CN1859389A

CN1859389A - Method and device for improving e-mail safety

Info

Publication number: CN1859389A
Application number: CNA2005101277629A
Authority: CN
Inventors: 梁刚; 吴凌燕
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2005-12-06
Filing date: 2005-12-06
Publication date: 2006-11-08
Anticipated expiration: 2025-12-06
Also published as: WO2007065340A1; CN100514970C

Abstract

The present invention discloses raising electronic mail security method. Said method configures each security level corresponded operation authority in electronic mail server; said electronic mail server receiving electronic mail and determining and recording said electronic mail security level; said electronic mail server receiving electronic mail operation request, according to said electronic mail security level corresponded operation authority to control requester operation. The present invention also discloses electronic mail server.

Description

A kind of method and device that improves Email Security

Technical field

The present invention relates to communication and field of computer technology, relate in particular to the method and the device thereof that improve Email Security.

Background technology

Along with the development of mobile communication technology, Internet uses and is extended to mobile application.The 3G (Third Generation) Moblie technology has been quickened the fusion of telecommunications network and Internet, and Internet uses and expanded mobile network's professional ability to mobile network's extension, and mobile network's inherent characteristics has proposed new demand to these application.

Email occupies an important position in Internet uses, the mobile e-mail business is the expansion to traditional internet email, support utilizes the mobile terminal device editor to send and receive e-mail, and can carry out seamless fusion with the electronic mail service of Internet.The mobile e-mail business is meant by wireless access way and visits e-mail server safely and information is carried out a kind of application of respective handling.

The method of the mail account of user bound has two kinds in the mobile e-mail business: based on equipment and based on the user's; The former is with mobile device and mail account binding, and the latter is with user's SIM card and mail account binding.Binding relationship is stored in the network, and specific mail account can only could be visited by specific portable terminal or SIM card.But this problem that may bring is: unauthorized other people under certain conditions can be by the mail in this portable terminal or the SIM card calling party mailbox.

Along with improving constantly of memory technology, the content that portable terminal can be stored is also more and more, and most of users not deletion immediately after reading mail, perhaps need to keep important mail so that consult later on, thus cause unauthorized other people can see mail in the portable terminal under certain conditions.Therefore, people are more and more higher to the requirement of the fail safe of mobile e-mail.

It is a kind of by the method that password guarantees safety of electronic mail is set that prior art provides, and the basic principle of this method is: for reading or consult the operation setting password of the message in the described mobile communication terminal; Password will be set to be stored in the mobile communication terminal; The user only just can consult or read that mobile communication terminal receives or the canned data content under the correct situation of input password.

Though said method can improve the fail safe of Email to a certain extent, has the following disadvantages:

1, can only carry out cryptoguard to the information in the portable terminal, for mobile e-mail is professional, unauthorized other people still can be by the user the mail of mobile terminal accessing in the e-mail server, thereby its fail safe is not high.

2, the message that receives of user has only a kind of rank, and can only be provided with whether need cryptoguard by the recipient, if the sender of the message thinks that the mail that sends is extremely important, but can't take safety measures.

3, the user has adopted cryptoguard to Email, all will input password for any a piece of news and could read or receive, and operates comparatively loaded down with trivial details.

Summary of the invention

The invention provides a kind of method that improves Email Security, to solve in the prior art problem that there is the not high and complex operation of fail safe in protection to Email.

The invention provides following technical scheme:

A kind of method that improves Email Security comprises the steps:

The pairing operating right of each level of security of configuration in e-mail server;

Described e-mail server receives the level of security of determining and write down this Email behind sender's the Email; And

After described e-mail server is received operation requests to Email, by the pairing operating right of the level of security control request person's of this Email operation.

Wherein:

Set in advance the level of security of sender institute send Email and/or the level of security of send Email is set by the Email senders by the Email recipient.

The sender sets in advance the level of security of send Email and is recorded in the e-mail server; Perhaps, the sender is provided with level of security at this Email when send Email.

After e-mail server received sender's Email, if detect the sender and the recipient all is provided with the safety of electronic mail rank, then the highest level of security that will be provided with was recorded as the level of security of Email.

After e-mail server received sender's Email, if detect the sender and the recipient all is not provided with the safety of electronic mail rank, then this Email was set to lowest security level.

By dividing the safety of electronic mail rank to the safe coefficient of email request or to user's performance constraint.

