JP6716995B2 - Information processing apparatus, information processing method, and program - Google Patents

Description

The present invention relates to an information processing device, an information processing method, and a program.

Many systems are composed of multiple components. The components are, for example, a network device that constitutes a network and a device connected to the network. The device connected to the network is, for example, a printer or a server. The devices connected to the network have security problems against vulnerabilities and threats caused by cyber attacks from the outside. Security issues are also called information security risks, or simply security risks. In order to operate the system safely, there is a technique for investigating whether a device having a security risk exists on the network and taking necessary measures. In a system including a network device and a device connected to a network, the administrator of the network device and the manager of the device connected to the network are often different administrators. In the operation where the device administrator and the network administrator are separated, if a device has a security risk and it is necessary to change the network settings as a countermeasure against the security risk, for example, enable the firewall. If it is necessary to restrict communication due to such reasons, the administrator of the device with the security risk should contact the administrator of the network device, and the administrator of the network device that receives the contact shall take necessary measures. Become.

Related art includes the following Patent Documents 1 and 2.

Patent Document 1 discloses a security risk information providing device that presents information about security risks that occur when a plurality of Web services are linked. The security risk information providing apparatus sets a security policy for using the service provided by the Web service providing apparatus. Then, using the service usage status information indicating the usage status of the service used by the user and the service cooperation information indicating the cooperation information between the services used by the user, whether the service usage status of the user conforms to the security policy. To judge.

Patent Document 2 discloses a management computer that detects a mismatch between the volume management range on the management computer and the volume management range due to storage partition in the storage. When a plurality of volumes are designated as a user's management target, the management computer acquires from the storage the identifier of the volume group to which the designated plurality of volumes belong. Then, the storage management information that stores the correspondence between the volume group identifier and the user identifier is referred to, and it is determined whether or not the acquired volume groups fall within the same user management range.

JP, 2013-196422, A JP, 2005-322102, A

It may be necessary to take measures against security risks as soon as possible. However, as described above, when the administrator of each of the plurality of constituent elements of the system is divided, when it is necessary to perform work on another constituent element as a countermeasure for the security risk of one constituent element, it is urgent. There was a problem that I could not take measures.

Patent Documents 1 and 2 do not disclose means for solving the problem.

An object of the present invention is to provide an information processing device, an information processing method, and a program that solve the above problems.

The information processing apparatus of the present invention includes a specifying unit that specifies a second constituent element related to coping with a security risk related to the first constituent element, and an administrator of the first constituent element from the second constituent element. A receiving unit that receives instruction information for coping and an execution unit that executes coping based on the instruction information are provided.

According to the information processing method of the present invention, a specific step of identifying a second component related to dealing with a security risk relating to the first component, and a countermeasure in the second component from an administrator of the first component. And a step of executing a countermeasure based on the instruction information.

The program of the present invention allows a computer to perform a specific process of identifying a second constituent element related to coping with a security risk related to the first constituent element, and an administrator of the first constituent element from the second constituent element. A reception process for receiving handling instruction information and an execution process for performing handling based on the instruction information are executed.

According to the present invention, in order to deal with a security risk of a component managed by a predetermined administrator, a countermeasure is performed on a component other than the component managed by the administrator based on an instruction from the administrator. It is possible to provide an information processing device, an information processing method, and a program that can be performed.

It is a figure which shows the structure of the system 1000 concerning 1st Embodiment. It is a figure which shows the structure of the information processing apparatus 100 concerning 1st Embodiment. 5 is a diagram illustrating an operation of the information processing device 100. FIG. It is a figure which shows the structure of the system 2000 concerning 2nd Embodiment. It is a figure which shows the structure of the information processing apparatus 110 concerning 2nd Embodiment. FIG. 6 is a diagram showing an example of information stored in a storage unit 112. It is a figure which shows the hardware constitutions of the information processing apparatus 110. 5 is a diagram illustrating an operation of the information processing device 110. FIG. It is a figure which shows the structure of the information processing apparatus 120 concerning 3rd Embodiment. It is a figure which shows an example of the notification screen to an administrator. 6 is a diagram illustrating an operation of the information processing device 120. FIG. It is a figure which shows the structure of the information processing apparatus 130 concerning 4th Embodiment. FIG. 6 is a diagram showing an example of information stored in a storage unit 132. 6 is a diagram illustrating an operation of the information processing device 130. FIG.

