WO2023162136A1

WO2023162136A1 - Information processing device, method, and program

Info

Publication number: WO2023162136A1
Application number: PCT/JP2022/007876
Authority: WO
Inventors: 健太郎園田
Original assignee: 日本電気株式会社
Priority date: 2022-02-25
Filing date: 2022-02-25
Publication date: 2023-08-31

Abstract

Provided is an information processing device and the like that can contribute to highly accurate determination of a phishing site by a user. This information processing device comprises: an operation blocking unit configured to block an operation of a hyperlink in mail text of a displayed mail; an element extraction unit configured to extract an element including at least the hyperlink in the mail text; an element reading unit configured to read aloud the element including at least the hyperlink; and an operation blocking cancellation unit configured to cancel the blocking of the operation of the hyperlink.

Description

Information processing apparatus, method, and program

The present invention relates to an information processing device, method, and program.

Phishing emails have existed for a long time, and there is no end to the damage caused by phishing emails. In recent years, phishing email texts have also become very sophisticated, making it difficult to distinguish them from legitimate emails. The aim of phishing emails is to deceive recipients by sending emails that resemble the headers and text of legitimate emails, and trick them into clicking fake hyperlinks in the phishing emails to access the attacker's phishing site. It is to induce and exploit personal information such as ID, password, credit card information at the phishing site. Therefore, there is a need for a mechanism to prevent damages caused by accidental clicks on hyperlinks in the text of phishing emails.

As a technique related to a mechanism for preventing damage due to accidental clicking of a hyperlink, for example, Patent Document 1 discloses that as the level of understanding in learning the dangers of browsing by a user increases, one part of received site content information indicating a site increases. By replacing the part with other information at an arbitrary timing, the site content information indicating the dummy site is generated so as to be closer to the site content information indicating the actual malicious site, and the generated site content information is transmitted to the terminal device. A browsing learning server is disclosed.

In addition, in Patent Document 2, an Internet address of a website from which a user attempts to connect to a specific website through e-mail or a web browser is analyzed, and the user selects whether or not to actually access the website. and warns users that if they are trying to connect to a website that is similar to a well-known website address, it may be a phishing website and asks if the user actually connects to the site. If you directly enter personal information by e-mail, etc. and use the function that the personal information is immediately transmitted to a specific server, etc., let the user choose whether to actually transmit the information. An anti-phishing method is disclosed.

Further, in Patent Document 3, it is determined whether or not a link included in a received e-mail addressed to a user is a link to a site suspected of being fraudulent. Then, the link destination address is rewritten to the address of the unauthorized access warning device, and when the user opens the rewritten link, a warning is displayed on the display screen of the terminal device to prevent guidance to the unauthorized site. A system is disclosed.

Furthermore, in Patent Document 4, mail information including sender and link destination information of a received e-mail is extracted, and by comparing the domain of the mail address corresponding to the sender and the domain of the link destination information, the e-mail An information processing apparatus for determining whether or not is appropriate is disclosed.

Patent No. 6478691 JP 2007-287124 A Patent No. 4682855 JP 2020-86547 A

The following analysis is given by the inventor of this application.

According to the techniques described in Patent Literatures 1 to 4, users can easily determine the degree of risk of a phishing site linked to a hyperlink described in a phishing email. It is difficult to judge the authenticity of a phishing site that looks like it, and the user may make a mistake in judgment. For example, some texts and images on phishing sites are the same as those on legitimate websites, increasing the possibility of users making erroneous judgments. Also, a homograph attack that displays characters in hyperlinks with visually similar characters (for example, the character "m" is displayed as "rn" and the character "O" is displayed as "0"). makes users visually deceptive.

A main object of the present invention is to provide an information processing device, method, and program that can contribute to a user's highly accurate determination of a phishing site.

An information processing apparatus according to a first aspect includes an operation block unit configured to block an operation of a hyperlink in an email text of a displayed email, and an element in the email text including at least the hyperlink. an element extractor configured to extract; an element reader configured to read aloud the element including at least the hyperlink; and an element reader configured to unblock manipulation of the hyperlink. and an operation block releasing unit.

