Risk analysis device, risk analysis method and program storage medium

[0001] This application is a National Stage Entry of PCT/JP2013/005211 filed on Sep. 3, 2013, which claims priority from Japanese Patent Application 2012-201746 filed on Sep. 13, 2012, the contents of all of which are incorporated herein by reference, in their entirety.

[0002] The present invention relates to risk analysis technology, and in particular, relates to technology of analyzing legal or contractual risks in datacenter migration.

[0003] In recent years, services utilizing cloud computing have come into widespread use. Datacenters are generally used as an infrastructure for providing such services. Datacenters are located all over the world and provided by a large number of service providers.

[0004] Hereafter, an application software program is referred to simply as an “application”.

[0005] It is often the case that a plurality of datacenters are used in operation of a service utilizing cloud computing. In such a case, migration of applications and data between datacenters is occasionally performed. At a time of such migration of applications and data, it is possible that a problem arises from a difference between the migration origin and the migration destination in operation rules about data operation and the like, a difference in applicable laws due to the difference between location countries for the datacenters, presence or absence of a contract with the datacenter provider with regard to these matters, and the like.

[0006] Specifically, when a law to be applied to data (for example, a law related to protection of personal information and privacy) exists at the migration origin but no law corresponding to the law exists at the migration destination, it is possible that no appropriate protection policy is taken with respect to data to be migrated. When an accident such as data leakage occurs at the migration destination datacenter as a result of that no appropriate protection policy has been taken there, if no measures against such an accident are explicitly prescribed in the contract with the migration destination datacenter, it is possible that a problem arises in terms of ex post measures, compensation and the like. For example, when migrating applications and data to a datacenter (cloud) located in a foreign country, with the aim of a cost reduction effect, great risk is involved in entrusting management of data requiring particular legal protection to a cloud provider not taking an appropriate measure. Inspecting in advance the occurrence of such a problem requires an enormous workload, because it is necessary to check a large number of matters including the contents of applications and data, contracts between datacenter providers, relevant laws in the country or area of the migration destination, and the like.

[0007] Already known are the following technologies for determining or inspecting risks of legal violation and of contractual incompleteness.

[0008] A contract information management system described in Patent Literature 1 (PTL 1) demands inputting a possibility (risk) of problem occurrence and determines a degree of the risk on the basis of the inputted information, in management of contractual coverage. Here, the risk is referred to as lack of a description of a legal clause which is to be prescribed in the contract.

[0009] An export management system described in Patent Literature 2 (PTL 2) includes a database storing relevant laws to be obeyed in exporting a product, such as the Export Control Order, and a database storing previous determination results on whether an export item violated a law, and thereby supports determining whether an export item or the like violates the relevant laws or not.

[0010] A law-observance condition inspection support system described in Patent Literature 3 (PTL 3) supports inspecting a law-observance condition in a business performed by the company, using a law-observance matrix consisting of a table of law themes and a check list of laws.

• • [0011] PTL 1: Japanese Patent Application Laid-Open No. 2003-99678
  • [0012] PTL 2: Japanese Patent Application Laid-Open No. 2003-36323
  • [0013] PTL 3: Japanese Patent Publication No. 4709876

[0014] The contract information management system described in the above-mentioned PTL 1 requires a user to input information representing a contract and the content of its risk. Accordingly, because it is required of a user to perform determination and input the determination result, there still is a problem in that the user is required to bear an enormous workload.

[0015] The export control system described in the above-mentioned PTL 2 displays previous determination results, results of determination by experts, texts of relevant laws, and the like, and then requests a user to input his/her determination on the presence or absence of violation of the relevant laws. Accordingly, because it is required of users including the experts to perform determination and input the determination results, there still is a problem in that the users are required to bear an enormous workload. There is also another problem in that, when no previous determination results exist, a user needs to perform determination by himself by means of such as referring to other information, and accordingly to bear a large load. The export control system described in PTL 2 has also a problem in that, because it does not determine whether an export item violates a law of the destination country or area for the export, determination of legal violation risks with respect to the export destination needs to be separately performed by another means.

[0016] The law-observance condition inspection system described in the above-mentioned PTL 3 requires a user to input a risk level with regard to laws and a condition for obeying the laws. Accordingly, because it is required of a user to input information about legal violation risks, there still is a problem in that the user is required to bear an enormous workload.

[0017] The main purpose of the present invention is to solve the problems described above, and accordingly to provide a risk analysis device, a risk analysis method and a program which reduce a workload of analysis and determination of legal or contractual risks in migration of applications and data between datacenters.

[0018] A risk analysis device according to the present invention to achieve the purpose, includes:

[0019] a storage means; a first migration information extraction means; a second migration information extraction means; a third migration information extraction means; and a migration risk determination means, wherein:

[0020] the storage means stores business application information which is information about management of applications and data, applicable law information at a datacenter and contract information about a contract with a datacenter;

[0021] the first migration information extraction means extracts first migration information, which is information regarding datacenter migration, from the business application information associated with a particular application and particular data which are migration targets;

[0022] the second migration information extraction means extracts second migration information, which is information regarding the datacenter migration, from the applicable law information associated with a migration destination datacenter;

[0023] the third migration information extraction means extracts third migration information, which is information regarding the datacenter migration, from the contract information associated with migration destination datacenter; and

[0024] the migration risk determination means determines legal or contractual risks in datacenter migration, by comparing the first and second migration information with the third migration information.

