JP7287068B2 - Information processing program, information processing method, and information processing apparatus - Google Patents

Description

The present invention relates to an information processing program, an information processing method, and an information processing apparatus.

As a billing system for cloud services such as Infrastructure as a Service (IaaS), for example, a pay-as-you-go billing system is used. When using a pay-as-you-go cloud service, the user can reduce costs by stopping the use of the service during times when the service is not in use (for example, at night or on holidays). Therefore, during periods such as nights and holidays, the number of users is small, so resources become available.

As a related technology, a technology has been proposed that uses information about data center migration to determine legal or contractual risks in data center migration (see Patent Document 1, for example).

WO2014/041761

When using a pay-as-you-go billing system, cloud service providers can encourage use during times when there are few users by setting service usage fees during times when there are few users, such as nights and holidays, to be lower than other times. It is conceivable to promote In that case, for example, when using the cloud service during the daytime, it is possible to use the resource at a low nighttime rate by deploying the resource in another country with a time difference. However, if the data you use contains sensitive data, storing that sensitive data on resources deployed in other countries poses a security risk.

One aspect of the present invention is to improve security when using cloud services.

In one aspect, the information processing program acquires a resource deployment request for a cloud service with different charges depending on the time zone, along with the specification of the usage time zone of the resource, and is attached to the data used for the resource. determining whether or not the data includes confidential data by referring to an identifier indicating confidentiality and determining whether or not the referenced identifier includes an identifier indicating that the data is confidential data; if so, selecting a predetermined region as the region in which the resource is deployed; and if the data does not include confidential data, the region in which the resource is deployed based on usage charges for the time period of use of the resource in a plurality of regions to cause the computer to execute the process of deploying the resource in the selected area.

According to one aspect, it is possible to improve security when using cloud services.

It is a figure which shows an example of the functional structure of an information processing apparatus. FIG. 4 is a diagram showing an example of information on data used for each resource; A first example of setting information for a predetermined region in which confidential data can be stored is shown. FIG. 4 is a diagram showing a first example of price information for each resource in each region; FIG. 10 is a diagram showing a first example of extracting price information of resources corresponding to designated resource types; FIG. 11 shows a second example of setting information for a predetermined area in which confidential data can be stored; FIG. FIG. 10 is a diagram showing a second example of price information for each resource in each region; FIG. 10 is a diagram showing a second example of extracted price information of resources corresponding to the specified resource type; 4 is a flowchart illustrating an example of processing according to the embodiment; It is a figure which shows an example of the hardware constitutions of an information processing apparatus.

In order to promote the use of cloud services during times when there are few users, such as nights and holidays, it is conceivable, for example, to determine prices through a bidding system and vary prices according to the relationship between supply and demand. However, if the bid price is lower than the bid price of other bidders, the cloud service cannot be used. Also, it is difficult to predict in advance the bid prices of other bidders. In other words, cloud services cannot always be used, so they are not suitable for use in batch operations. In addition, the operation cost and the like for responding to bidding will increase.

For this reason, when using a pay-as-you-go system, cloud service providers set service usage fees during times when there are few users, such as nights and holidays, to be lower than other times. It is conceivable to promote their use. For example, when using a cloud service during the daytime, by deploying resources in another country with a time difference, it is possible to use the resources at low nighttime rates. But if the data you use contains sensitive data, storing that data on resources deployed in other countries poses a security risk.

Embodiments will be described below with reference to the drawings. FIG. 1 is a diagram showing an example of a functional configuration of an information processing device 1. As shown in FIG. The information processing device 1 is an example of a computer, such as a server or a personal computer. The information processing device 1 includes a setting unit 11 , an acquisition unit 12 , a calculation unit 13 , a selection unit 14 , a deployment unit 15 and a storage unit 16 . The information processing device 1 may be held by a user who uses the cloud service, or may exist on a data center used for the cloud service. The cloud service in this embodiment is, for example, IaaS, and the charge varies depending on the time zone in the region where it is used.

