JP6907762B2 - Information processing equipment, programs and information processing systems - Google Patents

Description

The present invention relates to information processing devices, programs and information processing systems .

In recent years, information leakage has become a problem in which internal employees and staff (hereinafter referred to as employees) leak information assets held by companies and organizations. Incidents such as information leakage caused by such internal fraud include the outflow of information assets due to the distribution of electronic data and the outflow of information assets due to the taking out of paper media output using an image forming device. Measures are required.

On the other hand, in Patent Document 1, for example, in order to prevent the outflow of information assets due to the distribution of electronic data, the transmission and reception of e-mails are monitored, and the risk of information leakage by e-mails is predicted from the destination and the content of the text. The method is disclosed.

However, for example, it is difficult to detect the act of taking out the paper medium output by using the image forming apparatus.

The present invention has been made in view of the above problems, and an object of the present invention is to determine the behavior of a user who uses an image forming apparatus by using the usage status of the image forming apparatus and the like.

The information processing system according to each embodiment of the present invention has the following configuration. That is,
The first information indicating the usage status of the job executed in the image forming apparatus, the second information indicating the attributes of the user who executed the job, and the third information regarding the data to be executed by the job. And a calculation means for calculating the first value according to the job using
The behavior of each user is determined based on the total value and the average value of the first values calculated for each user using the first value of each job executed within a predetermined period. Has a determination means ,
The determination means is provided in each region of the coordinate space formed by the first axis showing the distribution of the total value of the first value and the second axis showing the distribution of the average value of the first value. , The behavior of each user is determined by referring to the determination index to which the information indicating the risk of information leakage of the user is assigned .

According to the present invention, the behavior of the user of the image forming apparatus can be determined by using the usage status of the image forming apparatus and the like.

It is a figure which shows an example of the system configuration of the information leakage risk determination system. It is a figure which shows an example of the hardware configuration of a server device. It is a figure which shows an example of the data stored in the management data storage part. It is a figure which shows an example of the data stored in a job data storage part. It is a figure which shows an example of the functional structure of the information leakage risk determination service part. It is a figure which shows an example of the person attribute scoring index stored in the scoring index storage part. It is a figure which shows an example of the usage situation scoring index stored in the scoring index storage part. It is a figure which shows an example of the information content scoring index stored in the scoring index storage part. It is a figure which shows an example of the score output by quantifying the information contained in each job of job data. It is a figure which shows an example of the addition result which weighted and added the score for each person to be monitored. It is a figure which shows an example of the addition result which weighted and added the score for each person to be monitored. It is a figure which shows an example of the addition result which weighted and added the score for each person to be monitored. It is a figure which shows an example of the calculation result of the determination parameter which determines the information leakage risk. It is a figure which shows an example of the judgment index which shows the relationship between the judgment parameter and the information leakage risk. It is a figure which shows an example of the determination result of the information leakage risk. It is a figure which shows an example of a report. It is a sequence diagram which shows the flow of the information leakage risk determination service provision processing in an information leakage risk determination system. It is a flowchart which shows the flow of the information leakage risk determination processing by a server device.

Hereinafter, details of each embodiment will be described with reference to the accompanying drawings. In the description of the specification and the drawings according to each embodiment, the components having substantially the same functional configuration are designated by the same reference numerals to omit duplicate explanations.

[First Embodiment]
<1. System configuration of information leakage risk judgment system>
First, the system configuration of the information leakage risk determination system, which is an example of the information processing system, will be described. FIG. 1 is a diagram showing an example of a system configuration of an information leakage risk determination system. As shown in FIG. 1, the information leakage risk determination system 100 includes a server device 110 that provides an information leakage risk determination service, and each device owned by a company to which the service is provided. It is connected via the network 130.

The server device 110 is an example of an information processing device. An information leakage risk determination program is installed in the server device 110. The server device 110 functions as an information leakage risk determination service unit 111 by executing the program.

The information leakage risk determination service unit 111 processes the management data and the job data transmitted from the service providing company and stored in the management data storage unit 112 and the job data storage unit 113, respectively. As a result, the information leakage risk determination service unit 111 determines the information leakage risk of the person to be monitored in response to the request from the service providing company, and outputs a report according to the determination result.

As shown in FIG. 1, each device owned by the service providing company includes a management device 121 and an MFP (Multi-Function Peripheral) 122_1 to 122_m. Further, each device owned by the service target company includes a PC (Personal Computer) 123_1 to 123_n. The devices are connected to each other via a LAN (Local Area Network) 124.

The management device 121 manages the personal attribute data of the employees engaged in the company to which the service is provided. Further, the management device 121 manages the device attribute data of the MFPs 122_1 to 122_m among the devices owned by the service providing company. Further, the management device 121 manages the information attribute data of the information assets (electronic data) possessed by the service providing company.

The management device 121 transmits personal attribute data, device attribute data, and information attribute data as management data to the server device 110. As a result, the server device 110 identifies the person to be monitored based on the person attribute data, identifies the device to be monitored based on the device attribute data, and the electronic object to be monitored based on the information attribute data. Data or paper media can be identified.

Further, the management device 121 requests the server device 110 to provide the information leakage risk determination service after transmitting the management data. As a result, the management device 121 can acquire a report according to the determination result of the information leakage risk from the server device 110.

The MFPs 122_1 to 122_m are examples of printing devices. The MFPs 122_1 to 122_m operate by logging in to an employee engaged in a company to which the service is provided, and execute various jobs (print job, copy job, facsimile (FAX) job, etc.). The MFPs 122_1 to 122_m transmit job data to the server device 110 each time various jobs are executed.

PC123_1 to 123_n operates by logging in to an employee engaged in a company to which the service is provided, and various processes (for example, a process of reading electronic data stored in a predetermined folder and printing via the MFP 122_1 to 122_m, etc.) ) Is executed.

<2. Hardware configuration of each device in the information leakage risk determination system>
Next, among the devices included in the information leakage risk determination system 100, the hardware configuration of the server device 110 will be described. FIG. 2 is a diagram showing an example of the hardware configuration of the server device.