[0025] A risk analysis method according to the present invention to achieve the purpose, includes:

[0026] extracting first migration information, which is information regarding datacenter migration, from business application information associated with a particular application and particular data which are migration targets;

[0027] extracting second migration information, which is information regarding the datacenter migration, from applicable law information;

[0028] extracting third migration information, which is information regarding datacenter migration, from contract information associated with a migration destination datacenter; and

[0029] determining legal or contractual risks in datacenter migration, by comparing the first and second migration information with the third migration information.

[0030] A program according to the present invention to achieve the purpose, to allow a computer to execute, includes a process of:

[0031] extracting first migration information, which is information regarding datacenter migration, from business application information associated with a particular application and particular data which are migration targets;

[0032] extracting second migration information, which is information regarding the datacenter migration, from applicable law information;

[0033] extracting third migration information, which is information regarding datacenter migration, from contract information associated with a migration destination datacenter; and

[0034] determining legal or contractual risks in datacenter migration, by comparing the first and second migration information with the third migration information.

[0035] Here, the objective is also achieved by means of a computer-readable storage medium storing the program.

[0036] A risk analysis device, a risk analysis method and a program according to the present invention enable a user to easily analyze legal or contractual risks in datacenter migration.

[0046] Next, exemplary embodiments of the present invention will be described in detail, with reference to drawings.

[0047] FIG. 1 is a diagram illustrating a configuration of a risk analysis device according to a first exemplary embodiment of the present invention. A risk analysis device 100 according to the first exemplary embodiment of the present invention is provided with a storage unit 101, a first migration information extraction unit 102, a second migration information extraction unit 103, a third migration information extraction unit 104 and a migration risk determination unit 105.

[0048] The storage unit 101 stores business application information, which is information about management of applications and data, applicable law information at a datacenter (not illustrated), and contract information for the datacenter.

[0049] In the following descriptions, “information regarding migration” means primarily that it is information which influences analysis of risks in migration of applications or data between datacenters and information which is to be taken into consideration in the risk analysis. The “information regarding migration” is used in the analysis of legal or contractual risks in datacenter migration, by being extracted from the business application information, the applicable law information, the contract information, a service policy and the like, and then compared with each other.

[0050] The first migration information extraction unit 102 extracts first migration information, which is information regarding migration, from business application information associated with a particular application and particular data which are to be migration targets.

[0051] The second migration information extraction unit 103 extracts second migration information, which is information regarding migration, from applicable law information associated with a migration destination datacenter.

[0052] The third migration information extraction unit 104 extracts third migration information, which is information regarding migration, from contract information associated with the migration destination datacenter.

[0053] By comparing the first and second migration information with the third migration information, the migration risk determination unit 105 determines legal or contractual risks in the datacenter migration.

[0054] As has been described above, the risk analysis device 100 according to the first exemplary embodiment of the present invention enables a user to easily analyze legal or contractual risks in datacenter migration. It is because the migration risk determination unit 105 determines the risks on the basis of pieces of information regarding migration extracted from, respectively, the business application information, the applicable law information and the contract information.

[0055] Next, a second exemplary embodiment of the present invention will be described.

[0056] FIG. 2 is a diagram illustrating a configuration of a risk analysis device according to the second exemplary embodiment of the present invention. A risk analysis device 100A according to the second exemplary embodiment of the present invention is provided with a storage unit 101, a first migration information extraction unit 102, a second migration information extraction unit 103, a third migration information extraction unit 104, a migration risk determination unit 105, a fourth migration information extraction unit 106, an input unit 107 and an output unit 108.

[0057] The storage unit 101 stores business application information, applicable law information, contract information and a service policy. The business application information includes information about the contents and configuration of an application and information about management and operation of data. The applicable law information is information about laws to be applied to data held by a datacenter (not illustrated) on the basis of the placement location (country or area) of the datacenter. The contract information is information representing the contents of a contract with a datacenter. The service policy is information representing service policies of the datacenter.

[0058] In migration of applications and data between datacenters, the first migration information extraction unit 102 extracts first migration information, which is information regarding the migration, from information about an application and data being targets of the migration, which is included in the business application information stored in the storage unit 101.

[0059] The second migration information extraction unit 103, in the migration of applications and data between datacenters, extracts second migration information, which is information regarding the migration, from the applicable law information stored in the storage unit 101. Specifically, the second migration information extraction unit 103 may extract applicable law information about the migration destination datacenter, as the second migration information.

[0060] The third migration information extraction unit 104, in the migration of applications and data between datacenters, extracts third migration information, which is information regarding the migration, from the contract information stored in the storage unit 101. Specifically, the third migration information extraction unit 104 may extract contract information about the migration destination datacenter, as the third migration information.

[0061] The fourth migration information extraction unit 106, in the migration of applications and data between datacenters, extracts fourth migration information, which is information regarding the migration, from the service policies stored in the storage unit 101. Specifically, the fourth migration information extraction unit 106 may extract a service policy of the migration destination datacenter, as the fourth migration information.

[0062] By comparing the first and second migration information with the third and fourth migration information, the migration risk determination unit 105 determines legal or contractual risks in the datacenter migration.

[0063] The input unit 107 is a device, such as a keyboard or a mouse, by which a user operates a computer.

[0064] The output unit 108 is a device, such as a display device or a printer device, which outputs results of the computer's processing.

[0065] The storage unit 101 may be realized by a storage medium such as a magnetic disk device or by a storage device such as a memory device.

