JP5780988B2 - Information processing apparatus, information processing system, and information processing method - Google Patents

Description

  The present invention relates to a technology for supporting security design in an information processing system.

  When designing security for a system, an expert is in charge of security design as a consultant, and follows a predetermined procedure to prepare a document that serves as a security measure guideline in accordance with a predetermined format called ST (Security Target). Completion is generally done. For example, Patent Document 1 discloses a technique for performing security design. Patent Document 1 discloses a security design method in which ISO / IEC27001 (ISMS) and ISO / IEC158 (CC), which are representative international security standards, are integrated. According to the invention of Patent Document 1, security design can be performed more efficiently than when each is performed alone. When the security design is completed, a security design document compliant with ISO / IEC27001 (ISMS) and a security design document (ST) compliant with ISO / IEC158 (CC) are output. Patent Documents 2 and 3 disclose tools that support the formulation of security guidelines.

JP 2005-258512 A JP 2004-220459 A JP 2008-234409 A

  In order to construct a system in accordance with the established security guidelines such as ST, it is necessary to determine a specific implementation mode. An implementation form is a collection of implementation examples that specify what hardware resources are used and what functions are executed with what specifications at what timing. Here, the implementation example is, for example, execution of a predetermined application, adoption of a predetermined data transmission / reception protocol, execution of other processes, and implementation of a functional module in the system. Here, there are usually a plurality of implementation examples that can be adopted for one security guideline. In other words, there can be multiple approaches to countermeasures against a certain threat (for example, infection with a computer virus). Conversely, there are implementation examples that are effective for realizing a plurality of security guidelines. In such a situation, it is not easy to determine a suitable implementation example (combination) from given security guidelines.

  Hereinafter, the above situation will be described as a specific example with reference to FIG. Usually, the established ST is expressed by a combination of a plurality of security guidelines (hereinafter referred to as “security countermeasure policies”). In the figure, it is assumed that three security countermeasure policies, “O.AUTH_PEER_INFO”, “O.AUTH_PEER”, and “O.AUTH_ADMIN”, are formulated according to the ISO / IEC158 standard. Implementation examples for realizing “O.AUTH_PEER_INFO” include “Firewall”, “Web server configuration file usage”, “SSL”, “IPsec”, “Introduction of integrated log management tool”, “IPS”, “ Assume that there is “validation in API” and “validation at API entry level”. Implementation examples for realizing the security guideline “O.AUTH_PEER” include “IPsec”, “introduction of integrated log management tool”, and “server authentication mechanism by certificate”. As an implementation example for realizing “O.AUTH_ADMIN”, “introduction of integrated log management tool” exists. In this way, multiple implementation examples correspond to one security objective. In addition, the implementation examples include implementation examples necessary for realizing the security objectives (hereinafter referred to as “required implementation examples”) and implementation examples in which one of a plurality of selections is sufficient (hereinafter referred to as “selection”). There is an example of “a typical implementation”. In the figure, the essential implementation example is represented by a solid line, the selective implementation example is represented by a dotted line, and the groups to which the selection target belongs are represented by # 1 and # 2.

  In the figure, the required implementation examples for “O.AUTH_PEER_INFO” are “Firewall”, “Use of Web server configuration file”, “Introduction of integrated log management tool”, and the optional implementation examples are “SSL”, “ “IPsec”, “IPS”, “API validation”, and “API entry level validation”. “# 1” and “# 2” are identifiers of groups constituting the selective implementation example. In other words, in order to realize “O.AUTH_PEER_INFO”, it is necessary to introduce three implementation examples: “Firewall”, “Use of Web server configuration file”, and “Introduction of integrated log management tool”. One of “SSL” and “IPsec” belonging to the # 1 group is selected, and “IPS”, “API verification” and “API entry level verification” belonging to the # 2 group are selected. Either one must be selected. On the other hand, when viewed from the implementation example side, there may be one having a plurality of security countermeasure guidelines that can be handled ("IPsec" in the figure).

  At present, the determination of the implementation mode largely depends on the intuition and experience of experts. An engineer who is not a security expert can efficiently and effectively implement a combination of implementation examples with many possible combinations of implementation examples (more specifically, the security countermeasure guidelines can be realized with a smaller number of implementation examples. Such a combination) is difficult to determine.

