JP2004287790A - Communication adapter and gateway device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To dispense with installation of virus checking software, updating work of a virus definition file, formalities of concluding a contract with a provider on virus checking, etc. for each e-mail terminal, and prevent viral infection to an e-mail terminal or network without troubling a user. <P>SOLUTION: A gateway device 105 is installed between a LAN 103 to which e-mail terminals 102a and 102b are connected, and a WAN 106 to which a mail server 107 is connected. A virus checking is carried out by the gateway device 105 before data from a mail server 107 are transferred to the e-mail terminals 102a and 102b or before data are transmitted from the e-mail terminals 102a and 102b to the mail server 107. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a communication adapter and a gateway device that perform a virus check on an electronic mail.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, a virus check of an e-mail is performed on a client side or a server side.
[0003]
When performing a virus check on the client side, anti-virus software is installed on the e-mail terminal on the client side.
[0004]
Also, when performing a virus check on the server side, if an e-mail for reception is accepted, it is determined whether or not the transfer destination client has a virus check contract based on the e-mail address of the transfer destination, and the contracted If so, the e-mail has been deployed to scan for viruses. When the server finds an e-mail infected with the virus, the server deletes the e-mail and notifies the client accordingly instead.
[0005]
A specific example of such a virus check method is disclosed in Patent Document 1.
[0006]
[Patent Document 1]
JP-A-2002-108778
[0007]
[Problems to be solved by the invention]
However, according to such a conventional technique, the following problems have occurred.
[0008]
That is, when performing a virus check on the client side, for example, when using a plurality of terminals at home, it is necessary to install or update anti-virus software for each terminal, which is troublesome. There was a problem.
[0009]
Further, when performing a virus check on the server side, the virus check is effective only for the recipient who has contracted the virus check with the server, so that there is a problem that it is not perfect as an antivirus measure. In addition, when using a plurality of e-mail addresses at home, it is necessary to make a virus check contract with a provider company for each e-mail address, which is troublesome.
[0010]
Thus, the present invention eliminates the need to install virus check software on individual e-mail terminals, update virus definition files, and perform procedures for contracting a virus check with a provider company, and thus bother the user. It is an object of the present invention to provide a communication adapter and a gateway device for preventing a virus infection to an electronic mail terminal or a network.
[0011]
[Means for Solving the Problems]
The present invention intervenes between the e-mail terminal and the network, performs a virus check on the e-mail before transferring to the e-mail terminal or before sending from the e-mail terminal to the network, It prevents virus infection to the network.
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
Upon receiving an IP packet from the server, the communication adapter according to the first aspect of the present invention checks the source port number set in the TCP header of the IP packet, and determines that the source port number indicates that an e-mail has been received. If so, the IP packet is expanded to perform a virus check, while if the source port number does not indicate reception of an e-mail, control is performed to transfer the IP packet to the e-mail terminal as it is.
[0013]
According to this, a virus check of an email is performed by a communication adapter interposed between a server and an email terminal, so that, for example, a case where a plurality of email terminals are used in a home or a plurality of email addresses are used. Even in this case, since the virus check is performed collectively in the communication adapter, the trouble of installing or updating anti-virus software in a plurality of e-mail terminals can be omitted. Further, it is possible to eliminate the trouble of signing a virus countermeasure with a provider for each of a plurality of e-mail addresses.
[0014]
Also, when performing a virus check on an e-mail with a communication adapter, identifying whether or not it is a received e-mail based on the source port number in the packet frame and performing a virus check enables various types of packets that pass through the communication adapter to be checked. Since it is possible to easily determine a packet to be subjected to a virus check, the virus check can be performed without increasing the load on the communication adapter.
[0015]
When transmitting an IP packet from an e-mail terminal, the communication adapter according to the second aspect of the present invention checks the destination port number set in the TCP header of the IP packet, and the destination port number determines whether the e-mail is transmitted. If so, the IP packet is expanded to perform a virus check, while if the destination port number does not indicate an e-mail transmission, the IP packet is transferred to the network as it is.
