JPH11122293A - Electronic mail server system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the security in the electronic mail server system. SOLUTION: The electronic mail server system is provided with a communication network configured by using an ISDN, a public telephone line, the Ethernet or the like, a network interface section 1-1 that provides physical connection to the network, understands a protocol to make communication with an optional host connected to the communication network to control the communication, a relay electronic mail information acquisition section 1-3 that receives an electronic mail transferred from other computer via the network and acquires the information of the electronic mail, an individual security information management section 1-5 that stores an encryption scheme applied to the mail for each user of each electronic mail, an encryption scheme storage section 1-4 that stores a scheme to maintain the security in the entire organization in which mail severs are in existence, an encryption device 1-6 that encrypts the mail when it is discriminated that encryption is conducted by refering the individual security information management section 1-5 and the encryption scheme storage section 1-4 based on the information obtained by the relay electronic mail information acquisition 1-3, and a system control section 1-2 that controls all the sections.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer having a function of transmitting and receiving data using a network such as the Internet, and a computer (server) used for transmission and reception.
About.

[0002]

2. Description of the Related Art In recent years, the number of cases of transmitting and receiving data to and from remote locations using a network, such as the Internet, has been increasing.

When data is transmitted and received using a network system such as the Internet, there is a possibility that data may be eavesdropped, falsified, erased, etc. on the network by a third party. The Internet connects a network provided by a plurality of organizations using a router or the like, and configures a large-scale network as a whole.

[0004] When a member of an arbitrary company transfers data such as e-mail to another organization using this network, there is a very high possibility that the data goes through networks of a plurality of organizations. In an organization through which data passes, there is a problem that data flowing on a network from a router or the like can be easily read.

The above problem is solved by encrypting transmitted and received data (Japanese Patent Laid-Open No. 9-46330, Japanese Patent Laid-Open No.
27622). Encryption methods applicable to data transfer include target key encryption, public key encryption, digital signature, etc.
By using multiple tools already, data can be easily encrypted.

[0006]

However, if the sender does not encrypt the data before sending it to the network, the receiving side has no solution to the above problem.

[0007] Further, a user who transmits / receives data to / from other than his / her own organization using a network usually does not need to be conscious of which physical path the data passes through. Low awareness is also a problem. For one user who is not concerned about security in network communication, there is a risk that the confidentiality of the company to which the individual belongs is leaked. Currently, no particular measures have been taken to address this issue.

[0008]

An electronic mail server system according to the present invention provides a communication network configured using ISDN, a public telephone line, or Ethernet, and a physical connection to the network. Understands a protocol for communicating with an arbitrary host connected to a communication network, and receives a forwarded e-mail from another computer via the network, and receives information on the e-mail, Maintains security in the entire organization where the relay e-mail information acquisition unit that acquires the e-mail, the individual security information management unit that stores the encryption strategy for e-mail for each e-mail user, and the mail server The encryption strategy storage unit that stores the strategy for the operation and the relay email information acquisition unit An encryptor for encrypting a mail when it is determined that encryption is to be performed by referring to the security information management unit for individual and the encryption strategy storage unit based on the obtained information; An electronic mail server system comprising: a system control unit for controlling the electronic mail.

According to a second aspect of the present invention, in the electronic mail server system according to the first aspect, the encryption strategy storage unit stores a keyword table which can be arbitrarily determined by the electronic mail server. When the control unit determines from the information obtained from the relay e-mail information acquisition unit that the keyword includes the keyword indicated in the keyword table, the control unit performs encryption by an encryptor. is there.

According to a third aspect of the present invention, in the electronic mail server system according to the first aspect, the encryption strategy storage unit stores an electronic mail user list that can be arbitrarily determined by the electronic mail server. At the same time, if the system control unit determines from the information obtained from the relay e-mail information acquisition unit that the mail is the outgoing mail of the user indicated in the e-mail user list, the system control unit performs encryption using the encryptor. An electronic mail server system characterized by the following.

