JP6911967B2 - Security risk management system, terminal, server, control method, program - Google Patents

Description

The present invention relates to a security risk management system, a server, a control method, and a program.

Terminals used in enterprises have security risks such as vulnerabilities in hardware and software. Therefore, it is necessary for a company to manage the vulnerability of terminals in the company. Recently, a security risk management system that supports the management of vulnerabilities has also been proposed (for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2009-015570

By the way, companies that use security risk management systems generally manage vulnerabilities as follows.
After disclosing the vulnerability information, the security manager of the company uses the security risk management system to investigate the presence or absence of vulnerabilities in the terminals in the company.
As a result of the investigation, the security manager of the company uses the security risk management system to formulate countermeasures for the vulnerabilities and implement the countermeasures when there are vulnerable terminals.

However, if the vulnerability information is disclosed, there is a risk that the terminal will be attacked by a malicious individual or group, so it is necessary to shorten the time required to take countermeasures against the vulnerability.
The technique disclosed in Patent Document 1 described above registers the handling status of a terminal vulnerability in a database in association with a keyword indicating the type of the vulnerability. That is, the technique disclosed in Patent Document 1 is a technique for registering the countermeasure status of the vulnerability actually taken by the terminal in the database, and is not a technique for shortening the time until the countermeasure for the vulnerability is taken.

An object of the present invention is to provide a technique capable of solving the above-mentioned problems and shortening the time required to take countermeasures against vulnerabilities.

According to one aspect of the invention, the security risk management system
With the server
Including the agent part provided in the terminal
The server
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit, and the vulnerability information is transmitted to the agent unit.
The agent unit
Before the release date and time of the vulnerability information, the presence or absence of the vulnerability of the terminal is investigated based on the information of the vulnerability investigation method included in the vulnerability information, and the vulnerability investigation result including the investigation result is obtained by the server. Send to
The server
The vulnerability information and the result of the vulnerability investigation will be presented after the date and time when the vulnerability information is published.

According to one aspect of the invention, the server
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit provided in the terminal, and the agent unit performs the agent based on the information of the vulnerability investigation method included in the vulnerability information. The communication unit that receives the vulnerability investigation results including the investigation results of the presence or absence of the vulnerability of the terminal investigated by the department, and
After the release date and time of the vulnerability information, the presentation unit that presents the vulnerability information and the vulnerability investigation result, and the presentation unit.
To be equipped.

According to one aspect of the present invention, the control method is
It ’s a server control method.
A transmission step of transmitting the vulnerability information to the agent unit provided in the terminal before the release date and time of the vulnerability information, and
A step of receiving a vulnerability investigation result including an investigation result of the presence or absence of a vulnerability of the terminal investigated by the agent unit based on the information of the vulnerability investigation method included in the vulnerability information from the agent unit. ,
After the release date and time of the vulnerability information, the presentation step of presenting the vulnerability information and the vulnerability investigation result, and
including.

According to one aspect of the invention, the program
On the computer
A transmission procedure for transmitting the vulnerability information to the agent unit provided in the terminal before the release date and time of the vulnerability information, and
Prior to the release date and time of the vulnerability information, the agent unit investigates the presence or absence of the vulnerability of the terminal investigated by the agent unit based on the information of the vulnerability investigation method included in the vulnerability information. Procedures for receiving vulnerability survey results, including
After the release date and time of the vulnerability information, the presentation procedure for presenting the vulnerability information and the vulnerability investigation result, and the presentation procedure.
It is a program to execute.

According to one aspect of the invention, the program
On the computer
The receiving procedure for receiving the vulnerability information from the server before the release date and time of the vulnerability information,
Prior to the release date and time of the vulnerability information, an investigation procedure for investigating the presence or absence of a terminal vulnerability based on the information on the vulnerability investigation method included in the vulnerability information, and
Before the release date and time of the vulnerability information, a procedure for transmitting the vulnerability investigation result including the investigation result of the investigation procedure to the server and a procedure for sending the vulnerability investigation result to the server.
It is a program to execute.

According to the present invention, it is possible to obtain an effect that the time required to take countermeasures against vulnerabilities can be shortened.

It is a figure which shows the configuration example of the security system which concerns on Embodiment 1. FIG. It is a block diagram which shows the block composition example of the vulnerability information distribution system and the security risk management system which concerns on Embodiment 1. FIG. It is a figure which shows the configuration example of the hardware composition of the computer which realizes the vulnerability information distribution system, the server, and the terminal which concerns on Embodiment 1. FIG. It is a flowchart which shows the operation example from receiving the vulnerability information from the vulnerability information transmission system, creating the vulnerability information data, and transmitting it to a server in the vulnerability information distribution system which concerns on Embodiment 1. FIG. It is a figure which shows an example of the vulnerability information data which concerns on Embodiment 1. FIG. It is a flowchart which shows the operation example until the vulnerability information data is received from the vulnerability information distribution system, and the vulnerability information data is transmitted to the agent part in the server which concerns on Embodiment 1. FIG. FIG. 5 is a flowchart showing an operation example in which the agent unit according to the first embodiment receives vulnerability data from a server, investigates the presence or absence of a vulnerability in the corresponding terminal, and transmits the vulnerability investigation result to the server. It is a figure which shows an example of the vulnerability investigation result which concerns on Embodiment 1. FIG. It is a flowchart which shows the operation example until the vulnerability investigation result is received from the agent part, and the vulnerability investigation result is stored in the vulnerability investigation result storage part in the server which concerns on Embodiment 1. In the server according to the first embodiment, the vulnerability information data of the vulnerability information data storage unit is periodically checked, the vulnerability information data whose publication date and time is before the current date and time is decoded, and the decoded vulnerability information data is decoded. Is a flowchart showing an operation example of storing the vulnerability information data storage unit again. It is a flowchart which shows the operation example which displays the vulnerability information and the vulnerability investigation result in the server which concerns on Embodiment 1. FIG. In the agent unit according to the first embodiment, the vulnerability information data of the vulnerability information data storage unit is periodically checked, and the vulnerability information data whose publication date and time is before the current date and time is decoded, and the decoded vulnerability information is obtained. It is a flowchart which shows the operation example which stores the data in the vulnerability information data storage part again. It is a flowchart which shows the operation example which displays the vulnerability information in the agent part which concerns on Embodiment 1. It is a block diagram which shows the block composition example of the security risk management system which concerns on Embodiment 2. It is a sequence diagram which shows the operation example of the security risk management system which concerns on Embodiment 2.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
(1) Embodiment 1
(1-1) Configuration of Embodiment 1 (1-1-1) Overall Configuration Figure 1 shows a configuration example of the security system according to the first embodiment. FIG. 2 shows a block configuration example of the vulnerability information distribution system 210 and the security risk management system 305 according to the first embodiment.

Referring to FIGS. 1 and 2, the security system according to the first embodiment is a vulnerability information transmission system 110 provided in the vulnerability information providing organization 100 and a vulnerability provided in the security risk management system providing company 200. The information distribution system 210 and the security risk management system 305 provided in the security risk management system user company 300 are provided.

Vulnerability information provider 100 is an organization that provides vulnerability information including an outline of vulnerabilities, investigation methods, countermeasures, etc. For example, CERT (Computer Emergency Response Team), JPCERT (Japan Computer Emergency Response Team), etc. , IPA (Information-technology Promotion Agency), etc. The security risk management system provider 200 is a company that provides the security risk management system 305. The security risk management system user company 300 is a company that uses the security risk management system 305 provided by the security risk management system provider 200. The security risk management system user company 300 manages the vulnerability of its own terminal 330 by using the security risk management system 305.

