JP7479741B1 - Information processing system, information processing method, program, and recording medium - Google Patents

Abstract

To identify when software was used, even if the software had a defect in the past.
[Solution] The information processing system generates, by a processing unit, history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a specified software, the history timing information indicating one or more timing points from the time the software component information was generated to the time the history information was stored. The processing unit further identifies, based on defect information stored in the storage unit and the history information, information indicating at least either a period during which a component corresponding to the defect information was included or the software component information.
[Selected Figure] Figure 1

Description

This disclosure relates to an information processing system, an information processing method, a program, and a recording medium.

The management device described in Patent Document 1 aims to identify locations in a system where abnormalities may occur. To achieve the aim, the management device stores configuration information indicating the configuration of each component of the system. The management device performs the following operations: identifies a first component in which an abnormality has occurred, and identifies a second component that is common to the identified first component from the stored configuration information.

In the management device, in relation to the above-mentioned operations, the software configuration information SBOM (Software Bill Of Materials) may include, for example, vulnerability information.

International Publication No. 2023-084671

However, the above-mentioned management device has an issue in that, for example, even if the software had a vulnerability in the past, it is not possible to identify when the software was used.

The objective of the present disclosure is to provide an information processing system, information processing method, program, and recording medium that can identify when software was used, even if the software had vulnerabilities in the past.

In order to solve the above-mentioned problems, an information processing system according to the present disclosure generates, by a processing unit, history information indicating a change history of the software component information based on software component information (including an SBOM) related to one or more software components constituting a predetermined software and history timing information;
The history timing information is information that indicates one or more timing points from the time when the software component information is generated to the time when the history information is stored.

The information processing system disclosed herein makes it possible to identify when the software was used, even if the software had vulnerabilities in the past.

2 shows the configuration of an information processing system JSS according to the first embodiment. 2 shows the configuration of a terminal TM according to the first embodiment. 3 shows the configuration of a server SV according to the first embodiment. 4 is a flowchart showing an operation of the information processing system JSS according to the first embodiment. 4 is a time chart showing the operation of the information processing system JSS according to the first embodiment. 1 shows configuration information KJ0 (at time t0) of the first embodiment. 13 shows time information JJ0 (at time t0) in the first embodiment. 1 shows configuration information KJ1 (at time t1) of the first embodiment. 1 shows time information JJ1 (at time t1) in the first embodiment. 1 shows configuration information KJ2 (at time t2) of the first embodiment. 13 shows time information JJ2 (at time t2) in the first embodiment. 13 shows configuration information KJ3 (at time t3) of the first embodiment. 13 shows time information JJ3 (at time t3) in the first embodiment. 13 shows configuration information KJ4 (at time t4) of embodiment 1. 13 shows time information JJ4 (at time t4) in the first embodiment. 13 shows configuration information KJ5 (at time t5) of the first embodiment. 13 shows time information JJ5 (at time t5) in the first embodiment. 1 shows history information RJ (at time t0) according to the first embodiment. 1 shows history information RJ (at time t1) according to the first embodiment. 1 shows history information RJ (at time t2) according to the first embodiment. 1 shows history information RJ (at time t3) according to the first embodiment. 1 shows history information RJ (at time t4) according to the first embodiment. 1 shows history information RJ (at time t5) according to the first embodiment. 11 shows history information RJ according to the second embodiment. 11 shows configuration information KJ0 and configuration information KJ1 of the second embodiment. 11 shows configuration information (hierarchy) KJ0 (KS) and configuration information (hierarchy) KJ1 (KS) of the second embodiment. 11 shows configuration information (relationship) KJ0(KK) and configuration information (relationship) KJ1(KK) of the second embodiment. 13 shows a display form of configuration information KJ11 of the third embodiment. 13 shows a display form of configuration information KJ12 according to the third embodiment. 13 shows a display form of configuration information KJ13 according to the third embodiment. 13 shows a display form of configuration information KJ14 according to the third embodiment. 1 shows a hardware configuration of an information processing system JSS according to first to third embodiments. 1 shows a hardware configuration based on software realization of the information processing system JSS according to the first to third embodiments.

An embodiment of the information processing system JSS according to the present disclosure will be described.

First Embodiment
The information processing system JSS according to the first embodiment will be described.

Configuration of First Embodiment
Configuration of Information Processing System JSS
FIG. 1 shows the configuration of an information processing system JSS according to the first embodiment.

