JP2009037432A - Verification policy setting device, program, and verification policy management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To properly set a verification policy which is commonly applied to a plurality of electronic mail receivers by considering how reliability of electronic mail to be sent to a plurality of electronic mail receivers is evaluated. <P>SOLUTION: A verification policy setting server 25 which sets a verification policy to a verification server 23 which relays electronic mail to be transmitted to an internal mail client 22, and processes the electronic mail according to a verification policy showing the conditions of the electronic mail having prescribed reliability includes: an evaluation message reception part 25A which receives individual reliability information for specifying the conditions to be transmitted by the operation of the user of each internal mail client 22; a common reliability evaluation part 25B which evaluates the reliability of the electronic mail fulfilling conditions to be specified by the information on the basis of the plurality of pieces of information specifying the conditions; and a policy setting part 25C which sets the verification policy to be commonly applied to the plurality of electronic mail receivers on the basis of the evaluation result by the common reliability evaluation part 25B. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a verification policy setting device, a program, and a verification policy management system, and in particular, a verification policy setting device that sets a verification policy that is commonly applied to a plurality of e-mail recipients belonging to a predetermined e-mail recipient group. The present invention relates to a program and a verification policy management system.

  Patent Document 1 listed below discloses a verification server (verification authority) that performs verification processing of an electronic signature. This verification server receives an electronic mail between the senders and receivers of an electronic mail with an electronic signature, and verifies the electronic signature of the received electronic mail. Then, the e-mail is transferred to the recipient with the verification result attached.

The verification server generally holds a verification policy indicating an e-mail condition having a predetermined reliability such as positive or negative, and whether or not the received e-mail satisfies the condition indicated by the verification policy. In response to this, the electronic mail verification process is executed. Such a verification server verifies an e-mail transmitted to any one of e-mail recipients (company employees, etc.) belonging to a predetermined group of e-mail recipients. A verification policy that is commonly applied to the large number of e-mail recipients is set by the administrator of the verification server.
JP 2005-203819 A

  However, the administrator of the verification server fully understands how many e-mail recipients actually evaluate the reliability of e-mails that reach them, and is common to those e-mail recipients. It was very difficult to set the appropriate validation policy.

  The present invention has been made in view of the above problems, and its object is to consider how a plurality of e-mail recipients evaluate the reliability of e-mails that reach them. It is an object of the present invention to provide a policy setting device, a program, and a verification policy management system that can appropriately set a verification policy that is commonly applied to mail recipients.

  According to the first aspect of the present invention, there is provided a verification policy for receiving an e-mail addressed to one of e-mail recipients belonging to a predetermined e-mail recipient group and indicating e-mail conditions having a predetermined reliability. The verification policy setting device that sets the verification policy to the verification server device that processes the received email according to the predetermined email sent by the respective email recipients according to a predetermined operation An individual reliability information receiving means for receiving individual reliability information for specifying a condition that satisfies an e-mail having reliability, and an e-mail reliability that satisfies the condition specified by the individual reliability information, Common reliability evaluation means for evaluating based on a plurality of the individual reliability information specifying the condition, and the predetermined electronic according to the evaluation result of the common reliability evaluation means Characterized in that it comprises a policy setting means for setting the verification policy that is applied in common to a plurality of e-mail recipients belonging to Lumpur recipient group, the.

  The invention described in claim 2 is the verification policy setting device according to claim 1, wherein each individual reliability information is an electronic mail that is determined to have the predetermined reliability by each electronic mail recipient. Indicates a condition that satisfies.

  A third aspect of the present invention is the verification policy setting apparatus according to the second aspect, wherein the condition indicated by each individual reliability information is received according to an e-mail received by each e-mail recipient. The e-mail is generated to be satisfactory.

Invention of Claim 4 is the verification policy setting apparatus of Claim 1, Comprising:
Each individual reliability information specifies an e-mail whose source is an e-mail address transmitted by each e-mail recipient, and the common reliability evaluation means is specified by each individual reliability information. Deriving a condition satisfying the e-mail, and evaluating the reliability of the e-mail satisfying the condition based on the plurality of individual reliability information for identifying the e-mail satisfying the condition And

  The invention according to claim 5 is the verification policy setting device according to claim 4, wherein each individual reliability information is an e-mail already transmitted from a destination of an e-mail transmitted by the e-mail recipient. It is characterized by specifying.

  The invention according to claim 6 is the verification policy setting device according to claim 4 or 5, wherein each individual reliability information is transmitted in the future from an e-mail destination transmitted by the e-mail recipient. E-mail is estimated.

  A seventh aspect of the present invention is the verification policy setting apparatus according to any one of the first to sixth aspects, wherein the common reliability evaluation unit is configured for each condition specified by the individual reliability information. The evaluation value indicating the degree to which the e-mail satisfying the above has the predetermined reliability is stored, and the evaluation value is updated based on the individual reliability information that specifies the condition, and according to the updated evaluation value The reliability of the e-mail satisfying the condition is evaluated.

  The invention according to claim 8 is the verification policy setting device according to any one of claims 1 to 7, wherein the condition specified by each individual reliability information is transmitted to each e-mail recipient. At least one of information on a certificate authority that issues an electronic certificate with respect to a mail address of a sender of the electronic mail, a mail domain of the sender of the electronic mail, or a public key corresponding to an electronic signature attached to the electronic mail It includes the condition regarding.

  The invention according to claim 9 is the verification policy setting device according to any one of claims 1 to 8, wherein the policy setting means is applied in common to the plurality of e-mail recipients. The verification policy applied to the e-mail recipient that is the source of the individual reliability information is set according to the individual reliability information received by the individual reliability information receiving means. It is characterized by that.