[0066] The business application information stored in the storage unit 101 includes information (application configuration information) about the contents, configuration, data format, license and the like of an application for performing a business. As examples of the application configuration information, mentioned are the name of the application, the name of a business realized by the application (accounting management, ordering management, material management, customer management or the like), the name of a section managing the application, a list of files whose input/output is performed by the application, data items (schema) of the files, and the like.

[0067] The business application information stored in the storage unit 101 further includes information about data management and an operation method. As examples of such information, mentioned are a data class from the viewpoint of confidentiality (personal information, classified information or the like), a data protection measure such as encryption, a restriction on operation (an area to which migration can be directed, a security policy), and the like. Here, a class of confidential information may be expressed in detail in accordance with a business realized by each application. Such a class of confidential information is, for example, personnel information, customer information or the like with respect to personal information, and accounting information, design information, manufacturing information or the like with respect to classified information.

[0068] Pieces of such business application information are stored in the storage unit 101 in a manner to be associated with each application, each service consisting of a group of applications or each datacenter managing or operating applications. FIG. 5 is a diagram showing an example of business application information stored in the storage unit 101. FIG. 5 shows the contents of a piece of business application information which is stored as one of the records stored in the storage unit 101, which is a database. The business application information shown in FIG. 5 includes information indicating an application to be a migration target and information associated with the application. In that case, it is assumed that applications to be migration targets are specified and migration between datacenters is performed in terms of each of the specified applications. However, a way of migration may be other than that. For example, applications may be assembled into groups corresponding to respective businesses, and migration may be thereby performed in terms of each of the businesses each consisting of a plurality of applications. Alternatively, applications may be assembled into groups corresponding to respective sections, and migration may be thereby performed in terms of each of the sections, that is, each of the groups consisting of a plurality of applications. The business application information may have a configuration which includes information representing a migration target (business, section or the like) and information associated with it, depending on the ways of migration described above.

[0069] The applicable law information stored in the storage unit 101 includes information on laws to be possibly applied in relation to the business (operation of applications and data) and provision of services at a datacenter. As examples of such laws, mentioned are laws related to personal information protection (the Personal Data Protection Act in the United Kingdom, the Federal Data Protection Act in Germany, and the like), laws related to privacy protection (the Privacy Act in Australia, and the like), laws related to judicial procedures (the E-discovery (electronic information discovery) Act in the United States, and the like), laws related to judicial investigative authority (the Data Restriction Investigation Right Act in China, the Patriot Act in the United States, and the like), copyright protection laws, and the like.

[0070] In an area where no laws related to personal information protection and privacy protection have been established, there is a risk of incompleteness in management of data including personal information and customer information, or of difficulty in performing countermeasures and compensation in case of information leakage from the migration destination. In an area where a law related to judicial procedures has been established, there is a risk of bearing a large load of data evidence discovery in case of a lawsuit occurring in relation to a business in the area. In an area where a law related to judicial investigative authority has been established, there is a risk of receiving an order of compulsory discovery of confidential information migrated to the area.

[0071] Pieces of such applicable law information are stored in the storage unit 101 in a manner to be associated with each area (country) as laws each applied to a datacenter located in the area (country) of the law. FIG. 6 is a table showing an example of applicable law information stored in the storage unit 101. The applicable law information in FIG. 6 is constituted, using the area as a key, in a form of comprising pieces of information each about data protection-related laws which are to be possibly applied to a datacenter in the corresponding area. Here, the “EC Data Protection Directive Safe Harbor Agreement” in FIG. 6 is an agreement on that the data protection directive, which is effective within the EC (European Community) zone, permits migration of personal information to the outside of EC as an exception. In return for the permission to migrate personal information from EC, an area being a safe harbor (in FIG. 6, the United States) is obliged to implement a data protection policy equivalent to that of EC. Here, the areas and laws shown in FIG. 6 are the ones used for explaining the present invention, and accordingly, they do not necessarily represent correctly the actual areas and laws.

[0072] The contract information stored in the storage unit 101 includes the contents of a contract concluded between a datacenter user, who migrates his/her own applications and data to entrust their operation to a datacenter, and a datacenter provider who operates the datacenter. The contract information stored in the storage unit 101 also includes the contents of a contract to be concluded between a datacenter and another datacenter when the former datacenter migrates applications and data to re-entrust their operation to the latter datacenter for the purpose of performance retention, cost reduction or the like. Such contract information may include a sentence described in the written contract of a corresponding contract, as it is. FIG. 7 is a diagram showing an example of such contract information stored in the storage unit 101. The contract information in FIG. 7 represents an outline of a usage contract for a case where a datacenter provider A migrates applications and data to entrust their operation to a datacenter provider B in a foreign country. In the contract information in FIG. 7, in order to make them more understandable, the names of typical terms in a written contract are written in Japanese, and their English expressions are added in the parentheses. The contract information may be written in only Japanese or only English.

[0073] The service policy stored in the storage unit 101 is a list (service menu) of functions offered by a datacenter for management of applications and data. The service policy may include detailed rules (resource arrangement, service operation, security measures and the like) which are not explicitly specified in a datacenter usage contract. The service policy may be expressed by sentences or a list of detailed function items accompanied by information on each function's presence or absence. Such service policies are stored in the storage unit 101 in a manner to be associated with each datacenter.