The setting unit 11 stores in the storage unit 16 an identifier indicating the confidentiality of the data used for the resource to be deployed, in association with the identifier of the data. It is assumed that resource identifiers and data identifiers are associated in advance and stored in the storage unit 16 . In addition, the setting unit 11 sets a predetermined area where confidential data can be stored according to an instruction from the user, and causes the storage unit 16 to store the area. The predetermined region is, for example, a region within the country where the user is located, or a region within a neighboring country whose laws are similar to those of the country where the user is located. Hereinafter, the predetermined area where confidential data can be stored may be simply referred to as the predetermined area. In addition, the setting unit 11 sets resource price information for each region for each type of resource according to an instruction from a cloud service provider, and causes the storage unit 16 to store the price information.

The acquisition unit 12 acquires from the user a resource deployment request for a cloud service, along with a specification of a resource usage time zone, a specification of a resource identifier to be used, and a specification of the type of resource. The acquisition unit 12 does not have to acquire designation of resource types.

The calculation unit 13 calculates the total amount of data corresponding to the resource identifiers acquired by the acquisition unit 12 . The capacity of each data is associated with the identifier of the data and stored in the storage unit 16, and the calculation unit 13 refers to the capacity of the data and calculates the total capacity of the data.

When the data used for the specified resource contains confidential data, the selection unit 14 selects a predetermined area where the confidential data can be stored as the resource deployment area. For example, the selection unit 14 refers to an identifier indicating confidentiality assigned to each data used in the designated resource, and if the referenced identifier includes an identifier indicating that the data is confidential data, the selection unit 14 selects a predetermined region to select.

In addition, when the data used for the designated resource includes confidential data and a plurality of predetermined regions are set, the selection unit 14 determines whether the resource is used in a plurality of predetermined regions during the designated time period. Choose the region where you want to deploy your resources, based on the price of In this case, the selection unit 14 uses the resources in a plurality of predetermined regions based on, for example, the usage time zone of the designated resource, the type of the designated resource, and the total data volume calculated by the calculation unit 13. Calculate the fee if Then, the selection unit 14 selects a predetermined area with the lowest charge as a resource deployment destination.

In addition, if the data used for the designated resource does not contain confidential data, the selection unit 14 selects the designated use time zone in a plurality of regions (for example, all regions where usable data centers are installed). Choose the region where you want to deploy your resources, based on the price of For example, the selection unit 14 refers to an identifier indicating confidentiality given to each data used for a designated resource, and determines whether the referenced identifier includes an identifier indicating confidential data. If the referenced identifier does not include an identifier indicating confidential data, the selection unit 14 selects an area in which resources are to be deployed based on charges for designated usage time periods in a plurality of areas. In this case, the selection unit 14 calculates the charge for each region based on the usage time zone of the specified resource, the type of the specified resource, and the total amount of data calculated by the calculation unit 13, and the charge is the highest. Choose a cheap region as the region to deploy resources.

Note that if the acquisition unit 12 does not acquire the specification of the resource type together with the resource allocation request, the selection unit 14 determines that the fee for using the resource during the specified resource usage time period is 100% regardless of the resource type. Choose the cheapest region as the region to deploy resources.

The deployment unit 15 deploys resources in the area selected by the selection unit 14 . For example, when a virtual machine and a storage are specified as resource types, the allocation unit 15 builds a virtual machine in the data center and secures a storage area.

The storage unit 16 stores information on data used for each resource, setting information on predetermined areas where confidential data can be stored, and price information for each resource in each area. Each piece of information stored in the storage unit 16 will be described later in detail.

FIG. 2 is a diagram showing an example of information about data used for each resource. The information shown in FIG. 2 is set by the setting unit 11 according to instructions from the user. As shown in FIG. 2, the information about data is associated with the identifier of the resource to be deployed, the path of the data used by the resource, the confidentiality flag indicating the confidentiality of the data, and the data capacity. A data path is an example of a data identifier. A confidentiality flag is an example of an identifier indicating confidentiality of data. For example, if the confidential flag is "TRUE", the data is confidential data, and if the confidential flag is "FALSE", it indicates that the data is not confidential data.