[First Embodiment]
[Processing configuration]
FIG. 1 is a diagram showing a configuration of a system 1000 according to the first embodiment. The system 1000 includes an information processing device 100, a component 200, and a component 300.

The component 200 and the component 300 are components (configuration item; CI) based on Information Technology. The component 200 and the component 300 are devices such as a computer, a server, and a printer. The components 200 and 300 may be components other than devices such as services, software, operating systems, and applications. An example of the operation in which the administrators are separated is an operation in which the administrator of the network device and the administrator of the device connected to the network are different administrators. Another example of the operation in which the administrator is separated is an operation in which the website administrator and the server administrator are different administrators. In the operation where the website administrator and the server administrator are different administrators, for example, the authority regarding the setting of directory permissions is not given to the website administrator, but in order to immediately deal with the security risk of the website. In some cases, the website administrator may need to set the C drive permission of the server.

Here, the security risk is a vulnerability existing in the constituent element 200, a threat caused by an external attack on the constituent element 200, or an unsecured operation setting (a weak setting for the security risk). Including the risk of. The countermeasure is a measure for eliminating, avoiding or reducing the security risk.

FIG. 2 is a diagram showing the configuration of the information processing apparatus 100 according to the first embodiment. The information processing device 100 includes a specifying unit 101, a receiving unit 102, and an executing unit 103.

The identifying unit 101 identifies a component related to dealing with a security risk related to the component 200. An example of the identifying method by the identifying unit 101 will be described. In the above-described operation in which the administrator of the network device is different from the administrator of the device connected to the network, the component 200 is the device connected to the network (first device), and the component 200 300 is a network device (second device). The identifying unit 101 refers to the communication log of the first device, for example, and identifies the second device having the communication history related to the security risk as the device related to the countermeasure. Further, the identifying unit 101 identifies the second device corresponding to the case where the network-related measures of the first device are implemented by referring to the system topology information. For example, if the measure related to the network is “blocking access from an external terminal to a specific port of the first device”, a firewall device that passes through when the first device and the external terminal communicate with each other, or a network having a firewall function The device is specified based on the topology information of the system, and the specified device is set as the second device. The system topology information is information indicating the network connection relationship between devices, the connection relationship between devices and peripheral devices such as disks, and the range of its own domain in the network. The topology information of the system may be configured such that the identifying unit 101 appropriately refers to or obtains it from an external subsystem as needed. The external subsystem stores, for example, the physical and logical configuration of the network and the information including at least a part of the relationship between the device and the peripheral device by the input of the user or discovers and holds the information by the discovery function. be able to. Further, in an operation in which the website administrator and the server administrator are different administrators, the component 200 is an application and the component 300 is a server. When an attack on a website occurs, the identifying unit 101 identifies a server on which an application related to the website operates as a device related to dealing with the attack.

The accepting unit 102 accepts handling instruction information in the component 300 from the administrator of the component 200.

The execution unit 103 executes a countermeasure based on the instruction information received by the reception unit 102.

[motion]
FIG. 3 is a flowchart illustrating the operation of the information processing device 100.

The identifying unit 101 identifies the component 300 related to the countermeasure against the security risk regarding the component 200 (step S11). The accepting unit 102 accepts instruction information for handling the component 300 from the administrator of the component 200 (step S13). The execution unit 103 executes a countermeasure based on the instruction information received by the reception unit 103 in step S13 (step S15).

[effect]
According to the information processing apparatus 100 of the present embodiment, in order to deal with the security risk of the component managed by a predetermined administrator, other than the component managed by the administrator based on the instruction from the administrator. Actions can be taken on the components. As a result, even when the administrator of each of the multiple components that make up the system is divided, it is necessary to perform work on other components as a countermeasure against the security risk of one component. Measures can be taken immediately.