  According to a tenth aspect of the present invention, a plurality of mail client devices and an e-mail transmitted to each of the mail client devices are received, and the e-mail is processed according to a verification policy indicating e-mail conditions having a predetermined reliability. A verification policy management system comprising: a verification server device to perform; and a verification policy setting device for setting the verification policy in the verification server device, wherein each of the mail client devices receives an email having the predetermined reliability. Including individual reliability information transmitting means for transmitting individual reliability information for specifying a satisfying condition in accordance with a predetermined operation by a user of the mail client device, wherein the policy setting device receives the individual reliability information Satisfying each condition specified by the individual reliability information receiving means and the individual reliability information. Common reliability evaluation means for evaluating the reliability of the e-mail based on the individual reliability information for specifying the condition, and a predetermined group of e-mail recipients according to the evaluation result of the common reliability evaluation means Policy setting means for setting a verification policy that is commonly applied to a plurality of e-mail recipients belonging to.

  The invention described in claim 11 is the verification policy management system according to claim 10, wherein each of the mail client devices has the predetermined reliability among e-mails received by the mail client device. In accordance with what is determined by the user of the mail client device, an individual reliability information generating unit that generates conditions for satisfying the determined electronic mail and generates the individual reliability information to indicate the generated conditions It is further characterized by including.

  The invention according to claim 12 is a verification policy for receiving an e-mail transmitted to one of e-mail recipients belonging to a predetermined e-mail recipient group and indicating a condition of e-mail having a predetermined reliability. The verification server device that processes the received email according to the computer as the verification policy setting device that sets the verification policy is transmitted in response to a predetermined operation by each email recipient. Individual reliability information receiving means for receiving individual reliability information for specifying a condition satisfying a reliable e-mail, and for each condition specified by the individual reliability information, an e-mail that satisfies the condition Common reliability evaluation means for evaluating reliability based on the individual reliability information specifying the condition, and an evaluation result of the common reliability evaluation means Flip and a program for functioning as a policy setting means for setting a validation policies applied in common to a plurality of e-mail recipients belonging to the predetermined electronic mail recipient group.

  According to the first, tenth, and twelfth aspects of the present invention, when a verification policy that is commonly applied to a plurality of e-mail recipients is set, the plurality of e-mail recipients are reliable with respect to e-mail conditions. It is possible to grasp how the evaluation is evaluated and set appropriately.

  According to the invention of claim 2, as compared with the invention of claim 1, the plurality of e-mail recipients can more reliably reflect the reliability evaluation of the e-mail conditions by the e-mail recipients. It is possible to appropriately set a verification policy that is commonly applied to.

  According to the invention of claim 3, compared to the invention of claim 2, the work of transmitting reliability evaluations for the e-mail conditions by a plurality of e-mail recipients to the verification policy setting device is easier. The verification policy that is commonly applied to a plurality of e-mail recipients can be appropriately set.

  According to the invention of claim 4, it is possible to appropriately set a verification policy that is commonly applied to a plurality of e-mail recipients, reflecting the transmission / reception results of e-mails by a plurality of e-mail recipients. it can.

  According to the invention of claim 5, when a plurality of e-mail recipients send an e-mail, the plurality of e-mail recipients reflect the results of e-mail transmission / reception to the plurality of e-mail recipients. The verification policy applied in common can be set appropriately.

  According to the invention of claim 6, when an email is transmitted to a plurality of email recipients, the transmission / reception results of the plurality of email recipients are reflected and common to the plurality of email recipients. The verification policy to be applied can be set appropriately.

  According to the invention of claim 7, for each e-mail condition, it is grasped how a plurality of e-mail recipients evaluate the reliability of the e-mail, and a plurality of e-mail recipients are evaluated. Therefore, it is possible to appropriately set a verification policy applied in common.

  According to the invention of claim 8, when a verification policy that is commonly applied to a plurality of e-mail recipients is set, it is attached to an e-mail sender address, a sender domain, or an e-mail. It is possible to appropriately set the reliability of a certificate authority that issues an electronic certificate for a public key corresponding to a digital signature obtained by grasping how a plurality of electronic mail recipients evaluate.

  According to the ninth aspect of the invention, it is commonly applied to the plurality of e-mail recipients by grasping how the plurality of e-mail recipients evaluate the reliability of the e-mail conditions. It is possible to appropriately set a verification policy and a verification policy to be applied to a person who shows an evaluation of reliability with respect to an e-mail condition among the e-mail recipients.

  According to the eleventh aspect of the present invention, as compared with the tenth aspect of the present invention, the transmission work to the verification policy setting apparatus by each e-mail recipient in the mail client can be performed more easily.

[First embodiment]
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is an overall configuration diagram of an information processing system 10 including a verification policy setting device and a mail client according to an embodiment of the present invention. In the information processing system 10 shown in the figure, a local area network (LAN) 20 and an external mail client 14 are connected via a wide area network (WAN) 12. The local communication network 20 connected to the wide area communication network 12 via the router 21 is a general network realized by an organization such as a company. In the present embodiment, the local communication network 20 includes a verification policy setting server 25, a verification server 23, a mail server 24, an internal mail client 22, and a router 21, and these are connected so that data communication is possible. In the local area network 20, the verification policy management system includes a verification server 23, an internal mail client 22, and a verification policy setting server 25.

  In the information system 10 shown in FIG. 1, when an e-mail is transmitted from the external mail client 14 to the internal mail client 22, it is relayed to the mail server 24 and the verification server 23. Specifically, the mail server 24 receives the electronic mail transmitted from the external mail client 14 and transfers it to the verification server 23. The verification server 23 performs a verification process on the transferred electronic mail, attaches the verification result, and transfers it to the mail server 24. The transferred electronic mail is temporarily stored in the mail server 24 and transmitted to the internal mail client 22 in response to an inquiry from the internal mail client 22.

