WO2024069875A1

WO2024069875A1 - Evaluation device, terminal, evaluation system, evaluation method, and recording medium

Info

Publication number: WO2024069875A1
Application number: PCT/JP2022/036509
Authority: WO
Inventors: 一彰中島; 衣緒古山
Original assignee: 日本電気株式会社
Priority date: 2022-09-29
Filing date: 2022-09-29
Publication date: 2024-04-04

Abstract

An evaluation device according to the present disclosure comprises: an evaluation index acquisition means that acquires a trust evaluation index for evaluating trustworthiness, the trust evaluation index being employed by an insurance company; an apparatus information acquisition means that acquires apparatus information pertaining to network apparatuses on a network for which a user entrepreneur purchases insurance; an inspection means that, on the basis of the trust evaluation index, inspects the network apparatuses using the apparatus information; an evaluation means that evaluates trustworthiness on the basis of the result of inspection; and an output means that outputs the result of evaluating trustworthiness.

Description

EVALUATION DEVICE, TERMINAL, EVALUATION SYSTEM, EVALUATION METHOD, AND RECORDING MEDIUM

This disclosure relates to an evaluation device, a terminal, an evaluation system, an evaluation method, and a recording medium.

　Methods for calculating insurance premiums for network devices are being considered.

For example, Patent Document 1 discloses that insurance premiums for computer and related equipment are calculated using information obtained by selecting and assessing each assessment item related to computers, etc. Patent Document 2 discloses that insurance premiums for industrial machinery are calculated based on the reliability rate of the industrial machinery calculated based on a reliability index that indicates the degree to which various functions contribute to the reliability of various elements related to the industrial machinery.

JP 2006-235961 A JP 2022-011368 A

Incidentally, there is an increasing demand for cyber insurance, which provides compensation for security risks. However, calculation of cyber insurance premiums and payment fees in the event of an incident are not always done systematically.

In addition, the criteria for judging the trustworthiness (reliability) of network devices differ depending on the standpoint and way of thinking of the evaluator. In the inventions described in Patent Documents 1 and 2, the information that is the basis for calculating insurance premiums is assessed based on the criteria from the standpoint of the evaluator. The trustworthiness required to calculate cyber insurance needs to be evaluated based on the index adopted by the insurance company that sells cyber insurance.

One example of the objective of this disclosure is to provide an evaluation device that can evaluate the trustworthiness of a cyber insurance that meets the standards adopted by insurance companies.

The evaluation device according to one aspect of the present disclosure includes an evaluation index acquisition means for acquiring a trust evaluation index used by an insurance company to evaluate trustworthiness, an equipment information acquisition means for acquiring equipment information of network equipment on a network insured by a user business operator, an inspection means for inspecting the network equipment using the equipment information based on the trust evaluation index, an evaluation means for evaluating trustworthiness based on the inspection results, and an output means for outputting the evaluation results of trustworthiness.

The evaluation system according to one aspect of the present disclosure is an evaluation system having a device information storage device that stores device information of network devices, and the evaluation device described above. The evaluation device includes an evaluation index acquisition means for acquiring a trust evaluation index used by an insurance company to evaluate trustworthiness, a device information acquisition means for acquiring device information of network devices on a network insured by a user business from the device information storage device, an inspection means for inspecting the network devices using the device information based on the trust evaluation index, an evaluation means for evaluating trustworthiness based on the inspection results, and an output means for issuing a certificate to attest to the trustworthiness evaluation results, attaching an electronic signature to the certificate, and storing it in the device information storage device.

In one aspect of the evaluation method disclosed herein, a computer acquires a trust evaluation index used by an insurance company to evaluate trustworthiness, acquires device information of network devices on a network insured by a user company, inspects the network devices using the device information based on the trust evaluation index, evaluates trustworthiness based on the inspection results, and outputs the trust evaluation results.

In one embodiment of the present disclosure, the recording medium stores a program that causes a computer to obtain a trust evaluation index used by an insurance company to evaluate trust, obtain device information of network devices on a network that a user business operator insures, inspect the network devices using the device information based on the trust evaluation index, evaluate trust based on the inspection results, and output the trust evaluation results.