Described safety of electronic mail rank comprises section-level or all rank in following four ranks:

First level of security, no cryptoguard allows this mail of recipient's free operant, and allows the recipient to revise level of security;

Second level of security has cryptoguard, and the recipient allows this mail of free operant after importing proper password, and allows the recipient to revise level of security;

The 3rd level of security has cryptoguard, and the recipient only allows this mail of on-line operation after importing proper password, and allows the recipient to revise level of security;

The 4th level of security has cryptoguard, and the recipient only allows this mail of on-line operation after importing proper password, and does not allow to revise level of security.

After the recipient revised the level of security of Email, e-mail server write down the level of security of this Email again.

A kind of e-mail server comprises:

Memory module, the level of security information of storage of e-mails, Email, and the operating right of level of security correspondence;

The level of security presetting module is used to be provided with the level of security of sender's send Email and is saved in described memory module;

The level of security processing module is determined the level of security of the Email that receives and is recorded described memory module;

The operation control module according to the level of security of the Email of solicit operation, is given the operation of the operating right of recipient's correspondence with the control recipient;

Authentication module is verified the password of recipient's input, and will be verified the described operation control module of result notification;

The level of security modified module is used to revise the level of security of Email.

Described level of security processing module is recorded as the highest level of security that is provided with the level of security of Email when detecting sender and recipient and be Email and be provided with level of security; Perhaps,

Described level of security processing module all is not provided with the safety of electronic mail rank detecting sender and recipient, and this Email is set to lowest security level.

Described e-mail server is the mobile E-mail server.

Adopt the present invention, the user can be provided with multiple mail security rank according to the factors such as material circumstance of mail, and each rank is given different operating rights, and, the recipient of mail and sender all can be provided with the rank of mail security, thereby the fail safe that can improve mail; In addition, the recipient can change the level of security of mail more neatly, for surface mail lowest security level without cryptoguard can be set, thereby simple to operate.Especially in mobile electronic mail service, adopt the present invention can further strengthen the fail safe of mail.

Description of drawings

Fig. 1 is e-mail server structural representation among the present invention;

Fig. 2 is provided with the flow chart of level of security reprocessing mail for recipient among the present invention;

Fig. 3 is provided with the flow chart of level of security reprocessing mail for sender among the present invention;

Fig. 4 all is provided with the flow chart of level of security reprocessing mail for recipient among the present invention and sender;

The flow chart that Fig. 5 handles postal matter when all level of security not being set for recipient among the present invention and sender;

Fig. 6 sends mail for Email Sender among the present invention and the signaling process figure of level of security is set;

Fig. 7, Fig. 8 receive the signaling process figure of mail for user among the present invention;

Fig. 9 revises the signaling process figure of level of security for recipient among the present invention.

Embodiment

In order to improve the fail safe of Email, the present invention is by to the safe coefficient (being importance) of email request or to recipient's the performance constraint level of security divided rank with mail, the operating right that each grade is corresponding different respectively, generally speaking, important more its level of security of mail is high more, and is also strict more to the restriction of operation; When receiving sender's Email, e-mail server determines and writes down the level of security of this Email; Then, control its operation by the pairing operating right of the level of security of mail after the user is to the operation requests of this Email receiving.This operation refers to comprise download, delete, consult and reading etc.

Present embodiment is that example describes with mobile E-mail (e-mail) business mainly, but is equally applicable to other electronic mail services.

Consult shown in Figure 1ly, mobile E-mail server 10 comprises: memory module 100, level of security presetting module 110, level of security processing module 120, operation control module 130, authentication module 140 and level of security modified module 150.Wherein:

Memory module 100 is used for the level of security information of storage of e-mails, Email, and the operating right of level of security correspondence etc.The operating right of level of security correspondence can come record by mapping table, utilizes this table of level of security sign inquiry can know corresponding operating right.

Level of security presetting module 110 is used to set in advance the level of security of sender's send Email, and setting is saved in memory module 100.After having preset level of security by this level of security presetting module 110, in e-mail server that sender's addresses of items of mail is related with level of security.If oneself has preset level of security the sender, the mail that this person sends all is designated this level of security.

Safe level processing module 120 is used for determining the level of security of the Email that receives and records described memory module 100.

