JP2006301988A - E-mail filtering method and filtering system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an e-mail filtering method and system capable of filtering e-mails transmitted and received by a client machine, wherever the client machine is installed. <P>SOLUTION: In the e-mail filtering method and system, a security policy about filtering of e-mail transmission/reception is preliminarily set in a client machine 103, so that e-mails transmitted/received by the client machine 103 are filtered in accordance with the security policy wherever the client machine 103 is installed. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a method and system for filtering email sent and received in a client machine having an email function, and more particularly, a method and system for filtering email based on a security policy distributed to each client machine. It is about.

  In an environment such as an in-house LAN where a large number of client machines such as personal computers (PCs) are connected, it is necessary to prevent leakage of confidential information or illegal data taking out by an electronic mail function provided in the client machine. As a means for ensuring such security, it is common to install a filtering device between the client machine and the e-mail server to monitor and filter the contents of e-mails sent and received by the client machine. . Patent Document 1 describes an e-mail filtering device used for such a purpose.

Japanese Patent Application Laid-Open No. 2004-266454.

  The conventional e-mail filtering technology described above is based on the premise that the client machine is installed inside an in-house LAN or the like, and e-mail data transmitted and received by the client machine always passes through the filtering device. However, with regard to portable client machines such as notebook PCs, a usage form in which the user takes them outside and connects them to other networks is conceivable. Would result in no filtering applied.

  Therefore, the present invention intends to provide a method and system capable of filtering e-mails transmitted and received by a client machine regardless of the installation location of the client machine.

  As a result of diligent research in view of the above problems, the present inventor has previously set a security policy regarding filtering of e-mail transmission / reception in the client machine, and is transmitted / received in the client machine regardless of the installation location of the client machine. The present inventors have come up with an e-mail filtering method and a filtering system that allow e-mail to be filtered according to the security policy.

  That is, the present invention includes an electronic mail transmission / reception means, a communication data hook means, and a filtering means, and a communication policy in the client machine is established by the communication data means in a client machine in which a security policy regarding transmission / reception of electronic mail is set. Data is hooked, and the filtering means determines whether the communication data is e-mail data. If the communication data is e-mail data, it is determined whether transmission / reception is permitted by the security policy. The present invention also provides an electronic mail filtering method characterized by interrupting transmission / reception of unauthorized electronic mail.

  In the e-mail filtering method according to the present invention, the security policy cannot be changed or deleted by a user of a client machine.

  In the electronic mail filtering method of the present invention, the security policy is set for each user, and the client machine identifies the current user and applies the security policy set for the user.

  In the electronic mail filtering method of the present invention, the filtering means determines whether the communication data is electronic mail data based on a destination port number.

  In the e-mail filtering method of the present invention, the security policy includes items relating to whether or not e-mail transmission / reception is permitted, such as transmission time, transmission source e-mail address, transmission destination e-mail address, client machine IP address, client machine user name, It includes at least one of a mail subject, presence / absence of an attached file, attached file name, and mail format.

  In the electronic mail filtering method according to the present invention, the client machine acquires information including a filtering result regarding transmitted / received electronic mail as a log.

  The present invention is also a filtering system for e-mails transmitted / received by a client machine, wherein means for applying a security policy relating to e-mail transmission / reception to the client machine, and communication data means for hooking communication data in the client machine And whether the communication data is e-mail data. If the communication data is e-mail data, it is determined whether transmission / reception is permitted by the security policy. And a filtering means for interrupting transmission / reception of e-mails.

  The electronic mail filtering system according to the present invention is characterized in that the security policy cannot be changed or deleted by a user of a client machine.

  In the electronic mail filtering system according to the present invention, the security policy is set for each user, and the client machine identifies a current user and applies the security policy set for the user.

  In the electronic mail filtering system of the present invention, the filtering means determines whether or not the communication data is electronic mail data based on a destination port number.

  In the e-mail filtering system of the present invention, the security policy includes items relating to whether or not e-mail transmission / reception is permitted, such as transmission time, transmission source e-mail address, transmission destination e-mail address, client machine IP address, client machine user name, It includes at least one of a mail subject, presence / absence of an attached file, attached file name, and mail format.