One example of the effect of this disclosure is the provision of an evaluation device that can evaluate the trustworthiness of a system in accordance with the cyber insurance standards adopted by insurance companies.

FIG. 1 is a block diagram showing the configuration of an evaluation system according to the first embodiment. FIG. 2 is a diagram showing a hardware configuration in which the evaluation device according to the first embodiment is realized by a computer device and its peripheral devices. FIG. 3 is a flowchart of the evaluation system according to the first embodiment.

Next, the embodiment will be described in detail with reference to the drawings.

[First embodiment]
The evaluation device 100 in the first embodiment is, for example, a device for an insurance company that takes out cyber insurance on a user company's network to evaluate the trustworthiness indicating the reliability of network devices that constitute the network. The cyber insurance in this embodiment includes liability for damages to third parties due to cyber incidents such as cyber attacks, as well as repair costs required for network recovery. A network device is, for example, a device for relaying or transferring data on a network, such as a router, hub, gateway, or switch. In addition, a network in this embodiment refers to a network composed of network devices introduced by a user company.

The evaluation system 10 in this embodiment includes an evaluation device 100, an insurance company terminal 200 of an insurance company that requests the evaluation device 100 to evaluate the trustworthiness of a network device, and a device information storage device 300 that stores device information for each network device. The device information storage device 300 is owned by a platform operator that manages the device information for each network device. The insurance company may, for example, request a third-party evaluation agency to evaluate the trustworthiness of a network device through the platform operator.

The insurance company terminal 200 includes an evaluation index sending unit 201, a certificate acquisition unit 202, a matching unit 203, and a determination unit 204, which send the trust evaluation index adopted by the user business to the evaluation device 100. When sending the trust evaluation index to the evaluation device 100, the evaluation index sending unit 201 may also send information indicating that the user business has requested the user business to take out cyber insurance. The insurance company terminal 200 is not limited to being a terminal, and may be realized as a server (including the cloud).

The device information storage device 300 stores at least the configuration information and inspection information of the network devices as device information. The device information stored in the device information storage device 300 is updated when the network devices are replaced or the software is upgraded.

FIG. 1 is a block diagram showing the configuration of an evaluation device 100 in the first embodiment. Referring to FIG. 1, the evaluation device 100 includes an evaluation index acquisition unit 101, a device information acquisition unit 102, an inspection unit 103, an evaluation unit 104, and an output unit 105. The evaluation device 100 of this embodiment will be described in detail below.

2 is a diagram showing an example of a hardware configuration in which the evaluation device 100 in the first embodiment of the present disclosure is realized by a computer device 500 including a processor. As shown in FIG. 2, the evaluation device 100 includes a CPU (Central Processing Unit) 501, memories such as a ROM (Read Only Memory) 502 and a RAM (Random Access Memory) 503, a storage device 505 such as a hard disk for storing a program 504, a communication I/F (Interface) 508 for network connection, and an input/output interface 511 for inputting and outputting data. In the first embodiment, the trust evaluation index acquired by the evaluation index acquisition unit 101 is input to the evaluation device 100 via, for example, the communication I/F 508.

The CPU 501 runs an operating system to control the entire evaluation device 100 according to the first embodiment of the present invention. The CPU 501 also reads programs and data from a recording medium 506 mounted in, for example, a drive device 507 into memory. The CPU 501 also functions as the evaluation index acquisition unit 101, device information acquisition unit 102, inspection unit 103, evaluation unit 104, output unit 105, and parts of these in the first embodiment, and executes the processes or commands in the flowchart shown in FIG. 3, which will be described later, based on the programs.

The recording medium 506 is, for example, an optical disk, a flexible disk, a magneto-optical disk, an external hard disk, or a semiconductor memory. A recording medium that is part of the storage device is a non-volatile storage device, and the program is recorded therein. The program may also be downloaded from an external computer (not shown) that is connected to a communication network.

