JP2002217981A - Device, program and method for watching electronic mail - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a device for watching electronic mails which enables efficient prevention of the second reception of an electronic mail, containing virus and the like. SOLUTION: While a mail source address, from which the reception is to be rejected, is previously stored in a mail address storage means 151, if a source address of a sent mail corresponds to entries in the mail storage means 151, the number and history of reception rejection are accumulated and stored classified by mail source addresses and also a reception rejection message, including the number and history of reception rejections, are returned to the opposite party. When virus is detected in a mail sent from an address un-entered in the mail storage means 151, whether to reject the further reception from the identical address is inquired of a client of its destination, and if the reply is rejection of reception, the mail address is registered in the mail storage means 151.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic mail monitoring device for ensuring the security of electronic mail to be transmitted and received, a program for causing a computer to function as an electronic mail monitoring device, and a computer readable recording of the program. The present invention relates to a recording medium and an electronic mail monitoring method.

[0002]

2. Description of the Related Art E-mail can be freely sent to its destination only by designating the e-mail address of the destination, so that e-mails containing viruses can be distributed or advertisement e-mails such as direct mails can be sent. It can be abused, for example by sending mail indiscriminately.

As one of the techniques for preventing the reception of e-mails containing viruses and unnecessary e-mails, Japanese Patent Laid-Open Publication No.
Japanese Patent No. 167533 discloses an e-mail firewall device. In this device, when the sender of the received e-mail is a pre-registered e-mail address,
In addition to rejecting the reception, if the user is not registered, a virus check is performed, and only a virus-free e-mail is received. Also, the e-mail whose reception has been refused is returned to the sender.

[0004]

In the above-described e-mail firewall device, even if an e-mail containing a virus is detected, the e-mail is simply sent back to the sender, so that the e-mail firewall apparatus rejects the e-mail. It was difficult to transmit the will of the other party to the other party, and it was not possible to effectively prevent the retransmission of an e-mail or the like containing a virus.

Further, even if an e-mail containing a virus is detected, it is simply sent back to the sender, so that if an e-mail containing a new virus arrives from the same source, the new virus will not be detected. Could not refuse to receive the e-mail, and might receive an inconvenient e-mail.

SUMMARY OF THE INVENTION The present invention has been made in view of such problems of the prior art, and has an electronic mail monitoring device and the like capable of effectively preventing an e-mail containing a virus or the like from being received again. It is intended to provide.

[0007]

The gist of the present invention to achieve the above object lies in the following inventions. [1] In an e-mail monitoring device (100) for ensuring the security of transmitted / received e-mails, a storage means (151) for storing a source mail address of an e-mail to be rejected, and an e-mail arrived Collating means (131) for collating whether or not the sender's email address is stored in the storage means (151);
31) receiving rejection means (132) for rejecting the reception of the electronic mail when the result of the collation by 31) is that the source mail address of the electronic mail is stored in the storage means (151); Reception rejection notification means (13) for transmitting a reception rejection message indicating that the reception of the electronic mail is rejected to the transmission source of the electronic mail whose reception has been rejected.
5) An electronic mail monitoring device (100), comprising:

[2] Rejection count storage means (137, 15) for accumulating and storing the number of rejections for which reception was rejected for each source mail address of the e-mail for which reception was rejected.
(2), the reception rejection notifying means (135)
Transmits a rejection message including the number of rejections stored in the rejection count storage means (137, 152) to the sender of the e-mail whose reception has been rejected in association with the source e-mail address of the e-mail. The e-mail monitoring device (100) according to [1], wherein:

[3] Rejection history storage means (1) for storing a history of e-mails for which reception has been rejected for each source mail address stored in the storage means (151).
37, 153), and the reception rejection notifying means (13
5) transmitting a rejection message including the history stored in the rejection history storage means (137, 153) to the sender of the e-mail whose reception has been rejected in association with the source e-mail address of the e-mail. The electronic mail monitoring device (10) according to [1] or [2],
0).

[4] Opening confirmation storage means (137, 15)
(4) the reception rejection notifying means (135)
Sends a reception rejection message set to return an opening confirmation message for confirming that the other party has received and opened the transmitted message, and the opening confirmation storage means (137, 154) The electronic mail monitoring device (100) according to any one of [1] to [3], wherein the returned opening confirmation message is stored and held.

[5] Inspection means (133) for inspecting whether or not there is a predetermined inconvenient event in the e-mail which the reception refusal means (132) did not reject, and said inspection means (133) A second reception rejecting unit (134) for rejecting reception of the e-mail having detected the inconvenient event, and when the inspection unit (133) detects the inconvenient event from the e-mail, the e-mail is sent to a destination of the e-mail. A query means (136) for inquiring whether or not to refuse to receive a message indicating that the inconvenient event has been detected and an e-mail having the same source mail address thereafter, and a response to the inquiry Registration means (137) for registering the source mail address of the e-mail in the storage means (151) when rejecting reception; Characterized by further comprising a preparative [1] electronic mail monitoring device according to any one of - [4] (100).

[6] In an electronic mail monitoring device (100) for ensuring the security of transmitted and received electronic mail,
Storage means (151) for storing a source mail address of an e-mail to be rejected, and collation for collating whether the source e-mail address of the received e-mail is stored in the storage means (151) Means (131) and when the result of the collation by the collation means (131) indicates that the source mail address of the e-mail is stored in the storage means (151), the reception of the e-mail is determined. Rejection means (132) for rejecting, and inspection means (13) for inspecting whether there is a predetermined inconvenient event in the e-mail for which the reception rejection means (132) did not reject the reception.
3), a second reception rejecting unit (134) for rejecting reception of the electronic mail in which the inspection unit (133) has detected the inconvenient event, and the inspection unit (133) detecting the inconvenient event from the electronic mail. Then, the inquiry means (136) inquires the destination of the electronic mail as to whether or not to reject reception of the message indicating that the inconvenient event has been detected from the electronic mail and the electronic mail having the same source mail address thereafter. ) And registration means (137) for registering the source mail address of the e-mail in the storage means (151) when the answer to the inquiry refuses to receive the e-mail. An e-mail monitoring device (100).