  In the electronic mail filtering system according to the present invention, the client machine further includes means for acquiring, as a log, information including a filtering result regarding the transmitted / received electronic mail.

  As described above, according to the e-mail filtering method and filtering system of the present invention, e-mail filtering according to the security policy set by the administrator on the client machine regardless of the installation location of the client machine. Will be done.

  DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The best mode for carrying out an e-mail filtering method and filtering system according to the present invention will be described below in detail with reference to the accompanying drawings. 1 to 5 are diagrams illustrating embodiments of the present invention. In these drawings, the same reference numerals denote the same components, and the basic configuration and operation are the same. To do.

  FIG. 1 is a diagram schematically showing a configuration of a computer system to which an e-mail filtering method of the present invention is applied. In FIG. 1, this system is a computer system placed under a certain management such as an in-house LAN, and includes at least one management server 101 for managing security in the system and one or more PCs. The client machine 103 includes a mail server 110 for sending / receiving e-mails and a log server 111 for storing a log of sending / receiving e-mails in each client machine 103.

  The management server 101 stores the security policy set for each user by the administrator of the system in the security policy DB 102. The client machine 103 responds to the security policy 104 to be applied to the current user distributed from the management server 101, the e-mail application 105, the communication hook function 106 for hooking e-mail communication, and the hooked e-mail communication. A filtering function 107 that performs filtering in accordance with the security policy 104 and an electronic mail communication log acquisition function 108 are included. The security policy may be set not for each user but for each client machine. In addition, the same security policy may be set for each user group or each client machine group that is distinguished not by individual users or client machines but by departments in the organization.

  FIG. 2 is a flowchart showing the flow of filtering processing when the client machine 103 transmits an e-mail in the computer system shown in FIG. In FIG. 2, first, the client machine 103 downloads a security policy corresponding to the current user from the management server 101 (step 200). In the client machine 103, the current user is identified from login information or the like. The security policy may be downloaded only once when the user logs in. The downloaded security policy is encrypted so that the user cannot change it.

  Next, when the user performs an operation of sending an email using the email application 105 in the client machine 103, the sent email data is hooked by the communication hook function 106 (step 201). The communication hook function 106 is a function provided to the electronic mail application 105 by an OS (operating system), and the hook is transparently performed regardless of the type of the electronic mail application 105.

  Subsequently, the hooked electronic mail data is analyzed and filtered by the filtering function 107. The filtering is performed according to the applied security policy. In the example shown in FIG. 2, it is determined whether the destination port number of the e-mail data is a port number set in the security policy (step 202). If not applicable, the filtering is terminated as it is. Subsequently, it is determined whether or not the transmission protocol of the e-mail data is a protocol (SMTP in this example) set in the security policy (step 203). If the protocol does not correspond to the protocol, the filtering is finished as it is. . Subsequently, the header information of the e-mail data is analyzed, and the source mail address, destination mail address, mail subject, attached file name, and attached file format are acquired (step 204). By comparing the acquired information with the security policy, it is determined whether the electronic mail data is permitted by the security policy (step 205). If the e-mail data is not permitted by the security policy, the transmission is interrupted (step 206), and if it is permitted, the transmission is continued (step 207), and filtering is performed. Exit.

  Thereafter, the e-mail data permitted to be transmitted is transmitted to the mail server 110, and the transmission log is acquired by the log acquisition function 108 of the client machine 103 and accumulated as the transmission log 109. The transmission log 109 is uploaded to the log server 111 in a timely manner.

  FIG. 3 is a diagram showing a data configuration example of a security policy applied to e-mail filtering in the present invention. The items set as the security policy are not limited to those shown in the figure, and the administrator can set items related to various attributes of e-mail transmission / reception data.

  FIG. 4 is a diagram showing a data configuration example of an e-mail transmission / reception log acquired at the time of e-mail transmission / reception and stored in the log server 111 or the like. Also regarding this log, items relating to various attributes of e-mail transmission / reception data can be set.

