WO2021157073A1 - Information processing device, information processing method, and information processing program - Google Patents

Abstract

A model analysis unit (22) groups a plurality of operations performed by a data processing system. A first information asset determination unit (23) determines whether or not to treat usage data as an information asset, on the basis of the attributes of each group resulting from the grouping and on the basis of the method used by the operations in the group to use the usage data.

Description

Information processing equipment, information processing methods and information processing programs

This disclosure relates to security evaluation.

In security evaluation such as risk analysis, analysis is performed based on the value of assets to be protected by the system or software to be evaluated. When analyzing a data processing system, the assets to be protected are mainly information assets. Information assets include valuable information and data in data processing systems and the mechanisms and equipment that handle them.
When dealing with information assets in security evaluations such as risk analysis, the importance of the information assets is often expressed numerically. The importance of information assets is determined for each security characteristic required for information assets. As the security characteristics, confidentiality, integrity, and availability, which are the basic characteristics of information security, are generally used. These three security characteristics are called CIA, which is an acronym for English.

When conducting risk analysis, etc., it is necessary to extract information assets and determine the security characteristics of the extracted information assets and the importance of the extracted information assets. Generally, information assets are extracted based on the knowledge of the analyst (for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2015-041167

In the method described in Patent Statement 1, a person extracts information assets based on qualitative criteria. Therefore, the method of Patent Document 1 has a problem that a subjective element is included and information assets cannot be extracted objectively.

One of the main purposes of this disclosure is to solve the above problems. More specifically, the main purpose of this disclosure is to objectively extract information assets by excluding subjective elements.

The information processing device according to the present disclosure is
A grouping unit that groups multiple operations performed in the data processing system,
It has an information asset determination unit that determines whether or not to treat the usage data as an information asset based on the attributes of the group obtained by grouping and the usage method of the usage data used in the operation belonging to the group. ..

According to this disclosure, it is possible to objectively extract information assets by excluding subjective elements.

The figure which shows the structural example of the information processing apparatus which concerns on Embodiment 1. FIG. The flowchart which shows the operation example of the information processing apparatus which concerns on Embodiment 1. The figure which shows the example of the design model which concerns on Embodiment 1. FIG. The flowchart which shows the detail of step S2 which concerns on Embodiment 1. The figure which shows the example of the operation classification table which concerns on Embodiment 1. The figure which shows the example of the grouping result which concerns on Embodiment 1. FIG. The flowchart which shows the detail of step S3 which concerns on Embodiment 1. The figure which shows the example of the 1st information asset determination table which concerns on Embodiment 1. FIG. The flowchart which shows the detail of step S4 which concerns on Embodiment 1. The figure which shows the example of the 2nd information asset determination table which concerns on Embodiment 1. FIG. The figure which shows the example of the information asset list which concerns on Embodiment 1.

Hereinafter, embodiments will be described with reference to figures. In the following description and drawings of the embodiments, those having the same reference numerals indicate the same parts or corresponding parts.

Embodiment 1.
*** Explanation of configuration ***
A configuration example of the information processing apparatus 10 according to the first embodiment will be described with reference to FIG.
The operation procedure of the information processing device 10 corresponds to the information processing method. Further, the program that realizes the operation of the information processing device 10 corresponds to the information processing program.

The information processing device 10 includes hardware such as a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware via a signal line, and the processor 11 controls these other hardware.

The processor 11 is an IC (Integrated Circuit) that performs processing. Specific examples of the processor 11 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit). In FIG. 1, only one processor 11 is shown. However, the number of processors 11 may be plural, and the plurality of processors 11 may execute programs that realize the functional components shown in FIG. 1 in cooperation with each other.

The memory 12 is a storage device that temporarily stores data for processing of the processor 11. Specific examples of the memory 12 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory).

The storage 13 is a storage device for storing data. As a specific example, the storage 13 is an HDD (Hard Disk Drive). Further, the storage 13 may be an SSD (Solid State Drive). In addition, portable recording media such as SD (Secure Digital, registered trademark) memory cards, CF (CompactFlash, registered trademark), NAND flash, flexible discs, optical disks, compact discs, Blu-ray (registered trademark) discs, and DVDs (Digital Versailles Disc). It may be.

The communication interface 14 is an interface for communicating with an external device. As a specific example, the communication interface 14 is a port of Ethernet (registered trademark), USB (Universal Serial Bus), HDMI (High-Definition Multimedia Interface, registered trademark).

The information processing device 10 includes an input unit 21, a model analysis unit 22, a first information asset determination unit 23, a second information asset determination unit 24, and an output unit 25 as functional components. The functions of each functional component of the information processing apparatus 10 are realized by a program.
A program that realizes the functions of each functional component of the information processing device 10 is stored in the storage 13. This program is read into the memory 12 by the processor 11 and executed by the processor 11. As a result, the functions of each functional component of the information processing apparatus 10 are realized.

The function of each functional component of the information processing device 10 may read information for determining the operation of analysis performed by the program and the condition of determination from the database or the setting file stored in the storage 13. Further, the information that determines the operation of the analysis and the information that determines the condition of the determination may be a part of the program. For example, in the present embodiment, the model analysis unit 22 reads the motion classification table 31 and changes the analysis motion. Further, the first information asset determination unit 23 reads the first information asset determination table 32 and changes the determination operation.

Note that FIG. 1 illustrates a configuration in which only one information processing device 10 is used. Instead, a plurality of computers may be connected via a network, and the plurality of computers may cooperate to form an information asset characteristic analysis system.
Further, in FIG. 1, it is assumed that an input / output device for inputting the user to the information processing device 10 and outputting from the information processing device 10 is connected to the communication interface 14. Alternatively, the information processing apparatus 10 may be provided with an interface for input and output. In this case, the user can directly operate the information processing device 10.