For example, the selection unit 14 refers to the information shown in FIG. 2, and if data associated with the identifier of the specified resource has a confidential flag of "TRUE", the data is used for the specified resource. determine that the data received contains sensitive data. For example, the selection unit 14 refers to the information shown in FIG. Determine that the data used does not contain confidential data.

The calculation unit 13 calculates the total amount of data corresponding to the resource identifiers acquired by the acquisition unit 12 by referring to the information shown in FIG. Further, the selection unit 14 determines whether the data is confidential data by referring to the confidentiality flag of the information shown in FIG.

FIG. 3 shows a first example of setting information for a predetermined region in which confidential data can be stored. The information shown in FIG. 3 is set by the setting unit 11 according to instructions from the user. The user sets, for example, the region where the data center is located in his/her own country as the predetermined region. In the example shown in FIG. 3, "Eastern Japan" is set as a predetermined area where confidential data can be stored.

FIG. 4 is a diagram showing a first example of price information for each resource in each region. The information shown in FIG. 4 is set by the setting unit 11, for example, according to an instruction from a cloud service provider. As shown in FIG. 4, the price information is set in association with regions, resource types, time periods, and unit prices. A region is a region in which a data center used for cloud services exists. The resource types include type 1 and type 2. For type 1, for example, Virtual Machine (VM) or storage is set. When the type 1 is VM, the type 2 is set to the type of VM (for example, S1 or S2). For example, the Central Processing Unit (CPU) performance, memory capacity, etc. differ for each type of VM. When the type 1 is storage, the type 2 is set to the type of storage (for example, Hard Disk Drive (HDD) or Solid State Drive (SSD)).

The time zone is, for example, the standard time in any region where the cloud service is available, and in the example shown in FIG. 4, Japan Standard Time (JST) is used. The unit price includes a VM unit price (yen/hour) and a storage unit price (yen/(GB×hour)).

FIG. 5 is a diagram showing a first example of extracting price information of resources corresponding to the specified resource type. The information shown in FIG. 5 is information extracted by the selection unit 14 when the data used for the resource does not contain confidential data. If the acquisition unit 12 acquires the specification of the resource type together with the resource allocation request, and the data does not include confidential data, the selection unit 14 acquires the resource during the specified time period in a plurality of regions with respect to the specified resource type. Calculate the fee for use. Then, the selection unit 14 selects an area in which resources are deployed based on the calculated fee. In this case, the selection unit 14 does not refer to the setting information of the predetermined area shown in FIG. 3, but refers to the price information shown in FIG.

For example, "9:00 to 12:00" (JST) is specified as the resource usage time zone, "VM, S1" and "storage, HDD" are specified as the types of resources to be used, and the identifier of the resource to be used is Assume that "abcdef" is specified as the In that case, the selection unit 14 extracts the price information corresponding to the designated resource type from the price information shown in FIG. 4, and obtains the information shown in FIG.

The calculation unit 13 calculates the total amount of data used for the resource "abcdef" based on the information shown in FIG. Assume that this calculation result is 100 GB. The selection unit 14 calculates the fee for using the resource in the specified time slot for each region, as shown in the following formula (1).
(Usage fee for each region [yen]) = (VM unit price [yen]) x (Usage time [H]) + (Storage unit price [yen]) x (Data capacity [GB]) x (Usage time [H]) (1)