[7] A combination of the source mail address of the electronic mail and the destination mail address is stored in place of the source mail address of the electronic mail whose reception is to be refused, and the reception of the electronic mail is performed for each combination. The e-mail monitoring device (100) according to any one of [1] to [6], which manages refusal.

[8] Outgoing mail checking means (141)
Reply determination means (142) and inconvenience notification means (143)
The transmitted mail inspection means (141).
Is for checking whether or not a predetermined inconvenient event exists in the e-mail requested to be transmitted. The reply determination means (142) determines whether or not the e-mail is a reply e-mail. And the inconvenience notification means (14
3) When the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, a message to the effect that the inconvenient event is detected from the e-mail is sent to the destination of the e-mail. [1] to [7] characterized by being transmitted instead of e-mail
The electronic mail monitoring device (100) according to any one of the above.

[9] In the electronic mail monitoring device (100) for ensuring the security of the transmitted and received electronic mail, the transmitted mail inspection means (141) and the reply judgment means (142)
And an inconvenience notifying means (143). The outgoing e-mail checking means (141) checks whether or not a predetermined inconvenient event exists in the e-mail requested to be sent. (142) is for judging whether the e-mail is a reply e-mail or not, and the inconvenience notifying means (143) detects the inconvenience event from the e-mail and returns the e-mail to the reply e-mail. An e-mail monitoring device (100), wherein, when the e-mail is a mail, a message to the effect that the inconvenient event has been detected is sent from the e-mail to the destination of the e-mail instead of the e-mail.

[10] The inconvenience notifying means (143)
When the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, transmitting a message to the sender of the e-mail that the inconvenient event is detected from the e-mail E-mail monitoring device (1) according to [8] or [9],
00).

[11] The electronic mail monitoring device (100) according to any one of [1] to [10], wherein the inconvenient event is a computer virus.

[12] Change the computer from [1] to [1]
A program for functioning as the electronic mail monitoring device (100) according to any one of [1] and [2].

[13] Change the computer from [1] to [1]
A computer-readable recording medium storing a program for causing the electronic mail monitoring device to function as the electronic mail monitoring device according to any one of [1] to [10].

[14] In an electronic mail monitoring method for ensuring the security of an electronic mail to be transmitted and received, the collating means (130) determines that the source mail address of the received electronic mail is the same as that of the electronic mail to be rejected. A step of collating whether or not the received e-mail is stored in the storage means (151) storing the source e-mail address; When the result of the comparison indicates that the electronic mail is stored in the storage means (151), a step of rejecting the reception of the electronic mail;
5) transmitting a reception refusal message indicating that the reception of the e-mail is rejected to the transmission source of the e-mail whose reception was rejected.

[15] Rejection count storage means (137, 15)
2) further comprising the step of accumulatively adding the number of rejections for which reception has been rejected for each source mail address of the e-mail for which reception has been rejected and storing the number, and transmitting the rejected e-mail to the reception rejection message. The electronic mail monitoring method according to [14], further including a rejection count stored in association with the original mail address.

[16] Rejection history storage means (137, 15)
3) keeps a history of emails that have been rejected
Storing, for each of the source email addresses of the e-mails whose reception has been rejected, the reception rejection message including the history stored in association with the source e-mail address of the e-mail whose reception has been rejected. The e-mail monitoring method according to [14] or [15], wherein:

[17] Opening confirmation means (137, 154)
Has a step of storing and holding the returned open confirmation message, and in the step of transmitting the reception refusal message, the reception refusal notifying means (135)
Transmits a reception rejection message set to return an opening confirmation message for confirming that the other party has received and opened the transmitted message, [14] to [16]. E-mail monitoring method according to any of the above.

[18] The checking means (133) checks whether there is a predetermined inconvenient event in the e-mail which has not been refused to receive based on the result of the collation, and the second receiving refusing means ( 134) rejecting the reception of the e-mail in which the inconvenient event is detected by the inspection; and when the inquiry means (136) detects the inconvenient event in the inspection, the e-mail is sent to the destination of the e-mail. Inquiring whether or not to reject a message indicating that the inconvenient event has been detected and an e-mail having the same source mail address thereafter, and the registration means (137) determines whether the answer to the inquiry is When the reception of the e-mail is refused, the source mail address of the e-mail is registered in the storage means (151). Email monitoring method according to any one of [14] to [17], characterized by further comprising the step of.

[19] In the electronic mail monitoring method for ensuring the security of the transmitted and received electronic mail, the collating means (130) determines that the source mail address of the received electronic mail is the same as that of the electronic mail to be rejected. A step of collating whether or not the received e-mail is stored in the storage means (151) storing the source e-mail address; A step of rejecting the reception of the e-mail when the result of the comparison indicates that the electronic mail is stored in the storage means (151); and a step of rejecting the reception based on the result of the comparison by the inspection means (133). Checking whether or not the undelivered e-mail has a predetermined inconvenient event; and the second reception refusal means (134) detects the inconvenient event by the inspection. Refusing to receive the received e-mail, and inquiring means (136) sends a message indicating that the inconvenient event is detected from the e-mail to the destination of the e-mail in which the inconvenient event is detected by the inspection. Thereafter, an inquiry is made as to whether or not to reject the reception of the e-mail having the same source mail address. If the answer to the inquiry indicates that the reception of the e-mail is rejected, Registering a source mail address of the mail in the storage means (151).

[20] A combination of the source mail address of the electronic mail and the destination mail address is stored in place of the source mail address of the electronic mail whose reception is to be rejected, and the reception of the electronic mail is performed for each combination. The e-mail monitoring method according to any one of [14] to [19], wherein rejection is managed.