According to a fourth aspect of the present invention, in the electronic mail server system according to the first aspect, the encryption strategy storage unit stores an electronic mail delivery destination table that can be arbitrarily determined by the electronic mail server. At the same time, when the system control unit determines from the information obtained from the relay e-mail information acquisition unit that the mail is transmitted to the destination indicated in the e-mail delivery destination table, the encryption is performed by the encryptor. It is an electronic mail server system characterized by performing:

According to a fifth aspect of the present invention, there is provided the electronic mail server system according to the first aspect, wherein the encryption strategy storage unit comprises: an electronic mail delivery destination table which can be arbitrarily determined by the electronic mail server; In addition to storing a table describing the passage route of the e-mail to the delivery destination and the security level of the route, the system control unit uses the information obtained from the relay e-mail information acquisition unit to display the table in the e-mail delivery destination table. If the e-mail is judged to be sent to the specified destination, it is necessary to acquire the route that the e-mail passes before it reaches the destination and the security level of the route, and encrypt the e-mail based on the information. The electronic mail server system is characterized in that, when it is determined that there is, encryption is performed by an encryptor.

According to a sixth aspect of the present invention, there is provided the electronic mail server system according to the first aspect, wherein the encryption strategy storage unit stores a transmission timetable which can be arbitrarily determined by the electronic mail server. The system control unit, from the information obtained from the relay e-mail information acquisition unit,
An e-mail server system characterized in that when it is determined that the e-mail is transmitted to the destination indicated in the e-mail transmission time table, the e-mail is encrypted by an encryptor.

According to a seventh aspect of the present invention, in the electronic mail server system according to the first aspect, the encryption specified by the sender in the additional information of the mail obtained from the relay electronic mail information acquisition unit. An electronic mail server system characterized in that when a request keyword is included, encryption is performed by an encryptor.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in detail with reference to the drawings.

FIG. 1 is a block diagram of an electronic mail server system in consideration of security according to the present embodiment.

The electronic mail server system comprises a network interface unit (1-1), a system control unit (1).
-2), a relay electronic mail information acquisition unit (1-3), an encryption strategy storage unit (1-4), an individual security information management unit (1-5), and an encryptor (1-6). You.

This mail server is connected to a network such as Ethernet (whether wired or wireless) and has an arbitrary communication protocol (TCP / IP, IPX).
Etc.) to send and receive e-mails with other computers.

FIG. 2 shows an example of the position of the mail server system on the network.

In the example of FIG. 2, the mail server of the present invention is E
A computer (2-2) connected to the network via the network and connected to the same network as a client for mail transmission, and a computer (2-3) in a mobile environment that performs communication using a wireless communication path, such as PPP. Have.

When mail is transferred from the mail server (2-1) to the computer (2-8) of the present invention, the mail is transferred through a plurality of networks having different network addresses. That is, in FIG. 2, the transfer is performed with the router (2-4 to 7) as a relay point. The physical interface to the network is defined as a network interface unit (1-
1) provided. It also has a function of forming received data into mail according to a communication protocol.

The mail obtained at the interface unit is
In the relay email information acquisition unit, the sender, destination,
The transmission date / time, transmission text, etc. are extracted and transferred to the system control unit. The system control unit obtains the attached information from the mail and obtains the encryption strategy from the encryption strategy storage unit (1-4).

A specific example of the encryption strategy will be described below.

When "encrypt if a specific keyword is included in mail" is set as the encryption strategy, a keyword table which can be arbitrarily set in the encryption strategy storage unit at the same time is set. Hold.

FIG. 3 shows an example of the keyword table.

According to this setting, if a keyword such as "encryption" is included in the text of the mail, the system control unit determines that the mail needs to be encrypted.

If "encrypt a mail sent from a specific person" is set as the encryption strategy, the encryption strategy storage unit simultaneously holds an arbitrarily configurable sender list. .

FIG. 4 shows an example of the sender list.

According to this setting, when the sender name of the mail is described in this list, the system control unit determines that the mail needs to be encrypted.

If "encrypt a mail sent to a specific person" is set as an encryption strategy, the encryption strategy storage unit simultaneously holds an arbitrarily settable recipient list. .

FIG. 5 shows an example of the recipient list.

According to this setting, when the recipient name (destination) of the mail is described in this list, the system control unit determines that the mail needs to be encrypted.

When "encrypt a mail transmitted by using a specific route" is set as the encryption strategy, the transmission strategy list and the destination list which can be arbitrarily set at the same time are set in the encryption strategy storage unit. The route information to the destination is held.

FIG. 6 shows an example of the route information list.

In FIG. 6, a security level evaluation value for the route is added together with the route information. The index used to evaluate each route depends on the security administrator. In the example in the figure, it is assumed that the number of passing networks is an evaluation value, and the smaller the value, the higher the security level.