[Second Embodiment]
[Processing configuration]
FIG. 4 is a diagram showing the configuration of the system 2000 according to the second embodiment. The system 2000 includes an information processing device 110 and a device 210. The information processing device 110 and the device 210 are connected to the network 310. In the present embodiment, the device 210 corresponds to the component 200 in the first embodiment, and the network 310 corresponds to the component 300 in the first embodiment. The network 310 includes network devices.

FIG. 5 is a diagram showing the configuration of the information processing device 110. The information processing device 110 is a device that manages the security risk of the device 210. The information processing device 110 includes an acquisition unit 111, a storage unit 112, a reception unit 113, an analysis unit 114, a determination unit 115, and an execution unit 116.

The acquisition unit 111 acquires the security risk investigation result of the device 210. The security risk survey is a survey performed based on information indicating security risks and countermeasures provided by each vendor, for example, and is a survey performed by a survey unit 212 (described later) of the device 210. Hereinafter, information indicating security risks and countermeasures for them is also referred to as security risk information. The security risk information may include vulnerability information of the device provided by each vendor or research organization. Security risks may include information about non-secure operational settings of the device. The security risk investigation result includes information indicating the device 210 having the security risk, the type of the security risk, and the countermeasure thereof. The acquisition unit 111 may acquire, from the device 210, the result of the security risk investigation performed by the device 210 in response to the investigation request from the information processing device 110. The acquisition unit 111 may also acquire the result of the security risk investigation performed by the apparatus 210 in response to an investigation request from an apparatus other than the information processing apparatus 110 or independently. Further, a storage device may be provided in the system 2000 in addition to the information processing device 110 and the device 210, and the result of the security risk investigation in the device 210 may be stored in the storage device. In this case, the acquisition unit 111 acquires the result of the security risk investigation from the storage device.

The information processing apparatus 110 that has acquired the security risk investigation result can notify the administrator of the security risk investigation result. As the notification method, there are a method of displaying on the display unit (not shown) of the device 210 and a method of sending an electronic mail to the administrator.

The storage unit 112 stores the component-based countermeasure information 10 in which the countermeasure applicable to the security risk included in the investigation result acquired by the acquisition unit 111 is associated with each device 210. Referring to FIG. 6, the component-based countermeasure information 10 is information in which a security risk survey identifier (survey ID) 11, a device identifier (device ID) 12, and an applicable countermeasure 13 are associated with each other. The applicable countermeasure 13 is a countermeasure that eliminates the security risk when the countermeasure is applied to the device 210 having the security risk. The component-based countermeasure information 10 is generated, for example, by investigating the device 210 based on information (security risk information) that is provided from each vendor and that indicates the type of security risk and the countermeasure thereto. The storage unit 112 also stores information 20 in which an administrator identifier (administrator ID) 21 that is an identifier of the administrator of the device 210 and a device ID 22 are associated with each other. Referring to FIG. 6, for example, the administrator identified by the administrator ID 21 “user01” can perform operations and obtain information about the device 210 identified by the device IDs “A” and “B”. The device ID 12 and the device ID 22 are a serial number of the device 210, a Media Access Control address, an Internet Protocol (IP) address, or a port number of the device 210.

The accepting unit 113 accepts the instruction information regarding the network setting change and the administrator ID 21 from the administrator. The instruction information relating to the network setting change is, for example, instruction information having the content of “blocking communication from the IP address 123.456.7.8 for the device A”, “closing the port BB of the device B”, and the like. The reception unit 113 corresponds to the reception unit 102 of the information processing device 100 according to the first embodiment.

The analysis unit 114 analyzes the instruction information received by the reception unit 113 and refers to the storage unit 112 to determine whether or not the instruction information includes instruction information regarding a countermeasure applicable to the device 210 against the security risk. To do. This is because when the instruction information regarding the network setting change received by the receiving unit 113 includes the instruction information that is not applicable for dealing with the security risk, the administrator of the device 210 is unnecessarily given the authority regarding the network setting change. This is to prevent it. The processing of the analysis unit 114 will be specifically described with reference to FIG. 6. The applicable countermeasure 13 is searched using the device ID 12 included in the instruction information accepted by the acceptance unit 113 as a key, and the retrieved countermeasure 13 and the acceptance unit The countermeasures included in the instruction information received by 113 are compared.