The input unit 21 receives various instructions from the user of the information processing device 10. More specifically, the input unit 21 accepts the design model 41. The details of the design model 41 will be described later, but the design model 41 shows a plurality of operations performed by the data processing system to be analyzed. The operation of the data processing system shown in the design model 41 is an operation related to data processing. The operation of the data processing system shown in the design model 41 includes not only the calculation by the computer included in the data processing system but also the input of commands by the user (person) of the data processing system.

The model analysis unit 22 analyzes the design model 41 and groups the operations performed in the data processing system.
The model analysis unit 22 corresponds to the grouping unit. Further, the process performed by the model analysis unit 22 corresponds to the grouping process.

The first information asset determination unit 23 includes group attributes obtained by grouping by the model analysis unit 22 and usage data that is data used in operations belonging to the group (hereinafter, also referred to as first usage data). Whether or not to treat the first usage data as an information asset (hereinafter, also referred to as a first information asset) is determined based on the usage method of. Further, when the first information asset determination unit 23 decides to treat the first usage data as the first information asset, the first information asset determination unit 23 determines the security characteristics associated with the first usage data.
In the present specification, information assets are information and data that are protected as assets by distinguishing them from ordinary information and data. Information assets are subject to risk assessment, and information assets are subject to special management. For example, information assets are managed in the information asset ledger. Also, for example, information assets are encrypted.
The first information asset determination unit 23 corresponds to the information asset determination unit. Further, the process performed by the first information asset determination unit 23 corresponds to the information asset determination process.

The second information asset determination unit 24 determines that the first information asset determination unit 23 treats the first usage data of the first group, which is an arbitrary group among the plurality of groups, as the first information asset. When determined, a group with a specific attribute is selected as the second group from the plurality of groups. Then, the second information asset determination unit 24 is based on the relationship between the usage data used in the operation belonging to the second group (hereinafter, also referred to as the second usage data) and the first usage data. It is decided whether or not to treat the usage data of the above as an information asset (hereinafter, also referred to as a second information asset). Further, when the second information asset determination unit 24 decides to treat the second usage data as the second information asset, the second information asset determination unit 24 determines the security characteristics associated with the second usage data.
The second information asset determination unit 24 also corresponds to the information asset determination unit. Further, the processing performed by the second information asset determination unit 24 also corresponds to the information asset determination processing.

The output unit 25 handles the first usage data determined to be treated as the first information asset by the first information asset determination unit 23 and the second information asset by the second information asset determination unit 24. Outputs the determined second usage data. The output unit 25 also outputs the security characteristics of the first usage data and the security characteristics of the second usage data.

*** Explanation of operation ***
FIG. 2 is a flowchart showing the overall operation of the information processing apparatus 10 according to the first embodiment.

First, the input unit 21 receives one or more design models 41, which will be described later, as information necessary for analysis (step S1).
As will be described later, the design model 41 shows a plurality of elements included in the data processing system to be analyzed. Further, the design model 41 shows the operation of each element included in the data processing system. If a plurality of functions exist in the data processing system to be analyzed, the design model 41 for each function is input.

Next, the model analysis unit 22 analyzes the input design model 41 and groups the operations related to each other among the plurality of operations described in the design model 41 (step S2).

Next, the first information asset determination unit 23 receives the result in step S2 and uses the usage data (first usage data) used in the operation belonging to the group as the first information asset for each group. It is decided to handle it, and the security characteristic of the first information asset is determined (step S3).

As a result of step S3, if it is determined that no information asset exists, the process ends. In this case, the output unit 25 may output a message or the like for notifying that there is no information asset in the given design model 41.

If it is determined that one or more information assets exist as a result of step S3, the second information asset determination unit 24 secondly uses the second usage data based on the results in steps S2 and S3. It is decided to treat it as the information asset of the second information asset, and the security characteristic of the second information asset is determined (step S4).

Finally, the output unit 25 outputs a list showing the information assets and the security characteristics of the information assets, which are the results of steps S3 and S4 (step S5).
When only the first information asset is extracted, the list output by the output unit 25 shows the security characteristics of the first information asset and the first information asset. When the second information asset is extracted, the security characteristics of the second information asset and the second information asset are also shown in the list output by the output unit 25.

When a plurality of design models 41 are input in step S1, the information processing device 10 performs the processing after step S2 for each design model 41. When a plurality of design models 41 are input in step S1, the list output in step S5 collectively describes the plurality of information assets extracted from the plurality of design models 41 and the security characteristics of each information asset. NS.

Next, the details of each step in Fig. 2 will be explained in sequence.

(Step S1: Input processing in FIG. 2)
The input unit 21 accepts one or more design models 41 (FIG. 3).
Specifically, the input / output device connected via the communication interface 14 is operated by the user. One or more design models 41 are input by the operation of the user. Then, the input unit 21 accepts all the design models 41 input via the communication interface 14. Further, the input unit 21 writes all the design models 41 into the memory 12.

An example of the design model 41 will be described with reference to FIG.
The design model 41 shows the procedure of operation in the data processing system to be analyzed in risk analysis or the like. Although FIG. 3 assumes a data processing system composed of a plurality of elements, the data processing system may be composed of one element.

The design model 41 includes information on objects related to a series of operations of functions, information on the state of objects, information on interactions between objects, and information representing a control structure in a data processing system.

Objects represent elements of a data processing system.
The design model 41 of FIG. 3 includes a user object 411 and a component object 412 as objects.
The user object 411 is an object representing a user of the data processing system. The user object 411 contains information representing the state of the user.
The component object 412 is an object that represents a device that constitutes a data processing system. The component object 412 also includes information representing the state of each device. In FIG. 3, a component object 412 of an HMI (Human Machine Interface), a component object 412 of a controller, and a component object 412 of a device are shown.