[21] Outgoing mail inspection means (141)
Checking whether a predetermined inconvenient event exists in the electronic mail requested to be transmitted, and a reply determination unit (1).
42) determining whether the e-mail is a reply e-mail, and the inconvenience notifying means (143) detects the inconvenient event from the e-mail and the e-mail is a reply e-mail. Sending a message to the destination of the electronic mail to the effect that the inconvenient event has been detected from the electronic mail instead of the electronic mail [14] to [2].
0], the electronic mail monitoring method according to any one of the above.

[22] In the electronic mail monitoring method for ensuring the security of transmitted and received electronic mails, the transmitted mail inspection means (141) checks whether or not a predetermined inconvenient event exists in the electronic mail requested to be transmitted. And the reply determining means (142) determines whether the e-mail is a reply e-mail, and the inconvenience notifying means (143) detects the inconvenient event from the e-mail and When the mail is a reply e-mail, transmitting a message indicating that the inconvenient event has been detected from the e-mail to the destination of the e-mail instead of the e-mail. Monitoring method.

[23] When the inconvenient event is detected from the electronic mail requested to be transmitted and the electronic mail is a reply electronic mail,
[21] or [2], further comprising a step of transmitting a message to the sender of the electronic mail to the effect that the inconvenient event has been detected from the electronic mail.
An email monitoring method according to [2].

[24] The electronic mail monitoring method according to any one of [14] to [22], wherein the inconvenient event is a computer virus.

The present invention operates as follows. The storage means (151) of the e-mail monitoring device (100) stores the source mail address of the e-mail to be rejected. The collating means (131) collates whether or not the source mail address of the e-mail arriving through the computer network such as the Internet is stored in the storage means (151). Rejection means (1
32) is a storage unit (1) in which the result of the comparison by the comparison unit (131) is stored in the storage unit (1).
51), the reception of the e-mail is refused. Rejection notification means (135)
Transmits a reception refusal message indicating that the reception is rejected to the transmission source of the e-mail for which the reception refusal means (132) has rejected the reception.

As described above, since the message indicating that the reception is refused is returned to the sender of the electronic mail whose reception has been refused, it is possible to inform the other party who has received the message that the reception has been refused. It is possible to prevent the same party from sending annoying e-mails again.

The rejection count storage means (137, 1
52) accumulatively adds and stores the number of rejections for which the reception refusal means (132) has refused reception for each source mail address of the e-mail for which reception has been rejected. The rejection notifying means (135) sends, to the sender of the e-mail rejected by the rejection means (132), a rejection message including the number of rejections stored in association with the source mail address of the e-mail. Send

As described above, since the message including the number of times of rejection is returned to the sender of the e-mail whose reception has been refused, the receiving side manages the reception status of the e-mail with the other party who has received the message. Tells you that you refused to receive
It is possible to effectively prevent an unwanted e-mail from being sent again from the same party.

In the rejection history storage means (137, 153),
Stores the history of e-mails for which refusal has been received for each source e-mail address, and includes, for the source of e-mails for which refusal has been received, the history including the history stored in association with the source e-mail address of the e-mail Send a reject message. History includes, for example, date received,
The presence / absence of an attached file, the presence / absence of virus detection, and the like.

As described above, detailed information about the e-mail whose rejection has been rejected is left as a history, and a message of rejection including the e-mail is returned. It is possible to recognize that the receiver has evidence of the arrival, and it is possible to hesitate and prevent retransmission again more effectively.

Further, the reception rejection notifying means (135) transmits a reception rejection message set to return an opening confirmation message for confirming that the transmitted message has been received and opened by the other party and opened. The confirmation storage means (137, 154) stores and returns the returned opening confirmation message. As a result, the e-mail received after the confirmation of the opening is intentional (intentional, malicious) of the sender
The evidence of that can be accurately suppressed.

The checking means (133) checks whether there is a predetermined inconvenient event in the e-mail for which the checking means (131) did not reject the reception. For example, it is checked whether a virus is contained. The second reception refusal means (134) refuses to receive the e-mail for which the inspection means (133) has detected the inconvenient event.

The inquiry means (136) transmits the message indicating that the inconvenient event is detected from the e-mail to the destination of the e-mail when the inconvenient event is detected by the inspection means (133). Inquires whether to reject the reception of the electronic mail having the original mail address. For example, an inquiry message is transmitted, and an answer is received.

When the answer to the inquiry is to reject the reception of the corresponding e-mail, the registration means (137) registers the source mail address of the e-mail in the storage means (151). As a result,
Receiving e-mail from the earlier source is rejected.

As described above, when an inconvenient event such as a virus is detected from the received e-mail, an inquiry is made to the destination of the e-mail as to whether or not to reject reception of the e-mail from the same transmission source. If you receive an answer to refuse reception, register it and then refuse to receive the corresponding e-mail, so senders who have sent e-mails containing inconveniences such as viruses even once have been sent After that, the reception of the e-mail can be appropriately rejected, and only the highly secure e-mail can be received.

Note that, in place of the source mail address of the e-mail to be rejected, a combination of the source e-mail address of the e-mail and the destination mail address is stored, and the rejection of the e-mail is rejected for each combination. Configure to manage. In this way, even when the function of the present e-mail monitoring device (100) is incorporated in an e-mail server or e-mail firewall device that manages a plurality of clients, the transmission source that refuses to receive is individually managed for each client. can do.

In the apparatus further provided with an outgoing mail checking means (141), a reply judging means (142), and an inconvenient notifying means (143), the outgoing mail checking means (141) determines whether or not an e-mail requested to be transmitted is sent to the electronic mail. The reply determination means (142) checks whether or not the inconvenience event exists, and determines whether or not the electronic mail is a reply electronic mail. The inconsistency notifying means (143) detects when an inconvenient event is detected from the e-mail and the e-mail is a reply e-mail.
A message to the effect that an inconvenient event has been detected from the electronic mail is sent to the destination of the electronic mail instead of the electronic mail. Further, when the inconvenient event is detected from the reply e-mail, a message to the effect that the inconvenient event is detected from the reply e-mail is transmitted to the sender of the e-mail. As a result, it is possible to automatically notify the other party and the sender of the reply e-mail of the reason why the reply e-mail has not arrived.

