JP2002314614A - System and method for relaying e-mail - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a means for detecting e-mail, that is transmitted from an evil-minded user and links computer virus, without using a database, etc., for computer virus patterns prepared by an expert. SOLUTION: This system is provided with an e-mail receiving part 101a for receiving e-mail, mail test terminals 1031 to 103n for testing whether or not the received e-mail brings about prescribed abnormal operation in a user terminal 1 for e-mail reception, and a received mail server 101 for test for deciding whether or not to relay the e-mail to the user terminal 1 for e-mail reception in accordance with an abnormal e-mail detection signal transmitted by the mail test terminals 1031 to 103n.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic mail relay system and an electronic mail relay method for avoiding abnormal operation of a computer caused by electronic mail and abnormal operation of an electronic mail system caused by electronic mail.

[0002]

2. Description of the Related Art Electronic mail is relayed through several mail servers. 2. Description of the Related Art E-mail via a network to which a large number of users are connected, such as the Internet, is used conveniently because information can be exchanged among an unspecified number of users. On the other hand, there is a possibility that an e-mail sent from a malicious user may be received.

One type of e-mail sent from a malicious user is an e-mail containing a computer virus. Computer viruses lurking in e-mail can be roughly divided into those that destroy the terminal used for reception or resources on the connected network, and those that perform malicious operations, regardless of the recipient's consciousness, by performing reception operations There are those that newly transmit mail, those that try to leak security information on the terminal used for reception, or the connected network, and the like.

Conventionally, as a system or method for preventing damage caused by an e-mail concealing a computer virus, a mail server or a receiving terminal uses a computer virus countermeasure software and has a known computer virus pattern. The database is compared with the e-mail, and if they match, it is recognized that the e-mail contains a computer virus, and the user is warned not to open the e-mail, or the computer virus is automatically removed. What is known is to take measures such as whether to delete the e-mail or the like.

[0005]

However, in the above-described system or method, the database of computer virus patterns is often created by an expert, and is effective only for known computer viruses. Therefore, there is a problem that unknown computer viruses cannot be prevented, and damage cannot be prevented until a database of unknown computer virus patterns is created by an expert.

Therefore, the present invention has been made in view of the above, and is transmitted from a malicious user and hides a computer virus without using a database of computer virus patterns created by an expert. The purpose of the present invention is to provide a means for detecting an e-mail.

[0007]

SUMMARY OF THE INVENTION An electronic mail relay system and an electronic mail relay method according to the present invention relay an electronic mail to an electronic mail receiving terminal, and open or execute the received electronic mail. Means of execution;
The electronic mail execution means monitors whether a predetermined abnormal operation occurs, and only when the predetermined abnormal operation does not occur in the electronic mail execution means, relays the electronic mail to an electronic mail receiving terminal. Mail relay means.

According to the electronic mail relay system and the electronic mail relay method of the present invention, the electronic mail relay means
It monitors whether or not a predetermined abnormal operation occurs in the e-mail execution unit by opening or executing the received e-mail, and relays the e-mail only when the predetermined abnormal operation does not occur in the e-mail execution unit. Therefore, even if a database of computer virus patterns has not been created, it is possible to determine beforehand whether or not the received e-mail is an e-mail containing a computer virus, and the damage caused by the e-mail can be determined. Can be prevented.

In the above-described electronic mail relay system and electronic mail relay method, a plurality of electronic mail executing means are provided, and operate based on different environment settings for opening or executing a received electronic mail. It is preferable that the mail relay unit relays the electronic mail to the electronic mail receiving terminal only when the predetermined abnormal operation does not occur in all of the plurality of electronic mail execution units.

In this case, the received e-mail is opened or executed by a plurality of e-mail executing means operating based on different environment settings, and the e-mail relay means sets a predetermined abnormality in all of the plurality of e-mail executing means. Since the e-mail is relayed only when no operation occurs, it is possible to prevent damage caused by an e-mail including a computer virus that causes an abnormal operation of the e-mail receiving terminal only in a specific environment setting.

In the electronic mail relay system and the electronic mail relay method according to the above-mentioned invention, when the electronic mail relay means does not relay the electronic mail to the electronic mail receiving terminal, it is preferable to transmit a warning mail indicating the fact.

