KR102644495B1 - System and Method for integrated business management of SaaS Application - Google Patents

Abstract

The present invention relates to a SaaS application integrated management system and method for managing application and data access details and permissions used in a cloud-based digital workspace based on member information and member access rights information for each department within the company. A SaaS access management unit that recognizes applications used in the workspace and manages access data for the applications, a SaaS task management unit that performs business management of company members based on the usage history of applications accessed by the SaaS access management unit, and the SaaS access It includes a SaaS security processing unit that processes security for application and data access rights in a cloud-based digital workspace based on application access data recognized by the management unit and member work management contents performed by the SaaS business management unit.

Description

SaaS application integrated management system and method {System and Method for integrated business management of SaaS Application}

The present invention relates to a SaaS application integrated management system and method, which manages application and data access details and rights used in a cloud-based digital workspace based on member information and member access rights information for each department within the company. This relates to a SaaS application integrated management system and method.

SaaS (Software as a Service) is software that allows users to use only the services they need among the many functions of the software.

SaaS is a concept that describes a fundamental change in the way software is distributed, in which a supplier provides software services to multiple customers using a single platform, and users pay for the amount used.

There is a big difference in product ownership compared to traditional software business models. It is different from the existing licensing model in that software is a service rather than a product, that is, a rental model.

SaaS significantly reduces the cost for companies to purchase new software features and allows them to avoid infrastructure investment and management burden by paying based on usage over a certain period of time.

Therefore, the use of SaaS is increasing in various areas such as business email, collaboration, sales, payroll systems, and code storage.

While SaaS is revolutionizing modern organizations, SaaS Sprawl is eroding IT control. In the case of IT, these changes pose widespread risks that will need to be addressed sooner rather than later. The risk of loss of control and over-authorization due to SaaS Sprawl is underestimated.

Changes to the way IT manages and operates SaaS applications are essential and the risks of not doing so are high.

Not only is SaaS data growing rapidly, but if software usage management is not integrated, there are problems with identifying overall software usage within the company or being vulnerable to data security and operational security.

At this time, publicly shared data can be used by anyone anywhere there is a data link. In particular, there is the problem of companies losing control over publicly shared data.

Typically, employees are granted access to company assets and data using their personal email addresses.

Private sharing can provide an avenue for data leaks during and after employees work at the company. In other words, allowing external access to continue even when legitimate rights to company assets and data are lost provides a path for data leakage.

Specifically, thorough, integrated management of access rights is necessary even when there is no ongoing legitimate business relationship need for access. This means you need a way to reliably manage, secure, and support your SaaS work environment.

KR 10-2016-0062523 A KR 10-2013-0040167 A

The present invention was derived from this technical background, and integrates SW access rights, device (HW) access rights, and ID access rights for the use of apps and data through SaaS within a company. In addition to access rights management, SaaS data security Provides a SaaS application integrated management system and method that provides a process for automatically reinforcing regulatory compliance through continuous data generation, reading, update, and deletion (CRUD) history management, operator alerts, and this. There is a purpose to it.

In addition, we seek to strengthen the security of application use and data access by managing access rights to applications and data operated in a cloud environment.

In addition, we aim to provide an integrated SaaS application management system and method that can control the indiscriminate increase in data usage.

The present invention for achieving the above problems includes the following configuration.

That is, the SaaS application integrated management system according to an embodiment of the present invention includes a SaaS access management unit that recognizes applications used in a cloud-based digital workspace and manages access data for the applications, and an application whose access is recognized by the SaaS access management unit. Cloud-based digital work based on application access recognized by the SaaS task management department and the SaaS access management department that performs task management for in-house members based on usage history and task management for in-house members performed by the SaaS task management department It includes a SaaS security processing unit that handles security for application and data access rights in the space.

Meanwhile, in the SaaS application integrated management method running on a computer device or a cloud environment, the computer device includes at least one processor configured to execute computer-readable instructions included in a memory, and the SaaS application integrated management method includes: A SaaS access management step that recognizes applications used in a cloud-based digital workspace and manages access data for the applications, and performs task management for company members based on the usage history of applications recognized as accessed in the SaaS access management step. Processes security for application and data access rights in a cloud-based digital workspace based on the SaaS task management step and the application access data recognized in the SaaS access management step and the task management content performed in the SaaS task management step. Includes SaaS security processing steps.

According to the present invention, it is effective to provide a SaaS application integrated management system and method that can comprehensively manage SW access rights, device (HW) access rights, and ID access rights for application and data use through SaaS within a company. It is derived.