[0044]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an embodiment of the present invention will be described.
This will be described with reference to the drawings. FIG. 1 shows a schematic configuration of an e-mail monitoring device 100 according to an embodiment of the present invention and a connection state of the e-mail monitoring device 100. The e-mail monitoring device 100 functions as one of e-mail servers connected to the Internet 201, and also supports protocols such as SMTP (Simple Mail Transfer Protocol) and POP (Post Office Protocol).

A plurality of clients are connected to the e-mail monitoring device 100. In FIG. 1, the second terminal device 181 and the third terminal device 182 are shown as typical examples of the client. Also, a terminal device for transmitting and receiving electronic mail via the Internet 201 and another mail server is connected. In FIG. 1, the first terminal device 210 is shown as a representative.

The e-mail monitoring device 100 includes a communication processing unit 110, a control unit 120, a database 150, and a mailbox 160. The communication processing unit 110 includes the Internet 201 and the second terminal device 181.
This is a part that performs communication control for exchanging e-mails and various messages with a client such as a client. The control unit 120 is a part that executes various processes for fulfilling the function as an e-mail server in addition to the function as the e-mail monitoring device according to the present invention.

The database 150 includes a mail address storage unit 151 for storing a source mail address of an e-mail to be rejected, a rejection count storage unit 152 for storing the number of rejected e-mails, This is a storage device that functions as a rejection history storage unit 153 that stores the history and an opening confirmation storage unit 154 that stores the contents of the opening confirmation message when the reception confirmation message is returned from the transmission destination of the reception rejection message. The mail box 160 is a storage device for temporarily storing e-mail addressed to a client managed by the e-mail monitoring device 100 for each e-mail address. The database 150 and the mailbox 160 are composed of a large-capacity hard disk device or the like. In the present embodiment, an e-mail monitoring device 100 is executed by executing a predetermined program on a general-purpose computer device having a communication function.
As a function.

The control unit 120 includes a received mail processing unit 130
And the function of the transmission mail processing unit 140. The received mail processing unit 130 includes a collation unit 131, a reception rejection unit 132, an inspection unit 133, and a second reception rejection unit 134.
And rejection notifying means 135 and inquiry means 13
6. Each function of the registration control means (registration means) 137 is provided.

The collating means 131 is the Internet 201
The function of checking whether or not the source mail address of the e-mail received via the e-mail is one stored in the mail address storage unit 151 of the database 150 is performed. The reception rejecting unit 132 rejects the reception of the electronic mail when the result of the verification by the verification unit 131 indicates that the source mail address of the previous electronic mail is stored in the mail address storage unit 151. Fulfill. If the reception is refused, the e-mail is not stored in the mailbox 160.

The inspection means 133 is a part for inspecting whether or not there is a predetermined inconvenient event in the electronic mail for which the reception refusal means 132 has not rejected the reception. Here, it is checked whether the e-mail contains a computer virus. If the e-mail has an attached file, the attached file is also checked for viruses. If necessary, unzip the attached file once,
Virus check is performed.

The second reception rejecting means 134 has a function of rejecting the reception of the electronic mail in which the inconvenient event is detected.
The rejection notifying unit 135 has a function of transmitting a predetermined reception rejection message to the transmission source when the reception of the electronic mail is rejected. The reception refusal message is an e-mail including a message indicating that the reception has been rejected, the number of times the reception has been rejected so far, and various kinds of history information when the reception of the e-mail from the transmission source is rejected. Further, the reception refusal message is set so that when the recipient opens the reception rejection message, an open confirmation message is returned to the transmission source of the reception rejection message.

When an inconvenient event is detected from the e-mail by the inspection, the inquiry means 136 sends, to the destination of the e-mail, a message indicating that the inconvenient event is detected from the e-mail and the same source mail address thereafter. This is for inquiring whether or not to reject reception of the e-mail. Specifically, it has a function of transmitting an inquiry message to a destination terminal device and receiving a response message from the terminal device.

The registration control means 137 stores the database 15
This is a part for performing a process of registering various types of information to 0. Specifically, the function of registering the source mail address of the e-mail to be rejected in the e-mail address storage unit 151 and the number of refusal of reception are counted for each source e-mail address and stored in the rejection count storage unit 152. Function, a function of storing the history of the e-mails whose reception has been refused in the rejection history storage unit 153 for each transmission source mail address, and a function of opening the receipt when the receipt confirmation message is returned from the destination to which the reception refusal message was sent. The function of storing the contents of the confirmation message in the opening confirmation storage unit 154 is achieved. That is, the function as the rejection count storage means is performed by the registration control means 137 and the rejection number storage section 152, and the function as the rejection history storage means is performed by the registration control means 137 and the rejection history storage section 153. Is realized by the registration control unit 137 and the opening confirmation storage unit 154.

The outgoing mail processing section 140 fulfills the functions of the outgoing mail checking means 141, the reply judging means 142 and the inconvenience notifying means 143. Among them, the transmission mail inspection means 141 inspects whether or not an inconvenient event such as a virus exists in the electronic mail requested to be transmitted. The reply determination unit 142 is a part that determines whether the requested e-mail is a reply e-mail. The inconvenient notification unit 143 is a function of, when an inconvenient event is detected from the reply e-mail, transmitting a message to the destination of the e-mail to the effect that the inconvenient event is detected from the e-mail reply instead of the previous e-mail. It is the part that fulfills. The inconvenient notification unit 143 has a function of returning a message to the effect that an inconvenient event has been detected to the sender of the reply e-mail.

Next, the flow of sending and receiving electronic mail via the electronic mail monitoring apparatus 100 will be described. FIG. 2 shows a flow of transmission and reception when an inconvenient event such as a virus is detected from the received e-mail, and FIG. 3 shows a flow of transmission and reception when an inconvenient event is detected from the returned e-mail. . 4 and 5 show an outline of a processing procedure when sending and receiving an e-mail via the e-mail monitoring device 100. Here, a case where an electronic mail is exchanged between the first terminal device 210 and the second terminal device 181 will be described as an example.