  The verification server 23 is a well-known server computer configured mainly with a CPU and a memory, and includes a control unit, a storage unit, and a communication unit. The electronic mail transmitted by the user operation in the external mail client 14 is relayed by the router 21 and the mail server 24 and received by the verification server 23. The verification server 23 performs processing such as signature verification according to the received electronic mail, and transfers the result to the mail server 24 with the result of the verification processing.

  In particular, in the verification server 23, a verification policy for determining a processing method is set according to the condition of the e-mail. Here, the e-mail condition refers to the contents of elements related to e-mail processing. For example, the e-mail sender domain (hereinafter referred to as the sender domain) is included in the e-mail condition. It is. The verification policy of the present embodiment illustrated in FIG. 2 is a table that associates a transmission source domain with a trust level that indicates the degree of reliability of the transmission source domain. The verification server 23 can perform processing according to the trust level by determining the trust level of the source domain of the received electronic mail according to the verification policy.

  Here, the processing according to the trust level in the verification server 23 is as follows: “E-mail sent from a domain having the trust level 2 is verified by the electronic signature and transferred to the mail server 24, and the domain having the trust level 1 or lower The e-mail transmitted from is transferred to the mail server 24 without verifying the electronic signature. Such processing contents corresponding to the trust level are determined in advance by an administrator of the verification server 23 or the like. The reason why electronic signature verification is not performed on emails sent from domains with trust level 1 is that there is a low possibility that business-critical emails will be sent, such as spam emails. It depends on the circumstances.

  The mail server 24 is a server computer mainly composed of a CPU and a memory, and is installed with software that realizes the functions of a known mail server. The mail server 24 receives the electronic mail transmitted from the external mail client 14 via the router 21 and transfers it to the verification server 23. Further, the e-mail transferred from the verification server 23 is temporarily stored in the mail server 24 and transferred to the internal mail client 22 in response to an inquiry from the user of the internal mail client 22.

  The internal mail client 22 and the external mail client 14 are known personal computers or the like mainly configured with a CPU and a memory, and include a control unit, a storage unit, a communication unit, a display unit, and an input / output unit. It consists of The internal mail client 22 and the external mail client 14 are installed with known applications for realizing functions such as creation and transmission / reception of e-mails, and are given e-mail addresses from a network administrator to which the mail client belongs. Shall. The user of the internal mail client 22 can receive an e-mail stored in the mail server 24 by making an inquiry to the mail server 24.

  In particular, in this embodiment, the user of the internal mail client 22 browses the electronic mail displayed on the display unit and evaluates the reliability of the electronic mail with respect to the transmission source domain. When the user evaluates the reliability of the sender domain of the electronic mail being browsed, the “evaluation message transmission trigger” displayed on the display unit is activated using a mouse or the like in the input / output unit. When the “evaluation message transmission trigger” is activated, the internal mail client 22 extracts the source domain of the displayed e-mail, and gives the extracted source domain to the verification policy setting server 25 as an evaluation message. Send in the form of an e-mail addressed to the e-mail address.

  The evaluation message in the present embodiment includes data indicating the transmission source domain and a mail address indicating the sender ID of the evaluation message sender. The evaluation message only needs to include at least data for specifying the transmission source domain, but may further include data indicating the reliability of the transmission source domain. Further, the data to be transmitted as the evaluation message and the format thereof may be the format of an email for transferring the email received by the internal mail client 22 to the verification policy setting server 25, or the data received by the internal mail client 22 The e-mail itself or the header information itself may be transmitted to the verification policy setting server 25 in another format. If the evaluation message is in the form of an e-mail, it is relayed to the mail server 24. However, it is sufficient that the evaluation message reaches at least the verification policy setting server 25 regardless of the transmission path.

  Here, the evaluation message in the present embodiment is an e-mail that includes data indicating a transmission source domain for which the user of the internal mail client 22 has performed reliability evaluation and is individually transmitted to the verification policy setting server 25. . Such an evaluation message is individually transmitted from the plurality of internal mail clients 22 to the verification policy setting server 25. Then, the verification policy setting server 25 that receives various evaluation messages from each internal mail client 22 specifies an evaluation message for each transmission source domain specified by the evaluation message in order to specify a transmission source domain having a predetermined trust level. The verification policy is set by performing the process of counting and evaluating the reliability. Therefore, the evaluation message is an example of individual reliability information in the present invention.

  The verification policy setting server 25 is a well-known server computer configured mainly with a CPU and a memory, and includes a control unit, a communication unit, and a storage unit. The verification policy setting server 25 performs processing for setting a verification policy for the verification server 23 by receiving the evaluation message from the internal mail client 22. Details of the processing performed by the verification policy setting server 25 will be described later.

  Hereinafter, functions realized by the verification policy setting server 25 and the internal mail client 22 included in the information processing system 10 having the configuration described above will be described in more detail.

  As shown in FIG. 3, the verification policy setting server 25 is functionally configured to include an evaluation message receiving unit 25A, a common reliability evaluation unit 25B, and a policy setting unit 25C. These functions can be realized, for example, when the control unit of the verification policy setting server 25 executes a program or the like stored in the storage unit. This program may be provided by being stored in various computer-readable information storage media such as CD-ROM and DVD-ROM, or may be provided via communication means such as the Internet.

  First, the evaluation message receiving unit 25A receives evaluation messages, which are evaluations on the reliability of various source domains, which are individually transmitted from the users of the internal mail clients 22 existing in the local communication network 20.

  Next, based on the evaluation message received by the evaluation message receiving unit 25A, the common reliability evaluation unit 25B evaluates the common reliability in the local area communication network 20 for each transmission source domain included in the evaluation message. Do. Further, the common reliability evaluation unit 25B causes the storage unit of the verification policy setting server 25 to store a table as shown in FIG. 4 that associates the transmission source domain with the reliability evaluation value as a verification policy setting table.

