JP2006014136A - Electronic mail distribution system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic mail distribution system in which immunity to a new species of and subspecific virus is reinforced. <P>SOLUTION: An electronic mail distribution system comprises a judging means 8 for judging, on the basis of mail attributes of electronic mail, whether or not predetermined computer virus countermeasure processing is required for the electronic mail transferred from a public area mail server 1; and a countermeasure processing means 9 for holding the electronic mail without transferring it to an intra-company mail server 4 for the lapse of a predetermined delay time as predetermined computer virus countermeasure processing if it is judged that the predetermined computer virus countermeasure processing is required and further, transferring the text of the electronic mail to the intra-company mail server 4 before the lapse of the delay time if the electronic mail contains an attached file in addition to the text and it is judged that the predetermined computer virus countermeasure processing is required. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an electronic mail distribution system, and more particularly to an electronic mail distribution system with enhanced resistance to new and sub-type computer viruses.

  As a countermeasure against a computer virus (hereinafter, abbreviated as “virus” as appropriate), a method is generally used in which a virus vaccine file created for each virus is used to detect and eliminate the intrusion. The creation of a virus vaccine file usually takes about 2-3 hours from the discovery of the virus. The same applies to viruses that use electronic mail as a medium. In general, an e-mail distribution system is configured to immediately deliver a received e-mail to a recipient.

  As a method for inspecting a virus using e-mail as a medium, that is, a virus present in an attached file of an e-mail, there is a technique disclosed in Patent Document 1 below. In the conventional virus inspection method, the received electronic mail is transferred to a separately installed virus inspection system, and an unknown virus is inspected from the operation of the macro virus mounted in the attached file.

  In the conventional virus inspection method, a macro virus operating in a specific application can be detected even with an unknown virus, and has a certain effect. However, even if the macro function of the attached file is the original normal usage method, it may be erroneously detected if it performs the same operation as that set for virus detection. In addition, there is a problem that a virus cannot be detected in a file that can be executed independently without using a specific application.

Therefore, for new and subtype viruses, it is preferable to use a virus vaccine file corresponding to the virus.
JP 2003-169096 A

  As described above, in a general electronic mail distribution system, received electronic mail is immediately delivered to a recipient. On the other hand, since it takes a certain amount of time to create virus vaccine files for new and subtype viruses, when new and subspecies viruses occur, anti-virus software manufacturers need to create and distribute virus vaccine files. The virus is unprotected against the virus, and the damage is expanded.

  By the way, in a company or the like that has opened a homepage or the like and widely discloses various e-mail addresses, there is a problem that the e-mail addresses are easily attacked by new and subtype viruses. Therefore, if a large amount of e-mails destined for the e-mail address is not properly processed, there is a risk that virus damage will spread to computer systems in the company.

  The present invention has been made in view of the above-described problems, and an object thereof is to provide an e-mail delivery system with enhanced resistance against new and sub-type computer viruses.

  In order to achieve this object, the first characteristic configuration of the electronic mail delivery system according to the present invention is to determine whether or not a predetermined computer virus countermeasure process is necessary for the electronic mail transferred from the public area mail server. A determination means for determining based on a mail attribute of an e-mail and a predetermined delay time elapses as the predetermined computer virus countermeasure process when it is determined that the predetermined computer virus countermeasure process is necessary. And countermeasure processing means for holding the electronic mail without transferring it.

  In the second feature configuration, in addition to the first feature configuration, the countermeasure processing means determines that the predetermined computer virus countermeasure process is necessary when the electronic mail includes an attached file in addition to the body part. In addition, the entire electronic mail including the attached file is transferred to a predetermined transfer destination after the delay time has elapsed.

  According to the first or second characteristic configuration described above, a predetermined computer virus countermeasure process is performed by the countermeasure processing unit on a certain email selected by the determination unit from among the emails received by the open area mail server. Because a predetermined delay time elapses before the recipient opens the e-mail, it is possible to secure time for preparing an updated virus vaccine for new or sub-type computer viruses. Ensure that virus testing is performed on emails that are likely to contain new or sub-type computer viruses that receive email addresses that are widely open to a large number of individuals in the early stages of the outbreak. it can. As a result, new or sub-type computer viruses can be prevented from entering the in-house computer system. It should be noted that the virus inspection for a new or sub-type computer virus may be performed by countermeasure processing means or a recipient (a recipient who should finally receive an email, regardless of whether the email is received or not). The same can be executed in an in-house mail server for receiving e-mails.