In this case, the original recipient or administrator, who is the destination of the e-mail, receives the e-mail containing the above-mentioned computer virus by the e-mail relay system by the warning mail transmitted by the e-mail relay unit. However, it is possible to recognize that it was not relayed.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS (Configuration of Electronic Mail Relay System) An embodiment of the present invention will be described with reference to FIG. FIG. 1 is a schematic configuration diagram showing an electronic mail network system including an electronic mail relay system 1 according to the present embodiment.

As shown in FIG. 1, an electronic mail relay system 1 according to this embodiment is connected to another mail server 2 connected to the Internet 3 and a user mail system 5 via a router 4. This is a means for detecting an e-mail transmitted from a malicious user and hiding a computer virus without using a computer virus pattern database created by an expert.

The electronic mail relay system 1 includes a test reception mail server 101 and a test transmission mail server 102.
And a mail test terminal group 103 including a plurality of mail test terminals 1031 to 103n.

The test reception mail server 101 is connected to the router 4, the test transmission mail server 102, and the mail test terminal group 103, and transmits an e-mail transmitted from another mail server 2 via the router 4. In response to an abnormal e-mail detection signal that indicates whether or not a predetermined abnormal operation has occurred in the e-mail test terminal group 103 or the test transmission e-mail server 102, the e-mail is sent to the user mail via the router 4. This is an electronic mail relay unit that relays to the system 5 or discards it. The test receiving mail server 101, specifically, as shown in FIG.
E-mail receiving unit 101a and E-mail storage unit 101
b, a reception notification signal transmission unit 101c, an e-mail transmission unit 101d, and an abnormal e-mail detection signal reception unit 101e.
And an e-mail transfer unit 101f.

The e-mail receiving section 101a is connected to the reception notification signal transmitting section 101b and the e-mail storage section 101c, and receives an e-mail transmitted from another mail server 2. E-mail receiving unit 101a
Is sent from another mail server 2 to the SMTP (Si
Mple Mail Transport Proto
col) is received.

The e-mail storage unit 101b is connected to the e-mail reception unit 101a, the e-mail transmission unit 101d, and the e-mail transfer unit 101f, and stores the e-mail received by the e-mail reception unit 101a into an attached file. In addition, it is temporarily stored. The e-mail storage unit 101b includes an auxiliary storage device such as an HDD.

The reception notification signal transmission unit 101c is connected to the e-mail reception unit 101a, and notifies that the e-mail received by the e-mail reception unit 101a is temporarily stored in the e-mail storage unit 101b. A reception notification signal is created and transmitted to the mail test terminal group 103. When there are a plurality of mail test terminals, the reception notification signal transmission unit 101c transmits a reception notification signal to all the mail test terminals.

The e-mail transmission unit 101d is connected to the e-mail storage unit 101b,
In response to an e-mail transmission request from 31 to 103n,
The e-mail stored in the e-mail storage unit 101b is transmitted to the mail test terminal groups 1031 to 103n. The e-mail transmission unit 101d, for example,
POP3 (Post Office Protocol)
version 3) or IMAP4 (Intern
et Messaging Access Proto
The e-mail is transmitted according to col version 4).

Abnormal e-mail detection signal receiving section 101e
Is connected to the e-mail transfer unit 101f, and transmits the test transmission mail server 102 or the mail test terminal 1031
Receiving the abnormal e-mail detection signal transmitted from each of the e-mails 103 to 103n, and determining whether or not to relay the e-mail to the user mail system 5 according to the received abnormal e-mail detection signal. Transfer unit 101f
To inform. Specifically, the abnormal e-mail detection signal receiving unit 101e sets an abnormality detection flag that is set to “1” in the received abnormal e-mail detection signal when detecting that an abnormal operation has occurred due to the corresponding e-mail. When “0” is set, it is determined that the corresponding e-mail should be relayed to the user mail system 5 via the e-mail transfer unit 101f, and the abnormality detection flag is set to “1”. In such a case, it is determined that the corresponding e-mail should be discarded.

Abnormal e-mail detection signal receiving section 101e
When the reception notification signal is transmitted to a plurality of mail test terminals, the above determination is made after receiving the same number of abnormal e-mail detection signals as the number of transmitted reception notification signals. In this case, when the abnormality detection flags of all the abnormal e-mail detection signals are set to “0”, the abnormal e-mail detection signal receiving unit 101e transmits the corresponding e-mail to the user via the e-mail transfer unit 101f. It is determined that the message should be relayed to the mail system 5, and otherwise, it is determined that the corresponding e-mail should be discarded.