If the software is vulnerable, the vulnerability information provider 100 may provide the software vendor who created the software with the vulnerability information of the vulnerability for the purpose of investigation before the release date and time. .. The vulnerability information provided by the vulnerability information provider 100 to the software vendor can be used by the security risk management system provider 200. However, the security risk management system provider 200 is limited to using the vulnerability information in-house if the vulnerability information is before the release date and time. As described above, the security risk management system provider 200 can use the vulnerability information provided by the vulnerability information provider 100 before the release date and time, although it is limited to its own use.

In the first embodiment, attention is paid to the fact that the security risk management system user company 300 can use the vulnerability information provided by the vulnerability information provider 100 before the release date and time, and the vulnerability information is used before the release date and time. Then, the investigation for the presence or absence of the vulnerability of the terminal 330 is completed.

(1-1-2) Configuration of Vulnerability Information Transmission System 110 The vulnerability information transmission system 110 transmits vulnerability information to the vulnerability information distribution system 210. The vulnerability information transmission system 110 only needs to have a function of transmitting vulnerability information to the vulnerability information distribution system 210, and this function can be realized by a well-known technique. Omit.

(1-1-3) Configuration of Vulnerability Information Distribution System 210 The vulnerability information distribution system 210 has a vulnerability information receiving unit 211, a vulnerability information data creating unit 212, a vulnerability information data encryption unit 213, and a common key storage. It includes a unit 214, a vulnerability information data storage unit 215, and a vulnerability information data transmission unit 216.

The vulnerability information receiving unit 211 receives the vulnerability information from the vulnerability information transmitting system 110. The vulnerability information data creation unit 212 creates the vulnerability information data according to the operation performed by the vulnerability information data creator based on the vulnerability information received by the vulnerability information reception unit 211. The vulnerability information data encryption unit 213 encrypts the vulnerability information data created by the vulnerability information data creation unit 212 using the common key. The common key storage unit 214 stores a common key used by the vulnerability information data encryption unit 213 to encrypt the vulnerability information data. The vulnerability information data storage unit 215 stores the vulnerability information data created by the vulnerability information data creation unit 212. The vulnerability information data transmission unit 216 reads the vulnerability information data from the vulnerability information data storage unit 215 and transmits the read vulnerability information data to the server 310.

(1-1-4) Configuration of Security Risk Management System 305 The security risk management system 305 includes a server 310 and an agent unit 320. The agent unit 320 is software that is also called agent software or an agent. The agent unit 320 corresponds to the terminal 330 in which the security risk management system user company 300 manages the vulnerability, and is installed in the corresponding terminal 330. In FIG. 1, assuming that there are a plurality of terminals 330, a plurality of agent units 320 corresponding to each of the plurality of terminals 330 are provided, but if there is one terminal 330, the agent unit 320 is also one. Become.

The server 310 receives the vulnerability information data from the vulnerability information distribution system 210 before the release date and time of the vulnerability information, transmits the received vulnerability information data to the agent unit 320, and instructs the vulnerability investigation. Further, the server 310 receives the vulnerability investigation result from the agent unit 320, and displays the vulnerability information and the vulnerability investigation result after the release date and time of the vulnerability information. On the other hand, the agent unit 320 receives the vulnerability information data from the server 310 before the release date and time of the vulnerability information, investigates the presence or absence of the corresponding terminal 330 for vulnerabilities, and transmits the vulnerability investigation result to the server 310. do. In addition, the agent unit 320 displays the vulnerability information after the release date and time of the vulnerability information.

(1-1-5) Configuration of Server 310 The server 310 has a vulnerability information data receiving unit 311, a vulnerability information data storage unit 312, a vulnerability information data distribution unit 313, a vulnerability investigation result receiving unit 314, and a vulnerability investigation. It includes a result storage unit 315, a vulnerability disclosure date / time confirmation unit 316, a vulnerability information data decryption unit 317, a common key storage unit 318, and a vulnerability information / investigation result display unit 319. The vulnerability information data distribution unit 313 and the vulnerability investigation result reception unit 314 are examples of the components of the communication unit. The vulnerability information / investigation result display unit 319 is an example of a presentation unit. The vulnerability information data storage unit 312 is an example of a vulnerability information storage unit. The vulnerability disclosure date / time confirmation unit 316 is an example of the publication date / time confirmation unit. The vulnerability investigation result storage unit 315 is an example of the vulnerability investigation result storage unit.

The vulnerability information data receiving unit 311 receives the vulnerability information data from the vulnerability information distribution system 210. The vulnerability information data storage unit 312 stores the vulnerability information data received by the vulnerability information data reception unit 311. The vulnerability information data distribution unit 313 reads the vulnerability information data from the vulnerability information data storage unit 312, and transmits the read vulnerability information data to the agent unit 320. The vulnerability investigation result receiving unit 314 receives the vulnerability investigation result from the agent unit 320. The vulnerability investigation result storage unit 315 stores the vulnerability investigation result received by the vulnerability investigation result receiving unit 314. The vulnerability disclosure date / time confirmation unit 316 periodically reads the vulnerability information data from the vulnerability information data storage unit 312, confirms the publication date / time, and extracts the vulnerability information data whose publication date / time has passed into the vulnerability information data decoding unit. It is decrypted by 317, and the decrypted vulnerability information data is written back to the vulnerability information data storage unit 312. When the vulnerability information data decryption unit 317 receives the vulnerability information data from the vulnerability disclosure date / time confirmation unit 316, the vulnerability information data decryption unit 317 decrypts the vulnerability information data using the common key. The common key storage unit 318 stores a common key used by the vulnerability information data decoding unit 317 to decrypt the vulnerability information data. The vulnerability information / investigation result display unit 319 reads the vulnerability information data whose publication date and time has passed from the vulnerability information data storage unit 312, and corresponds from the vulnerability investigation result storage unit 315 based on the read vulnerability information data. Read the vulnerability investigation result and present the vulnerability information and the vulnerability investigation result based on the read vulnerability investigation result. In the following, this presentation is to be displayed on the screen of the server 310.

(1-1-6) Configuration of Agent Unit 320 The agent unit 320 includes a vulnerability information data receiving unit 321, a vulnerability information data storage unit 322, a vulnerability investigation unit 323, a vulnerability information data decoding unit 324, and a common key storage. It includes a unit 325, a vulnerability investigation result storage unit 326, a vulnerability investigation result transmission unit 327, a vulnerability disclosure date / time confirmation unit 328, and a vulnerability information display unit 329. The vulnerability information data receiving unit 321 and the vulnerability investigation result transmitting unit 327 are examples of the components of the communication unit. The vulnerability information display unit 329 is an example of a presentation unit. The vulnerability information data storage unit 322 is an example of the vulnerability information storage unit. The vulnerability disclosure date / time confirmation unit 328 is an example of the publication date / time confirmation unit. The vulnerability investigation result storage unit 326 is an example of the vulnerability investigation result storage unit.