  In particular, according to the second feature configuration described above, when an attached file that is a computer virus medium is included, a predetermined delay time elapses before the recipient opens the entire email including the attached file. It is possible to secure a time for preparing an updated virus vaccine for a computer virus of a subtype and a subspecies, and to achieve the above-described effects. In other words, if there is an attached file in the e-mail, there is a possibility that a new type or a variant of a computer virus may be included. Therefore, the entire e-mail is received for the e-mail with the attached file until a predetermined delay time elapses. For example, by making the recipient unopenable and then transferring it to an in-house mail server, etc. so that the recipient can open it, the recipient can attach a virus-checked attachment to a new or subtype of computer virus. The file can be opened safely.

  For example, when the electronic mail delivery system having the second characteristic configuration has an in-house mail server separately from the public area mail server, an in-house mail server is assumed as a predetermined transfer destination.

  In the third feature configuration, in addition to the second feature configuration, the countermeasure processing means includes a case where the e-mail includes an attached file in addition to a body part and the predetermined computer virus countermeasure process is determined to be necessary. In addition, the body part of the electronic mail is transferred to the predetermined transfer destination before the delay time elapses.

  According to the third feature configuration, an email body portion of only text data not containing a new or sub-type computer virus can be transferred to a predetermined transfer destination such as an in-house mail server without waiting for the delay time to elapse. Since it is transferred and the recipient can open it, the recipient can grasp the outline of the received e-mail for the time being and can avoid delaying the acquisition of the minimum information.

  In the fourth feature configuration, in addition to any one of the feature configurations described above, if the countermeasure processing means determines that the predetermined computer virus countermeasure processing is not necessary, the electronic mail is sent to the delay time. The point is that the data is transferred to a predetermined transfer destination before the elapse.

  According to the fourth feature configuration described above, for e-mails that are not likely to contain new or sub-type computer viruses at the initial stage of their occurrence or are small, without waiting for the delay time to elapse, for example, By transferring to an in-house mail server or the like so that the recipient can open the email, the recipient can open the email at an early stage.

  In the fifth feature configuration, in addition to the first or second feature configuration, when it is determined that the predetermined computer virus countermeasure processing is necessary, the electronic mail is transferred to the countermeasure processing means, In the case where it is determined that the computer virus countermeasure processing is not necessary, there is a distribution means for transferring the electronic mail to a predetermined transfer destination.

  According to the fifth feature configuration, the e-mail delivery system having the first or second feature configuration can be more specifically realized, and the same operation as the e-mail delivery system having the first or second feature configuration can be realized. There is an effect. Further, since the countermeasure processing means receives only the e-mail from the distribution means determined by the determination means that the predetermined computer virus countermeasure processing is necessary, the countermeasure processing means is constituted by another computer independently of the determination means and the distribution means. It becomes possible to do.

  In the sixth feature configuration, in addition to the fifth feature configuration, the distribution means includes the electronic mail including an attached file in addition to the body part, and it is determined that the predetermined computer virus countermeasure processing is necessary. The body part of the electronic mail is transferred to the predetermined transfer destination before the delay time elapses.

  According to the sixth feature configuration, an e-mail body part containing only text data not containing a new or sub-type computer virus can be sent to a predetermined transfer destination such as an in-house mail server without waiting for the delay time to elapse. Since it is transferred and the recipient can open it, the recipient can grasp the outline of the received e-mail for the time being and can avoid delaying the acquisition of the minimum information.

  In the seventh feature configuration, in addition to the fifth or sixth feature configuration, the countermeasure processing means is provided on the Internet, and the received email after the predetermined computer virus countermeasure processing is received. Is transferred to the second public area mail server that is transferred to the predetermined transfer destination without being transferred to the determination means.

  According to the seventh characteristic configuration, since the countermeasure processing means is provided on the Internet, the emails transmitted to the plurality of public area mail servers and determined to require the computer virus countermeasure processing in a batch are collectively collected. Even if each individual e-mail distribution system does not have a countermeasure processing means independently, the same effects as those of the e-mail distribution system having the fifth or sixth characteristic configuration can be obtained. In addition, since the e-mail that has undergone the predetermined computer virus countermeasure processing in the countermeasure processing means is transferred to the second public area mail server, the same processing by the determination means and the countermeasure processing means is repeated many times. The data is transferred to a predetermined transfer destination while avoiding repetition.

  The eighth characteristic configuration is the determination means for determining whether or not a predetermined computer virus countermeasure process is necessary for the email transferred from the public area mail server, based on the email attribute of the email, When the electronic mail includes an attached file other than the body part and it is determined that the predetermined computer virus countermeasure processing is necessary, the predetermined file anti-virus processing is performed with a predetermined delay time. Countermeasure processing means for making the locked state impossible to open until the time has elapsed.