If sender and recipient all are provided with level of security, preferable mode is that level of security processing module 120 is determined the level of security of this mail by the highest level of security; Certainly, also can determine the level of security of this mail by the rank that the sender is provided with.If sender and recipient all are not provided with the safety of electronic mail rank, preferable mode is that level of security processing module 120 is determined the level of security of this Email by lowest security level.

Operation control module 130, the level of security of Email of operation from memory module 100 from query requests, and by the operating right control recipient's of this level of security correspondence operation.

Authentication module 140, password to recipient's input is verified, and will verify the described operation control module 130 of result notification, if password authentification success, 130 of operation control modules allow the recipient to operate accordingly, if authentication failed, 130 of control modules of operation forbid that the recipient carries out any operation.

Level of security modified module 150 is used for revising the level of security of memory module 100 Emails, writes down the level of security of this Email after the level of security of Email is revised again.

But level of security according to the form below setting:

Mail security rank table
Mail security rank table			Rank	Can the person of setting	Implication (operating right)
0	Recipient, sender	Do not need cryptoguard, but level of security is revised in this mail of free operant and permission.Free operant comprises: comprise forwarding, deletion, download, online browse and this read purposefully.	Rank	Can the person of setting	Implication (operating right)
0	Recipient, sender		1	Recipient, sender	But this mail of free operant behind the input proper password, and allow to revise level of security.Free operant comprises: comprise forwarding, deletion, download, online browse and this read purposefully.
2	The recipient	Only allow on-line operation behind the input proper password, and allow to revise level of security.On-line operation comprises forwarding, deletion and online browse.	1	Recipient, sender
2	The recipient		3	The sender	Only allow on-line operation behind the input proper password, and do not allow to revise level of security.On-line operation comprises forwarding, deletion and online browse.

Wherein, 0 grade level of security is minimum, but i.e. this mail of recipient's free operant; 3 grades level of security is the highest.Certainly, can be divided into more multi-levelly according to actual needs, perhaps be divided into still less rank.

Consult shown in Figure 2ly, the process that user A is provided with the Email that the level of security of user B send Email and process user B send is as follows:

Step 200, user A are 2 grades by the level of security that the level of security presetting module 110 in the e-mail server of place is provided with the Email of user B, and the input validation password, level of security pre-sets module 110 information that is provided with is saved in the memory module 110.

The mail that user A can send user B in several ways is provided with level of security, for example, by the mode of webpage, SMS sends means of signaling, the method of voice suggestion is dialed modes (adopting which kind of method can't influence realization of the present invention) such as artificial speech phone.

Step 210, user B are to user A send Email.

After step 220, user A place e-mail server received mail, level of security processing module 120 was by the pairing level of security of inquiring user B, and the level of security of determining this mail is 2 grades and is saved in the memory module 100.

The Email that user B sends is consulted in step 230, the request of user A login mail server.

Step 240, operation control module 130 are inquired about the level of security of Email from memory module 100, determine that it is 2 grades and know the control corresponding authority, require user A input validation password.

Step 250, user A input validation password, authentication module 140 compares the password of this password and protection, and notifying operation control module 130 (this example is for being proved to be successful).

Step 260, operation control module 130 allow online the consulting of user A (if receive the authentication failed notice, then refusing user's is consulted).

Step 270, user's request are revised as 1 grade with the level of security of mail.

Step 280, level of security modified module 150 are revised as 1 grade and the information of revising is saved in the memory module 100 with the level of security of this mail.

In above-mentioned flow process, if this mail is downloaded in user A request earlier, server then can be refused this user's request.

Consult shown in Figure 3ly, the process that user B is provided with the Email that the level of security of send Email and process user B send is as follows:

Step 300, user B are 3 grades by the level of security that the level of security presetting module 110 in the e-mail server of place is provided with own send Email, and the input validation password, level of security pre-sets module 110 information that is provided with is saved in the memory module 110.

Step 310, user B are to user A send Email.

After step 320, user A place e-mail server receive mail, because user A does not set the level of security of user B send Email, therefore, level of security processing module 120 backs determine that the level of security of this mail is 3 grades and is saved in the memory module 100.

The Email that user B sends is consulted in step 330, the request of user A login mail server.

Step 340, operation control module 130 are inquired about the level of security of Email from memory module 100, determine that it is 3 grades and know the control corresponding authority, require user A input validation password (this password is notified user A by user B).

Step 350, user A input validation password, authentication module 140 compares the password of this password and protection, and notifying operation control module 130 (this example is for being proved to be successful).