As shown in FIG. 1, the information processing system JSS of the first embodiment includes terminals TM1 to TMm (m is an integer equal to or greater than 1) and a server SV. As shown in FIG. 1, the terminals TM1 to TMm and the server SV are connected to each other via a network NW (e.g., the Internet).

The terminals TM1 to TMm are used by users US1 to USm who develop and use software SW to be managed by the server SV. For example, the terminal TM1 is used by the user US1, the terminal TM2 is used by the user US2, and so on, and the terminal TMm is used by the user USm.

The server SV is used by the administrator KA. As shown in FIG. 1, the server SV stores the software SW, and also generates and stores the configuration information KJ (particularly, the part information included in the software SW (hereinafter, also referred to as "software part information")) and the history information RJ having the history timing information (e.g., time information JJ). The history timing information is timing information stored as history information, and in particular, it can be timing information (e.g., information including at least a date, hereinafter, also referred to as "time information JJ" in the explanation) at one or more points from the time of generation of the software part information (e.g., the configuration information KJ) to the time of storage of the history information RJ. More specifically, the history timing information can be, for example, the time when the software part information is generated by the processing unit SY (SV), the time when the software part information is acquired by the server SV (for example, when generated outside the server SV), the time when the software part information is stored by the server SV, the time when the history information is generated by the processing unit SY (SV), the time when the history information is stored by the server SV, the time when the history information is generated by the processing unit SY (SV), the time when the history information is stored by the server SV, etc. In addition, if the server SV is configured logically (e.g., a cloud server), operations on the server SV may be performed by the administrator KA operating the terminal TM.

In the following, for ease of explanation and understanding, multiple identical devices may be collectively referred to by a single name, for example, terminals TM1 to TMm may be collectively referred to as terminal TM.

<Configuration of Terminal TM>
FIG. 2 shows the configuration of the terminal TM of the first embodiment.

As shown in FIG. 2, the terminal TM of the first embodiment has an input/output unit NS(TM), a processing unit SY(TM), a memory unit KI(TM), and a communication unit TU(TM).

The input/output unit NS(TM) is used by the user US to make inputs to change, add, delete, etc., the components that make up the software SW (e.g., as shown in FIG. 6) in order to update the software SW, and is also used to output the configuration of the software SW obtained from the server SV. The input/output unit NS(TM) is, for example, a touch panel, a keyboard, a mouse, an LCD monitor, or a printer.

The processing unit SY(TM) performs, for example, processing related to input for updating the above-mentioned software SW and output of the configuration of the above-mentioned software SW. The processing unit SY(TM) also executes the software SW obtained by the user US according to the needs of the user US.

The memory unit KI(TM) stores, for example, data necessary for processing by the processing unit SY(TM).

The communication unit TU (TM) communicates via the network NW, for example, sending the above-mentioned updated software SW to the server SV, and also receiving the software SW managed by the server SV from the server SV.

<Server SV Configuration>
FIG. 3 shows the configuration of the server SV in the first embodiment.

As shown in FIG. 3, the server SV of the first embodiment has an input/output unit NS (SV), a processing unit SY (SV), a memory unit KI (SV), and a communication unit TU (SV).

The input/output unit NS (SV) is used, for example, in connection with an update of the software SW, to output history information RJ (e.g., as shown in FIG. 1), and is also used to input information to add supplementary information (e.g., bibliographic information) to the history information RJ. The input/output unit NS (TM) is, for example, a touch panel, a keyboard, a mouse, an LCD monitor, or a printer. As mentioned above, when the server SV is logically configured via a network (e.g., a cloud server), it may be replaced by the input/output unit NS provided on the terminal TM of the administrator KA.

The processing unit SY (SV) performs, for example, processing related to the output of the above-mentioned history information RJ and input to the history information RJ. The processing unit SY (SV) also notifies the user US and manages the license of the software SW as necessary based on the history information RJ.

The memory unit KI (SV) stores, for example, data necessary for processing by the processing unit SY (SV).

The communication unit TU (SV) communicates via the network NW, for example, receives updated software SW from the user US, and also transmits software SW managed by the server SV to the terminal TM.

<Operation of the First Embodiment>
FIG. 4 is a flowchart showing the operation of the information processing system JSS according to the first embodiment.