As shown in FIG. 2, the server device 110 includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, and a RAM (Random Access Memory) 203. The CPU 201, ROM 202, and RAM 203 form a so-called computer.

Further, the server device 110 includes an auxiliary storage unit 204, an input unit 205, a display unit 206, and a communication unit 207. Each part of the server device 110 is connected to each other via the bus 208.

The CPU 201 executes various programs (for example, an information leakage risk determination program) stored in the auxiliary storage unit 204.

ROM 202 is a non-volatile memory. The ROM 202 functions as a main storage device that stores various programs, data, and the like necessary for the CPU 201 to execute various programs stored in the auxiliary storage unit 204. Specifically, it stores boot programs such as BIOS (Basic Input / Output System) and EFI (Extensible Firmware Interface).

The RAM 203 is a volatile memory such as a DRAM (Dynamic Random Access Memory) or a SRAM (Static Random Access Memory). The RAM 203 functions as a main storage device that provides a work area that is expanded when various programs stored in the auxiliary storage unit 204 are executed by the CPU 201.

The auxiliary storage unit 204 is an auxiliary storage device that stores various programs executed by the CPU 201 and various data used when the various programs are executed by the CPU 201. The management data storage unit 112 and the job data storage unit 113 are realized in the auxiliary storage unit 204.

The input unit 205 is an input device for the administrator of the server device 110 to input various instructions. The display unit 206 is a display device for displaying various information included in the server device 110.

The communication unit 207 is a communication device for communicating with the management device 121 and the MFPs 122_1 to 122_m via the network 130.

The hardware configuration of the management device 121 and PC123_1 to PC123_n is also substantially the same as the hardware configuration of the server device 110 (FIG. 2). Further, the MFPs 122_1 to 122_m have the same hardware configuration as a general MFP (image forming apparatus). Therefore, the description of these hardware configurations is omitted here.

<3. Description of data stored in the storage section of the server device>
Next, the management data stored in the management data storage unit 112 of the server device 110 and the job data stored in the job data storage unit 113 will be described.

(1) Description of Management Data First, the management data stored in the management data storage unit 112 will be described. FIG. 3 is a diagram showing an example of management data stored in the management data storage unit. Of these, FIG. 3A is a diagram showing an example of the person attribute data 310.

As shown in FIG. 3A, the person attribute data 310 includes "person ID", "name", "affiliation", "affiliated department PC", and "affiliated department MFP" as information items. In addition, the personal attribute data 310 includes "regular employee / dispatched employee", "years of service", "retirement schedule", "demotion history", "incident history", and "other personnel information" as information items.

The "person ID" stores an identifier for identifying the person to be monitored among the employees engaged in the company to which the service is provided. In "name", the name of the person identified by the corresponding person ID is stored.

In "affiliation", the department name to which the person identified by the corresponding person ID belongs is stored. The device ID of the PC assigned to the department to which the person identified by the corresponding person ID belongs is stored in the "affiliated department PC". In the "affiliated department MFP", the device ID of the MFP assigned to the department to which the person identified by the corresponding person ID belongs is stored.

In "regular employee / dispatched employee", the employment form of the person identified by the corresponding person ID is stored. In the "years of service", the number of years that the person identified by the corresponding person ID has worked for the company to which the service is provided is stored.

In the "retirement schedule", information indicating whether or not the person identified by the corresponding person ID is scheduled to retire or information indicating whether or not there is a sign of retirement is stored. The "demotion history" stores information indicating whether or not the person identified by the corresponding person ID has been demoted in terms of personnel. The "incident history" stores information indicating whether or not the person identified by the corresponding person ID has a history of being involved in an information leakage incident. "Other personnel information" stores other personnel information about the person identified by the corresponding person ID.

FIG. 3B is a diagram showing an example of the device attribute data 320. As shown in FIG. 3B, the device attribute data 320 includes "device ID", "model", and "arrangement" as information items.

The "device ID" stores a device ID for identifying the MFP to be monitored among the devices owned by the service providing company. The "model" stores the type of MFP identified by the corresponding device ID. In the "arrangement", information regarding the arrangement location of the MFP identified by the corresponding device ID (area name, information indicating whether the MFP is in an inconspicuous place or in a conspicuous place) is stored.

FIG. 3C is a diagram showing an example of the information attribute data 330. As shown in FIG. 3C, the information attribute data 330 includes "print file name", "URL", and "document detection keyword" as information items.

The "print file name" stores a specific word included in the file name of the electronic data to be monitored among the information assets owned by the service providing company. The "URL" is a URL (Uniform Resource Locator) indicating the storage location of the site printed via the device to be monitored, and is included in the URL of the site that is highly likely to be accessed by private use. Contains a specific word. The "in-document detection keyword" stores a specific word contained in electronic data or a paper medium to be monitored among the information assets owned by the service providing company.

(2) Description of Job Data Next, the job data stored in the job data storage unit 113 will be described. FIG. 4 is a diagram showing an example of job data stored in the job data storage unit. Here, an example of job data 400 transmitted from the MFP 122_1 identified by the device ID = "MFP001" and stored in the job data storage unit 113 is shown.

As shown in FIG. 4, the job data 400 includes "time", "day of the week", and "job instructor" as information items. These items are common items regardless of the type of job.

Information indicating the job execution date and time and the day of the week are stored in "time" and "day of the week", respectively. In the "job instructor", a person ID that identifies the person who has instructed to execute the job is stored.

Further, as shown in FIG. 4, the job data 400 includes "PC used", "print file name", "number of prints", and "execution / cancellation" as information items. These items are related to print jobs.

The "used PC" stores a device ID that identifies a PC (device used for job execution instruction) to send print data when the MFP 122_1 executes a print job. In the "print file name", the file name of the print data printed out when the MFP122_1 executes the print job is stored.

The "number of prints" stores the number of paper media printed out when the MFP 122_1 executes a print job. In "execute / cancel", information indicating whether the MFP 122_1 has completed the execution of the print job or interrupted in the middle is stored.

