JP7824438B2 - Information processing system, program, and information processing method - Google Patents

Description

The present invention relates to an information processing system, a program, and an information processing method.

Patent document 1 discloses a technology that provides a system and method for discovering the use of applications within a computing environment and managing access to applications in order to minimize security threats and risks in an organization's computing environment.

Japanese Patent Application Laid-Open No. 2022-050462

In recent years, there has been a demand for technology that can improve the manageability of services used within organizations.

In consideration of the above circumstances, the present invention provides technology that can improve the manageability of services used within an organization.

According to one aspect of the present invention, an information processing system is provided for providing an IT management service for managing services used in an organization. The information processing system includes at least one processor capable of executing a program to perform the following steps: In the detection step, services used in the organization are detected. In the identification step, services that are not managed by the IT management service as services used in the organization are identified from the detected services. It is determined whether the unmanaged service is an automatically acquired service. An automatically acquired service is an API-integrated service that can be integrated with the IT management service via API, or a scrapeable service that can use data acquired by scraping on the IT management service.

This disclosure makes it possible to provide technology that can improve the manageability of services used within an organization.

FIG. 1 is a diagram illustrating an example of a system configuration of an information processing system 1. FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing device 2. FIG. 2 is a diagram illustrating an example of a hardware configuration of a user terminal 3. FIG. 2 is a diagram illustrating an example of functional units included in a processor 21. FIG. 2 is an activity diagram showing the flow of operations of the information processing system 1. FIG. 6 is a diagram illustrating an example of a service registration screen 6 in the IT management service of the embodiment. FIG. 7 is a diagram showing an example of a service confirmation screen 7 in an IT management service. FIG. 10 is a diagram showing an example of a service registration screen 8 in an IT management service according to a modified example.

[Embodiment]
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below with reference to the accompanying drawings. Various features shown in the following embodiments can be combined with each other.

The program for realizing the software appearing in this embodiment may be provided as a non-transitory computer-readable recording medium, may be provided so that it can be downloaded from an external server, or may be provided so that the program is launched on an external computer and its functions are realized on a client device (so-called cloud computing).

In this embodiment, a "unit" may include, for example, hardware resources implemented by a circuit in the broad sense, and software information processing that can be specifically realized by these hardware resources. Furthermore, this embodiment handles a variety of information, which may be represented, for example, by physical signal values representing voltage or current, high or low signal values as a collection of binary bits consisting of 0 or 1, or quantum superposition (so-called quantum bits), and communication and calculations may be performed on a circuit in the broad sense.

In the broad sense, a circuit is a circuit realized by at least an appropriate combination of a circuit, circuitry, processor, memory, etc. In other words, circuits include application-specific integrated circuits (ASICs), programmable logic devices (e.g., simple programmable logic devices (SPLDs), complex programmable logic devices (CPLDs), and field programmable gate arrays (FPGAs)), etc. The circuit also includes a serverless architecture that uses container-based services to run applications in an environment abstracted from the management of physical infrastructure.

1. System Configuration of Information Processing System 1 First, the system configuration of the information processing system 1 of this embodiment will be described with reference to FIG.

Figure 1 is a diagram showing an example of the system configuration of information processing system 1. Information processing system 1 is an information processing system for providing IT management services. As shown in Figure 1, information processing system 1 includes an information processing device 2, a user terminal 3, a service server 4, a detection server 5, and a communication network N. Note that there may be multiple information processing devices 2, multiple user terminals 3, multiple service servers 4, and multiple detection servers 5. Here, the system exemplified by information processing system 1 consists of one or more devices or components. Therefore, even an information processing device 2 alone, a user terminal 3 alone, a service server 4 alone, and a detection server 5 alone are included in the system exemplified by information processing system 1.

The information processing device 2 is composed of one or more servers and provides IT management services, which will be described later.

The user terminal 3 is a terminal used by a user. The user terminal 3 may be a PC (Personal Computer), a tablet computer, a smartphone, etc.

Service server 4 is a server that provides services used within the organization. Service server 4 is composed of multiple different servers, each for a different service.

The detection server 5 is a server that acquires detection data for detecting shadow IT used within the organization. The detection server 5 consists of one or more servers. The detection server 5 includes at least one of a data management server, a mail server, an accounting service, expense service, prepaid service or credit card service server, and a banking service server. This data management server manages information regarding the use of personal computers, mobile phones, etc. assigned to each employee within the organization, such as data on internet browsing history and account usage history. This mail server manages data on emails sent and received within the organization. The accounting service server, expense service server, prepaid service server, or credit card service server manages payment data acquired from the accounting service, expense service, prepaid card service, or credit card service, respectively. The banking service server manages data on withdrawal details acquired from the banking service.

The communication network N enables the information processing device 2, the user terminal 3, the service server 4, and the detection server 5 to communicate with each other. The communication network N may be wireless communication using the Internet, but is not limited to this and may also be wired communication.

2. Hardware Configuration Next, the hardware configuration of the information processing device 2, the user terminal 3, the service server 4, and the detection server 5 of this embodiment will be described with reference to FIGS.

2.1 Hardware Configuration of Information Processing Device 2 Fig. 2 is a diagram showing an example of the hardware configuration of the information processing device 2. As shown in Fig. 2, the information processing device 2 includes a processor 21, a storage unit 22, and a communication unit 23, and these components are electrically connected via a communication bus 20 inside the information processing device 2. The information processing device 2 executes the processing according to the embodiment.

The processor 21 processes and controls the overall operations related to the information processing device 2. The processor 21 is, for example, a central processing unit (CPU). The processor 21 reads out a predetermined program stored in the memory unit 22 and executes processing based on the program, thereby realizing various functions related to the information processing device 2, such as the processing shown in Figures 5 to 8 described below. Note that the number of processors 21 is not limited to a single processor, and the device may be implemented with multiple processors 21 for each function. A combination of these may also be used.