The input device 509 is realized, for example, by a mouse, keyboard, built-in key buttons, etc., and is used for input operations. The input device 509 is not limited to a mouse, keyboard, or built-in key buttons, but may be, for example, a touch panel. The output device 510 is realized, for example, by a display, and is used to check the output.

As described above, the first embodiment shown in FIG. 1 is realized by the computer hardware shown in FIG. 2. However, the means for realizing each part of the evaluation device 100 in FIG. 1 is not limited to the configuration described above. The evaluation device 100 may be realized by a single physically combined device, or may be realized by two or more physically separated devices connected by wire or wirelessly. For example, the input device 509 and the output device 510 may be connected to the computer device 500 via a network. The evaluation device 100 in the first embodiment shown in FIG. 1 may also be configured by cloud computing, etc.

In FIG. 1, the evaluation index acquisition unit 101 is a means for acquiring a trust evaluation index used by an insurance company to evaluate its trustworthiness. In this embodiment, the evaluation index acquisition unit 101 acquires the trust evaluation index from the evaluation index transmission unit 201 via a network.

Trustworthiness refers to the reliability of an entire network consisting of multiple network devices, for example, reliability in maintaining stable operation of the entire network. Trust evaluation indicators are perspectives for evaluating trustworthiness, and include the presence of risks to network devices, countermeasures against risks, the presence or absence of unauthorized functions such as backdoors, inspection status, and the visualization status of device information.

The results of the trustworthiness evaluation are used as a reference by insurance companies when underwriting insurance for user businesses, etc. Since trustworthiness is used for judgment by third parties, including user businesses and insurance companies, it is desirable for it to be expressed in a manner that allows for easy objective judgment. However, trustworthiness is not limited to numerical values, and may be data in a form other than numerical values, such as A to C. Specifically, trustworthiness can be, for example, as follows:

(1) Outage Risk The reliability of the outage risk is the possibility that a network device will be out of service and the predicted outage time in the event of outage. Alternatively, the outage risk is the average outage interval or the average recovery time. The outage risk may be the outage risk of a part of the network device. For example, a network device with a low outage risk is more reliable than a network device with a high outage risk.

(2) Information Leakage Risk Trustworthiness regarding information leakage risk is the presence or absence or possibility of information leakage for a network device, and the status of measures against information leakage, etc. The status of measures against information leakage is, for example, that all measures against information leakage have been implemented, that measures against serious information leakage have been implemented, that measures against information leakage have been identified, or that measures are not identified, etc. For example, a network device with a low risk of information leakage is more trustworthy than a network device with a high risk of information leakage.

(3) Backdoor The trustworthiness of a backdoor is the presence or absence of a backdoor in a network device, or the possibility of the existence of a backdoor. Alternatively, the trustworthiness of a backdoor may be the backdoor inspection state, such as the inspection method, inspection range, or inspection time of a backdoor in a network device. The backdoor inspection method is, for example, inspection using an inspection application, binary inspection of a program running on a network device, or source code inspection of a program. For example, a network device that has been inspected for a backdoor has a higher trustworthiness than a network device that has not been inspected for a backdoor.

(4) Risk Assessment The reliability of risk assessment refers to whether or not a risk assessment inspection of the vulnerability of a network device has been conducted, the inspection results, the implementation status of countermeasures, the time of inspection, or the time elapsed since the inspection, etc. The implementation status of vulnerability countermeasures may be that countermeasures have been implemented for all vulnerabilities, that countermeasures for serious vulnerabilities have been implemented, that countermeasures for vulnerabilities have been identified, or that countermeasures are not identified, etc. For example, a network device that has been inspected for a risk assessment is more reliable than a network device that has not been inspected for a risk assessment.

(5) Incident Response The reliability of an incident response is the defined state of a response when an incident occurs in a network. The reliability of an incident response may include a range of incidents for which responses are defined, such as a response for a major incident being defined. For example, a network device for which an incident response is defined is more reliable than a network device for which an incident response is not defined.