Further, the design model 41 includes a request message 413 and a response message 414 as information indicating the interaction between the objects.
Request message 413 is a message indicating a request from one object to another. The request message 413 includes the direction of the request, the content of the request, and the like.
Response message 414 is a message indicating a response to a request from one object to another. The response message 414 includes the direction of the response, the content of the response, and the like.

Further, the design model 41 includes a control structure block 415 as information representing the control structure.
The control structure block 415 represents a control structure such as conditional branching, parallel processing, and a loop structure.

In the present embodiment, the processing of the request message 413, the processing of the response message 414, and the processing of the control structure block 415 shown in FIG. 3 all correspond to the "operation" performed in the data processing system.

Specifically, the design model 41 is, for example, a sequence diagram, an activity diagram, a flowchart, a source code, a DFD (Data Flow Diagram), a block diagram used in control engineering, or the like. These sequence diagrams and the like may be those generated using SysML. SystemsML is a language usage developed based on UML (Unified Modeling Language).
In reality, the design model 41 is described and stored in a data format that can represent a hierarchical structure so that the processor 11 can process it. For example, the design model 41 is described in a data format such as XML (Extension Markup Language) and JSON (Java® Script Object Notification).
For example, the design model 41 can be represented using a UML sequence diagram, as shown in FIG.

In FIG. 3, a person-shaped icon, a broken line extending downward from the icon, and a rectangle on the broken line represent the user object 411.
Further, the rectangle showing the character string "HMI", the broken line extending downward from the rectangle, and the rectangle on the broken line represent the component object 412 of "HMI". The rectangle showing the character string "controller", the broken line extending downward from the rectangle, and the rectangle on the broken line represent the component object 412 of the "controller". The rectangle showing the character string "device", the broken line extending downward from the rectangle, and the rectangle on the broken line represent the component object 412 of the "device".
Note that the user object 411 may have the same notation as the component object 412 depending on the sequence diagram. In such a case, the user object 411 and the component object 412 can be distinguished from each other by adding the character string "User" to the rectangle in the same manner as the rectangle of "HMI".

Further, in FIG. 3, the request message 413 is represented by a solid arrow and a character string above it.
The response message 414 is represented by a dashed arrow and a character string above it.
The direction of the arrows in the request message 413 and the response message 414 indicates the direction of the message. Furthermore, the character string above the arrow is supplementary information such as the message name and parameters. For example, the solid arrow from "User" to "HMI" in the upper left of FIG. 3 indicates that a request message has been input from "User" to "HMI". Then, from the character string above the arrow, it can be seen that the name of the request message is "user_enter" and the parameters of the request message are "id", "pwd", and "val".

Further, in FIG. 3, the broken line block in which the pentagonal tag 4151 is arranged is the control structure block 415. In the control structure block 415, the type of control structure such as conditional branching, parallel processing, and loop structure is specified in the pentagonal tag 4151 arranged at the upper left. Then, the control information of the interaction exchanged between the objects is described according to the designation. For example, in the control structure block 415 of FIG. 3, "alt" is designated for the pentagonal tag 4151. From this, it can be seen that the conditional branch is shown in the control structure block 415. Further, in FIG. 3, the control structure block 415 is divided into a partial block 4152 and a partial block 4153.
Condition 4154 is described in each of the partial blocks 4152 and 4153. Then, when the condition 4154 is satisfied, the corresponding message is transmitted and received between the objects. For example, in the upper partial block 4152, "user_check (id, pwd) = true" is shown as the condition 4154. Then, when this condition 4154 is satisfied, the request message 413 is transmitted from the "controller" to the "device", and the subsequent operation is further performed.

(Step S2 in FIG. 2: Grouping process)
The model analysis unit 22 analyzes the operation described in the design model 41 for each of the one or more design models 41 received in step S1. Then, the model analysis unit 22 extracts actions that match a specific description pattern or a specific condition, and groups the extracted actions.

FIG. 4 is a flowchart illustrating an operation example of the model analysis unit 22 in step S2.

First, the model analysis unit 22 reads the motion classification table 31 (step S21).

Next, the model analysis unit 22 performs classification processing on all the design models 41 received in step S1 (step S22). Specifically, in step S22, the model analysis unit 22 executes steps S221 to S224 described below for each design model 41. In the following, the processing of the model analysis unit 22 for the i-th design model 41 will be described.

First, the model analysis unit 22 reads the i-th design model 41 (step S221).

Next, the model analysis unit 22 analyzes the description in the i-th design model 41 (step S222).

Next, the model analysis unit 22 groups the operations described in the i-th design model 41 based on the classification criteria of the operation classification table 31 (step S223).

Finally, the model analysis unit 22 writes the result of grouping the i-th design model 41 into the memory 12 (step S224).

Next, the details of steps S21 to S22 and S221 to S224 in FIG. 4 will be described.

<Details of step S21 in FIG. 4>
In step S21, the model analysis unit 22 reads the operation classification table 31 from the storage 13. Next, the model analysis unit 22 writes the read operation classification table 31 into the memory 12. Then, the model analysis unit 22 reads the operation classification table 31 from the memory 12.

An example of the operation classification table 31 will be described with reference to FIG.
The operation classification table 31 includes a group 311 and a classification standard 312 as table items.

The name of the group to which the operation is classified is described in the group 311. Further, in the classification standard 312, a standard for classifying the operation into a group is described. Specifically, the classification standard 312 defines a message type, a message condition, a message combination pattern, a processing procedure condition, and the like.
In the example shown in FIG. 5, "Request from user" is described as group 311. As the classification criterion 312 of "Request from user", "transmission and reception of a series of request messages generated from a user object" is described. That is, the operations of sending and receiving a request message from the user object and sending and receiving a request message derived from the request message from the user object are classified into the group "Request from user".