The memory unit 22 stores various information as defined above. This can be implemented, for example, as a storage device such as a solid state drive (SSD) that stores various programs related to the information processing device 2 executed by the processor 21, or as memory such as random access memory (RAM) that stores temporarily required information related to program calculations (arguments, arrays, etc.). The memory unit 22 stores various programs, variables, and data used when the processor 21 executes processing based on the programs related to the information processing device 2. The memory unit 22 is an example of a storage medium.

The communication unit 23 is preferably a wired communication means such as USB, IEEE 1394, Thunderbolt (registered trademark), or wired LAN network communication, but may also include wireless LAN network communication, mobile communication such as LTE/3G/4G/5G, or BLUETOOTH (registered trademark) communication as needed. In other words, it is more preferable to implement it as a collection of multiple communication means. In other words, the information processing device 2 may communicate various information from the outside via the communication unit 23.

2.2 Hardware Configuration of User Terminal 3 Fig. 3 is a diagram showing an example of the hardware configuration of the user terminal 3. As shown in Fig. 3, the user terminal 3 has a processor 31, a storage unit 32, a communication unit 33, an input unit 34, and an output unit 35, and these components are electrically connected via a communication bus 30 inside the user terminal 3. The user terminal 3 executes the processing according to the embodiment. For the processor 31, storage unit 32, and communication unit 33 of the user terminal 3, please refer to the processor 21, storage unit 22, and communication unit 23 of the information processing device 2.

The input unit 34 may be included in the housing of the user terminal 3 or may be externally attached. For example, the input unit 34 may be implemented as a touch panel integrated with the output unit 35. A touch panel allows the user to input tapping, swiping, etc. Of course, switch buttons, a mouse, a QWERTY keyboard, etc. may be used instead of a touch panel. In other words, the input unit 34 accepts input based on operations performed by the user. The input is transferred as a command signal to the processor 31 via the communication bus 30, and the processor 31 can execute predetermined control or calculations as necessary.

The output unit 35 can function as a display device for the user terminal 3. The output unit 35 may, for example, be included in the housing of the user terminal 3 or may be attached externally. The output unit 35 displays a graphical user interface (GUI) screen that can be operated by the user. This is preferably implemented by using display devices such as a CRT display, liquid crystal display, organic EL display, and plasma display, depending on the type of user terminal 3.

2.3 Hardware Configuration of Service Server 4 and Detection Server 5 The service server 4 and detection server 5 include a processor, a storage unit, and a communication unit. The components of the service server 4 and the detection server 5 are electrically connected via a communication bus within the service server 4 and the detection server 5. The service server 4 and the detection server 5 execute the processing according to the embodiment. For the processor, storage unit, and communication unit of the service server 4 and the detection server 5, please refer to the processor 21, storage unit 22, and communication unit 23 of the information processing device 2.

3. Functional Configuration of the Processor 21 of the Information Processing Device 2 Fig. 4 is a diagram illustrating an example of functional units included in the processor 21. As illustrated in Fig. 4, the processor 21 executes various programs stored in the storage unit 22, thereby functioning as an information transmitting/receiving unit 210, a detecting unit 211, an identifying unit 212, a display unit 213, a managing unit 214, an acquiring unit 215, and a notifying unit 216. In other words, information processing by software stored in the storage unit 22 is specifically realized by the processor 21, which is an example of hardware, and can be executed as each functional unit included in the processor 21.

The information transmission/reception unit 210 is configured to accept, receive, or acquire various information from the user terminal 3, the service server 4, or the detection server 5 via the communication network N and the communication unit 23. The information transmission/reception unit 210 is also configured to transmit or output various information to the user terminal 3, the service server 4, or the detection server 5 via the communication unit 23 and the communication network N.

The detection unit 211 detects the services used in the organization.

The identification unit 212 identifies, from the detected services, services that are not managed by the IT management service as services used in the organization. The identification unit 212 also identifies whether the unmanaged service is an automatically acquired service or a manually registered service.

The display unit 213 displays the type of service that is not managed in an identifiable manner.

When the management unit 214 receives an operation on any first registered object, it manages the linkable services linked to the first registered object as services used in the organization by the IT management service and initiates API linkage with the IT management service. When the management unit 214 receives an operation on any second registered object, it manages the scrapable services linked to the second registered object as services used in the organization by the IT management service and initiates scraping of the scrapable services. When the management unit 214 receives an operation on any third registered object, it manages the unlinked services linked to the third registered object as services used in the organization by the IT management service.

The acquisition unit 215 acquires usage data indicating the usage status of the automatically acquired service through API integration or scraping.

The notification unit 216 notifies the user that the service requires the user to input usage data.

The information transmission/reception unit 210, detection unit 211, identification unit 212, display unit 213, management unit 214, acquisition unit 215, and notification unit 216 will be described in detail later.

4. Explanation of Terms An "organization" is a group that aims to achieve a specific purpose. An organization may include any legal entity, such as a joint stock company, a limited liability company, a limited partnership company, a general incorporated association, a general incorporated foundation, a public interest incorporated association/public interest incorporated foundation, an NPO, or a union. Furthermore, if the organization is a company, for example, the organization may include group companies, affiliated companies, related companies, parent companies, and subsidiaries.

An "IT management service" is a service that manages services used by an organization. The IT management service itself is a service. The IT management service is configured to be able to register services that are permitted for use within an organization. The IT management service is also configured to be able to detect shadow IT. Furthermore, the IT management service is configured to be able to manage which users within the organization use each service and how frequently. The IT management service stores various services provided in the world, and among those services, stores API-integrated services, scrapable services, and manually registered services in a distinguishable manner.