The vulnerability information data receiving unit 321 receives the vulnerability information data from the server 310. The vulnerability information data storage unit 322 stores the vulnerability information data received by the vulnerability information data reception unit 321. The vulnerability investigation unit 323 reads the vulnerability information data from the vulnerability information data storage unit 322, decodes the read vulnerability information data by the vulnerability information data decoding unit 324, and investigates included in the decrypted vulnerability information data. Based on the method, the presence or absence of vulnerabilities in the corresponding terminal 330 is investigated, and the vulnerability investigation results including the investigation results are stored in the vulnerability investigation result storage unit 326. When the vulnerability information data decoding unit 324 receives the vulnerability information data from the vulnerability investigation unit 323 and the vulnerability disclosure date / time confirmation unit 328, the vulnerability information data decryption unit decrypts the vulnerability information data using the common key. The common key storage unit 325 stores the common key used by the vulnerability information data decoding unit 324 to decrypt the vulnerability information data. The vulnerability investigation result storage unit 326 stores the vulnerability investigation result including the investigation result investigated by the vulnerability investigation unit 323. The vulnerability investigation result transmission unit 327 reads the vulnerability investigation result from the vulnerability investigation result storage unit 326 and transmits the read vulnerability investigation result to the server 310. The vulnerability disclosure date / time confirmation unit 328 periodically reads the vulnerability information data from the vulnerability information data storage unit 322, confirms the publication date / time, and extracts the vulnerability information data whose publication date / time has passed into the vulnerability information data decoding unit. It is decrypted by 324, and the decrypted vulnerability information data is written back to the vulnerability information data storage unit 322. The vulnerability information display unit 329 reads the vulnerability information data whose publication date and time has passed from the vulnerability information data storage unit 322, and based on the read vulnerability information data, the corresponding vulnerability investigation is performed from the vulnerability investigation result storage unit 326. Read the result and present the vulnerability information based on the read vulnerability investigation result. In the following, this presentation is to be displayed on the screen of the corresponding terminal 330.

The common key storage unit 214 of the vulnerability information distribution system 210, the common key storage unit 318 of the server 310, and the common key storage unit 325 of the agent unit 320 share a common key and store the shared common key. is doing.

(1-1-7) Hardware Configuration FIG. 3 shows a configuration example of the hardware configuration of the computer 400 that realizes the vulnerability information distribution system 210 according to the first embodiment. Below,

With reference to FIG. 3, the vulnerability information distribution system 210 according to the first embodiment can be realized by the computer 400. The computer 400 includes a processor 401, a memory 402, a storage 403, an input / output interface (input / output I / F) 404, a communication interface (communication I / F) 405, and the like. The processor 401, the memory 402, the storage 403, the input / output interface 404, and the communication interface 405 are connected by a data transmission line for transmitting and receiving data to and from each other.

The processor 401 is, for example, an arithmetic processing unit such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The memory 402 is, for example, a memory such as a RAM (Random Access Memory) or a ROM (Read Only Memory). The storage 403 is a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a memory card. Further, the storage 403 may be a memory such as a RAM or a ROM.

The storage 403 is a processing unit (vulnerability information receiving unit 211, vulnerability information data creating unit 212, vulnerability information data encryption unit 213, vulnerability information data transmitting unit 216, etc.) included in the vulnerability information distribution system 210. It remembers the program that realizes the function. The processor 401 realizes the function of each processing unit by executing each of these programs. Here, when executing each of the above programs, the processor 401 may read these programs onto the memory 402 and then execute the programs, or may execute the programs without reading them onto the memory 402. The memory 402 and the storage 403 also play the roles of the common key storage unit 214 and the vulnerability information data storage unit 215.

The input / output interface 404 is connected to a display device 4041, an input device 4042, and the like. The display device 4041 is a device such as an LCD (Liquid Crystal Display) or a CRT (Cathode Ray Tube) display that displays a screen corresponding to drawing data processed by the processor 401. The input device 4042 is a device that receives an operator's operation input, and is, for example, a keyboard, a mouse, a touch sensor, and the like. The display device 4041 and the input device 4042 may be integrated and realized as a touch panel.

The communication interface 405 transmits / receives data to / from an external device. For example, the communication interface 405 communicates with an external device via a wired network or a wireless network.

The server 310 and the terminal 330 can also be realized by the computer 400 shown in FIG.
For example, when the server 310 is realized by the computer 400, the storage 403 includes each processing unit (vulnerability information data receiving unit 311, vulnerability information data distribution unit 313, vulnerability investigation result receiving unit 314, vulnerability) included in the server 310. A program that realizes the functions of the publication date / time confirmation unit 316, the vulnerability information data decoding unit 317, the vulnerability information / investigation result display unit 319, etc.) is stored. The memory 402 and the storage 403 also play the roles of the vulnerability information data storage unit 312, the vulnerability investigation result storage unit 315, and the common key storage unit 318.

When the terminal 330 is realized by the computer 400, the storage 403 includes each processing unit (vulnerability information data receiving unit 321, vulnerability investigation unit 323, vulnerability information data decoding unit 324, vulnerability investigation) included in the agent unit 320. A program that realizes the functions of the result transmission unit 327, the vulnerability disclosure date / time confirmation unit 328, the vulnerability information display unit 329, etc.) is stored. The memory 402 and the storage 403 also serve as a vulnerability information data storage unit 322, a common key storage unit 325, and a vulnerability investigation result storage unit 326.

(1-2) Operation of the first embodiment The operation of the security system according to the first embodiment will be described in detail below.
(1-2-1) First, in the vulnerability information distribution system 210, the operation from receiving the vulnerability information from the vulnerability information transmission system 110, creating the vulnerability information data, and transmitting the vulnerability information data to the server 310 is shown in FIG. This will be described with reference to 4.

Referring to FIG. 4, in the vulnerability information distribution system 210, the vulnerability information receiving unit 211 receives the vulnerability information transmitted from the vulnerability information transmitting system 110 (S101). Vulnerability information includes information on the outline of the vulnerability, information on the investigation method, information on the countermeasure method, and information on the date and time of publication. The vulnerability information receiving unit 211 sends the received vulnerability information to the vulnerability information data creating unit 212. The vulnerability information data creation unit 212 creates the vulnerability information data according to the operation performed by the vulnerability information data creator based on the vulnerability information (S102).

As shown in FIG. 5, the vulnerability information data is in a format including a vulnerability information ID (Identifier), publication date / time information, publication flag, summary information, investigation method information, and countermeasure method information. Vulnerability information data corresponds to vulnerability information (outline of vulnerability, investigation method, countermeasure method, and date and time of publication) with a vulnerability information ID and a disclosure flag added. The vulnerability information data creation unit 212 assigns a number to the vulnerability information ID, and sets an ID that uniquely identifies the vulnerability information. For the publication date and time, set the publication date and time information included in the vulnerability information. In the publication flag, 0 indicating unpublished is set when the publication date and time is later than the current date and time, and 1 indicating published is set when the publication date and time is before the current date and time. Information on the outline, investigation method, and countermeasure method included in the vulnerability information is set in the outline, investigation method, and countermeasure method, respectively.

When the vulnerability information data creation unit 212 sets the disclosure flag of the vulnerability information data to 0 indicating undisclosed (Yes in S103), the vulnerability information data creation unit 212 sends the vulnerability information data to the vulnerability information data encryption unit 213. The vulnerability information data encryption unit 213 reads the common key from the common key storage unit 214, and uses the read common key to encrypt information on the outline of the vulnerability information data, the investigation method, and the countermeasure method (S104). ), Return the encrypted vulnerability information data to the vulnerability information data creation unit 212. The vulnerability information data creation unit 212 stores the vulnerability information data encrypted by the vulnerability information data encryption unit 213 in the vulnerability information data storage unit 215 (S105). On the other hand, when the vulnerability information data creation unit 212 sets the vulnerability information data to 1 indicating that it has been published (No in S103), the vulnerability information data storage unit does not encrypt the vulnerability information data. It is stored in 215 (S105). The vulnerability information data transmission unit 216 reads the vulnerability information data from the vulnerability information data storage unit 215 (S106), and transmits the read vulnerability information data to the server 310 (S107).

