JP2010102592A - Electronic mail check-up device, control method therefor, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve the efficiency of the check-up operation of an auditor who checks up electronic mails. <P>SOLUTION: This electronic mail check-up device which is able to communicate with a manager terminal that is used by a manager who check up electronic mail is characterized to acquire the schedule information of a manager; to store electronic mail and evaluation information, showing the need for the auditing of the electronic mail; to specify the electronic mail to be audited from among the stored electronic mails, in accordance with the acquired schedule information and the evaluation information of the electronic mail; and to transmit the data of specified electronic mail to be audited to the manager terminal. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technology that makes it possible to set whether or not auditing is performed up to another email in the same thread as the email to be audited.

  In recent years, leakage of personal information and confidential information has been affecting corporate trust. Information leakage may occur due to unauthorized access from the outside, but most are caused by carelessness of people inside the company, and information leakage is caused by inadvertent transmission of files using e-mail, etc. I sometimes get up. Since the Personal Information Protection Law was enforced in 2005, it has become an urgent task for companies to take measures against information leakage.

  Therefore, when an e-mail is sent from an internal network to an external network, measures against information leakage are introduced, such as by introducing an e-mail audit system that decides whether or not to permit delivery according to the content of the e-mail. I have taken.

  In addition, emails sent from corporate mail servers can be saved as log data, and in the unlikely event that a leak occurs, it is possible to investigate afterwards what kind of situation has occurred. I am doing so.

  In such a system, a keyword or the like is set, and mail that uses the keyword is made undeliverable, or delivery is permitted to the superior (administrator) of the employee who sent the e-mail. In general, a notification is sent to make a selection, and mail transmission control is performed according to the selection by the administrator.

As such prior art, Patent Document 1 discloses a mechanism for checking in advance the content of a mail to be transmitted and preventing an undesired mail from being transmitted in advance.
JP 2007-272607 A

  However, conventionally, even if the number of e-mails to be audited increases, only the e-mails to be audited are displayed, so the administrator should determine which e-mail should be audited first. It's hard to understand.

  In addition, for example, even if the administrator has little time to perform the auditing work, many audited e-mails are displayed. It's hard to tell if you should do it.

  Furthermore, as the number of e-mails audited (evaluated) by the auditor increases, the burden on the auditor increases.

  An object of the present invention is to provide a mechanism for improving the efficiency of audit work performed by an inspector who audits electronic mail.

  The present invention is an e-mail auditing apparatus capable of communicating with an administrator terminal used by an administrator who conducts e-mail auditing, and a schedule for acquiring the schedule information from schedule storage means in which the administrator's schedule information is stored Stored in the e-mail storage means, the e-mail storage means for storing the acquisition means, the e-mail, and the evaluation information indicating the necessity of audit of the e-mail, and the schedule information acquired by the schedule acquisition means According to the evaluation information of the e-mail, the specifying unit for specifying the audit target e-mail from the e-mails stored in the e-mail storage unit, and the audit target e-mail data specified by the specifying unit Transmission means for transmitting to the administrator terminal.

  ADVANTAGE OF THE INVENTION According to this invention, the audit work of the auditor who audits an electronic mail can be made efficient.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments to which the invention is applied will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram showing a configuration of an information processing system according to an embodiment of the present invention. In FIG. 1, reference numeral 101 denotes an electronic mail monitoring server. The e-mail monitoring server 101 stores the e-mail storage process instructed to be transmitted from the local network 105 to the wide-area line 120, the transmission permission / rejection determination / holding determination process, the transmission permission / rejection determination, and the conditions for determining the hold.・ Has a function to change. The e-mail monitoring server 101 has a configuration as an application example of the e-mail auditing apparatus of the present invention.

  The e-mail monitoring server 101 records a group configuration table and its representative in time series (a group information table 1601 and a management target definition information table 1602 shown in FIG. 16 to be described later), and according to the data It also has a function to determine the administrator who conducts an email audit.

  Reference numeral 102 denotes an electronic mail server. For example, the electronic mail server 102 transmits and receives mail between the information processing apparatus 104-1 and the information processing apparatus 104-2. The e-mail server 102 manages mail transmission / reception between the information processing apparatus 104-1 and an apparatus outside the local area network 105 (information processing apparatus 114 in the figure). As described above, the e-mail server 102 performs a process of transmitting mail to the transmission destination specified by the mail address. Since such a series of processes performed by the e-mail server 102 is well known, further explanation is omitted.

  Reference numeral 103 denotes an LDAP server that provides a directory service for managing corporate directory information, that is, corporate directory information such as a mail address of a user who uses a network and information on an organization. The directory service applicable to the present invention is not limited to LDAP, but may be other services. For example, it may be Active Directory or NDS (NetWare Directory Service). LDAP is an abbreviation for Lightweight Directory Access Protocol.

  Reference numerals 104-1, 104-2, and 104-3 are information processing apparatuses, which are ordinary computers, and have an e-mail transmission / reception function. Further, the information processing apparatuses 104-1, 104-2, and 104-3 operate as Web service clients.

  The information processing apparatus 104-3 is a terminal used by an administrator, and is a terminal that audits an email whose transmission is suspended by the email monitoring server 101 and an audit of the transmitted email. In this embodiment, the information processing apparatus 104-3 is described as a terminal used by an administrator.

  Further, the schedule management server 106 is a server that manages the schedule (schedule) of the administrator, and stores a schedule event information table shown in FIG.

  The schedule management server 106, the information processing device 104-1, the information processing device 104-2, the information processing device 104-3, the e-mail audit server 101, and the e-mail server 102 can communicate with each other via the local network 105. It is connected.

  The schedule management server 106 has a function of transmitting, to the e-mail audit server 101, information on an administrator's schedule (schedule) stored in the schedule event information table in response to a request from the e-mail audit server 101. Furthermore, the schedule management server 106 has a WEB service function, and in response to a request from the browser software provided in the administrator terminal 104-3, the schedule of the administrator of the administrator terminal 104-3 is assigned to the administrator terminal 104-. 3, a function of transmitting by a communication protocol such as HTTP, and a function of registering the schedule in the schedule event information table when the administrator's schedule input to the administrator terminal 104-3 is received from the administrator terminal 104-3. I have.

  An information processing device 114 and an e-mail server 112 are connected to the local network 115, which are the same as the information processing device 104, the e-mail server 102, and the local area network 105, respectively, and description thereof is omitted. To do.

  FIG. 2 is a block diagram showing a basic configuration of the email monitoring server 101 shown in FIG. In FIG. 2, reference numeral 201 denotes a CPU that controls the entire email monitoring server 101 using programs and data stored in the RAM 202 and the ROM 203 and executes each process described below performed by the email monitoring server 101. .