An information processing method according to a second aspect is an information processing method for performing information processing using hardware resources, comprising the steps of: blocking an operation of a hyperlink in a displayed email text; extracting an element therein containing at least the hyperlink; reading aloud the element containing at least the hyperlink; and unblocking manipulation of the hyperlink.

A program according to a third aspect includes processing for blocking manipulation of hyperlinks in the email text of a displayed email, processing for extracting elements including at least the hyperlink in the email text, and and a process of unblocking the operation of the hyperlink.

The program can be recorded on a computer-readable storage medium. The storage medium can be non-transient such as semiconductor memory, hard disk, magnetic recording medium, optical recording medium, and the like. The present disclosure may also be embodied as a computer program product. A program is input to a computer device via an input device or an external communication interface, is stored in a storage device, drives a processor in accordance with predetermined steps or processes, and stages the results of processing including intermediate states as necessary. can be displayed via a display device, or can be communicated with the outside via a communication interface. A computer device for this purpose, as an example, typically includes a processor, a storage device, an input device, a communication interface, and optionally a display device, all of which are connectable to each other by a bus.

According to the first to third viewpoints, it is possible to contribute to the user's highly accurate determination of the phishing site.

1 is a block diagram schematically showing the configuration of an information processing apparatus according to Embodiment 1; FIG. FIG. 4 is an image diagram schematically showing the element extraction operation of the information processing apparatus according to the first embodiment; FIG. 4 is an image diagram schematically showing an example of element reading by the information processing apparatus according to the first embodiment; FIG. 10 is an image diagram schematically showing a first display example when reading out elements of the information processing apparatus according to the first embodiment; FIG. 10 is an image diagram schematically showing a second display example during element reading by the information processing apparatus according to the first embodiment; 4A and 4B are image diagrams schematically showing first and second examples of noticing a sense of incongruity when reading out elements of the information processing apparatus according to the first embodiment; FIG. FIG. 5 is an image diagram schematically showing a display example of an operation block release screen of the information processing apparatus according to the first embodiment; FIG. 4 is a flowchart diagram schematically showing the operation of the information processing apparatus according to the first embodiment when phishing damage is prevented; FIG. 11 is a block diagram schematically showing the configuration of an information processing apparatus according to Embodiment 2; FIG. 11 is an image diagram schematically showing an example of noticing a sense of incongruity when reading out elements of the information processing apparatus according to the second embodiment; FIG. 11 is a flow chart diagram schematically showing the operation of the information processing apparatus according to the second embodiment when phishing damage is prevented; FIG. 11 is a block diagram schematically showing the configuration of an information processing apparatus according to Embodiment 3; 3 is a block diagram schematically showing the configuration of hardware resources; FIG.

Hereinafter, embodiments will be described with reference to the drawings. It should be noted that when reference numerals are used in the drawings in this application, they are solely for the purpose of helping understanding, and are not intended to limit the embodiments shown in the drawings. Moreover, the following embodiments are only examples, and do not limit the present invention. Also, connection lines between blocks in drawings and the like referred to in the following description include both bidirectional and unidirectional connections. The unidirectional arrows schematically show the flow of main signals (data) and do not exclude bidirectionality. Furthermore, in the circuit diagrams, block diagrams, internal configuration diagrams, connection diagrams, etc. disclosed in the present application, an input port and an output port exist at the input end and the output end of each connection line, respectively, although not explicitly shown. The input/output interface is the same. The program is executed via a computer device, and the computer device includes, for example, a processor, a storage device, an input device, a communication interface, and optionally a display device. It is configured to be able to communicate with external devices (including computers), whether wired or wireless.

[Embodiment 1]
An information processing apparatus according to the first embodiment will be described with reference to the drawings. FIG. 1 is a block diagram schematically showing the configuration of an information processing apparatus according to Embodiment 1. As shown in FIG. FIG. 2 is an image diagram schematically showing the element extraction operation of the information processing apparatus according to the first embodiment. FIG. 3 is an image diagram schematically showing an example of element reading by the information processing apparatus according to the first embodiment. FIG. 4 is an image diagram schematically showing a first display example at the time of element reading by the information processing apparatus according to the first embodiment. FIG. 5 is an image diagram schematically showing a second display example at the time of element reading by the information processing apparatus according to the first embodiment. FIGS. 6A and 6B are image diagrams schematically showing first and second examples of noticing a sense of incongruity when reading out elements of the information processing apparatus according to the first embodiment. FIG. 7 is an image diagram schematically showing a display example of an operation block release screen of the information processing apparatus according to the first embodiment.