(1-2-2) Next, refer to FIG. 6 for the operation of the server 310 from receiving the vulnerability information data from the vulnerability information distribution system 210 to transmitting the vulnerability information data to the agent unit 320. I will explain.

Referring to FIG. 6, in the server 310, the vulnerability information data receiving unit 311 receives the vulnerability information data transmitted from the vulnerability information distribution system 210 (S201). The vulnerability information data receiving unit 311 stores the received vulnerability information data in the vulnerability information data storage unit 312 (S202). The vulnerability information data distribution unit 313 reads the vulnerability information data from the vulnerability information data storage unit 312 (S203), and transmits the read vulnerability information data to the agent unit 320 (S204).

When there are a plurality of agent units 320, the server 310 transmits vulnerability information data to each of the plurality of agent units 320.

(1-2-3) Next, the agent unit 320 receives the vulnerability data from the server 310, investigates the presence or absence of the corresponding terminal 330 for vulnerabilities, and obtains the vulnerability investigation result showing the investigation result on the server 310. The operation up to the transmission to the server will be described with reference to FIG. 7.

Referring to FIG. 7, in the agent unit 320, the vulnerability information data receiving unit 321 receives the vulnerability information data transmitted from the server 310 (S301). The vulnerability information data receiving unit 321 stores the received vulnerability information data in the vulnerability information data storage unit 322 (S302). The vulnerability investigation unit 323 reads the vulnerability information data from the vulnerability information data storage unit 322 (S303). If the public flag of the read vulnerability information data is set to 0 indicating undisclosed (Yes in S304), the vulnerability investigation unit 323 sends the vulnerability information data to the vulnerability information data decoding unit 324. The vulnerability information data decryption unit 324 reads the common key for decryption from the common key storage unit 325, and uses the read common key to decode the information of the investigation method of the vulnerability information data (S305) and decrypt it. Return the vulnerable information data to the Vulnerability Investigation Department 323. The vulnerability investigation unit 323 investigates the presence or absence of the vulnerability of the corresponding terminal 330 based on the information of the investigation method of the vulnerability information data decoded by the vulnerability information data decoding unit 324 (S306). On the other hand, when the vulnerability investigation unit 323 sets the disclosure flag of the read vulnerability information data to 1 indicating that it has been published (No in S304), the information on the investigation method of the read vulnerability information data is encrypted. Since it has not been encrypted, the presence or absence of vulnerabilities in the corresponding terminal 330 is investigated based on the information of the investigation method (S306). The vulnerability investigation unit 323 creates a vulnerability investigation result showing the investigation result of the presence or absence of the vulnerability of the corresponding terminal 330 (S307).

As shown in FIG. 8, the vulnerability investigation result is in a format including the vulnerability information ID, the terminal ID, the information on the date and time of the investigation, and the information on the investigation result. In the vulnerability information ID, an ID that uniquely identifies the vulnerability information of the investigated vulnerability, that is, the vulnerability information ID included in the vulnerability information data is set. In the terminal ID, an ID that identifies the terminal 330 that has been investigated is set. In the survey date and time, information on the date and time when the survey was conducted is set. In the investigation result, 0 is set when the terminal 330 is not vulnerable, and 1 is set when the terminal 330 is vulnerable.

The vulnerability investigation unit 323 stores the created vulnerability investigation result in the vulnerability investigation result storage unit 326 (S308). The vulnerability investigation result transmission unit 327 reads the vulnerability investigation result from the vulnerability investigation result storage unit 326 (S309), and transmits the read vulnerability investigation result to the server 310 (S310).

When there are a plurality of agent units 320, each of the plurality of agent units 320 performs the operation shown in FIG. 7 described above.

(1-2-4) Next, refer to FIG. 9 for the operation of the server 310 from receiving the vulnerability investigation result from the agent unit 320 to storing the vulnerability investigation result in the vulnerability investigation result storage unit 315. I will explain.

Referring to FIG. 9, in the server 310, the vulnerability investigation result receiving unit 314 receives the vulnerability investigation result transmitted from the agent unit 320 (S401). The vulnerability investigation result receiving unit 314 stores the received vulnerability investigation result in the vulnerability investigation result storage unit 315 (S402).

When there are a plurality of agent units 320, the server 310 stores the vulnerability investigation results received from each of the plurality of agent units 320 in the vulnerability investigation result storage unit 315.

(1-2-5) Next, on the server 310, the vulnerability information data of the vulnerability information data storage unit 312 is periodically checked, and the vulnerability information data whose publication date and time is before the current date and time is decoded. The operation of storing the decrypted vulnerability information data in the vulnerability information data storage unit 312 again will be described with reference to FIG. 10.

Referring to FIG. 10, in the server 310, the vulnerability disclosure date / time confirmation unit 316 periodically (for example, once every 10 minutes) contains vulnerability information data in which the disclosure flag is set to 0, which indicates undisclosed. It is confirmed whether or not it is stored in the vulnerability information data storage unit 312 (S501), and if such vulnerability information data is stored (Yes in S501), one of the vulnerability information data is stored. Read (S502). If the release date / time of the read vulnerability information data is before the current date / time (Yes in S503), the vulnerability disclosure date / time confirmation unit 316 sends the vulnerability information data to the vulnerability information data decoding unit 317. The vulnerability information data decryption unit 317 reads the common key for decryption from the common key storage unit 318, and uses the read common key to decrypt information on the outline of the vulnerability information data, the investigation method, and the countermeasure method. Then, the decrypted vulnerability information data is returned to the vulnerability disclosure date / time confirmation unit 316. The vulnerability disclosure date / time confirmation unit 316 sets the disclosure flag of the decrypted vulnerability information data to 1 indicating that it has been published (S505). The vulnerability disclosure date / time confirmation unit 316 decrypts and stores the vulnerability information data in which the disclosure flag is set to 1 again in the vulnerability information data storage unit 312 (S506). On the other hand, if the release date / time of the read vulnerability information data is later than the current date / time (No in S503), the vulnerability disclosure date / time confirmation unit 316 stores the read vulnerability information data in the vulnerability information data storage unit 312. It is stored again as it is in (S506). This completes the process for the vulnerability information data read in S502. The vulnerability disclosure date / time confirmation unit 316 processes S502 when the vulnerability information data whose disclosure flag is 0 indicating that it has not been disclosed is still stored in the vulnerability information data storage unit 312 (Yes in S507). Return to. On the other hand, the vulnerability disclosure date / time confirmation unit 316 indicates that the vulnerability information data whose disclosure flag is 0 indicating that it has not been disclosed is no longer stored in the vulnerability information data storage unit 312 (No. in S501 and S507). No), the process is terminated.

(1-2-6) Next, the operation of displaying the vulnerability information and the vulnerability investigation result on the server 310 will be described with reference to FIG.