  The technology described in the above-mentioned patent documents is effective security measures against the assumed threats (in the figure, “O.AUTH_PEER_INFO”, “O.AUTH_PEER”, “O.AUTH_ADMIN”). It does not support the process of determining the implementation example from the established guidelines.

  An object of the present invention is to support an operation of determining an implementation example based on a security countermeasure policy.

In one aspect, the present invention provides a designation unit for designating a plurality of security countermeasure policies, one or a plurality of first implementation examples to be applied to each of the designated plurality of security countermeasure policies, and selection to an acquisition unit for acquiring a second implementation example of the number of double that apply, among the plurality of second mounting example of the acquired excluded by applying one or more first example of implementation which is the acquired for each of a plurality of second example of implementation which is said the second implementation example of the plurality of security objectives targeted for selective application to calculate the number of security objectives are, a large number issued the calculated first A determination unit that determines one combination of implementation examples that conforms to the plurality of security countermeasure policies by preferentially selecting two implementation examples from the plurality of second implementation examples; and the determined combination Out To provide an information processing apparatus having an output unit for.
In a preferred aspect, the security objective is information generated in accordance with the ISO / IEC15408 standard.
In another preferred aspect, the acquisition unit acquires a degree of contribution to the realization of the corresponding security countermeasure policy for each of the one or more implementation examples, and the determination unit includes a plurality of selection targets. When the numbers are the same for the mounting examples, one mounting example is selected using the contributions for the plurality of mounting examples that are the selection targets.
In still another preferred aspect, the implementation example acquired by the acquisition unit includes one or more implementation examples that are essential in addition to the one or more implementation examples that are selectively applied. .
In yet another preferred aspect, the determination unit selects the implementation example to be applied to the essential, and selects the implementation example that is not required to apply the specific result, thereby selecting the implementation example. Exclude from candidates.
The invention, in another aspect, the security objectives for the security objectives, one or a plurality of first example implementation applies mandatory, second implementation example of the number of double that will be selectively applied Doo and database storing a designation unit for designating a plurality of security objectives, for each of a plurality of security policies is the specified one or a plurality of first example implementation applies essential, selectively an acquisition unit for acquiring a second implementation example of the number of double that applied Ru from the database of the plurality of second example of implementation which is the acquisition, applying one or more first example of implementation which is the acquired for each of the plurality of excluded second implementation example in, calculates the number of security objectives are targeted for selective application of the second implementation example of the plurality of security objectives, issued the calculated By selects preferentially more second implementation example from among the plurality of second mounting example, the determination unit determines one combination of compatible implementation to the plurality of security objectives, is the determined An information processing system having an output unit that outputs the combination is provided.
In yet another aspect, the present invention provides a step of accepting designation of a plurality of security countermeasure policies , and the acquisition means is applied to each of the designated plurality of security countermeasure policies . and implementation, obtaining a second implementation example of the number of double that will be selectively applied, is determining means, among the plurality of second example of implementation which is the acquired one or more first, which is the acquired For each of a plurality of second implementation examples excluded by applying one implementation example, the number of security objective policies for which the second implementation example is selectively applied among the plurality of security objective policies is calculated. by preferentially selecting the second implementation example the calculated issued a large number from among the plurality of second mounting example, one determined the combination of conforming implementations to the plurality of security objectives The method comprising, an information processing method and a step of outputting the combination which is the determined.

  According to the present invention, one combination of implementation examples conforming to a plurality of given security objectives is determined.

1 is a schematic diagram of an information processing system 1. FIG. The functional block diagram of the terminal 10. FIG. The figure showing the example of the information stored in the database. FIG. 3 is a functional block diagram of the information processing apparatus 20. The operation | movement flowchart of the information processing apparatus 20. FIG. A diagram that schematically shows the relationship between the security objectives and the acquired implementation example The figure which represents typically the correspondence of a security objective policy and a required implementation example. The figure for demonstrating the process which excludes the selective mounting example relevant to an essential mounting example from a selection candidate. The figure for demonstrating narrowing down a selection candidate in the selective implementation example in the same group. The figure which shows the combination pattern of an example of selective mounting. The figure for demonstrating the process which selects one from several combination patterns. The figure for demonstrating the relationship with the implementation example which adapts a security objective.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
1. Configuration FIG. 1 is a schematic diagram of an information processing system 1 according to an embodiment of the present invention. The information processing system 1 includes a terminal 10, an information processing device 20, and a database 30. The terminal 10, the information processing device 20, and the database 30 can transmit and receive information via the communication network 40. Note that the information processing device 20 and the database 30 may be physically the same device.