Further, as shown in FIG. 4, the job data 400 includes "in-document detection keyword", "number of copies", and "double-sided / single-sided" as information items. These items are copy job related items.

In the "document detection keyword", the keyword detected from the paper medium to be scanned when the MFP 122_1 executes the copy job is stored. The "number of copies" stores the number of paper media printed out when the MFP 122_1 executes the copy job. In "double-sided / single-sided", the setting contents (information indicating the double-sided printing setting or the single-sided printing setting) at the time of executing the copy job of the MFP 122_1 are stored.

Further, as shown in FIG. 4, the job data 400 includes "number of faxes", "fax transmission destination", and "fax transmission source" as information items. These items are fax job related items.

The "number of faxes" stores the number of paper media scanned when the MFP122_1 faxed. In the "FAX destination", the FAX number of the destination to which the MFP122_1 has faxed is stored. In the "FAX transmission source", the FAX number of the transmission source of the FAX when the MFP122_1 receives the FAX is stored.

<4. Functional configuration of server device>
Next, the functional configuration of the information leakage risk determination service unit 111 of the server device 110 will be described. FIG. 5 is a diagram showing an example of the functional configuration of the information leakage risk determination service unit.

As shown in FIG. 5, the information leakage risk determination service unit 111 has a scoring unit 500 (person attribute scoring unit 501, usage status scoring unit 502, information content scoring unit 503). Further, the information leakage risk determination service unit 111 includes a person-specific score calculation unit 504, a determination parameter calculation unit 505, an action determination unit 506, and a determination result output unit 507. Hereinafter, the processing of each part of the information leakage risk determination service unit 111 will be described with reference to FIGS. 6 to 16.

(1) Processing of the person attribute scoring unit The person attribute scoring unit 501 reads out the person attribute data 310 stored in the management data storage unit 112, and among the employees engaged in the company to be provided with the service, the person is monitored. Identify the person who becomes.

Further, the person attribute scoring unit 501 reads the job data 400 from the job data storage unit 113, and also reads the person attribute scoring index, which is one of the indexes related to information leakage, from the scoring index storage unit 511.

Further, the person attribute scoring unit 501 quantifies the information of each job of the job data 400 by comparing the job data 400 with the person attribute scoring index while referring to the person attribute data 310, and obtains the person attribute score. (An example of the second information) is output.

FIG. 6 is a diagram showing an example of a person attribute scoring index stored in the scoring index storage unit. As shown in FIG. 6, the person attribute scoring index 600 includes "scoring items" and "scores" as information items.

In the "scoring item", an evaluation item for quantifying the attribute of the person to be monitored from the viewpoint of information leakage is stored. In the example of FIG. 6, "retirement schedule", "demotion history", and "incident history" are stored as scoring items.

The "score" stores the score for quantifying the attributes of the person to be monitored for the corresponding scoring item.

The person attribute scoring unit 501 refers to the person attribute data 310 and scores when outputting the person attribute score of the person identified by the person ID stored in the "job instructor" of each job of the job data 400. Get the information of the item corresponding to the item. In the case of FIG. 6, the scoring items include "retirement schedule", "demotion history", and "incident history". Therefore, the person attribute scoring unit 501 acquires the information of the item corresponding to the scoring item ("retirement schedule", "demotion history", "incident history") by referring to the person attribute data 310. ..

In the personal attribute data 310, it is assumed that the item corresponding to the "retirement schedule" stores information indicating that there is a retirement schedule or a sign of retirement. In this case, the person attribute scoring unit 501 outputs "5 points" as the person attribute score of the person identified by the person ID.

On the other hand, in the person attribute data 310, when the information is not stored in the item corresponding to the "retirement schedule", the person attribute scoring unit 501 sets the person attribute score of the person identified by the person ID to "0". "Point" is output.

Further, it is assumed that in the person attribute data 310, information indicating that the person has been demoted for personnel purposes is stored in the item corresponding to the "demotion history". In this case, the person attribute scoring unit 501 outputs "5 points" as the person attribute score of the person identified by the person ID.

On the other hand, in the person attribute data 310, when the information is not stored in the item corresponding to the "demotion history", the person attribute scoring unit 501 outputs "0 points" as the person attribute score.

Further, it is assumed that in the person attribute data 310, the item corresponding to the "incident history" stores information indicating that there is a history of being involved in the information leakage incident. In this case, the person attribute scoring unit 501 outputs "5 points" as the person attribute score of the person identified by the person ID.

On the other hand, in the person attribute data 310, when the information is not stored in the item corresponding to the "demotion history", the person attribute scoring unit 501 outputs "0 points" as the person attribute score.

(2) Processing of Usage Status Scoring Unit The usage status scoring unit 502 reads out the device attribute data 320 stored in the management data storage unit 112 and becomes a monitoring target among the devices owned by the service providing company. Identify the MFP.

Further, the usage status scoring unit 502 reads the job data 400 stored in the job data storage unit 113, and also reads the usage status scoring index, which is one of the indexes related to information leakage, from the scoring index storage unit 511. ..

Further, the usage status scoring unit 502 quantifies the information of each job in the job data by comparing the job data 400 with the usage status scoring index while referring to the person attribute data 310 and the device attribute data 320. do. As a result, the usage status scoring unit 502 outputs the usage status score (an example of the first information).

FIG. 7 is a diagram showing an example of a usage status scoring index stored in the scoring index storage unit. As shown in FIG. 7, the usage status scoring index 700 includes "scoring items" and "scores" as information items.

In the "scoring item", an evaluation item for quantifying the usage status of the monitored MFP from the viewpoint of information leakage is stored. In the example of FIG. 7, “used MFP”, “used PC”, “day of the week”, “time”, “number of prints”, and “fax destination” are stored as scoring items.

The "score" stores the score for quantifying the usage status of the MFP to be monitored for the corresponding scoring item.

The usage status scoring unit 502 acquires information on items corresponding to the scoring items from the job data 400. In the case of FIG. 7, the scoring items include "used MFP", "used PC", "day of the week", "time", "number of prints", and "fax destination". Therefore, the usage status scoring unit 502 acquires the information of the item corresponding to the scoring item from the job data 400.