FIG. 5 is a time chart showing the operation of the information processing system JSS according to the first embodiment.
The operation of the information processing system JSS according to the first embodiment will be described with reference to the flow chart of FIG. 4 and the time chart of FIG.

In the following, for ease of explanation and understanding, the following is assumed.
(1) Among the users US1 to USm, the users US1 to US3 are involved in the development of the software SW (as shown in FIG. 4).
(2) The initial version of the software SW includes one or more parts (e.g., parts A, B, C, . . . W) (as shown in FIG. 6).
(3) History information RJ (shown in FIG. 18 ) linking configuration information KJ0 (shown in FIG. 6 ) indicating the configuration of the initial version of the software SW and time information JJ0 (shown in FIG. 7 ) indicating the time t0 (12:34 p.m. on Feb. 3, 2023) when the software SW (initial version) was saved is stored in the server SV.

Step ST11 (at time t1): Terminal TM1 transmits the software SW to which "part Dadd has been added" by user US1, i.e., configuration information KJ1 (shown in FIG. 8), to server SV.

Step ST12: When the server SV receives, i.e., acquires, the software SW to which "part Dadd has been added", i.e., the configuration information KJ1, it acquires, for example, time information JJ1 (shown in FIG. 9) indicating time t1 "March 4, 2023, 13:45" from the clock in the information processing system JSS. The server SV further updates the history information RJ by linking the configuration information KJ1 and the time information JJ1 to each other (shown in FIG. 19).

Step ST13 (at time t2): Terminal TM2 transmits the software SW for which user US2 has "changed part T to part Tchg," i.e., configuration information KJ2 (shown in FIG. 10), to server SV.

Step ST14: When the server SV receives the software SW in which "part T has been changed to part Tchg", i.e., the configuration information KJ2, it acquires the time information JJ2 (shown in FIG. 11) indicating the time t2, "14:32, April 5, 2023". The server SV further updates the history information RJ by linking the configuration information KJ2 and the time information JJ2 to each other (shown in FIG. 20).

Step ST15 (at time t3): Terminal TM3 transmits the software SW for which user US3 has "changed part U to part Uchg," i.e., configuration information KJ3 (shown in FIG. 12), to server SV.

Step ST16: When the server SV receives the software SW in which "part U has been changed to part Uchg", i.e., the configuration information KJ3, it acquires the time information JJ3 (shown in FIG. 13) indicating the time t3 "15:21, May 6, 2023". The server SV further updates the history information RJ by linking the configuration information KJ3 and the time information JJ3 to each other (shown in FIG. 21).

Step ST17 (at time t4): Terminal TM2 transmits the software SW for which user US2 has "changed part Tchg1 to part Tchg2," i.e., configuration information KJ4 (shown in FIG. 14), to server SV.

Step ST18: When the server SV receives the software SW in which "part Tchg1 has been changed to part Tchg2", i.e., the configuration information KJ4, it acquires time information JJ4 (shown in FIG. 15) indicating time t4, "16:10, June 7, 2023". The server SV further updates the history information RJ by linking the configuration information KJ4 and the time information JJ4 to each other (shown in FIG. 22).

Step ST19 (at time t5): Terminal TM1 transmits the software SW for which user US1 has "changed part W to part Wchg," i.e., configuration information KJ5 (shown in FIG. 16), to server SV.

Step ST20: When the server SV receives the software SW in which "part W has been changed to part Wchg", i.e., the configuration information KJ5, it acquires the time information JJ5 (shown in FIG. 17) indicating time t5 "17:05, July 8, 2023". The server SV further updates the history information RJ by linking the configuration information KJ5 and the time information JJ5 to each other (shown in FIG. 23).

In the above example, the configuration information KJ is sent to the server SV. Alternatively, the configuration information KJ (particularly, software component information) of the software SW may be constructed by analyzing information about the software SW (e.g., hierarchical information about folders, hierarchical information about the source of a program, etc.) by the processing unit SY of the server SV, so that the configuration information KJ includes hierarchical component information. The information about the software may be transmitted from the terminal TM, or may be information read from a storage area of another computer (e.g., a cloud server, etc.) via a predetermined path. The predetermined path may be, for example, reading by the processing unit SY of the server SV or the terminal TM via a network or a wired cable (especially by being granted access rights to the storage area of the other computer), or may be temporarily stored in an external storage device such as a memory card, and the external storage device may be connected to a computer that can access the server SV, such as the terminal TM, and read out, thereby storing the information in the storage unit KI of the server SV.