The first terminal device 210 to the second terminal device 18
When the e-mail is transmitted to the first terminal device 210 via the Internet 201, the e-mail monitoring device 100 transmits the e-mail 30 to the second terminal device 181.
1 (step S401). Email 301
The e-mail monitoring device 100 having received the e-mail checks whether the e-mail 301 contains a computer virus (step S402). At this time, if there is an attached file, the attached file is also checked for viruses. If the attached file is compressed, it is temporarily decompressed to check for viruses.

Although omitted in FIG. 4, the e-mail monitoring device 100 checks whether the source e-mail address of the received e-mail is registered in the e-mail address storage unit 151 before performing a virus check. If the e-mail is registered, the reception of the e-mail is refused.

If no virus is detected by the virus check (step S403: Y), the e-mail monitoring device 100 sends the e-mail 301 to the mailbox 16 associated with the second terminal device 181 of the destination.
0 and save the message that the e-mail has arrived
It sends the notification to the terminal device 181 to notify the incoming call (step S4).
04). The user of the second terminal device 181 operates the second terminal device 181 to access the electronic mail monitoring device 100, and the second terminal device 181 extracts the electronic mail from the first terminal device 210 from the mailbox 160. (Step S405).

On the other hand, if a virus is detected in the e-mail received from the first terminal device 210 (step S403; N), the e-mail monitoring device 100
A message indicating that a virus has been detected from the e-mail addressed to the terminal device 181 (inconvenience notification 302) is returned to the first terminal device 210 (step S412). Further, the e-mail monitoring device 100 sends a message indicating that a virus has been detected in the e-mail from the first terminal device 210 to the second terminal device 181, and sends the first terminal device An inquiry message 303 is sent to inquire whether the reception of the e-mail from the electronic mail 210 will be rejected thereafter (step S413).

The second terminal device 181 receives the inquiry message from the electronic mail monitoring device 100, and the user of the second terminal device 181 knows the arrival of the inquiry message (step S414). The user of the second terminal device 181 determines whether to reject the reception and answers the inquiry. The second terminal device 181 returns an answer message 304 indicating the determination result to the electronic mail monitoring device 100 (Step S415).

If the content of the reply message from the second terminal device 181 indicates that the reception of the e-mail from the previous transmission source is to be rejected thereafter (step S416: Y), the e-mail monitoring device 100 The mail address of the one terminal device 210 (the source mail address of the electronic mail 301) is stored in the mail address storage unit 15 of the database 150.
1 (step S417). Thereafter, when an e-mail addressed to the second terminal device 181 from the first terminal device 210 arrives, the e-mail monitoring device 100 refuses to receive the e-mail based on the result of collating the e-mail address storage unit 151. Will be.

The e-mail monitoring device 100 counts the number of times of arrival (the number of refusals to receive), stores the history of the received e-mail, and sends a reception refusal message together with the number of times and the history to the first terminal device. A reply is sent to 210 (step S417). It should be noted that the reception refusal message incorporates an opening confirmation function. Therefore, when the recipient opens the reception refusal message, an opening confirmation message indicating that the message has been opened is returned from the other party. The e-mail monitoring device 100 stores and saves the contents of the returned opening confirmation message.

If the response to the inquiry message from the second terminal device 181 does not reject the reception (step S416; N), the registration of the source mail address in the mail address storage unit 151 is not performed.

Next, an e-mail 311 from the first terminal device 210 reaches the second terminal device 181, and the second terminal device 1
A case will be described in which the user 81 transmits a reply e-mail 312 to the e-mail. The e-mail monitoring device 100 receives a reply e-mail from the second terminal device 181 addressed to the first terminal device 210 (step S406). E-mail monitoring device 100 receiving this
Is a reply e-mail 312 from the second terminal device 181.
Is performed (step S407).

As a result of this check, if no virus is detected (step S 408: Y), the electronic mail monitoring device 100 sends a message to the effect that the reply electronic mail 312 from the second terminal device 181 has arrived to the first terminal. Device 210
Via the Internet (step S41).
0). The user of the first terminal device 210 is the first terminal device 2
Operate 10 to access the specified e-mail server,
The first terminal device 210 receives the reply e-mail 312 from the second terminal device 181 (step S411).

On the other hand, if a virus is detected from the reply e-mail 312 (step S408; N), the e-mail monitoring device 100 detects a virus in the reply e-mail 312 addressed to the first terminal device 210. The message (inconvenient occurrence notification 313) indicating that the
81 is returned (step S409). A message indicating that a virus has been detected in the reply e-mail 312 addressed to the first terminal device 210 (inconvenience occurrence notification 314)
May be transmitted to the first terminal device 210.

Next, reception processing and transmission processing performed by the electronic mail monitoring apparatus 100 to perform the above-described electronic mail monitoring function will be described. FIG. 6 shows the flow of the receiving process performed by the electronic mail monitoring device 100. When the e-mail arrives (step S601: Y), the received e-mail processing unit 130 of the e-mail monitoring device 100 checks the destination, and if the e-mail is not addressed to the client managed by the own device (step S602; N), the transfer destination The e-mail server is checked, and the e-mail is transferred to the corresponding e-mail server (step S603).

When the received e-mail is addressed to the client managed by the own device (step S602: Y), the combination of the source mail address and the destination mail address of the e-mail is stored in the mail address storage unit 151 of the database 150. It is checked whether or not it is stored (step S604). Then, the combination of the source mail address and the destination mail address of the e-mail received this time is regarded as a combination of rejection of reception and the mail address storage unit 1
51 (step S60).
5: Y), the rejection count storage unit 1 corresponding to this combination
The number of reception rejections stored in 52 is incremented by one, and further, predetermined information relating to the currently received e-mail is added to the history information stored corresponding to the combination and stored (step S606).