For example, the usage status scoring unit 502 acquires the device ID stored in the "utilization MFP" from the job data 400. Then, the usage status scoring unit 502 refers to the device attribute data 320 and acquires the information stored in the "arrangement" of the acquired device ID.

When information indicating that the location is inconspicuous is stored in the "arrangement" of the device attribute data 320, the usage status scoring unit 502 outputs "5 points" as the usage status score for the "usage MFP". do.

On the other hand, when the information indicating that the place is conspicuous is stored in the "arrangement" of the device attribute data 320, the usage status scoring unit 502 sets "0 points" as the usage status score for the "usage MFP". Output.

Further, the usage status scoring unit 502 acquires the device ID stored in the "used PC" from the job data 400. At this time, the usage status scoring unit 502 also acquires the person ID stored in the "job instructor" from the job data 400.

Then, the usage status scoring unit 502 refers to the device ID of the "affiliated department PC" corresponding to the person ID in the person attribute data 310, and determines whether or not it matches the device ID acquired from the job data 400. do. As a result of the determination, if they do not match (when it is determined that the PC is not the PC of the department to which the user belongs), the usage status scoring unit 502 outputs "5 points" as the usage status score for the "usage PC".

On the other hand, if the results of the determination match (when it is determined that the PC belongs to the department to which the user belongs), the usage status scoring unit 502 outputs "0 points" as the usage status score for the "usage PC".

Further, the usage status scoring unit 502 acquires the information stored in the "day of the week" from the job data 400. When the acquired information is information indicating that it is a Sunday or a holiday, the usage status scoring unit 502 outputs "5 points" as the usage status score for the "day of the week".

On the other hand, when the acquired information is information indicating that it is a weekday, the usage status scoring unit 502 outputs "0 points" as the usage status score for the "day of the week".

Further, the usage status scoring unit 502 acquires the information stored in the "time" from the job data 400. When the acquired information is information indicating that it is from 10 pm to 6 am, the usage status scoring unit 502 outputs "5 points" as the usage status score for "time".

On the other hand, when the acquired information is information indicating that it is from 6:00 am to 10:00 pm, the usage status scoring unit 502 outputs "0 points" as the usage status score for "time".

Further, the usage status scoring unit 502 counts the number of prints stored in the "number of prints" from the job data 400. At this time, the usage status scoring unit 502 also acquires the number of prints of other jobs having the same job instructor from the job data 400.

Then, the usage status scoring unit 502 determines whether or not the difference between the number of prints of the job and the number of prints of the other job is equal to or greater than a predetermined threshold value. If the result of the determination is equal to or higher than a predetermined threshold value, the usage status scoring unit 502 outputs "5 points" as the usage status score for the "number of prints".

On the other hand, if the result of the determination is less than a predetermined threshold value, the usage status scoring unit 502 outputs "0 points" as the usage status score for the "number of prints".

Further, the usage status scoring unit 502 acquires the FAX number stored in the "FAX transmission destination" from the job data 400. When the acquired fax number is a specific fax number (for example, the fax number of a list trader), the usage status scoring unit 502 outputs "300 points" as the usage status score for the "fax destination". ..

On the other hand, when the acquired fax number is a fax number other than a specific fax number, the usage status scoring unit 502 outputs "0 points" as the usage status score for the "fax destination".

(3) Processing of the information content scoring unit The information content scoring unit 503 reads out the information attribute data 330 stored in the management data storage unit 112 and becomes a monitoring target among the information assets owned by the company to which the service is provided. Identify information assets.

Further, the information content scoring unit 503 reads the job data 400 from the job data storage unit 113, and also reads the information content scoring index, which is one of the indexes related to information leakage, from the scoring index storage unit 511.

Further, the information content scoring unit 503 compares the job data 400 with the information content scoring index while referring to the information attribute data stored in the management data storage unit 112. As a result, the information content scoring unit 503 quantifies the information content (data that is the job execution target) handled by the monitored person via the monitored MFP, and the information content score (third information). An example) is output.

FIG. 8 is a diagram showing an example of the information content scoring index stored in the scoring index storage unit. As shown in FIG. 8, the information content scoring index 800 includes "scoring items" and "scores" as information items.

In the "scoring item", an evaluation item for quantifying the information content handled through the monitored MFP from the viewpoint of information leakage is stored. In the example of FIG. 8, "print file name (electronic data)", "print file name (URL)", and "document detection keyword" are stored as scoring items.

The "score" stores the score for quantifying the information content of the corresponding scoring item.

Information content The scoring unit 503 acquires the information of the item corresponding to the scoring item from the job data 400. In the case of FIG. 8, "print file name (electronic data)", "print file name (URL)", and "document detection keyword" are stored in the scoring item. Therefore, the information content scoring unit 503 acquires the information of the item corresponding to the scoring item from the job data 400.

For example, the information content scoring unit 503 acquires the print file name stored in the "print file name" from the job data 400. Further, the information content scoring unit 503 refers to a specific word stored in association with the "print file name" of the information attribute data 330. Then, the information content scoring unit 503 determines whether or not the acquired print file name includes a specific word. If a specific word is included as a result of the determination, the information content scoring unit 503 outputs "10 points" as the information content score for the "print file name".

On the other hand, when the specific word is not included, the information content scoring unit 503 outputs "0 points" as the information content score for the "print file name".

Further, the information content scoring unit 503 acquires the URL stored in the "print file name" from the job data 400. Further, the information content scoring unit 503 refers to a specific word stored in association with the "URL" of the information attribute data 330. Then, the information content scoring unit 503 determines whether or not the acquired URL includes a specific word. If a specific word is included as a result of the determination, the information content scoring unit 503 outputs "1 point" as the information content score for the "print file name".

On the other hand, when the specific word is not included, the information content scoring unit 503 outputs "0 points" as the information content score for the "print file name".