Effects of the First Embodiment
As described above, in the information processing system JSS of the first embodiment, each time the users US1 to US3 update the contents of the software SW (adding, changing, deleting, etc.), the server SV generates history information RJ by linking the configuration information KJ and the time information JJ to each other. This makes it possible to check the history information RJ and identify when the software SW was used, even if the software SW had a defect in the past (for example, a vulnerability, a bug, a crash, or other malfunction, or a license-related defect caused by the licensor of a licensed component (for example, use outside the scope of the license, open source software no longer being open source, a paid license expiring, etc.)).

For example, even if part Tchg1 has a vulnerability, as shown in FIG. 5, it is possible to determine that part Tchg1 is in use and the usage period SK is between time t2 and time t4, and more specifically, between "April 5, 2023, 14:32" and "June 7, 2023, 16:10."

<Modification 1-1>
Information on whether components A to W, etc., included in the software SW have vulnerabilities (hereinafter also referred to as "vulnerability information") may be input from a terminal TM of a user US who develops the software SW and stored in the storage unit KI of the server SV, or the vulnerability information may be generated by an original analysis performed by a processing unit SY of the server SV and stored in the storage unit KI of the server SV. In addition, if a vulnerability database in which vulnerability information of the software SW is stored is publicly available (especially if it is open source), the processing unit SY of the server SV may access the vulnerability database via a network NW (e.g., the Internet) to collect (crawl) and store the vulnerability information.

Then, the processing unit SY of the server SV may execute a process of comparing the vulnerability information stored in the memory unit KI of the server SV with the configuration information KJ (particularly, information on parts A to W) included in the history information RJ, and identifying information indicating at least one of the period during which the part corresponding to the vulnerability information was included, software information (including version information), and configuration information KJ (hereinafter also referred to as "vulnerability target information").

In addition, to facilitate explanation and understanding, vulnerability information has been described, but the present invention is not limited to this, and may be any information (such as vulnerability information, malfunction information, license-related defect information, etc., as described above) that is information (hereinafter also referred to as "defect information") related to defects in the software SW (particularly, the parts A to W included in the software SW) stored in the storage unit KI of the server SV. That is, the processing unit SY of the server SV may execute a process of comparing the defect information stored in the storage unit KI of the server SV with the configuration information KJ (particularly, information related to the parts A to W) included in the history information RJ, and identifying (generating) information indicating at least one of the period or version in which the part corresponding to the defect information was included in the history information RJ and the configuration information KJ (hereinafter also referred to as "defect-related information"). In addition, "storing" defect information includes storing it in any of the primary storage device (main memory), secondary storage device, cache memory, etc. included in the storage unit KI, and may be, for example, storing it by a registration process in response to a registration operation by the user US or the administrator KA, or temporarily storing it when obtaining it from an external database or the like and referencing it.

<Effects of Modification Example 1-1>
With the configuration of variant example 1-1, even if the software SW has had a defect in the past (including, for example, vulnerabilities, bugs, crashes, and other malfunctions, as well as license-related defects caused by the licensor of a licensed component (for example, use outside the scope specified in the license, open source software ceasing to be open source, the expiration of a paid license, etc.)), it is possible to identify the defect information by processing by the processing unit SY of the server SV.

<Modification 1-2>
In addition, the processing unit SY of the server SV may, based on a defect matching designation process in which an administrator KA or the like checks the history information RJ and then specifies at least one of the period or version in which a part corresponding to the defect information was included in the history information RJ, and the configuration information KJ, by a defect matching designation operation, as in embodiment 1, or based on the processing of the processing unit SY as in the above-mentioned variant example 1-1, in response to the identification (generation) of defect matching information such as a period in which a defect such as a vulnerability is present, the processing unit SY of the server SV may, based on a defect matching designation process in which an administrator KA or the like checks the history information RJ and then specifies at least one of the period or version in which a part corresponding to the defect information was included in the history information RJ, and the configuration information KJ ... above-mentioned variant example 1-1,

<Effects of Modification Example 1-2>
The configuration of variant example 1-2 enables the user US to smoothly recognize the defect by sending a notification regarding the identified software component having the defect to the terminal TM of the user US.

<Modification 1-3>
In addition, the processing unit SY of the server SV may associate importance information indicating the importance of each software component or software SW (which may also be called ``impact degree indicating the impact degree'') with the software component or software SW, and store the associated information in the memory unit KI of the server SV.