  For example, as an example of setting items other than those shown in FIGS. 3 and 4, permission / prohibition of transmission / reception of an electronic mail with an attached file can be set as shown in FIG. 5. In the above description, filtering is mainly described in the case where an electronic mail is transmitted from a client machine. However, it is also possible to perform filtering on a received mail downloaded from a mail server to a client machine in exactly the same manner.

  The e-mail filtering method and filtering system of the present invention have been described above by showing specific embodiments. However, the present invention is not limited to these. A person skilled in the art can make various changes and improvements to the configurations and functions of the invention according to the above-described embodiments or other embodiments without departing from the gist of the present invention.

  The e-mail filtering method and filtering system of the present invention can be realized on a computer system composed of a client machine and various server machines, and information processing such as e-mail transmission / reception filtering is a hardware resource of each machine. It is an invention that can be used industrially because it is concretely realized using this.

It is a figure which shows roughly the structure of the computer system to which the electronic mail filtering method of this invention is applied. 2 is a flowchart showing a flow of filtering processing when a client machine transmits an electronic mail in the computer system shown in FIG. 1. It is a figure which shows the data structural example of the security policy applied to the filtering of an email in this invention. It is a figure which shows the data structural example of the email transmission / reception log acquired at the time of transmission / reception of an email, and accumulate | stored in a log server etc. It is a figure which shows the example which sets permission / prohibition of transmission / reception of the email with an attached file as an example of the setting item of a security policy.

Explanation of symbols

101 ... Management server 102 ... Security policy DB
DESCRIPTION OF SYMBOLS 103 ... Client machine 104 ... Security policy 105 distributed to client machine ... E-mail application 106 ... Communication hook function 107 ... Filtering function 108 ... Log acquisition function 109 ... Acquired log 110 ... Mail server 111 ... Log server 112 ... Log Reference function 113 ... Accumulated log

Claims (12)

In a client machine provided with an e-mail transmission means, a communication data hook means, and a filtering means, and a security policy regarding the transmission of e-mail is set,
The communication data means hooks communication data in the client machine,
The filtering means determines whether the communication data is e-mail data. If the communication data is e-mail data, it is determined whether transmission is permitted by the security policy. An e-mail filtering method characterized by interrupting transmission of no e-mail.   The e-mail filtering method according to claim 1, wherein the security policy cannot be changed or deleted by a user of a client machine.   The e-mail according to claim 1 or 2, wherein the security policy is set for each user, and the client machine identifies a current user and applies the security policy set for the user. Filtering method.   The e-mail filtering method according to claim 1, wherein the filtering unit determines whether the communication data is e-mail data based on a transmission destination port number.   The security policy includes items relating to whether or not to send e-mails, such as transmission time, source e-mail address, destination e-mail address, client machine IP address, client machine user name, e-mail subject, presence of attached file, attachment The e-mail filtering method according to any one of claims 1 to 4, wherein at least one of a file name and a mail format is included.   The e-mail filtering method according to claim 1, wherein the client machine acquires information including a filtering result regarding the sent e-mail as a log. A filtering system for emails sent by a client machine,
Means for applying a security policy relating to email transmission to the client machine;
Communication data means for hooking communication data in the client machine;
It is determined whether the communication data is e-mail data. If the communication data is e-mail data, it is determined whether transmission is permitted by the security policy, and transmission of unauthorized e-mail is performed. And an e-mail filtering system comprising: filtering means for interrupting;   8. The e-mail filtering system according to claim 7, wherein the security policy cannot be changed or deleted by a user of a client machine.   9. The e-mail according to claim 7 or 8, wherein the security policy is set for each user, and the client machine identifies the current user and applies the security policy set for the user. Filtering system.   10. The e-mail filtering system according to claim 7, wherein the filtering unit determines whether the communication data is e-mail data based on a transmission destination port number. 11.   The security policy includes items relating to whether or not to send e-mails, such as transmission time, source e-mail address, destination e-mail address, client machine IP address, client machine user name, e-mail subject, presence of attached file, attachment 11. The e-mail filtering system according to claim 7, wherein the e-mail filtering system includes at least one of a file name and a mail format. 12. The e-mail filtering system according to claim 7, wherein the client machine further includes means for acquiring, as a log, information including a filtering result relating to the transmitted e-mail. 13. .

Images