[0016]
According to this, a virus check of an email is performed by a communication adapter interposed between a server and an email terminal, so that, for example, a case where a plurality of email terminals are used in a home or a plurality of email addresses are used. Even in this case, since the virus check is performed collectively in the communication adapter, the trouble of installing or updating anti-virus software in a plurality of e-mail terminals can be omitted. Further, it is possible to eliminate the trouble of signing a virus countermeasure with a provider for each of a plurality of e-mail addresses.
[0017]
Also, when performing a virus check on e-mails with the communication adapter, the e-mail is identified based on the destination port number in the packet frame to determine whether it is an e-mail to be sent. Thus, it is possible to easily determine the packet to be subjected to the virus check, so that the virus check can be performed without increasing the load on the communication adapter.
[0018]
A gateway device according to a third aspect of the present invention includes a first interface unit that connects to a first network, a second interface unit that connects to a second network, and a virus check unit that performs a virus check on e-mail. Receiving the IP packet received from the first network from the first interface unit, checking the port number, and if the port number indicates an e-mail service, restoring the e-mail to the e-mail, And returns only the e-mail that is not infected with the virus to an IP packet and sends out the IP packet from the second interface unit onto a second network. Also, the IP packet received from the second network is sent to the second interface unit. And confirm the port number. If the port number indicates an e-mail service, the e-mail is restored to an e-mail and passed to the virus check means, and only e-mails not infected with a virus are returned to an IP packet to be transmitted from the first interface unit to the first network. And control means for sending the information upward.
[0019]
Thus, a virus check is performed in the gateway device connecting the network during the transmission of the e-mail from the first network to the second network, so that the e-mail terminal has a virus check function. The virus check can be performed even if the user does not have the contract and the mail server does not sign a virus check, and the burden on the user can be reduced.
[0020]
Hereinafter, a gateway device according to an embodiment of the present invention will be described with reference to the accompanying drawings.
[0021]
First, a network system to which the gateway device according to the above embodiment is applied will be described. FIG. 1 is a configuration diagram of a network system according to the above embodiment.
[0022]
The network system 100 according to the present embodiment uses Ethernet (R).
[0023]
Specifically, in the network system 100, in the home 101, a plurality of mail terminals (terminals) 102 a and 102 b are connected to a gateway device 105 via a LAN 103 made up of Ethernet (R) and a HUB (switching hub) 104. Have been.
[0024]
The gateway device 105 is connected to a mail server 107 via a WAN 106 that is a wide area Ethernet (R).
[0025]
The terminals 102a and 102b send and receive e-mails to and from the mail server 107 via the gateway device 105. The terminals 102a and 102b also transmit and receive data other than electronic mail to and from the WAN 106 via the gateway device 105.
[0026]
Next, the configurations of the gateway device 105 and the HUB 104 will be described with reference to FIG. FIG. 2 is a configuration diagram of the gateway device 105 and the HUB 104.
[0027]
The HUB 104 is provided with an Ethernet (R) port 201 which is a terminal for connecting cables connected to a plurality of terminals 102 a and 102 b on the LAN 103 side.
[0028]
Further, the HUB 104 is provided with a chip 202 that performs switching processing of the received frame with reference to the MAC address of the frame received via the Ethernet (R) port 201 and outputs a predetermined frame to the gateway device 105. ing. The chip 202 also outputs a predetermined frame to the terminals 102a and 102b via the Ethernet (R) port 201.
[0029]
The gateway device 105 is provided with a CPU (network processor) 203 that controls the entire gateway device 105. The CPU 203 downloads the program to the RAM 204, which is a work memory, and executes the program.
[0030]
Further, the gateway device 105 is provided with an Ethernet (R) I / F 205 that receives a frame sent from the HUB 104 and sends the frame to the CPU 203.