Additionally, security for application use and data access can be strengthened by managing access rights to applications and data in the cloud environment.

In addition, it is effective in providing a SaaS application integrated management system and method that can control the indiscriminate increase in data usage.

1 is a block diagram showing an example of a computer device according to an embodiment of the present invention.
Figure 2 is an exemplary diagram for explaining the schematic configuration of a SaaS application integrated management system according to an embodiment of the present invention.
Figure 3 is an exemplary diagram for explaining the structure and function of a SaaS application integrated management system according to an embodiment of the present invention.
4 to 6 are diagrams illustrating the architecture of a SaaS application integrated management system according to an embodiment of the present invention.
Figure 7 is an example diagram for explaining a zero trust architecture according to an embodiment of the present invention.
Figures 8 and 9 are exemplary diagrams showing the functions of the platform provided by the SaaS application integrated management system according to an embodiment.
Figure 10 is a flowchart of a SaaS application integrated management method executed on a computer device according to an embodiment of the present invention.

It should be noted that the technical terms used in the present invention are only used to describe specific embodiments and are not intended to limit the present invention. In addition, the technical terms used in the present invention, unless specifically defined in a different sense in the present invention, should be interpreted as meanings generally understood by those skilled in the art in the technical field to which the present invention pertains, and are not overly comprehensive. It should not be interpreted in a literal or excessively reduced sense.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the attached drawings.

The SaaS application integrated management system according to embodiments of the present invention may be implemented by at least one computer device or a cloud environment, and the SaaS application integrated management method according to embodiments of the present invention is included in the SaaS application integrated management system. It may be performed through at least one computer device or a cloud environment. At this time, a computer program according to an embodiment of the present invention may be installed and driven in a computer device or a cloud environment, and the computer device may provide a method of providing expert consultation according to embodiments of the present invention under the control of the driven computer program. It can be done. The above-described computer program may be stored in a computer-readable recording medium in order to execute the SaaS application integrated management method by being coupled to a computer device or a cloud environment. In this specification, application refers to a SaaS application.

1 is a block diagram showing an example of a computer device according to an embodiment of the present invention.

As shown in FIG. 1 , the computer device 100 may include a memory 110, a processor 120, a communication interface 130, and an input/output interface 140.

The memory 110 is a computer-readable recording medium and may include a non-permanent mass storage device such as random access memory (RAM), read only memory (ROM), and a disk drive. Here, non-perishable large-capacity recording devices such as ROM and disk drives may be included in the computer device 100 as a separate permanent storage device that is distinct from the memory 110.

Additionally, an operating system and at least one program code may be stored in the memory 110. These software components may be loaded into the memory 110 from a computer-readable recording medium separate from the memory 110. Such separate computer-readable recording media may include computer-readable recording media such as floppy drives, disks, tapes, DVD/CD-ROM drives, and memory cards. In another embodiment, software components may be loaded into the memory 110 through the communication interface 130 rather than a computer-readable recording medium. For example, software components may be loaded into memory 110 of computer device 100 based on computer programs installed by files received over network 20.

The processor 120 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input/output operations. Commands may be provided to the processor 120 by the memory 110 or the communication interface 130. For example, the processor 120 may be configured to execute received instructions according to program codes stored in a recording device such as memory 110.

The communication interface 130 may provide a function for the computer device 100 to communicate with other devices (eg, the storage devices described above) through the network 20. For example, a request, command, data, file, etc. generated by the processor 120 of the computer device 100 according to a program code stored in a recording device such as memory 110 is transmitted to the network ( 20) and can be transmitted to other devices.

Conversely, signals, commands, data, files, etc. from other devices may be received by the computer device 200 through the communication interface 130 of the computer device 100 via the network 20. Signals, commands, data, etc. received through the communication interface 130 may be transmitted to the processor 120 or memory 110, and files, etc. may be stored in a storage medium (as described above) that the computer device 100 may further include. can be stored in permanent storage).

The input/output interface 140 may be a means for interfacing with the input/output device 150. For example, input devices may include devices such as a microphone, keyboard, or mouse, and output devices may include devices such as displays and speakers. As another example, the input/output interface 140 may be a means for interfacing with a device that integrates input and output functions, such as a touch screen. The input/output device 150 may be configured as a single device with the computer device 100.