<Details of step S22 in FIG. 4>
In step S22, the model analysis unit 22 performs a grouping process including steps S221 to S224, which will be described in detail below, for all the design models 41 received in step S1. In the following description, the grouping process for the i-th design model 41 will be described.

<< Details of step S221 in FIG. 4 >>
In step S221, the model analysis unit 22 reads the i-th design model 41 from the memory 12. Here, the design model 41 read by the model analysis unit 22 is one of the design models 41 received in step S1, and includes, for example, the information illustrated in FIG.

<< Details of step S222 in FIG. 4 >>
In step S222, the model analysis unit 22 analyzes the operation described in the read design model 41. The analysis process of step S222 is performed according to the description rule of the design model 41. In the present embodiment, the model analysis unit 22 holds the description rule of the design model 41. The description rule may be stored in the storage 13.

For example, in the example of the design model 41 of FIG. 3, the model analysis unit 22 has a relationship between the user object 411, the component object 412, the request message 413, the response message 414, the control structure block 415, the condition 4154, and the like. To analyze.

<Details of step S223 in FIG. 4>
In step S223, the model analysis unit 22 extracts the operations performed by the data processing system from the analysis result of step S222, and groups the extracted operations according to the classification standard 312 of the operation classification table 31 read in step S221. To become.

FIG. 6 shows an example of the grouping result 51 obtained by grouping the operations of the design model 41 of FIG. 3 based on the operation classification table 31 of FIG. In the example of FIG. 6, the operations surrounded by the frame with reference numeral 512 are classified into one group. The balloon with the reference numeral 511 is the group name. The group name of the balloon with the reference numeral 511 corresponds to the group 311 in FIG.
In FIG. 6, the request message “user_enter (id, pwd, val)” transmitted from “User” to “HMI” and “write_and_read_value (id, pwd, val)” transmitted from “HMI” to “controller”. , The request message "write_and_read (val)" sent from the "controller" to the "device" is grouped. And this group has an attribute called "Request from user". The sending and receiving of these request messages matches the "giving and receiving of a series of request messages generated from the user object" described in the first classification criterion 312 of the operation classification table 31 of FIG. Therefore, the operation of sending and receiving these request messages is classified into "Request from user".

<< Details of step S224 in FIG. 4 >>
In step S224, the model analysis unit 22 writes the analysis result of step S222 and the grouping result of S223 into the memory 12.

Specifically, the model analysis unit 22 can express the hierarchical structure of the grouping result 51 illustrated in FIG. 6 so that the actions belonging to the group and the correspondence between the actions can be understood for each group. Write to memory 12. For example, the model analysis unit 22 describes the grouping result 51 in a data format such as XML or JSON. Then, the model analysis unit 22 writes the grouping result 51 described in a data format such as XML or JSON into the memory 12.

(Step S3 of FIG. 2: First information asset determination process)
Based on the grouping result 51 obtained in step S2, the first information asset determination unit 23 decides to treat the usage data used in the operation belonging to the group as the first information asset for each group. In addition, the first information asset determination unit 23 determines the security characteristics of the first information asset.

FIG. 7 is a flowchart illustrating an operation example of the first information asset determination unit 23 in step S3.

First, the first information asset determination unit 23 reads the first information asset determination table 32 (step S31).

Next, the first information asset determination unit 23 performs a determination process including determination of the first information asset and determination of security characteristics for all the design models 41 received in step S1 (step S32). Specifically, in step S32, the first information asset determination unit 23 executes steps S321 to S323 described below for each design model 41. In the following, the processing for the i-th design model 41 will be described.

First, the first information asset determination unit 23 reads the grouping result 51 of the i-th design model 41 obtained in step S2 (step S321).

Next, the first information asset determination unit 23 makes a first based on the grouping result 51 of the first information asset determination table 32 read in step S31 and the i-th design model 41 read in step S321. The information asset is determined and the security characteristics are determined (step S322).

Finally, the first information asset determination unit 23 writes the result of step S322 to the memory 12 (step S323). That is, the first information asset determination unit 23 writes the first usage data determined as the first information asset and the security characteristics of the first usage data into the memory 12.

Next, the details of steps S31 to S32 and S321 to S323 in FIG. 7 will be described.

<Details of step S31 in FIG. 7>
In step S31, the first information asset determination unit 23 reads the first information asset determination table 32 from the storage 13. Next, the first information asset determination unit 23 writes the first information asset determination table 32 to the memory 12. Then, the first information asset determination unit 23 reads the first information asset determination table 32 from the memory 12.

An example of the first information asset determination table 32 will be described with reference to FIG.
The first information asset determination table 32 includes a group 321, a data condition 322, and a security characteristic 323 as table items.

Group 321 shows the name described in group 311 of the operation classification table 31 (FIG. 5). In FIG. 8, “Request from user” and the like are described in group 321.

The data condition 322 indicates a condition for treating the first usage data used in any operation belonging to the group 321 as the first information asset.
In the example of FIG. 8, the data condition 322 corresponding to the group 321 “Request from user” is described as “data written to the component object by the operation belonging to the group“ Data write ””. The data here is data exchanged between objects, and specifically, data included in the request message 413 and the response message 414. For example, in FIG. 3, it is “id”, “pwd”, “value”, “ans”, and “error”. Further, in the example of FIG. 8, the data conditions are written in natural language for easy understanding, but the data conditions are actually described in a format that can be processed by a computer.

The security characteristic 323 describes the security characteristic regarding the data extracted as the first information asset. In FIG. 8, “C”, “I” and “A” are described as security characteristics. In addition, "C" means confidentiality. "I" means completeness. "A" means availability.
In this embodiment, "C", "I" and "A" are used as security characteristics. In addition, commonly used security characteristics such as authenticity, accountability, non-repudiation, and reliability may be used. Furthermore, security characteristics required by a control system or the like such as environmental impact, safety, health impact, etc. may be used. Moreover, any security characteristic other than these may be used.