The information processing device 10 is a device that processes information (see FIG. 1). The information processing device 10 may be, for example, a personal computer, a tablet terminal, a smartphone, or the like. The information processing device 10 can send and receive mails to and from other information processing devices (not shown) via a network (not shown) and a mail server (not shown). The information processing apparatus 10 receives and displays an email 40, and operates (for example, clicks, taps, etc.) a hyperlink in the email 40 to display information on the URL (Uniform Resource Locator) of the hyperlink destination. have The information processing device 10 has a function of preventing phishing damage when a hyperlink in the mail 40 is operated. The information processing device 10 includes a communication section 11 , an input section 12 , an output section 13 and a control section 15 .

Here, the mail 40 is received from another information processing device (not shown) via a network (not shown) and a mail server (not shown). The mail 40 can be configured to include, for example, a sender, a destination, a subject, a date and time, and a mail text (including hyperlinks).

The communication unit 11 is a functional unit that performs information communication (wired communication or wireless communication) (see FIG. 1). The communication unit 11 is communicably connected to a network (not shown). The communication unit 11 performs communication under the control of the control unit 15 . The communication unit 11 can receive the mail 40 . The communication unit 11 can access the hyperlink destination in the mail 40 and receive the URL information of the hyperlink destination.

The input unit 12 is a functional unit that inputs information (character input, voice input, operation input, etc.) (see FIG. 1). The input unit 12 performs input under the control of the control unit 15 . As the input unit 12, for example, a touch panel, mouse, keyboard, microphone, gesture sensor, etc. can be used.

The output unit 13 is a functional unit that outputs information (display output, audio output, etc.) (see FIG. 1). The output unit 13 outputs under the control of the control unit 15 . For example, a display, a speaker, or the like can be used as the output unit 13 .

The storage unit 14 is a functional unit that stores information (including data and programs) (see FIG. 1). The storage unit 14 stores information under the control of the control unit 15 .

The control unit 15 is a functional unit that controls the communication unit 11, the input unit 12, the output unit 13, and the storage unit 14 (see FIG. 1). As the control unit 15, for example, a processor such as a CPU (Central Processing Unit) or an MPU (Micro Processor Unit) can be used. By executing a predetermined program stored in the storage unit 14, the control unit 15 can perform predetermined information processing described in the program. The control unit 15 includes a mail processing unit 20 and a phishing damage prevention unit 30 .

The mail processing unit 20 is a functional unit that performs various processes related to mail (sending/receiving, reading, creating, etc.) (see FIG. 1). As the mail processing unit 20, for example, a mailer (email software) can be executed, or a mail service (web mail) on a web browser can be used. A phishing damage prevention unit 30 is plugged into the mail processing unit 20 .

The phishing damage prevention unit 30 is a functional unit that prevents phishing damage when accessing the hyperlink destination in the email 40 (see FIG. 1). The phishing damage prevention unit 30 is configured so that a homograph attack that deceives the user's sight can be determined by using the sense of hearing instead of the sense of sight. The phishing damage prevention unit 30 is implemented by executing a predetermined program. The phishing damage prevention unit 30 is plugged into the mail processing unit 20 . The phishing damage prevention unit 30 includes an operation block unit 31 , an element extraction unit 32 , an element reading unit 33 , and an operation block release unit 34 .

When the output unit 13 displays the mail 40 received by the mail processing unit 20, the operation block unit 31 blocks operations (for example, clicking, tapping, etc.) of hyperlinks (URLs) in the displayed mail text. (see FIG. 1). Here, as an example of blocking the operation of a hyperlink, it is possible to temporarily cancel the hyperlink, or to control so that even if the user operates the hyperlink, the process of accessing the site indicated by the hyperlink does not occur. mentioned. As a method of blocking the operation of hyperlinks, for example, a function provided in the mailer may be used, or the text of the mail may be extracted as text and saved.