Additionally, in other embodiments, computer device 100 may include fewer or more components than those of FIG. 1 . However, there is no need to clearly show most prior art components. For example, the computer device 100 may be implemented to include at least some of the input/output devices 150 described above, or may further include other components such as a transceiver, a database, etc.

Below, specific embodiments of the SaaS application integrated management method and system will be described.

Figure 2 is an exemplary diagram for explaining the schematic configuration of a SaaS application integrated management system according to an embodiment of the present invention.

The SaaS application integrated management system according to one embodiment can be performed by encompassing processes, technologies, and responsibilities for IT (department) in a digital workspace in a cloud environment.

To reliably manage, secure, and support SaaS environments, IT needs to understand exactly how SaaS applications work and interact with each other.

Centralization, Discoverability, Insights, Action, Automation, Delegation and Auditability systems are required to provide analysis and statistics that a simple management console does not provide.

This empowers IT to wangle SaaS data, automating manual tasks and compliance. It also has the effect of avoiding alert fatigue and minimizing security risks.

Additionally, you can protect your data, gain reasonable control over your SaaS environment, and gain clarity about management and security.

As shown in FIG. 2 , the SaaS application integrated management system according to an embodiment includes a SaaS access management unit 2210, a SaaS task management unit 2220, and a SaaS security processing unit 2230.

The SaaS access management unit 2210 recognizes and searches applications used in a cloud-based digital workspace and manages access data for the applications.

Specifically, the SaaS access management unit 2210 includes Application Discovery to access applications used in a cloud-based digital workspace, an Application Adoption unit to select applications that can provide services in a cloud-based digital workspace, and an application selection unit. License Optimization, which selects functions and data access rights for applications selected by the government, and Application Usage Analysis, which conducts application usage trends and analysis according to the access rights set in the license setting department. ) includes.

The SaaS access management department 2210 needs visibility to determine which applications employees use and how those applications are used. This can pose a security threat to your IT environment when employees log in to unauthorized applications, especially using OAuth (Open Authorization). Each department can easily use various SaaS applications that perform similar functions.

OAuth is an open standard for access delegation that serves as a common means for Internet users to grant websites or applications access to their information on other websites without providing a password.

Improved visibility into your SaaS stack allows you to integrate applications to improve collaboration and optimize spending. You can also protect your environment by removing access to risky applications.

The SaaS task management unit 2220 performs work management of in-house members based on the usage history of applications recognized as access by the SaaS access management unit 2210.

In one embodiment, the SaaS business management unit 2220 may perform at least one of the following functions: usage history of each application, integration of cost and application usage data, application discovery and inventory creation, contract or contract renewal, cost savings identification, and user and operational life cycle automation. By performing one and based on this, you can perform efficient and productive work management of company members.

The SaaS business management unit 2220 includes a group management unit that identifies and manages at least one group information within the company, a user onboarding unit that matches and stores member information and group information when new member information is entered, and a member onboarding unit that matches and stores member information. Once resignation information is entered, the member withdrawal processing department (User Offboarding) removes the work authority for the member, and the member work cycle management department (User Lifecycle Changes), which receives and updates new work details and group change information for each member, and the application management department ( Application Configuration).

SaaS Business Management 2220 needs a SaaS-optimized no-code automation platform that can provide zero-touch automation for onboarding, offboarding, and other common IT tasks.

IT departments can maximize operational efficiency through faster help desk ticket resolution and elimination of manual IT tasks, allowing them to focus on strategic projects.

The SaaS security processing unit 2230 determines application and data access rights in the cloud-based digital workspace based on the application access data recognized by the SaaS access management unit 2220 and the member work management contents performed by the SaaS task management unit 2220. Handle security.

The SaaS security processing unit 2230 protects company SaaS data and maintains regulatory compliance. The SaaS security processor 2230 quickly finds potential risks in the SaaS stack and raises alerts while files are being shared excessively. At this point, threat remediation can be automated. Additionally, unified roles and permissions can be used to implement a least-privilege access model across SaaS applications.

The SaaS Security Processing Department 2230 is responsible for protecting SaaS data and maintaining compliance.

Zero Trust is a strategic initiative to prevent data breaches from occurring by removing the concept of trust from an organization's network architecture. Zero Trust is designed to protect modern digital environments by leveraging network segmentation, intranet movement blocking, L7 threat prevention, and simplification of granular user access.

Zero Trust identifies protected surfaces. The protection surface consists of critical data, assets, applications, and services on the network, and the protection surface is unique to each organization.