The e-mail transfer unit 101f includes an e-mail storage unit 101b and an abnormal e-mail detection signal reception unit 101
e, and relays the corresponding e-mail to the user mail system 5 according to the determination result notified by the abnormal e-mail detection signal receiving unit 101e,
Or, it is to be destroyed. That is, the e-mail transfer unit 101f relays the corresponding e-mail to the user mail system 5 when the abnormality detection flags of all the abnormal e-mail detection signals are set to “0”, and otherwise, Is to discard the corresponding e-mail. The e-mail transfer unit 101f transmits an e-mail to the user mail system 5, for example, in accordance with SMTP.

When the e-mail is discarded as described above, the e-mail transfer unit 101f can transmit a warning mail to that effect to a preset e-mail administrator. Further, the e-mail transfer unit 101f extracts destination information (for example, an e-mail address) from the e-mail received by the e-mail receiving unit 101a, and sends the warning mail to the user of the user terminal 5021 related to the destination information. Can also be sent.

The mail test terminals 1031 to 103n are:
It is connected to the router 4, the test receiving mail server 101, and the test sending mail server 102, and is stored in the test receiving mail server 101 according to the reception notification signal transmitted from the test receiving mail server 101. An e-mail executing means for receiving an e-mail, opening the received e-mail, and executing the attached file.
Further, the mail test terminals 1031 to 103n create an abnormal electronic mail detection signal according to the above-described monitoring result, and transmit the signal to the test reception mail server 101. When there are a plurality of mail test terminals 1021 to 103n, each of the mail test terminals 1021 to 103n operates based on different environment settings for opening or executing an e-mail, for example, different operating systems, It is configured to operate with a mail client program (mailer). Here, the predetermined abnormal operation includes a file destruction operation of a rewriting operation of an operating system, a rewriting operation of a file not related to transmission / reception of e-mail, and a waste of memory.

The mail test terminal 1031 is, specifically,
As shown in FIG. 3, an e-mail receiving unit 1031a, an e-mail opening unit 1031b, an attached file execution unit 1031
c, monitoring unit 1031d, e-mail transmission unit 1031e,
It is composed of an abnormal e-mail detection signal transmission section 1031f and a reception notification signal reception section 1031g.

The reception notification signal receiving unit 1031g is connected to the electronic mail reception unit 1031a, and receives the reception notification signal transmitted by the test reception mail server.

The e-mail receiving section 1031a is connected to the e-mail opening section 1031b, the attached file execution section 1031c, and the reception notification signal receiving section 1031g.
It receives the e-mail from 01. The e-mail receiving unit 1031a is, for example, POP3 or IMAP.
4 to receive an e-mail.

The e-mail opening section 1031b is connected to the e-mail receiving section 1031a and the monitoring section 1031d, and opens the e-mail received by the e-mail receiving section 1031a. E-mail receiving unit 10
31a and the e-mail opening unit 1031b are configured using a mail client program. The attached file execution unit 1301c is connected to the e-mail receiving unit 1031a and the monitoring unit 1031d. If the e-mail received by the e-mail receiving unit 1031a has an attached file, the attached file is executed using the corresponding application program. The attachment is automatically executed.

The monitoring unit 1031d is the electronic mail opening unit 1
031b, attached file execution unit 1031c, e-mail transmission unit 1031e, and abnormal e-mail detection signal transmission unit 10
31f, receiving and opening e-mail,
When a predetermined abnormal operation occurs in the mail test terminal 1031 due to the execution of the attached file, the abnormal e-mail detection signal transmitting unit 1031f sets the abnormality detection flag to “1”.
The abnormal e-mail detection signal set in is transmitted. The monitoring unit 1031d stores the initial state of the mail test terminal 1031 and transmits an abnormal e-mail detection signal to the test receiving mail server 101 via the abnormal e-mail detection signal transmission unit 1031f.
The state of 031 is restored to the initial state before the abnormal operation.

The monitoring unit 1031d creates the new e-mail when the reception / opening of the e-mail and execution of the attached file create or transmit a new e-mail, and the e-mail transmission unit 1031e To send to. When the monitoring unit 1031d does not detect a predetermined abnormal operation and an event of creating / transmitting a new e-mail, the monitoring unit 1031d generates an abnormal e-mail detection signal in which the abnormality detection flag is set to “0”, and detects the abnormal e-mail. The signal is transmitted to the signal transmission unit 1031f.