[0074] FIG. 3 is a flow chart illustrating operation of the risk analysis device 100A according to the second exemplary embodiment. With reference to FIG. 3, overall operation of the risk analysis device 100A will be described in detail below.

[0075] First, the risk analysis device 100A acquires information regarding a datacenter migration (step S301). Specifically, the risk analysis device 100A acquires information which specifies an application to be the migration target (for example, the application name, the name of a business of which the application is in charge, or the like) and information which specifies a datacenter to be the migration destination (for example, the datacenter provider name, the name of an area where the datacenter is located, or the like). A user may input such information specifying an application and a migration destination datacenter to the risk analysis device 100A by operating the input unit 107. Alternatively, the present step may be performed in a way where pieces of information each specifying an application and a migration destination datacenter, which were inputted in advance and stored in the storage unit 101, are read out from the storage unit 101 and then displayed, and a user subsequently makes selection from them by operating the input unit 107. Still alternatively, a cloud operation management system (not illustrated) may monitor the resource utilization condition, and for the purpose of utilization load reduction and service continuation in case of incident occurrence, may automatically input such information specifying an application and a migration destination datacenter on the basis a predetermined operation rule.

[0076] Next, the risk analysis device 100A extracts information regarding the migration from business application information, applicable law information the contract information (steps S302 to S304).

[0077] The first migration information extraction unit 102 extracts a relevant piece of business application information from among pieces of business application information stored in the storage unit 101, using a business or application to be the migration target as a key. From the extracted business application information, the first migration information extraction unit 102 further extracts first migration information (step S302). The first migration information represents matters having a possibility of causing a legal problem at a time of datacenter migration, which are potentially included in the applications and data being the migration targets.

[0078] With reference to FIG. 5, the process performed by the first migration information extraction unit 102 will be described below. Out of the information shown in FIG. 5, the first migration information extraction unit 102 extracts the class and protection methods for data with high confidentiality, referring to attributes of each of the business, data class and data protection methods.

[0079] In the example in FIG. 5,

• • [0080] Data class: personal information

[0081] is resulted. The first migration information extraction unit 102 extracts also items regarding operation of the application. They correspond to restrictions on a migration destination. In the example in FIG. 5,

• • [0082] Migration area: Japan, Hong Kong, North America
  • [0083] Resource occupation: server
  • [0084] Security: file encryption, access log, management authority division are extracted.

[0085] Here, the “migration area” indicates a range permitted to be a migration destination of the application. The “resource occupation: server” means that the application is not executed by the same physical server as that for executing other applications, but the application occupies a server, because of a reason in terms of security or performance. The “security: file encryption” means that output files are encrypted, and the “security: access log” means that a log of accesses to the output files is recorded. The “security: management authority division” means that an administrator at the migration origin can manage the application by accessing the migration destination datacenter with a limited privilege (that the management authority is clarified).

[0086] As a result, the first migration information extraction unit 102 obtains the followings, as the first migration information;

• • [0087] Data class: personal information
  • [0088] Migration area: Japan, Hong Kong, North America
  • [0089] Resource occupation: server
  • [0090] Security: file encryption, access log, management authority division.

[0091] The second migration information extraction unit 103 extracts information relevant the migration destination datacenter, from the applicable law information stored in the storage unit 101. From the extracted applicable law information, the second migration information extraction unit 103 further extracts second migration information, which is information regarding the migration (step S303).

[0092] The process performed by the second migration information extraction unit 103 will be described below, with reference to FIGS. 5 and 6. For example, when “Hong Kong” is designated as a migration destination according to the “migration area” in FIG. 5, the second migration information extraction unit 103 refers to the table in FIG. 6 stored in the storage unit 101. Then, the second migration information extraction unit 103 reads out the “Personal Data Ordinance” as the Hong Kong law related to personal information and privacy protection. In the table in FIG. 6, there is no law related to judicial investigative authority or judicial procedures for Hong Kong. It is also seen that Hong Kong is not a safe harbor from the EC law. As a result, the second migration information for Hong Kong turns out to be as follows;

• • [0093] Personal information and privacy protection law: the Personal Data Ordinance
  • [0094] EC safe harbor: NO (Hong Kong is not an EC safe harbor)
  • [0095] Judicial procedure law: absent
  • [0096] Judicial investigative authority law: absent.

[0097] When “the United States” is designated as a migration destination, the second migration information for the United States turns out to be as follows;

• • [0098] Personal information and privacy protection law: the FTC guidelines
  • [0099] EC safe harbor: YES
  • [0100] Judicial procedure law: the E-discovery Act
  • [0101] Judicial investigative authority law: the Patriot Act.

[0102] Further, when “Singapore” is designated as a migration destination, the second migration information for Singapore turns out to be as follows;

• • [0103] Personal information and privacy protection law: absent
  • [0104] EC safe harbor: NO
  • [0105] Judicial procedure law: absent
  • [0106] Judicial investigative authority law: absent

[0107] In the above-described way, the second migration information extraction unit 103 extracts information regarding the datacenter migration from information about laws to be applied to the migration destination datacenter. When, among the above-described items, the item of personal information and privacy protection law indicates the presence of a law (that is, the item is not given “absence”) or that of EC safe harbor is given “YES”, it is determined that the risk of leakage is reduced because the situation results in enhancement of personal information protection. When the items of judicial procedure law and of judicial investigative authority law both indicate the existence of a law (that is, the items are not given “absence”), it is determined that the risk of being requested for compulsory discovery of confidential information by the judicature in the country or area is increased.

