be readable / writable. It has been an environmental information storage means, when the requested information relating to its own information environment is generated or input, using the setting or the corresponding process related to the requested information to the information preferences system for executing the information environment Program,
A computer of the information environment setting system;
Demand risk selection means based on the generated or input requested information to select the requested risk information in the request risk storage means,
Based on the desire risk information selected by the request risk selection means searches the risk correspondence information in the risk correspondence storage means to search for only those corresponding to the corresponding application information in the environment information storage unit, Risk correspondence selection means for selecting risk correspondence information obtained by the search ,
Setting / corresponding execution means for executing the related setting or handling process based on the risk handling information selected by the risk handling selecting means;
Program to function as. The program according to claim 4,
A computer of the information environment setting system;
When new request information is read from a network or computer-readable storage medium connected to the information environment setting system main body, request information writing means for writing the request information to the request storage means,
A request risk writing means for writing the request risk information to the request risk storage means when new request risk information is read from the network or storage medium;
A risk response writing means for writing the risk response information to the risk response storage means when new risk response information is read from the network or storage medium;
Program to function as. A demand storage means for storing a plurality of demand information in a readable / writable manner, and one or more layers of demand risk information for associating the demand information in the demand storage means with predetermined risk information are read / written. Desired risk storage means stored in a possible manner, and risk response information of one or more layers in which the risk information of the desired risk information of the final layer in the request risk storage means and a predetermined setting or response process are linked in a chain manner are read / A risk handling storage means that is stored in a writable manner and the risk handling information includes handling application information indicating an application as a handling execution destination, and a handling included in the risk handling information in the risk handling storage means Among the application information, corresponding application information indicating applications that can be executed in the information environment is recorded in advance so as to be readable / writable. Used in the information environment system including a environment information storage unit that is, when the requested information relating to its own information environment is generated or input, the information set or corresponding processing the information environment system associated with the requested information An information environment setting method for executing in an environment,
A request risk selection step in which the information environment system selects request risk information in the request risk storage means based on the generated or input request information;
The risk in the risk correspondence storage means so that the information environment system searches only the corresponding application information in the environment information storage means based on the desired risk information selected in the desired risk selection step. A risk response selection step of searching response information and selecting risk response information obtained by the search ;
A setting / response execution step in which the information environment system executes the related setting or response processing based on the risk response information selected by the risk response selection means;
An information environment setting method comprising:

Images