Once the protective surfaces are identified, you can determine how traffic moves relative to the protective surfaces within your organization. Knowing who your users are, what applications they use, and how they are connected can help you identify and apply policies that ensure secure data access. That is, understanding the interdependencies between services (DAAS), infrastructure, services, and users creates a micro-perimeter around the protected surface by placing controls as close to the protected surface as possible. The micro border moves with the protective surface. Micro-perimeter is configured by deploying segmentation gateways (next-generation firewalls), allowing only known traffic, permitted traffic, or legitimate applications to access the protected surface.

The segmentation gateway provides detailed information about traffic and applies multiple layers of additional inspection and access control with detailed L7 policies based on the Kipling method. Zero trust policies can specify who can cross a micro-perimeter at any given time, preventing unauthorized users from accessing protected surfaces and preventing sensitive data from being leaked. In other words, if you build a zero trust policy around the protection surface, you can use real-time monitoring and management to find out what should be included in the protection surface and how to improve the policy for interdependencies that were not considered.

In other words, with Zero Trust, you can gain visibility and context for all traffic across users, devices, locations, and applications, and provide zone segmentation capabilities to check internal traffic.

At this time, traffic visibility and context must be secured through a next-generation firewall with decryption capabilities. Next-generation firewalls support micro-segmentation of the perimeter and serve as overall control within the organization.

A zero trust strategy identifies business processes, users, data, data flows, and associated risks, and policy rules can be set to automatically update based on associated risks with each iteration.

In an additional aspect of the present invention, the SaaS security processing unit 2230 uses a cloud-based method based on security processing results, application access data recognized by the SaaS access management unit 2220, and member task management contents performed by the SaaS task management unit 2220. In the digital workspace, information on application and data access rights can be created in the form of a visible graph or diagram and provided to the administrator.

Periodically updated changes are provided to the administrator terminal in a visible form. For example, if the number of inappropriate access attempts to a certain program in a certain department exceeds the standard amount, setting and changing a password for that department's program may be requested. In addition, a warning message is sent to employees whose number of attempts to access data exceeds a certain amount of permissions is exceeded, and the employee's superior is notified of this.

By clarifying the manager of the program or data, quick and accurate updates and management of data access rights are possible.

Figure 3 is an example diagram for explaining the structure and function of a SaaS application integrated management system according to an embodiment of the present invention.

As shown in Figure 3, the SaaS application integrated management system includes an audit function that audits overall SaaS application activities to ensure compliance with regulations, and a delegation function that grants detailed administrator authority delegation and user-specified roles (Role-based). , the ability to automate tasks on data objects (Automation), the ability to perform actions on data objects (Action), the ability to monitor applications and display important insights, and filter specific relevant objects through Data Set Filtering. It includes discoverability to explore and centralization to centrally manage all system records.

The SaaS application integrated management system captures information about how users use SaaS applications at the intersection of SaaS application management, security, and collaboration systems.

Specifically, we identify SaaS application operation information (time), performance and availability, and monitor the provider and cloud host areas.

Additionally, the application lifecycle (onboarding~offboarding) and ULM (User Lifecycle Management) can be identified and managed.

In addition, SaaS data such as Data Discovery, RBAC (Role Based Access Control), and User activity event monitoring can be obtained.

It also provides an integrated information-based workflow between business domain knowledge and SaaS applications.

4 to 6 are diagrams illustrating the architecture of a SaaS application integrated management system according to an embodiment of the present invention.

Part a (Empowered Outcomes) in Figure 4 provides visibility into the location of sensitive data across SaaS applications and supports finding users responsible for the data. And it provides valuable information to IT.

Part b (Universal Integration & Intelligence) is Knowledge graph + Universal SaaS Integration = Centralization + Discoverability + Insights.

Based on the knowledge graph, all data about users, configuration, privileges, and overall activities, including inside and outside the application, are collected. And it provides the ability to understand where SaaS applications (all Digital Assets) are and how they interact (beyond visualization).

In one aspect, SaaS security processor 2230 includes a zero trust architecture.

As shown in Figures 5 and 6, it is based on zero trust architecture.

Data Engineering collects (aggregated) API data from SaaS applications. This includes Authentication, Account Info, Privileges, User Activities, and Specific Info based on each Application. And data is generated based on the knowledge graph.

In one embodiment, the Zero Trust architecture is based on a Knowledge Graph that contains data about users, configurations, permissions, and activities within and across applications and identity provider activities.