The element extraction unit 32 is a functional unit that extracts an element including at least a hyperlink (or including the email text) in the email text when the hyperlink operation is blocked by the operation block unit 31 (see FIG. 1). ). The hyperlink may be extracted by any method such as extracting the A tag HREF attribute portion or extracting the character string portion starting with http(s) (see FIG. 2). At the same time, the display portion of the hyperlink is also extracted (see FIG. 2). Any method may be used to extract the text of the mail, such as extracting a part other than the A tag or the character string part starting with http(s) (see FIG. 2). It should be noted that extraction of the email text may be enabled or disabled as a read-aloud option. The element extraction unit 32 may also extract keywords related to login information such as login, password, and ID.

The element reading unit 33 is a functional unit that reads aloud the elements including at least hyperlinks extracted by the element extraction unit 32 (see FIG. 1). Any method, such as using existing reading software, may be used as a method of reading aloud by voice. Hyperlinks may be read aloud up to the depth of the directory hierarchy of the URL designated in advance by the user's operation of the input unit 12 (see FIG. 3). In addition, the reading of the hyperlink may be selected from reading only the hyperlink extraction portion, and displaying and reading the hyperlink display portion and the hyperlink extraction portion (see FIG. 4). In addition, when displaying and reading out the hyperlink display part and the hyperlink extraction part, for example, using a GUI (Graphical User Interface) screen, or displaying the hyperlink display part and the hyperlink extraction part on the pop-up screen of the mailer It is also possible to read aloud by voice at the same time. In addition, in the element readout section 33, the URL of the hyperlink display portion is stored in advance as a normal URL in a database (not shown), and the hyperlink display portion and the hyperlink extraction portion are displayed with the normal URL added. A read aloud mechanism may be used. When reading aloud, you can use markers to indicate which part of the text of the email is being read, or display the character string in a different color according to the flow of the reading voice (see Fig. 5). , the difference in characters may be emphasized (see FIG. 6).

The operation block canceling unit 34 cancels (for example, clicks, taps, etc.) blocks of operations (for example, clicks, taps, etc.) of the hyperlink by operating the input unit 12 of the user who has heard the voice reading of the element reading unit 33 and determines that the hyperlink is true. (see FIG. 1). Here, as an example of unblocking the operation of the hyperlink, accessing the link destination after operating the hyperlink can be mentioned. The operation block canceling unit 34 may use a plug-in function of a mailer or browser to display a pop-up screen (see FIG. 7) for authenticity determination. When the user selects the allow button, the hyperlinked URL is accessed and the information of the hyperlinked URL is displayed. If the user selects the allow button, unblocks the operation of the hyperlink. Alternatively, the mail may be discarded when the user selects the reject button. The operation block release unit 34 may prevent the operation block of the hyperlink from being released until the reading is completed.

Next, the operation of the information processing apparatus according to Embodiment 1 will be described using the drawings. FIG. 8 is a flowchart diagram schematically showing the operation of the information processing apparatus according to the first embodiment when phishing damage is prevented. Please refer to FIG. 1 for the configuration of the information processing apparatus.

First, the mail processing unit 20 of the information processing device 10 receives the mail 40 by the user's operation of the input unit 12, and displays and outputs the mail 40 from the output unit 13 (step A1).

Next, the operation blocking unit 31 of the phishing damage prevention unit 30 of the information processing device 10 blocks (disables) the operation of the hyperlink (URL) in the email text of the displayed email 40 (step A2). Note that the operation block continues until it is released.

Next, the element extraction unit 32 of the phishing damage prevention unit 30 of the information processing device 10 extracts the elements (hyperlink, email text) in the email text of the displayed email 40 (step A3). The element extraction may be started when the user operates the input unit 12 to operate the hyperlink.

Next, the element reading unit 33 of the phishing damage prevention unit 30 of the information processing device 10 reads out the extracted elements (hyperlink, email text) and causes the output unit 13 to output them by voice (step A4). When reading out the elements, the hyperlink display portion and the hyperlink extraction portion may be displayed and read out using a GUI (Graphical User Interface) screen.