A "service" is a service provided using computer-based information processing. From another perspective, a service may be a service provided via a user terminal 3. The user terminal 3 may be loaned or provided by the service provider.

"Shadow IT" refers to services that are not managed as services used within an organization by an IT management service. From another perspective, shadow IT can also be services used within an organization that are introduced or used at the discretion of individual employees or business departments, and that are not understood or managed by management departments, systems management departments, etc.

"Management" of services means that an organization recognizes the services being used within the organization and approves their use. By being managed, shadow IT is no longer shadow IT.
For example, services registered in an IT management service can be managed and visualized via a screen such as that shown in Figure 7, which will be described later, and therefore such services do not fall under the category of shadow IT. In other words, services that are not registered in an IT management service and that are used by users belonging to an organization may fall under the category of shadow IT. Services that are not managed by an organization, i.e., shadow IT, include automatically acquired services and manually registered services, and are classified as either automatically acquired services or manually registered services.

An "API (Application Programming Interface)" is a mechanism for calling the functions of one piece of software from another piece of software. Examples of APIs include Web APIs. "API integration" is the integration of data or functions between an IT management service and an API-integrable service. API integration enables the IT management service to accumulate usage data on API-integrable services.

"Scraping" refers to the acquisition of desired data within a service based on a preset algorithm. In this embodiment, for example, usage data for each service is acquired through scraping. The scraping algorithm is developed within or outside the IT management service organization. By releasing an IT management service with the developed scraping algorithm incorporated, a service that did not support scraping becomes one that does support scraping. Scraping includes web scraping, which analyzes HTML, XML, etc.

"Usage data" refers to data on the usage of services within an organization. Usage data differs for each service and includes at least one of account count information, user identification information, job information, and amount information. Account count information may be any information indicating the number of accounts according to account type, including, for example, the number of subscribed workspaces, the number of free/paid accounts, the number of administrator/general accounts, and the number of accounts for each grade. User identification information may be any information that can identify an account, including, for example, the email address, name, employee number, nickname, and photo of the user associated with the account. Job information may be any information indicating the number of jobs for each service, including, for example, the number of tasks, documents, contracts, orders, posts, and comments. Amount information may be any information on the amount used for the service, including, for example, payment history associated with the service and the purpose of those payments.

An "automatic acquisition service" is a service that allows an IT management service to acquire usage data by utilizing functions provided by the IT management service. An automatic acquisition service is a service that falls into at least one of the following categories: an API-enabled service and a scraping-enabled service.

An "API-integrable service" is a service that can be integrated with an IT management service via API. An API-integrable service can automatically acquire usage data through API integration. If the provider of a manual registration service begins offering an API and the IT management service is updated to support the provision of that API, the manual registration service can become an automatic acquisition service. Note that usage data for an API-integrable service may be acquired in the same way as for a manual registration service.

A "scrapable service" is a service that can use data obtained by scraping on the IT management service. If the IT management service is updated to a state that allows scraping of a manually registered service, the manually registered service can become a scrapable service. Note that usage data for a scrapable service may be obtained in the same manner as for a manually registered service.

A "manual registration service" is a service that does not fall under the category of an automatic acquisition service and can be managed by an IT management service. A manual registration service is a service for which an API is not provided and for which a scraping algorithm is not available. For example, manual registration services include recently released services, services with a small number of users, services developed by the user themselves, and services developed by the organization to which the user belongs. Usage data for manual registration services is obtained by users entering information, uploading files in formats such as csv, txt, or json, or using APIs provided by the IT management service itself.

5. Operational Flow of Information Processing System 1 An example of a preferable information process executed by the information processing system 1 of this embodiment will be described.

In addition, in the information processing described below, various information sent and received via the communication network N, communication unit 23, communication unit 33, communication unit of service server 4 or communication unit of detection server 5 is stored in memory unit 22, memory unit 32, memory unit of service server 4 or memory unit of detection server 5.

In the information processing described below, the information processing for displaying information on the output unit 35 may be briefly described as simply processor 31 displaying certain information on the output unit 35, or indirectly processor 21 displaying certain information on the output unit 35. In such cases, the information processing described below is performed, for example. For example, processor 31 accepts a user instruction to change the state of the screen. Processor 31 generates display information based on the instruction. Processor 31 controls the display on the output unit 35 based on the generated display information. As another example, processor 31 accepts a user instruction to display information on the screen. Processor 31 transmits the instruction to the information processing device 2. Processor 21 receives the instruction from the user terminal 3. Processor 21 generates display information based on the instruction. Processor 21 transmits the generated display information to the user terminal 3. Processor 31 receives the generated display information from the information processing device 2. Processor 31 controls the display on the output unit 35 based on the generated display information. Here, the display information is a concept that includes not only the information itself, such as a screen, an image, an icon, or text, that is generated in a form that can be viewed by the user, but also rendering information for displaying the information.

5.1 Overview of Information Processing Fig. 5 is an activity diagram showing the flow of operations of the information processing system 1. Fig. 5 describes an example in which an IT management service is used to manage various services used within an organization.

(Step S1)
First, the information transmitting/receiving unit 210 accesses an arbitrary detection server 5 to request detection data. Here, the information transmitting/receiving unit 210 accesses the arbitrary detection server 5 using the login ID and password of the admin (administrator) account of the organization, which have been acquired in advance from the user.