  According to the eighth characteristic configuration described above, as a predetermined computer virus countermeasure process by the countermeasure processing unit for a certain email selected by the determination unit among the emails received by the public domain mail server, Since a predetermined delay time elapses before the recipient can open the attached file of the e-mail, it is possible to secure time for preparing an updated virus vaccine against new or sub-type computer viruses. Ensure that virus testing is performed on emails that are likely to contain new or sub-type computer viruses that receive email addresses that are widely open to a large number of individuals in the early stages of the outbreak. it can. As a result, new or sub-type computer viruses can be prevented from entering the in-house computer system. In addition, the text part of the e-mail containing only text data that does not contain a new or sub-type of computer virus will not be locked even before the delay time has elapsed, so refer to it from the recipient's computer terminal, etc. Thus, since the recipient can be opened, the recipient can grasp the outline of the received e-mail for the time being and can avoid delaying the acquisition of the minimum information.

  An embodiment of an electronic mail delivery system according to the present invention (hereinafter referred to as “the present invention system” as appropriate) will be described with reference to the drawings.

<First Embodiment>
As shown in FIG. 1, the system of the present invention includes a public area mail server 1, a firewall 2, an email processing system 3, and an in-house mail server 4. Further, a LAN 5 and a LAN 6 are respectively provided inside the firewall 2, and the electronic mail processing system 3, the in-house mail server 4, and the in-house computer terminal 7 are respectively connected to the LAN 6 inside the firewall 2. The public area mail server 1, the firewall 2, and the in-house mail server 4 are basically the same as those used in a general conventional electronic mail distribution system.

  The public area mail server 1 is installed in the LAN 5 inside the firewall 2, and receives an electronic mail connected to the Internet and transmitted via the Internet via the firewall 2. The public area mail server 1 transfers the received electronic mail to the electronic mail processing system 3 via the LAN 5, the firewall 2, and the LAN 6. This is the point that the public area mail server 1 in this embodiment is different from the conventional public area mail server. That is, the conventional public area mail server transfers the received electronic mail to the in-house mail server 4.

  The e-mail processing system 3 includes a determination unit 8 that determines whether or not a predetermined computer virus countermeasure process is necessary for an e-mail transferred from the public area mail server 1 based on a mail attribute of the e-mail. Countermeasure processing means 9 for holding the electronic mail until a predetermined delay time elapses and then transferring it to the in-house mail server 4 as predetermined computer virus countermeasure processing when it is determined that predetermined computer virus countermeasure processing is necessary; A mail attribute database 10 in which the relationship between computer virus countermeasure processing and mail attributes is registered is provided.

  The determination unit 8 determines whether or not a computer virus countermeasure process is necessary based on the received mail address of the electronic mail transferred from the public area mail server 1 and the presence / absence of an attached file. In the case of an email without an attached file, it is determined that the computer virus countermeasure processing is not necessary without searching the mail attribute database 10. In the case of an e-mail with an attached file, the mail attribute database 10 is searched based on the received mail address, and it is verified whether the received mail address matches the countermeasure processing address registered in the mail attribute database 10. Then, it is determined whether computer virus countermeasure processing is necessary. It should be noted that one or a plurality of countermeasure processing addresses are registered in advance in the mail attribute database 10, and are separately updated by a system administrator in a timely manner.

  The countermeasure processing means 9 responds to an e-mail with an attached file determined to require computer virus countermeasure processing with a comment such as “Now checking for viruses” in the body part of the e-mail consisting of text data excluding the attached file. It appends to the forefront of the subject of the e-mail and transfers the body part to the in-house mail server 4. Furthermore, the time measurement is started with the reception of the e-mail, and the e-mail is held without being transferred to the in-house mail server 4 until a predetermined delay time elapses. A comment such as “hold” is added to the front of the subject of the e-mail, and the entire e-mail is transferred to the in-house mail server 4 together with the attached file. Further, when an e-mail for which it is determined that the computer virus countermeasure processing is not necessary is received regardless of the presence or absence of an attached file, the e-mail is transferred to the in-house mail server 4 as it is.

  The determination means 8 and the countermeasure processing means 9 are realized as software means by executing a predetermined program on computer hardware constituting the electronic mail processing system 3.

  The in-house mail server 4 includes a mailbox corresponding to a received mail address set in advance for a user in the company (e-mail recipient), and receives an e-mail received from the e-mail processing system 3 with a corresponding received e-mail address. The electronic mail is transmitted to the user who has temporarily stored it in the mail box and accessed from the computer terminal 7. The in-house mail server 4 performs a virus check on the received electronic mail before sending it to the computer terminal 7 to detect and remove the computer virus. In-house users can check the virus-checked e-mail received at their computer terminal 7. Note that e-mail processing in the in-house mail server 4 and the computer terminal 7 is realized using known e-mail software, and thus detailed description thereof is omitted.

  Next, the e-mail delivery processing procedure in the system of the present invention will be described with reference to the flowchart of FIG.