Further, a reception rejection message is transmitted to the sender of the e-mail whose reception has been rejected this time (step S607). The e-mail as the reception rejection message includes the number of rejections read from the rejection count storage unit 152 and the corresponding history read from the rejection history storage unit 153. Also, it is set so that an opening confirmation message is returned.

If the combination of the source mail address and the destination mail address of the electronic mail received this time is not stored in the mail address storage unit 151 as a combination of rejection of reception (step S605: N), the electronic mail It is checked whether a virus is contained (step S608). If a virus is not detected by the inspection (step S609; N), the e-mail is stored in the mailbox 160 of the corresponding destination because the e-mail is a secure e-mail and does not need to be rejected. The destination client is notified that the mail has arrived (step S610).

The electronic mail monitoring apparatus 100 has a function of responding to an inquiry from a client as to whether or not an electronic mail is stored in the mailbox of the client, and an electronic mail monitoring apparatus 100 storing the electronic mail stored in the mail box 160. When a request to retrieve mail is received from a client, a function is provided for transmitting the electronic mail stored in the corresponding mailbox 160 to the terminal device of the client.

If a virus is detected in the previous inspection (step S609: Y), it is rejected to the source of the e-mail in which the virus has been detected because the virus has been detected in the e-mail. A message is returned (step S611). Thereafter, an inquiry message for inquiring whether to refuse to receive an e-mail having the same transmission source mail address is sent to the client of the destination of the refused e-mail (step S612).

After that, the electronic mail monitoring apparatus 100 receives a response to the inquiry message from the client (step S613). The received reply message includes a reply as to whether or not to refuse reception, and the source mail address and destination mail address of the e-mail to be refused reception. Included in the inquiry message. If the content of the received reply message refuses subsequent reception (step S614: Y), the combination of the source mail address and the destination mail address included in the reply message is stored in the mail address storage unit. 151 (step S615). If the answer is not to reject the reception (step S614; N),
The registration in the mail address storage unit 151 is not performed.

Note that, if there is a reply to the effect that registration of rejection is registered, the number of rejections of the e-mail whose reception has been rejected this time may be counted and a history may be left.

FIG. 7 shows the flow of the transmission process performed by the electronic mail monitoring apparatus 100. When an e-mail transmission request is received from a client managed by the own device (step S701: Y), it is checked whether the e-mail is a reply e-mail (step S702). If it is not a reply e-mail (step S702; N), the e-mail is transmitted to a designated destination (step S702).
705).

In the case of a reply e-mail (step S
702: Y), it is checked whether or not the e-mail contains a virus (step S703). When no virus is detected (step S704; N), the e-mail is transmitted to a designated destination (step S70).
5).

When a virus is detected (step S70)
4: Y), a message to the effect that a virus has been detected from the reply e-mail is transmitted to the client that transmitted the reply e-mail (step S706). Also, a message to the effect that a virus has been detected from the reply e-mail is sent to the destination of the reply e-mail instead of the e-mail (step S707).

In the embodiment described above, the function as the e-mail monitoring device 100 is incorporated in the e-mail sending / receiving server. For example, the firewall device may have the function as the e-mail monitoring device 100. Good. Further, the function of the e-mail monitoring device 100 may be incorporated into the terminal device of the client, or may be a part of the function of the mailer of the client. The function of the e-mail monitoring device 100 is provided to the client terminal device or its mailer.
When the number of clients managed by 0 is limited to one, the reception rejection is managed based on only the source email address instead of managing the reception rejection based on the combination of the source email address and the destination email address. It may be configured as follows.

That is, the mail address storage unit 151 registers a source mail address to which reception should be refused, and the rejection count storage unit 152 stores the number of reception denials for each source mail address. Further, the rejection history storage unit 15
In the field 3, a history of electronic mails whose reception has been refused is registered for each of the above-mentioned source mail addresses. When the function as an e-mail monitoring device is incorporated in the terminal device of the client, the inquiry message is displayed, for example, by causing another window to appear on the screen,
An inquiry may be made in the form of a pop-up menu to obtain an answer.

In addition to the above, in the embodiment, a function of returning a reception refusal message including the number of refusals and the rejection history to the party who rejected the reception, and a function of detecting the destination when a virus is detected from the received e-mail. Inquires the client whether to refuse to receive further e-mails, and if the answer is refusal to receive e-mails, both e-mail monitoring and the automatic registration function to reject subsequent e-mails from the same sender Although the apparatus 100 is provided, the apparatus 100 may be configured to have only one of the functions.

The present invention relates to the electronic mail monitoring device 10
In addition to the configuration as 0, a program for causing a computer to function as the above-described electronic mail monitoring device or a recording medium on which the program is recorded may be used. The recording medium is a floppy (registered trademark) disk, CD-RO
Any computer-readable one such as M or a magneto-optical disk may be used. In the case of a program, it can be distributed via the Internet.

[0082]

According to the electronic mail monitoring device, the program for causing a computer to function as an electronic mail monitoring device, the computer-readable recording medium storing the program, and the electronic mail monitoring method according to the present invention, reception is refused. A rejection message containing a history of the refusal of reception, the number of rejections, the date and time of rejection, etc. is returned to the sender of the e-mail, and the recipient receives the e-mail. You can manage the reception status of the e-mail and notify that it is rejected, effectively preventing the arrival of unsolicited e-mail from the same person as compared to simply replying to the received e-mail Can be prevented.

Further, in the case where the reception refusal message is provided with a function of returning an open confirmation message and the returned open confirmation message is stored and stored, the e-mail from the sender arrived after the open confirmation is intentional. You can leave evidence to prove that something is there and be prepared in case a dispute arises with the other party.

Further, when an inconvenient event such as a virus is detected from the received e-mail, the destination of the e-mail is inquired as to whether or not to reject reception of the e-mail from the same source. If you receive a refusal response and register it, and subsequently refuse to receive the corresponding e-mail, you can accurately refuse to receive unwanted e-mail from the same person, It is possible to receive only e-mails with high prices. For example,
Even if the received e-mail contains a new type of virus that does not yet have a virus check function, if the e-mail is from a person who has registered refusal to receive in the past virus check, the e-mail Since the reception is rejected, the possibility of receiving an e-mail containing a new type of virus can be reduced.