Step 360, operation control module 130 allow online the consulting of user A (if receive the authentication failed notice, then refusing user's is consulted).

Consult shown in Figure 4ly, the process that user A and user B all are provided with the Email that the level of security of Email and process user B send is as follows:

Step 400, user A are 2 grades by the level of security that the level of security presetting module 110 in the e-mail server of place is provided with own send Email, and the input validation password, level of security pre-sets module 110 information that is provided with is saved in the memory module 110.

Step 410, user B are 3 grades by the level of security that the level of security presetting module 110 in the e-mail server of place is provided with own send Email, and the input validation password, level of security pre-sets module 110 information that is provided with is saved in the memory module 110.

Step 420, user B are to user A send Email.

After step 430, user A place e-mail server receive mail, level of security processing module 120 finds that the level of security that user A is provided with is 2 grades, the level of security that user B is provided with in the mail is 3 grades, and therefore, the level of security of determining this mail is 3 grades and is saved in the memory module 100.

The Email that user B sends is consulted in step 440, the request of user A login mail server.

Step 450, operation control module 130 are inquired about the level of security of Email from memory module 100, determine that it is 3 grades and know the control corresponding authority, require user A input validation password (this password is notified user A by user B).

Step 460, user A input validation password, authentication module 140 compares the password of this password and protection, and notifying operation control module 130 (this example is inputed the password mistake for the user, authentication failed).

Step 470, operation control module 130 do not allow that user A is online to be consulted.(certainly, can point out the user input validation password once more.)

Consult shown in Figure 5ly, the process that user A and user B all are not provided with the Email that the level of security of Email and process user B send is as follows:

Step 500, user B are to user A send Email.

After step 510, user A place e-mail server received mail, because user A and user B all are not provided with the level of security of mail, therefore, level of security processing module 120 determined that the level of security of this mail is 0 grade and is saved in the memory module 100.

The Email that user B sends is consulted in step 520, the request of user A login mail server.

Step 530, operation control module 130 inquire abouts the level of security of Email from memory module 100, determine that it is 0 grade and know the control corresponding authority, this mail of permission user A free operant.

The processing procedure of other level of securitys and in like manner above-mentioned repeats no more.

Consult shown in Figure 6ly, the Email Sender sends the signaling process following (supposing that e-mail sending and recipient belong to same mobile e-mail server) that mail is provided with level of security simultaneously:

Step 600, Email Sender's client send SMTP HELO signaling to mail server, and expression requires to send mail.

After step 605, mail server receive, send SMTP 250OK, expression prepares to receive mail.

Step 610, Email Sender's client send SMTP MAIL FROM:＜B〉to mail server, expression Email Sender's address is B.

Step 615, mail server are replied SMTP 250OK, represent to get the mail the sender address.

Step 620, Email Sender's client send SMTP RCPT TO:＜A〉to mail server, expression mail reception person's address is A.

Step 625, mail server are replied SMTP 250OK, express willingness to be B reception mail.

Step 630, Email Sender's client send SMTP SAFETY LEVEL x to mail server, and the level of security of representing this mail is x.

Step 635, mail server are replied SMTP 250OK, and the level of security of this mail is known in expression.

Step 640, Email Sender's client send SMTP DATA to mail server, and expression begins to transmit data.

Step 645, mail server are replied SMTP 354Start mail input; End with＜CRLF 〉.＜CRLF 〉, expression can begin to transmit data, and with＜CRLF 〉.＜CRLF〉represent that mail transmission finishes.

Step 650, Email Sender's client send data to mail server.

Step 655, Email Sender's client transmission＜CRLF 〉.＜CRLF〉to mail server, the expression mail transmission finishes.

Step 660, mail server are replied SMTP 250OK, and expression successfully receives.

The rank that level of security that step 665, mail server are preset according to the recipient and sender are provided with is determined the level of security of this envelope mail.

If the sender belongs to different mail servers with the recipient, then step 665 is carried out at the e-mail server of recipient's ownership.

Consult shown in Figure 7ly, the user receives the signaling process following (the mail security rank is 0 or 1 situation) of mail:

Step 700, mail reception person's client send IMAP FETCH x full to mail server, and expression requires to download x envelope mail.

Step 710, mail server are judged the level of security of mail, find that level of security is 0 or 1, and explanation can download to client.