Next, after reading out the elements (possibly during reading), the operation block canceling unit 34 of the phishing damage prevention unit 30 of the information processing device 10 causes the output unit 13 to display and output the operation block canceling selection screen (see FIG. 7). (Step A5).

Next, the operation block release unit 34 of the phishing damage prevention unit 30 of the information processing device 10 determines whether or not the user has selected "permit" on the operation block release selection screen (see FIG. 7) by operating the input unit 12. Make a decision (step A6). If "reject" is selected (NO in step A6), the process ends. It should be noted that if "reject" is selected, the mail may be discarded.

If "permit" is selected (YES in step A6), the operation block cancellation unit 34 of the phishing damage prevention unit 30 of the information processing device 10 cancels (validates) the operation block of the hyperlink in the email text of the email 40. ) (step A7).

Next, when the mail processing unit 20 of the information processing apparatus 10 receives an operation of a hyperlink in the mail body of the mail 40 by operating the input unit 12 of the user, the mail processing unit 20 accesses the URL of the hyperlink destination and reads the hyperlink. The information of the previous URL is displayed and output from the output unit 13 (step A8), and then the process ends.

According to the first embodiment, the operation of the hyperlink in the email 40 is blocked, the elements (hyperlink, email text) extracted from the email 40 are read aloud, and if the user determines that the email is legitimate, the hyperlink Since the operation of is enabled, it can contribute to the user's judgment of the phishing site with high accuracy. In other words, the hyperlink to the fraudulent site described in the phishing email is read aloud to prompt the user to determine the authenticity of the fraudulent site, thereby preventing erroneous operation of the hyperlink.

[Embodiment 2]
An information processing apparatus according to the second embodiment will be described with reference to the drawings. FIG. 9 is a block diagram schematically showing the configuration of an information processing apparatus according to the second embodiment; FIG. 10 is an image diagram schematically showing an example of noticing a sense of incongruity when reading out elements of the information processing apparatus according to the second embodiment.

Embodiment 2 is a modification of Embodiment 1, and includes a recording unit 35 that records each voice data read by the user and the device (information processing device 10), and a comparison unit 36 that compares the recorded voice data. It is an addition.

The recording unit 35 causes the output unit 13 to display and output the character string of the elements (hyperlink, email text) extracted by the element extraction unit 32, asks the user to read the character string, and records the voice read by the user. Data is input from the input unit 12 and recorded. The recording unit 35 records voice data of the character strings of the extracted elements (hyperlinks, mail text) read aloud by the device. The recording unit 35 may be included in the element reading unit 33 .

The comparison unit 36 acquires the user's voice data and the device's voice data recorded by the recording unit 35, and compares these voice data. The method of comparison may be a method of reproducing these audio data (simultaneously reproducing or reproducing them so that they can be heard and compared) and asking the user to compare the different parts. A method of processing data and comparing differences may also be used. As an example in which the user notices a sense of incongruity by the comparison unit 36, the user's assumed hyperlink reads out the character string of the hyperlink that the user thinks is legitimate. By comparing the voice data of the device that read out the character string of the actual hyperlink, it can be seen that the hyperlink is different from the hyperlink that the user thinks is legitimate (see FIG. 10). ).

Next, the operation of the information processing apparatus according to Embodiment 2 will be described using the drawings. FIG. 11 is a flowchart diagram schematically showing the operation of the information processing apparatus according to the second embodiment when phishing damage is prevented. Please refer to FIG. 9 for the configuration of the information processing apparatus.

First, the mail processing unit 20 of the information processing device 10 receives the mail 40 by the user's operation of the input unit 12, and displays and outputs the mail 40 from the output unit 13 (step B1).

Next, the operation blocking unit 31 of the phishing damage prevention unit 30 of the information processing device 10 blocks (disables) the operation of the hyperlink (URL) in the email text of the displayed email 40 (step B2). Note that the operation block continues until it is released.

Next, the element extraction unit 32 of the phishing damage prevention unit 30 of the information processing device 10 extracts the elements (hyperlink, email text) in the email text of the displayed email 40 (step B3). The element extraction may be started when the user operates the input unit 12 to operate the hyperlink.