(6) Performance Evaluation Test Results The reliability of the performance evaluation test results is the presence or absence of the performance evaluation test results and the performance content in the test results. The reliability of the performance evaluation test results may be the test status of the performance evaluation, such as the test method, test scope, test time, or the elapsed time since the test was conducted. For example, a network device whose performance evaluation has been tested is more reliable than a network device whose performance evaluation has not been tested.

(7) Business The trustworthiness of a business is the state of understanding of the business of a user company and the state of preparation for recovery work for the business. The state of understanding of a business is, for example, the state of understanding of the scope of impact of each business, or the state of understanding of the priority of each business. For example, a network device whose business is understood is more trustworthy than a network device whose business is not understood. The state of preparation for recovery work is, for example, a state of preparation for recovery from a business with a large scope of impact or a business with a high priority when an incident occurs. For example, a network device for which recovery work is prepared is more trustworthy than a network device for which recovery work is not prepared.

(8) Developer The trustworthiness of a developer is the state of understanding of the attributes of the developer of a network device. The understanding state may be, for example, that the attributes of all developers are understood, that some attributes are not understood, or that some developers' attributes are not understood. The attributes may be, for example, nationality, affiliation, development location, or past career. The developer attributes are not limited to the attributes of a person such as an individual, but may also be the attributes of a corporation or organization such as a development manufacturer. For example, a network device whose developer attributes are understood is more trustworthy than a network device whose developer attributes are not understood.

(9) Supply Chain The trustworthiness of a supply chain is the trustworthiness of companies, etc., related to the supply chain of network devices. Companies related to the supply chain are, for example, companies that design, provide, maintain, and manage network devices. Furthermore, the trustworthiness of a company is, for example, the implementation status of a trustworthiness inspection in each company and the contents of the inspection results. The implementation status of an inspection is whether or not an inspection has been conducted, the extent to which an inspection has been conducted, or the extent to which an inspection has not been conducted. For example, a network device whose trustworthiness has been inspected with respect to companies that make up the supply chain is more trustworthy than a network device whose trustworthiness has not been inspected with respect to companies that make up the supply chain.

The trust evaluation index is an evaluation index for evaluating the trustworthiness of network equipment that meets the needs of user operators. For example, the trust evaluation index is an evaluation index for the above-mentioned trust items such as "presence or absence of a backdoor". The trust evaluation index may be a single evaluation index, a collection of multiple evaluation indexes, an integration of multiple evaluation indexes, or an evaluation index calculated using multiple evaluation indexes such as an average. The insurance company may create a trust evaluation index in accordance with the trust required for the network equipment of the user operator, or may obtain a trust evaluation index from a third-party organization or platform operator. The evaluation index acquisition unit 101 outputs the acquired trust evaluation index to the inspection unit 103.

The device information acquisition unit 102 is a means for acquiring device information of network devices on a network for which a user operator takes out insurance. The device information acquisition unit 102 acquires device information of the network device to be evaluated from, for example, the device information storage device 300. Device information is information required to evaluate the trustworthiness of a network device, and includes configuration information and inspection information. The device information storage device 300 stores, for example, configuration information and inspection information linked to each network device.

Configuration information is, for example, hardware information and software information of network devices. Hardware information is developer information, model numbers of chips, boards, ports, etc. that make up the hardware, and identifiers assigned to the hardware. Software information includes developer information, the OS (Operating System) that processes the hardware, software names such as libraries or applications, version information of that software, and code information of the software. Configuration information is updated when the configuration information is updated, such as when the software is upgraded.

Inspection information is information on the results of inspections based on the configuration information of network devices by businesses along the supply chain from procurement of network device parts to delivery. Inspection information includes the above-mentioned backdoor or risk assessment inspections. When the device information acquisition unit 102 acquires the device information of the network device to be evaluated, it outputs the information to the inspection unit 103.

The inspection unit 103 is a means for inspecting a network device using device information based on a trust evaluation index. A specific inspection method is as follows. That is, the inspection unit 103 creates inspection items for a network device to evaluate the trustworthiness of the network device based on configuration information and a trust evaluation index. For example, the inspection unit 103 creates inspection items for evaluating the trust evaluation index for the network device to be evaluated.