The e-mail transmitting unit 1031e is connected to the monitoring unit 1
031d, and transmits the above-described new e-mail created by the monitoring unit 1031d to the test transmission mail server 102. Email receiver 1
02a is for transmitting an e-mail according to the SMTP, for example. Abnormal e-mail detection signal transmission unit 103
1f is connected to the monitoring unit 1031d,
The above-described abnormal e-mail detection signal created by the process 031d is transmitted to the test reception mail server 101.

The test sending mail server 102 is connected to the test receiving mail server 101 and the mail test terminal group 103, receives the above-mentioned new e-mail transmitted from the mail test terminal group 103, and In response to the e-mail, an abnormal e-mail detection signal is transmitted to the test reception mail server 101. As shown in FIG. 4, the test transmission mail server 102 includes an e-mail receiving unit 102a, a monitoring unit 102b, and an abnormal e-mail detection signal transmitting unit 102c.

The e-mail receiving unit 102a is connected to the monitoring unit 10
2b, and receives the above-described new electronic mail transmitted by the mail test terminal group 103. The electronic mail receiving unit 102a receives an electronic mail according to, for example, SMTP.

The monitoring unit 102b includes the electronic mail receiving unit 10
2a is connected to the abnormal e-mail detection signal transmitting unit 102c, and it is tested whether the above-mentioned new e-mail received by the e-mail receiving unit 102a is created for a valid reason. If an abnormal operation such as sending a mail is confirmed, the abnormality detection flag is set to “1” in order to transmit the result to the test receiving mail server 101.
Is transmitted to the abnormal e-mail detection signal transmission unit 102c. If no abnormal operation is confirmed, an abnormal e-mail detection signal with the abnormality detection flag set to “1” is transmitted to the abnormal e-mail detection signal transmission unit 102c.

Abnormal e-mail detection signal transmission section 102c
Is connected to the monitoring unit 102b.
Is transmitted to the test receiving mail server 101.

The other mail server 2 connected to the Internet 3 transmits the e-mail transmitted by the user via the router 4 and the e-mail relay system 1
This is for relaying to the user mail server 501. The communication between the mail server 2 and the user mail server 501 is performed according to, for example, SMTP.

The user mail system 5 includes a user mail server 501 and a plurality of user terminals 5021 to 501.
m of user terminals 502. The user mail server 501 is connected to the test receiving mail server 10.
1 is to receive the e-mail transmitted by the user terminal 1 and transmit it to each of the user terminals 5021 to 5021m. Here, the received e-mail is not an e-mail transmitted from a malicious user and containing a computer virus because the e-mail is transmitted through the e-mail relay system 1 described above. User mail server 501 and user terminal group 50
2 is performed according to, for example, POP3 or IMAP4.

(E-mail Relay Method Using E-mail Relay System) An e-mail relay method using the e-mail relay system having the above configuration can be implemented by the following procedure. FIG. 5 and FIG. 6 are diagrams showing an email relay method using the email relay system according to the present embodiment.

As shown in FIGS. 5 and 6, step S1
, The mail server 2 transmits the e-mail transmitted by the user to the test receiving mail server 101 via the Internet 3 and the router 4. Then, the e-mail receiving unit 101a of the test receiving mail server 101 receives the e-mail. Step S2
, The e-mail received by the e-mail reception unit 101a is stored in the e-mail storage unit 101b of the test reception mail server 101.

In step S3, the reception notification signal transmission unit 101c of the test reception mail server 101 transmits a reception notification signal notifying that the electronic mail is temporarily stored to the mail test terminal 1031. Then, the reception notification signal receiving unit 1031g of the mail test terminal 1031
Receives the reception notification signal. When there are a plurality of mail test terminals, the reception notification signal transmission unit 101c of the test reception mail server 101 transmits a reception notification signal to all the mail test terminals. Thereafter, the test receiving mail server 101 is in a state of waiting for an abnormal electronic mail detection signal transmitted from the mail test terminal group 103 or the test transmission mail server 102. When there are a plurality of mail test terminals, this waiting state continues until the test receiving mail server 101 receives the abnormal e-mail detection signal from all the mail test terminals 1031 to 103n.