Next, the recording unit 35 of the phishing damage prevention unit 30 of the information processing device 10 causes the output unit 13 to display and output the extracted elements (hyperlinks, email text), and the elements read aloud by the user from the input unit 12 (hyperlinks). , mail text) is recorded and stored in the storage unit 14 (step B4).

Next, the recording unit 35 of the phishing damage prevention unit 30 of the information processing device 10 causes the element reading unit 33 to read out the extracted element (hyperlink, email text), and reads out the element (hyperlink, email text). Audio data (audio data of the device) is recorded and stored in the storage unit 14 (step B5). The order of steps B4 and B5 may be reversed.

Next, the comparison unit 36 of the phishing damage prevention unit 30 of the information processing device 10 acquires the recorded voice data of the user and the voice data of the device, and compares these voice data (step B6). The method of comparison may be a method of reproducing these audio data (simultaneously reproducing or reproducing them so that they can be heard and compared) and having the user confirm and judge the difference. A method of performing data processing with 10 tools and confirming differences may be used.

Next, after comparing the voice data (possibly even during the comparison), the operation block canceling unit 34 of the phishing damage prevention unit 30 of the information processing apparatus 10 displays and outputs the operation block canceling selection screen (see FIG. 7) from the output unit 13. (step B7).

Next, the operation block release unit 34 of the phishing damage prevention unit 30 of the information processing device 10 determines whether or not the user has selected "permit" on the operation block release selection screen (see FIG. 7) by operating the input unit 12. It judges (step B8). If "reject" is selected (NO in step B8), the process ends. It should be noted that if "reject" is selected, the mail may be discarded.

If "permit" is selected (YES in step B8), the operation block canceling unit 34 of the phishing damage prevention unit 30 of the information processing device 10 cancels (validates) the hyperlink operation block in the email text of the email 40. ) (step B9).

Next, when the mail processing unit 20 of the information processing apparatus 10 receives an operation of a hyperlink in the mail body of the mail 40 by operating the input unit 12 of the user, the mail processing unit 20 accesses the URL of the hyperlink destination and reads the hyperlink. The information of the previous URL is displayed and output from the output unit 13 (step B10), and then the process ends.

According to the second embodiment, as in the first embodiment, it is possible to contribute to the user's determination of a phishing site with high accuracy, and elements (hyperlinks, email text) in the email text of the extracted email 40 A phishing email that leads to a phishing site by homograph attack, which is a method of deceiving the eyes, by comparing the audio data read by the user and the audio data read by the device (computer). can be detected with high accuracy.

[Embodiment 3]
An information processing apparatus according to Embodiment 3 will be described with reference to the drawings. FIG. 12 is a block diagram schematically showing the configuration of an information processing apparatus according to the third embodiment;

The information processing apparatus 10 includes an operation block section 31, an element extraction section 32, an element reading section 33, and an operation block release section 34.

The operation blocker 31 blocks the operation of the hyperlinks in the email text of the displayed email 40. The element extraction unit 32 extracts elements including at least hyperlinks in the email text. The element reading unit 33 reads aloud the element including at least the hyperlink. The operation block cancellation unit 34 cancels the block of the operation of the hyperlink by the operation of the user who listens to the voice reading and determines that the hyperlink is true.

According to the third embodiment, the hyperlink operation of the email 40 is blocked, the elements (including at least the hyperlink) extracted from the email 40 are read aloud, and if the user judges the email to be legitimate, the hyperlink Since the operation of is enabled, it can contribute to the user's judgment of the phishing site with high accuracy.

It should be noted that the information processing apparatus according to the first to third embodiments can be configured by so-called hardware resources (information processing apparatus, computer), and those having the configuration illustrated in FIG. 13 can be used. For example, hardware resource 100 includes processor 101 , memory 102 , network interface 103 , etc. interconnected by internal bus 104 .

Note that the configuration shown in FIG. 13 is not intended to limit the hardware configuration of the hardware resource 100 . The hardware resource 100 may include hardware not shown (for example, an input/output interface). Alternatively, the number of units such as the processors 101 included in the device is not limited to the illustration in FIG. For the processor 101, for example, a CPU (Central Processing Unit), MPU (Micro Processor Unit), GPU (Graphics Processing Unit), etc. can be used.