In other words, the items to be inspected for the above-mentioned trust evaluation indicators (1) to (9) are predetermined, and the inspection unit 103 selects an inspection item according to the trust evaluation indicator selected for the insured network device or network. For example, if the trust evaluation indicator is a backdoor, the inspection unit 103 creates an inspection item to inspect the possibility of a backdoor for the network device to be inspected. The inspection unit 103 may create multiple inspection items for one trust evaluation indicator, or may create one inspection item for multiple trust evaluation indicators.

Next, the inspection unit 103 inspects the network device using the evaluation criteria of the trust evaluation index for each created inspection item. The inspection unit 103 may display the inspection result for each trust evaluation index as a binary value of 0 or 100, or may display it as a specific rank such as A to C. The inspection unit 103 may also display the inspection result for each trust evaluation index as a numerical value (score) such as 0 to 100%.

The evaluation unit 104 is a means for evaluating the trustworthiness based on the test results. The evaluation unit 104 comprehensively evaluates the trustworthiness of the network device based on the test results of each trust evaluation index.

The evaluation unit 104 evaluates the trustworthiness, for example, by calculating the sum or average value of the test results of each trust evaluation index. Furthermore, the evaluation unit 104 may determine that the trustworthiness is not satisfied if the test result of any of the trust evaluation indexes is 0, or that the trustworthiness is not satisfied if the test result of a predetermined trust evaluation index is equal to or lower than a predetermined value. However, the method of evaluating the trustworthiness by the evaluation unit 104 is not limited to these.

The output unit 105 is a means for outputting the evaluation result of the trustworthiness of the network device. For example, the output unit 105 displays the evaluation result of the trustworthiness on an output device 510 such as a display. The output unit 105 may also output the evaluation result of the trustworthiness of the network device to a user operator or an insurance company. The output unit 105 may also issue a certificate to certify the evaluation result of the trustworthiness. The certificate is issued to a third party, including the user operator and the insurance company, to certify the evaluation result of the trustworthiness of the network device. In this case, the output unit 105 affixes an electronic signature to the certificate describing the evaluation result of the trustworthiness, and stores it in the device information storage device 300 together with the public key.

Next, the configuration of the insurance company terminal 200 will be described. When a certificate of the trust evaluation result is issued by the output unit 105, the insurance company terminal 200 performs processing up to determining the insurance premium. The certificate acquisition unit 202 is a means for acquiring the certificate issued by the evaluation device 100. The certificate acquisition unit 202 acquires the certificate stored in the device information storage device 300. The certificate acquisition unit 202 may also acquire from the user business the certificate that the user business acquired from the device information storage device 300. The certificate acquisition unit 202 outputs the acquired certificate to the comparison unit 203.

The matching unit 203 is a means for matching, based on the certificate, whether the network equipment installed in the user operator is the same as the network equipment covered by the insurance. Specifically, the matching unit 203 uses the public key to decrypt the hash value of the electronic signature included in the certificate input from the certificate acquisition unit 202, and compares it with the hash value of the network equipment installed in the user operator to match it with the network equipment installed in the user operator. If the two network devices are not the same, the matching unit 203 again requests a third party to evaluate the trustworthiness of the network equipment that is the same as the network equipment installed in the user operator.

The determination unit 204 is a means for determining the insurance premium based on the evaluation result of the trustworthiness. The determination unit 204 increases or decreases the insurance premium from a predetermined standard insurance premium based on the level of trustworthiness for each trust evaluation index. For example, for (4) risk assessment, among the examples of the trust evaluation indexes mentioned above, the determination unit 204 increases the insurance premium from the standard insurance premium if measures against vulnerabilities are not understood. On the other hand, the determination unit 204 decreases the insurance premium from the standard insurance premium if measures against vulnerabilities are understood. The determination unit 204 may determine the degree of increase or decrease from the standard insurance premium based on the degree of understanding of measures against vulnerabilities.