In step S4, the mail test terminal 1
In response to the reception notification signal received by the reception notification signal receiving unit 1031g, the e-mail receiving unit 1031a of the test mail server 031 converts the corresponding e-mail stored in the e-mail storage unit 101b of the test receiving mail server 101 into a test e-mail. It is received via the e-mail transmission unit 101d of the reception mail server 101.

In step S5, the mail test terminal 1
The e-mail opening unit 1031b of 031 opens the e-mail received by the e-mail receiving unit 1031a.

In the branch 1, the mail test terminal 1031
The attached file execution unit 1031c determines whether there is an attached file in the received e-mail. If there is an attached file, the attached file is executed in step S6. Go to the next step without performing.

In the branch 2, the mail test terminal 1031
The monitoring unit 1031d monitors the occurrence of a predetermined abnormal operation in the mail test terminal 1031 and detects the predetermined abnormal operation.
031, return to the initial state before the abnormal operation, generate an abnormal e-mail detection signal with the abnormality detection flag set to “1”,
In step S8, the abnormal e-mail detection signal is transmitted, and the process proceeds to step S15. Conversely, if no abnormal operation is detected, the process proceeds to the next step.

In branch 3, mail test terminal 1031
Monitoring unit 1031d checks occurrence of an event in which mail test terminal 1031 creates and transmits a new e-mail,
If this event is detected, in step S10, the new e-mail is transmitted to the test transmission mail server 102 via the e-mail transmission unit 1031e, and the e-mail reception unit 102a of the test transmission mail server 102
Receive this e-mail. Then, in step S10, the monitoring unit 102 of the test transmission mail server 102
b, it is checked whether the e-mail is created for a valid reason. If a predetermined abnormal operation such as transmitting a large amount of new e-mails is confirmed in step S11, the abnormality detection flag is set to " An abnormal e-mail detection signal set to "1" is created, and if the predetermined abnormal operation is not confirmed, an abnormal e-mail detection signal with the abnormality detection flag set to "0" is created and an abnormal e-mail detection signal is set. The abnormal e-mail detection signal is transmitted via the e-mail detection signal transmission unit 102c.

In the branch 3, the mail test terminal 1031
If the monitoring unit 1031d does not detect the event that the mail test terminal 1031 creates and transmits a new e-mail, the abnormality detection flag is set to “0” in step S12.
The abnormal e-mail detection signal set in the abnormal e-mail detection signal transmission unit 10 is created in step S13.
This abnormal electronic mail detection signal is transmitted via 31f. Then, the abnormal e-mail detection signal receiving unit 101e of the test reception mail server 101 receives the abnormal e-mail detection signal.

In step S14, the abnormal e-mail detection signal receiving section 101 of the test reception mail server 101
e confirms that the abnormal email detection signal has been received from all the mail test terminals 1031 to 103n, and then checks whether the abnormality detection flags of all the abnormal email detection signals are “0”. I do. If the abnormality detection flags of all the abnormal electronic mail detection signals are “0”, in step S15, the electronic mail transfer unit 101
f relays the corresponding e-mail to the user mail server 501 of the user mail system 5. Conversely, when the abnormality detection flags of all the abnormal electronic mail detection signals are not “0”, the abnormal electronic mail detection signal receiving unit 101e discards the corresponding electronic mail.

In step S16, the user terminal group 5
02 receives the electronic mail stored in the user mail server 501.

(Operation / Effect of Electronic Mail Relay System and Electronic Mail Relay Method) According to the electronic mail relay system and the electronic mail relay method according to the present embodiment, the mail test terminal 1031 opens or executes the received electronic mail. Then, the test receiving mail server 101 monitors whether a predetermined abnormal operation occurs in the mail test terminal group 1031 and relays this e-mail only when the predetermined abnormal operation does not occur. Even if the database of the pattern is not created, it is possible to determine beforehand whether the received e-mail is an e-mail containing a computer virus, and to prevent damage by the e-mail. it can.

The received e-mail is opened or executed by a plurality of mail test terminal groups 103 operating based on different environment settings, and the test reception mail server 10
1 only when a predetermined abnormal operation has not occurred in all of the plurality of mail test terminals 1031 to 103n,
Since the electronic mail is relayed, it is possible to prevent damage caused by an electronic mail including a computer virus that causes an abnormal operation of the electronic mail receiving terminal only in a specific environment setting.