FIG. 2 is a diagram illustrating functions of the terminal 10. The terminal 10 is an information processing apparatus such as a personal computer or a portable information terminal, and includes a control unit 101, a communication unit 102, a display unit 103, an input unit 104, and a storage unit (not shown). The communication unit 102 is realized by a LAN card, a wireless communication module, or the like, and transmits / receives information to / from the information processing apparatus 20 via the communication network 40 by wire or wireless. The control unit 101 is realized by a processor such as a CPU, and controls the communication unit 102, the display unit 103, the input unit 104, and a storage unit (not shown).
The display unit 103 is a display device and displays information received from the information processing device 20. The input unit 104 is an input unit such as a keyboard and a mouse, and is used by a user to supply information and instructions to the control unit 101. The storage unit is a storage unit such as a RAM, a ROM, and an HDD, and stores information input from the OS program and the input unit 104, information received from the information processing apparatus 20, and the like.
In the terminal 10, when a plurality of security countermeasure policies are designated by the user via the input unit 104, the designated plurality of security countermeasure policies are transmitted to the information processing apparatus 20. The plurality of security objectives are generated according to the ISO / IEC15408 standard using existing methods based on the threats assumed in the system.

The database 30 is a database that stores, for each security countermeasure policy, an implementation example and its attributes necessary for realizing the security countermeasure policy in association with each other. The database 30 receives an inquiry from the information processing apparatus 20 using the security countermeasure policy as a key, specifies an implementation example corresponding to the security countermeasure policy, and transmits the specified implementation example to the information processing apparatus 20.
Here, the implementation example is a specific implementation mode for implementing the established security guidelines such as ST in the system, and what kind of hardware resource or software is used and what timing is used. Thus, what function is realized in the computer system is specified. The implementation example is, for example, execution of a predetermined application, adoption of a predetermined data transmission / reception protocol, and execution of other processes. The attribute is information indicating whether the implementation example is an essential implementation example or a selective implementation example, and in the case of the selective implementation example, the group to which the attribute belongs.

  Here, the essential implementation example is an implementation example that must be used in order to realize the security objective. The selective implementation example is one in which any one (or more) needs to be selected in a certain group constituted by a plurality of selective implementation examples. Furthermore, the contribution degree is stored in association with the selective implementation example. The degree of contribution refers to the realization of the associated security objective (that is, to be protected from the threat targeted by the security objective) when the implementation example is used. It is information indicating how much effect is expected, in other words, how much effect is expected by adopting the implementation example. Normally, it is unlikely that a security threat will be 100% surely protected if the implementation example is used, and the degree of contribution to security measures (protection effect from the target threat) may vary from implementation to implementation. The degree of contribution is represented by a numerical value of 1 to 100 (points) in order from low to high, for example. Other methods may be used for the method of expressing the contribution level. Moreover, the existing technique can be used for the determination method of a numerical value. In short, the degree of contribution only needs to be an index representing the relative magnitude of the degree of contribution (effect) within the same group.

  FIG. 3 is a diagram illustrating an example of information stored in the database 30. Security measures "O.AUTH_PEER_INFO" include implementation examples ("Firewall", "Web server configuration file usage", "SSL", "IPsec", "IPS", "API validation", and "API entry / "Verification at level"). “Firewall” and “Use Web server configuration file” are mandatory implementation examples, “SSL” and “IPsec” are selective implementation examples belonging to group # 1, “IPS”, “Validation in API” “API entry level verification” is a selective implementation example belonging to the group # 2. In other words, in this example, implementation of “Firewall” and “Use Web server configuration file” is indispensable to realize “O.AUTH_PEER_INFO”, and in addition, one from each of the groups of # 1 and # 2. An example must be selected. That is, there are 2 * 3 = 6 possible combinations of implementation examples.