The importance information (impact information) may be, for example, an input operation from at least one of the user US and the administrator KA, and an arbitrary importance may be set for each software component and/or each software SW in the memory unit KI of the server SV, and/or the processing unit SY of the server SV may execute a setting process to set the importance by referring to importance condition information indicating the conditions for setting each importance. Here, the conditions for setting each importance may be, for example, at least one of the following six:
(1) Whether or not at least one of the target software SW or software components (hereinafter referred to as software components, etc.) is connected to the Internet (i.e., a condition based on connection relationship information);
(2) Whether or not the target software component, etc. is connected to an area to which access is restricted (i.e., a condition based on access restriction information)
(3) Whether or not the target software component, etc. contains important data information (e.g., confidential information, customer information, personal information, credit card information, etc.) (i.e., a condition based on important data information)
(4) In which software environment (test environment, development environment, production environment, etc.) the target software components, etc. are intended (i.e., conditions based on software environment information)
(5) Whether or not the target software component has access rights to other resources (computers, databases, networks, etc.) (i.e., conditions based on access right information)
(6) What is the threat level of the defects (particularly vulnerabilities) associated with the software component itself (i.e., conditions based on the threat level information of the defects)

Then, the processing unit SY performs a determination process to compare the importance information indicating the importance corresponding to the changed software components, etc. (particularly software components, etc., for which the difference in the changes identified in the second embodiment described below is greater than a standard) with the standard information, and determines whether the importance is higher than the standard. Only when it is determined that the importance is higher than the standard, may a notification including information regarding the importance of the changed software components, etc. (for example, a notification informing users that a software component, etc., with a high level of importance has been changed) be sent (i.e., the need for a notification may be determined based on the importance). At this time, one or more pieces of criterion information may be stored in the memory unit KI of the server SV, and when two or more comparison results are obtained (for example, when the importance level is set to four levels, Critical, High, Medium, and Low, according to the conditions, if there is one criterion, two comparison results of Critical or higher and High or lower, or two comparison results of High or higher and Medium or lower, and if there are three criteria, four comparison results with respective weights from Critical to Low, etc.), notification destination information may be set according to each comparison result. That is, the notification destination information may include destination information (for example, an email address, etc.), and for example, if there is one criterion, if the importance level of the changed software component or the like is Critical, a notification may be sent based on destination information indicating a mailing list for all members of the group, and if it is High or lower, a notification may be sent based on destination information indicating only one specific responsible person. In other words, depending on the comparison result, the notification may be sent to different recipients (e.g., a mailing list or just one responsible person) or to different notification scopes (e.g., a mailing list and one responsible person or just one responsible person).

Alternatively, or in addition, the processing unit SY may compare the importance information indicating the importance corresponding to the software component, etc., identified as the defect-related information with the reference information, and perform a judgment process to judge whether the importance is higher than the reference, and send the notification described in the modified example 1-2 only if the importance is judged to be higher than the reference (i.e., the necessity of the above-mentioned notification may be determined based on the importance). At this time, one or more reference information may be stored in the memory unit KI of the server SV, and when two or more comparison results are obtained, notification destination information according to each comparison result may be set. That is, the notification destination information may include destination information (e.g., email address, etc.), and for example, if there is one criterion, when the importance of the changed software component, etc. is Critical, a notification may be sent based on destination information indicating a mailing list for all members of the group, and when it is High or lower, a notification may be sent based on destination information indicating only one specific responsible person. In other words, depending on the comparison result, the notification may be sent to different recipients (e.g., a mailing list or just one responsible person) or to different notification scopes (e.g., a mailing list and one responsible person or just one responsible person).

<Effects of Modification Example 1-3>
The configuration of Modification 1-3 enables efficient response by checking the importance (impact) of changed software components, etc. (or software components, etc. with identified defects) when software is updated frequently. In particular, when issuing a notification, it is possible to reduce the number of notifications by limiting the notifications to those indicating a predetermined importance (importance higher than the standard).

Second Embodiment
An information processing system JSS according to the second embodiment will be described.

Configuration of Second Embodiment
The information processing system JSS of the second embodiment has a configuration similar to that of the information processing system JSS of the first embodiment (shown in FIGS. 1, 2, and 3).