  A RAM 202 includes an area for temporarily storing programs and data loaded from the HDD 204 and the recording medium drive 206, and data received via the network I / F (interface) 205, and the CPU 201 has various types of data. The work area used when executing the process is provided.

  A ROM 203 stores setting data, a boot program, and the like of the e-mail monitoring server 101.

  Reference numeral 204 denotes an HDD, which stores an OS (Operating System) and programs and data for causing the CPU 201 to execute each process described later performed by the e-mail monitoring server 101. Some or all of these programs and data are loaded into the RAM 202 in accordance with the control of the CPU 201, and the CPU 201 performs processing using this, whereby the e-mail monitoring server 101 executes each processing described below.

  Reference numeral 205 denotes a network I / F for connecting the e-mail monitoring server 101 to the local area network 105, and the e-mail monitoring server 101 performs data communication with an external device via the network I / F 205. Can do.

  Reference numeral 206 denotes a recording medium drive, which reads out programs and data recorded on a storage medium such as a CD-ROM, CD-R / RW, DVD-ROM, DVD-R / RW, and DVD-RAM and outputs them to the RAM 202. This reading operation is controlled by the CPU 201.

  A keyboard 207 can input various instructions to the CPU 201. A pointing device 208 such as a mouse can input various instructions to the CPU 201.

  Reference numeral 209 denotes a video I / F (interface) which functions as an I / F for supplying an image to be displayed on the display device 210 to the display device 210 as a signal.

  A display device 210 includes a CRT, a liquid crystal screen, and the like, and can display a processing result by the CPU 201 using an image, characters, or the like.

  Reference numeral 211 denotes a peripheral device I / F, which includes a USB port, an IEEE1394 port, and the like, and can be connected to the peripheral device via the peripheral device I / F 211. The connection form with the peripheral device may be wired or wireless. A bus 212 connects the above-described units.

  The electronic mail servers 102 and 112, the schedule management server 106, the LDAP server 103, and the information processing apparatuses 104 and 114 shown in FIG. 1 have the same configuration.

  FIG. 3 is a block diagram showing the characteristic part of the functional configuration of the e-mail monitoring server 101 in this embodiment.

  As shown in FIG. 3, the email monitoring server 101 includes an acquisition unit 301, a reception unit 302, a schedule acquisition unit 303, an audit target determination unit 304, an image information generation unit 305, and an evaluation unit 306 as characteristic function configurations. A storage unit 307 and a transmission unit 308.

  The acquisition unit 301 acquires an e-mail from the e-mail server 102 (112). The receiving unit 302 receives an audit request and an audit result from the administrator terminal. Further, the schedule acquisition unit 303 acquires the administrator's schedule information (plan) from the schedule management server 106. Further, the audit target determination unit 304 determines (identifies) an email to be audited by the administrator from the administrator's schedule information and evaluation information (estimated evaluation value) or thread evaluation information (thread estimated evaluation value). The image information generation unit 305 generates an audit target e-mail list screen specified by the audit target determination unit 304. The evaluation unit 306 executes an evaluation process. The storage unit 307 stores a log table, a thread management table, group information, management target definition information, a remaining time-audit scenario correspondence table, a schedule definition table, and a schedule event table. Further, the transmission unit 308 transmits the audit target electronic mail list screen generated by the image information generation unit 305 to the administrator terminal so as to be displayed on the administrator terminal.

  FIG. 4 is a sequence chart showing the operation of the information processing system according to the embodiment of the present invention. Here, a case will be described in which information processing apparatus 104-1 instructs external information processing apparatus 114 to transmit an e-mail.

  First, when the information processing apparatus 104-1 transmits an e-mail (step S401), the e-mail server 102 that has acquired the e-mail transmits the e-mail to the e-mail monitoring server 101 (step S402).

  Then, when the e-mail monitoring server 101 acquires the e-mail, whether or not the e-mail matches a filtering rule (transmission disable condition or transmission hold condition shown in FIG. 25) stored in the e-mail monitoring server 101. Determine whether.

  Here, the case where the e-mail monitoring server 101 acquires an e-mail to be transmitted from the information processing apparatus 104-1 to the external information processing apparatus 114 has been described. However, the e-mail monitoring server 101 may acquire an e-mail addressed to the information processing apparatus 104-1 transmitted from the external information processing apparatus 114. Of course, the configuration may be such that the e-mail monitoring server 101 acquires an e-mail transmitted from the information processing apparatus 104-1 to the information processing apparatus 104-2 and determines whether or not the filtering rule is met.

  Here, the transmission disabling condition (a) and the transmission hold condition (b) shown in FIG. 25 will be described. FIG. 25A is an example of a transmission disabling condition that is a filtering rule. FIG. 25A shows an example of condition 1, condition 2, condition 3, condition 4, condition 5, and five transmission disabled conditions.

  The CPU 201 of the e-mail monitoring server 101 determines whether the transmitted e-mail is an e-mail that meets any one of the five conditions. If they match, the CPU 201 of the email monitoring server 101 cancels the transmission of the email and notifies the information processing apparatus 104-1 that is the transmission source that the transmission of the email has been stopped (step). S403).

  Each condition of the transmission disabling condition (a) shown in FIG.

  Condition 1: “*** 1.co.jp” (predetermined domain name) is included in the mail address of the e-mail destination.

  Condition 2: A predetermined character string “XX company” is included in the mail text of the e-mail.

  Condition 3: A predetermined character string “confidential” is included in the attached data of the e-mail.

  Condition 4: The total file size of the attached data of the e-mail exceeds 1 MB (megabyte).

  Condition 5: “*** 2.co.jp” (predetermined domain name) is included in the mail address of the e-mail destination, and a predetermined character string “△ Company” is included in the mail body of the e-mail. A predetermined character string “confidential” is included in the attached data of the e-mail, and the total file size of the attached data of the e-mail exceeds 0.9 MB (megabytes).

  Next, the transmission suspension condition shown in FIG. FIG. 25B is an example of a transmission suspension condition that is a filtering rule. FIG. 25B shows an example of condition 1, condition 2, condition 3, condition 4, condition 5 and five transmission suspension conditions.

  The CPU 201 of the e-mail monitoring server 101 determines whether or not the acquired e-mail is an e-mail that matches any one of the five conditions. If it is determined that the e-mail matches, the CPU 201 does not send the e-mail and holds it. To do. That is, the electronic mail is stored in storage means such as the HDD 204 or the RAM 202 of the electronic mail monitoring server 101.

  As described above, when the transmission monitoring condition is satisfied, the CPU 201 of the email monitoring server 101 determines that the email is an email that needs to be audited by the administrator, and requests the administrator terminal to make a pre-audit request. (Step S405).

  Hereinafter, each condition of the transmission suspension condition shown in FIG. 25 (b) will be described.