Here, the implementation example “Firewall” refers to software (or hardware equipped with the software) for controlling the communication between a specific computer network and the outside of the computer network and maintaining the safety of the internal computer network. ) Technology.
Implementation example “Use of Web server configuration file” means that a process that refers to the option setting of an application or website (for example, an XML file with (***. Config) as an extension) is incorporated into the system. is there.
The implementation example “IPS” means that devices that protect the corporate network from unauthorized access that cannot be prevented by a normal firewall are introduced, or there are always illegally crafted packets or packets containing errors. This means monitoring and detecting suspicious behavior, attacks, and unauthorized intrusion attempts, and incorporating functions to protect the system by blocking the connection in real time as hardware or software.
SSL (Secure Sockets Layer) is a technology for encrypting communication, and the implementation example “SSL” means introducing SSL into the system.
An implementation example “IPsec” (Security Architecture for Internet Protocol) means that a protocol that provides data falsification prevention and a secret function in units of IP packets is used in the system using encryption technology.
API (Application Program Interface) is a set of instructions and functions that can be used when developing software for a certain platform (OS and middleware), or a convention that defines the program procedures for using them. It is a set. The implementation example “API verification” means introducing a process for checking whether an execution instruction or the like for malicious or unauthorized access is included in the API. The implementation example “API entry level verification” means that API verification is performed only for new users.
Note that the implementation example described in this embodiment is merely an example, and any implementation example can be defined and used.

  FIG. 4 is a diagram illustrating functions of the information processing apparatus 20. The information processing apparatus 20 includes an acquisition unit 210, a specification unit 220, and a communication unit 230. The communication unit 230 is realized by a communication module that transmits and receives information to and from the terminal 10 via the communication network 40, and includes a designation unit 231 and an output unit 232. The designation unit 231 supplies a plurality of security countermeasure policies to the acquisition unit 210 when designated by the terminal 10. The output unit 232 transmits the information output from the second specifying unit 222 to the terminal 10. The acquisition unit 210 makes an inquiry to the database 30 for each of the plurality of security countermeasure policies supplied from the specification unit 231, and acquires the essential implementation example and the selective implementation example from the database 30. The acquisition unit 210 supplies information on an implementation example corresponding to the acquired plurality of security countermeasure policies to the specifying unit 220.

  The specifying unit 220 is an information processing module realized by a processor or a memory (RAM, ROM, HDD, etc.), and includes a first specifying unit 221 and a second specifying unit 222. The first identification unit 221 first identifies the required implementation example based on the plurality of security countermeasure policies supplied from the acquisition unit 210 and the implementation examples (required implementation example and selective implementation example) corresponding thereto. Subsequently, by determining a selective mounting example that does not require application of the specific result, the selective mounting example is excluded from the selection candidates. Information on the identified essential implementation examples and selective implementation examples remaining as selection candidates, and information identifying the correspondence relationship between these and the security objectives are supplied to the second identification unit 222.

The second specifying unit 222 includes an application number evaluation unit 224 and a contribution evaluation unit 223. The application number evaluation unit 224, when the combination of the selective implementation examples can be considered even after the processing in the specifying unit 220 (that is, when the combination of the implementation examples is not fixed to one), For each of the implementation examples, the number of security objective policies that are subject to selective application among the plurality of security objective policies is calculated, and the implementation examples having a large number are calculated. By preferentially selecting from the above, a combination of implementation examples conforming to the plurality of security countermeasure policies is determined. In the processing of the application number evaluation unit 224, the contribution evaluation unit 223 determines that the combination of implementation examples cannot be narrowed down to one, that is, if the number is the same for a plurality of implementation examples to be selected, One implementation example is selected using the contributions of a plurality of implementation examples to be selected.
In addition, if the combination of the mounting examples cannot be narrowed down to one even after the processing in the contribution evaluation unit 223 (that is, there are two or more combination patterns having the same overall contribution), it is further targeted. One combination pattern is determined from the combination of implementation examples. This determination may be performed by, for example, selecting one combination at random, or by using other predetermined information (for example, information such as the rank added to each individual selective implementation example). You may go.
In this way, a combination of one implementation example that satisfies a plurality of security countermeasure policies designated by the terminal 10 is finally determined. The determined combination of one implementation example is output to the output unit 232 and output to the terminal 10.