In addition, the information content scoring unit 503 acquires the information stored in the "document detection keyword" from the job data 400. Further, the information content scoring unit 503 refers to a specific word stored in association with the "document detection keyword" of the information attribute data 330. Then, the information content scoring unit 503 determines whether or not the acquired information includes a specific word. If a specific word is included as a result of the determination, the information content scoring unit 503 outputs "20 points" as the information content score for the "document detection keyword".

On the other hand, when a specific word is not included, the information content scoring unit 503 outputs "0 points" as the information content score for the "document detection keyword".

(4) Explanation of the score calculation unit for each person The score calculation unit 504 for each person is an example of the calculation means. The person-specific score calculation unit 504 has a person attribute score output from the person attribute scoring unit 501, a usage status score output from the usage status scoring unit 502, and information content output from the information content scoring unit 503. Get the score and for each job data.

FIG. 9 is a diagram showing an example of the score acquired for each job data, and the score acquired from the scoring unit 500 is obtained for the job data 400 transmitted from the MFP 122_1 identified by the device ID = "MFP001". It shows the state described repeatedly.

In the example of FIG. 9, the information that "5 points" is output by the usage status scoring unit 502 is stored as the usage status score in the "date and time" of the first job of the job data 400. Shown.

Further, in the example of FIG. 9, information in which "5 points" are output by the usage status scoring unit 502 is stored as the usage status score in the "day of the week" of the second job of the job data 400. It is shown that.

Further, in the example of FIG. 9, information in which "5 points" are output by the person attribute scoring unit 501 is stored as the person attribute score in the "job instructor" of the fourth job of the job data 400. It shows that it was.

Further, in the example of FIG. 9, information in which "5 points" are output by the usage status scoring unit 502 is stored as the usage status score in the "usage PC" of the eighth job of the job data 400. It shows that.

Further, in the example of FIG. 9, the information in which "1 point" is output by the information content scoring unit 503 is stored as the information content score in the "print file name" of the seventh job of the job data 400. It shows that it was.

Further, in the example of FIG. 9, information in which "5 points" are output by the usage status scoring unit 502 is stored as the usage status score in the "number of prints" of the sixth job of the job data 400. It shows that.

Further, in the example of FIG. 9, information in which "10 points" are output by the information content scoring unit 503 is stored as the information content score in the "document detection keyword" of the fifth job of the job data 400. It shows that it was done.

Further, in the example of FIG. 9, information in which "300 points" are output by the usage status scoring unit 502 is stored as the usage status score in the "FAX destination" of the third job of the job data 400. It shows that it was.

When the person-specific score calculation unit 504 acquires the person attribute score, usage status score, and information content score output for each job of all job data transmitted by the monitoring target MFP, the person-specific score calculation unit 504 sets the score as the monitoring target. Classify by person and job. In addition, the person-specific score calculation unit 504 weights and adds the person attribute score, the usage status score, and the information content score for each job to be monitored.

10 to 12 are diagrams showing an example of an addition result in which the scores of each job are weighted and added for each person to be monitored. Of these, the job data 1000 in FIG. 10 shows the job data of the person identified by the person ID = P001.

The person-specific score calculation unit 504 obtains an addition result (an example of the first value) by weighting and adding the acquired person attribute score, usage status score, and information content score based on the following equation.

ジョブデータ１０００の場合、人物属性スコアは０点である。また、ジョブ１００１の利用状況スコアが５点、情報内容スコアが１０点であることから、ジョブ１００１の加算結果は５０点となる。また、ジョブ１００２の利用状況スコアが３００点、情報内容スコアが１点であることから、ジョブ１００２の加算結果は３００点となる。

In the case of job data 1000, the person attribute score is 0 points. Further, since the usage status score of the job 1001 is 5 points and the information content score is 10 points, the addition result of the job 1001 is 50 points. Further, since the usage status score of job 1002 is 300 points and the information content score is 1 point, the addition result of job 1002 is 300 points.

In the weighted addition, it is assumed that "1" is input as the default value in the information content score.

In this way, the person-specific score calculation unit 504 obtains the addition result of the person attribute score, the usage status score, and the information content score of each job of the person identified by the person ID = P001.

The job data 1100 in FIG. 11 shows the job data of a person identified by the person ID = P002. In the case of job data 1100, the person attribute score is 0 points. Further, since the usage status score of job 1101 is 10 points (5 points + 5 points) and the information content score is 10 points, the addition result of job 1101 is 100 points.

In this way, the person-specific score calculation unit 504 obtains the addition result of the person attribute score, the usage status score, and the information content score of each job of the person identified by the person ID = P002.

The job data 1200 of FIG. 12 shows the job data of the person identified by the person ID = P003. In the case of job data 1200, the person attribute score is 0 points. Further, since the usage status score of job 1201 is 1 point and the information content score is 1 point, the addition result of job 1201 is 1 point.

Further, since the usage status score of jobs 1202 to job 1220 is 1 point each and the information content score is 1 point each, the addition result of jobs 1201 to 1220 is 1 point each.

Further, since the usage status score of the job 1221 is 5 points and the information content score is 20 points, the addition result of the job 1221 is 100 points.

In this way, the person-specific score calculation unit 504 obtains the addition result of the person attribute score, the usage status score, and the information content score of each job of the person identified by the person ID = P003.

(5) Processing of Judgment Parameter Calculation Unit The judgment parameter calculation unit 505 acquires the score addition result of each job for each person to be monitored from the person-specific score calculation unit 504. In addition, the determination parameter calculation unit 505 aggregates the addition results of the scores of each job for each person to be monitored, and calculates a determination parameter (an example of the second value) for determining the risk of information leakage. ..

In the present embodiment, the determination parameter calculation unit 505 sums the addition results of the scores of each job for each person to be monitored, and calculates the total value. Further, the determination parameter calculation unit 505 calculates the average value by summing the addition results of the scores of each job for each person to be monitored and dividing by the number of jobs.

Further, the determination parameter calculation unit 505 calculates the deviation value of the total value for each person to be monitored based on the total value calculated for each person to be monitored. Further, the determination parameter calculation unit 505 calculates the deviation value of the average value for each person to be monitored based on the average value calculated for each person to be monitored.