This detection data is data used to detect shadow IT within an organization. The detection data includes at least one of the following within the organization: internet browsing history data, account usage history data, sent and received email data, payment data obtained from accounting services, expense services, prepaid card services, or credit card services, and withdrawal details data obtained from banking services. These detection data include text information. Text information is composed of arbitrary characters and is information that can detect a service by referencing a database. In the case of internet browsing history data, the text information includes strings of characters and URLs within the relevant webpage. In the case of account usage history data, the text information includes log data from devices used by employees of the organization. In the case of sent and received email data, the text information includes information regarding the email recipient, title, body, or attachments. In the case of payment data or withdrawal details data, the text information includes information on the characters or amount contained in each transaction.

(Step S2)
Subsequently, the service server 4 transmits the detection data to the information processing device 2. The information transmitting/receiving unit 210 acquires the detection data from a predetermined service server 4.

(Step S3)
Next, the detection unit 211 detects shadow IT used within the organization based on the text information included in the detection data. For example, the detection unit 211 detects shadow IT used by the organization by matching the text information with a database stored in the storage unit 22. The detection unit 211 detects a shadow IT service name corresponding to the text information from among multiple service names stored in the accessed database. For example, if the text information is "Company A (service_a)," the detection unit 211 checks whether a service name corresponding to "Company A (service_a)" exists in the data stored in the database. Then, if the service name "service_a" corresponding to "Company A (service_a)" exists in the data stored in the database, the detection unit 211 acquires "service_a" as the shadow IT service name corresponding to the text information. This allows an organization to significantly reduce the amount of computer-based information processing required and the amount of data stored in storage devices compared to when the organization manually detects shadow IT, making it possible to detect shadow IT using computers and storage devices that are less expensive than before.

(Step S4)
Next, the identification unit 212 identifies, from the detected services, services that are not managed by the IT management service as services used in the organization (shadow IT). Furthermore, the identification unit 212 identifies the type of service the identified service is. Specifically, for example, by referring to a database in which service names are associated with whether the service corresponds to an automatically acquired service, the identification unit 212 identifies whether the unmanaged service (shadow IT) is an API-linkable service, a scrapeable service, or a manually registered service that does not correspond to either an API-linkable service or a scrapeable service.

(Step S5)
Next, the notification unit 216 notifies the user terminal 3 of information that an unmanaged service (shadow IT) has been identified, and information indicating whether the unmanaged service is an API-integrated service, a scraping-enabled service, or a manually registered service.

(Step S6)
Next, the processor 31 of the user terminal 3 accepts a request for access to the IT management service by accepting an operation from the user. The processor 31 transmits the request for access to the IT management service to the information processing device 2. The information transmitting/receiving unit 210 accepts the request for access to the IT management service from the user terminal 3.

(Step S7)
Next, in response to receiving a request for access to the IT management service, the display unit 213 displays a service registration screen 6 (described later in FIG. 6 ) for the IT management service on the output unit 35. At this time, the display unit 213 displays on the output unit 35 in an identifiable manner what type of service the identified service is. Specifically, for example, the display unit 213 displays on the output unit 35 in an identifiable manner whether the unmanaged service is an API-linkable service, a scrapeable service, or a manual registration service. Furthermore, at this time, the display unit 213 displays on the output unit 35 one or more API registration objects 620 corresponding to each API-linkable service, one or more scraping registration objects 622 corresponding to each scrapeable service, and one or more manual registration objects 624 corresponding to each manual registration service. The term "identifiable manner" means that when a user visually checks the information displayed on the output unit 35, the user can recognize what information the information indicates. The API registration object 620 is an example of a first registration object. The scraping registration object 622 is an example of a second registration object. The manual registration object 624 is an example of a third registration object. Step S7 will be described in detail with reference to FIG. 6. This allows the service to which the shadow IT used in the organization corresponds to be displayed, enabling more efficient operation of services within the organization. As a result of the user being able to identify the service to which the shadow IT corresponds, the user can reduce the number of information processing operations that the computer executes, thereby reducing the information processing load on the entire information processing system 1. This allows the information processing system 1 to be configured using a computer that is less expensive than conventional computers.

When the unmanaged service identified by the identification unit 212 corresponds to an API-interoperable service or a scrapable service, the display unit 213 may cause the output unit 35 to display information recommending management as an API-interoperable service or a scrapable service. Furthermore, when the unmanaged service identified by the identification unit 212 corresponds to neither an API-interoperable service nor a scrapable service, the display unit 213 may cause the output unit 35 to display information recommending management as a manually registered service. "Information recommending management" is information for guiding the user to select a registration method (whether to register as an API-interoperable service, a scrapable service, or a manually registered service). The information recommending management may be provided, for example, by notification of the recommended registration method, displaying a pop-up on the screen, preferentially visualizing it on the screen, highlighting it on the screen, etc.

(Step S8)
The processor 31 of the user terminal 3 accepts an operation on the API registration object 620, the scraping registration object 622, or the manual registration object 624. The processor 31 transmits information identifying the object for which the operation has been accepted to the information processing device 2. The information transmitting/receiving unit 210 accepts, from the user terminal 3, information identifying the object for which the operation has been accepted.

(Step S9)
In step S8, if the operation of the API registration object 620 is accepted, the management unit 214 manages the API-linkable service linked to the API registration object 620 as a service used in the organization by the IT management service, and starts API linkage with the IT management service. That is, the information transmission/reception unit 210 sends an API request to the service server 4 of the API-linkable service corresponding to the API registration object 620. If the operation of the API registration object 620 is accepted, the management unit 214 may accept input of information such as the ID, password, email address, and access key of the account of the API-linkable service linked to the API registration object 620. If the input of information is accepted, the management unit 214 manages the API-linkable service as a service used in the organization by the IT management service, and starts API linkage with the IT management service.