  Here, the reliability evaluation value refers to a value calculated by aggregating evaluation messages in order to determine the trust level of the transmission source domain. Further, in the present embodiment, not only the reliability evaluation value is associated with the record of the transmission source domain in the verification policy setting table shown in the figure, but also the sender ID and the trust level are associated and stored. Has been.

  Specifically, the process of the common reliability evaluation unit 25B will be described. As shown in FIG. 3, the common reliability evaluation unit 25B further includes three functional blocks, that is, a data analysis unit 25X, a policy update control unit 25Y, and a reliability evaluation unit 25Z.

  The data analysis unit 25X analyzes the evaluation message received by the evaluation message reception unit 25A. By the analysis processing, the data analysis unit 25X identifies the transmission source domain indicated by the evaluation message and the sender ID of the evaluation message.

  The policy update control unit 25Y searches the verification policy setting table held in the storage unit of the verification policy setting server 25 for the record of the transmission source domain identified by the data analysis unit 25X. If the record does not exist as a result of the search, the policy update control unit 25Y newly adds a record of the transmission source domain to the verification policy setting table in the verification policy setting table stored in the storage unit, The mail address that is the sender ID of the received evaluation message is stored in association with the record. On the other hand, if there is a record, the policy update control unit 25Y uses the verification policy setting table stored in the storage unit to specify the email address of the sender of the evaluation message as the sender of the record of the source domain. Add to ID column.

  The reliability evaluation unit 25Z calculates a reliability evaluation value based on the sender ID field of the verification policy setting table processed by the policy update control unit 25Y, and the calculated reliability evaluation value is set in the transmission source domain. Correlate and store in the verification policy setting table. In order to determine the trust level based on the reliability evaluation value, a threshold is set in advance by the administrator of the verification policy setting server 25. The reliability evaluation unit 25Z reads the set threshold value from the storage unit, compares it with the calculated reliability evaluation value, and determines the reliability level. Further, the reliability evaluation unit 25Z stores the determined trust level in association with the transmission source domain.

  In the verification policy setting table shown in FIG. 4, the reliability evaluation value is determined by counting the sender IDs while excluding duplicates. In addition, since the threshold for determining the trust level is set as 5 by the administrator separately, the source domain having a reliability evaluation value of 5 or more has a trust level of 2 and a reliability evaluation value of less than 5. The source domain has a trust level of 1. When the sender IDs stored in the verification policy setting table are duplicated, the reliability evaluation value may be obtained by counting the total number of received evaluation messages while ignoring the duplicate of the sender ID. . Further, the reliability evaluation value may be counted by performing different weighting for each sender ID.

  Then, the policy setting unit 25C transmits the reliability evaluation of the transmission source domain evaluated by the common reliability evaluation unit 25B to the verification server 23. The data to be transmitted to the verification server 23 in the present embodiment is a part in which the reliability evaluation value field is excluded from the verification policy setting table, but may be the verification policy setting table itself, or the verification policy Only the data of the changed part of the setting table may be extracted.

  In the verification server 23, a verification policy is set based on the data transmitted from the policy setting unit 25C. Here, the verification server 23 receives the table of the part from which the reliability evaluation value field of the verification policy setting table shown in FIG. 4 is excluded, and also eliminates duplication in the sender ID, and the verification as shown in FIG. The policy is stored in the storage unit.

  As described above, the verification policy setting server 25 sets the verification policy by evaluating the reliability for each email transmission source domain using the evaluation message individually transmitted from each internal mail client 22. . As a result, a verification policy that can be commonly applied to the internal mail client 22 existing in the local communication network 20 can be appropriately set.

  In the policy management system including the verification policy setting server 25 as described above, as shown in FIG. 5, the internal mail client 22 includes an e-mail transmission / reception unit 22A, an evaluation message generation unit 22B, and an evaluation message transmission unit. And 22C. With these configurations, the user of the internal mail client 22 can simplify the operation for generating and transmitting the evaluation message. Further, these functions can be realized, for example, when the control unit of the internal mail client 22 executes a program or the like stored in the storage unit. This program may be provided by being stored in various computer-readable information storage media such as CD-ROM and DVD-ROM, or may be provided via communication means such as the Internet.

  The e-mail transmission / reception unit 22A receives e-mail stored in the mail server 24 and transmitted to the e-mail address given to the internal mail client 22 from the mail server 24.

  The evaluation message generator 22B obtains information on the sender domain from the email received by the email sender / receiver 22A according to the input of the user of the internal mail client 22 that evaluates the reliability of the sender domain of the email. An evaluation message including the information of the transmission source domain is created in a predetermined format.

  Here, the input of the user of the internal mail client 22 is, for example, a trigger that is an instruction to create an evaluation message provided in advance on the display unit of the internal mail client 22 at the input / output unit of the internal mail client 22. This operation is activated by operating a mouse or keyboard. Note that this input is not limited to the input of an instruction for creating an evaluation message. For example, the input domain of the e-mail to be opened for the user's input when opening the e-mail received by the e-mail transmission / reception unit 22A A process of creating an evaluation message including

  The evaluation message transmission unit 22C transmits the evaluation message created by the evaluation message generation unit 22B to the verification policy setting server 25. The evaluation message transmission process in the evaluation message transmission unit 22C may be separately performed in response to a user input, or may be performed in association with the evaluation message creation process in the evaluation message generation unit 22B.

  FIG. 6 is a diagram illustrating a flow in which the verification policy setting server 25 sets a verification policy for the verification server 23. First, the verification policy setting server 25 receives an evaluation message from the internal mail client 22 (S61).

  Next, in S62 to S66, processing for updating the verification policy setting table is performed according to the evaluation message received in S61.