  Condition 1: “tana@***.co.jp” (predetermined mail address) is included in the mail address of the e-mail destination.

  Condition 2: A predetermined character string “XX company” is included in the mail text of the e-mail.

  Condition 3: A predetermined character string “limited to related parties” is included in the attached data of the e-mail.

  Condition 4: The total file size of the attached data of the e-mail exceeds 0.7 MB (megabytes).

  Condition 5: “*** 2.co.jp” (predetermined domain name) is included in the mail address of the e-mail destination, and a predetermined character string “△ Company” is included in the mail body of the e-mail. A predetermined character string “copy prohibited” is included in the attached data of the e-mail, and the total file size of the attached data of the e-mail exceeds 0.5 MB (megabytes).

  In addition, the CPU 201 of the email monitoring server 101 determines whether the email transmitted from the information processing apparatus 104-1 is in either the transmission disabled condition (FIG. 25 (a)) or the transmission suspension condition (FIG. 25 (b)). If it is determined that the condition is not met, the electronic mail is transmitted to the information processing apparatus 114 via the external network (wide area line) 120 (step S404).

  As described above, the CPU 201 of the e-mail monitoring server 101 transmits (relays) the e-mail to the destination set in the e-mail according to the acquired e-mail data, the transmission disabled condition, and the transmission hold condition. Or, it is determined whether to hold without transmitting or to cancel without transmitting.

  When the transmission of the e-mail is suspended, the CPU 201 of the e-mail monitoring server 101 causes the administrator to perform a preliminary audit (steps S405 to S408).

  Specifically, the CPU 201 of the email monitoring server 101 makes an audit request for the email to the administrator terminal 104-3 (step S405).

  When the CPU 201 of the administrator terminal 104-3 receives the audit request, the CPU 201 displays the fact that the audit request has been received on the display device 210 of the administrator terminal 104-3.

  When the CPU 201 of the administrator terminal 104-3 receives an instruction to display a list screen of emails to be pre-audited from the administrator, the CPU 201 requests the email monitoring server 101 to display a list of emails to be pre-audited ( Step S406).

  The CPU 201 of the e-mail monitoring server 101 that has received the e-mail list display request displays a list display screen (FIG. 10) (hereinafter also referred to as a pre-audit screen) of e-mails whose transmission is suspended and to be pre-audited. Information to be generated, and the generated information is transmitted to the administrator terminal 104-3 (step S407).

  Next, the CPU 201 of the administrator terminal 104-3 displays a list display screen of e-mails to be pre-audited based on the information, and accepts whether or not the displayed e-mail can be transmitted from the administrator. Then, the CPU 201 of the administrator terminal 104-3 transmits the result of the pre-audit received from the administrator (whether the electronic mail can be transmitted or suspended) to the electronic mail monitoring server 101 (step S408).

  The CPU 201 of the e-mail monitoring server 101 that has received the result of the preliminary audit stores the result in a storage unit such as the HDD 204 and executes processing corresponding to the result.

  That is, if transmission of an email is permitted, the CPU 201 of the email monitoring server 101 transmits the email to the information processing apparatus 114 (step S404). On the other hand, if the transmission of the e-mail is rejected, the CPU 201 of the e-mail monitoring server 101 stops the transmission of the e-mail and notifies the information processing apparatus 104-1 to that effect (step S403). If the transmission of the email is suspended, the CPU 201 of the email monitoring server 101 stores the email in the storage unit such as the HDD 204 as the email to be pre-audited.

  As described above, in the present embodiment, it is determined whether to transmit (relay) an e-mail according to the transmission disabling condition and the transmission suspension condition or the administrator's determination in the preliminary audit.

  However, since the information processing system according to the present embodiment is intended to perform “audit” related to transmission / reception of electronic mail, it is required that the administrator himself / herself audits as much as possible.

  In other words, it is necessary to audit (recognize) after the determination whether the e-mail can be transmitted (relayed) or the e-mail that should be stopped. .

  The outline of the post-audit will be described below using steps S409 to S411 shown in FIG.

  The CPU 201 of the administrator terminal 104-3 transmits a request for performing post-audit to the electronic mail monitoring server 101 (step S409). Upon receiving the request, the CPU 201 of the email monitoring server 101 generates information for displaying a list display screen (FIG. 19) of emails to be audited, and uses the generated information as the administrator terminal 104-3. (Step S410).

  Then, the CPU 201 of the administrator terminal 104-3 displays a list display screen of emails to be audited based on the information, and receives evaluation of the displayed emails from the administrator. Here, as an evaluation result received from the administrator, for example, “transmission allowed / transmission rejected / check required / neither” can be cited. Then, the CPU 201 of the administrator terminal 104-3 transmits the evaluation result of the email received from the administrator to the email monitoring server 101 (step S411).

  The CPU 201 of the e-mail monitoring server 101 that has received the e-mail evaluation result stores the evaluation result in a storage unit such as the HDD 204 in association with the e-mail.

  In the following, with reference to FIG. 5, the e-mail storage process and the transmission permission / inhibition determination process performed by the e-mail monitoring server 101 will be described.

  FIG. 5 is a flowchart showing an email storage process and a transmission permission / inhibition determination process performed by the email monitoring server 101. This process is performed by the CPU 201 of the e-mail monitoring server 101 according to control by a program recorded in the HDD 204. Further, the HDD 204 of the email monitoring server 101 temporarily suspends the transmission of the email for the transmission disabling condition (FIG. 25A) indicating the condition for stopping the transmission of the email (not relaying) and the preliminary audit. A transmission hold condition (FIG. 25B) indicating the condition is stored. The filtering rule is stored in the HDD 204. The HDD 204 of the email monitoring server 101 stores group information (group information 1601 shown in FIG. 16 described later) and manager information (managed object definition information 1602 shown in FIG. 16 described later). In the present embodiment, it is possible to specify the group to which the mail sender belongs and the manager of the group using this group information.

  First, the CPU 201 of the email monitoring server 101 obtains an email (SMTP packet) sent from the network 105 to the wide area line 120 from the email server 102 (step S501). In the present embodiment, a case where an e-mail sent to the wide area line 120 is acquired will be described. However, whether or not the CPU 201 of the email monitoring server 101 obtains an email received from the email server 112 via the wide area line 120 and sends the email to the local network 105 based on the filtering rule. You may judge.

  Next, the CPU 201 of the email monitoring server 101 registers information (Message-ID) that identifies the email included in the header information of the email acquired in step S501 in the thread management table (FIG. 7) (step 7). S502). Detailed processing in step S502 will be described later with reference to FIG. The thread management table shown in FIG. 7 is a configuration that is an application example of the management means of the present invention.