[0108] The third migration information extraction unit 104 extracts third migration information from the contract information stored in the storage unit 101, using information on the migration destination datacenter, which was already inputted, as a key (step S304). The third migration information is information into which information regarding the datacenter migration is extracted from the contents of a contract concluded with the migration destination datacenter. Here, the “information regarding datacenter migration” means information which mainly affects the analysis of risk in datacenter migration, as was already described above. That is, the third migration information may include not only contract contents based on assuming their effectiveness in datacenter migration (contents referring to datacenter migration) but also those corresponding to matters having a possibility of their being included in the first or second migration information.

[0109] Specifically, the above-mentioned “contract contents based on assuming their effectiveness in datacenter migration (contents referring to datacenter migration)” means, for example, contract contents such as the following one. “In case migration of data and applications to another datacenter occurs, First Party (the datacenter provider) and Second Party (the datacenter user) each shall bear 50% of the cost”. The above-mentioned “contract contents corresponding to matters having a possibility of their being included in the first or second migration information” means, for example, contract contents such as the following one. “With respect to data designated by Second Party to be personal information, First Party shall perform management of predetermined security measures (for example, encryption)”.

[0110] The third migration information includes information capable of being compared with matters included in the first and second migration information, in a process (described later) performed by the risk determination unit 105. The third migration information may be in a form of sentences including parts of sentences in the written contract, which are relevant matters having a possibility of being included in the first or second migration information and accordingly extracted from the sentences in the written contract. Alternatively, the third migration information may be information in a form of a list of matters having a possibility of being included in the first or second migration information, which is accompanied by information on whether or not each of the matters is described in the written contract.

[0111] The third migration information extraction unit 104 extracts the third migration information by performing the following checks on the terms and accompanying texts in the contract information. Here, titles of the checks shown below are based on the name of the terms in the contract information shown in FIG. 7. The following checks may be performed by simple keyword search or by another method such as text search using a dictionary of contract terminology or a thesaurus.

[0112] Services:

• • [0113] Server setting: a check is performed on whether a text regarding server setting has a description of an installation site of a server to be used. If the installation site is not made explicit, it is possible that the migration is not directed to the area desired by the company being the migration origin.
  • [0114] Service level agreement: a check is performed on whether a text regarding service level agreement has a description of data backup. If no such description is present, it is possible that data is lost in case of an accident such as a system failure.

[0115] Contract:

• • [0116] Termination: a check is performed on whether a description of “return” or “erasure” with regard to data treatment after service termination is present or not. If no such description is present, it is possible that data remains at the migration destination even after service termination.

[0117] Miscellaneous:

• • [0118] Confidentiality: a check is performed on, with regard to the migration data (confidential information owned by the service consignor), whether a description of a duty not to leak the data to any third party is present or not.
  • [0119] Arbitration: confirmation is performed on a place of arbitration in case of occurrence of an accident such as information leakage. The place of arbitration usually is determined to be the country where the migration destination provider is located. In that case, the legal system of the country is applied to the arbitration. If no laws related to personal information protection or the like have been established in the country, the fact itself has a possibility to be a risk.

[0120] Performing the above-described checks on the contract information, the third migration information extraction unit 104 obtains the third migration information such as shown below, for example.

• • [0121] Server setting: server installation site Singapore
  • [0122] Service level agreement: description of data backup present
  • [0123] Termination: description of data treatment absent
  • [0124] Confidentiality: description of leakage prohibition present
  • [0125] Arbitration: place of arbitration the United States

[0126] Here, it is assumed that a risk on a place of arbitration is given as prior knowledge in a form of the presence or absence of a data protection legal system.

[0127] In the check result shown above, a risk of “description of data treatment absent” has been detected. While the installation site at a time of service termination is Singapore having no rules equivalent to a personal information protection law, the place of arbitration is the United States, and accordingly, personal information protection rules of the United States (in a plural number) are applied also to an accident in Singapore. For this reason, arbitration risk is eliminated here.

[0128] Here, the above-described checks are just typical examples, and check targets are not limited to the above-described items.

[0129] After performing the steps S302 to S304, the migration risk determination unit 105 compares the first and second migration information with the third migration information, and thereby determines legal or contractual risks in the datacenter migration (step S305). Specifically, the migration risk determination unit 105 compares the matters extracted into the first and second migration information with the third migration information. The migration risk determination unit 105 thereby determines whether or not the matters regarding businesses and laws included in the first and second migration information are included in the third migration information. If included, the migration risk determination unit 105 determines that, in terms of the matters regarding businesses and laws, there is no risk in the datacenter migration because the matters are included in the contents of the contract. If not included, the migration risk determination unit 105 determines that, in terms of the matters regarding businesses and laws, there is a risk in the datacenter migration because the matters are not included in the contents of the contract.

[0130] Hereinafter, a description will be given of details of the process of comparing the first and second migration information with the third migration information and of the risk determination process. In determining legal or contractual risks in the processes, the risk of each of the determination items is expressed by a flag. The value of each of the flags expresses risk absence and risk presence when it is 0 and 1, respectively. Here, unless particularly described, the initial value is 0 for each of the flags. The flags expressing risks of the respective determination items are collectively referred to as risk flags.