<Details of step S32 in FIG. 7>
In step S32, the first information asset determination unit 23 determines the first information asset and determines the security characteristics of the first information asset. Specifically, the first information asset determination unit 23 performs steps S321 to S323 described in detail below. In the following description, the process related to the i-th design model 41 will be described.

<< Details of step S321 in FIG. 7 >>
In step S321, the first information asset determination unit 23 reads the grouping result 51 in step S2 for the i-th design model 41 from the memory 12.
As shown in FIG. 6, the grouping result 51 is information indicating the result of grouping the operations included in the design model 41 and the relationship between the operations.

<< Details of step S322 in FIG. 7 >>
In step S322, the first information asset determination unit 23 determines the first information asset and the first information asset determination unit 23 based on the first information asset determination table 32 read in step S31 and the grouping result 51 read in step S321. Judge the security characteristics of the information asset of 1.

Specifically, the first information asset determination unit 23 treats each group of the grouping result 51 as the first information asset based on the data condition 322 of the first information asset determination table 32 (FIG. 8). The first usage data is extracted, and the security characteristics of the first usage data to be treated as the first information asset are determined based on the security characteristics 323.

For example, the first information asset determination unit 23 has the first usage data of FIG. 8 among the plurality of first usage data used in the plurality of operations belonging to the “Request from user” in the grouping result 51 of FIG. It is determined whether or not there is first usage data that matches the condition described in the data condition 322 of the "Request from user" of the information asset determination table 32.
The data condition 322 of the group "Request from user" is "data written to the component object by the operation belonging to the group" Data write "". In FIG. 6, the data “val” is written to the component object “device” by the operation “write (val)” belonging to the group “Data write”. Then, the data "val" is used in "write_and_read (id, pwd, val)" which is an operation belonging to "Request from user". Therefore, the data "val" meets the data condition 322 of the "Request from user", and the first information asset determination unit 23 decides to treat the data "val" as the first information asset. Further, in FIG. 8, the security characteristic 323 is “I” for the group “Request from user”. Therefore, the first information asset determination unit 23 determines "I" as one of the security characteristics of the data "val" which is the first information asset.
Further, in FIG. 8, as the data condition 322 of the group “Normal response user” in the third row, “data read from the component object by the operation belonging to the group“ Data read ”and provided to the user object” is defined. Has been done. Therefore, the first information asset determination unit 23 determines that "ans", which is data read by the device and reaches the user object, is treated as the first information asset. Then, the security characteristic of the data "ans" is determined to be "C".

If the same data also meets the data condition 322 of another group, the first information asset determination unit 23 maintains the value of each security characteristic without overwriting the security characteristic of the data. For example, it is assumed that the data "val" meets the data condition 322 in the fourth row of FIG. In this case, the first information asset determination unit 23 determines "A" in addition to the above-mentioned "I" as the security characteristic of the data "val". Then, in this case, the security characteristics of the data "val" are both "I" and "A".

The first information asset determination unit 23 determines the first information asset and determines the security characteristics for all the operations of the design model 41.

<< Details of step S323 in FIG. 7 >>
In step S323, the first information asset determination unit 23 writes the result obtained in step S322 to the memory 12.

As shown in FIG. 2, if there is no information asset at the time when all the processing in step S3 is completed, the information processing device 10 ends the processing. In this case, the information processing apparatus 10 may end the process after the output unit 25 outputs a message or the like for notifying that no information asset exists in the given design model 41.

(Step S4 in FIG. 2: Second information asset determination process)
When it is found that one or more information assets exist in step S3, the second information asset determination unit 24 further determines the second information asset based on the results in steps S2 and S3. , The security characteristic of the second information asset is determined (step S4).

Specifically, the second information asset determination unit 24 has usage data (second usage data) used in operations belonging to a specific attribute group and usage data determined as the first information asset (first). Whether or not to treat the second usage data as a second information asset is determined based on the relationship with the usage data of 1). For example, the second information asset determination unit 24 decides to treat the second usage data as the second information asset when the second usage data has a relationship of protecting the first usage data. Further, when the second usage data is used to determine whether or not to read or write the first usage data, the second information asset determination unit 24 uses the second usage data as the second information asset. Decide to treat as. Then, when the second information asset determination unit 24 decides to treat the second usage data as the second information asset, the security of the second usage data decided to be treated as the second information asset. Determine the characteristics.

FIG. 9 is a flowchart illustrating an operation example of the second information asset determination unit 24 in step S4.

First, the second information asset determination unit 24 reads the second information asset determination table 33 (step S41).

Next, the second information asset determination unit 24 performs a determination process including determination of the second information asset and determination of security characteristics for all the design models 41 received in step S1 (step S42). Specifically, in step S42, the second information asset determination unit 24 executes steps S421 to S424 described below for each design model 41. In the following, the processing for the i-th design model 41 will be described.

First, the second information asset determination unit 24 reads the grouping result 51 of the i-th design model 41 obtained in step S2 (step S421).

Next, the second information asset determination unit 24 reads the result of the determination of the first information asset and the determination of the security characteristics for the i-th design model 41 obtained in step S3 (step S423).

Next, the second information asset determination unit 24 of the second information asset determination table 33 read in step S41, the grouping result 51 read in step S421, and the first information asset read in step S422. Based on the result of the determination and the determination of the security characteristic, the second information asset is determined and the security characteristic is determined (step S424).

Finally, the second information asset determination unit 24 writes the result of step S423 to the memory 12 (step S424). That is, the second information asset determination unit 24 writes the second usage data determined as the second information asset and the security characteristics of the second usage data into the memory 12.