FIG. 6 shows security levels at which encryption is required.

In this figure, the setting is made to encrypt mail to be sent to a destination having a security level of 4 or more. According to this example, YYY. ad. The system control unit determines that the mail addressed to jp needs to be encrypted. When "encrypt a mail sent at a specific time" is set as the encryption strategy, the encryption strategy storage unit holds an arbitrarily configurable encryption time list at the same time.

FIG. 7 shows an example of the encryption time list.

According to this setting, when the transmission time of the mail is described in this list, the system control unit determines that the mail needs to be encrypted.

When "encrypt a mail that the sender clearly requires encryption" is set as an encryption strategy, the system control unit determines that the mail needs to be encrypted. to decide.

FIG. 8 shows an example of a mail in which the sender specifies the necessity of encryption.

In the present example, it is specified by the Encryption field. If the system control unit determines that encryption is not necessary by referring to the attached information obtained from the relay e-mail information acquisition unit and the strategies stored in the encryption strategy storage unit, the mail will be encrypted. It is sent from the mail server without being added.

When the system control unit determines that the mail needs to be encrypted, the system control unit obtains information on the sender of the mail from the individual security information obtaining unit.

FIG. 9 shows an example of individual security information.

This information indicates a sender address, an encryption system designated for each sender, and, if necessary, an encryption key in the encryption system.

FIG. 10 shows a flowchart of the process.

The system control unit drives the encryptor 1 based on the information obtained from the individual security information obtaining unit (S1 to S5). The encryption device includes all encryption mechanisms for the encryption method indicated in the individual security information acquisition unit. When the encryption process is completed, the mail is sent from the mail server (S6 to S8).

[0048]

According to the electronic mail server system of the present invention, the mail transmitted from another client physically connected to the Ethernet or the like is obtained from the network interface unit, and the relay electronic mail information obtaining unit obtains the mail. The system control unit refers to the various information (such as the transmission destination) of the data, the encryption policy stored in the encryption strategy storage unit, and the security-related settings set in the individual security information management unit. It decides which encryption is to be performed on the data, and the encryptor performs encryption based on the decision. The encrypted data is sent out again via the network. With the above mechanism, it is possible for the network administrator to prevent confidential leakage from the network without the data sender being particularly conscious or irrespective of the mail sender.

In the electronic mail server system according to the second aspect, in addition to the effect of the first aspect, the encryption strategy storage unit stores a keyword table which can be freely set by a network or a security administrator. Only when the keyword is included in the mail, the mail is encrypted. By performing the encryption process only on the mail that meets the conditions and not performing the other processes, there is an effect of preventing the waste of the calculation function.

According to a third aspect of the present invention, in addition to the effect of the first aspect, in addition to the effect of the first aspect, the encryption strategy storage unit uses a sender name table or a mail address list which can be freely set by a network or security administrator. Only when the sender of the mail is stored in the list, the mail is encrypted. By performing the encryption process only on the mail that meets the conditions and not performing the other processes, there is an effect of preventing the waste of the calculation function.

According to a fourth aspect of the present invention, in addition to the effect of the first aspect, in the encryption strategy storage unit, a destination or a destination address list which can be freely set by a network or a security administrator is provided. Only when the transmission destination of the mail is stored in the list, the mail is encrypted. By performing the encryption process only on the mail that meets the conditions and not performing the other processes, there is an effect of preventing the waste of the calculation function.

In the electronic mail server system according to the fifth aspect, in addition to the effect of the first aspect, in the encryption strategy storage unit, a transmission destination which can be freely set by a network or a security administrator, and a transmission destination can be set. The security level of the communication path is also stored for each communication path, and encryption of the mail is performed only when the security level of the transmission path of the mail is lower than an arbitrarily settable threshold value. Do. By performing the encryption process only on the mail that meets the conditions and not performing the other processes, there is an effect of preventing the waste of the calculation function.

According to a sixth aspect of the present invention, in addition to the effect of the first aspect, in addition to the effect of the first aspect, the encryption strategy storage unit satisfies a condition by an encryption time list which can be freely set by a network or a security administrator. By performing the encryption process only on the received mail and not performing the other processes, there is an effect of preventing the waste of the calculation function.

In the electronic mail server system according to the seventh aspect, in addition to the effect of the first aspect, the mail server can perform the encryption processing by allowing the sender of the mail to be able to specify the encryption. I do. Therefore, there is an effect that the mail is encrypted without imposing a load on the computer of the mail sender.