At this time, the Knowledge Graph includes records, file sharing, and control change operations accessed within applications used in a cloud-based digital workspace.

In addition, the Knowledge Graph includes relationships between applications, network open status of applications, user group information, permission information granted to groups and group members, policies and entities to which policies are applied, and security required data information. do.

In addition, the Knowledge Graph includes user access events, application resource usage information, information on connected users and devices, and data sharing information.

Figure 7 is an example diagram for explaining a zero trust architecture according to an embodiment of the present invention.

Zero trust can ensure continuous access to all elements and limit the impact of a potential breach. Additionally, behavioral data can be collected to support rapid incident response.

In zero trust architecture, all data and computing services are resources, that is, subject to protection. And all communications can meet the same security requirements regardless of internal/external networks.

Per-session access to individual enterprise resources is verified on a per-session basis, and access is determined based on client ID, application/service, and request asset dynamic policy. It is based on detailed information such as software versions installed on every edge, network location, time and date of request, and previously observed behavior.

Additionally, the company continuously monitors and measures the integrity and security status of all required assets and related assets.

All Authentication and Authorization authorizations are dynamic and enforced thoroughly before allowing access.

Additionally, companies can continuously improve their security posture by collecting and utilizing as much information as possible about assets, network infrastructure, and current communication status.

The zero trust security approach applied to the SaaS application integrated management system according to one embodiment is based on a Knowledge Graph filled with data about users, configurations, permissions, and activities within and across applications and identity provider activities, It aims to provide complete visibility into all actions performed within the connected application (all records accessed, file sharing, control changes, etc.).

Specifically, the Knowledge Graph refers to which applications are connected to which applications, which applications are open to the Internet, information about users and groups they belong to, permissions granted to groups and group members, and policies to which policies are applied. Contains entities (or resources) and data to be protected.

It also includes user access events, application resource usage, connected user and device information, and data sharing information (files, repository, calendar).

Figures 8 and 9 are exemplary diagrams showing the functions of the platform provided by the SaaS application integrated management system according to an embodiment.

As shown in FIG. 8, the SaaS task management unit 2220 collects new user information within the organization during onboarding. And you can, for example, identify new users created in the last few days. And when a new user is created in HRIS (Human Resources Information System), a warning message is notified to IT (department).

The SaaS task management unit 2220 grants new users access to appropriate files, folders, calendars, and groups within the SaaS application and sends a notification message to the administrator.

Additionally, access to the application can be automatically granted and notification messages can be delivered.

The SaaS business management unit 2220 can obtain information on all users in the organization during offboarding. It then identifies users scheduled for offboarding and notifies IT (department) when a user is deleted/suspended from HRIS. You can also detect when a user is hidden in the directory, reset a user's password, add a message during automation, delegate access to another user, or transfer ownership. It is possible to automatically hide users in the directory and perform automation of actions.

The SaaS security processing unit 2230, for example, identifies all users working in the sales department (IT).

For example, download 100+ records from Salesforce within 7 days, share a document with a competitor, identify sales department users logging in from home on weekends, and have sales department users download 100 records from Salesforce within 7 days. Download more than one record, share documents with competitors, and alert IT when you log in from home on the weekend. Then, they suspend the account, send a Slack message to the supervisor, and open a ticket with the security team. Automatically suspends accounts, sends a Slack message to supervisors, and opens a ticket with the security team.

And, as shown in Figure 9, external user management, compliance, license management, and group management are performed.

In other words, the SaaS application integrated management system according to one embodiment is a SaaS application to quickly and accurately control access to applications, data, and identities according to employment and retirement of people with access to applications and data provided on SaaS. You can manage the overall usage history and situation.

In addition, when running a program through SaaS, there are management and security issues regarding the increase in overall data management data. The business integration management system for SaaS applications according to one embodiment can be managed collectively by establishing a central management system, and can manage and control all data explosion-control and external security issues in data management.

It can also help with collaboration between departments through management insights into software or data.

Figure 10 is a flowchart of a SaaS application integrated management method running on a computer device or a cloud environment according to an embodiment of the present invention.

The SaaS application integrated management method according to one embodiment recognizes applications used in a cloud-based digital workspace and manages access data for the applications (S300).

In addition, in-house member work management is performed based on the usage history of applications recognized as access in the SaaS access management stage (S310).

At this time, access data for the application, work authority information for each member, group information, new work content for each member, and group change information are recorded in the knowledge graph (S320).