  Next, the CPU 201 of the e-mail monitoring server 101 determines whether or not the e-mail acquired in step S501 matches the transmission disabling condition (FIG. 25A) that is a filtering rule stored in the HDD 204. (Step S503).

  If the CPU 201 of the e-mail monitoring server 101 determines that the e-mail acquired in step S501 matches the transmission disabled condition (YES in step S503), the CPU 201 moves the process to step S504, and Transmission is stopped (step S504).

  Then, the CPU 201 of the e-mail monitoring server 101 transmits an e-mail to the effect that the e-mail has not been transmitted because the e-mail sender address is met because the e-mail sender address is met (step S505).

  If it is determined in step S503 that the e-mail acquired in step S501 does not match the transmission disabling condition (NO in step S503), the CPU 201 of the e-mail monitoring server 101 determines that the e-mail acquired in step S501 is pending transmission. It is determined whether the condition (FIG. 25B) is met (step S506).

  If it is determined in step S506 that the email acquired in step S501 does not match the transmission suspension condition (NO in step S506), the CPU 201 of the email monitoring server 101 sends the email to the wide area line 120. It is sent out (step S507). Here, in the case of the electronic mail received (acquired) from the wide area network 120 in step S501, the electronic mail is transmitted (relayed) to the local area network 105.

  On the other hand, if it is determined in step S506 that the transmission suspension condition is met (YES in step S506), the CPU 201 of the email monitoring server 101 “holds” the email transmission processing acquired in step S501. (Step S508), and the process proceeds to step S509.

  Note that the e-mail suspended here becomes an e-mail subject to a pre-inspection in which the administrator of the e-mail sender makes an instruction to determine whether transmission is possible / not possible after visual confirmation.

  Next, the CPU 201 of the email monitoring server 101 identifies the sender of the email (step S509).

  The sender of the mail is specified by acquiring the mail address of the sender of the electronic mail from the header information of the electronic mail and specifying the user to whom the mail address is assigned.

  Then, the CPU 201 of the email monitoring server 101 identifies the sender of the email (sender), and then identifies the administrator of the email sender (step S510).

  This is based on group information (group information 1601 shown in FIG. 16 described later) and administrator information (managed object definition information 1602 shown in FIG. 16 described later) stored in the HDD 204 of the email monitoring server 101. This is done by specifying the manager of the group to which the sender belongs.

  Here, the group information 1601 and the management target definition information 1602 illustrated in FIG. 16 will be described.

  The group information 1601 stores at least “group name”, “valid period”, “mail address”, and “user name (not shown) to which a mail address is assigned” corresponding to each other.

  Therefore, it is possible to specify the group name to which the user belongs from the user's mail address or user name. The “valid period” indicates a period in which each user belongs to the group. That is, for example, in the case of the first record, the user “alice@example.com” (mail address) belongs to “Group-A” (group name) from January 1, 2006 to March 31, 2006. It shows that it was. Further, a record in which no end date is input indicates that the user set in the record still belongs to the group set in the record.

  The management target definition information 1602 corresponds to “manager ID”, “management target group” (corresponding to the item “group name” of the group information 1601), “validity period”, and “the manager ID”. "Mail address (not shown)" is stored correspondingly. Therefore, by referring to the management target definition information 1602, it is possible to specify the manager of each group or the mail address of the manager.

  That is, by referring to the group information 1601 and the management target definition information 1602, the manager (group manager) of the group to which the sender of the e-mail belongs and the mail address of the group manager can be specified. Is possible.

  Next, the CPU 201 of the e-mail monitoring server 101 notifies the administrator terminal 104-3 of the administrator identified in step S510 so as to perform e-mail pre-inspection. As this notification, for example, the CPU 201 of the e-mail monitoring server 101 may send an e-mail indicating that a pre-audit is to be performed to the e-mail address assigned to the administrator. Further, the mail address assigned to the administrator may be specified from data stored in the LDAP server 103.

  Further, when the administrator logs in to the application of the e-mail monitoring server 101, a message may be displayed so that pre-audit of the e-mail is performed.

  Then, after executing any one of steps S504, S508, and S507, the CPU 201 of the e-mail monitoring server 101 stores (saves) the e-mail acquired in step S501 in a storage unit such as the HDD 204. At that time, the CPU 201 of the e-mail monitoring server 101 sets the e-mail filtering result (data indicating the state of sending / holding / deleting) in association with the e-mail (stored in the HDD 204) (step S511). ).

  That is, after executing step S504, data indicating “deletion (not transmitted)” when transmission of an electronic mail is stopped is set in association with the electronic mail as a filtering result. After executing step S508, data indicating “hold” when the transmission of the electronic mail is suspended is set in association with the electronic mail as a filtering result. After executing step S507, data indicating “sending” in the case of transmitting an e-mail is set in association with the e-mail as a filtering result.

  Specifically, the electronic mail (data constituting the electronic mail) acquired in step S501 and the filtering result are stored (saved) in the log table shown in FIG.

  In FIG. 9, the mail ID of the e-mail, each data composing the e-mail (sender's e-mail address, e-mail address of the recipient, e-mail body, attached file, transmission date / time, etc.) and filtering result correspond respectively And remembered.

  In step S511, the CPU 201 of the email monitoring server 101 registers the email ID numbered in step S602 (FIG. 6), which will be described later, in the email ID of the email included in the log table (FIG. 9). After the process of step S511, this process ends.

  FIG. 6 is a flowchart showing detailed processing in step S502 of FIG. Note that the CPU 201 of the email monitoring server 101 executes the processing from step S601 to step S612 shown in FIG.

  Steps S601 and S612 in FIG. 6 mean that the processing from step S602 to step S611 or S608 is repeatedly executed for all emails acquired by the CPU 201 of the email monitoring server 101.

  The CPU 201 of the email monitoring server 101 assigns a unique email ID to the email acquired in step S501 (step S602).

  The CPU 201 of the email monitoring server 101 obtains MESSAGE-ID, which is data unique to the email added to the email, from the header information of the email obtained in step S501 (step S603).

  Next, the CPU 201 of the email monitoring server 101 sets (registers) the MESSAGE-ID acquired in step S603 in the thread management table shown in FIG. 7 in association with the mail ID numbered in step S602 (step S604). ).

  Then, the CPU 201 of the e-mail monitoring server 101 searches for “In-Reply-To” contained in the reply mail in the header information of the e-mail acquired in step S501 (step S605).

  Next, the CPU 201 of the email monitoring server 101 determines whether or not “In-Reply-To” has been searched in step S605 (step S606). That is, it is determined whether or not the electronic mail is a reply mail.

  If the CPU 201 of the e-mail monitoring server 101 determines that it is a reply mail in step S606 (when it is determined that “In-Reply-To” exists) (YES in step S606), the “In-Reply” The MESSAGE-ID of “-To” is searched from the thread management table (FIG. 7) (step S607).