2. Operation FIG. 5 is a diagram illustrating an example of an operation executed in the information processing apparatus 20. In S100 of the figure, the information processing apparatus 20 acquires a plurality of security countermeasure policies designated by the terminal 10. In S <b> 200, a plurality of designated security countermeasure policies and an inquiry request are transmitted to the database 30. As an answer to the request, an implementation example (including an essential implementation example and an optional implementation example) corresponding to a plurality of security countermeasure policies is provided from the database 30 to the information processing apparatus 20.

  FIG. 6 shows an example of a plurality of security countermeasure policies specified from the terminal 10 acquired in S200 and an implementation example acquired from the database 30 and corresponding to the security countermeasure policies. In the figure, the security countermeasure policy includes ST1 to ST5, and the implementation example includes an example including I1 to I16. Similar to FIG. 12, the correspondence relationship between the security countermeasure policy and the implementation example is represented by a line, the solid line represents an essential implementation example, and the dotted line represents a selective implementation example.

  Here, the implementation example “writing to a machine that does not have administrator authority” means that a terminal used by a user without administrator authority is provided with a function for restricting data writing. “Use write-once medium” is to use a storage medium having an access restriction function so that data can be written only once but read as many times as possible from a terminal in the system. “Granting a time stamp to the audit trail” is to introduce a process of giving a time stamp when there is data movement in order to provide evidence to electronic data in the system. The “certificate server authentication mechanism” is to introduce a function of allowing data exchange in the system only between users who have an electronic certificate issued by an authentication server. “Administrator identification authentication” is to introduce a function for determining whether or not the system user has administrator authority. “User identification” is to introduce a function for identifying a user. “Implementation of access control” is to introduce a function for restricting access to a predetermined resource. Other implementation examples are the same as those described in FIG.

In S300 of FIG. 5, unnecessary mounting examples are excluded from I1 to I16, and one combination of mounting examples is determined. Specifically, first, in S302, all required implementation examples among the implementation examples acquired from the database 30 are specified. All the required implementation examples that are identified are necessarily included in the combination of the implementation examples that are finally determined.
For convenience of explanation, FIG. 7 is a diagram showing only the correspondence relationship regarding the required implementation example from the correspondence relationship between the security countermeasure policy and the implementation example shown in FIG. In the example of the figure, I1, I2, I4, I5, and I13 to I16 (shown by “◯”) are specified as essential implementation examples, and it is determined that these implementation examples are adopted. The remaining selective implementation examples (indicated by “?”) Are not yet adopted.

  In S304 of FIG. 5, the first specifying unit 221 specifies all the selective mounting examples that are necessarily excluded from the selection candidates due to the determination of the required mounting example in S302. For example, as shown in FIG. 8, for group # 1 of the selective mounting example regarding ST1, either I3 or I4 should be selected, but I4 is an essential mounting example in relation to ST4. From this, it is determined that I4 is selected. As a result, there is no need to select I3 for ST1. In this way, I3 is excluded from the selection candidates, and non-adoption is determined (this state is indicated by x in the figure).

  Subsequently, the application number evaluation unit 224 narrows down selective implementation examples. First, paying attention to one arbitrary security measure, a selective implementation example related to the security measure is specified. FIG. 9 is a diagram for explaining narrowing of selection candidates in a selective implementation example in the same group. In the example of the figure, it is shown that there are four corresponding selective implementation examples I6, I7, I8, and I9 when focusing on ST5. It should be noted that the lines of correspondence not related to these implementation examples are omitted from the figure so as not to complicate the figure. Subsequently, in the selective implementation examples I6, I7, I8, and I9, the number of security countermeasure policies having themselves as selection candidates is determined. In other words, in addition to ST5, if there is a security countermeasure policy that designates itself as a selection candidate, the number (hereinafter referred to as “application number”) is determined. In the example in the figure, since I6 and I9 are also selection candidates for ST2, the number of applications is “2”. Since I7 and I8 are not selection candidates other than ST5, the number of applications is “1”.

Based on the calculated number of applications for each implementation example, an implementation example to be left as a selection candidate (in other words, an implementation example to be excluded from selection candidates) is determined. Specifically, the larger the number of applications, the higher the number of selection candidates (in other words, the smaller the number of applications, the higher priority is excluded from the selection candidates). In the example shown in the figure, since I7 and I8 have a lower application number than I6 and I9, it is determined that I7 and I8 are excluded from the selection candidates. Since the number of applications for I6 and I9 is equal, superiority or inferiority cannot be assigned, and either one is not selected at this stage.
In this way, selective implementation examples were narrowed down to I6 and I9 for one security candidate ST5 of interest. This process is repeated for all security objectives (ST1 to ST4).