Referring to FIG. 11, in the server 310, the vulnerability information / investigation result display unit 319 stores the vulnerability information data in which the disclosure flag is 1 indicating that it has been published in the vulnerability information data storage unit 312. Whether or not it is confirmed (S601), and if such vulnerability information data is stored (Yes in S601), one of the vulnerability information data is read out (S602). The vulnerability information / investigation result display unit 319 matches the vulnerability information ID of the read vulnerability information data, and the investigation result is 1 indicating that there is a vulnerability. The vulnerability investigation result is the vulnerability investigation result. If it is stored in the storage unit 315 (Yes in S603), all the vulnerability investigation results are read out (S604). The vulnerability information / investigation result display unit 319 displays an outline of the read vulnerability information data, a countermeasure method, and a list of terminal IDs of the read vulnerability investigation results on the screen of the server 310 (S605). On the other hand, the vulnerability information / investigation result display unit 319 matches the vulnerability information ID of the read vulnerability information data, and the investigation result is 1 indicating that there is a vulnerability. The vulnerability investigation result is a vulnerability. If it is not stored in the investigation result storage unit 315 (No in S603), it is not displayed on the screen of the server 310. This completes the process for the vulnerability information data read in S602. In the vulnerability information / investigation result display unit 319, if the vulnerability information data whose disclosure flag is 1 indicating that it has been published is still stored in the vulnerability information data storage unit 312 (Yes in S606), S602 Return to the process of. On the other hand, in the vulnerability information / investigation result display unit 319, when the vulnerability information data whose public flag is 1 indicating that it has been published is no longer stored in the vulnerability information data storage unit 312 (No of S601 and No. of S606), the process is terminated.

The timing of starting the operation of FIG. 11 may be a periodic timing or a timing in which an operation for instructing the display of the vulnerability information and the vulnerability investigation result is performed.

(1-2-7) Next, the agent unit 320 periodically checks the vulnerability information data of the vulnerability information data storage unit 322, and decodes the vulnerability information data whose publication date and time is before the current date and time. The operation of storing the decrypted vulnerability information data in the vulnerability information data storage unit 322 again will be described with reference to FIG.

Referring to FIG. 12, in the agent unit 320, the vulnerability disclosure date / time confirmation unit 328 periodically (for example, once every 10 minutes) has the vulnerability information data whose disclosure flag is 0 indicating that it has not been disclosed. Is stored in the vulnerability information data storage unit 322 (S701), and if such vulnerability information data is stored (Yes in S701), the vulnerability information data is 1 Read one (S702). If the release date / time of the read vulnerability information data is before the current date / time (Yes in S703), the vulnerability disclosure date / time confirmation unit 328 sends the vulnerability information data to the vulnerability information data decoding unit 324. The vulnerability information data decryption unit 324 reads the common key for decryption from the common key storage unit 325, and uses the read common key to decrypt information on the outline of the vulnerability information data, the investigation method, and the countermeasure method. Then, the decrypted vulnerability information data is returned to the vulnerability disclosure date / time confirmation unit 328. The vulnerability disclosure date / time confirmation unit 328 sets the disclosure flag of the decrypted vulnerability information data to 1 indicating that it has been published (S705). The vulnerability disclosure date / time confirmation unit 328 decrypts and stores the vulnerability information data in which the disclosure flag is set to 1 again in the vulnerability information data storage unit 322 (S706). On the other hand, if the release date / time of the read vulnerability information data is later than the current date / time (Yes in S703), the vulnerability disclosure date / time confirmation unit 328 stores the read vulnerability information data in the vulnerability information data storage unit 322. It is stored again as it is in (S706). This completes the process for the vulnerability information data read in S702. The vulnerability disclosure date / time confirmation unit 328 processes S702 when the vulnerability information data whose disclosure flag is 0 indicating that it has not been disclosed is still stored in the vulnerability information data storage unit 322 (Yes in S707). Return to. On the other hand, the vulnerability disclosure date / time confirmation unit 328 indicates that the vulnerability information data whose disclosure flag is 0 indicating that it has not been disclosed is no longer stored in the vulnerability information data storage unit 322 (No of S701 and S707). No), the process is terminated.

When there are a plurality of agent units 320, each of the plurality of agent units 320 performs the operation shown in FIG. 12 described above.

(1-2-8) Next, the operation of displaying the vulnerability information in the agent unit 320 will be described with reference to FIG.

Referring to FIG. 13, in the agent unit 320, the vulnerability information display unit 329 indicates whether or not the vulnerability information data whose public flag is 1 indicating that it has been published is stored in the vulnerability information data storage unit 322. If such vulnerability information data is stored (Yes in S801), one of the vulnerability information data is read out (S802). In the vulnerability information display unit 329, the vulnerability investigation result is the vulnerability investigation result storage unit 326, which matches the vulnerability information ID of the read vulnerability information data and the investigation result is 1. If it is stored in (Yes in S803), the vulnerability investigation result is read out (S804). The vulnerability information display unit 329 displays an outline of the read vulnerability information data and a countermeasure method on the screen of the corresponding terminal 330 (S805). On the other hand, the vulnerability information display unit 329 stores the vulnerability investigation result, which matches the vulnerability information ID of the read vulnerability information data and the investigation result is 1 indicating that there is a vulnerability. If it is not stored in the unit 326 (No of S803), it is not displayed on the screen of the corresponding terminal 330. This completes the process for the vulnerability information data read in S802. If the vulnerability information data whose public flag is 1 indicating that it has been published is still stored in the vulnerability information data storage unit 322 (Yes in S806), the vulnerability information display unit 329 performs processing in S802. return. On the other hand, in the vulnerability information display unit 329, when the vulnerability information data whose public flag is 1 indicating that it has been published is no longer stored in the vulnerability information data storage unit 322 (No of S801 and No of S806). ), End the process.

The timing of starting the operation of FIG. 13 may be a periodic timing or a timing in which an operation for instructing the display of vulnerability information is performed.
When there are a plurality of agent units 320, each of the plurality of agent units 320 performs the operation shown in FIG. 13 described above.

(1-3) Effect of the first embodiment As described above, according to the first embodiment, the server 310 transmits the encrypted vulnerability information to the agent unit 320 before the publication date and time. , The investigation for the presence or absence of the vulnerability of the terminal 330 is completed, and the vulnerability investigation result is displayed when the publication date and time has passed.
Therefore, the security administrator of the security risk management system user company 300 can grasp the investigation result of the presence or absence of the vulnerability of the terminal 330 of the company at the time when the vulnerability information is released, and immediately devises countermeasures for the vulnerability. You can move on to the next step. Therefore, the effect of shortening the time required to take countermeasures against vulnerabilities can be obtained.

According to the first embodiment, the vulnerability information is decrypted for the vulnerability investigation inside the security risk management system 305 before the release date and time of the vulnerability information. However, the decrypted vulnerability information is displayed after the publication date and time. Therefore, since the security manager and employees of the security risk management system user company 300 cannot see the vulnerability information before the publication date and time, the confidentiality of the vulnerability information is ensured.

(2) Embodiment 2
The second embodiment corresponds to one embodiment extracted from the superordinate concept of the first embodiment described above. FIG. 14 shows a block configuration example of the security risk management system 305 according to the second embodiment.

Referring to FIG. 14, the security risk management system 305 according to the second embodiment includes a server 310 and an agent unit 320 as in the first embodiment described above. The agent unit 320 corresponds to the terminal 330 (see FIG. 1) that manages the vulnerability, and is installed in the corresponding terminal 330. FIG. 14 shows an example in which only one agent unit 320 corresponding to one terminal 330 is provided, but if there are a plurality of terminals 330, a plurality of agent units 320 may be provided correspondingly.

The server 310 includes a communication unit 3101 and a presentation unit 3102. The communication unit 3101 corresponds to a component that combines the vulnerability information data distribution unit 313 and the vulnerability investigation result receiving unit 314 of the first embodiment described above. The presentation unit 3102 corresponds to the vulnerability information / investigation result display unit 319 of the first embodiment described above.

The agent unit 320 includes a communication unit 3201 and a research unit 3202. The communication unit 3201 corresponds to a component that combines the vulnerability information data receiving unit 321 and the vulnerability investigation result transmitting unit 327 of the first embodiment described above. The investigation unit 3202 corresponds to the vulnerability investigation unit 323 of the above-described first embodiment.