  Then, the CPU 201 of the e-mail monitoring server 101 determines whether or not the MESSAGE-ID of the “In-Reply-To” has been searched in step S607 (step S609). That is, it is determined whether or not a parent mail corresponding to the electronic mail is registered in the thread management table.

  If the CPU 201 of the email monitoring server 101 determines in step S609 that the MESSAGE-ID of the “In-Reply-To” has been retrieved (the parent email corresponding to the email is registered in the thread management table). If it is determined that the thread ID associated with the searched MESSAGE-ID is obtained from the thread management table, the obtained thread ID is associated with the MESSAGE-ID set in step S604. At the same time, it is registered (set) in the thread management table (step S610). The thread ID is a configuration that is an application example of the thread identification information of the present invention.

  Next, the CPU 201 of the electronic mail monitoring server 101 acquires the mail ID corresponding to the MESSAGE-ID of the parent mail searched and identified in step S607 from the thread management table. Then, the CPU 201 of the email monitoring server 101 registers the acquired mail ID as a “parent mail ID” in the thread management table in association with the MESSAGE-ID set in step S604 (step S611). The parent mail ID is a configuration that is an application example of the parent mail identification information of the present invention.

  On the other hand, if it is determined in step S606 that “In-Reply-To” has not been searched in step S605 (if it is determined not to be a reply mail) (NO in step S606), the process proceeds to step S608. In step S609, when it is determined that the MESSAGE-ID of “In-Reply-To” has not been searched (when it is determined that the parent mail corresponding to the e-mail is not registered in the thread management table). (NO in step S609) also shifts to the processing in step S608.

  In step S608, the CPU 201 of the email monitoring server 101 assigns a unique new thread ID, and sets (registers) the thread ID in association with the MESSAGE-ID set in step S604 (step S608).

  As a result, each piece of data indicating the relationship of each email thread can be registered in the thread management table shown in FIG.

  FIG. 18 is a diagram illustrating an example of part of header information of an electronic mail and a parent mail of the electronic mail.

  18 shows a part of header information of the e-mail, and 1801 of FIG. 18 shows a part of header information of the parent mail of the e-mail. As indicated by 1802, “In-Reply-To” is added to the header information of the e-mail. Accordingly, in step S606, the electronic mail is determined as a reply mail. Also, since the MESSAGE-ID of “In-Reply-To” of the e-mail is registered in the header information of 1801, if the same MESSAGE-ID is registered in the thread management table, the process proceeds to step S609. Thus, it is determined that the parent mail of the electronic mail is registered in the thread management table.

  FIG. 7 is a diagram showing a thread management table stored in a storage unit such as the HDD 204 of the email monitoring server 101.

  The thread management table has items of mail ID, parent mail ID, thread ID, and MESSAGE-ID.

  The MESSAGE-ID is information unique to each e-mail as described above, and is represented by, for example, each symbol as shown in FIG.

  The mail ID is unique information for identifying each electronic mail in the thread management table.

  The thread ID is information for identifying whether each electronic mail is an electronic mail of the same thread. In the example of FIG. 7, the same thread ID indicates that the electronic mail is the same thread.

  Next, the parent mail ID will be described. In the example of FIG. 7, the electronic mail of the first record indicates that it is the original electronic mail (parent mail) transmitted first because there is no parent mail ID. In the second record, since the mail ID of the first record is registered in the parent mail ID field, the second record e-mail indicates that it is a reply e-mail of the first record e-mail.

  FIG. 8 is a flowchart showing detailed processing of the pre-audit (steps S405 to S408) shown in FIG. 4, and shows processing for the administrator to perform pre-audit of e-mail. Note that the processing of steps S801 and S805 to 810 is executed by the CPU 201 in accordance with control by a program recorded in the HDD 204 of the administrator terminal 104-3. Further, the processing of steps S802 to 804 and S811 to 817 is executed by the CPU 201 in accordance with control by a program recorded in the HDD 204 of the e-mail monitoring server 101.

  First, the CPU 201 of the administrator terminal 104-3 transmits a request for performing a pre-audit to the e-mail monitoring server 101 (step S801).

  When the CPU 201 of the e-mail monitoring server 101 receives a request for performing the preliminary audit from the administrator terminal 104-3 (step S802), the CPU 201 first checks the authority of the user who has made the request.

  Here, the CPU 201 of the e-mail monitoring server 101 determines whether the user has group administrator authority based on the management target definition information 1602 recorded in the storage unit such as the HDD 204. . Specifically, it is determined whether the user ID (administrator ID) included in the request data received in step S802 is stored in the “administrator ID” of the management target definition information table 1602. If it is determined that the user ID (administrator ID) included in the request data received in step S802 is stored in the “administrator ID” of the management target definition information table 1602, the administrator ID The “valid period” stored in correspondence with is acquired from the management target definition information table 1602. Whether or not the administrator who made the request is a past or current administrator can be determined based on whether or not the end date is registered in the “valid period” acquired here. With the above processing, it is determined whether the user is a group manager in the past or the present.

  When it is determined that the user who made the request is not a group administrator, that is, neither a group administrator in the past nor the present (that is, the user ID (administrator ID included in the request data received in step S802) ) Is not stored in the “manager ID” of the management target definition information table 1602), the CPU 201 of the email monitoring server terminates this processing (not shown).

  On the other hand, when it is determined that the user who made the request is a group administrator (that is, the user ID (administrator ID) included in the request data received in step S802 is “management” in the management target definition information table 1602). CPU 201 of the email monitoring server 101 determines that the filtering result of the management target user specified based on the group information 1601 recorded in the HDD 204 is “ The e-mail set to “pending” is extracted from the log table (FIG. 9) stored in the storage means of the e-mail monitoring server 101 (step S803).

  Hereinafter, the detailed process of step S803 will be described with reference to FIG.

  The processing of steps S2701 to S2706 is executed by the CPU 201 of the e-mail monitoring server 101 according to control by a program recorded in the HDD 204 of the e-mail monitoring server 101.

  First, the CPU 201 of the email monitoring server 101 is included in the request data received in step S802 from the schedule event information table (FIG. 31B) stored in the storage means such as the HDD 204 of the schedule management server 105. The administrator's schedule (schedule information) specified by the user ID (manager ID) is acquired (step S2701).

  Here, the various tables shown in FIG. 31 will be described.

  The schedule definition table (A) 3101 has items of “ID”, “account”, “password”, “format”, and “URL”, and is stored in a storage unit such as the HDD 204 of the e-mail monitoring server 101. .

  The schedule definition table (A) 3101 includes an “ID” for identifying each record in the schedule definition table (A) 3101, an “account” (administrator ID) of the administrator, a “password” of the administrator, In addition, a “format” for identifying a schedule application running on the schedule management server 105 and a “URL” for accessing each administrator's schedule (schedule information) are stored.