Furthermore, for (5) incident response, one of the examples of the evaluation indexes of trustworthiness, if countermeasures against risks are defined and incident response is easy, the decision unit 204 reduces the insurance premium from the standard premium. On the other hand, if countermeasures against risks are not defined and incident response is difficult, the decision unit 204 increases the insurance premium from the standard premium.

Furthermore, the decision unit 204 reduces the insurance premium from the standard insurance premium for (7) business operations if the business is ready to recover from the business scope with a high priority when an incident occurs. On the other hand, the decision unit 204 increases the insurance premium from the standard insurance premium if the business is not ready to recover from the business scope with a high priority when an incident occurs.

The determination unit 204 may notify the user operator of the insurance premium for the user operator's network determined in this manner.

The operation of the evaluation system 10 configured as above will be explained with reference to the flowchart in FIG. 3.

FIG. 3 is a flowchart showing an overview of the operation of the evaluation device 100 in the first embodiment. Note that the processing according to this flowchart may be executed based on program control by the processor described above.

As shown in FIG. 3, first, the evaluation index sending unit 201 in the insurance company terminal 200 sends the trust evaluation index used by the insurance company to the evaluation device 100 (step S101). Next, the evaluation index acquisition unit 101 in the evaluation device 100 acquires the trust evaluation index used by the insurance company from the insurance company terminal 200 (step S102). Next, the device information acquisition unit 102 acquires device information of the network devices on the network insured by the user company (step S103). Next, the inspection unit 103 inspects the network devices based on the trust evaluation index (step S104). Next, the evaluation unit 104 evaluates the trust based on the inspection result (step S105). Next, the output unit 105 issues a certificate to certify the trust evaluation result (step S106).

Meanwhile, the certificate acquisition unit 202 in the insurance company terminal 200 acquires the certificate issued by the evaluation device 100 (step S107). The comparison unit 203 uses the certificate to check whether the network device installed in the user business is the same as the network device covered by the insurance (step S108). Finally, the determination unit 204 checks the identity of both network devices, and then determines the insurance premium for the network composed of the network devices based on the results of the trust evaluation (step S109). With this, the evaluation system 10 terminates its operation.

In the evaluation device 100 of this embodiment, the evaluation index acquisition unit 101 acquires the trust evaluation index adopted by the insurance company, the inspection unit 103 inspects the network device based on the trust evaluation index, and the evaluation unit 104 evaluates the trustworthiness based on the inspection results. This makes it possible to evaluate the trustworthiness in accordance with the cyber insurance standards adopted by the insurance company.

In addition, in this embodiment, the output unit 105 issues a certificate by attaching an electronic signature to the trust evaluation result. This ensures the validity of the trust evaluation result. An insurance company that obtains a trust certificate can use the valid trust evaluation result, and can therefore determine cyber insurance premiums for the user operator's network based on the highly reliable trust evaluation result.

A modified version of this embodiment will be described, focusing on the differences from the first embodiment. In the first embodiment, the inspection unit 103 performs all the inspections to evaluate the trust evaluation index. In contrast, in the modified version, it is assumed that the user operator has already performed an evaluation of the trust of the network device. In this case, the network device is inspected only for items that have not been inspected, using the results of the already performed trust evaluation. In other words, the inspection unit 103 creates inspection items that have not been performed to evaluate the trust evaluation index. Next, the inspection unit 103 inspects the network device using the evaluation criteria of the trust evaluation index for each created inspection item. For example, if the presence or absence of a backdoor is included as an inspection item for the trust evaluation index, but an inspection for a backdoor has already been performed, the inspection unit 103 omits the creation of an inspection item for the presence or absence of a backdoor. In addition, the evaluation unit 104 evaluates the trust based on the inspection results performed by the inspection unit 103 and the inspection results already performed by the user operator. However, even if the user operator has evaluated the trustworthiness of the network device, if the inspection time is before the specified time, the inspection unit 103 may perform all inspections to evaluate the trust evaluation index without using the inspection results performed by the user operator. Note that the configuration of the evaluation device 100 is the same except for the inspection unit 103 and evaluation unit 104.