For the memory 102, for example, RAM (Random Access Memory), ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), etc. can be used.

For the network interface 103, for example, a LAN (Local Area Network) card, network adapter, network interface card, etc. can be used.

The functions of the hardware resource 100 are realized by the processing modules described above. The processing module is implemented by the processor 101 executing a program stored in the memory 102, for example. Also, the program can be downloaded via a network or updated using a storage medium storing the program. Furthermore, the processing module may be realized by a semiconductor chip. In other words, the functions performed by the above processing modules may be realized by executing software in some kind of hardware.

Some or all of the above embodiments can be described as the following supplementary notes, but are not limited to the following.

[Appendix 1]
an operation block unit configured to block operation of hyperlinks in the email body of the displayed email;
an element extraction unit configured to extract an element including at least the hyperlink in the body of the email;
an element reader configured to read aloud the element including at least the hyperlink;
an operation blocking unblocking unit configured to unblock operation of the hyperlink;
An information processing device.
[Appendix 2]
The element extracting unit is configured to also extract a display portion of the hyperlink in the email text.
The information processing device according to appendix 1.
[Appendix 3]
When extracting the hyperlink, the element extracting unit is configured to extract an A tag HREF attribute part or a character string part starting with http(s) in the email text.
3. The information processing device according to appendix 1 or 2.
[Appendix 4]
The element extraction unit is configured to extract a keyword related to login information,
The information processing apparatus according to any one of Appendices 1 to 3.
[Appendix 5]
The element reading unit is configured to read aloud the hyperlink up to a predetermined directory hierarchy depth.
5. The information processing apparatus according to any one of Appendices 1 to 4.
[Appendix 6]
The element reading unit is configured to display the elements extracted by the element extraction unit on a GUI screen or a pop-up screen during the voice reading.
6. The information processing apparatus according to any one of Appendices 1 to 5.
[Appendix 7]
The element reading unit is configured to display the hyperlink extracted by the element extracting unit by adding a pre-stored normal URL of the hyperlink and read aloud.
7. The information processing apparatus according to any one of Appendices 1 to 6.
[Appendix 8]
The element read-out unit is configured to display the text-to-speech portion of the email text with a marker, display it in a different color from other portions, or display it with more emphasis than other portions.
8. The information processing apparatus according to any one of Appendices 1 to 7.
[Appendix 9]
The operation block releasing unit is configured to display a pop-up screen for authenticity determination of the hyperlink.
9. The information processing apparatus according to any one of Appendices 1 to 8.
[Appendix 10]
The operation blocking canceling unit is configured to cancel the blocking of the hyperlink operation when an allow button on the pop-up screen is selected.
The information processing device according to appendix 9.
[Appendix 11]
The operation block release unit is configured to discard the email when a rejection button on the pop-up screen is selected.
The information processing device according to appendix 9 or 10.
[Appendix 12]
Displaying the character string of the element extracted by the element extraction unit, recording first voice data of the character string read out by the user, and recording second voice of the character string read out by the element reading unit a recording unit configured to record data;
a comparison unit configured to compare the recorded first audio data and the second audio data;
further comprising
12. The information processing apparatus according to any one of appendices 1 to 11.
[Appendix 13]
The comparison unit is configured to reproduce the first audio data and the second audio data so that they can be listened to and compared, or process the data of the first audio data and the second audio data with a tool and compare them. has been
12. The information processing device according to appendix 12.
[Appendix 14]
An information processing method for performing information processing using hardware resources,
blocking manipulation of hyperlinks in the email body of the displayed email;
extracting an element containing at least the hyperlink in the body of the email;
reading aloud the element containing at least the hyperlink;
unblocking operation of said hyperlink;
A method of processing information, comprising:
[Appendix 15]
a process of blocking the operation of hyperlinks in the email body of the displayed email;
a process of extracting an element containing at least the hyperlink in the body of the email;
reading aloud the element containing at least the hyperlink;
a process of unblocking manipulation of the hyperlink;
A program that causes a hardware resource to execute