  That is, the schedule definition table (A) 3101 stores information for acquiring the schedule information of each administrator from the schedule event information table (B) 3102 stored in the schedule management server 105.

  Next, the schedule event information table (B) 3102 has items of “ID”, “start date”, “start time”, “end date”, “end time”, and “event name”. Stored in a storage unit such as the HDD 204 of the schedule management server 105.

  In a storage unit such as the HDD 204 of the schedule management server 105, a schedule event information table (FIG. 31B) is stored for each administrator (manager ID).

  The schedule event information table (B) 3102 stores the future (future) schedule (planned information) of the administrator.

  Here, “ID” in the schedule event information table (B) 3102 is information for identifying each record in the schedule event information table (B) 3102. The “event name” stores an event scheduled by the administrator. For example, the contents of a schedule (plan) such as “conference” and “visitor” are stored. In addition, the “start date” stores the date on which the event is started. Further, the “start time” stores a start time at which the event is started. In “End Date”, the date of ending the event is stored. Further, the “end time” stores a start time for ending the event.

  The remaining time-audit scenario correspondence table (C) 3103 has items of “ID”, “scheduled time”, “threshold”, “Max display number”, and “menu display name”, and the HDD 204 of the e-mail monitoring server 101. Is stored in the storage means.

The remaining time-audit scenario correspondence table (C) 3103 is data for displaying the mail audit menu screen shown in FIG.

  Here, “ID” in the remaining time-audit scenario correspondence table (C) 3103 is information for identifying each record in the remaining time-audit scenario correspondence table (C) 3103.

  If the administrator has free time for the time set for “scheduled time”, emails with an evaluation value of “threshold” or higher should be displayed as audit targets for the maximum number of items set for “Max display count”. Is shown. The “menu display name” is displayed corresponding to each scheduled time displayed on the mail audit menu screen (FIG. 26).

  In step S2701, “URL” and “password” corresponding to the administrator ID (account) included in the request data received in step S802 are acquired from the schedule definition table, and schedule management is performed based on the “URL”. The server 105 is accessed, and the account acquired in step S802 and the password are transmitted.

  Then, the CPU 201 of the schedule management server 106 performs an authentication process using the account and password acquired from the e-mail monitoring server 101, and when authenticated, the schedule event information table corresponding to the account (administrator ID) ( Schedule (schedule information)) is transmitted to the email monitoring server 101. Then, the CPU 201 of the email monitoring server 101 receives the schedule event information table from the schedule management server 106.

  Through the above processing, the e-mail monitoring server 101 can acquire schedule information from the schedule management server 106.

  Next, when acquiring the schedule information acquired in step S2701, the CPU 201 of the email monitoring server 101 stores the schedule information in a storage unit such as an HDD or a RAM of the email monitoring server 101. The schedule information stored here is the same as the schedule event information table shown in FIG.

  Then, the CPU 201 of the email monitoring server 101 sorts (resorts) the records of the stored schedule information in the order of “start date”, “start time”, “end date”, “end time”. ) Process. Then, the CPU 201 of the email monitoring server 101 acquires the current time from the OS, and calculates the free time until the nearest event after the current time (step S2704). Thus, the manager's free time is obtained by calculating the difference between the start time of the schedule (event) closest to the current time after the current time and the current time.

  Next, the CPU 201 of the e-mail monitoring server 101 specifies (selects) the number of e-mails that can be audited in accordance with the calculated administrator free time (step S2705).

  Details of this processing will be described later with reference to FIG.

  Next, the CPU 201 of the e-mail monitoring server 101 acquires e-mails for the number of auditable items in the administrator's idle time specified in step S2709 and sets them as audit targets (step S2706).

  Details of this processing will be described later with reference to FIG.

  Next, the CPU 201 of the email monitoring server 101 executes the process of step S2706, and then proceeds to the process of step S804.

  Details of the processing in step S2705 will be described below with reference to FIG.

  A flowchart (A) and a flowchart (B) shown in FIG. 28 are flowcharts for explaining processing for specifying the number of emails to be audited.

  The flowchart (A) shown in FIG. 28 is a flowchart illustrating a process of specifying the number of audit target mails that can be audited by the administrator by selecting the number of audit target mails by the administrator.

  The flowchart (B) shown in FIG. 28 calculates the number of auditable emails that can be audited by the administrator by calculating the number of auditable emails that can be audited by the administrator from the free time of the administrator calculated in step S2704. It is a flowchart which shows the process which pinpoints.

  As a process for specifying the number of emails to be audited, either the flowchart (A) or the flowchart (B) may be executed. By executing either one of the processes, the number of auditable mails that can be audited can be specified.

  First, the flowchart (A) shown in FIG. 28 will be described.

  The processing of steps S2801 and S2806 is executed by the CPU 201 of the email monitoring server 101 according to control by a program recorded in the HDD 204 of the email monitoring server 101.

  The processing of steps S2802 to S2805 is executed by the CPU 201 of the administrator terminal 104-3 according to control by a program recorded in the HDD 204 of the administrator terminal 104-3.

  First, the CPU 201 of the email monitoring server 101 displays information for displaying an audit menu screen (FIG. 26) from information (information of each record) in the remaining time-audit scenario correspondence table (C) 3103 stored in the HDD. Is generated and transmitted to the administrator terminal (step S2801).

  When the CPU 201 of the administrator terminal 104-3 receives the information of the remaining time-audit scenario correspondence table (C) 3103 from the e-mail monitoring server 101, the audit menu screen (FIG. 26) is displayed according to the information. Is displayed on the display unit (step S2802).

  The audit menu screen 2601 shown in FIG. 26 includes “1 emergency only (required time about 10 minutes) 2604”, “2 rush (required time about 20 minutes) 2605”, “3 standard audit (required time about “30 minutes) 2606”, “4 scrutiny (required time about 60 minutes) 2607”, “5 all cases audit 2608”, and “end 2602” buttons are displayed. Also, 2603 displays the manager's available time calculated in step S2705.

  When the “end 2602” button is pressed by the administrator, the CPU 201 of the administrator terminal 104-3 ends the process.

  The CPU 201 of the administrator terminal 104-3 receives from the administrator “1 emergency only (required time approximately 10 minutes) 2604”, “2 rush (required time approximately 20 minutes) 2605”, “3 standard audit (required time approximately 30 minutes). Minutes) 2606 ”,“ 4 scrutinization (required time approximately 60 minutes) 2607 ”, and“ 5 all audits 2608 ”are pressed (step S2804), the pressed audit menu is displayed on the email monitoring server. 101 is transmitted (step S2805).