[0031]
Further, the gateway device 105 is provided with an Ethernet (R) port 206 which is a single-port terminal for connecting a cable on the WAN 106 side.
[0032]
In addition, the gateway device 105 is provided with an Ethernet (R) I / F 207 that receives a frame transmitted from the WAN 106 via the Ethernet (R) port 206 and sends the frame to the CPU 203.
[0033]
The gateway device 105 is provided with a Flash ROM 208 in which the CPU 203 stores the virus definition file sent from the WAN 106 side. The CPU 203 downloads the virus definition file stored in the Flash ROM 208 to the RAM 204 as needed and uses it. Further, the virus definition file is automatically updated as needed.
[0034]
Next, a format of a frame of an e-mail sent from the terminal 102 to the gateway device 105 will be described with reference to FIG. FIG. 3 is a diagram illustrating a frame format according to the present embodiment.
[0035]
The e-mail sent from the terminal 102 has been converted into the Ethernet (R) frame format shown in FIG. The Ethernet (R) frame 300 has a data configuration in the order of an Ethernet (R) header 301, an IP packet format 302, and an Ethernet (R) trailer 303. In this example, since Ethernet (R) is used as the LAN 103, an Ethernet (R) header and a trailer are attached. However, in the case of an IP network, only an IP packet is sufficient.
[0036]
The Ethernet (R) header 301 includes a destination MAC address, a source MAC address, and an Ethernet (R) type indicating a protocol following the Ethernet (R) header 301.
[0037]
The Ethernet (R) trailer 303 is an FCS (Frame Check Sequence) for detecting that data has been destroyed due to noise or the like.
[0038]
The IP packet format 302 has an order of an IP header 304, a TCP header 305, and mail data 306.
[0039]
The IP header 304 includes a source IP address, a destination IP address, a protocol type indicating a protocol following the IP header 304, and the like.
[0040]
The TCP header 305 includes a source port number, a destination port number, a sequence number, and the like.
[0041]
The destination port number of the IP packet format 302 is 25 indicating that a service using the SMTP (Simple Mail Transfer Protocol) is requested for transmission of an e-mail to the destination.
[0042]
Next, the structure of a frame of an e-mail sent from the mail server 107 will be described with reference to FIG.
[0043]
In the Ethernet (R) frame 400 sent from the mail server 107, the source port number set in the TCP header 305 of the IP packet format 302 indicates that the source is POP3 (Post) for receiving an e-mail. Office Protocol-Version 3) indicates that a service using the service is requested.
[0044]
Next, a protocol used by the gateway device 105 will be described with reference to FIG. FIG. 5 is a protocol stack diagram of the gateway device 105.
[0045]
The gateway device 105 includes a network access layer protocol 501 corresponding to the network access layer, a network layer protocol 502 corresponding to the network layer, a transport layer protocol 503 corresponding to the transport layer, and an application layer protocol 504 corresponding to the application layer. Communication is performed using
[0046]
The network layer protocol 502 corresponding to the network layer is IP (Internet Protocol) or the like, the transport layer protocol 503 corresponding to the transport layer is TCP (Transmission Control Protocol) or the like, and the application layer protocol 504 corresponding to the application layer. Is POP, SMTP, or the like.
[0047]
Next, an IP packet transmission process of the gateway device 105 will be described with reference to FIG.
[0048]
First, a process in which the gateway device 105 transmits an Ethernet (R) frame received from the terminal 102 to the WAN 106 will be described.
[0049]
The gateway device 105 determines whether or not the destination port number of the Ethernet (R) frame transmitted from the terminal 102 is 25 in the transport layer protocol 503.
[0050]
If the destination port number of the frame sent from the terminal 102 is 25, the gateway device 105 raises the frame up to the application layer protocol 504 because this frame indicates an electronic mail transmitted by the terminal 102 ((1) in the figure). Path), restore the e-mail by expanding the IP packet, and then check for viruses. Thereafter, the gateway device 105 converts the e-mail determined not to be infected as a result of the virus check into an IP packet, further converts the e-mail into an Ethernet (R) frame, lowers the network to the network access layer protocol 501, and transmits the e-mail to the mail server 107. (The route (2) in the figure).