FIG. 13 is a diagram showing an example of a calculation result of a determination parameter for determining an information leakage risk. As shown in FIG. 13, in the judgment parameter calculation result 1300, "person ID", "total risk value", "average risk value", "deviation value of total risk value", and "average risk value" are included in the information items. Deviation value of "is included.

The person ID of the person to be monitored is stored in the "person ID". In the "total risk value", the total value of the score addition results of each job of the person to be monitored, which is acquired from the score calculation unit 504 for each person, is stored. In the "risk average value", the average value of the score addition results of each job of the person to be monitored acquired from the determination parameter calculation unit 505 is stored.

In the "deviation value of the total risk value", the deviation value of the total value of the addition results of the scores of each job of the person to be monitored acquired from the determination parameter calculation unit 505 is stored. In the "deviation value of the average risk value", the deviation value of the average value of the addition results of the scores of each job of the person to be monitored acquired from the determination parameter calculation unit 505 is stored.

The determination parameter calculation unit 505 sets the deviation value of the total risk value and the deviation value of the average risk value among the above values obtained by totaling the addition results of the scores of each job for each person to be monitored. Notify the action determination unit 506 as a determination parameter.

(6) Processing of the action determination unit The action determination unit 506 is an example of the determination means. The action determination unit 506 performs an action determination for each person to be monitored by comparing the determination parameter notified by the determination parameter calculation unit 505 with the determination index stored in the determination index storage unit 512. Specifically, the behavior determination unit 506 determines the rank indicating the risk of information leakage.

FIG. 14 is a diagram showing an example of a determination index showing the relationship between the determination parameter and the information leakage risk. As shown in FIG. 14A, the horizontal axis (an example of the second axis) is the “deviation value of the average risk value” and the vertical axis (an example of the first axis) is the “total risk value”. It is defined by dividing the coordinate space as "deviation value" into a plurality of areas (rank areas). The coordinate space used as the judgment index represents the distribution of the average risk value and the total risk value.

In the example of FIG. 14A, the region where the deviation value of the average risk value is 70 or more and the deviation value of the total risk value is 70 or more is defined as the region of rank = “rank A” indicating the information leakage risk. .. Further, the area where the deviation value of the average risk value is 70 or more and the deviation value of the total risk value is 50 or more and less than 70 is defined as the area of rank = "rank B" indicating the information leakage risk.

Further, the deviation value of the average risk value is 70 or more and the deviation value of the total risk value is less than 50, or the deviation value of the average risk value is 50 or more and less than 70 and the deviation value of the total risk value is 70 or more. The area is defined as the area of rank = "rank C" indicating the risk of information leakage.

FIG. 14B is a table defining the characteristics of persons determined to be rank A to rank C. For example, a person who is judged to be rank A is defined as "a person with a high risk who has a strong intention to leak information". In addition, a person who is judged to be rank B is defined as "a person who has an action or a sign that easily leads to information leakage and has a moderate risk". Furthermore, a person who is judged to be rank C has a slight risk, such as "a person who has loose information security morals such as information leakage due to negligence such as accidental loss of documents or many private prints". Defined as a person.

FIG. 15 is a diagram showing an example of the determination result of the information leakage risk. As shown in FIG. 15, the behavior determination unit 506 applies the determination parameter notified by the determination parameter calculation unit 505 to the determination index (FIG. 14A) to reduce the risk of information leakage of the person to be monitored. The indicated rank can be determined.

In the example of FIG. 15, the black circle 1501 is a determination parameter of the person identified by the person ID = P001. According to the example of FIG. 15, the behavior determination unit 506 determines that the person identified by the person ID = P001 has a rank indicating the information leakage risk of "rank A".

Similarly, in the example of FIG. 15, the black circle 1502 is a determination parameter of the person identified by the person ID = P002. According to the example of FIG. 15, the behavior determination unit 506 determines that the person identified by the person ID = P002 has a rank indicating the information leakage risk of "rank B".

Similarly, in the example of FIG. 15, the black circle 1503 is a determination parameter of the person identified by the person ID = P003. According to the example of FIG. 15, the behavior determination unit 506 determines that the person identified by the person ID = P003 has a rank indicating the information leakage risk of "rank C".

(7) Processing of Judgment Result Output Unit The judgment result output unit 507 acquires a judgment result list by the action judgment unit 506. Further, the determination result output unit 507 acquires job data of a person who is determined to have a rank indicating an information leakage risk of any of "Rank A" to "Rank C". Further, the determination result output unit 507 displays the acquired job data. As a result, the administrator of the server device 110 analyzes each person determined to be "rank A" to "rank C" based on the displayed job data.

When the administrator of the server device 110 inputs the analysis result, the determination result output unit 507 accepts the analysis result and generates a report including the accepted analysis result. Further, the determination result output unit 507 transmits the generated report to the company to which the service is provided.

FIG. 16 is a diagram showing an example of a report. As shown in FIG. 16, the report 1600 includes "rank", "person ID", and "main reason for determination" as information items. In the "rank", the rank determined by the action determination unit 506 is stored. In the "person ID", the person ID of the person determined to have the corresponding rank is stored.

In the "main reason for determination", the analysis result analyzed by the administrator of the server device 110 based on the job data is stored. The job data analysis by the administrator of the server device 110 is also performed for evaluation items other than the scoring items of each scoring index stored in the scoring index storage unit 511.

The content of the report is not limited to that shown in FIG. 16, and for example, a determination parameter may be described instead of the "main reason for determination". Further, the content described in the "main reason for determination" may be, for example, a template prepared in advance for each rank.

<5. Information leakage risk judgment service provision processing>
Next, the flow of the information leakage risk determination service provision process in the information leakage risk determination system 100 will be described. FIG. 17 is a sequence diagram showing a flow of information leakage risk determination service provision processing in the information leakage risk determination system.

In step S1711, the employee 1701 logs in to the PC 123_1 by inputting the person ID to the PC 123_1.

In step S1712, PC123_1 performs an authentication process based on the input person ID. If the authentication process by PC123_1 is successful, the process proceeds to step S1713.