Further, according to the warning mail transmitted from the test receiving mail server 101, the intended recipient or administrator or the like, which is the destination of the e-mail, receives the e-mail including the above-mentioned computer virus by the e-mail relay system. It can be recognized that the broadcast was performed but was not relayed.

[0053]

As described above, according to the present invention, an e-mail transmitted from a malicious user and containing a computer virus lurking without using a database of computer virus patterns created by an expert. Can be provided.

[Brief description of the drawings]

FIG. 1 is a schematic configuration diagram showing an electronic mail network system including an electronic mail relay system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a schematic function of a test receiving mail server according to an embodiment of the present invention.

FIG. 3 is a block diagram showing a schematic function of a mail test terminal according to an embodiment of the present invention.

FIG. 4 is a block diagram showing a schematic function of a test sending mail server according to an embodiment of the present invention.

FIG. 5 is a diagram showing an operation of the electronic mail relay system according to one embodiment of the present invention.

FIG. 6 is a diagram showing an operation of the electronic mail relay system according to one embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... E-mail relay system 2 ... Other mail server 3 ... Internet 4 ... Router 5 ... User mail system 101 ... Test receiving mail server 101a, 102a, 1031a ... E-mail receiving unit 101b ... E-mail storage unit 101c ... Reception notification Signal transmission unit 101d ... E-mail transmission unit 101e ... Abnormal e-mail detection signal reception unit 101f ... E-mail transfer unit 102 ... Test transmission mail server 103 ... E-mail test terminal group 1031 to 103n ... E-mail test terminal 1031b ... E-mail opening unit 1031c: attached file execution unit 102b, 1031d: monitoring unit 102c, 1031f: abnormal e-mail detection signal transmission unit 1031g: reception notification signal reception unit 501: user mail server 502: user terminal group 5021 to 502m: user terminal End

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Katsuhiko Honjo, Inventor 3-19-2 Nishi-Shinjuku, Shinjuku-ku, Tokyo East Japan Nippon Telegraph and Telephone Corporation (72) Inventor Akinori Watanabe 3-19, Nishishinjuku, Shinjuku-ku, Tokyo No.2 East Japan Nippon Telegraph and Telephone Corporation F term (reference) 5K030 GA15 HA06 JA11 LD11

Claims (7)

[Claims] 1. An electronic mail relay system for relaying an electronic mail to an electronic mail receiving terminal, the electronic mail executing means for opening or executing the received electronic mail, and a predetermined abnormal operation occurs in the electronic mail executing means. E-mail relay means for monitoring whether or not the e-mail is executed, and relaying the e-mail to an e-mail receiving terminal only when a predetermined abnormal operation does not occur in the e-mail execution means. Email relay system. 2. The electronic mail executing means, wherein a plurality of the e-mail executing means are provided and operate based on different environment settings for opening or executing a received e-mail. 2. The electronic mail relay system according to claim 1, wherein the electronic mail is relayed to an electronic mail receiving terminal only when a predetermined abnormal operation does not occur in all of the above. 3. The electronic mail relay unit according to claim 1, wherein, when the electronic mail is not relayed to the electronic mail receiving terminal, a warning mail indicating the fact is transmitted.
E-mail relay system according to the above. 4. The electronic mail relay unit according to claim 3, wherein the electronic mail relay unit extracts destination information of the received electronic mail, and transmits the warning mail to an electronic mail receiving terminal associated with the extracted destination information. E-mail relay system. 5. An electronic mail relay method for relaying an electronic mail to an electronic mail receiving terminal, comprising: a first step of opening or executing a received electronic mail by an electronic mail executing means; A second step of monitoring whether or not an abnormal operation of the electronic mail is generated. The electronic mail relaying means sends the electronic mail to the electronic mail receiving terminal only when the predetermined abnormal operation does not occur in the electronic mail execution means. And a third step of relaying. 6. In the first step, a plurality of e-mail executing means are provided and operate based on different environment settings for opening or executing a received e-mail. 6. The electronic mail relay method according to claim 5, wherein the electronic mail is relayed to the electronic mail receiving terminal only when a predetermined abnormal operation does not occur in all of the electronic mail executing means. 7. The method according to claim 5, further comprising the step of transmitting a warning mail indicating that the electronic mail is not relayed to the electronic mail receiving terminal in the third step. Email relay method.