[0051]
When the gateway device 105 finds a virus-infected e-mail, it deletes the e-mail and sends a notification to that effect to the source mail address instead.
[0052]
On the other hand, if the destination port number of the IP packet sent from the terminal 102 is not 25, the gateway device 105 transmits this frame from the transport layer protocol 503 to the network access layer protocol since the frame does not indicate the transmission e-mail. 501, and sends it to the WAN 106 (path (3) in the figure). In other words, if it is not an e-mail, no virus check is performed.
[0053]
Next, a process in which the gateway device 105 transmits a frame received from the WAN 106 to the terminal 102 will be described.
[0054]
The gateway device 105 determines whether or not the source port number of the IP packet transmitted from the WAN 106 is 110 in the transport layer protocol 503.
[0055]
If the source port number of the IP packet sent from the WAN 106 is 110, the gateway device 105 restores the e-mail and performs a virus check because the IP packet indicates the e-mail received by the terminal 102. Up to the application layer protocol 504 (path (1) in FIG. 5), and check the virus when the electronic mail is restored. Thereafter, as a result of the virus check, the gateway device 105 converts the e-mail determined not to be infected into an IP packet, further converts the e-mail into an Ethernet (R) frame to the network access layer protocol 501, and transmits the frame to the terminal 102. (The route (2) in FIG. 5).
[0056]
When the gateway device 105 finds a virus-infected e-mail, it deletes the e-mail and sends a notification to that effect to the destination e-mail address instead.
[0057]
On the other hand, if the destination port number of the IP packet sent from the WAN 106 is not 25, the gateway device 105 transmits the IP packet from the transport layer protocol 503 to the network access layer since the IP packet does not indicate the received e-mail. It is lowered to the protocol 501 and transmitted to the terminal 102 (path (3) in FIG. 5).
[0058]
Next, details of a process in which the gateway device 105 transmits an IP packet received from the terminal 102 to the mail server 107 will be described. FIG. 6 is a flowchart illustrating a process in which the gateway device 105 transmits an IP packet (Ethernet (R) frame) to the mail server 107. FIG. 7A is a diagram for explaining a process when the gateway device 105 receives an electronic mail (Ethernet (R) frame). FIG. 7B is a diagram illustrating a process when the gateway device 105 receives an Ethernet (R) frame other than an electronic mail.
[0059]
First, the gateway device 105 receives the Ethernet (R) frame transmitted from the HUB 104 at the Ethernet (R) I / F 205. The Ethernet (I) I / F 205 sends the received Ethernet (R) frame to the CPU 203.
[0060]
Next, the CPU 203 receives the transmitted Ethernet (R) frame in the network access layer protocol 501 (processing shown in (1) in FIG. 7A), and receives the received Ethernet (R) frame. Confirm that the MAC address described in the Ethernet (R) header is addressed to itself. Then, the CPU 203 discards the Ethernet (R) frame not addressed to itself, removes the Ethernet (R) header from the Ethernet (R) frame addressed to itself, converts the frame into an IP packet, and passes it to the IP layer protocol 502 (FIG. 7 ( (Process shown in (2) of a)) (ST601).
[0061]
Next, in the IP layer protocol 502, the CPU 203 receives the IP packet, removes the IP header from the received IP packet to make a TCP packet, and passes it to the TCP layer protocol 503 (processing (3) in FIG. 7A). ) (ST602).
[0062]
Next, the CPU 203 receives a TCP packet in the TCP layer protocol 503. Next, CPU 203 determines whether the destination port of the TCP header of the received TCP packet is 25 in order to determine whether the received TCP packet is an electronic mail (ST603).