  First, when the public area mail server 1 receives an electronic mail (step # 101), the received electronic mail is transferred to the electronic mail processing system 3 (step # 102). In the electronic mail processing system 3, it is determined whether or not a computer virus countermeasure process is necessary based on the mail attribute of the electronic mail received by the determination means 8 (step # 103). Specifically, as described above, the determination unit 8 determines that the computer virus countermeasure process is not necessary without searching the mail attribute database 10 in the case of an email without an attached file. Further, in the case of an e-mail with an attached file, the determining means 8 searches the mail attribute database 10 based on the received mail address, and the countermeasure processing address registered in the mail attribute database 10 is the received countermeasure address. It is determined whether the computer virus countermeasure processing is necessary or not.

  Next, if it is determined in step # 103 that computer virus countermeasure processing is required, the countermeasure processing means 9 of the e-mail processing system 3 applies the body part made up of text data excluding the attached file of the received e-mail. On the other hand, a comment such as “Virus Checking” added to the front of the subject of the email is transferred to the in-house mail server 4 (step # 104). Subsequently, the in-house mail server 4 stores the transferred e-mail in the corresponding recipient's mailbox (step # 105). When the recipient of the received e-mail accesses the in-house mail server 4 from the computer terminal 7 before the elapse of a delay time described later, the body part of the e-mail stored in the mailbox at the recipient's computer terminal 7 And the computer terminal 7 receives the body part of the electronic mail (step # 106). As a result, even for an electronic mail that requires a computer virus countermeasure process, the recipient can check the body part of the electronic mail transmitted to the receiver without delay.

  The countermeasure processing means 9 of the e-mail processing system 3 starts the process of step # 104 and starts measuring a preset delay time, and the entire e-mail received including the attached file passes the delay time. After the delay time has elapsed, a comment such as “hold time” is added to the forefront of the subject of the e-mail, and the entire e-mail is transferred to the in-house mail server 4 together with the attached file. (Step # 107). Subsequently, the in-house mail server 4 executes the latest virus vaccine file for the transferred e-mail, performs a virus check, and stores the e-mail after execution in the corresponding recipient's mailbox (step). # 108). Here, since the internal mail server 4 receives the e-mail after the public domain mail server 1 receives the e-mail, the in-house mail server 4 receives the e-mail after the delay time elapses. Because there is time to create and distribute virus vaccine files for various viruses, the in-house mail server 4 includes virus attachments using virus vaccine files that are effective against new and subtype viruses. Can be performed on the entire email. Therefore, the above delay time is set in consideration of the time (for example, 2 to 3 hours) required for the creation and distribution of virus vaccine files for new and subtype viruses newly generated by anti-virus software manufacturers. The Subsequently, when the recipient of the received e-mail accesses the in-house mail server 4 from the computer terminal 7, the e-mail stored in the mailbox is transmitted to the recipient's computer terminal 7 together with the attached file, and the computer terminal 7 receives the entire electronic mail (step # 109). As a result, the recipient can safely check the entire e-mail that requires computer anti-virus processing after virus inspection.

  Next, as a result of the determination in step # 103, when the computer virus countermeasure processing is not necessary, the countermeasure processing means 9 of the email processing system 3 transfers the received email as it is to the in-house mail server 4 (step #). 110). The in-house mail server 4 stores the transferred e-mail in the corresponding recipient's mailbox (step # 111). When the recipient of the received electronic mail accesses the in-house mail server 4 from the computer terminal 7, the electronic mail stored in the mailbox is transmitted to the computer terminal 7 of the recipient, and the computer terminal 7 The entire mail is received (step # 112). As a result, for e-mails that do not require computer virus countermeasures, the recipient can check the e-mails sent to him / her, including the attached files, without delay.

  Here, when the recipient receives the email from the in-house mail server 4, before opening the received email at his computer terminal 7, the recipient performs a virus check using the virus vaccine file updated at that time. To do. However, since virus vaccine files against newly generated new and sub-species viruses are not always updated on the computer terminals 7 of individual users in a timely manner, in this embodiment, at least newly generated new species. Virus inspection for viruses and variants is performed on the in-house mail server 4 so that virus inspections for newly generated viruses and variants are performed on all e-mails that are determined to require computer virus countermeasures. The configuration is executable.

Second Embodiment
Next, a second embodiment of the system of the present invention will be described. As shown in FIG. 3, the system of the present invention in the second embodiment includes first and second public area mail servers 11 and 12, a firewall 2, an e-mail processing system 13, countermeasure processing means 14, and an in-house mail server 4. It is comprised with. Further, a LAN 5 and a LAN 6 are respectively provided inside the firewall 2, and the electronic mail processing system 13, the in-house mail server 4, and the in-house computer terminal 7 are respectively connected to the LAN 6 inside the firewall 2. The firewall 2, the in-house mail server 4, the LAN 5, the LAN 6, and the computer terminal 7 are the same as those in the first embodiment, and duplicate descriptions are omitted.