Hereinafter, the operation of the security risk management system 305 according to the second embodiment will be described with reference to FIG.
Referring to FIG. 15, in the server 310, the communication unit 3101 transmits the vulnerability information to the agent unit 320 before the release date and time of the vulnerability information (S901). When there are a plurality of agent units 320, the server 310 transmits vulnerability information to each of the plurality of agent units 320.

In the agent unit 320, the communication unit 3201 receives the vulnerability information transmitted from the server 310 before the release date and time of the vulnerability information (S902). The investigation unit 3202 investigates the presence or absence of a vulnerability in the corresponding terminal 330 based on the vulnerability investigation method included in the vulnerability information before the release date and time of the vulnerability information (S903). Further, the investigation unit 3202 transmits the vulnerability investigation result including the investigation result of the presence or absence of the vulnerability of the terminal 330 to the server 310 before the release date and time of the vulnerability information (S904). When there are a plurality of agent units 320, each of the plurality of agent units 320 performs the operations of S902 to S904 described above.

In the server 310, the communication unit 3101 receives the vulnerability investigation result transmitted from the agent unit 320 before the release date and time of the vulnerability information (S905). The presentation unit 3102 presents the vulnerability information and the vulnerability investigation result (for example, displayed on the screen of the server 310) after the release date and time of the vulnerability information (S906).

As described above, according to the second embodiment, the server 310 sends the vulnerability information to the agent unit 320 before the release date and time to complete the investigation of the presence or absence of the vulnerability of the terminal 330. , The vulnerability investigation result will be presented when the publication date and time has passed.
Therefore, the security administrator can grasp the investigation result of the presence or absence of the vulnerability of the terminal 330 at the time when the vulnerability information is released, and can immediately move to the next step of planning the countermeasures for the vulnerability. .. Therefore, the effect of shortening the time required to take countermeasures against vulnerabilities can be obtained.

In the above description, the operation of the components in the server 310 and the agent unit 320 according to the second embodiment has been briefly described, but the components in the server 310 and the agent unit 320 according to the second embodiment have been briefly described. May perform the same operation as the corresponding component of the first embodiment described above. Further, the server 310 and the agent unit 320 according to the second embodiment may further include other components included in the server 310 and the agent unit 320 according to the first embodiment described above.

Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above. Various changes that can be understood by those skilled in the art can be made to the structure and details of the present invention within the scope of the invention.

For example, in the above-described embodiment, the agent unit investigates the presence or absence of the terminal vulnerability, but the server may investigate the presence or absence of the terminal vulnerability. In this case, the agent unit collects only the information necessary for the investigation from the terminal and sends the collected information to the server. The server investigates the presence or absence of vulnerabilities in each terminal based on the information collected from each agent section.

Further, in the above-described first embodiment, in FIGS. 11 and 13, first, the vulnerability information data whose disclosure flag has already been published is read, and the vulnerability investigation result is obtained based on the read vulnerability information data. Reading, but not limited to this. For example, contrary to the above, first, the vulnerability investigation result in which the investigation result is vulnerable may be read, and the vulnerability information data may be read based on the read vulnerability investigation result.

Further, in the plurality of flowcharts used in the above description, a plurality of steps (processes) are described in order, but the execution order of the steps executed in the above-described embodiment is not limited to the order of description. .. In the above-described embodiment, the order of the illustrated steps can be changed within a range that does not hinder the contents.