Further, in the system which manages the rejection of e-mail for each combination of the source mail address of the e-mail to be rejected and the destination e-mail address, an e-mail server or e-mail firewall for managing a plurality of clients It is possible to cope with a case where the function of the present e-mail monitoring device is incorporated in the device.

Further, when an inconvenient event such as a virus is detected from the reply e-mail requested to be sent, the fact that the fact is notified to the destination of the reply e-mail is not as follows. Since the other party is automatically notified, it is possible to eliminate the anxiety of the other party waiting for a reply.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a functional configuration and a connection state of an e-mail monitoring device according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing a flow of transmission and reception of an e-mail and the like when the e-mail monitoring device according to the embodiment of the present invention detects an inconvenient event such as a virus from the e-mail received.

FIG. 3 is an explanatory diagram showing a flow of sending and receiving e-mails and the like when the e-mail monitoring device according to the embodiment of the present invention detects an inconvenient event from a reply e-mail having received a transmission request.

FIG. 4 is a flowchart showing an outline of a processing procedure when sending and receiving an e-mail via the e-mail monitoring device according to the embodiment of the present invention.

FIG. 5 is a flowchart showing an outline of a processing procedure when sending and receiving an e-mail via the e-mail monitoring device according to the embodiment of the present invention.

FIG. 6 is a flowchart showing a receiving process performed by the electronic mail monitoring device according to the embodiment of the present invention.

FIG. 7 is a flowchart showing a transmission process performed by the electronic mail monitoring device according to the embodiment of the present invention.

[Explanation of symbols]

 Reference Signs List 100 e-mail monitoring device 110 communication processing unit 120 control unit 130 received mail processing unit 131 collation unit 132 reception rejection unit 133 inspection unit 134 second reception rejection unit 135 reception rejection notification unit 136 inquiry Means 137 Registration control means 140 Sent mail processing part 141 Sent mail inspection means 142 Reply determination means 143 Inconvenience notification means 150 Database 115 Mail address storage part 152 Rejection count storage part 153 Rejection history storage part 154 ... opening confirmation storage unit 160 ... mail box 181 ... second terminal device 182 ... third terminal device 201 ... internet 210 ... first terminal device 301,311 ... e-mail 302 ... inconvenience occurrence notification 303 ... inquiry message 304 ... answer message 312 … For reply E-mail 313, 314 ... inconvenience occurrence notification

Claims (24)