<Operation of the Second Embodiment>
The information processing system JSS of the second embodiment basically performs the same operations as the information processing system JSS of the first embodiment (shown in FIGS. 4 and 5).

On the other hand, the information processing system JSS of embodiment 2 differs from the information processing system JSS of embodiment 1 which stores history information RJ (shown in Figures 18 to 23) consisting of time information JJ and configuration information KJ, or in addition, stores history information RJ consisting of time information JJ and difference information SJ, as shown in Figure 24. In other words, it generates comparison result information (hereinafter also referred to as "difference information") that indicates the result (difference) of comparing software component information stored at two points in time with each other. The difference information SJ may be stored in the memory unit KI of the server SV by receiving an input from the terminal TM, and/or the processing unit SY of the server SV may perform a comparison process (e.g., character comparison by character-based search, or image comparison by image-based image analysis, etc.) between any form of configuration information KJ among tree-diagram-like configuration information KJ (i.e., configuration information KJ showing the relationships between software components), matrix-like configuration information KJ, and interrelationship configuration information KJ, and the result of the comparison may be stored in the memory unit KI of the server SV as difference information.

In the history information RJ, as shown in FIG. 24, the time information JJ and the difference information SJ are linked to each other. For example, the time information JJ1 at time t1 and the difference information SJ1 at time t1 are linked to each other.

The difference information SJ of the second embodiment, which replaces the configuration information KJ of the first embodiment, indicates the difference between the software SW before and after the software SW is updated, i.e., the difference between the configuration information KJ.

For example, difference information SJ1 is the result of comparing configuration information KJ0 (shown in the top of FIG. 25) in the form of a tree diagram at time t0 indicated by time information JJ0 with configuration information KJ1 (shown in the bottom of FIG. 25) in the form of a tree diagram at time t1 indicated by time information JJ1, i.e., it indicates the difference "addition of part Dadd" (shown in FIGS. 24 and 25).

The difference information SJ1 also indicates the difference "addition of part Dadd" (shown in Figures 24 and 26) between the matrix-shaped configuration information (hierarchy) KJ0 (KS) (shown in the top of Figure 26) at time t0 indicated by the time information JJ0 and the matrix-shaped configuration information (hierarchy) KJ1 (KS) (shown in the bottom of Figure 26) at time t1 indicated by the time information JJ1.

The difference information SJ1 further indicates the difference "addition of part Dadd" (shown in Figures 24 and 27) between the configuration information (relationship) KJ0 (KK) (shown in the top of Figure 27) indicating the interrelationship between parts (e.g., parent-child relationship) at time t0 indicated by the time information JJ0, and the configuration information (relationship) KJ1 (KK) (shown in the bottom of Figure 27) indicating the interrelationship between parts at time t1 indicated by the time information JJ1.

Effects of the Second Embodiment
As described above, in the information processing system JSS of the second embodiment, history information RJ in which difference information SJ and time information JJ are linked to each other is generated, instead of history information RJ in which configuration information KJ and time information JJ are linked to each other as in the first embodiment. This makes it possible to identify when software SW was used, even if software SW had vulnerability in the past, as in the first embodiment.

<Modification 2-1>
The difference information described above includes the part name, but instead of or in addition to this, a difference value according to the amount of difference may be associated with the part name. The difference value may be, for example, a value based on the number of differences. Alternatively, the difference value may be a value obtained by multiplying the number of differences by a weighting coefficient set for each part.

<Effects of Modification Example 2-1>
With the configuration of Modification 2-1, by linking a difference value according to the amount of difference instead of or in addition to the part name as difference information, it becomes possible to recognize not only differences in the software configuration but also changes more quantitatively. This makes it possible to operate in a way that, for example, "checks whether the difference amount after a change exceeds a reference value, and if it does exceed it, checks whether a malfunction has occurred."

<Modification 2-2>
In addition, result condition information indicating conditions related to the comparison result may be set, and a notification indicating that the conditions have been met may be sent to the terminal TM based on the comparison result information (difference value) and the result condition information (for example, a reference value is set and the difference value exceeds the reference difference value, etc.).

<Effects of Modification Example 2-2>
With the configuration of variant example 2-2, notifications regarding software components having a difference amount equal to or greater than a predetermined standard are sent to the terminal TM of the user US, enabling the user US to smoothly recognize changes to the software SW (especially changes with large difference amounts).

Third Embodiment
An information processing system JSS according to the third embodiment will be described.