In S306 of FIG. 5, it is determined whether or not a combination of selective implementation examples is uniquely determined as a result of the processing in S304. When the combination is uniquely determined (S306: NO), the combination is determined and the combination is output in S400. For example, when combinations are not uniquely determined as shown in FIG. 9 (S306: YES), that is, when there are a plurality of combination patterns of implementation examples remaining as selection candidates, the combinations are narrowed down to one in S308. Process.
FIG. 10 shows a combination pattern of possible selective mounting examples as a result of executing the processing of S304 of FIG. 5 based on the correspondence relationship between the security countermeasure policy and the required mounting example shown in FIG. Among the groups # 1 to # 4 of the selective implementation example illustrated in FIG. 6, # 1 is necessarily excluded from the selection candidates in S304 due to the determination of the essential implementation example in S302 as described above. An optional implementation to be done is specified. Similarly, for # 3, a selective implementation example that should be inevitably excluded from the selection candidates is specified. Therefore, there are two groups of selective implementation examples that are undetermined: # 2, # 3. For # 2, I10, I11, and I12 are selection candidates, and for # 4, I6, I9 are selection candidates. Therefore, there are 2 * 3 = 6 possible combination patterns. These patterns (patterns 1 to 6) are shown in FIGS. 10 (a) to (f), respectively.

  In S308 of FIG. 5, the contribution degree evaluation unit 223 first specifies the contribution degree in each undetermined selective implementation example. Here, when a plurality of security objectives are designated as selection candidates, the total value of contributions regarding each security objective is determined as the contribution of the implementation example. As in the example shown in FIG. 10, I6 is a selection candidate for ST2 and ST5, and contribution degree “20” is set for ST2 and contribution degree “10” is set for ST5. If so, the contribution degree of I6 is determined to be “30”. When contributions are calculated for all unconfirmed implementation examples, for each pattern, the sum of contributions of unconfirmed implementation examples constituting the pattern (referred to as total contribution degree) is calculated.

  FIG. 11 is a diagram for explaining a process of selecting one from a plurality of combination patterns. As shown in the figure, it is assumed that the contributions for I6, I9, I10, I11, and I12 are calculated as “30”, “10”, “30”, “10”, and “20”, respectively. Then, for pattern 1, the total contribution is “60”, which is the sum of the contributions of the constituent elements I6 and I10. Similarly, for patterns 2 to 6, “40”, “50”, “30”, “30”, and “20” are calculated as total contributions, respectively. Of these, the pattern having the largest overall contribution is determined as the final combination of mounting examples. In the case of FIG. 11, pattern 1 or I16 and I10 is finally selected.

  In addition, although not existing in the example of FIG. 11, when there are a plurality of combination patterns having the same total contribution, any one of the patterns is determined by a predetermined method. This determination may select one combination pattern at random. Or you may select the pattern containing the implementation example which has the largest contribution among the implementation examples which comprise a combination pattern. Conversely, a pattern including an implementation example having the smallest contribution may be excluded. In addition, it is possible to determine one combination pattern by performing various other existing statistical processes using the degree of contribution.

  In S <b> 400, the determined combination of implementation examples is transmitted to the terminal 10. In the case of FIG. 11, there is information that the combination of the implementation examples for realizing all of the designated ST1, ST2, ST3, ST4, ST5 is I1, I2, I3, I4, I6, 13, I14, I15, and I16. Is output and provided to the user of the terminal 10.

  According to the above-described embodiment, among the selective implementation examples, the number of conforming security objectives is large, in other words, the one with a wide application range is selected, so the number of implementation examples to be adopted can be reduced. . Furthermore, when the number of security objectives is equal, the one with the maximum total combination contribution of the implementation examples to be selected is selected. Therefore, the implementation example with the highest feasibility of the security countermeasure policy is selected while suppressing the complexity of the implementation. As described above, in the above-described embodiment, if the user designates a plurality of security countermeasure policies, the user can be presented with a combination of suitable implementation examples. In other words, the user is freed from the task of searching for a combination of mounting examples by experience and intuition or by groping. In this way, support for system security construction work by the user is realized.