  The difference from the first embodiment is that the first and second public area mail servers 11 and 12 are provided with two types of public area mail servers, the function and configuration of the e-mail processing system 13, and countermeasure processing. The function of the means 14 and the installation location.

  The first public area mail server 11 is installed in the LAN 5 inside the firewall 2, receives an e-mail transmitted via the Internet by connecting to the Internet via the firewall 2, and receives the received e-mail, The data is transferred to the electronic mail processing system 13 via the LAN 5, the firewall 2, and the LAN 6. The second public area mail server 12 is installed in the LAN 5 inside the firewall 2, receives the electronic mail transferred from the countermeasure processing means 14 through the firewall 2, and receives the received electronic mail in the LAN 5, firewall 2 and transfer to the in-house mail server 4 via the LAN 6.

  The electronic mail processing system 13 includes a determination unit 8, a distribution unit 15, and a mail attribute database 10. The determination means 8 determines whether or not a predetermined computer virus countermeasure process is necessary for the electronic mail transferred from the first public area mail server 11 based on the mail attribute of the electronic mail and the mail. The mail attribute database 10 in which attribute relationships are registered is searched and determined. Here, the functions and configurations of the determination unit 8 and the mail attribute database 10 are the same as those in the first embodiment.

  The distribution unit 15 transfers the e-mail to the countermeasure processing unit 14 on the Internet when it is determined that the predetermined computer virus countermeasure process is necessary, and when the predetermined computer virus countermeasure process is not determined to be necessary. The electronic mail is transferred to the in-house mail server 4. Further, the distribution means 15 responds to an e-mail with an attached file determined to require computer virus countermeasure processing with a comment such as “Now checking virus” for the body part of the e-mail consisting of text data excluding the attached file. Is added to the front of the subject of the e-mail and transferred to the in-house mail server 4.

  The countermeasure processing means 14 is installed on the Internet and, as a predetermined computer virus countermeasure process, holds the e-mail transferred from the distribution means 15 until a predetermined delay time elapses, and then the second public area mail server. 12 for transfer. More specifically, the countermeasure processing unit 14 starts timing with the reception of the e-mail and holds the e-mail without being transferred to the in-house mail server 4 until a predetermined delay time elapses. When the delay time elapses, a comment such as “hold time” is added to the front of the subject of the e-mail, and the entire e-mail is transferred to the second public area mail server 12 together with the attached file.

  The determination means 8 and the distribution means 15 are realized as software means by executing a predetermined program on computer hardware constituting the electronic mail processing system 13. The countermeasure processing means 14 is realized as software means by executing a predetermined program on the computer hardware constituting the countermeasure processing means 14.

  Next, an e-mail delivery processing procedure in the second embodiment of the system of the present invention will be described with reference to the flowchart of FIG.

  First, when the first public area mail server 11 receives an email (step # 201), the received email is transferred to the email processing system 13 (step # 202). The electronic mail processing system 13 determines whether or not a computer virus countermeasure process is necessary based on the mail attribute of the electronic mail received by the determination means 8 (step # 203). Specifically, as described above, the determination unit 8 determines that the computer virus countermeasure process is not necessary without searching the mail attribute database 10 in the case of an email without an attached file. Further, in the case of an e-mail with an attached file, the determining means 8 searches the mail attribute database 10 based on the received mail address, and the countermeasure processing address registered in the mail attribute database 10 is the received countermeasure address. It is determined whether the computer virus countermeasure processing is necessary or not.

  Next, if it is determined in step # 203 that computer virus countermeasure processing is necessary, the distribution means 15 of the e-mail processing system 13 applies to the body part consisting of text data excluding the attached file of the received e-mail. Then, a comment such as “Checking for viruses” added to the front of the subject of the e-mail is transferred to the in-house mail server 4 (step # 204). Subsequently, the in-house mail server 4 stores the transferred e-mail in the corresponding recipient's mailbox (step # 205). When the recipient of the received e-mail accesses the in-house mail server 4 from the computer terminal 7 before the elapse of a delay time described later, the body part of the e-mail stored in the mailbox at the recipient's computer terminal 7 And the computer terminal 7 receives the body part of the electronic mail (step # 206). As a result, even for an electronic mail that requires a computer virus countermeasure process, the recipient can check the body part of the electronic mail transmitted to the receiver without delay.