  Specifically, the verification policy setting server 25 identifies the transmission source domain of the email transmitted to the internal mail client 22 from the received evaluation message, and the verification stored in the storage unit of the verification policy setting server 25 It is determined whether there is a record of the identified transmission source domain in the policy setting table (S62). Here, when the record of the transmission source domain does not exist in the verification policy setting table, a new record is added, and the mail address in the internal mail client 22 indicating the ID of the sender of the evaluation message is set as the verification policy setting table. The reliability evaluation value is set to 1 point and the reliability level is set to 1 (S66). On the other hand, if the record of the transmission source domain exists in the verification policy setting table, the mail address of the internal mail client 22 that transmitted the evaluation message is stored in the verification policy setting table, and 1 point is added to the reliability evaluation value. (S63). Next, the reliability evaluation value obtained by adding 1 point in step S63 is compared with a threshold value stored in advance in the verification policy setting server 25 (S64). If the threshold is exceeded, the confidence level of the record is changed to 2 (S65).

  In S67, a process for updating the update part of the verification policy setting table in S62 to S66 to the corresponding part of the verification policy is performed.

  Specifically, when the verification policy setting table is changed in each step of S63, S65, and S66, the data of the portion excluding the reliability evaluation value field in the verification policy setting table is stored in a predetermined format. And updated by transmitting to the verification server 23 (S67).

  As described above, the verification policy is set in the verification server 23, and the email received by the verification server 23 is processed according to the trust level.

  In the verification server 23, as shown in FIG. 7, the processing content corresponding to the trust level in the verification server 23 may be the processing content using the sender ID. In the following, the flow of FIG. 7 will be described.

  First, when the verification server 23 receives a signed e-mail (S71), the e-mail transmission source domain and e-mail destination e-mail address are specified from the received e-mail (S72). Next, the trust level of the identified source domain is determined from the verification policy (S73), and if the trust level is 2, the electronic signature is verified (S75). Even if the trust level is 1, if the e-mail destination mail address exists in the sender ID field in the verification policy (S74), the electronic signature is verified (S75). The success or failure of the electronic signature verification is determined (S76). If the electronic signature verification is successful, a notification that the verification result is successful is attached to the electronic mail, and the verification server 23 forwards it to the mail server 24 ( S77). On the other hand, when the electronic signature is not attached to the received electronic mail (S71), when the trust level is not set because the record of the source domain does not exist and the electronic signature is not verified (S74), the trust When the level is 1 and the e-mail destination mail address does not exist in the sender ID column and the electronic signature is not verified (S74), the electronic signature is verified but the signature verification fails ( In S76), a notification that the verification result is unsuccessful is attached to the e-mail, and the verification server 23 transfers it to the mail server 24 (S78).

  If the verification result is unsuccessful, the trust level of the source domain, the sender ID, and the reason for the failure of the verification result may be attached to the e-mail and transferred. By viewing these pieces of information by the recipient of the e-mail, it is possible to facilitate a response such as sending an evaluation message.

  As described above, the verification server 23 processes the email using the verification policy set by the verification policy setting server 25. A domain in which reliability is evaluated by transmitting an evaluation message from a plurality of users of the internal mail client 22 becomes a trust level 2 when the reliability evaluation value exceeds a preset threshold value. On the other hand, if the reliability evaluation value does not exceed a preset threshold value even in a domain in which the evaluation message is transmitted from the users of the plurality of internal mail clients 22 and the reliability is evaluated, the trust level 1 It becomes.

  An email from a domain that exceeds a predetermined threshold and has a trust level 2 is the same as that of the user who sent the evaluation message, even if it is a user of the internal mail client 22 that does not send the evaluation message. The possibility of evaluating reliability increases. From the above, when setting the verification policy common to each internal mail client 22 in the verification server 23, the reliability evaluation for the transmission source domain individually transmitted from each internal mail client 22 is used. Verification policy setting.

  In addition, an e-mail from a domain having a trust level 1 that does not exceed a predetermined threshold is less likely to be evaluated by a user of the internal mail client 22 that does not transmit an evaluation message in the same manner as the user who transmitted the evaluation message. Become. Therefore, until the transmission source domain obtains a certain reliability evaluation, an appropriate verification policy is set by setting a verification policy that is commonly applied to the user who transmitted the evaluation message.

[Second Embodiment]
FIG. 8 is a flowchart for explaining the second embodiment of the present invention. In the first embodiment, the reliability of the internal mail client 22 is determined by an evaluation message that the user of the internal mail client 22 specifies and transmits. However, in the second embodiment, the user of the internal mail client 22 The reliability of the transmission source domain is determined from the results of electronic mail transmitted to the mail client 14. The second embodiment is almost the same as the first embodiment, except that the user of the internal mail client 22 determines the reliability of the transmission source domain from the results of e-mails sent to the external mail client 14. It is.

  Here, the e-mail transmitted by the user of the internal mail client 22 includes data indicating the mail domain of the destination, and can be handled as the user individually evaluating the reliability of the mail domain of the destination. Therefore, if the results of e-mails individually transmitted from the plurality of internal mail clients 22 are used, the verification policy setting server 25 can perform processing for specifying a source domain having a predetermined trust level. The electronic mail transmitted by the user of the internal mail client 22 is an example of the individual reliability information of the present invention.

  FIG. 8 shows an example of processing of a device group including the internal mail client 22 and the verification policy setting server 25. In the process shown in FIG. 8, first, in step S801, an e-mail transmitted from the internal mail client 22 existing in the local communication network 20 to the mail address of the external mail client 14 (hereinafter, an e-mail from the local communication network 20). ) Is transmitted from the internal mail client 22. Next, when the mail server 24 performs the process of relaying the e-mail, the result of the e-mail is determined, and information on the transmission source domain necessary for setting the verification policy is transmitted to the verification policy setting server 25. (S802-S805).