In addition, some or all of the above-described embodiments may be described as in the following appendix, but are not limited to the following.
(Appendix 1)
With the server
Including the agent part provided in the terminal
The server
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit, and the vulnerability information is transmitted to the agent unit.
The agent unit
Before the release date and time of the vulnerability information, the presence or absence of the vulnerability of the terminal is investigated based on the information of the vulnerability investigation method included in the vulnerability information, and the vulnerability investigation result including the investigation result is obtained by the server. Send to
The server
The vulnerability information and the vulnerability investigation result will be presented after the release date and time of the vulnerability information.
Security risk management system.
(Appendix 2)
The server
Prior to the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information of the vulnerability investigation method included in the vulnerability information is encrypted.
The agent unit
Before the release date and time of the vulnerability information, the information of the vulnerability investigation method included in the vulnerability information is decoded, and the presence or absence of the vulnerability of the terminal is investigated based on the information of the decrypted vulnerability investigation method. ,
The security risk management system described in Appendix 1.
(Appendix 3)
The server
Prior to the release date and time of the vulnerability information, the vulnerability information is stored in an encrypted state in which the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
Prior to the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
The agent unit
Before the release date and time of the vulnerability information, the vulnerability information is stored in an encrypted state in which the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
The security risk management system described in Appendix 1 or 2.
(Appendix 4)
The vulnerability information includes
A public flag is added to indicate that the vulnerability information is unpublished or published.
The server
Of the stored vulnerability information, the vulnerability information to which the public flag to which a value indicating unpublished is set is added is read.
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. After setting a value indicating published in the public flag added to the vulnerability information, the read-out vulnerability information is stored again.
The security risk management system described in Appendix 3.
(Appendix 5)
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
The server
Store the results of the vulnerability investigation
Of the stored vulnerability information, the vulnerability information to which the public flag to which the value indicating published has been set is read is read.
Among the stored vulnerability investigation results, the vulnerability investigation result including the vulnerability information ID that matches the read-out vulnerability information and the investigation result indicating that the terminal is vulnerable. Read,
In addition to presenting the outline and countermeasures included in the read-out vulnerability information, the terminal ID included in the read-out vulnerability investigation result is presented.
The security risk management system described in Appendix 4.
(Appendix 6)
The vulnerability information includes
A public flag is added to indicate that the vulnerability information is unpublished or published.
The agent unit
Of the stored vulnerability information, the vulnerability information to which the public flag to which a value indicating unpublished is set is added is read.
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. After setting a value indicating published in the public flag added to the vulnerability information, the read-out vulnerability information is stored again.
The security risk management system described in Appendix 3.
(Appendix 7)
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
The agent unit
Store the results of the vulnerability investigation
Of the stored vulnerability information, the vulnerability information to which the public flag to which the value indicating published has been set is read is read.
The vulnerability investigation includes the vulnerability information ID that matches the read-out vulnerability information in the stored vulnerability investigation result, and includes the investigation result indicating that the terminal is vulnerable. If there is a result, the outline and countermeasures included in the read-out vulnerability information are presented.
The security risk management system described in Appendix 6.
(Appendix 8)
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit provided in the terminal, and the agent unit performs the agent based on the information of the vulnerability investigation method included in the vulnerability information. The communication unit that receives the vulnerability investigation results including the investigation results of the presence or absence of the vulnerability of the terminal investigated by the department, and
After the release date and time of the vulnerability information, the presentation unit that presents the vulnerability information and the vulnerability investigation result, and the presentation unit.
Server with.
(Appendix 9)
The communication unit
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information of the vulnerability investigation method included in the vulnerability information is encrypted.
The server according to Appendix 8.
(Appendix 10)
Vulnerability information storage unit that stores the vulnerability information in an encrypted state before the release date and time of the vulnerability information, with the information of the vulnerability outline, investigation method, and countermeasure method included in the vulnerability information encrypted. With more
The communication unit
Prior to the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
The server according to Appendix 8 or 9.
(Appendix 11)
It also has a release date and time confirmation section.
A public flag is added to indicate that the vulnerability information is unpublished or published.
The release date and time confirmation section
Of the vulnerability information stored in the vulnerability information storage unit, the vulnerability information to which the public flag set with a value indicating undisclosed is added is read.
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. After setting a value indicating published in the public flag added to the vulnerability information, the read-out vulnerability information is stored again in the vulnerability information storage unit.
The server according to Appendix 10.
(Appendix 12)
It also has a vulnerability investigation result storage unit that stores the vulnerability investigation results.
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
The presentation unit
Of the vulnerability information stored in the vulnerability information storage unit, the vulnerability information to which the public flag to which the value indicating published has been set is added is read.
Among the vulnerability investigation results stored in the vulnerability investigation result storage unit, an investigation indicating that the terminal includes the vulnerability information ID that matches the read-out vulnerability information and that the terminal is vulnerable. Read the vulnerability investigation result including the result,
In addition to presenting the outline and countermeasures included in the read-out vulnerability information, the terminal ID included in the read-out vulnerability investigation result is presented.
The server according to Appendix 11.
(Appendix 13)
It ’s a server control method.
A transmission step of transmitting the vulnerability information to the agent unit provided in the terminal before the release date and time of the vulnerability information, and
A step of receiving a vulnerability investigation result including an investigation result of the presence or absence of a vulnerability of the terminal investigated by the agent unit based on the information of the vulnerability investigation method included in the vulnerability information from the agent unit. ,
After the release date and time of the vulnerability information, the presentation step of presenting the vulnerability information and the vulnerability investigation result, and
Control methods including.
(Appendix 14)
In the transmission step,
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information of the vulnerability investigation method included in the vulnerability information is encrypted.
The control method according to Appendix 13.
(Appendix 15)
Before the release date and time of the vulnerability information, the vulnerability information is stored in the vulnerability information storage unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted. Including additional steps to
In the transmission step,
Prior to the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
The control method according to Appendix 13 or 14.
(Appendix 16)
The vulnerability information includes
A public flag is added to indicate that the vulnerability information is unpublished or published.
The control method is
Among the vulnerability information stored in the vulnerability information storage unit, a step of reading out the vulnerability information to which the public flag set with a value indicating undisclosed is added, and
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. Further including a step of setting a value indicating published in the public flag added to the vulnerability information and then storing the read-read vulnerability information in the vulnerability information storage unit again.
The control method according to Appendix 15.
(Appendix 17)
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
The control method is
The step of storing the vulnerability investigation result in the vulnerability investigation result storage unit, and
Among the vulnerability information stored in the vulnerability information storage unit, a step of reading out the vulnerability information to which the public flag set with a value indicating published has been added, and
Among the vulnerability investigation results stored in the vulnerability investigation result storage unit, an investigation indicating that the terminal includes the vulnerability information ID that matches the read-out vulnerability information and that the terminal is vulnerable. Further including a step of reading the vulnerability investigation result including the result.
In the presentation step,
In addition to presenting the outline and countermeasures included in the read-out vulnerability information, the terminal ID included in the read-out vulnerability investigation result is presented.
The control method according to Appendix 16.
(Appendix 18)
On the computer
A transmission procedure for transmitting the vulnerability information to the agent unit provided in the terminal before the release date and time of the vulnerability information, and
Prior to the release date and time of the vulnerability information, the agent unit investigates the presence or absence of the vulnerability of the terminal investigated by the agent unit based on the information of the vulnerability investigation method included in the vulnerability information. Procedures for receiving vulnerability survey results, including
After the release date and time of the vulnerability information, the presentation procedure for presenting the vulnerability information and the vulnerability investigation result, and the presentation procedure.
A program to execute.
(Appendix 19)
In the transmission procedure,
Before the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information of the vulnerability investigation method included in the vulnerability information is encrypted.
The program described in Appendix 18.
(Appendix 20)
On the computer
With the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information encrypted, the procedure for storing the vulnerability information in the vulnerability information storage unit is further executed.
In the transmission procedure,
Prior to the release date and time of the vulnerability information, the vulnerability information is transmitted to the agent unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
The program according to Appendix 18 or 19.
(Appendix 21)
The vulnerability information includes
A public flag is added to indicate that the vulnerability information is unpublished or published.
On the computer
Of the vulnerability information stored in the vulnerability information storage unit, a procedure for reading out the vulnerability information to which the public flag set with a value indicating undisclosed is added, and
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. After setting a value indicating published in the public flag added to the vulnerability information, the procedure of storing the read vulnerability information in the vulnerability information storage unit again is further executed.
The program described in Appendix 20.
(Appendix 22)
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
On the computer
The procedure for storing the vulnerability investigation result in the vulnerability investigation result storage unit and
Of the vulnerability information stored in the vulnerability information storage unit, a procedure for reading out the vulnerability information to which the public flag set with a value indicating published has been added, and
Among the vulnerability investigation results stored in the vulnerability investigation result storage unit, an investigation indicating that the terminal includes the vulnerability information ID that matches the read-out vulnerability information and that the terminal is vulnerable. Further execute the procedure for reading out the vulnerability investigation result including the result,
In the presentation procedure,
In addition to presenting the outline and countermeasures included in the read-out vulnerability information, the terminal ID included in the read-out vulnerability investigation result is presented.
The program described in Appendix 21.
(Appendix 23)
On the computer
The receiving procedure for receiving the vulnerability information from the server before the release date and time of the vulnerability information,
Prior to the release date and time of the vulnerability information, an investigation procedure for investigating the presence or absence of a terminal vulnerability based on the information on the vulnerability investigation method included in the vulnerability information, and
Before the release date and time of the vulnerability information, a procedure for transmitting the vulnerability investigation result including the investigation result of the investigation procedure to the server and a procedure for sending the vulnerability investigation result to the server.
A program to execute.
(Appendix 24)
In the reception procedure,
Prior to the release date and time of the vulnerability information, the vulnerability information is received from the server in a state where the information of the vulnerability investigation method included in the vulnerability information is encrypted.
In the investigation procedure,
Before the release date and time of the vulnerability information, the information of the vulnerability investigation method included in the vulnerability information is decoded, and the presence or absence of the vulnerability of the terminal is investigated based on the information of the decrypted vulnerability investigation method. ,
The program described in Appendix 23.
(Appendix 25)
In the reception procedure,
Prior to the release date and time of the vulnerability information, the vulnerability information is received from the server in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted.
On the computer
Before the release date and time of the vulnerability information, the vulnerability information is stored in the vulnerability information storage unit in a state where the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the vulnerability information is encrypted. To perform further steps to
The program according to Appendix 23 or 24.
(Appendix 26)
The vulnerability information includes
A public flag is added to indicate that the vulnerability information is unpublished or published.
On the computer
Of the vulnerability information stored in the vulnerability information storage unit, a procedure for reading out the vulnerability information to which the public flag set with a value indicating undisclosed is added, and
When the publication date and time included in the read-out vulnerability information is before the current date and time, the information on the outline of the vulnerability, the investigation method, and the countermeasure method included in the read-out vulnerability information is decoded, and the read-out information is obtained. After setting a value indicating published in the public flag added to the vulnerability information, the procedure of storing the read vulnerability information in the vulnerability information storage unit again is further executed.
The program described in Appendix 25.
(Appendix 27)
The vulnerability information includes
A vulnerability information ID that identifies the vulnerability information is further added,
According to the results of the vulnerability investigation,
It includes a vulnerability information ID that identifies the vulnerability information of the investigated vulnerability, a terminal ID that identifies the terminal, and a survey result indicating the presence or absence of the vulnerability of the terminal.
On the computer
The procedure for storing the vulnerability investigation result in the vulnerability investigation result storage unit and
Of the vulnerability information stored in the vulnerability information storage unit, a procedure for reading out the vulnerability information to which the public flag set with a value indicating published has been added, and
It is shown that the vulnerability information ID that matches the read-out vulnerability information is included in the vulnerability investigation result stored in the vulnerability investigation result storage unit, and that the terminal is vulnerable. If there is the vulnerability investigation result including the investigation result, the procedure for presenting the outline and the countermeasure method included in the read out vulnerability information and the procedure for presenting the countermeasure method are further executed.
The program described in Appendix 26.