Step 720, mail server send IMAP x FETCH to mail reception person's client, and expression is carried out mail and downloaded.

After step 730, download were finished, mail server sent IMAP OK FETCH completed to mail reception person's client, and expression is downloaded and finished.

Step 740, mail reception person carry out mail by client and check, if the level of security of mail is 1, the user needs correct input password just can check; If the level of security of mail is 0, the user can freely check reading.

Consult shown in Figure 8ly, it is that the process of 2 or 3 mail is as follows that the user receives level of security:

Step 800, mail reception person's client send IMAP FETCH x full to mail server, and expression requires to download x envelope mail.

Step 810, mail server are judged the level of security of mail, find that level of security is 2 or 3, and explanation cannot download to client.

Step 820, mail server send IMAP ERROR the mail only be read online to mail reception person's client, represent that this envelope mail can only online browse.

Step 830, user can only read by the mode of online browse and check.

Consult shown in Figure 9ly, it is as follows to revise mail level signalling flow process:

Step 900, mail reception person's client send HTTP:POST request change safety levelofthe mail x to level z to mail server, and the expression request is made as z with the level of security of x envelope letter.

Step 910, mail server are replied HTTP:response please input password, and expression requires the input password.

Step 920, mail reception person's client send HTTP:POST submit password to mail server, expression input password.

Step 930, mail server authentication password, if correct, then the level of security with mail x is made as z, and replys HTTP:response 200OK, expression is changed successfully; If wrong (as: password mistake, rank 3 is revised as other rank) then replied miscue information and given mail reception person's client.

The user can level of security be that 0 mail is set to 1 behind the correct password of own client input; Equally can level of security be that 1 mail is set to 0.

Describe though Fig. 6, Fig. 7, Fig. 8, Fig. 9 are example with the http protocol, be not limited to this, the mail security rank setting of adopting other agreements to carry out server end does not influence realization of the present invention, as also adopting agreements such as SIP, WAP.

Adopt the present invention, especially can protect for the safety of Email in the mobile E-mail of on mobile communications network, carrying out (e-mail) business strong guarantee is provided, described mobile communications network comprises 2G, 2.5G, 3G and IP Multimedia System (IMS) etc.

Obviously, those skilled in the art can carry out various changes and modification to the present invention and not break away from the spirit and scope of the present invention.Like this, if of the present invention these are revised and modification belongs within the scope of claim of the present invention and equivalent technologies thereof, then the present invention also is intended to comprise these changes and modification interior.

Claims

1, a kind of method that improves Email Security is characterized in that, comprises the steps:

2, the method for claim 1 is characterized in that, is set in advance the level of security of sender institute send Email and/or the level of security of send Email is set by the Email senders by the Email recipient.

3, method as claimed in claim 2 is characterized in that, the sender sets in advance the level of security of send Email and is recorded in the e-mail server; Perhaps, the sender is provided with level of security at this Email when send Email.

4, method as claimed in claim 2, it is characterized in that, after e-mail server received sender's Email, if detect the sender and the recipient all is provided with the safety of electronic mail rank, then the highest level of security that will be provided with was recorded as the level of security of Email.

5, method as claimed in claim 2 is characterized in that, after e-mail server received sender's Email, if detect the sender and the recipient all is not provided with the safety of electronic mail rank, then this Email was set to lowest security level.

6, the method for claim 1 is characterized in that, by dividing the safety of electronic mail rank to the safe coefficient of email request or to user's performance constraint.

As each described method of claim 1 to 6, it is characterized in that 7, described safety of electronic mail rank comprises section-level or all rank in following four ranks:

8, method as claimed in claim 7 is characterized in that, the free operant in first level of security and second level of security comprises forwarding, deletion, download, online browse and this read purposefully.

9, method as claimed in claim 7 is characterized in that, the on-line operation in the 3rd level of security and second level of security comprises forwarding, deletion and online browse.

10, method as claimed in claim 7 is characterized in that, after the recipient revised the level of security of Email, e-mail server write down the level of security of this Email again.

11, a kind of e-mail server is characterized in that, comprising:

12, e-mail server as claimed in claim 11, it is characterized in that, described level of security processing module is recorded as the highest level of security that is provided with the level of security of Email when detecting sender and recipient and be Email and be provided with level of security; Perhaps,

As claim 11 or 12 described e-mail servers, it is characterized in that 13, described e-mail server is the mobile E-mail server.