It should be noted that the disclosures of the above patent documents are incorporated herein by reference, and can be used as the basis or part of the present invention as necessary. Within the framework of the entire disclosure of the present invention (including claims and drawings), modifications and adjustments of the embodiments and examples are possible based on the basic technical concept thereof. Also, various combinations or selections of various disclosure elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) within the framework of the full disclosure of the present invention (if necessary not selected) is possible. That is, the present invention naturally includes various variations and modifications that can be made by those skilled in the art according to the entire disclosure including the claims and drawings and the technical idea. Also, with regard to numerical values and numerical ranges described in this application, it is assumed that any intermediate values, sub-numerical values and sub-ranges thereof are described even if not specified. Furthermore, each disclosure item of the above-cited document can be used in combination with the items described in this document as part of the disclosure of the present invention in accordance with the spirit of the present invention, if necessary. are considered to be included in (belong to) the disclosure of the present application.

10 information processing device 11 communication unit 12 input unit 13 output unit 14 storage unit 15 control unit 20 mail processing unit 30 phishing damage prevention unit 31 operation block unit 32 element extraction unit 33 element reading unit 34 operation block release unit 35 recording unit 36 comparison Part 40 Mail 100 Hardware Resources 101 Processor 102 Memory 103 Network Interface 104 Internal Bus

Claims

an operation block unit configured to block operation of hyperlinks in the email body of the displayed email;
an element extraction unit configured to extract an element including at least the hyperlink in the body of the email;
an element reader configured to read aloud the element including at least the hyperlink;
an operation blocking unblocking unit configured to unblock operation of the hyperlink;
An information processing device.
The element extracting unit is configured to also extract a display portion of the hyperlink in the email text.
The information processing apparatus according to claim 1.
When extracting the hyperlink, the element extracting unit is configured to extract an A tag HREF attribute part or a character string part starting with http(s) in the email text.
The information processing apparatus according to claim 1 or 2.
The element extraction unit is configured to extract a keyword related to login information,
The information processing apparatus according to any one of claims 1 to 3.
The element reading unit is configured to read aloud the hyperlink up to a predetermined directory hierarchy depth.
The information processing apparatus according to any one of claims 1 to 4.
The element reading unit is configured to display the elements extracted by the element extraction unit on a GUI screen or a pop-up screen during the voice reading.
The information processing apparatus according to any one of claims 1 to 5.
The element reading unit is configured to display the hyperlink extracted by the element extracting unit by adding a pre-stored normal URL of the hyperlink and read aloud.
The information processing apparatus according to any one of claims 1 to 6.
The element read-out unit is configured to display the text-to-speech portion of the email text with a marker, display it in a different color from other portions, or display it with more emphasis than other portions.
The information processing apparatus according to any one of claims 1 to 7.
The operation block releasing unit is configured to display a pop-up screen for authenticity determination of the hyperlink.
The information processing apparatus according to any one of claims 1 to 8.
The operation blocking canceling unit is configured to cancel the blocking of the hyperlink operation when an allow button on the pop-up screen is selected.
The information processing device according to claim 9 .
The operation block release unit is configured to discard the email when a rejection button on the pop-up screen is selected.
The information processing apparatus according to claim 9 or 10.
Displaying the character string of the element extracted by the element extraction unit, recording first voice data of the character string read out by the user, and recording second voice of the character string read out by the element reading unit a recording unit configured to record data;
a comparison unit configured to compare the recorded first audio data and the second audio data;
further comprising
The information processing apparatus according to any one of claims 1 to 11.
The comparison unit is configured to reproduce the first audio data and the second audio data so that they can be listened to and compared, or process the data of the first audio data and the second audio data with a tool and compare them. has been
13. The information processing apparatus according to claim 12.
An information processing method for performing information processing using hardware resources,
blocking manipulation of hyperlinks in the email body of the displayed email;
extracting an element containing at least the hyperlink in the body of the email;
reading aloud the element containing at least the hyperlink;
unblocking operation of said hyperlink;
A method of processing information, comprising:
a process of blocking the operation of hyperlinks in the email body of the displayed email;
a process of extracting an element containing at least the hyperlink in the body of the email;
reading aloud the element containing at least the hyperlink;
a process of unblocking manipulation of the hyperlink;
A program that causes a hardware resource to execute