  The distribution unit 15 of the e-mail processing system 13 starts the process of step # 204 and transfers the entire received e-mail including the attached file to the countermeasure processing unit 14 on the Internet (step # 207). When the countermeasure processing means 14 receives the e-mail from the distribution means 15, the countermeasure processing means 14 attaches a time stamp indicating a time after the elapse of a preset delay time from the reception time, and attaches the time stamp until the time stamp time arrives. Keeps the entire received email including the attached attachments. After the elapse of the time stamp time, the countermeasure processing means 14 executes the latest virus vaccine file for the entire e-mail and conducts a virus test, and then adds a comment such as “hold time” to the subject of the e-mail. The entire electronic mail together with the attached file is transferred to the second public area mail server 12 (step # 208). Here, since the countermeasure processing means 14 conducts a virus inspection after the delay time has elapsed since the first public area mail server 11 received the electronic mail, a new anti-virus software manufacturer occurred during that time. Since there is time to create and distribute virus vaccine files for new and subspecies viruses, the countermeasure processing means 14 performs virus inspection using a virus vaccine file effective for new and subspecies viruses. It can be executed on the entire email including the attached file. Therefore, the above delay time is set in consideration of the time (for example, 2 to 3 hours) required for the creation and distribution of virus vaccine files for new and subtype viruses newly generated by anti-virus software manufacturers. The

  Subsequently, the second public area mail server 12 forwards the forwarded email to the in-house mail server 4 (step # 209), and the in-house mail server 4 places the forwarded email in the mailbox of the corresponding recipient. Store (step # 210). Subsequently, when the recipient of the received e-mail accesses the in-house mail server 4 from the computer terminal 7, the e-mail stored in the mailbox is transmitted to the recipient's computer terminal 7 together with the attached file, and the computer terminal 7 receives the entire electronic mail (step # 211). As a result, the recipient can safely check the entire e-mail that requires computer anti-virus processing after virus inspection.

  Next, as a result of the determination in step # 203, when the computer virus countermeasure processing is not necessary, the distribution means 15 of the electronic mail processing system 3 transfers the received electronic mail as it is to the in-house mail server 4 (step # 212). ). The in-house mail server 4 stores the transferred e-mail in the corresponding recipient's mailbox (step # 213). When the recipient of the received electronic mail accesses the in-house mail server 4 from the computer terminal 7, the electronic mail stored in the mailbox is transmitted to the computer terminal 7 of the recipient, and the computer terminal 7 A mail is received (step # 214). As a result, for e-mails that do not require computer virus countermeasures, the recipient can check the e-mails sent to him / her, including the attached files, without delay.

  Here, when the recipient receives the email from the in-house mail server 4, before opening the received email at his computer terminal 7, the recipient performs a virus check using the virus vaccine file updated at that time. To do. However, since virus vaccine files against newly generated new and sub-species viruses are not always updated on the computer terminals 7 of individual users in a timely manner, in this embodiment, at least newly generated new species. By executing the virus inspection for the virus of the virus and the variant by the countermeasure processing means 14, the virus inspection for the newly generated virus of the new species and the variant is performed on all e-mails determined to require the computer virus countermeasure processing. The configuration is executable.

<Third Embodiment>
Next, a third embodiment of the system of the present invention will be described. As shown in FIG. 5, the system of the present invention in the third embodiment includes a public area mail server 21, a firewall 2, and an in-house mail server 22. Further, a LAN 5 and a LAN 6 are respectively provided inside the firewall 2, and the in-house mail server 22 and the in-house computer terminal 7 are respectively connected to the LAN 6 inside the firewall 2. The firewall 2, the LAN 5, the LAN 6, and the computer terminal 7 are the same as those in the first embodiment and the second embodiment, and redundant description is omitted.

  The difference between the first embodiment and the second embodiment is the function of the public area mail server 21 and the function and configuration of the in-house mail server 22.

  The public area mail server 21 is installed in the LAN 5 inside the firewall 2, receives an electronic mail transmitted via the Internet by connecting to the Internet via the firewall 2, and receives the received electronic mail via the LAN 5, The data is transferred to the in-house mail server 22 via the firewall 2 and the LAN 6. In the third embodiment, unlike the first or second embodiment, the received e-mail is transferred to the in-house mail server 22 as in the case of the conventional public area mail server.

  The in-house mail server 22 includes a determination unit 8, a countermeasure processing unit 23, and a mail attribute database 24 in addition to the original in-house mail server function. The determination means 8 determines whether or not a predetermined computer virus countermeasure process is necessary for the electronic mail transferred from the public area mail server 21 based on the mail attribute of the electronic mail. The mail attribute database 24 in which the relationship is registered is searched and determined. Here, the function and configuration of the determination unit 8 are the same as those of the first and second embodiments. In the third embodiment, the mail attribute database 24 is prepared as a table with identification flags when computer virus countermeasure processing is required for each received mail address as shown in FIG. Here, in the table shown in FIG. 6, the presence / absence of an identification flag is set for all of the pre-registered received mail addresses recognized when the in-house mail server 22 stores the transferred email in the mailbox. Has been. In FIG. 6, the identification flag is indicated by a circle for convenience.