[0063]
If the destination port of the received TCP packet is 25, this indicates that the packet is for electronic mail, and the CPU 203 proceeds to the virus check operation of the received TCP packet.
[0064]
First, the CPU 203 removes the TCP header from the received TCP packet and passes it to the application layer protocol 504 (processing (4) in FIG. 7A) (ST604).
[0065]
Next, the CPU 203 receives the e-mail data (fragment) in the application layer protocol 504. Next, the CPU 203 combines the e-mail data (fragment) transmitted as a packet because the e-mail data (fragment) is transmitted in a plurality of packets separately and cannot be checked for viruses. Revert to original email status.
[0066]
Next, CPU 203 performs a virus check on the combined e-mail and determines whether a virus has been detected (ST605).
[0067]
If the e-mail contains a virus, the CPU 203 deletes the e-mail. Further, the CPU 203 creates a notification mail notifying that the electronic mail has a virus and has been deleted. Then, CPU 203 transfers the data of the notification mail to TCP layer protocol 503 (processing (5) in FIG. 7A) (ST606).
[0068]
Next, the CPU 203 receives the mail data in the TCP layer protocol 503. Then, the CPU 203 divides the received mail data into packets, attaches a TCP header to each of the divided packets, makes them into TCP packets, and passes them to the IP layer protocol 502 so that the received mail data can be transmitted. (Process (6) in FIG. 7A) (ST607).
[0069]
Next, in the IP layer protocol 502, the CPU 203 adds an IP header to the received TCP packet to make it an IP packet and passes it to the network access layer protocol 501 (processing (7) in FIG. 7A) (ST708). ).
[0070]
Next, in the network access layer protocol 501, the CPU 203 generates an Ethernet (R) frame by adding an Ethernet (R) header to the received IP packet, and transmits the frame to the mail server 107 as the destination (FIG. 7). (Process of (8) in (a)) (ST609).
[0071]
Then, the CPU 203 determines whether or not the processing has been performed on all the frames. If the processing has been performed on all the frames, the CPU 203 ends the processing. The process returns to ST601 (ST610).
[0072]
Next, a process when the destination port of the received TCP packet is not 25 in ST603 will be described.
[0073]
If the destination port of the received TCP packet is not 25, this indicates that the packet is not for an e-mail, and the CPU 203 passes the received TCP packet to the IP layer protocol 502 without performing a virus check (FIG. 7 ( (Process of (9) in b)) (ST611).
[0074]
Next, in the IP layer protocol 502, the CPU 203 adds an IP header to the received TCP packet to make it an IP packet, and passes it to the network access layer protocol 501 (processing (10) in FIG. 7B) (ST608). ).
[0075]
Next, in the network access layer protocol 501, the CPU 203 generates an Ethernet (R) frame by adding an Ethernet (R) header to the received IP packet, and sends the frame to the WAN 106 ((FIG. 7B) 11)) (ST609), and the process proceeds to ST610.
[0076]
Next, a process in ST605 when the e-mail has no virus will be described.
[0077]
If no virus is detected from the e-mail, there is no problem even if this e-mail is transmitted, so the CPU 203 passes this e-mail to the TCP layer protocol 503, shifts to the processing of ST607 (ST612), and performs the subsequent processing. do.
[0078]
In this way, the gateway device 105 performs a virus check on the e-mail sent from the terminal 102, deletes the e-mail infected with the virus as necessary, and prevents the virus from being transmitted to the network.
[0079]
Next, a process in which the gateway device 105 transmits the Ethernet (R) frame received from the mail server 107 to the terminal 102 will be described in detail. FIG. 8 is a flowchart showing a process in which the gateway device 105 transmits an Ethernet (R) frame to the terminal 102.
[0080]
First, the gateway device 105 receives the Ethernet (R) frame transmitted from the mail server 107 at the Ethernet (R) I / F 207. The Ethernet (R) I / F 207 sends the received Ethernet (R) frame to the CPU 203.