In step S8, if an operation of the scraping registration object 622 is accepted, the management unit 214 manages the scrapable service associated with the scraping registration object 622 as a service used in the organization by the IT management service, and initiates scraping of the service server 4 by the information processing device 2 that provides the IT management service. That is, the information transmission/reception unit 210 sends a source request to the service server 4 of the scrapable service corresponding to the scraping registration object 622. This source request may be information requesting a source that can be analyzed by scraping, such as an HTTP request. If an operation of the scraping registration object 622 is accepted, the management unit 214 may also accept input of information such as the account ID, password, email address, and access key of the scrapable service associated with the scraping registration object 622. If input of information is accepted, the management unit 214 manages the scrapable service as a service used in the organization by the IT management service, and initiates scraping by the information processing device 2.

Note that, in step S8, when an operation of the manual registration object 624 is accepted, the management unit 214 manages the manually registered service linked to the manually registered object 624 as a service used in the organization by the IT management service. Here, the notification unit 216 may notify the user that the manually registered service is a service that requires the user to input usage data. Specifically, for example, when a predetermined period (e.g., one month, three months, one year, etc.) has passed since the last time usage data was accepted for a certain manually registered service (when a predetermined period has passed since the last time usage data was entered in the API linkage area 75), the notification unit 216 may notify the user that the service requires the user to input usage data.

(Step S10)
If the API request is accepted in step S9, the service server 4 of the API-cooperable service transmits an API response to the information processing device 2. That is, the acquisition unit 215 acquires the usage data through API cooperation between the IT management service and the API-cooperable service.
When a source request is received in step S9, the acquisition unit 215 acquires a source that can be analyzed by scraping, such as HTML, XML, etc. The acquisition unit 215 acquires usage data by scraping.
The usage data that can be acquired through API linkage and scraping may differ for each service. The frequency at which usage data is acquired through API linkage and scraping may be set for each service.
This allows a computer to acquire usage data through API linkage or scraping according to specific rules, thereby optimizing the number of information processing operations and reducing the load caused by information processing on the entire information processing system 1. This allows the information processing system 1 to be configured using a computer that is less expensive than conventional computers.

According to this embodiment, it is possible to improve the manageability of services used within an organization. Since complex information processing is not required to manage services used within an organization, it is also possible to reduce the use of cache memory in the information processing device 2 and user terminal 3. Furthermore, as a result of being able to reduce the use of cache memory, large-scale devices or computers are not required, and information processing can be performed inexpensively.

5.2. Details of Information Processing Next, the details of the information processing outlined above will be described with reference to FIGS.

Figure 6 is a diagram showing an example of a service registration screen 6 in an IT management service of an embodiment. The service registration screen 6 is a screen for providing various functions in the IT management service. The service registration screen 6 includes a menu area 60, a search area 61, and a service display area 62.

The menu area 60 is an area for transitioning the service registration screen 6 to another function. In response to pressing the portion labeled "Service" in the menu area 60, the display unit 213 displays the service confirmation screen 7 shown in Figure 7.

The search area 61 is configured to allow input of a string of characters. The search area 61 is an area for searching for services that match the input string.

The service display area 62 is an area where an organization's shadow IT is displayed in a list-like format. The service display area 62 is an area where the shadow IT detected by the detection unit 211 is displayed. The service display area 62 includes an API registration object 620 linked to multiple API-linkable services, a scraping registration object 622 linked to multiple scrapable services, and a manual registration object 624 linked to multiple manually registered services. The API registration object 620 includes an API linkable mark 621. The API linkable mark 621 is any information indicating that the shadow IT is an API-linkable service, and may be composed of characters such as "API linkage," or symbols, figures, illustrations, etc. The scraping registration object 622 includes a scrapable mark 623. The scrapable mark 623 is any information indicating that the shadow IT is a scrapable service, and may be composed of characters such as "scraping," or symbols, figures, illustrations, etc. The manually registered object 624 includes a manually registered mark 625. The manually registered mark 625 may be any information indicating that the shadow IT is a manually registered service, and may be composed of characters such as "manual registration," or may be composed of symbols, figures, illustrations, etc. The API registered object 620, the scraping registered object 622, and the manually registered object 624 may each display the number of users currently using the shadow IT associated with that object. Note that there may be services that are capable of both API integration and scraping. In the example of FIG. 6, "service_a" is an API-integrated service and a scraping-enabled service.

Also, in a screen like that of FIG. 6, when a user clicks (operates) an API integration mark 621, the IT management service may start processing to initiate API integration with the API integration-enabled service corresponding to the clicked API integration mark 621. Also, when a user clicks (operates) a scraping-enabled mark 623, the IT management service may start processing to initiate scraping for the scrapeable service corresponding to the clicked scraping-enabled mark 623. Furthermore, on such a screen, in addition to the API integration-enabled mark 621, the scraping-enabled mark 623, and the manual registration mark 625, an object called "Register" may be displayed. When the user clicks (operates) this object, the service corresponding to the clicked object may be registered in the IT management service. Registered services can be managed, for example, via a screen like that of FIG. 7. Also, a screen like that of FIG. 6 may display objects such as "Mute" and "Ignore." When the user clicks (operates) this object, the service corresponding to the clicked object may no longer be displayed to the user as shadow IT. In this way, by displaying objects such as "API integration," "scraping," "registration," and "mute" for each service, it is possible to encourage users to perform the actions they desire regarding shadow IT.

Figure 7 shows an example of a service confirmation screen 7 for an IT management service. The service confirmation screen 7 is a screen for displaying, in list format, information about services managed by the IT management service in the organization. The service confirmation screen 7 includes a menu area 70, a search area 71, a service identification area 72, an alert area 73, an account area 74, an API integration area 75, a scraping status area 76, an expenditure area 77, and an engagement area 78. For information about the search area 71, please refer to the search area 61.