The determination unit 115 refers to the storage unit 112 when the instruction information received by the reception unit 113 includes the instruction information regarding the countermeasure applicable to the device 210 with respect to the security risk, and the instruction information received by the reception unit 113. It is determined whether or not the correspondence relationship between the device ID 22 included in the ID and the administrator ID 21 received by the reception unit 113 is correct.

The analysis unit 114 and the determination unit 115 correspond to the identification unit 101 in the information processing device 100 according to the first embodiment.

As a result of the determination by the determination unit 115, the execution unit 116 accepts the acceptance unit 113 when the device ID 22 included in the instruction information accepted by the acceptance unit 113 and the manager ID 21 accepted by the acceptance unit 113 are correct. The countermeasure is executed based on the countermeasure instruction information. Changing the settings for the network includes changing the settings of the firewall to block communication from a specific IP address, and to close a specific port. The execution unit 116 corresponds to the execution unit 103 in the information processing device 100 according to the first embodiment.

The device 210 is a device such as a client personal computer (hereinafter referred to as a personal computer), a server, or a printer. However, the device 210 is not limited to the example given here. The device 210 includes a communication unit 211 and a research unit 212.

The communication unit 211 communicates with an external device (for example, the information processing device 110) via the network 310. The communication unit 211 acquires security risk information provided by each vendor or the like.

The investigation unit 212 compares the operating system (OS) type of the device 210, the version of the OS, information about various applications installed in the device 210 with the security risk information acquired by the communication unit 211, and performs security. Investigate at-risk device 210.

It should be noted that instead of the investigation unit 212 investigating the security risk, an investigation unit may be provided in the information processing device 110 or another device, and the investigation unit may perform the investigation. When the investigation unit of the information processing device 110 or the other device investigates the security risk, the device 210 transmits the information necessary for the investigation to the investigation unit of the information processing device 110 or the other device. The information necessary for the investigation is, for example, the product version of the OS or application running on the device 210. The form of transmitting the information necessary for the investigation may be either Push type or Pull type. For example, when the device 210 is a personal computer, the agent software installed in the personal computer can realize transmission of information necessary for the investigation. Further, when the device 210 is a printer or a network device, the Simple Network Management Protocol server can realize the transmission of information necessary for the investigation.

The network 310 may be a Local Area Network or the Internet, a telephone line network, or a public line network such as satellite communication.

[Hardware configuration]
FIG. 7 is a diagram showing a hardware configuration of the information processing device 110. The information processing device 110 includes a processor 110a, a memory 110b, a storage 110c, an input/output interface (input/output I/F) 110d, and a communication interface (communication I/F) 110e. The processor 110a, the memory 110b, the storage 110c, the input/output interface 110d, and the communication interface 110e are connected by a data transmission path 110f for transmitting/receiving data mutually.

The processor 110a is an arithmetic processing unit such as a Central Processing Unit or a Graphics Processing Unit. The processor 110a realizes the function of each processing unit by executing each program stored in the storage 110c described later. Here, when executing each program, the processor 110a may execute these programs after reading them on the memory 110b described later, or may execute them without reading them on the memory 110b.

The memory 110b is a memory such as a Random Access Memory (RAM) or a Read Only Memory (ROM).

The storage 110c is a storage device such as a Hard Disk Drive, a Solid State Drive, or a memory card. The storage 110c may be a memory such as a RAM or a ROM. The storage 110c stores programs that implement the functions of the processing units.

The communication interface 110e transmits/receives data to/from an external device or an external network. The communication interface 110e communicates with an external device or an external network via, for example, a wired network or a wireless network. The hardware configuration of the information processing device 110 is not limited to the configuration shown in FIG. 7.

[motion]
The operation of the information processing device 110 will be described with reference to FIG.

Referring to FIGS. 4 and 8, the acquisition unit 111 acquires a security risk investigation result of the device 210 (step S21). The accepting unit 113 accepts the instruction information regarding the network setting change and the administrator ID 21 from the administrator (step S23). When the instruction information and the administrator ID 21 are not received from the administrator (no in step S23), the information processing apparatus 110 ends the operation. When the instruction information and the administrator ID 21 are received from the administrator (yes in step S23), the analysis unit 114 analyzes the instruction information received by the reception unit 113 and refers to the storage unit 112 to determine that the instruction information is It is determined whether or not the instruction information regarding the countermeasure applicable to the device 210 with respect to the security risk is included (step S25).