  As described above, when selection of each audit menu is received from the administrator via the mail audit menu screen shown in FIG. 26 (when selected), the selected audit menu is transmitted to the email monitoring server 101.

  Next, the CPU 201 of the email monitoring server 101 receives the audit menu selected by the administrator from the administrator terminal 104-3 (step S2806), and the process proceeds to step S2706.

  Next, the flowchart (B) shown in FIG. 28 will be described.

  The processing of steps S28011 and S28012 is executed by the CPU 201 of the email monitoring server 101 according to control by a program recorded in the HDD 204 of the email monitoring server 101.

  The CPU 201 of the email monitoring server 101 calculates the number of emails that can be audited by the administrator from the administrator's available time calculated in step S2704 (step S28011). Specifically, an audit time per e-mail is set in advance, and an e-mail that can be audited is calculated from the free time calculated in step S2704 and the set audit time per e-mail. Calculate the number of cases. For example, if the audit time per e-mail is set to 2 minutes and the free time calculated in step S2704 is 10 minutes, “the free time calculated in step S2704 (10 minutes) ÷ one e-mail” By calculating the "audit time (2 minutes)", the number of emails that can be audited (5) can be obtained.

  Next, the CPU 201 of the email monitoring server 101 obtains the “threshold value” and “Max display number” corresponding to the number of emails that can be audited calculated in step S28011 from the remaining time-audit scenario correspondence table (C) 3103. (Step S28012), and the process proceeds to step S2706.

  Details of the processing in step S2706 will be described below with reference to FIG.

  The processing of steps S2901 to S2916 is executed by the CPU 201 of the e-mail monitoring server 101 according to control by a program recorded in the HDD 204 of the e-mail monitoring server 101.

  First, the CPU 201 of the e-mail monitoring server 101 acquires, from the log table (FIG. 9), an e-mail to be audited by the administrator identified by the administrator ID included in the request data received in step S802 (step 9). S2901).

  Hereinafter, the e-mail acquisition process (extraction process) executed in step S2901 will be described.

  For example, when the user ID (administrator ID) included in the request data received in step S802 is “Admin-A2”, referring to the management target definition information table 1602, the management of the administrator ID “Admin-A2” is performed. It can be seen that the person is an administrator of the group name “Group-A”. Further, referring to the management target definition information table 1602, it can be seen that this administrator is an administrator of the group name “Group-A” from July 1, 2006, and is also an administrator at present. Referring to the group information table 1601, the group name “Group-A” includes user 1 “alice@example.com” and user 2 “cab@example.com” from April 1, 2006 to the present. You can see that That is, the administrator of the group name “Group-A” uses the electronic mail in which the user 1 “alice@example.com” and the user 2 “cab@example.com” are set as the transmission destination or transmission source to be audited. It will be audited as email. At this time, among e-mails in which user 1 “alice@example.com” and user 2 “cab@example.com” are set as transmission destinations or transmission sources, “filtering result” is registered as “hold”. The e-mail is identified by referring to the log table (FIG. 9). Then, all the e-mails specified here are extracted from the log table (FIG. 9).

  Then, the CPU 201 of the email monitoring server 101 stores the extracted email data, for example, in the form of a log table shown in FIG. In the log table stored here, an item for storing an estimated evaluation value to be described later is newly created.

  Next, when the CPU 201 of the e-mail monitoring server 101 acquires e-mails in step S2901, the CPU 201 executes automatic evaluation processing on all the acquired e-mails (step S2902).

  Here, the detailed process of the automatic evaluation process will be described in detail with reference to FIG.

  The processing in steps S3001 to S3012 is executed by the CPU 201 of the e-mail monitoring server 101 according to control by a program recorded in the HDD 204 of the e-mail monitoring server 101.

  First, the CPU 201 of the email monitoring server 101 acquires emails evaluated in the past from the log table (FIG. 9) (step S3001).

  Specifically, an electronic mail corresponding to the “mail ID” stored in the post-audit result DB (FIG. 24) is acquired from the log table (FIG. 9).

  The post-audit result DB (FIG. 24) stores the results of past post-audits, and stores the evaluation (audit) results of each e-mail as evaluation values.

Here, the evaluation value (evaluation information) is information indicating a higher value for an e-mail having a higher rate at which transmission is impossible. That is, it is information indicating the degree of necessity for positive auditing.

  The evaluation value may be information indicating how early the audit should be or the priority to be audited.

  The post-audit result DB (FIG. 24) in which the e-mail evaluation results are stored is stored in a storage unit such as the HDD of the e-mail monitoring server 101.

  The post-audit result DB (FIG. 24) has items of “mail ID”, “audit execution date / time”, “auditor”, and “evaluation”, and the contents of each item are stored. Here, the “mail ID” is information for identifying an electronic mail and corresponds to the mail ID of the log table. The “audit execution date / time” stores the date / time when the post-audit of the e-mail corresponding to the e-mail ID was executed. The “auditor” stores the user ID (account) (auditor name) of the auditor who performed the post-audit. In “evaluation”, an evaluation value is stored as a result of the audit (evaluation).

  Next, when the CPU 201 of the e-mail monitoring server 101 acquires e-mails evaluated in the past from the log table (FIG. 9), the process from step S3003 to step S3011 is performed for all e-mails acquired in step S2901. Processing is executed (step S3002, step S3011).

  Further, the CPU 201 of the email monitoring server 101 executes the processing from step S3004 to step S3007 for all the emails evaluated in the past acquired in step S3001 (steps S3003 and S3008).

  First, the CPU 201 of the e-mail monitoring server 101 calculates the similarity between the e-mail acquired in step S2901 and the e-mail evaluated in the past acquired in step S3001 (step S3004). Here, the similarity of information such as an e-mail destination, transmission source, text, and attached file is calculated. The similarity calculation method may be calculated by using a known similarity search technique. For example, the similarity of the mail text can be calculated by a method of calculating the similarity of the character string of the mail text.

  Next, the CPU 201 of the email monitoring server 101 determines whether or not the similarity calculated in step S3004 is equal to or higher than a preset similarity (threshold) (step S3005).

  If the CPU 201 of the email monitoring server 101 determines in step S3005 that the similarity calculated in step S3004 is greater than or equal to a preset similarity (step S3005: Y), the CPU 201 of the e-mail monitoring server 101 currently evaluates. An evaluation value corresponding to the mail ID of the electronic mail is acquired from the post-audit result DB (FIG. 24) (step S3006).

  Next, the CPU 201 of the email monitoring server 101 stores the similarity calculated in step S3004 and the evaluation value acquired in step S3006 in association with each other in the storage unit (step S3007).

  Here, the evaluation value indicates that the higher the evaluation value is, the lower the evaluation is and it is necessary to audit more actively.