The selection unit 14 refers to the information shown in FIG. 5 and calculates charges for using resources in eastern Japan, western United States, and United Kingdom based on the calculation formula (1). The usage fee for each area is calculated according to the following formulas (2) to (4). As for the United Kingdom, since the usage time spans two time zones (0:00 to 11:00 and 11:00 to 0:00), the selection unit 14 adds up the charges for each time zone. . Also, as described above, the amount of data used is 100 GB. Also, since the usage time zone is "9:00 to 12:00", the usage time is 3 [H].
East Japan usage fee = 400 [yen] x 3 [H] + 5 [yen] x 100 [GB] x 3 [H] = 2700 [yen] (2)
Western US usage fee = 250 [yen] x 3 [hours] + 1 [yen] x 100 [GB] x 3 [hours] = 1050 [yen] (3)
UK usage fee = (400 [yen] x 2 [H] + 200 [yen] x 1 [H]) + (3 [yen] x 100 [GB] x 2 [H] + 2 [yen] x 100 [GB] × 1 [H]) = 1000 [yen] + 800 [yen] = 1800 [yen] (4)

As shown in equations (2) to (4), the selection unit 14 selects the western US as the resource deployment destination because the western US has the lowest usage fee. In this example, the designated time period is morning in Japan but nighttime in the western United States, so the user can use the cloud service at a low nighttime rate.

As described above, the information processing apparatus 1 calculates the charge for using the designated resource type during the resource usage time period, and selects the region where the resource is to be deployed based on the calculated charge. Therefore, the information processing device 1 can deploy resources of the designated resource type at a low cost.

Note that if the type of resource is not specified, the selection unit 14 selects the region where the resource is deployed as the region with the lowest charge when using the specified resource during the usage time period, regardless of the type of resource. Select as In this case, for example, the selection unit 14 selects the resource deployment regions and the types of VMs and storages so that the total fee for the VMs and storages during the specified resource usage time zone is the lowest in a plurality of regions. Select automatically.

FIG. 6 shows a second example of setting information for a predetermined region in which confidential data can be stored. The information shown in FIG. 6 is set by the setting unit 11 according to instructions from the user, as in the example shown in FIG. The user sets, for example, the region where the data center is located in his/her own country as the predetermined region. In the example shown in FIG. 6, "East Japan" and "West Japan" are set as predetermined areas where confidential data can be stored.

FIG. 7 is a diagram showing a second example of price information for each resource in each region. The information shown in FIG. 7 is set by the setting unit 11 in accordance with, for example, an instruction from the cloud service provider, similarly to the example shown in FIG. The example shown in FIG. 7 differs from the example shown in FIG. 4 in that the area includes "West Japan".

FIG. 8 is a diagram showing a second example of extracted resource price information corresponding to the specified resource type. As shown in the example of FIG. 6, it is assumed that a plurality of predetermined areas where confidential data can be stored are set. Then, when the acquisition unit 12 acquires the specification of the resource type together with the resource allocation request, and if the data includes confidential data, the selection unit 14 selects the specified resource type in a plurality of predetermined regions at the specified time. Calculate the fee when resources are used for the band. Also, the selection unit 14 selects an area in which resources are deployed based on the calculated fee.

As shown in the example of FIG. 6, "Eastern Japan" and "West Japan" are set as the predetermined areas. Extract the price information of the resource corresponding to the resource type.

For example, assume that "9:00 to 12:00" is specified as the resource usage time zone, and "VM: S1" and "storage: HDD" are specified as the type of resource to be used. Also, assume that "abcdef" is specified as a resource identifier. The selection unit 14 extracts information corresponding to the designated resource type from the price information shown in FIG. 7, and obtains the information shown in FIG.

Assume that the calculation unit 13 has calculated the total amount of data used for the resource "abcdef" to be 100 GB. As in the case where the data used for the resource does not contain confidential data, the selector 14 calculates the usage fees for East Japan and West Japan based on the above equation (1). The usage fee for each area is calculated as in the following formulas (5) and (6).
East Japan usage fee = 400 x 3 + 5 x 100 x 3 = 2700 (5)
Western Japan usage fee = 350 x 3 + 5 x 100 x 3 = 2550 (6)

As shown in formulas (5) and (6), the selection unit 14 selects western Japan as the resource deployment destination because the usage fee is the lowest in western Japan.