[Brief description of the drawings]

FIG. 1 is a block diagram of an electronic mail server system in consideration of security of the present invention.

FIG. 2 is a diagram showing a positional relationship of a mail server of the present invention on a communication network.

FIG. 3 is a keyword table for determining the necessity of encryption.

FIG. 4 is a caller list for determining the necessity of encryption.

FIG. 5 is a recipient list for determining the necessity of encryption.

FIG. 6 is a route information list for determining the necessity of encryption.

FIG. 7 is an encryption time list for determining the necessity of encryption.

FIG. 8 is an example of an encryption request by a sender.

FIG. 9 is an example of individual security information.

FIG. 10 is a flowchart showing a process of the present invention.

[Explanation of symbols]

 1-1 Network interface unit 1-2 System control unit 1-3 Relay e-mail information acquisition unit 1-4 Encryption strategy storage unit 1-5 Individual security information management unit 1-6 Encryption unit 2-1 Mail server device 2-2 POP / SMTP client 2-3 POP / SMTP client 2-4 Router 2-5 Router 2-6 Router 2-7 Router

Claims (7)

[Claims] 1. An ISDN, a public telephone line, or Eth
a communication network configured using ernet, etc., and a network interface unit that provides a physical connection to the network, understands a protocol for communicating with an arbitrary host connected to the communication network, and manages communication. A relay e-mail information acquisition unit that receives e-mails transferred from another computer via the network and obtains information of the e-mails, and encryption performed on the e-mails for each e-mail user A security information management unit for each individual that stores a strategy, an encryption strategy storage unit that stores a strategy for maintaining security in the entire organization where the mail server exists, and information obtained from the relay e-mail information acquisition unit. It is determined that encryption will be performed by referring to the individual security information management unit and the encryption strategy storage unit. Email server system, wherein the encryptor for encrypting mail if it is, that a system control unit that controls the all parts. 2. The electronic mail server system according to claim 1, wherein the encryption strategy storage unit stores a keyword table that can be arbitrarily determined by the electronic mail server, and the system control unit obtains relay electronic mail information. From the information obtained from the department,
An e-mail server system characterized in that when it is determined that the keyword includes the keyword indicated in the keyword table, the encryption is performed by an encryptor. 3. The electronic mail server system according to claim 1, wherein the encryption strategy storage unit stores an electronic mail user list that can be arbitrarily determined by the electronic mail server, and the system control unit controls the relay electronic mail. An e-mail server system characterized in that when it is determined from the information obtained from the e-mail information obtaining section that the outgoing mail is of a user indicated in the e-mail user list, the mail is encrypted by an encryptor. . 4. The electronic mail server system according to claim 1, wherein the encryption strategy storage unit stores an electronic mail delivery destination table that can be arbitrarily determined by the electronic mail server, and the system control unit stores the relay electronic mail. An e-mail server that, when judging from the information obtained from the e-mail information acquisition section that the e-mail is to be transmitted to the destination indicated in the e-mail delivery destination table, encrypts the e-mail using an encryptor; system. 5. The e-mail server system according to claim 1, wherein the encryption strategy storage unit stores an e-mail delivery destination table that can be arbitrarily determined by the e-mail server, and an e-mail passage route to each delivery destination. And a table describing the security level of the route, and the system control unit, based on the information obtained from the relay e-mail information acquisition unit, transmits the mail transmitted to the destination indicated in the e-mail delivery destination table. If it is determined that there is, the route that the e-mail passes before reaching the destination and the security level of the route are acquired,
An e-mail server system characterized in that when it is determined that the e-mail needs to be encrypted based on the information, the e-mail is encrypted by an encryptor. 6. The electronic mail server system according to claim 1, wherein the encryption strategy storage unit stores a transmission timetable arbitrarily determinable by the electronic mail server, and the system control unit includes:
When it is determined from the information obtained from the relay e-mail information acquisition unit that the mail is transmitted to the destination indicated in the e-mail transmission time table, the e-mail is encrypted by an encryptor. Mail server system. 7. The electronic mail server system according to claim 1, wherein the keyword of the encryption request specified by the sender is included in the attached information of the mail obtained from the relay electronic mail information acquisition unit. An electronic mail server system characterized in that encryption is performed by an encryptor.