3. Other Embodiments The above embodiment is an example of the present invention and can be modified as appropriate. Hereafter, the viewpoint which performs a modification is illustrated.

  The implementation example corresponding to each security objective may be composed of only selective implementation examples. In this case, the processes of S302 and S304 in FIG. 5 are omitted.

  The order of processes in the information processing apparatus 20 is not an aspect in which the final specification based on the contribution degree is performed after narrowing down based on the number of applications, but the narrowing down using the contribution degree is performed first, and then the narrowing down based on the number of applications is performed as necessary. May be adopted. For example, first, a process of excluding those in which the contribution degree of each selective implementation example (or the total contribution degree when other selective implementation examples are combined) is equal to or less than a predetermined value is performed. When there are combination options, the narrowing-down process based on the number of applications described above is performed. In this way, it is possible to design a system that emphasizes security enhancement rather than ease of mounting (the number of selected mounting examples to be applied and the simplicity of the system). That is, in the present invention, it is only necessary to determine an implementation example to be selected based on at least one of the number of applications and the degree of contribution.

  There is no particular restriction on the order of security objectives to be focused on in S308. For example, if it is desirable from the viewpoint of improving the calculation speed and reducing the calculation amount, the security countermeasure policy having a large number of corresponding selective implementation examples is preferentially executed. In addition, there is no particular meaning in the order of presentation of the above-mentioned security objectives and implementation examples.

  In the example of FIG. 6, the security objective is specified to select one selective implementation example for each group, but it may be specified to select two or more for each group. In short, the present invention can be applied in a situation where there are two or more options for the implementation example.

In S308 of FIG. 5, a weighting value may be introduced for each security countermeasure policy, and at least one of the calculated application number or contribution may be multiplied by this weighting value. For example, when the certain feasibility of ST1 is regarded as more important than other security countermeasure policies, a weight value “1.2” (120%) is set only for ST1. That is, for the implementation example corresponding to ST1, the number of applications and the degree of contribution are multiplied by “1.2”. As a result, the possibility of selecting the mounting example corresponding to ST1 increases.
This weighting value may be transmitted from the terminal 10 to the information processing apparatus 20 together with the security countermeasure policy. Alternatively, the information processing device 20 may be set based on a combination of designated security countermeasure policies in accordance with a predetermined algorithm.

  The degree of contribution may be held by a node different from the database 30. For example, in the database 30, only information excluding the contribution from FIG. 3 is stored, the contribution is stored in a storage unit (not shown) of the information processing apparatus 20, and a selective implementation example is acquired from the database 30. The information processing apparatus 20 reads out the degree of contribution from the storage unit. Alternatively, a database in which the implementation example and the contribution degree are associated and stored is provided in the information processing system 1 so that contribution degree information can be provided in response to an inquiry from the database 30 via the communication network 40. Good.

  The formulation of the security countermeasure policy according to the present invention does not necessarily conform to the security standard ISO / IEC15408. In short, the present invention is provided with one guideline consisting of a plurality of security objectives, and in a situation where there are implementation example options that can be adopted for each security objective, a combination of implementation examples to be adopted is determined from the guidelines. It can be applied to any processing.

  The functional configurations of the terminal 10, the information processing apparatus 20, and the database 30 described above are merely examples, and in the present invention, how each function is implemented in hardware is not limited. As an example, the functions of the information processing apparatus 20 described above are realized by the CPU of the information processing apparatus 20 executing a program. This program includes a magnetic recording medium (magnetic tape, magnetic disk (HDD (Hard Disk Drive), FDD (Flexible Disk Drive)), etc.), optical recording medium (optical disk (CD (Compact Disc), DVD (Digital Versatile Disk)) Etc.), and may be provided in a state stored in a computer-readable recording medium such as a magneto-optical recording medium or a semiconductor memory. Such a program can be downloaded via a network such as the Internet.