In this modified example, when a user business operator evaluates the trustworthiness of network devices, the determination unit 204 in the insurance company terminal 200 determines the insurance premium based on the inspection items inspected by the inspection unit 103. Specifically, the determination unit 204 deducts from the insurance premium calculated based on the results of the trustworthiness evaluation the costs corresponding to the items not inspected by the inspection unit 103.

The present invention has been described above with reference to each embodiment, but the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

For example, although multiple operations are described in sequence in the form of a flowchart, the order of description does not limit the order in which the multiple operations are performed. Therefore, when implementing each embodiment, the order of the multiple operations can be changed to the extent that does not interfere with the content. In the flowchart of FIG. 3, in step S106, the output unit 105 issues a certificate to attest to the trust evaluation result. However, the output unit 105 may simply output the trust evaluation result to the output device 510. In this case, no subsequent processing is performed in the insurance company terminal 200.

REFERENCE SIGNS LIST 10 Evaluation system 100 Evaluation device 101 Evaluation index acquisition unit 102 Device information acquisition unit 103 Inspection unit 104 Evaluation unit 105 Output unit 200 Insurance company terminal 201 Evaluation index transmission unit 202 Certificate acquisition unit 203 Collation unit 204 Determination unit 300 Device information storage device

Claims

An evaluation index acquisition means for acquiring a trust evaluation index for evaluating the trustworthiness adopted by an insurance company;
A device information acquisition means for acquiring device information of a network device on a network insured by a user company;
an inspection means for inspecting the network device using the device information based on the trust evaluation index;
An evaluation means for evaluating the trustworthiness based on the result of the inspection;
and an output unit for outputting the evaluation result of the trustworthiness.
The evaluation device according to claim 1, wherein the output means issues a certificate to attest to the trust evaluation result.
The evaluation device according to claim 1 or claim 2, wherein the inspection means inspects the network device for items not inspected in the trust evaluation when the user operator is conducting an evaluation of the trust of the network device.
The evaluation device according to any one of claims 1 to 3, wherein the device information includes configuration information and inspection information of the network device.
A certificate acquisition means for acquiring a certificate issued by the evaluation device according to any one of claims 2 to 4;
a verification means for verifying whether a network device installed in a user company is identical to a network device covered by the insurance based on the certificate;
a determination means for determining an insurance premium for the network configured by the network devices based on a result of the evaluation of the trustworthiness after the verification;
A terminal comprising:
The terminal according to claim 5, wherein the determining means calculates the insurance premium based on the inspection items inspected when the user operator has evaluated the reliability of the network device.
a device information storage device that stores device information of the network device;
An evaluation system comprising the evaluation device according to any one of claims 1 to 4,
The evaluation device includes an evaluation index acquisition means for acquiring a trust evaluation index for evaluating the trustworthiness adopted by an insurance company;
a device information acquisition means for acquiring device information of a network device on a network insured by a user company from the device information storage device;
an inspection means for inspecting the network device using the device information based on the trust evaluation index;
An evaluation means for evaluating the trustworthiness based on the result of the inspection;
an output means for issuing a certificate for attesting to the evaluation result of the trustworthiness, and storing the certificate in the device information storage device with a digital signature attached thereto.
The computer
Obtain a trust evaluation index to evaluate the trustworthiness of insurance companies,
Obtaining device information of network devices on the network that the user company is insuring,
Inspecting a network device using device information based on the trust evaluation index;
Evaluating the reliability based on the results of the inspection;
and outputting the evaluation result of the trust.
Obtain a trust evaluation index to evaluate the trustworthiness of insurance companies,
Obtaining device information of network devices on the network that the user company is insuring,
Inspecting a network device using device information based on the trust evaluation index;
Evaluating the reliability based on the results of the inspection;
A recording medium storing a program for causing a computer to execute outputting the evaluation result of the trustworthiness.