  Specifically, the mail server 24 first stores an e-mail transmission / reception record table as shown in FIG. 9 when relaying an e-mail from the local communication network 20 (S802). The mail server 24 is not only an e-mail from the local communication network 20, but also an e-mail (hereinafter referred to as a local e-mail) transmitted from the external mail client 14 existing outside the local communication network 20 to the mail address of the internal mail client 22. Since e-mails from outside the communication network 20 are also relayed, the results of these e-mails are recorded in the transmission / reception result table shown in FIG. The table of e-mail transmission / reception results stored in the present embodiment includes fields of a source e-mail address (From), a destination e-mail address (To), and a transmission date / time (Date), and further includes a Message-ID and a reference e-mail (References). ) Header information, electronic certificate issuer (CA) information, and the like.

  Next, the e-mail destination mail domain from the relayed local area communication network 20 is read (S803), and the e-mail transmitted from the read destination mail domain is read using the transmission / reception record table shown in FIG. The result of the mail is specified (S804). In particular, in the present embodiment, the fact that e-mail results are specified is that policy setting processing is performed by more reliable reliability evaluation by checking the results of e-mail transmission / reception between mail domains. Because.

  Here, the identification of the e-mail in step S804 is performed by searching the past e-mail record from the transmission / reception record table shown in FIG. In this case, when relaying an e-mail from the local communication network 20, an e-mail from a transmission source domain outside the local communication network 20 is received, and the e-mail is sent from the local communication network 20 to the transmission source domain. The result that the transmission / reception of being transmitted is established will be confirmed.

  Specifically, when relaying an electronic mail from the local communication network 20, the results of the electronic mail from outside the local communication network in which the mail domain that is the destination of the electronic mail is the transmission source domain are shown in FIG. It specifies by searching from the transmission / reception performance table shown in FIG. Here, when there are a plurality of e-mail results that can be identified by searching from the transmission / reception results, the latest e-mail results with respect to the e-mail transmission date and time from the relaying local area communication network 20 Is identified.

  In addition, when the e-mail from the local communication network 20 that is relaying is a reply mail to the destination of the e-mail, the result of the e-mail that is the reply source may be specified. In this case, the e-mail destination e-mail address and the e-mail address of the e-mail from the relay local area communication network 20 are read (S803), and transmitted from the e-mail address of the e-mail to the e-mail address of the transmission source. It specifies by searching the result of an electronic mail (S804). Further, for example, by recording the reference mail (References) information and the Message-ID information in the header information of the e-mail relayed by the mail server 24 in the transmission / reception record table, the e-mail record can be specified. It becomes possible to do. Specifically, by retrieving the reference mail information in the e-mail from the relaying local communication network 20 from the information of the Message-ID, the e-mail from outside the local communication network 20 that is the reply source Identify the track record.

  Also, when it is determined that a certain period has not elapsed by comparing the transmission date / time of the e-mail from the relay local network 20 with the transmission date / time of the actual e-mail to be specified The e-mail performance may be specified.

  In this way, e-mails are identified and identified by grasping the results of e-mails being sent and received between mail domains within a certain period and the results of responses between e-mail addresses being established within a certain period. By performing the policy setting process in the verification policy setting server 25 using the data indicating the sender domain of the e-mail, the policy setting process is performed by more reliable reliability evaluation.

  The identification of the actual result of the e-mail in step S804 is transmitted in the future from the destination of the relayed e-mail based on the transmission date and time when relaying the e-mail from the local communication network 20 (S802). You may carry out by estimating the results of e-mail. In this case, when the mail server 24 relays an e-mail from outside the local communication network 20, the e-mail is transmitted from the local communication network 20 to a predetermined mail domain, and the mail domain outside the local communication network 20. The result that the transmission / reception that the e-mail from is received is established is confirmed.

  In this case, an e-mail from outside the local communication network whose e-mail destination is the source domain is sent to the mail server 24 after the e-mail transmission date and time from the local communication network 20. Can relay the results of e-mails. That is, when the mail server 24 relays an e-mail from outside the local communication network 20, the e-mail record in which the e-mail transmission source domain is the destination mail domain is shown in FIG. And the actual performance of the e-mail from outside the local communication network 20 that is relaying is specified. Here, when a plurality of e-mail results from the local communication network 20 that can be specified by searching from the transmission / reception result table shown in FIG. 9 are searched, the electronic mail from outside the local communication network 20 is relayed. The result of the e-mail from outside the local communication network 20 that is relaying is specified with respect to the latest e-mail result from the mail transmission date and time.

  Further, when the e-mail from outside the on-site communication network 20 is a reply e-mail to the e-mail destination, the e-mail being relayed is compared with the result of the e-mail that is the reply source. It is good also as specifying the track record. In this case, the e-mail destination address and the e-mail address of the e-mail addressed from outside the local area communication network 20 are read, and the results of e-mails transmitted from the address e-mail address to the source e-mail address are searched. Then, the record of the e-mail from outside the local communication network 20 that is being relayed is specified with respect to the retrieved result of the e-mail from within the local communication network 20 (S804). Further, for example, by recording the reference mail (References) information and the Message-ID information in the header information of the e-mail relayed by the mail server 24 in the transmission / reception record table, the e-mail record can be specified. It becomes possible to do. Specifically, by retrieving the reference mail information in the e-mail from outside the local communication network 20 that is relaying from the information of the Message-ID, the e-mail from the local communication network 20 that is the reply source The result of the e-mail from outside the local area communication network 20 is specified.

  In addition, when it is determined that a certain period has not elapsed by comparing the transmission date / time of the e-mail from the local communication network 20 and the transmission date / time of the e-mail from outside the local communication network 20 that is relaying In addition, for the e-mail from the local communication network 20, the results of the e-mail from outside the local communication network 20 may be specified.