As a result of the analysis in step S25, when the instruction information received by the reception unit 113 does not include the instruction information regarding the countermeasure applicable to the device 210 for the security risk (no in step S25), the information processing device 110 ends the operation. To do. When the instruction information received by the reception unit 113 includes the instruction information related to the countermeasure applicable to the device 210 for the security risk (yes in step S25), the determination unit 115 refers to the storage unit 112 and refers to the reception unit 113. It is determined whether or not the correspondence between the device ID 22 included in the instruction information received by and the administrator ID 21 received by the receiving unit 113 is correct (step S27).

As a result of the determination in step S27, when the correspondence between the device ID 22 included in the instruction information received by the reception unit 113 and the manager ID 21 received by the reception unit 113 is correct (yes in step S27), the execution unit 116 The setting change for the network is executed based on the instruction information received by the reception unit 113 (step S29). When the correspondence between the device ID 22 included in the instruction information received by the reception unit 113 and the administrator ID 21 received by the reception unit 113 is not correct (no in step S27), the information processing device 110 ends the operation.

[effect]
According to the information processing apparatus 110 according to the second embodiment, in order to deal with the security risk of the component managed by a predetermined manager, the manager manages the security risk based on an instruction from the manager. Actions can be taken on components other than elements.

[Third Embodiment]
[Processing configuration]
FIG. 9 is a diagram showing the configuration of the information processing device 120 according to the third embodiment. The information processing device 120 includes an acquisition unit 121, a storage unit 122, a reception unit 123, an analysis unit 124, a determination unit 125, and an execution unit 126. Configurations not specifically described are similar to those of the information processing apparatus 100 and the information processing apparatus 110 according to the first and second embodiments.

The acquisition unit 121 acquires the operation information of the device 220 in addition to the security risk investigation result. The operation information is at least one of information (operation history information) indicating a history of operations and processes performed by the device 220 or information (operation schedule information) indicating an operation and a process scheduled to be performed in the device 220. It is the information to include. The operation information is generated by the device 220 and stored in the storage unit 122 of the device 220 in response to the execution of the predetermined operation or process in the device 220 or the input of the execution schedule of the predetermined operation or process.

The determination unit 125 refers to the storage unit 122 when the instruction information received by the reception unit 123 includes the instruction information regarding the countermeasure applicable to the device 220 with respect to the security risk, and the instruction information received by the reception unit 123. It is determined whether or not the correspondence relationship between the device ID 22 included in the ID and the administrator ID 21 received by the receiving unit 123 is correct. In addition, the determination unit 125 calculates a recommended execution time of countermeasures against security risks (recommended countermeasure time) based on the operation information acquired by the acquisition unit 121. When countermeasures such as firewall setting changes and port closures are required as countermeasures to security risks, the apparatus 220 may need to be restarted in accordance with the countermeasures. For example, in the case of the device 220 that restarts every Thursday in the operation information acquired by the acquisition unit 121, the security risk is dealt with at the timing of the periodic rebooting, and the countermeasure is taken. It is efficient to restart.

The execution unit 126 executes applicable measures at the execution time calculated by the determination unit 125.

In some cases, taking security risks as soon as possible is prioritized over minimizing downtime of the device 220. In this case, the administrator is notified of the execution time determined based on the operating status (FIG. 10), and the operator is made to select whether to immediately execute the coping or the recommended coping time calculated based on the operating status. You can also

[motion]
The operation of the information processing device 120 will be described with reference to FIG.

The acquisition unit 121 acquires the security risk investigation result of the device 220 (step S31). Then, the acquisition unit 121 acquires the operation information of the device 220 (step S33). The accepting unit 123 accepts the instruction information regarding the network setting change and the administrator ID 21 from the administrator (step S35). When the instruction information and the administrator ID 21 are not received from the administrator (no in step S35), the information processing apparatus 120 ends the operation. When the instruction information and the administrator ID 21 are received from the administrator (yes in step S35), the analysis unit 124 analyzes the instruction information received by the reception unit 123 and refers to the storage unit 112 to determine that the instruction information is It is determined whether or not the instruction information regarding the countermeasure applicable to the device 220 for the security risk is included (step S37).