Next, the details of steps S41 to S42 and S421 to S424 of FIG. 9 will be described.

<Details of step S41 in FIG. 9>
In step S41, the second information asset determination unit 24 reads the second information asset determination table 33 from the storage 13. Next, the second information asset determination unit 24 writes the second information asset determination table 33 to the memory 12. Then, the second information asset determination unit 24 reads the second information asset determination table 33 from the memory 12.

FIG. 10 is an example of the second information asset determination table 33.
The second information asset determination table 33 will be described with reference to FIG.
The second information asset determination table 33 includes a group 331, a data condition 332, and a security characteristic 333 as table items.

Group 331 shows the name described in group 311 of the operation classification table 31 (FIG. 5). In FIG. 10, "Judgment of execution" is described in group 331.

The data condition 332 indicates a condition for treating the usage data used in any operation belonging to the group 331 as a second information asset.
In the example of FIG. 10, the data condition 332 corresponding to the group 331 "Judgment of execution" is described as "data used for determining whether or not the first information asset whose security characteristic is C can be read or written". There is. In the example of FIG. 10, the data conditions are written in natural language for easy understanding, but the data conditions are actually described in a format that can be processed by a computer.
In the second information asset determination table 33 of FIG. 10, data conditions are described for extracting the second information asset for protecting the first information asset.

The security characteristic 323 describes the security characteristic related to the second usage data extracted as the second information asset. In FIG. 10, “C” and “I” are described as security characteristics.

<Details of step S42 in FIG. 9>
In step S42, the second information asset determination unit 24 utilizes the result obtained in step S3 to determine the second information asset and determine the security characteristics of the second information asset. Specifically, the second information asset determination unit 24 performs steps S421 to S424 which will be described in detail below. In the following description, the process related to the i-th design model 41 will be described.

<< Details of step S421 in FIG. 9 >>
In step S421, the second information asset determination unit 24 reads the grouping result 51 in step S2 for the i-th design model 41 from the memory 12.
As shown in FIG. 6, the grouping result 51 is information indicating the result of grouping the operations included in the design model 41 and the relationship between the operations.

<< Details of step S422 in FIG. 9 >>
In step S422, the second information asset determination unit 24 reads the result of the determination of the first information asset and the determination of the security characteristics obtained in step S3 with respect to the i-th design model 41 from the memory 12.

<< Details of step S423 in FIG. 9 >>
In step S423, the second information asset determination unit 24 has the second information asset determination table 33 read in step S41, the grouping result 51 read in step S421, and the first information asset read in step S422. Based on the result of the determination and the determination of the security characteristic, the second information asset is determined and the security characteristic is determined.

Specifically, the second information asset determination unit 24 determines whether or not the second usage data used in the operation belonging to the group shown in the group 331 meets the condition shown in the data condition 332. judge. Then, the second information asset determination unit 24 decides to treat the second usage data that matches the condition shown in the data condition 332 as the second information asset. Further, the security characteristic of the second usage data treated as the second information asset is determined based on the security characteristic 333.

In FIG. 6, the execution of the conditional statement “user_check (id, pwd) = true” and the execution of “user_check (id, pwd) = false” of the control structure block 415 are operations belonging to the group “Judgment of execution”. be.
In "user_check (id, pwd) = true" and "user_check (id, pwd) = false", the data "id" and "pwd" are used. Therefore, the data "id" and "pwd" correspond to the second usage data, respectively.
Here, it is assumed that in step S3, the data “ans” read by the device and returned to the user object is extracted as the first information asset of the security characteristic “C”.
The second information asset determination unit 24 is based on the data condition 332 of the first row of the second information asset determination table 33 in FIG. It is determined whether or not "id" and [pwd] correspond to "data whose security characteristics are used for determining whether or not to read or write the first information asset of C" described in the data condition 332.
Here, the second information asset determination unit 24 reads and writes the data “ans” whose second usage data “id” and [pwd] are the first information assets of the security characteristic “C”. It is judged that it is used to judge whether or not it is possible. Then, the second information asset determination unit 24 decides to treat the second usage data "id" and [pwd] as the second information asset, respectively.
Further, the second information asset determination unit 24 sets the security characteristics of the second usage data "id" and [pwd] to "C" based on the item of the security characteristic 333 of the second information asset determination table 33. Is determined.

If the same second usage data also meets the data condition 322 of another group, the first information asset determination unit 23 does not overwrite the security characteristics of the second usage data, and each of them Maintain the value of security characteristics. For example, if the second information asset determination unit 24 determines "I" in addition to "C" as the security characteristic of the data "id" and "pwd", the security characteristic of the data "id" and "pwd" is Both "C" and "I".

The above-mentioned two conditional statements "user_check (id, pwd) = true" and "user_check (id, pwd) = false" are in the same control structure block 415, and have the same description except for the constants on the right side. .. Therefore, the second information asset determination unit 24 may treat the execution operation of these two conditional statements as one operation.

The second information asset determination unit 24 determines the second information asset and determines the security characteristics for all processes in the group of the design model 41.

<< Details of step S324 in FIG. 9 >>
In step S424, the second information asset determination unit 24 writes the result obtained in step S423 into the memory 12.

(Step S5 in FIG. 2: Information asset list output processing)
The output unit 25 accumulates the results of steps S3 and S4 in all the design models 41, and outputs the obtained information assets and security characteristics as a list of information assets.

FIG. 11 shows an example of the information asset list 34 output by the output unit 25.

The information asset list 34 includes a design model 341, an information asset 342, and a security characteristic 343. The design model 341 shows the identifier of the design model 41. Information assets 342 show information assets extracted by the first information asset determination unit 23 and the second information asset determination unit 24. The security characteristic 343 indicates the security characteristic of the information asset determined by the first information asset determination unit 23 and the second information asset determination unit 24.
For example, in the first line of FIG. 11, it is shown that the information asset “val” is extracted from the design model “1” and its security characteristic is “I”.