[0131] First, the migration risk determination unit 105 compares the “Data class” in the first migration information with the second migration information. For example, in the case of “Data class: personal information”, if the item “Personal information and privacy protection law” in the second migration information is not blank, the migration risk determination unit 105 determines that a corresponding law (for example, the FTC guidelines) exists at the migration destination. Similarly, in the case of “Data class: classified information”, if the item “Classified information protection law” in the second migration information is not blank, the migration risk determination unit 105 determines that a corresponding law exists at the migration destination. Here, in the applicable law information shown in FIG. 6, no law corresponding to such a classified information protection law is registered.

[0132] In contrast, if at least either of the items “Personal information and privacy protection law” and “Classified information protection law” corresponding to the respective data classes is blank, the migration risk determination unit 105 determines that there is incompleteness in data protection laws, and accordingly sets “data protection laws incompleteness flag=1”.

[0133] If at least either of the items “Judicial procedure law” and “Judicial investigative authority law” is not blank, the migration risk determination unit 105 may determine that there is a risk of compulsory discovery or the like of personal information or classified information, and may accordingly set “judicial risk flag=1”.

[0134] Next, the migration risk determination unit 105 compares the “Migration area” in the first migration information with the “Server setting” in the third migration information. If any installation site described in the “Server setting” is a site not included in the areas described in the “Migration area”, the migration risk determination unit 105 determines that there is a risk of migration to an unintended migration destination, and accordingly sets “migration destination risk flag=1”.

[0135] In the case of “data protection laws incompleteness flag=1”, the migration risk determination unit 105 may further refer to the “Arbitration” in the third migration information. Then, if the place of arbitration is an area having a data protection law, the migration risk determination unit 105 may determine that arbitration risk related to incompleteness in data protection laws is eliminated, as already described above, and may accordingly set back the data protection laws incompleteness flag to be 0.

[0136] Next, when the “Data class” in the first migration information is personal information or classified information, if there is no description related to the “Termination” in the third migration information, the migration risk determination unit 105 determines that there is a leakage risk due to incompleteness of the contract, and accordingly sets “termination risk flag=1”.

[0137] Next, the migration risk determination unit 105 compares the “Resource occupation” in the first migration information with each of the items in the third migration information. If there is no item comparable with the “Resource occupation”, the migration risk determination unit 105 determines that there is a possibility of the resource occupation being impossible, and sets “resource occupation risk flag=1”.

[0138] Next, the migration risk determination unit 105 compares the functions described in the “Security” in the first migration information with each of the items in the third migration information. If there is no comparable item for any one (or more) of the “Security” functions, the migration risk determination unit 105 determines that there is a possibility of some of the security measures implemented at the migration origin being unable to be implemented at the migration destination, and sets “security risk flag=1”.

[0139] As a result of the above-described processes, the migration risk determination unit 105 obtains risk determination results shown below, for example.

• • [0140] Data protection laws incompleteness flag=0
  • [0141] Judicial risk flag=1
  • [0142] Migration destination risk flag=0
  • [0143] Resource occupation risk flag=1
  • [0144] Termination risk flag=1
  • [0145] Security risk flag=1

[0146] If, in the step S305, there is no matter having been determined to have a risk, that is, if all of the risk flag values are determined to be 0 (NO at a step S306), the process proceeds to a step S309.

[0147] If, in the step S305, there is any matter having been determined to have a risk, that is, if there is any risk flag having a value of 1 (YES at the step S306), the service policy is then referred to, and thereby performed is determination on whether the risk is eliminated or not.

[0148] The fourth migration information extraction unit 106 extracts a service policy associated with the migration destination datacenter from service policies stored in the storage unit 101. From the extracted service policy, the fourth migration information extraction unit 106 further extracts fourth migration information which is information regarding the datacenter migration (step S307). The extraction may be performed by keyword search or by search using a dictionary of datacenter operation-related terminology.

[0149] As the fourth migration information, for example, a service policy specialized in rules on the details, such as a resource arrangement rule, a remigration rule and a security function rule, is considered. The resource arrangement rule prescribes, for example, a condition for exclusive occupation of computation resources by an application. While physical resources are shared through virtualization in a cloud environment, there is a case where an application emphasizing performance and security needs to occupy the resources. The resource arrangement rule is necessary in such a case.

[0150] The remigration rule prescribes a range of remigration destinations in case of remigration of applications being necessary at the migration destination for a reason such as performance deterioration and an accident. If no remigration rule exists, there is a risk of remigration being directed to an undesired area.

[0151] The security function rule prescribes that the migration destination datacenter shall have security functions equivalent to those held by the migration origin datacenter. For example, the security functions include a data encryption method, a backup method, a monitoring method, a log collection method, an ID management method (such as one enabling a user side administrator to make access with the same privilege also at the migration destination), an incident handling method (such as one notifying also a user side administrator of a specific event), and the like. If such a security function rule cannot be confirmed to exist, there is a risk that the security level of the migration destination cannot satisfy the security level which has been guaranteed to the user of an application until the migration.

[0152] FIG. 8 is a diagram showing an example of the fourth migration information. That is, FIG. 8 shows information regarding migration included in the service policy of a particular datacenter. The “Resources” part shows whether the menus relating to resource occupation are offered or not. For example, “Y”s given at the “server occupation” and the “storage occupation” indicate that physical occupation of a server and storage is offered as menus at the datacenter. The country names given at the “remigration destination range” described in the “Migration destination” part represent countries included in the range of remigration destinations. The “Y” given at the “Security” part indicates that the security functions, such as an encryption algorithm, offered by the datacenter are of the same level (strength) as those by the migration origin datacenter.