[0081]
Next, the CPU 203 receives the transmitted Ethernet (R) frame in the network access layer protocol 501 (processing shown in (1) in FIG. 7A), and receives the received Ethernet (R) frame. Confirm that the MAC address described in the Ethernet (R) header is addressed to itself. Then, the CPU 203 discards the frame not addressed to itself, removes the Ethernet (R) header from the frame addressed to itself, converts the frame into an IP packet, and passes it to the IP layer protocol 502 (processing shown in (2) in FIG. 7A). ) (ST801).
[0082]
Next, in the IP layer protocol 502, the CPU 203 receives the IP packet, removes the IP header from the received IP packet to make a TCP packet, and passes it to the TCP layer protocol 503 (processing (3) in FIG. 7A). ) (ST802).
[0083]
Next, the CPU 203 receives a TCP packet in the TCP layer protocol 503. Next, CPU 203 determines whether the source port of the TCP header of the received TCP packet is 110 in order to determine whether the received TCP packet is an electronic mail (ST803).
[0084]
If the source port of the received TCP packet is 110, this indicates that the packet is for electronic mail, and the CPU 203 proceeds to the virus check operation of the received TCP packet.
[0085]
First, the CPU 203 removes the TCP header from the received TCP packet and passes it to the application layer protocol 504 (processing (4) in FIG. 7A) (ST804).
[0086]
Next, the CPU 203 receives the packet in the application layer protocol 504. Next, the CPU 203 combines the e-mail data (fragment) transmitted as a packet and transmits the original e-mail, because the e-mail is sent in a plurality of packets and cannot be checked for viruses. Return to email state.
[0087]
Next, CPU 203 performs a virus check on the combined e-mail and determines whether a virus has been detected (ST805).
[0088]
If the e-mail contains a virus, the CPU 203 deletes the e-mail. Further, the CPU 203 creates a notification mail notifying that the electronic mail has a virus and has been deleted. Then, CPU 203 transfers the data of the notification mail to TCP layer protocol 503 (processing (5) in FIG. 7A) (ST806).
[0089]
Next, the CPU 203 receives the mail data in the TCP layer protocol 503. Then, the CPU 203 divides the received data into packets, attaches a TCP header to each of the divided packets, makes them into TCP packets, and passes them to the IP layer protocol 502 so that the received data can be transmitted (see FIG. 7 (a) (processing of (6)) (ST807).
[0090]
Next, in the IP layer protocol 502, the CPU 203 adds an IP header to the received TCP packet to make it an IP packet, and passes it to the network access layer protocol 501 (processing (7) in FIG. 7A) (ST808). ).
[0091]
Next, in the network access layer protocol 501, the CPU 203 generates an Ethernet (R) frame by adding an Ethernet (R) header to the received IP packet and transmits the frame to the destination terminal 102 (FIG. 7A )) (STEP 809).
[0092]
Then, the CPU 203 determines whether or not the processing has been performed on all the frames. If the processing has been performed on all the frames, the CPU 203 ends the processing. The process returns to ST801 (ST810).
[0093]
Next, processing in ST803 when the source port of the received TCP packet is not 110 will be described.
[0094]
If the source port of the received TCP packet is not 110, it indicates that the packet is not for an e-mail, so that the CPU 203 passes the received TCP packet to the IP layer protocol 502 without performing a virus check (FIG. 7). (Process of (9) in (b)) (ST811).
[0095]
Next, in the IP layer protocol 502, the CPU 203 adds an IP header to the received TCP packet to make it an IP packet, and passes the packet to the network access layer protocol 501 (processing (10) in FIG. 7B) (ST808). ).
[0096]
Next, in the network access layer protocol 501, the CPU 203 generates an Ethernet (R) frame by adding an Ethernet (R) header to the received IP packet and sends it to the terminal 102 (see FIG. 7B). (Process of (11)) (ST809), and the process proceeds to ST810.