In the example of FIG. 11, the first information asset obtained by the first information asset determination unit 23 and the second information asset obtained by the second information asset determination unit 24 are not distinguished from each other, and the information asset 342 is not distinguished. It is shown in the item of. Instead, the first information asset and the second information asset may be distinguished from each other.
Further, in the example of FIG. 11, one line is assigned to one information asset. Therefore, when a plurality of security characteristics are determined for one information asset, a plurality of security characteristics are described together in one line (for example, the second to fourth lines in FIG. 11). Instead, one line may be assigned for each security characteristic. For example, the second line (line of "ans") in FIG. 11 is divided into two lines, the security characteristic 343 "C" is described in the first line, and the security characteristic 343 "I" is described in the second line. May be described.

*** Explanation of the effect of the embodiment ***
As described above, according to the present embodiment, it is possible to objectively extract information assets by excluding subjective elements. Further, according to the present embodiment, it is possible to objectively determine the security characteristics.

Further, in the present embodiment, the extraction of the second information asset for protecting the first information asset and the determination of the security characteristics of the second information asset are performed.
Therefore, according to the present embodiment, it is possible to objectively extract secondary information assets for protecting information assets, and objectively determine the security characteristics of secondary information assets. can do.

Embodiment 2.
In this embodiment, the difference from the first embodiment will be mainly described.
The matters not explained below are the same as those in the first embodiment.

In the first embodiment, only the security characteristics are displayed for each information asset in the information asset list 34 (FIG. 11) output by the output unit 25. That is, in the first embodiment, even if there is a difference in the number of appearances of the security characteristic, the difference in the number of appearances of the security characteristic is not reflected in the information asset list 34.
For example, it is assumed that the security characteristic "C" appears five times and the security characteristic "I" appears once for "ans" in the second line of FIG. Even in this case, only "C" and "I" are displayed in the information asset list of the first embodiment. Therefore, the user of the information processing apparatus 10 cannot recognize that the security characteristic "C" appears frequently.
Further, it is assumed that the security characteristic "C" appears 10 times and the security characteristic "A" appears once with respect to the "id" in the third line of FIG. Even in this case, only "C" and "I" are displayed for "ans" and only "C" and "A" are displayed for "id" in the information asset list of the first embodiment. Therefore, the user of the information processing apparatus 10 cannot recognize that the security characteristic "C" for the "id" appears frequently.

Therefore, in the present embodiment, the number of appearances of the security characteristic is displayed in the information asset list 34.
Specifically, the first usage data determined by the first information asset determination unit 23 to be treated as the first information asset is used in a plurality of operations, as in the first embodiment. In this case, the security characteristic associated with the first usage data is determined for each operation in which the first usage data is used. Then, in the present embodiment, the first information asset determination unit 23 counts the number of appearances of the security characteristic for each security characteristic of the first usage data. Similarly, when the second usage data determined to be treated as the second information asset is used in a plurality of operations, the second information asset determination unit 24 also first, in the same manner as in the first embodiment. , The security characteristic associated with the second usage data is determined for each operation in which the second usage data is used. Then, in the present embodiment, the second information asset determination unit 24 counts the number of appearances of the security characteristic for each security characteristic of the second usage data.
The output unit 25 includes the number of occurrences for each security characteristic counted by the first information asset determination unit 23 and the second information asset determination unit 24 in the information asset list 34.
As described above, in the present embodiment, since the number of appearances of the security characteristic is displayed in the information asset list 34, the user of the information processing apparatus 10 can recognize the more important information asset and the security characteristic.

As described above, according to this embodiment, it is possible to provide an index for objectively determining more important information assets and more important security characteristics.

Embodiment 3.
In this embodiment, the difference from the second embodiment will be mainly described.
The matters not explained below are the same as those in the second embodiment.

In the present embodiment, the value of the usage data determined by the first information asset determination unit 23 or the second information asset determination unit 24 to be treated as an information asset is determined based on the counting result of the number of appearances of security characteristics. decide. Here, as an example, the second information asset determination unit 24 determines the value of the usage data. Further, the second information asset determination unit 24 assumes that the value of the usage data is evaluated by a plurality of ranks. By performing the same processing as below, the first information asset determination unit 23 can also determine the value of the usage data.

First, the first information asset determination unit 23 counts the number of occurrences of each security characteristic of the first information asset, as described in the second embodiment.
Further, the second information asset determination unit 24 also counts the number of occurrences of the second information asset for each security characteristic as described in the second embodiment.
The second information asset determination unit 24 is notified by the first information asset determination unit 23 of the number of occurrences of the security characteristics counted for the first information asset. Then, the second information asset determination unit 24 determines the value of each of the first information asset and the second information asset based on the number of appearances of the security characteristic. The second information asset determination unit 24 determines the value of each of the first information asset and the second information asset by, for example, the method 1) or 2) below.
1) A threshold value for the number of appearances is set in advance for each rank, and the second information asset determination unit 24 determines the value of the information asset by comparing the threshold value for each rank with the counted number of appearances.
2) The second information asset determination unit 24 obtains the maximum and minimum values of the number of appearances, sets a threshold value of the number of appearances for each rank so that the information assets are evenly distributed among the ranks, and sets the threshold value for the number of appearances for each rank. The value of the information asset is determined by comparing the threshold value with the counted number of occurrences.
In both cases 1) and 2), the second information asset determination unit 24 is requested to compare the total number of occurrences of a plurality of security characteristics (for example, "C", "I" and "A") with the threshold value. You may do it. Further, the second information asset determination unit 24 may compare the threshold value with the maximum number of appearances among the number of appearances of the plurality of security characteristics. In addition, the second information asset determination unit 24 may compare the number of occurrences of a specific security characteristic specified in advance among the plurality of security characteristics with the threshold value.