As a result of the analysis in step S37, when the instruction information received by the reception unit 123 does not include the instruction information regarding the countermeasure applicable to the device 220 for the security risk (no in step S37), the information processing device 120 ends the operation. To do. When the instruction information received by the reception unit 123 includes the instruction information regarding the countermeasure applicable to the device 220 with respect to the security risk (yes in step S37), the determination unit 125 refers to the storage unit 122, and the reception unit 123. It is determined whether or not the correspondence between the device ID 22 included in the instruction information received by and the administrator ID 21 received by the receiving unit 123 is correct (step S39).

As a result of the determination in step S39, when the correspondence relationship between the device ID 22 included in the instruction information received by the reception unit 123 and the manager ID 21 received by the reception unit 123 is correct (yes in step S39), the determination unit 125 The recommended coping time is calculated based on the operation information acquired by the acquisition unit 121 in step S33 (step S41). When the correspondence relationship between the device ID 22 included in the instruction information received by the reception unit 113 and the administrator ID 21 received by the reception unit 123 is incorrect (no in step S39), the information processing device 120 ends the operation.

When the present time reaches the recommended coping time calculated in step S41 (yes in step S43), the execution unit 126 executes the setting change for the network based on the instruction information received by the reception unit 123 (step S45). ..

[Effect]
According to the information processing apparatus 120 according to the third embodiment, it is possible to effectively deal with the security risk according to the operating status of the apparatus 220.

[Fourth Embodiment]
[Processing configuration]
FIG. 12 is a diagram showing the configuration of the information processing device 130 according to the fourth embodiment. The information processing device 130 includes an acquisition unit 131, a storage unit 132, a reception unit 133, an analysis unit 134, a determination unit 135, and an execution unit 136. Configurations not specifically described are similar to those of the information processing apparatus 100, the information processing apparatus 110, and the information processing apparatus 120 according to the first to third embodiments.

The storage unit 132 stores information corresponding to the component-by-component handling information 10 according to the second embodiment. The storage unit 132 also stores information corresponding to the information 20 in the second embodiment, that is, information in which the administrator ID 21 and the device ID 22 are associated with each other. FIG. 13 is a diagram showing an example of the information 30 corresponding to the information 20. In the information 30, a flag (coping completion flag) 34 indicating whether or not the execution of the coping by the execution unit 136 is completed is stored in association with the device ID. In FIG. 13, “1” of the coping completion flag 34 indicates that the coping execution is completed, and “0” indicates that the coping execution is not completed. Instead of the coping completion flag 34, it is possible to store information about the coping progress status and present the coping progress status to the administrator based on the information.

When the accepting unit 133 accepts the instruction information regarding the network setting change and the administrator ID 11 from the administrator, the determining unit 135 refers to the storage unit 132 and determines whether or not the execution unit 136 has completed the countermeasure. Determine whether. When the determination unit 135 determines that the execution of the countermeasure by the execution unit 136 has been completed, the determination unit 135 invalidates the instruction information. Specifically, the determination unit 135 discards the instruction information and notifies the administrator that the countermeasure has already been executed. The notification includes a notification by sending an electronic mail and a notification by a display on a display screen of a device or the like managed by an administrator.

[motion]
The operation of the information processing device 130 will be described with reference to FIG.

Steps S51 to S55 are the same as steps S21 to S25 in FIG.

In FIG. 14, when the instruction information received by the receiving unit 133 includes the instruction information regarding the countermeasure applicable to the device 230 with respect to the security risk (yes in step S55), the determination unit 135 refers to the storage unit 132, It is determined whether or not the execution of the countermeasure by the execution unit 136 has been completed (step S57). As a result of the determination in step S55, when the execution of the countermeasure by the execution unit 136 is completed (yes in step S57), the information processing apparatus 130 ends the operation. When the execution of the countermeasure by the execution unit 136 is not completed (No in step S57), the process proceeds to step S59. Steps S59 and S61 are the same as steps S27 and S29 of FIG.