[0153] That is, the fourth migration information is information into which service policies regarding datacenter migration are extracted from among service policies the migration destination datacenter can offer. Here, FIG. 8 shows just an example, and the fourth migration information may include other detail operation rules (such as backup, report and incident handling).

[0154] Next, the migration risk determination unit 105 refers to the risk flags and the fourth migration information, compares the first and second migration information with the fourth migration information, and thereby determines legal or contractual risks in the datacenter migration (step S308).

[0155] That is, the migration risk determination unit 105 compares the matters extracted into the first and second migration information with the fourth migration information. Then, the migration risk determination unit 105 determines whether or not the matters regarding businesses and laws included in the first and second migration information are included in the fourth migration information. If included, the migration risk determination unit 105 determines that there is no risk in the datacenter migration in terms of the matters regarding businesses and laws, because the matters are included in the service policies which can be offered by the migration destination datacenter. If not included, the migration risk determination unit 105 determines that there is a risk in the datacenter migration in terms of the matters regarding businesses and laws, because the matters are not included in the service policies which can be offered by the migration destination datacenter.

[0156] In the above-mentioned process, the migration risk determination unit 105 may refer to the risk flags instead of the first and second migration information. Hereinafter, a description will be given of a risk determination process performed by comparing the risk flags with the fourth migration information.

[0157] The migration risk determination unit 105 performs comparison of the items whose risk flag values are 1 with the fourth migration information. Here, the risk items represented by respectively the “data protection laws incompleteness flag” and the “judiciary risk flag” may be excluded from the comparison process, because the items are outside the scope of service policy. In the following process, comparison of the fourth migration information is made with the “termination risk flag”, the “resource occupation risk flag”, and the “security risk flag”. Here, the present description will be continued assuming a case of comparing the risk flags obtained in the step S305 with the fourth migration information shown in FIG. 8. Referring to FIG. 8, no data erasure rule relating to “termination incompleteness” is included in the policies. Therefore, the migration risk determination unit 105 determines that the termination risk is not eliminated, and accordingly keeps “termination risk flag=1”. Next, referring to FIG. 8, there is an item relating to “Resource occupation”, where server occupation is shown to be possible. Therefore, the migration risk determination unit 105 determines that the resource occupation risk is eliminated, and accordingly sets back the resource occupation risk flag to be 0. Further referring to FIG. 8, it is indicated that the encryption algorithm, log collection method and ID/role management, as items relating to “Security”, are equivalent to those of the migration origin datacenter. Therefore, the migration risk determination unit 105 determines that the “file encryption”, “access log” and “management authority division” described in the “Security” part of the first migration information can be realized, and accordingly sets back the security risk flag to be 0.

[0158] As a result of the above-described process, the migration risk determination unit 105 obtains a risk determination result shown below.

• • [0159] Data protection laws incompleteness flag=0
  • [0160] Judiciary risk flag=1
  • [0161] Migration destination risk flag=0
  • [0162] Resource occupation risk flag=0
  • [0163] Termination risk flag=1
  • [0164] Security risk flag=0

[0165] On the basis of the risk flags obtained as above, the migration risk determination unit 105 may perform overall risk determination (to be migration OK, or to be problematic and raise an alarm). The overall risk determination may be performed by, for example, simply summing up the above-described risk flag values, and then comparing the sum with a predetermined threshold value to determine which is larger than the other. In the overall risk determination, a weight may be assigned to a particular flag. For example, in the above-mentioned summing up of the risk flag values, a certain one of the risk flag values may be made to be larger than the other ones. Alternatively, if any one of the risk flag values is 1, the migration risk determination unit 105 may automatically determine that there is a problem, and may accordingly raise an alarm.

[0166] The process subsequently proceeds to the step S309.

[0167] After completing the process of the step S305 or that of the step S308, the migration risk determination unit 105 outputs a result on the basis of the risk determination made in the step S305 and/or the step S308 (step S309). Specifically, a matter having been determined to have a risk in both of the steps S305 and S308 is finally determined to have a risk in the datacenter migration. A matter having been determined to have no risk in at least either of the steps S305 and S308 is finally determined to have no risk in the datacenter migration.

[0168] In the above-described risk determination process using the risk flags, the migration risk determination unit 105 determines a matter having been determined to be of “risk flag=1” to have a risk in the datacenter migration. A matter having been determined to be of “risk flag=0” is determined to have no risk in the datacenter migration. Here, the overall determination result is not changed.

[0169] Then, the risk analysis device 100A outputs the final result of the analysis of risks in the datacenter migration via the output unit 108, and ends the process.

[0170] Although, in the above description, the processes of the steps S307 and S308 are performed only when there is any matter having been determined to have a risk in the step S305 (that is, only if YES at the step S306), the processes may be performed regardless of whether such a matter exists or not.

[0171] Although, also in the above description, the comparison processes are performed separately in the two steps, S305 and S308, they may be performed together in a single step. That is, after performing the extraction processes in the steps S302, S303, S304 and S307, matters extracted into the first and second migration information may be compared with the third and fourth migration information.

[0172] The extraction processes by the first migration information extraction unit 102, the second migration information extraction unit 103, the third migration information extraction unit 104 and the fourth migration information extraction unit 106 may be performed by keyword extraction or by using a terminology dictionary, a thesaurus or the like. Keywords used in such a case may be inputted in advance and stored in the storage unit 101. The keywords may be read from the storage unit 101 and thereby be put into use at a time of the extraction processes. The keywords may be appropriately updated using the input unit 107.