The menu area 70 is an area for transitioning the service confirmation screen 7 to another function. In response to pressing the portion labeled "Integration" in the menu area 70, the display unit 213 displays the service registration screen 6 shown in Figure 6.

The service identification area 72 is an area where the names of services managed by the organization are displayed. The service identification area 72 may also show the number of workspaces subscribed to for each service; in the example of Figure 7, it shows that the number of workspaces for the service "Service δ" is two. The number of workspaces may be obtained in association with account number information or amount information.

The alert area 73 is an area that may contain an alert. This alert is information indicating that there are unmanaged accounts within the organization for a certain service and the number of unmanaged accounts. When user identification information or account number information is obtained by starting API integration, the display unit 213 will erase the alert and display it.

The account area 74 is an area that indicates the number of accounts within the organization that are used for each service. The account area 74 is also an area for referencing information about the number of accounts within the organization that are used for each service. The number of accounts may be obtained in association with the account number information.

The API linkage area 75 is an area where information indicating whether or not a service is an API linkable service is displayed for each service. The API linkage area 75 may also display the time when usage data was last entered, along with information indicating that the service is not an API linkable service.
Additionally, the scraping status area 76 is an area that displays information for each service indicating whether the service is scrapable or not. The scraping status area 76 may also display the time when usage data was last entered.
That is, the display unit 213 displays a service list that lists the identified services, and the service list is a list that displays each service in a manner that makes it possible to identify whether it is an API-compatible service and whether it is a scraping-compatible service.
In addition, a screen like that shown in Figure 7 may be configured so that services with API integration can be sorted from services with API integration without, or a screen like that shown in Figure 7 may be configured so that services with scraping can be sorted from services with scraping without.

The expenditure area 77 is an area for displaying expenditures for each service. This expenditure may be obtained in association with amount information.

The engagement area 78 is an area that displays information indicating the usage rate of a service based on spending on that service and the number of accounts for that service. As shown in FIG. 7, the usage rate of a service may be displayed as a level such as "8/10." The usage rate of a service may be calculated based on account number information and amount information.

[others]
With respect to the information processing system 1 according to the above-described embodiment, the program causes a computer to function as a processor of the information processing system 1. Furthermore, the information processing method executed by the information processing system includes steps executed by the processor of the information processing system.

As shown in FIG. 8, the modified service registration screen 8 may be configured to distinguish between automatically acquired services and manually registered services in a manner different from that of the service registration screen 6 of the embodiment. FIG. 8 is a diagram showing an example of the service registration screen 8 for the modified IT management service. The service registration screen 8 includes a menu area 80, a search area 81, an automatically acquired service display area 82, and a manually registered service display area 83. For the menu area 80 and the search area 81, please refer to the menu area 60 and the search area 61, respectively.

The display unit 213 displays the automatically acquired service display area 82 and the manually registered service display area 83 in a distinguishable manner. The automatically acquired service display area 82 is an area in which multiple automatically acquired services are displayed. The automatically acquired service display area 82 is an example of a first area. The manually registered service display area 83 is an area in which multiple manually registered services are displayed. The manually registered service display area 83 is an example of a second area.

The automatically acquired service display area 82 includes automatically acquired registration objects 820 linked to multiple automatically acquired services. The automatically acquired registration objects 820 include an automatically acquired mark 821. The automatically acquired mark 821 is information indicating that the service displayed in association with the mark is an automatically acquired service. The manually registered service display area 83 includes manually registered objects 830 linked to multiple manually registered services.

In the embodiment, it has been described that an API-interoperable service is managed by an IT management service as a service used in an organization, and that API integration with the IT management service is initiated. In a variant example, the service may only be managed, without API integration. The information transmission/reception unit 210 may send a recommendation to the user terminal 3 to start API integration depending on the frequency of use of the API-interoperable service that it only manages. Similarly, for scrapeable services, the information transmission/reception unit 210 may send a recommendation to the user terminal 3 to start scraping.

In the embodiment, the IT management service is described as managing shadow IT as a service used by the organization. In a variant example, an option may be provided to leave shadow IT as shadow IT rather than managing it as a service used by the organization. The information transmission/reception unit 210 may send a recommendation to start management to the user terminal 3 depending on the subsequent frequency of use of shadow IT.

If a manual registration service becomes an automatic acquisition service, the user may be notified of this. For example, if the provider of the manual registration service begins offering an API and the IT management service supports the provision of the API, the notification unit 216 may notify the user terminal 3 that API integration is now possible. The notification unit 216 may also notify the user of scraping-enabled services in a similar manner.

In step S9 of FIG. 5, a notification of approval may be issued to the organization's administrator in order to register the service. That is, when the API registration object 620 or the manual registration object 624 is operated, the information transmission/reception unit 210 notifies the administrator's user terminal 3 that a request for approval to register the service has been made. The processor 31 of the administrator's user terminal 3 displays on the output unit 35 that this request for approval has been made. The processor 31 of the administrator's user terminal 3 accepts the approval from the administrator and transmits that approval to the information processing device 2. The information transmission/reception unit 210 accepts that approval has been made. If the management unit 214 accepts that approval has been made, it manages the service as a service used in the organization by the IT management service. Note that there may be multiple approvers, in which case approval may be requested from multiple administrators simultaneously, or in any order.