Configuration of Third Embodiment
The information processing system JSS of the third embodiment has a configuration similar to that of the information processing system JSS of the first embodiment (shown in FIGS. 1, 2, and 3).

<Operation of the Third Embodiment>
In the information processing system JSS of embodiment 3, the input/output units NS (TM) (shown in Figure 2) of terminals TM1 to TMm display, for example, the configuration of software SW in the form of configuration information KJ11 to KJ4 (shown in Figures 28 to 31) instead of or in addition to the configuration information KJ (for example, configuration information KJ0 (shown in Figure 6)) of embodiment 1.

In the configuration information KJ11, the components A to W that make up the software SW may be displayed separately as main routines and subroutines, as shown in FIG. 28.

In the configuration information KJ12, as shown in FIG. 29, the number of times that components A to W that make up the software SW are used in the software SW may be displayed.

In the configuration information KJ13, as shown in FIG. 30, the components A to W that make up the software SW may be displayed separately as components that have subroutines and components that do not have subroutines.

In the configuration information KJ14, as shown in FIG. 31, the required times T(A), T(B), T(C), and T(D) for the main routines of parts A, B, C, and D among the parts A to W that make up the software SW, and the parts that make up parts A, B, C, and D (for example, parts S and T that make up part A) may be displayed in chronological order.

Effects of the Third Embodiment
As described above, the information processing system JSS of the third embodiment displays the configuration information KJ11 to KJ14 in a display format instead of or in addition to the display format used by the information processing system JSS of the first embodiment. This makes it possible to identify when the software SW was used, even if the software SW had a defect in the past, just like in the first embodiment. Furthermore, the information processing system JSS of the first embodiment has better visibility in the display format of the configuration information KJ11 to KJ14, making it easier to perform the above identification.

<Hardware configuration of the first to third embodiments>
FIG. 32 shows the hardware configuration of the information processing system JSS according to the first to third embodiments.

In order to perform the above-mentioned functions, the information processing system JSS of embodiments 1 to 3 includes a processing circuit SYO as shown in FIG. 32, and further includes an input circuit NYU and an output circuit SYU as necessary.

The processing circuit SYO is dedicated hardware. The processing circuit SYO mainly realizes the functions of the processing unit SY(TM) of the terminal TM and the processing unit SY(SV) of the server SV (shown in Figures 2 and 3).

The processing circuit SYO may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these.

The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processing circuit SYO, for example, between the terminal TM and the outside of the server SV.

<Hardware configuration based on software implementation of the first to third embodiments>
FIG. 33 shows a hardware configuration based on the software realization of the information processing system JSS according to the first to third embodiments.

As shown in FIG. 32, the information processing system JSS of embodiments 1 to 3 includes a processor PRO and a memory circuit KIO, and further includes an input circuit NYU and an output circuit SYU as necessary.

The processor PRO is a CPU (also called a Central Processing Unit, central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, or DSP (Digital Signal Processing)) that executes programs. The processor PRO mainly realizes the functions of the processing unit SY (TM) of the terminal TM and the processing unit SY (SV) of the server SV.

The processor PRO realizes the above-mentioned functions by software, firmware, or a combination of software and firmware. The software and firmware are written as a program PRG and stored in the memory circuit KIO.

The processor PRO realizes the above-mentioned functions by reading and executing the above-mentioned program PRG from the memory circuit KIO. The above-mentioned program PRG can be said to mainly cause the computer to execute the procedures and methods of the processing unit SY (TM) of the terminal TM and the processing unit SY (SV) of the server SV.

Here, the memory circuit KIO is, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), etc., as well as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), etc.

Some of the functions of the input/output unit NS(TM) to the communication unit TU(TM) of the terminal TM and the input/output unit NS(SV) to the communication unit TU(SV) of the server SV may be realized by a processing circuit SYO (shown in FIG. 32), while other functions may be realized by a processor PRO (shown in FIG. 33).

As described above, the functions of the input/output unit NS(TM) to the communication unit TU(TM) of the terminal TM and the input/output unit NS(SV) to the communication unit TU(SV) of the server SV can be realized by hardware, software, firmware, or a combination of these.

The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processor PRO, for example, between the terminal TM and the outside of the server SV.

<Example of composition>
An information processing system, an information processing method, a program, and a recording medium according to the present disclosure have, for example, the following configuration.