[Effect]
According to the information processing apparatus 130 according to the fourth embodiment, even if the reception unit 133 receives instruction information having the same content as the countermeasure required as a result of the security risk investigation, the countermeasure has been completed. Then, the determination unit 135 discards the instruction information. Therefore, it is possible to prevent the duplicated execution of the measures, and it is possible to prevent the range of granting the authority regarding the network setting change from being expanded more than necessary.

Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and it goes without saying that other modifications and applications are included without departing from the spirit of the present invention.

10 Response information for each component 11, 31, Survey ID
12, 22, 32 Device ID
13, 33 Applicable measures 21 Administrator ID
20, 30 Information 34 Coping completion flag 100, 110, 120, 130 Information processing device 101 Identification unit 102, 113, 123, 133 Reception unit 103, 116, 126, 136 Execution unit 110a Processor 110b Memory 110c Storage 110d Input/output interface 110e Communication interface 110f Data transmission path 111, 121, 131 Acquisition unit 112, 122, 132 Storage unit 114, 124, 134 Analysis unit 115, 125, 135 Determination unit 200, 300 Component 210, 220, 230 Device 310, 320, 330 Network 211 Communication unit 212 Research unit 1000, 2000 system

Claims (10)

A specifying unit that specifies a second component related to coping with a security risk relating to the first component;
A receiving unit that receives a first configuration needed fluorinated et al, administrator information of the instruction information and the first component containing the address in said second component,
It is determined that the correspondence between the first constituent element for which the reception unit has received the instruction information and the manager information is included in the correspondence information in which the constituent element and the manager information of the constituent element are stored in association with each other. A determination unit that
When the correspondence is included in the correspondence information, an information processing apparatus including: an execution unit that executes the handling based on the instruction information. The information processing apparatus according to claim 1, wherein the specifying unit specifies the second constituent element based on communication history information of the first constituent element. A storage unit that stores component-by-component countermeasure information indicating a countermeasure applicable to each of the first components with respect to the security risk;
The information processing apparatus according to claim 1, wherein the identifying unit identifies the second component with reference to the component-by-component handling information stored in the storage. An acquisition unit for acquiring operation information including operation history information and operation schedule information of the first component;
The execution unit calculates an execution time of a countermeasure applicable to the first component with respect to the security risk, based on the operation information acquired by the acquisition unit, and calculates the applicable countermeasure. to execute the execution time, the information processing apparatus according to any one of claims 1 to 3. The information processing device
Identifying steps of identifying a second component associated with addressing a security risk associated with the first component;
A reception step of receiving said first configuration is needed fluorinated et al, administrator information of the instruction information and the first component containing the address in said second component,
A determination step of determining that the correspondence between the first constituent element that has received the instruction information and the manager information is included in the correspondence information stored in association with the constituent element and the manager information of the constituent element; ,
When the correspondence is included in the correspondence information, an execution step of executing the handling based on the instruction information, the information processing method. The information processing method according to claim 5, wherein in the identifying step, the second component is identified based on communication history information of the first component. 7. In the identifying step, the second component is identified with reference to component-by-component countermeasure information indicating countermeasures applicable to the security risk for each of the first components, 7. Information processing method described. Including an acquisition step of acquiring operation information including operation history information and operation schedule information of the first component;
In the execution step, based on the operation information acquired in the acquisition step, an execution time of a countermeasure applicable to the first component with respect to the security risk is calculated, and the applicable countermeasure is calculated. run the calculated execution time, the information processing method according to any one of claims 5 to 7. Identifying processing of causing the computer to identify a second component related to coping with a security risk relating to the first component;
A receiving process of receiving and said first configuration is needed fluorinated et al, administrator information of the instruction information and the first component containing the address in said second component,
Determination processing for determining that the correspondence between the first constituent element that has received the instruction information and the manager information is included in the correspondence information stored in association with the constituent element and the manager information of the constituent element. ,
A program that, when the correspondence is included in the correspondence information, executes an execution process that executes the handling based on the instruction information. The program according to claim 9, wherein in the identifying process, the second component is identified based on communication history information of the first component.

Images