As described above, when a plurality of predetermined areas where confidential data can be stored are set, the information processing apparatus 1 selects the area with the lowest charge among the plurality of predetermined areas as a resource deployment destination. . Therefore, the information processing apparatus 1 can deploy the resource of the specified resource type at a low fee even if the data used includes confidential data.

FIG. 9 is a flowchart illustrating an example of processing according to the embodiment. The setting unit 11 sets a predetermined region in which confidential data can be stored according to an instruction from the user, and stores it in the storage unit 16 (step S101). The setting unit 11 associates the identifier indicating the confidentiality of the data used for the resource to be deployed with the identifier of the data and stores it in the storage unit 16 (step S102).

The acquiring unit 12 acquires from the user a resource allocation request for the cloud service, along with the designation of the resource use time zone, the designation of the resource identifier to be used, and the designation of the resource type (step S103). The calculation unit 13 calculates the total amount of data corresponding to the resource identifiers acquired by the acquisition unit 12 (step S104). The selection unit 14 refers to the identifier indicating confidentiality given to each data used for the designated resource, and determines whether the data used includes confidential data (step S105).

If the data used for the designated resource includes confidential data (YES in step S105), the selection unit 14 selects a predetermined area where confidential data can be stored as the resource deployment area (step S106). ). In addition, when the data used for the designated resource includes confidential data and a plurality of predetermined areas are set, the selection unit 14 selects the charge for the designated resource use time zone among the plurality of predetermined areas. choose the region where the

If the data used for the designated resource does not contain confidential data, the selection unit 14 selects the region where the resource is deployed based on the charge for the designated usage time period in a plurality of regions (step S107). ). The deployment unit 15 deploys resources in the region selected by the selection unit 14 in step S106 or step S107 (step S108).

As described above, when the information processing apparatus 1 of the present embodiment receives a resource allocation request for a cloud service with different fees depending on the time period, the information processing apparatus 1 allocates resources according to whether the data to be used includes confidential data. Select the region to be used. If the data to be used includes confidential data, the information processing apparatus 1 can improve security when using the cloud service by selecting a predetermined area where the confidential data can be stored. In addition, when the data to be used does not include confidential data, the information processing apparatus 1 selects the region in which the resource is deployed based on the usage charges for the usage time period of the resource in a plurality of regions. can be provided.

When the information processing apparatus 1 of the present embodiment is applied, for example, a production environment system including customer data, etc. is constructed and operated in a predetermined region (for example, a region within one's own country), so security is ensured. be able to. In addition, for applications with low security requirements, such as system development and testing, the cheapest area among the plurality of areas is used, and the cost can be reduced. For example, a user can complete testing of developed software more quickly if the test is performed in another country during the daytime than if the test is performed at a data center in the user's own country at night.

Next, an example of the hardware configuration of the information processing device 1 will be described. FIG. 10 is a diagram showing an example of the hardware configuration of the information processing device 1. As shown in FIG. As shown in the example of FIG. 10, in the information processing apparatus 1, a bus 100 is connected to a processor 111, a memory 112, an auxiliary storage device 113, a communication interface 114, a medium connection section 115, an input device 116, and an output device 117. be.

The processor 111 executes programs developed in the memory 112 . An information processing program that performs the processing in the embodiment may be applied to the program to be executed.

Memory 112 is, for example, Random Access Memory (RAM). The auxiliary storage device 113 is a storage device that stores various information, and may be a hard disk drive, a semiconductor memory, or the like, for example. An information processing program that performs the processing of the embodiment may be stored in the auxiliary storage device 113 .

A communication interface 114 is connected to a communication network such as a Local Area Network (LAN) or a Wide Area Network (WAN), and performs data conversion and the like associated with communication.

A medium connection unit 115 is an interface to which a portable recording medium 118 can be connected. The portable recording medium 118 may be an optical disc (for example, Compact Disc (CD) or Digital Versatile Disc (DVD)), semiconductor memory, or the like. An information processing program for performing the processing of the embodiment may be recorded on the portable recording medium 118 .