In step S1713, the employee 1701 instructs PC123_1 to read a predetermined electronic data by designating a file name.

In step S1714, the PC 123_1 reads and displays the electronic data having the designated file name.

In step S1715, the employee 1701 inputs various print settings such as the number of prints, and then inputs a print instruction. As a result, in step S1716, the PC123_1 generates print data based on the read electronic data.

In step S1717, the PC123_1 transmits the generated print data, the person ID, the device ID of the PC123_1, the print file name, and the number of prints to the MFP122_1.

In step S1718, the MFP 122_1 prints the print data transmitted from the PC 123_1. Further, the MFP 122_1 generates job data 400 including the device ID, the date and time of printing, the day of the week, the job type, the device ID of the PC used, the print file name, the number of prints, and the like.

In step S1719, the MFP 122_1 transmits the generated job data 400 to the server device 110.

In step S1720, the server device 110 stores the received job data 400 in the job data storage unit 113.

The processes shown in steps S171 to S1720 are executed by any employee engaged in the company to which the service is provided. Further, the PCs to which each employee logs in and the MFPs for executing various jobs include all PC123_1 to PC123_n and all MFP122_1 to MFP122_m owned by the service providing company.

By repeating the processes of steps S171 to S1720 for a predetermined period (for example, one month), when a predetermined amount of job data is stored in the job data storage unit 113 of the server device 110, the process proceeds to step S1721.

In step S1721, the management device 121 requests the provision of the information leakage risk determination service. When requesting the provision of the information leakage risk determination service, the management device 121 transmits the latest management data (person attribute data, device attribute data, information attribute data) to the server device 110.

In step S1722, the server device 110 stores the management data transmitted from the management device 121 in the management data storage unit 112.

In step S1723, the server device 110 executes the information leakage risk determination process. The flow of the information leakage risk determination process will be described later with reference to FIG.

In step S1724, the server device 110 transmits the report 1600 generated by executing the information leakage risk determination process to the management device 121.

As a result, the company that received the report 1600 can take effective measures as a measure for reducing information leakage incidents caused by paper media.

<6. Information leakage risk judgment process flow>
Next, the details of the information leakage risk determination process (step S1723 in FIG. 17) will be described. FIG. 18 is a flowchart showing the flow of the information leakage risk determination process.

In step S1801, the person attribute scoring unit 501 reads out the person attribute data 310 from the management data storage unit 112. Further, the usage status scoring unit 502 reads out the device attribute data 320 from the management data storage unit 112. Further, the information content scoring unit 503 reads out the information attribute data 330 from the management data storage unit 112.

In step S1802, the person attribute scoring unit 501 reads out the job data 400 from the job data storage unit 113. Further, the usage status scoring unit 502 reads the job data 400 from the job data storage unit 113. Further, the information content scoring unit 503 reads the job data 400 from the job data storage unit 113.

In step S1803, the person attribute scoring unit 501 outputs the person attribute score of the information of each job of the job data 400 based on the person attribute scoring index 600 while referring to the person attribute data 310.

Similarly, the usage status scoring unit 502 outputs the usage status score of the information of each job of the job data 400 based on the usage status scoring index 700 while referring to the device attribute data 320. Similarly, the information content scoring unit 503 outputs the information content score of the information of each job of the job data 400 based on the information content scoring index 800 while referring to the information attribute data 330.

In step S1804, the person-specific score calculation unit 504 acquires the person attribute score, usage status score, and information content score of all job data, and classifies each person to be monitored. Further, the person-specific score calculation unit 504 weights and adds the person attribute score, the usage status score, and the information content score for each job for each person to be monitored, and outputs the addition result.

In step S1805, the determination parameter calculation unit 505 aggregates the addition results of each job for each person to be monitored and calculates the determination parameter.

In step S1806, the action determination unit 506 determines the rank indicating the risk of information leakage for each person to be monitored by comparing the determination parameter with the determination index.

In step S1807, the determination result output unit 507 generates the report 1600 based on the analysis result by the administrator of the server device 110.

<7. Summary>
As is clear from the above description, according to the present embodiment,
-Obtain job data of the MFP to be monitored and compare it with each index related to information leakage (person attribute scoring index, usage status scoring index, information content scoring index). As a result, the information of each job is quantified, and the personal attribute score, the usage status score, and the information content score are output.
-The output personal attribute score, usage status score, and information content score are weighted and added for each job, and the addition results are aggregated for each person to be monitored to calculate the judgment parameter.
-By comparing the calculated judgment parameters with the judgment index, the risk of information leakage of the person to be monitored is judged, and a report including the judgment result is provided.

In this way, the server device 110 in the present embodiment determines the printing behavior of the person to be monitored (who used what information content and how the printing device was used) via the job data of the MFP. Monitor.

Thereby, according to the present embodiment, the behavior of the user of the MFP can be determined by using the usage status of the MFP and the like.

[Second Embodiment]
In the first embodiment, when the person-specific score calculation unit 504 weights and adds the person attribute score, the usage status score, and the information content score, the influence of the information content score on the addition result becomes large ( Equation 1) is specified. Specifically, the addition result was calculated by multiplying the sum of the personal attribute score and the usage status score by the information content score. This is because, in the case of the first embodiment, the main focus is on providing effective information for measures to reduce information leakage incidents.

However, when focusing on providing information that is effective in reducing incidents other than information leakage incidents, the weighting addition method is not limited to (Equation 1), and is affected by the personal attribute score and usage status score. It may be specified to be large.

Specifically, the addition result may be calculated by multiplying the sum of the personal attribute score and the information content score by the usage status score. Alternatively, the addition result may be calculated by multiplying the sum of the usage status score and the information content score by the personal attribute score. In these cases, the behavior judgment is performed for the printing behavior different from the printing behavior having a high risk of information leakage.

Further, in the first embodiment, the information leakage risk determination program has been described as being installed in the server device 110, but the information leakage risk determination program may be installed in, for example, the management device 121. In this case, the job data is stored in the management device 121, and the information leakage risk determination service is provided by the management device 121.