  If the e-mail cannot be specified in S804, the process is terminated, and the mail server 24 stores the e-mail from the inside / outside the local communication network 20 to be relayed in the transmission / reception result table shown in FIG. The

  In the next step, S805, the sender domain of the email is extracted from the identified results of the email, and data including the extracted sender domain is transmitted to the verification policy setting server 25 (S805). The verification policy setting server 25 receives the data from the mail server 24 (S806), reads the transmission source domain (S807), performs the same processing as in the first embodiment, and verifies the verification server 23. A policy is set (S808 to S811).

  In the above embodiment, the verification policy is set by focusing on the transmission / reception results of e-mails between mail domains and the e-mail response results between e-mail addresses. The verification policy may be set by paying attention only to the result of the e-mail to be sent. In this case, the e-mail destination information read in S803 is transmitted to the verification policy setting server 25 without going through the step of S804 in FIG. 8 (S805).

  In this embodiment, the mail server 24 relays e-mails from inside and outside the local communication network 20, but the verification server 23 or the verification policy setting server 25 relays the e-mails and stores transmission / reception results, You may perform the process of the step of S802-S805. In addition, the verification policy setting server 25 relays the e-mail transmitted from the internal mail client 22, and sends the e-mail transmission / reception results and the electronic certificate from the inside and outside of the local communication network 20 to the mail server 24 etc. You may contact us. In this case, for example, the verification policy setting server 25 inquires of the mail server 24 about an email transmitted from the destination of the email relayed by the verification policy setting server 25, and the mail server 24 searches from the stored transmission / reception results. Then, the verification policy setting server 25 derives the information of the transmission source domain in such a manner that the mail server 24 transmits the transmission source domain of the searched e-mail to the verification policy setting server 25.

[Third Embodiment]
FIG. 10 is a modified example of the flow of the verification policy setting server of FIG. 6 in the first embodiment. The difference between the embodiment shown in FIG. 6 and FIG. 10 is that the former performs a process of aggregating positive reliability evaluation values from the internal mail client 22 and setting a verification policy setting table, whereas the latter is the latter. Is a process of setting the verification policy setting table by collecting the negative reliability evaluation values from the internal mail client 22.

  FIG. 10 is a flowchart in which the verification policy setting server 25 sets a verification policy for the verification server 23. First, the verification policy setting server 25 receives an evaluation message from the internal mail client 22 (S101).

  Next, the verification policy setting server 25 identifies the transmission source domain of the e-mail from the received evaluation message, and the identified transmission is stored in the verification policy setting table stored in the storage unit of the verification policy setting server 25. It is determined whether or not a record of the original domain exists (S102).

  Here, when the record of the sender domain does not exist in the verification policy setting table, a new record is added, and the mail address as the sender ID that sent the evaluation message from the internal mail client 22 is set for the verification policy setting. Store in the table. It is stored as an evaluation value, and the confidence level is set to 2 (S107). On the other hand, when the record of the transmission source domain exists in the verification policy setting table, the mail address of the internal mail client 22 that has transmitted the evaluation message is stored in the verification policy setting table, and the reliability evaluation value is subtracted by 1 point. (S103). Next, the reliability evaluation value obtained by subtracting one point in step S103 is compared with a threshold value set in advance by the administrator in the verification policy setting server 25 (S104). If it falls below the threshold, the confidence level of the record is changed to 1 (S105). And the process which updates the change location of the table for verification policy setting in each step of S103, S105, and S107 with respect to the corresponding part of the verification policy memorize | stored in the verification server 23 is performed (S106).

  As described above, the processing of the verification server 23 using the verification policy set as shown in FIG. 10 is, for example, “E-mail sent from a mail domain whose trust level is not 1 verifies the electronic signature. The e-mail transmitted from the mail domain having the trust level of 1 is transferred to the mail server 24 without verifying the electronic signature ”.

  In the above first to third embodiments, the verification policy corresponding to the trust level is set with two trust levels, but a plurality of threshold values are stored in the verification policy setting server 25, and the multi-step trust level is set. And a verification policy corresponding to each stage may be set.

  In the above first to third embodiments, when the administrator of the verification policy setting server 25 already has a verification policy setting table for which a reliability evaluation value for each transmission source domain is required, By changing the threshold value for determining the trust level, it is possible to control the trust level of each transmission source domain and set the verification policy appropriately.

  In the first to third embodiments, the verification server 23, the mail server 24, and the verification policy setting server 25 do not have to be configured separately, and any two servers are configured as a single unit. It may be. Further, the verification policy setting server 25 may be configured to set verification policies for a plurality of verification servers 23.

  In addition, although the verification policy in the above-described first to third embodiments associates a transmission source domain with a trust level, the verification policy includes an e-mail condition other than the transmission source domain, a trust level, and an e-mail processing method. May be associated with each other. The e-mail conditions other than the sender domain include, for example, contents described in header fields such as a mail account, e-mail address, affiliation / organization (Organization), and transmission date / time (Date) in the sender (From) of the e-mail. In addition, the contents described in an electronic certificate necessary for signature verification processing of an electronic signature attached to an electronic mail, such as a certificate authority (CA), are also included. The certificate authority that is the issuer of the electronic certificate can be identified by referring to the electronic certificate attached to the public key corresponding to the private key that encrypts the electronic signature attached to the electronic mail. . In the verification policy, the email condition associated with the trust level corresponding to the email processing method is not the above email condition alone, but a combination of the source domain and the certificate authority. Also good.