The input device 116 is, for example, a keyboard, a pointing device, or the like, and receives input such as instructions and information from the user. The output device 117 is, for example, a display device, a printer, a speaker, etc., and outputs inquiries or instructions to the user, processing results, and the like.

The storage unit 16 shown in FIG. 1 may be realized by the memory 112, the auxiliary storage device 113, the portable recording medium 118, or the like. The setting unit 11, the acquisition unit 12, the calculation unit 13, the selection unit 14, and the deployment unit 15 shown in FIG.

The memory 112, auxiliary storage device 113, and portable recording medium 118 are computer-readable, non-temporary tangible storage media, not temporary media such as signal carriers.

Note that the information processing apparatus 1 may not include all the components shown in FIG. 10, and some components may be omitted. Alternatively, some components may exist in an external device of the information processing device 1, and the information processing device 1 may connect to the external device to use the components in the external device.

The present embodiment is not limited to the embodiments described above, and various modifications, additions, and omissions can be applied without departing from the gist of the present embodiment.

1 information processing device 11 setting unit 12 acquisition unit 13 calculation unit 14 selection unit 15 allocation unit 16 storage unit 100 bus 111 processor 112 memory 113 auxiliary storage device 114 communication interface 115 medium connection unit 116 input device 117 output device 118 portable recording medium

Claims (6)

Acquiring a resource deployment request for a cloud service with different charges depending on the time period, together with the specification of the use time period of the resource;
Referencing an identifier indicating confidentiality assigned to data used in the resource, and determining whether the data includes confidential data based on whether or not the referenced identifier includes an identifier indicating confidential data. determine whether
If the data includes confidential data, a predetermined region is selected as a region in which the resource is deployed, and if the data does not include confidential data, based on the charges for the usage period of the resource in a plurality of regions, the Select the region where you want to deploy resources,
An information processing program for causing a computer to execute a process of deploying the resource in a selected area. Acquisition of resource type designation together with the resource allocation request,
if the data does not include confidential data, calculating a charge for using the resource in the plurality of regions during the time period of use of the resource for the designated resource type; 2. The information processing program according to claim 1, causing the computer to execute a process of selecting an area in which the . when the data used for the resource includes confidential data and a plurality of the predetermined regions are set, calculating a charge for using the resource in the plurality of predetermined regions during the usage time of the resource; 2. The information processing program according to claim 1, causing the computer to execute a process of selecting an area where the resource is to be deployed based on the calculated fee. Acquisition of resource type designation together with the resource allocation request,
a process of calculating a charge for using the resource during the usage time period of the resource in the plurality of predetermined regions with respect to the specified resource type, and selecting a region in which the resource is to be deployed based on the calculated charge; 4. The information processing program according to claim 3, causing said computer to execute: the computer
Acquiring a resource deployment request for a cloud service with different charges depending on the time period, together with the specification of the use time period of the resource;
Referencing an identifier indicating confidentiality assigned to data used in the resource, and determining whether the data includes confidential data based on whether or not the referenced identifier includes an identifier indicating confidential data. determine whether
If the data includes confidential data, a predetermined region is selected as a region in which the resource is deployed, and if the data does not include confidential data, based on the charges for the usage period of the resource in a plurality of regions, the Select the region where you want to deploy resources,
An information processing method, comprising executing a process of deploying the resource in a selected area. an acquisition unit that acquires a resource allocation request for a cloud service that charges differently depending on the time period, together with a specification of the use time period of the resource;
Referencing an identifier indicating confidentiality assigned to data used in the resource, and determining whether the data includes confidential data based on whether or not the referenced identifier includes an identifier indicating confidential data. and if the data includes confidential data, select a predetermined area as an area for deploying the resource, and if the data does not include confidential data, charge for the usage time period of the resource in a plurality of areas. a selection unit that selects a region for deploying the resource based on
and a deployment unit that deploys the resource in a selected area.

Images