100 Vulnerability information provider 110 Vulnerability information transmission system 200 Security risk management system provider 210 Vulnerability information distribution system 211 Vulnerability information receiver 212 Vulnerability information data creation unit 213 Vulnerability information data encryption unit 214 Common key storage Department 215 Vulnerability information data storage unit 216 Vulnerability information data transmission unit 300 Security risk management system user company 305 Security risk management system 310 Server 311 Vulnerability information data reception unit 312 Vulnerability information data storage unit 313 Vulnerability information data distribution unit 314 Vulnerability investigation result receiving unit 315 Vulnerability investigation result storage unit 316 Vulnerability disclosure date and time confirmation unit 317 Vulnerability information data decoding unit 318 Common key storage unit 319 Vulnerability information / investigation result display unit 3101 Communication unit 3102 Presentation unit 320 Agent Department 321 Vulnerability information data reception unit 322 Vulnerability information data storage unit 323 Vulnerability investigation unit 324 Vulnerability information data decryption unit 325 Common key storage unit 326 Vulnerability investigation result storage unit 327 Vulnerability investigation result transmission unit 328 Vulnerability disclosure Date and time confirmation unit 329 Vulnerability information display unit 3201 Communication unit 3202 Investigation unit 330 Terminal 400 Computer 401 Processor 402 Memory 403 Storage 404 Input / output interface 4041 Display device 4042 Input device 405 Communication interface

Claims (22)

It ’s a terminal control method.
The terminal receives the vulnerability information regarding the vulnerability existing in the software, which is received from the vulnerability information distribution system to the server, including the release date / time information and the investigation method information. The first step to do and
The second step in which the terminal investigates the presence or absence of a vulnerability related to the vulnerability information on the own terminal based on the investigation method information included in the vulnerability information and creates an investigation result.
Including
In the first step, the reception is performed before the publication date and time indicated by the publication date and time information.
Control method. In the second step, the survey is conducted before the publication date and time indicated by the publication date and time information.
The control method according to claim 1. The terminal further includes a third step of transmitting the survey result to the server.
The control method according to claim 1 or 2. The vulnerability information is encrypted and
In the second step, when the investigation is performed, the vulnerability information is decrypted and then the investigation is performed.
The control method according to any one of claims 1 to 3. It ’s a server control method.
The first step in which the server receives the vulnerability information regarding the vulnerability existing in the software, including the release date and time information, from the vulnerability information distribution system.
The second step in which the server transmits the vulnerability information to the terminal,
The third step in which the server receives the investigation result of the terminal related to the vulnerability information from the terminal, and the third step.
A fourth step in which the server displays the vulnerability information and the investigation result after the publication date and time indicated by the publication date and time information included in the vulnerability information related to the investigation result.
Control methods, including. A control method for a security risk management system that includes a server and a terminal.
The first step of receiving the vulnerability information from the vulnerability information distribution system, which is the vulnerability information regarding the vulnerability existing in the software and includes the publication date / time information and the investigation method information,
The second step in which the terminal receives the vulnerability information from the server,
The third step in which the terminal investigates the presence or absence of a vulnerability related to the vulnerability information on the own terminal based on the investigation method information included in the vulnerability information and creates an investigation result.
Including
In the second step, the reception is performed before the publication date and time indicated by the publication date and time information.
Control method. In the third step, the survey is conducted before the publication date and time indicated by the publication date and time information.
The control method according to claim 6. The terminal further includes a fourth step of transmitting the survey result to the server.
The control method according to claim 6 or 7. The server further includes a fifth step of displaying the vulnerability information and the investigation result after the publication date and time indicated by the publication date and time information included in the vulnerability information related to the investigation result.
The control method according to claim 8. The vulnerability information is encrypted and
In the third step, when the investigation is performed, the vulnerability information is decrypted and then the investigation is performed.
The control method according to any one of claims 6 to 9. The first means of receiving the vulnerability information regarding the vulnerability existing in the software, which is received from the vulnerability information distribution system to the server and includes the publication date / time information and the investigation method information, from the server. When,
Based on the investigation method information included in the vulnerability information, a second means of investigating the presence or absence of vulnerabilities related to the vulnerability information on the own terminal and creating an investigation result, and
With
The first means receives the reception before the publication date and time indicated by the publication date and time information.
Terminal. The second means conducts the survey before the publication date and time indicated by the publication date and time information.
The terminal according to claim 11. A third means for transmitting the investigation result to the server is further provided.
The terminal according to claim 11 or 12. The vulnerability information is encrypted and
The second means performs the investigation after decoding the vulnerability information when conducting the investigation.
The terminal according to any one of claims 11 to 13. Vulnerability information related to vulnerabilities existing in software, the first means of receiving the vulnerability information including the release date and time information from the vulnerability information distribution system, and
The second means of transmitting the vulnerability information to the terminal and
A third means for receiving the investigation result of the terminal related to the vulnerability information from the terminal, and
A fourth means for displaying the vulnerability information and the investigation result after the publication date and time indicated by the publication date and time information included in the vulnerability information related to the investigation result.
A server. With the server
With the terminal
With
The server receives the vulnerability information regarding the vulnerability existing in the software, including the release date / time information and the investigation method information, from the vulnerability information distribution system.
The terminal receives the vulnerability information from the server and receives the vulnerability information.
Based on the investigation method information included in the vulnerability information, the terminal investigates the presence or absence of vulnerabilities related to the vulnerability information on its own terminal and creates an investigation result.
The terminal performs the reception before the publication date and time indicated by the publication date and time information.
Security risk management system. The terminal conducts the survey before the publication date and time indicated by the publication date and time information.
The security risk management system according to claim 16. The terminal transmits the investigation result to the server.
The security risk management system according to claim 16 or 17. The server displays the vulnerability information and the investigation result after the publication date and time indicated by the publication date and time information included in the vulnerability information related to the investigation result.
The security risk management system according to claim 18. The vulnerability information is encrypted and
When the terminal conducts the investigation, the terminal decodes the vulnerability information and then conducts the investigation.
The security risk management system according to any one of claims 16 to 19. On the computer
The first step of receiving the vulnerability information regarding the vulnerability existing in the software, which is received from the vulnerability information distribution system to the server and includes the publication date / time information and the investigation method information, from the server. When,
Based on the investigation method information included in the vulnerability information, the second procedure of investigating the presence or absence of vulnerabilities related to the vulnerability information on the own terminal and creating the investigation result, and
To run,
In the first procedure, the reception is performed before the publication date and time indicated by the publication date and time information.
program. On the computer
The first step of receiving the vulnerability information regarding the vulnerability existing in the software, including the release date and time information, from the vulnerability information distribution system, and
The second step of sending the vulnerability information to the terminal and
The third step of receiving the investigation result of the terminal related to the vulnerability information from the terminal, and
A fourth procedure for displaying the vulnerability information and the investigation result after the publication date and time indicated by the publication date and time information included in the vulnerability information related to the investigation result.
A program that runs.

Images