It is a figure which shows the whole structure of the information processing system containing the verification policy management system concerning embodiment of this invention. It is a figure which shows an example of a verification policy. It is a functional block diagram which shows the function of a verification policy setting apparatus. It is a figure which shows an example of the table for a verification policy setting. It is a functional block diagram which shows the function of an internal mail client apparatus. It is a flowchart which shows an example of the process performed by the verification policy setting apparatus concerning embodiment of this invention. It is a flowchart which shows an example of the process performed by the verification server concerning embodiment of this invention. It is a flowchart which shows an example of the process performed by the internal mail client apparatus, mail server apparatus, verification policy setting apparatus, and verification server apparatus concerning embodiment of this invention. It is a figure which shows an example of the table of a transmission / reception track record. It is a flowchart which shows the modification of the process performed by the verification policy setting apparatus concerning embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Information processing system, 12 Wide area network (Wide area network), 14 External mail client, 20 Local area network (Local area network), 21 Router, 22 Internal mail client, 22A E-mail transmission / reception part, 22B Evaluation message generation part, 22C evaluation message transmission unit, 23 verification server, 24 mail server, 25 verification policy setting server, 25A evaluation message reception unit, 25B common reliability evaluation unit, 25C policy setting unit, 25X data analysis unit, 25Y policy update control unit, 25Z Reliability evaluation department.

Claims (12)

Receive an email sent to one of the email recipients belonging to the given email recipient group, and receive the email according to the verification policy indicating the email condition with the given reliability In a verification policy setting device that sets the verification policy for a verification server device that performs processing,
Individual reliability information receiving means for receiving individual reliability information for specifying a condition satisfied by an e-mail having the predetermined reliability, which is transmitted in response to a predetermined operation by each e-mail recipient;
Common reliability evaluation means for evaluating the reliability of an e-mail satisfying the condition specified by the individual reliability information based on the plurality of individual reliability information specifying the condition;
Policy setting means for setting the verification policy that is commonly applied to a plurality of e-mail recipients belonging to the predetermined e-mail recipient group according to the evaluation result of the common reliability evaluator;
A verification policy setting device comprising: In the verification policy setting device according to claim 1,
Each individual reliability information indicates a condition that an email determined to have the predetermined reliability by each email recipient is satisfied.
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to claim 2,
The condition indicated by each individual reliability information is generated so that the received e-mail is satisfied according to the e-mail received by each e-mail recipient.
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to claim 1,
Each individual reliability information specifies an e-mail addressed to a destination of an e-mail transmitted by each e-mail recipient,
The common reliability evaluation means derives a condition satisfying the e-mail specified by each individual reliability information, and specifies the e-mail satisfying the condition as the e-mail reliability satisfying the condition. Evaluating based on a plurality of the individual reliability information
The verification policy setting apparatus characterized by the above-mentioned. The verification policy setting device according to claim 4,
Each individual reliability information identifies an email that has already been sent from an email destination sent by the email recipient.
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to claim 4 or 5,
Each individual reliability information estimates an email to be sent in the future from an email destination sent by the email recipient.
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to any one of claims 1 to 6,
The common reliability evaluation unit stores, for each condition specified by the individual reliability information, an evaluation value indicating a degree to which an email satisfying the condition has the predetermined reliability, and specifies the condition Updating the evaluation value based on the individual reliability information, and evaluating the reliability of an email satisfying the condition according to the updated evaluation value.
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to any one of claims 1 to 7,
The conditions specified by each individual reliability information are attached to the email address of the email sent to each email recipient, the email domain of the email sender, or the email. Including a condition relating to at least one piece of information related to a certificate authority that issues an electronic certificate for a public key corresponding to the electronic signature,
The verification policy setting apparatus characterized by the above-mentioned. In the verification policy setting device according to any one of claims 1 to 8,
The policy setting means, according to the individual reliability information received by the individual reliability information receiving means, until the verification policy that is commonly applied to the plurality of email recipients is set. Set the verification policy to be applied to the email recipient that is the source of the reliability information;
The verification policy setting apparatus characterized by the above-mentioned. Multiple mail client devices;
A verification server device that receives an email transmitted to each of the mail client devices and processes the email according to a verification policy indicating a condition of the email having a predetermined reliability;
A verification policy setting device for setting the verification policy in the verification server device;
A verification policy management system comprising:
Each of the mail client devices is
Including individual reliability information transmitting means for transmitting individual reliability information for specifying a condition that the e-mail having the predetermined reliability satisfies in accordance with a predetermined operation by a user of the mail client device,
The verification policy setting device includes:
Individual reliability information receiving means for receiving the individual reliability information;
For each condition specified by the individual reliability information, common reliability evaluation means for evaluating the reliability of an email satisfying the condition based on the individual reliability information specifying the condition;
Policy setting means for setting a verification policy that is commonly applied to a plurality of e-mail recipients belonging to a predetermined e-mail recipient group according to the evaluation result of the common reliability evaluator.
A verification policy management system characterized by that. The verification policy management system according to claim 10,
Each of the mail client devices is
In accordance with what is determined by the user of the mail client device to have the predetermined reliability among the emails received by the mail client device, a condition that satisfies the determined email is generated and generated Further comprising individual reliability information generating means for generating the individual reliability information to indicate a condition to be performed,
A verification policy management system characterized by that. Receive an email sent to one of the email recipients belonging to the given email recipient group, and receive the email according to the verification policy indicating the email condition with the given reliability A program for causing a computer to function as a verification policy setting device that sets the verification policy for a verification server device that performs processing,
Individual reliability information receiving means for receiving individual reliability information for specifying a condition satisfied by the e-mail having the predetermined reliability, which is transmitted in response to a predetermined operation by each e-mail recipient;
For each condition specified by the individual reliability information, common reliability evaluation means for evaluating the reliability of an email satisfying the condition based on the individual reliability information specifying the condition, and
Policy setting means for setting a verification policy that is commonly applied to a plurality of e-mail recipients belonging to the predetermined e-mail recipient group, according to the evaluation result of the common reliability evaluator;
A program for causing the computer to function as

Images