  When the received electronic mail determines that the predetermined computer virus countermeasure processing is necessary by the determining means 8, the countermeasure processing unit 23 converts the attached file of the electronic mail into a predetermined delay time as the predetermined computer virus countermeasure processing. It is locked so that the recipient cannot open until it has passed. The lock state is set to be released after the delay time has elapsed for each attached file. Regardless of the determination result of the determination means 8, the body part of the e-mail is not locked, and the recipient can open it at any time.

  The determination means 8 and the countermeasure processing means 23 are realized as software means by executing a predetermined program on computer hardware constituting the in-house mail server 22.

  Next, an e-mail delivery processing procedure in the third embodiment of the system of the present invention will be described with reference to the flowchart of FIG.

  First, when the public area mail server 21 receives an e-mail (step # 301), the received e-mail is transferred to the in-house mail server 22 (step # 302). In-house mail server 22 determines whether computer virus countermeasure processing is necessary or not based on the mail attribute of the email received by determination means 8 (step # 303). Specifically, as described above, the determination unit 8 searches the mail attribute database 24 to determine whether or not an email address of an email received is provided with an identification flag when computer virus countermeasure processing is required. And whether or not the received e-mail is necessary for a computer virus countermeasure process is determined based on the presence or absence of the flag.

  Next, if it is determined in step # 303 that computer virus countermeasure processing is necessary, the countermeasure processing means 23 of the in-house mail server 22 sets a delay time set in advance from the reception time in the attached file of the received email. After the time stamp indicating the time after the lapse is set to the locked state, the time is stored in the corresponding recipient's mailbox (step # 304). The lock state is not released until after the time of the time stamp. If the determination result in step # 303 indicates that no computer virus countermeasure processing is required, the in-house mail server 22 stores the entire received e-mail as it is in the corresponding recipient's mailbox (step # 305). . When the recipient of the received e-mail accesses the internal mail server 22 from the computer terminal 7 and refers to the mailbox, the entire e-mail including the attached file stored in the mailbox is stored in the recipient's computer terminal 7. The computer terminal 7 receives the entire electronic mail (step # 306).

  When the recipient's computer terminal 7 receives an email from the in-house mail server 22, when the email software installed in the computer terminal 7 displays a list of received emails, the attached file is an electronic device whose lock is in a locked state. A signature that can identify the lock state is displayed for the mail (step # 307). If the attached file has a time stamp and the system time is before the time stamp, the electronic mail browsing software cannot open the attached file. When the attached file is unlocked after the time stamp has elapsed, the electronic mail software deletes the signature display.

  When the recipient's computer terminal 7 opens the body part and attached file of the received e-mail, it executes the virus scan by executing the latest virus vaccine file, opens the virus-checked e-mail, and the contents Can be safely confirmed (step # 308).

  When an e-mail that includes an attached file and has been determined to require predetermined computer virus countermeasure processing is received, even before the delay time elapses after the in-house mail server 22 receives the e-mail Since the body part of the electronic mail is not locked, the recipient can open the body part and check the content without delay. In addition, when an e-mail is received that includes an attached file but is not determined to require predetermined computer virus countermeasures, the attached file is not locked even before the delay time elapses. Therefore, the recipient can open the entire e-mail and check the contents without delay.

  Here, an attached file of an e-mail that is determined to require a predetermined computer virus countermeasure process is opened by the recipient in a locked state until the delay time elapses after the in-house mail server 22 receives the e-mail. In the meantime, there is time to create and distribute virus vaccine files for new and sub-species viruses newly generated by anti-virus software manufacturers. In addition, virus inspection using a virus vaccine file that is effective against a virus of a subtype can be performed on the entire e-mail including the attached file. Therefore, the above delay time is set in consideration of the time (for example, 2 to 3 hours) required for the creation and distribution of virus vaccine files for new and subtype viruses newly generated by anti-virus software manufacturers. The

  Hereinafter, another embodiment will be described.

  <1> In the above embodiments, a received mail address is assumed as a mail attribute serving as a reference for determining whether or not a computer virus countermeasure process is necessary. However, the mail attribute is not limited to a received mail address. For example, other mail attributes such as mail capacity and reception time may be used as a reference.

  <2> In the first embodiment, the e-mail processing system 3 and the in-house mail server 4 have been described as separate systems. However, the e-mail processing system 3 may be configured in the in-house mail server 4. In the second embodiment, the e-mail processing system 13 and the in-house mail server 4 have been described as separate systems. However, the e-mail processing system 13 may be configured in the in-house mail server 4.

  <3> In the first embodiment, the in-house mail server 4 executes a virus inspection using a virus vaccine file effective against new and subtype viruses on the entire e-mail including the attached file. However, the countermeasure processing means 9 may execute the virus check before the entire electronic mail including the attached file is transferred to the in-house mail server 4. Further, each recipient's computer terminal 7 may execute the virus check.