In the above embodiment, a system for identifying (determining) whether a service detected as shadow IT can be linked to an API is described, but the present invention should not be limited to this. For example, for each of multiple services manually registered by a user in an IT management service, the availability of API linkage with the IT management service (the latest presence or absence of API linkage) may be visualized on a screen such as that shown in FIG.
In other words, the present disclosure may be configured to identify whether or not API integration with the IT management service is possible (whether or not API integration is possible at the latest point in time) for each of multiple services registered in the IT management service and/or multiple services detected by the IT management service, and make this visible to the user.
That is, the system disclosed herein can display to the user whether or not each of a plurality of services is API-integrated. As a result, for API-integrated services, usage data including account data can be automatically updated in the IT management service via the API, but for non-API-integrated services, the system can notify/suggest to the user that the user must manually update usage data including account data in the IT management service. In this way, the user can appropriately manage the usage status of a plurality of services using the IT management service.

IT management services may also manage software or systems used within an organization. In such cases, "services" in this specification shall be read as "services, software, or systems."

In addition, in this embodiment, "object operation" may be any form that can accept instructions from the user, such as pressing a button or selecting a button.

Furthermore, it may be provided in the following forms:

(1) An information processing system for providing an IT management service for managing services used in an organization, the information processing system having at least one processor capable of executing a program to perform each of the following steps: in the detection step, services used in the organization are detected; in the identification step, services that are not managed by the IT management service as services used in the organization are identified from the detected services, and whether the unmanaged service is an automatically acquired service is identified; wherein the automatically acquired service is an API-integrated service that is capable of API integration with the IT management service, or a scrapable service that allows data acquired by scraping to be used on the IT management service.

(2) In the information processing system described in (1) above, in the display step, an information processing system is provided in which the automatically acquired service identified in the identification step is displayed in an identifiable manner as to whether it is an API-integrable service or a scraping-enabled service.

(3) In the information processing system described in (1) or (2) above, the unmanaged service includes a manually registered service, which is a service that does not fall under the automatically acquired service, and in the notification step, the user is notified that the manually registered service is a service that requires the user to input usage data, and the usage data includes data indicating the usage status of the manually registered service.

(4) In an information processing system described in any one of (1) to (3) above, in the display step, a first area and a second area are displayed in a distinguishable manner, wherein the first area is an area in which multiple automatically acquired services are displayed, the second area is an area in which multiple manually registered services are displayed, and the manually registered services are services that do not fall under the automatically acquired services.

(5) In an information processing system described in any one of (1) to (4) above, in the display step, one or more first registered objects corresponding to one or more API-interoperable services, one or more second registered objects corresponding to one or more scrapable services, and one or more third registered objects corresponding to one or more manually registered services are displayed, and the manually registered services are services that do not fall under the automatically acquired services. In the management step, when an operation of any first registered object is received, the interoperable services linked to the first registered object are managed by the IT management service as services used in the organization and API integration with the IT management service is started. When an operation of any second registered object is received, the scrapable services linked to the second registered object are managed by the IT management service as services used in the organization and scraping of the scrapable services is started. In this information processing system, when an operation of any third registered object is received, the uninteroperable services linked to the third registered object are managed by the IT management service as services used in the organization.

(6) In an information processing system described in any one of (1) to (5) above, in the display step, a service list listing the identified services is displayed, and the service list is a list displayed in a manner that makes it possible to identify, for each service, whether it is an API-integrable service and whether it is a scraping-enabled service.

(7) In the information processing system described in any one of (1) to (6) above, in the detection step, services used within the organization are detected based on detection data, wherein the detection data includes at least one of data on internet browsing history within the organization, data on account usage history, data on sent and received emails, payment data obtained from an accounting service, expense service, or prepaid card service, data on usage details obtained from a credit card service, and data on withdrawal details obtained from a banking service.

(8) In an information processing system described in any one of (1) to (7) above, in the acquisition step, usage data indicating the usage status of the API-interoperable service is acquired through API integration between an IT management service and the API-interoperable service.

(9) An information processing system in any one of (1) to (8) above, wherein the IT management service further manages software or systems used within the organization.

(10) In an information processing system described in any one of (1) to (9) above, in the display step, if the unmanaged service identified in the identification step does not correspond to either an API-interoperable service or a scrapeable service, information recommending management as a manually registered service is displayed, and the manually registered service is a service that is not an automatically acquired service.

(11) A program for causing a computer to function as the processor of an information processing system described in any one of (1) to (10) above.

(12) An information processing method executed by an information processing system, comprising steps executed by the processor of the information processing system described in any one of (1) to (10) above.
Of course, this is not the case.

Finally, while various embodiments of the present invention have been described, these are presented as examples and are not intended to limit the scope of the invention. These novel embodiments may be embodied in a variety of other forms, and various omissions, substitutions, and modifications may be made without departing from the spirit of the invention. These embodiments and their variations are intended to fall within the scope and spirit of the invention, as well as within the scope of the invention and its equivalents as set forth in the claims.

1: Information processing system, 2: Information processing device, 20: Communication bus, 21: Processor, 210: Information transmission/reception unit, 211: Detection unit, 212: Identification unit, 213: Display unit, 214: Management unit, 215: Acquisition unit, 216: Notification unit, 22: Memory unit, 23: Communication unit, 3: User terminal, 30: Communication bus, 31: Processor, 32: Memory unit, 33: Communication unit, 34: Input unit, 35: Output unit, 4: Service server, 5: Detection server, 6: Service registration screen, 60: Menu area, 61: Search area, 62: Service display area, 620: API registration object, 621: API linkable mark, 622: Scraping registration object, 62 3: Scraping possible mark, 624: Manually registered object, 625: Manually registered mark, 7: Service confirmation screen, 70: Menu area, 71: Search area, 72: Service identification area, 73: Alert area, 74: Account area, 75: API linkage area, 76: Scraping status area, 77: Expenditure area, 78: Engagement area, 8: Service registration screen, 80: Menu area, 81: Search area, 82: API linkage possible service display area, 820: Linkage management registration object, 821: API linkage possible mark, 83: API not linked service display area, 830: Manually registered object, N: Communication network