[0173] Although it has been described above that, in the process of the step S309, a matter having been determined to have no risk in at least either of the steps S305 and S308 is determined to have no risk in the datacenter migration, the process may be different. For example, a predetermined matter may be determined finally to have no risk only when it has been determined to have no risk in both of the steps S305 and S308. Alternatively, the final risk determination on a predetermined matter may be made according to only the determination result in the step S305, regardless of that in the step S308. Alternatively, the final risk may be determined according to only the determination result in the step S308, regardless of that in the step S305.

[0174] FIG. 4 is an example of a risk determination result outputted by the risk analysis device 100A according to the second exemplary embodiment. The risk determination result in FIG. 4 is shown, for example, on a display device corresponding to the output unit 108. Alternatively, the risk determination result in FIG. 4 is printed out, for example, from a printer device corresponding to the output unit 108.

[0175] The “APP” in FIG. 4 represents the name of an application being the target of each migration. The “migration origin DC” in FIG. 4 represents the name of a datacenter presently operating the application or data being the target of each migration. The “migration destination DC” in FIG. 4 represents the name of a datacenter to be a migration destination for the application or data being the target of each migration. The “data class” in FIG. 4 represents a data class extracted from the first migration information. The “legal risk” in FIG. 4 represents the presence or absence of each of “data protection laws incompleteness” and “judiciary risk” determined by comparison between the first and second migration information. The “contractual risk” in FIG. 4 represents the presence or absence of each of “migration destination risk”, “resource occupation risk”, “termination risk” and “security risk” determined by comparison of the first migration information with the third migration information or with the fourth migration information. The “overall risk determination” in FIG. 4 represents an overall determination result on whether or not there is a risk in each datacenter migration (“Alarm” if present, and “OK” if absent). The “overall risk determination” may represent a result of the overall risk determination described above performed by the migration risk determination unit 105.

[0176] As has been described above, the risk analysis device 100A according to the second exemplary embodiment of the present invention enables a user to easily analyze legal or contractual risks in datacenter migration. It is because the migration risk determination unit 105 determines such risks on the basis of information regarding data migration extracted from the business application information, the applicable law information, the contract information and the service policies, and outputs the result.

[0177] The risk analysis device 100A according to the second exemplary embodiment of the present invention also reduces workload of an analysis of legal or contractual risks in datacenter migration. It is because a user does not need to determine whether or not business and legal matters having a possibility of causing a problem are described in a written contract (whether or not legal agreement has been concluded on the matters), because the determination is performed by comparing pieces of information extracted from the respective information with each other. It is also because the user does not need to investigate and determine by himself/herself whether the above-described matters can be dealt with by means of service policies offered by the migration destination datacenter, because the determination is performed by a comparison similar to that described above.

[0178] FIG. 9 is a block configuration diagram illustrating an example of components constituting a computer. A computer 900 in FIG. 9 includes a CPU (Central Processing Unit) 901, a RAM (Random Access Memory) 902, a ROM (Read Only Memory) 903, a hard disk 904, a communication interface 905 and a removable storage medium 906. The removable storage medium 906 may be a magnetic disk medium, an optical disk medium or a memory card, which are all attachable and detachable. Components of the above-described risk analysis devices 100 and 100A may be realized by executing a program in the CPU 901 of the computer 900. Specifically, the first migration information extraction unit 102, the second migration information extraction unit 103, the third migration information extraction unit 104, the migration risk determination unit 105 and the fourth migration information extraction unit 106, which are components illustrated in FIG. 1 or 2 already shown above, may be realized by the CPU 901 reading a program from the ROM 903, the hard disk 904 or the removable storage medium 906 and then executing the program, for example, similarly to the procedure of the flow chart shown in FIG. 3. In such a case, the present invention, which has been described taking the above-described exemplary embodiments as examples, is constituted by program code representing the computer program or by a storage medium storing the program code representing the computer program. The storage medium may be the hard disk 904 or the removable storage medium 906.

[0179] Alternatively, the first migration information extraction unit 102, the second migration information extraction unit 103, the third migration information extraction unit 104, the migration risk determination unit 105 and the fourth migration information extraction unit 106 may be realized by dedicated hardware. The risk analysis devices 100 and 100A may be such dedicated hardware including those components.

[0180] The present invention has been described above with reference to the exemplary embodiments, but the present invention is not limited to the above-described exemplary embodiments. To the configurations and details of the present invention, various changes which are understandable to those skilled in the art may be made within the scope of the present invention.

[0181] This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2012-201746, filed on Sep. 13, 2012, the disclosure of which is incorporated herein in its entirety by reference.

• • [0182] 100, 100A risk analysis device
  • [0183] 101 storage unit
  • [0184] 102 first migration information extraction unit
  • [0185] 103 second migration information extraction unit
  • [0186] 104 third migration information extraction unit
  • [0187] 105 migration risk determination unit
  • [0188] 106 fourth migration information extraction unit
  • [0189] 107 input unit
  • [0190] 108 output unit
  • [0191] 900 computer
  • [0192] 901 CPU
  • [0193] 902 RAM
  • [0194] 903 ROM
  • [0195] 904 hard disk
  • [0196] 905 communication interface
  • [0197] 906 removable storage medium