[Item 1]
The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
the history timing information is information indicating one or more timing points from a time point when the software component information is generated to a time point when the history information is stored;
Information processing system.
[Item 2]
The processing unit further
Identifying information indicating at least one of a period during which the component corresponding to the defect information was included and software component information based on the defect information stored in the storage unit and the history information;
Item 2. The information processing system according to item 1.
[Item 3]
The processing unit further
sending at least one of a notification regarding the period of use during which the defective part was used, a notification regarding prohibition of use of software including the defective part, and a notification regarding recommendation of use of software including the non-defective part to a predetermined terminal;
3. The information processing system according to item 2.
[Item 4]
The processing unit further
determining whether or not to transmit the notification based on importance information set at least on a component basis or on a software component information basis;
Item 4. An information processing system according to item 3.
[Item 5]
generating comparison result information indicating a result of comparing the software component information stored at the two points in time;
5. The information processing system according to any one of items 1 to 4.
[Item 6]
transmitting a notification indicating that the condition is met to a predetermined terminal based on the comparison result information and result condition information indicating a condition related to the result;
Item 6. An information processing system according to item 5.
[Item 7]
the comparison result is difference value information based on a difference between pieces of software component information, and the condition includes that the difference value indicated by the difference value information exceeds a reference difference value.
Item 7. An information processing system according to item 6.
[Item 8]
the software component information is acquired by analyzing hierarchical information included in information about the software;
8. The information processing system according to any one of items 1 to 7.
[Item 9]
The information about the software is information read from a storage area of another computer.
Item 9. An information processing system according to item 8.
[Item 10]
The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
An information processing method, wherein the history timing information indicates one or more timing points from a time point when software component information is generated to a time point when the history information is stored.
[Item 10]
The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
the history timing information is information indicating one or more timing points from a time point when the software component information is generated to a time point when the history information is stored;
program.

JSS Information processing system TM Terminal SV Server US User KA Administrator NW Network SW Software RJ History information KJ Configuration information JJ Time information

Claims (9)

The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
Identifying information indicating at least one of a time point, a period, or software component information during which a component corresponding to the defect information was included, based on the defect information stored in the storage unit and the history information;
determining whether or not to send a notification regarding the component including the defect based on importance information set on a component basis or on a software component information basis;
Transmitting the notification to a destination terminal according to the determined necessity of transmission;
the history timing information is information indicating one or more timing points from a time point when the software component information is generated to a time point when the history information is stored;
Information processing system. The processing unit further
sending at least one of a notification regarding the period of use during which the defective part was used, a notification regarding prohibition of use of software including the defective part, and a notification regarding recommendation of use of software including the non-defective part to a predetermined terminal;
The information processing system according to claim 1 . The processing unit further
generating comparison result information indicating a result of comparing the software component information stored at the two points in time;
The information processing system according to claim 1 . transmitting a notification indicating that the condition is met to a predetermined terminal based on the comparison result information and result condition information indicating a condition related to the result;
The information processing system according to claim 3 . the comparison result is difference value information based on a difference between pieces of software component information, and the condition includes that the difference value indicated by the difference value information exceeds a reference difference value.
5. The information processing system according to claim 4 . the software component information is acquired by analyzing hierarchical information included in information about the software;
6. An information processing system according to claim 1 . The information about the software is information read from a storage area of another computer.
7. The information processing system according to claim 6 . The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
Identifying information indicating at least one of a time point, a period, or software component information during which a component corresponding to the defect information was included, based on the defect information stored in the storage unit and the history information;
determining whether or not to send a notification regarding the component including the defect based on importance information set on a component basis or on a software component information basis;
Transmitting the notification to a destination terminal according to the determined necessity of transmission;
the history timing information is information indicating one or more timing points from a time point when the software component information is generated to a time point when the history information is stored;
Information processing methods. The processing section:
generating history information indicating a change history of the software component information based on software component information and history timing information relating to one or more software components constituting a predetermined software;
Identifying information indicating at least one of a time point, a period, or software component information during which a component corresponding to the defect information was included, based on the defect information stored in the storage unit and the history information;
determining whether or not to send a notification regarding the component including the defect based on importance information set on a component basis or on a software component information basis;
Transmitting the notification to a destination terminal according to the determined necessity of transmission;
the history timing information is information indicating one or more timing points from a time point when the software component information is generated to a time point when the history information is stored;
program.