[Claims] 1. An electronic mail monitoring device for securing the security of an electronic mail to be transmitted and received, a storage means for storing an electronic mail address of an electronic mail to be refused to receive, and an electronic mail of the received electronic mail. A matching unit that checks whether or not the address is stored in the storage unit; and a result of the comparison by the matching unit that the source mail address of the e-mail is stored in the storage unit. When receiving the e-mail, the reception rejection means, and a reception rejection notifying means for transmitting a reception rejection message indicating that the reception of the e-mail is rejected to the sender of the e-mail rejected reception An e-mail monitoring device comprising: 2. A rejection count storage means for accumulating and storing the number of rejections for which reception has been refused for each source mail address of an e-mail for which reception has been rejected. 2. A rejection message including a rejection count stored in the rejection count storage unit in association with a source email address of the rejected email, to a sender of the rejected email. An e-mail monitoring device according to claim 1. 3. A rejection history storage means for storing a history of e-mails rejected for each source mail address stored in the storage means, wherein the rejection notifying means rejects the reception. 3. A transmission rejection message including a history stored in the rejection history storage means in association with the transmission source mail address of the e-mail to the transmission source of the e-mail. Email monitoring device as described. 4. An apparatus according to claim 1, further comprising an opening confirmation storage unit, wherein said reception rejection notifying unit is set so that an opening confirmation message for confirming that the other party has received and opened the transmitted message is returned. A reception refusal message is transmitted, and said opening confirmation storage means stores and holds the returned opening confirmation message.
3. The e-mail monitoring device according to claim 3. 5. Inspection means for inspecting whether there is a predetermined inconvenient event in the e-mail which the reception refusal means did not reject, and receiving the e-mail in which the inspection means detected the inconvenient event. A second reception rejecting unit for rejecting, when the inspection unit detects the inconvenient event from the e-mail, a message indicating that the inconvenient event is detected from the e-mail to the destination of the e-mail; Inquiring means for inquiring whether to reject the reception of the e-mail having the transmission source mail address, and when the answer to the inquiry indicates that the reception of the e-mail is denied, storing the transmission source mail address of the e-mail. 5. The e-mail monitoring device according to claim 1, further comprising a registration unit for registering in the unit. 6. An e-mail monitoring device for securing the security of transmitted / received e-mails, a storage means for storing a source e-mail address of an e-mail to be rejected, a source e-mail of the received e-mail A matching unit that checks whether or not the address is stored in the storage unit; and a result of the comparison by the matching unit that the source mail address of the e-mail is stored in the storage unit. When the reception rejecting unit rejects reception of the e-mail, an inspection unit that checks whether there is a predetermined inconvenient event in the e-mail that the reception rejection unit did not reject, and the inspection unit is A second reception rejecting unit for rejecting reception of the e-mail having detected the inconvenient event, and when the inspection unit detects the inconvenient event from the e-mail, Inquiring means for inquiring as to whether or not to refuse to receive a message indicating that the inconvenient event has been detected from the e-mail to the destination of the e-mail and an e-mail having the same source mail address thereafter, and a reply to the inquiry Registering means for registering a source mail address of the electronic mail in the storage means when the reception of the electronic mail is rejected. 7. A combination of a source mail address of an electronic mail and a destination mail address of the electronic mail instead of a source mail address of the electronic mail to be rejected, and rejection of the e-mail for each combination is stored. The e-mail monitoring device according to any one of claims 1 to 6, wherein the e-mail monitoring device manages the e-mail. 8. A transmission mail inspection means, a reply determination means,
Further comprising an inconsistency notifying means, wherein the outgoing e-mail checking means checks whether or not a predetermined inconvenient event exists in the e-mail requested to be transmitted, and wherein the reply determining means returns the e-mail The inconvenience notifying means, when the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, sends the e-mail to the destination of the e-mail. The electronic mail monitoring device according to any one of claims 1 to 7, wherein a message to the effect that the inconvenient event is detected from the mail is transmitted instead of the electronic mail. 9. An e-mail monitoring device for ensuring the security of transmitted / received e-mails, comprising: an outgoing mail inspection unit; a reply determination unit; and an inconvenience notification unit. To check whether there is a predetermined inconvenient event in the e-mail, wherein the reply determination means is to determine whether the e-mail is a reply e-mail, the inconvenience notification means, When the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, a message indicating that the inconvenient event is detected from the e-mail to the destination of the e-mail is replaced with the e-mail. An e-mail monitoring device for transmitting. 10. The inconvenient notification means, when the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, the inconvenient event is detected from the e-mail to a sender of the e-mail. 10. A message to the effect that the message has been transmitted.
An e-mail monitoring device according to claim 1. 11. The electronic mail monitoring device according to claim 1, wherein the inconvenient event is a computer virus. 12. A program for causing a computer to function as the electronic mail monitoring device according to claim 1. 13. A computer-readable recording medium storing a program for causing a computer to function as the electronic mail monitoring device according to claim 1. Description: 14. An e-mail monitoring method for ensuring the security of transmitted / received e-mails, wherein the collating means determines that the source e-mail address of the received e-mail is the source e-mail address of the e-mail to be rejected. Checking whether the received e-mail is stored in the storage unit, and checking whether the received e-mail is stored in the storage unit. Rejecting the reception of the e-mail when the result of the collation indicates that the reception of the e-mail is refused to the transmission source of the e-mail that rejected the reception. Sending a rejection message. 15. The rejection number storage means, further comprising the step of accumulatively adding the number of rejections for which reception has been rejected for each source mail address of the e-mail for which reception has been rejected, and storing the received rejection number. The e-mail monitoring method according to claim 14, further comprising a rejection count stored in association with a transmission source e-mail address of the e-mail that rejected the e-mail. 16. The rejection history storage means further comprises a step of storing a history of the e-mails whose rejection has been rejected for each source mail address of the e-mails whose rejection has been rejected. 16. The apparatus according to claim 14, wherein the history stored in association with a source mail address of the rejected e-mail is included.
Email monitoring method as described in. 17. The receipt confirmation means further comprises a step of storing and holding the returned receipt confirmation message. In the step of sending the reception refusal message, the receipt refusal notifying means sends the transmitted message to the other party. 17. The e-mail monitoring method according to claim 14, wherein a reception rejection message set so that the receipt confirmation message for confirming receipt and opening is returned is transmitted. . 18. A step for inspecting whether or not there is a predetermined inconvenient event in the e-mail which has not been rejected on the basis of the result of the collation. Rejecting the reception of the e-mail having detected the inconvenient event; andinquiring means for detecting that the inconvenient event was detected from the e-mail to the destination of the e-mail when the inconvenient event was detected by the inspection. A step of inquiring whether to refuse to receive an e-mail having the same source mail address as the message and thereafter, and when the registration means responds to the inquiry to refuse to receive the e-mail, Registering a source mail address of the mail in the storage means. E-mail monitoring method according to any one of to 17. 19. An e-mail monitoring method for ensuring the security of transmitted / received e-mails, wherein the collating means sets the source e-mail address of the received e-mail to the source e-mail address of the e-mail to be rejected. Checking whether the received e-mail is stored in the storage unit, and checking whether the received e-mail is stored in the storage unit. When the collation result indicates, the step of rejecting the reception of the e-mail, the inspection means determines whether there is a predetermined inconvenient event in the e-mail that did not reject the reception based on the result of the collation A step of inspecting; a step of rejecting the reception of the electronic mail in which the inconvenient event is detected by the inspection; a step of inquiring means; Whether or not to reject reception of a message indicating that the inconvenient event was detected from the e-mail to the destination of the e-mail in which the inconvenient event was detected by the inspection and an e-mail having the same source mail address thereafter. And when the answer to the inquiry refuses to receive the e-mail, the registration means registers the source mail address of the e-mail in the storage means. Email monitoring method. 20. A combination of a source mail address of the electronic mail and a destination mail address thereof instead of the source mail address of the electronic mail to be rejected, and rejection of the electronic mail for each combination. 20. The electronic mail monitoring method according to claim 14, wherein 21. A transmission mail inspection means for inspecting whether or not a predetermined inconvenient event exists in an electronic mail requested to be transmitted, and a reply determination means for determining whether or not the electronic mail is a reply electronic mail. Determining that the inconvenient event is detected from the e-mail to the destination of the e-mail when the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail. 21. The method according to claim 14, further comprising the step of transmitting a message to the effect that the message has been sent instead of the electronic mail. 22. An e-mail monitoring method for securing the security of e-mails to be transmitted and received, wherein a transmitted e-mail inspection means inspects whether or not a predetermined inconvenient event exists in the e-mail requested to be transmitted. Reply determining means for determining whether the e-mail is a reply e-mail, and inconvenience notifying means, when the inconvenient event is detected from the e-mail and the e-mail is a reply e-mail, Transmitting a message indicating that the inconvenient event is detected from the electronic mail to the destination of the electronic mail instead of the electronic mail. 23. An inconvenience notifying means, when the inconvenient event is detected from the e-mail requested to be transmitted and the e-mail is a reply e-mail, sends the e-mail to the inconvenience from the e-mail. The method according to claim 21 or 22, further comprising transmitting a message indicating that an event has been detected. 24. The electronic mail monitoring method according to claim 14, wherein said inconvenient event is a computer virus.