In addition, security for application and data access rights is processed in the cloud-based digital workspace based on application access data recognized in the SaaS access management stage and member work management content performed in the SaaS task management stage (S330).

In one aspect of the present invention, the SaaS security processing step performs security processing based on a zero trust architecture based on the Knowledge Graph (S330).

The above-described method may be implemented as an application or in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., singly or in combination.

The program instructions recorded on the computer-readable recording medium may be those specifically designed and configured for the present invention, or may be known and usable by those skilled in the computer software field.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and perform program instructions, such as ROM, RAM, flash memory, etc.

Examples of program instructions include not only machine language code such as that created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the invention and vice versa.

Although the above has been described with reference to embodiments, those skilled in the art will understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the following patent claims. You will be able to.

100: computer device 110: memory
120: processor 130: communication interface
140: input/output interface 150: input/output device

Claims (15)

A SaaS access management unit that recognizes SaaS applications used in a cloud-based digital workspace and manages access to the applications;
a SaaS task management unit that performs integrated task management of SaaS applications of company members using at least one application recognized as access by the SaaS access management unit; and
A SaaS security processing unit that processes security for application and data access rights in a cloud-based digital workspace based on application access data recognized by the SaaS access management unit and SaaS application integrated business management contents performed by the SaaS business management unit. Includes,
The SaaS access management department,
Application selection department (Adoption), which selects applications that can provide services in a cloud-based digital workspace,
A license setting unit that selects function and data access authority qualifications for the application selected in the application selection unit, and
It includes an application usage analysis unit that performs application usage trends and analysis according to the access rights set in the license setting unit,
The SaaS access management department,
A SaaS application integrated management system that recognizes applications used in a cloud-based digital workspace and records access data for applications in a knowledge graph.
delete delete According to claim 1,
The SaaS business management department,
A group management department that identifies and manages information on at least one group within the company;
A member recruitment processing unit that matches and stores member information and group information when new member information is entered;
A member resignation processing department that removes work authority for the member once member resignation information is entered, and
A SaaS application integrated management system that includes a member work cycle management department that receives and updates new work details and group change information for each member.
According to claim 4,
The SaaS business management department,
A SaaS application integrated management system that records each member's work authorization information, group information, new work details for each member, and group change information in a knowledge graph.
According to clause 4,
The SaaS business management department,
A SaaS application integrated management system that performs at least one of the following functions: integrating usage history, cost, and application usage data for each application, discovering and creating an inventory of applications, renewing contracts or contracts, identifying cost savings, and automating user and operational life cycles.
According to claim 1,
The SaaS security processing department,
SaaS application integrated management system with zero trust architecture.
According to claim 7,
The zero trust architecture is,
An integrated SaaS application management system based on the Knowledge Graph, which includes data on users, configurations, permissions, and activities within and across applications, as well as identity provider activities.
According to claim 8,
The Knowledge Graph is,
An integrated SaaS application management system that includes accessed records, file sharing, and control changes within applications used in a cloud-based digital workspace.
According to claim 8,
The Knowledge Graph is,
A SaaS application integrated management system that includes relationships between applications, network open status of applications, user group information, permission information granted to groups and group members, policies and entities to which policies are applied, and security required data information.
According to claim 8,
The Knowledge Graph is,
A SaaS application integrated management system that includes user access events, application resource usage information, accessing user and device information, and data sharing information.
In the integrated management method of SaaS applications running on a computer device or cloud environment,
The computer device includes at least one processor configured to execute computer readable instructions contained in a memory,
The SaaS application integrated management method is,
A SaaS access management step that recognizes applications used in a cloud-based digital workspace and manages access to the applications;
A SaaS task management step of performing task management of in-house members based on the usage history of applications whose access is recognized in the SaaS access management step; and
A SaaS security processing step of processing security for application and data access rights in a cloud-based digital workspace based on the application access management recognized in the SaaS access management step and the SaaS application integrated management performed in the SaaS task management step. Contains ;,
The SaaS task management step is,
A SaaS application integrated management method, characterized in that it performs at least one of the following functions: integrating usage history, costs, and application usage data for each application, discovering and creating an inventory of applications, renewing contracts or contracts, identifying cost savings, and automating user and operational life cycles. .
According to clause 12,
A SaaS application integrated management method further comprising: recording application access data, work authorization information for each member, group information, new work content for each member, and group change information in a knowledge graph.
According to clause 13,
The SaaS security processing step is,
An integrated SaaS application management method that handles security based on a zero trust architecture based on the Knowledge Graph.
delete