Further, in the first embodiment, the consideration for the provision of the information leakage risk determination service is not particularly mentioned, but for example, the administrator of the server device 110 charges the company to which the service is provided a fixed monthly fee. May be set. Alternatively, the administrator of the server device 110 may charge each time a request for providing the information leakage risk determination service is received.

In addition, the scoring items of each index (personal attribute scoring index, usage status scoring index, information content scoring index) shown in the first embodiment are merely examples, and include other scoring items. It may be.

Further, in the first embodiment, it has been described that there are two types of scores for each index for each scoring item. However, it goes without saying that depending on the scoring item, it may have three or more types of scores. Further, the score may be a continuous value instead of a discrete value.

Further, in the information leakage risk determination system of the first embodiment, various data (management data, job data) are transmitted from the management device 121 and each MFP 122_1 to 122_m. However, the method of transmitting various data (management data, job data) is not limited to this. For example, job data or the like may be transmitted from each MFP 122_1 to 122_m to the management device 121, and various data may be collectively transmitted from the management device 121 to the server device 110. Further, the server device 110 may provide the above-mentioned information leakage risk determination service as a service via a so-called network such as an ASP (Application Service Provider) or a Web service in addition to the cloud service. In that case, the server device 110 may be configured by server devices distributed for each of various functions (functions of each unit included in the information leakage risk determination service unit 111).

Further, in the first embodiment, the MFP is mentioned as an example of each device connected to the server device 110, but it goes without saying that an image forming device other than the MFP may be connected. The image forming apparatus other than the MFP mentioned here includes, for example, a printing apparatus such as an LP (laser printer), a facsimile apparatus, a scanner apparatus, and the like.

The present invention is not limited to the configurations shown here, such as combinations with other elements in the configurations and the like described in the above embodiments. These points can be changed without departing from the spirit of the present invention, and can be appropriately determined according to the application form thereof.

100: Information leakage risk determination system 110: Server device 111: Information leakage risk determination service unit 121: Management device 122_1 to 122_m: MFP
123_1 to 123_n: PC
310: Person attribute data 320: Device attribute data 330: Information attribute data 400: Job data 500: Scoring unit 501: Person attribute scoring unit 502: Usage status scoring unit 503: Information content scoring unit 504: Score by person Calculation unit 505: Judgment parameter calculation unit 506: Behavior judgment unit 507: Judgment result output unit 600: Person attribute scoring index 700: Usage status scoring index 800: Information content scoring index 1300: Judgment parameter calculation result 1600: Report

Japanese Unexamined Patent Publication No. 2010-9239

Claims (13)

The first information indicating the usage status of the job executed in the image forming apparatus, the second information indicating the attributes of the user who executed the job, and the third information regarding the data to be executed by the job. And a calculation means for calculating the first value according to the job using
The behavior of each user is determined based on the total value and the average value of the first values calculated for each user using the first value of each job executed within a predetermined period. Has a determination means,
The determination means is provided in each region of the coordinate space formed by the first axis showing the distribution of the total value of the first value and the second axis showing the distribution of the average value of the first value. , An information processing system that determines the behavior of each user by referring to a determination index to which information indicating the risk of information leakage of the user is assigned. The information processing system according to claim 1, wherein the calculation means calculates the first value by quantifying and weighting the first to third information for each job. The first information includes at least one of the arrangement of the image forming apparatus, the apparatus used for the execution instruction of the job, the execution date and time of the job, and the setting contents at the time of executing the job. The information processing system described. The information processing according to claim 1, wherein the second information includes at least one of the presence or absence of the user's retirement schedule, the presence or absence of the user's demotion, and the presence or absence of the user's history of information leakage. system. The information processing system according to claim 1, wherein the third information includes at least one of a file name of data to be executed by the job, a storage destination of data, and a word included in the data. The first information indicating the usage status of the job executed in the image forming apparatus, and the attributes of the user who executed the job, at least, whether or not the user is scheduled to retire, and the demotion of the user. A first value according to the job is used by using the second information including the presence / absence and the presence / absence of the history of information leakage of the user and the third information regarding the data to be executed by the job. And the calculation method to calculate
Information processing having a determination means for determining an action for each user based on a second value calculated for each user using the first value for each job executed within a predetermined period. system. The information processing system according to claim 6, wherein the calculation means calculates the first value by quantifying and weighting the first to third information for each job. The determination means uses the total value of the first value for each user calculated as the second value and the average value of the first value for each user. The information processing system according to claim 6 or 7, wherein an action determination is performed for each person. The determination means is provided in each region of the coordinate space formed by the first axis showing the distribution of the total value of the first value and the second axis showing the distribution of the average value of the first value. The information processing system according to claim 8, wherein the behavior determination for each user is performed by referring to the determination index to which the information indicating the risk of information leakage of the user is assigned. The first information includes at least one of the arrangement of the image forming apparatus, the apparatus used for the execution instruction of the job, the execution date and time of the job, and the setting contents at the time of executing the job. The information processing system described. The information processing system according to claim 6, wherein the third information includes at least one of a file name of data to be executed by the job, a storage destination of data, and a word included in the data. On the computer
The first information indicating the usage status of the job executed in the image forming apparatus, and the attributes of the user who executed the job, at least, whether or not the user is scheduled to retire, and the demotion of the user. A first value according to the job is used by using the second information including the presence / absence and the presence / absence of the history of information leakage of the user and the third information regarding the data to be executed by the job. And the calculation process to calculate
To execute a determination step of determining an action for each user based on a second value calculated for each user using the first value of each job executed within a predetermined period. Program. The first information indicating the usage status of the job executed in the image forming apparatus, and the attributes of the user who executed the job, at least, whether or not the user is scheduled to retire, and the demotion of the user. A first value according to the job is used by using the second information including the presence / absence and the presence / absence of the history of information leakage of the user and the third information regarding the data to be executed by the job. And the calculation means to calculate
Information processing having a determination means for determining an action for each user based on a second value calculated for each user using the first value for each job executed within a predetermined period. Device.

Images