Claims (13)

An information processing system for providing an IT management service for managing services used in an organization, comprising:
at least one processor capable of executing a program to perform the following steps;
The detecting step detects services used by the organization;
In a particular step,
Identifying, from among the detected services, services that are not managed by the IT management service as services used by the organization;
Identifying whether the unmanaged service is an automatic acquisition service, wherein the automatic acquisition service is an API-linkable service that can be linked with the IT management service via API, or a scrapeable service that can use data acquired by scraping on the IT management service;
In the display step, the automatic acquisition service identified in the identification step is displayed in an identifiable manner as to whether it is the API-linkable service or the scraping-enabled service.
Information processing system. 2. The information processing system according to claim 1,
In the identifying step, the information processing system identifies whether the unmanaged service corresponds to the automatically obtained service by referring to a database in which service names and automatically obtained service applicability are associated . 2. The information processing system according to claim 1,
In the identification step, an information processing system determines whether the unmanaged service corresponds to the automatically acquired service by referring to a storage means having information stored in a manner that allows identification of whether the service corresponds to the API-interoperable service, the scrapeable service, or the manual registration service for multiple services . An information processing system for providing an IT management service for managing services used in an organization, comprising:
at least one processor capable of executing a program to perform the following steps;
The detecting step detects services used by the organization;
In a particular step,
Identifying, from among the detected services, services that are not managed by the IT management service as services used by the organization;
Identifying whether the unmanaged service is an automatic acquisition service, wherein the automatic acquisition service is an API-linkable service that can be linked with the IT management service via API, or a scrapeable service that can use data acquired by scraping on the IT management service;
In the display step, the automatic acquisition service identified in the identification step is displayed in an identifiable manner as to whether it is the API-linkable service or the scraping-enabled service ;
The unmanaged service includes a manual registration service, and the manual registration service is a service that does not fall under the category of the automatic acquisition service;
In the notification step, the user is notified that the manual registration service is a service that requires input of usage status data from the user, and the usage status data includes data indicating usage status of the manual registration service.
Information processing system. 2. The information processing system according to claim 1,
In the display step, a first area and a second area are displayed in a distinguishable manner, wherein the first area is an area in which a plurality of the automatically acquired services are displayed, and the second area is an area in which a plurality of manually registered services are displayed, and the manually registered services are services that do not fall under the automatically acquired services.
Information processing system. An information processing system for providing an IT management service for managing services used in an organization, comprising:
at least one processor capable of executing a program to perform the following steps;
The detecting step detects services used by the organization;
In a particular step,
Identifying, from among the detected services, services that are not managed by the IT management service as services used by the organization;
Identifying whether the unmanaged service is an automatic acquisition service, wherein the automatic acquisition service is an API-linkable service that can be linked with the IT management service via API, or a scrapeable service that can use data acquired by scraping on the IT management service;
In the display step, one or more first registered objects corresponding to one or more of the API-interoperable services, one or more second registered objects corresponding to one or more of the scrapable services, and one or more third registered objects corresponding to one or more manually registered services are displayed, and the manually registered services are services that do not fall under the automatically acquired services,
In the management step,
When an operation of any of the first registered objects is received, the IT management service manages the linkable services associated with the first registered object as services used in the organization, and starts API linkage with the IT management service;
When an operation of any of the second registered objects is received, the scrapable service associated with the second registered object is managed by the IT management service as a service used in the organization, and scraping of the scrapable service is started;
When an operation of any of the third registered objects is received, the unlinked service associated with the third registered object is managed by the IT management service as a service used in the organization.
Information processing system. 2. The information processing system according to claim 1,
In the display step, a service list listing the identified services is displayed, and the service list is a list displayed in a manner that makes it possible to identify, for each service, whether it is an API-interoperable service and whether it is a scraping-enabled service.
Information processing system. 2. The information processing system according to claim 1,
In the detection step, services used within the organization are detected based on detection data, and the detection data includes at least one of data on internet browsing history, data on account usage history, data on emails sent and received within the organization, data on payments obtained from an accounting service, expense service, or prepaid card service, data on usage details obtained from a credit card service, and data on withdrawal details obtained from a bank service.
Information processing system. 2. The information processing system according to claim 1,
In the acquisition step, usage status data indicating a usage status of the API-cooperable service is acquired through API cooperation between the IT management service and the API-cooperable service.
Information processing system. 2. The information processing system according to claim 1,
The IT management service further manages software or systems used within the organization.
Information processing system. An information processing system for providing an IT management service for managing services used in an organization, comprising:
at least one processor capable of executing a program to perform the following steps;
The detecting step detects services used by the organization;
In a particular step,
Identifying, from among the detected services, services that are not managed by the IT management service as services used by the organization;
Identifying whether the unmanaged service is an automatic acquisition service, wherein the automatic acquisition service is an API-linkable service that can be linked with the IT management service via API, or a scrapeable service that can use data acquired by scraping on the IT management service;
In the display step, if the unmanaged service identified in the identification step does not correspond to either the API-interoperable service or the scrapeable service, information recommending management as a manually registered service is displayed , and the manually registered service is a service that is not the automatically acquired service.
Information processing system. A program,
A program for causing a computer to function as the processor of the information processing system according to any one of claims 1 to 11 . An information processing method executed by an information processing system,
The information processing system according to any one of claims 1 to 11 includes the steps executed by the processor.
Information processing methods.