As described above, according to this embodiment, the value of the information asset can be objectively determined.

Although the first to third embodiments have been described above, two or more of these embodiments may be combined and implemented.
Alternatively, one of these embodiments may be partially implemented.
Alternatively, two or more of these embodiments may be partially combined and implemented.
In addition, the configurations and procedures described in these embodiments may be modified as necessary.

*** Supplementary explanation of hardware configuration ***
Finally, a supplementary explanation of the hardware configuration of the information processing device 10 will be given.

In the storage 13 of the information processing device 10, for example, an OS (Operating System) is stored in addition to the program that realizes the functions of the functional components shown in FIG.
Then, at least a part of the OS is executed by the processor 11.
The processor 11 executes a program that realizes the functions of the functional components shown in FIG. 1 while executing at least a part of the OS.
When the processor 11 executes the OS, task management, memory management, file management, communication control, and the like are performed.
Further, at least one of the information, data, signal value, and variable value indicating the processing result of the functional component shown in FIG. 1 is stored in at least one of the memory 12, the storage 13, and the register and the cache memory in the processor 11. Will be done.
Further, the program that realizes the functions of the functional components shown in FIG. 1 may be stored in a portable recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. Then, a portable recording medium in which a program that realizes the functions of the functional components shown in FIG. 1 is stored may be distributed.

Further, the "units" of the input unit 21, the model analysis unit 22, the first information asset determination unit 23, the second information asset determination unit 24, and the output unit 25 are referred to as "circuits", "processes", or "procedures". It may be read as "processing".
Further, the information processing device 10 may be realized by a processing circuit. The processing circuit is, for example, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or an FPGA (Field-Programmable Gate Array).
In this specification, the superordinate concept of the processor and the processing circuit is referred to as "processing circuit Lee".
That is, the processor and the processing circuit are specific examples of the "processing circuit Lee", respectively.

10 information processing device, 11 processor, 12 memory, 13 storage, 14 communication interface, 21 input unit, 22 model analysis unit, 23 first information asset determination unit, 24 second information asset determination unit, 25 output unit, 31 Operation classification table, 32 first information asset determination table, 33 second information asset determination table, 34 information asset list, 41 design model, 51 grouping result, 311 group, 312 classification criteria, 321 group, 322 data conditions, 323 security characteristics, 331 groups, 332 data conditions, 333 security characteristics, 341 design models, 342 information assets, 343 security characteristics, 411 user objects, 412 component objects, 413 request messages, 414 response messages, 415 control structure blocks, 4151. Tag, 4152 partial block, 4153 partial block, 4154 condition.

Claims (13)

1. A grouping unit that groups multiple operations performed in the data processing system,
   It has an information asset determination unit that determines whether or not to treat the usage data as an information asset based on the attributes of the group obtained by grouping and the usage method of the usage data used in the operation belonging to the group. Information processing device.
2. The information asset determination department
   The information processing device according to claim 1, wherein when it is decided to treat the usage data as an information asset, the security characteristics associated with the usage data are determined.
3. The information asset determination department
   When a plurality of groups are obtained by grouping and it is decided to treat the first usage data used in the operation belonging to the first group, which is a group included in the plurality of groups, as an information asset, the plurality of groups. Select a group with a specific attribute as the second group from the groups in
   Claim 1 for determining whether or not to treat the second usage data as an information asset based on the relationship between the second usage data used in the operation belonging to the second group and the first usage data. The information processing device described in.
4. The information asset determination department
   When it is decided to treat the first usage data as an information asset, the security characteristics related to the first usage data are determined, and the security characteristics are determined.
   The information processing device according to claim 3, wherein the second group is selected when the security characteristic of the first usage data is a specific security characteristic.
5. The information asset determination department
   The information processing apparatus according to claim 3, wherein when it is decided to treat the second usage data as an information asset, the security characteristics related to the second usage data are determined.
6. The information processing device further
   The information processing device according to claim 1, further comprising an output unit that outputs an identifier of usage data determined to be treated as an information asset by the information asset determination unit.
7. The information processing device further
   Claim 2 has an identifier of usage data determined to be treated as an information asset by the information asset determination unit and an output unit that outputs security characteristics related to the usage data determined by the information asset determination unit. The information processing device described.
8. The information asset determination department
   The information processing apparatus according to claim 2, wherein at least one of confidentiality, integrity, and availability is selected as a security characteristic to which the usage data is related.
9. The information asset determination department
   Claim to select at least one of authenticity, liability traceability, non-repudiation, reliability, environmental impact, safety impact and health impact as the security characteristics associated with the usage data. The information processing apparatus according to 2.
10. The information asset determination department
    When the usage data decided to be treated as an information asset is used in a plurality of operations, the security characteristics related to the usage data are determined for each operation in which the usage data is used, and the usage data is used. The information processing device according to claim 1, wherein the number of appearances of the security characteristic is counted for each security characteristic.
11. The information asset determination department
    The information processing device according to claim 10, wherein the value of the usage data determined to be treated as an information asset is determined based on the counting result of the number of appearances of the security characteristic.
12. A computer groups multiple actions performed in a data processing system and
    An information processing method in which the computer determines whether or not to treat the usage data as an information asset based on the group attributes obtained by grouping and the usage data usage data used in the operations belonging to the group. ..
13. Grouping processing that groups multiple operations performed in the data processing system, and
    A computer performs an information asset determination process that determines whether or not to treat the usage data as an information asset based on the group attributes obtained by grouping and the usage method of the usage data used in the operation belonging to the group. Information processing program to be executed by.

Images