[0097]
Next, a process in ST805 when the e-mail has no virus will be described.
[0098]
If there is no virus in the e-mail, there is no problem even if this e-mail is transmitted, so the CPU 203 passes this e-mail to the TCP layer protocol 503, shifts to the processing of ST807 (ST812), and executes the subsequent processing. I do.
[0099]
As described above, in the gateway device 105, the e-mail sent from the mail server 107 is checked for viruses, and if necessary, the e-mail infected with the virus is deleted, thereby preventing the e-mail terminal 102 from being infected with the virus. be able to.
[0100]
As described above, according to the present embodiment, the virus check of the e-mail can be performed by the gateway device 105 which is the communication adapter interposed between the mail server 107 and the terminal 102. Thus, even when a plurality of terminals 102 are used in a home or a plurality of e-mail addresses are used, a virus check can be performed collectively in the gateway device 105 as a communication adapter. As a result, the trouble of installing or updating anti-virus software on the plurality of terminals 102 can be omitted. Further, it is possible to eliminate the trouble of signing a virus countermeasure with a provider for each of a plurality of e-mail addresses.
[0101]
In the above description, the gateway device is described as one of the communication adapters, but may be other than the gateway device. For example, the present invention can be applied to a router or the like. In addition, although the data of the IP packet is identified by the destination port number and the transmission source port number as an electronic mail, other identifiable information may be used.
[0102]
【The invention's effect】
As described above, according to the present invention, installation of virus check software on individual e-mail terminals, update work of virus definition files, and work of contracting a virus check with a provider company, and the like, can be eliminated. It is possible to provide a communication adapter and a gateway device for preventing a virus infection to an e-mail terminal or a network without bothering the user.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a network system according to an embodiment of the present invention;
FIG. 2 is a configuration diagram of a gateway device and a HUB according to the embodiment.
FIG. 3 is a first diagram showing a frame format.
FIG. 4 is a second diagram showing a frame format.
FIG. 5 is a protocol stack diagram of the gateway device according to the embodiment.
FIG. 6 is a flowchart showing a process in which the gateway device according to the embodiment transmits a frame to a mail server.
FIG. 7A is a diagram for explaining processing when the gateway device according to the embodiment receives an e-mail frame;
(B) A diagram for explaining processing when the gateway device according to the above embodiment receives a frame that is not an electronic mail.
FIG. 8 is a flowchart showing a process in which the gateway device according to the embodiment transmits a frame to the terminal.
[Explanation of symbols]
100 network system
102a, 102b terminals
104 HUB
105 Gateway device
107 mail server
203 CPU
204 RAM
205, 207 Ethernet (R) I / F

Claims (3)

When an IP packet is received from the server, the source port number set in the TCP header of the IP packet is checked. If the source port number indicates reception of an e-mail, the IP packet is expanded to check for viruses. A communication adapter that performs control to transfer the IP packet to an electronic mail terminal as it is when the source port number does not indicate reception of an electronic mail. When an IP packet is transmitted from an e-mail terminal, the destination port number set in the TCP header of the IP packet is checked, and if the destination port number indicates transmission of an e-mail, the IP packet is expanded to check for viruses. A communication adapter that controls to transfer the IP packet to the network as it is when the destination port number does not indicate transmission of an e-mail. A first interface unit for connecting to a first network, a second interface unit for connecting to a second network, a virus check unit for checking e-mail for viruses, and an IP packet received from the first network. The port number is checked by taking it in from the first interface unit, and if the port number indicates an e-mail service, it is restored to an e-mail and passed to the virus check means. The second interface unit returns the packet and sends it out onto the second network. The IP packet received from the second network is taken in from the second interface unit and the port number is confirmed. Indicates an email service Control means for restoring the e-mail into an e-mail, passing the e-mail to the virus check means, returning only the e-mail having no virus infection to an IP packet, and sending the e-mail from the first interface unit onto the first network. Gateway device.

Images