  <4> In the second embodiment, when the countermeasure processing means 14 executes virus inspection using a virus vaccine file effective against new and subtype viruses on the entire e-mail including the attached file. However, after the entire electronic mail including the attached file is transferred to the in-house mail server 4 via the second public area mail server 12, the in-house mail server 4 may execute the virus check. Absent. Further, each recipient's computer terminal 7 may execute the virus check.

  <5> In the first and second embodiments described above, even if it is determined that computer virus countermeasure processing is necessary, the body part is transferred to the in-house mail server 4 without waiting for the delay time to elapse. The case where the recipient can open the message has been described, but the body part may be transferred to the in-house mail server 4 after the delay time has elapsed. Further, the computer virus countermeasure processing for the body part may be made different depending on the mail attribute of the electronic mail.

  <6> In the third embodiment, even if an e-mail is determined to require computer virus countermeasure processing, its body portion is not set to the locked state, and the recipient can wait for the delay time to elapse. Although the case where the file can be opened has been described, the body portion may be set to a locked state that is released after the delay time elapses, similarly to the attached file. Further, the lock processing for the body part may be made different depending on the mail attribute of the e-mail.

The block diagram which shows 1st Embodiment of the electronic mail delivery system which concerns on this invention. The flowchart which shows an example of the email delivery processing procedure by 1st Embodiment of the email delivery system which concerns on this invention. The block diagram which shows 2nd Embodiment of the electronic mail delivery system which concerns on this invention. The flowchart which shows an example of the email delivery processing procedure by 2nd Embodiment of the email delivery system which concerns on this invention. The block diagram which shows 3rd Embodiment of the electronic mail delivery system which concerns on this invention. The figure which shows the structural example of the mail attribute database used by 3rd Embodiment of the electronic mail delivery system which concerns on this invention. The flowchart which shows an example of the email delivery processing procedure by 3rd Embodiment of the email delivery system which concerns on this invention.

Explanation of symbols

1, 2: 1: Public area mail server 2: Wall 3, 13: E-mail processing system 4, 22: In-house mail server 5, 6: LAN
7: Computer terminal 8: Determination means 9, 14, 23: Countermeasure processing means 10, 24: Mail attribute database 11: First public area mail server 12: Second public area mail server 15: Sorting means

Claims (8)

A determination means for determining whether or not a predetermined computer virus countermeasure process is necessary for an email transferred from a public area mail server, based on a mail attribute of the email;
When it is determined that the predetermined computer virus countermeasure processing is necessary, as the predetermined computer virus countermeasure processing, countermeasure processing means for holding the electronic mail without transferring it until a predetermined delay time elapses. When,
An e-mail delivery system comprising:   When the electronic mail includes an attached file other than the body part and the predetermined computer virus countermeasure processing is determined to be necessary, the countermeasure processing means converts the entire electronic mail including the attached file to the delay time. 2. The e-mail delivery system according to claim 1, wherein the e-mail delivery system transfers to a predetermined transfer destination after elapse of time.   The countermeasure processing means, when it is determined that the electronic mail includes an attached file in addition to the body part and the predetermined computer virus countermeasure process is necessary, the body part of the electronic mail before the delay time elapses. 3. The electronic mail distribution system according to claim 2, wherein the electronic mail is transferred to the predetermined transfer destination.   2. The countermeasure processing unit forwards the electronic mail to a predetermined transfer destination before the delay time elapses when it is determined that the predetermined computer virus countermeasure processing is not necessary. The e-mail delivery system according to any one of to 3.   When it is determined that the predetermined computer virus countermeasure processing is necessary, the electronic mail is transferred to the countermeasure processing means, and when it is determined that the predetermined computer virus countermeasure processing is not necessary, the electronic mail is The e-mail delivery system according to claim 1 or 2, further comprising sorting means for forwarding to a transfer destination.   The distribution means, when the electronic mail includes an attached file in addition to the body part, and when it is determined that the predetermined computer virus countermeasure processing is necessary, the body part of the electronic mail is moved before the delay time elapses. 6. The electronic mail distribution system according to claim 5, wherein the electronic mail is transferred to a predetermined transfer destination.   The countermeasure processing means is provided on the Internet, and transfers the e-mail after the predetermined computer virus countermeasure processing to the predetermined transfer destination without transferring the received e-mail to the determination means. 7. The e-mail delivery system according to claim 5, wherein the e-mail delivery system is transferred to a public area mail server. A determination means for determining whether or not a predetermined computer virus countermeasure process is necessary for an email transferred from a public area mail server, based on a mail attribute of the email;
When the electronic mail includes an attached file other than the body part and it is determined that the predetermined computer virus countermeasure processing is necessary, the attached file of the electronic mail is converted to a predetermined delay time as the predetermined computer virus countermeasure processing. Measures processing means to make the locked state unopenable until
An e-mail delivery system comprising:

Images