  In short, the information processing apparatus according to the present invention includes a designation unit that designates a plurality of security countermeasure policies, and one or a plurality of implementation examples that are selectively applied to each of the designated plurality of security countermeasure policies. For each of a plurality of implementation examples acquired by the acquisition unit acquired by the acquisition unit, the number of security objective policies that are targets of selective application of the implementation example among the plurality of security objective policies is calculated, A determination unit that determines one combination of implementation examples that conforms to the plurality of security objectives by preferentially selecting an implementation example with a large number of the calculated ones from the plurality of implementation examples; and the determination It is only necessary to have an output unit that outputs the combined combination.

  Further, the functional configurations of the terminal 10, the information processing device 20, and the database 30 may be implemented in one hardware device. In this case, the security policy and the implementation example are exchanged between the functional modules in the apparatus without going through the communication network 40. In short, the information processing system of the present invention includes a security countermeasure policy, a database that stores one or a plurality of implementation examples that are selectively applied to the security countermeasure policy, and a designation unit that specifies a plurality of security countermeasure policies. And, for each of the designated plurality of security objectives, an acquisition unit that acquires one or more implementation examples that are selectively applied from the database, and for each of the acquired plurality of implementation examples, Calculate the number of security objectives that are subject to selective application from a plurality of security objectives, and preferentially select an implementation example that has a large number of such implementations from the plurality of implementation examples A determination unit that determines one combination of implementation examples that conforms to the plurality of security objectives, and the determined combination Allowed only to have an output section for outputting.

DESCRIPTION OF SYMBOLS 1 ... Information processing system, 10 ... Terminal, 20 ... Information processing apparatus, 30 ... Database, 40 ... Communication network, 101 ... Control part, 102 ... Communication part, 103 ... Display unit, 104 ... Input unit, 210 ... Acquisition unit, 220 ... Identification unit, 221 ... First identification unit, 222 ... Second identification unit, 223 ... Contribution Degree evaluation unit, 224... Application number evaluation unit, 230... Communication unit, 231.

Claims (5)

A designating part for designating a plurality of security objectives;
For each of a plurality of security policies is the specified one or a plurality of first example implementation applies required, an acquisition unit for acquiring a second implementation example of the number of double that will be selectively applied,
Of the plurality of second implementation examples, among the plurality of security countermeasure policies, each of the plurality of second implementation examples excluded by applying the one or more first implementation examples obtained. calculating a number of security objectives are targeted for selective application of the second implementation example, preferentially selecting the second implementation example the calculated issued a large number from among the plurality of second mounting example A determination unit that determines one combination of implementation examples that conform to the plurality of security objectives,
And an output unit that outputs the determined combination. The information processing apparatus according to claim 1, wherein the security countermeasure policy is information generated in accordance with the ISO / IEC15408 standard. The acquisition unit acquires a contribution to the realization of a corresponding security objective for each of the one or more implementation examples,
The determination unit, when the number is the same for a plurality of implementation examples to be selected,
The information processing apparatus according to claim 1 or 2, wherein one implementation example is selected by using contributions of the plurality of implementation examples to be selected. And security objectives, and with respect to the security objectives, one or a plurality of first example implementation applies mandatory, storing a second mounting example of the number of double that will be selectively applied database,
A designating part for designating a plurality of security objectives;
For each of the specified plurality of security objectives, one or a plurality of first example implementation applies mandatory, acquisition unit for acquiring a second implementation example of the number of double that will be selectively applied from the database When,
Of each of the plurality of second implementation examples acquired, each of the plurality of second implementation examples excluded by applying the one or more first implementation examples acquired is the security countermeasure policy. Of these, the number of security objectives targeted for selective application of the second implementation example is calculated, and the second implementation example having a large number of the calculated numbers is preferentially selected from the plurality of second implementation examples. A determination unit for determining one combination of implementation examples conforming to the plurality of security objectives;
An information processing system comprising: an output unit that outputs the determined combination. And the step of accepting the designation of multiple security objectives,
Step acquisition means, for each of said specified plurality of security objectives, to acquire one or a plurality of first example implementation applies mandatory, and a second implementation example of the number of double that will be selectively applied When,
For each of the plurality of second implementation examples excluded by applying the one or more first implementation examples obtained from the plurality of second implementation examples obtained by the determination unit , priority is calculated the number of security objectives are targeted for selective application of the second implementation example of the security objectives, the second implementation example the calculated issued a large number from among the plurality of second mounting example Determining one combination of implementation examples conforming to the plurality of security objectives,
Outputting the determined combination. An information processing method.

Images