  Next, when the CPU 201 of the email monitoring server 101 executes the processing from step S3004 to step S3007 for all the emails evaluated in the past acquired in step S3001, the processing proceeds to step S3009.

Then, the CPU 201 of the email monitoring server 101 calculates an estimated evaluation value from the similarity and the evaluation value stored in step S3007 (step S3009).

  For example, the similarity calculated in step S3004 is equal to or higher than a predetermined similarity (for example, 20%), the similarity of each e-mail evaluated in the past is 90%, the evaluation value is 100, and the similarity is 60%. If the evaluation value is 100, the evaluation value is 50% at a similarity of 40%, and the evaluation value is 50 at a similarity value of 20%, these evaluation values are averaged, and the obtained value “75” is calculated as an estimated evaluation value.

  Next, the CPU 201 of the email monitoring server 101 stores the estimated evaluation value (evaluation information) calculated in step S3009 in association with the currently processed email stored in step S2901 (step S3010). . That is, the estimated evaluation value calculated in step S3009 is stored in the item for storing the estimated evaluation value generated in step S2901.

  Next, when the CPU 201 of the e-mail monitoring server 101 executes the processes from step S3003 to step S3011 for all e-mails acquired in step S2901, the process proceeds to step S2903.

  Here, the flowchart shown in FIG. 30 shows that the thread estimation evaluation value calculation process of step S3012 is executed after the process of step S3011, but in the case of preliminary audit, the process of step S3012 is executed. Without executing, the process proceeds to step S2903.

  Next, the description returns to the flowchart of FIG.

  The CPU 201 of the email monitoring server 101 executes the automatic evaluation process in step S2902, acquires the estimated evaluation value for all the emails acquired in step S2901, and then specifies the auditable audit target specified in step S2705. The “threshold value” and “Max display number” corresponding to the number of emails are acquired from the remaining time-audit scenario correspondence table (C) 3103 (step S2903).

  Specifically, the CPU 201 of the email monitoring server 101 sets the “threshold value” and “Max display number” corresponding to the time of the audit menu received in step S2806 (the required time displayed in each audit menu in FIG. 26). The remaining time-audit scenario correspondence table (C) 3103 is acquired.

  If the process shown in the flowchart (B) is executed instead of the process shown in the flowchart (A) shown in FIG. 28, since “threshold” and “Max display number” have already been acquired in step S29012, the process proceeds to step S2903. This process is not executed.

  Next, the CPU 201 of the email monitoring server 101 determines whether or not the “Max display number” acquired in step S2904 is “unlimited” (step S2904).

  If it is determined that the “Max display number” acquired in step S2904 is “unlimited” (step S2904: N), the CPU 201 of the e-mail monitoring server 101 audits all the e-mails acquired in step S2901. Is set as an e-mail (step S2914).

  On the other hand, if the CPU 201 of the email monitoring server 101 determines that the “Max display number” acquired in step S2904 is not “unlimited” (step S2904: Y), whether or not “threshold value” has been acquired in step S2904. Is determined (step S2905).

  If the CPU 201 of the e-mail monitoring server 101 determines that the “threshold value” has been acquired in step S2904 (step S2905: Y), the CPU 201 stores the estimated evaluation values stored in step S3010 in descending order. The sorting processing of the e-mails is executed (step S2906).

  On the other hand, if it is determined in step S2904 that the “threshold value” could not be acquired (step S2905: N), the CPU 201 of the e-mail monitoring server 101 sorts the e-mails stored in step S2901 in ascending order of transmission date and time ( A rearrangement process is executed (step S2912). The CPU 201 of the e-mail monitoring server 101 sets e-mails for “Max display number” acquired in step S2903 as audit targets from the higher-level e-mail after the e-mails are sorted in step S2913 (step S2913). S2913). That is, e-mails corresponding to the upper (late) “Max display number” in the order of late transmission date and time are set as audit targets.

  Next, in step S2906, the CPU 201 of the email monitoring server 101 executes the sort processing of the emails stored in step S2901 in descending order of the estimated evaluation value, and then the number of emails stored in step S2901 is It is determined whether or not there is more than the “Max display number” acquired in S2903 (step S2907). If the CPU 201 of the e-mail monitoring server 101 determines that the number is larger than the “Max display number” (step S2907: Y), an e-mail whose estimated evaluation value is equal to or greater than the “threshold” acquired in step S2903 is obtained. It is set as an audit target candidate (step S2908). Next, the CPU 201 of the e-mail monitoring server 101 identifies the number of e-mails set as audit target candidates in step S2908, and determines whether the number is greater than the “Max display number” (step S2909). ). If the CPU 201 of the e-mail monitoring server 101 determines that the number of e-mails set as the audit target candidate in step S2908 is larger than the “Max display number” (step S2909: Y), in step S2908. For each e-mail with the same estimated evaluation value set as the audit target candidate, the e-mails are sorted in order of late transmission time (step S2910).

  Next, in step S2910, the CPU 201 of the e-mail monitoring server 101 stores, for each e-mail having the same estimated evaluation value, an upper “Max display number” portion of the e-mail list as a result of sorting in order of late transmission time. Is set as an audit target (step S2911).

  In this way, the estimated evaluation values are rearranged in the order of e-mails having the highest estimated value (which should be actively audited), and the upper “Max display number” can be set as the audit target. That is, e-mails corresponding to “Max display number” in descending order of positive auditing can be set as audit targets.

  If the CPU 201 of the email monitoring server 101 determines in step S2907 that the number of emails stored in step S2901 is less than the “Max display number” acquired in step S2903 (step S2907: N). All e-mails acquired in step S2901 are set as audit targets (step S2916).

  If the CPU 201 of the email monitoring server 101 determines in step S2909 that the number of emails set as the audit target candidate in step S2908 is smaller than the “Max display number” (step S2909: N). Then, “Max Displayed Items” from the higher-order e-mail with a high estimated evaluation value is set as an audit target (step S2915).

  As described above, in step S2916, step S2915, step S2911, step S2913, and step S2914, an electronic mail to be audited is set.

As a result, the administrator can preferentially audit electronic mail that is likely to be unsent.

  Next, the description returns to the processing of the flowchart shown in FIG.

  The CPU 201 of the e-mail monitoring server 101 displays a list screen of e-mails extracted from the log table (FIG. 9) in step S803 and set as audit targets in steps S2916, S2915, S2911, S2913, and S2914. Is generated and transmitted to the administrator terminal 104-3 (step S804). The information includes, for example, e-mail data set as an audit target, an estimated evaluation value corresponding to the e-mail, and information (for example, a symbol) indicating the degree of the estimated evaluation value.

  Next, when the CPU 201 of the administrator terminal 104-3 receives the information for displaying the list screen (step S805), the CPU 201 displays a list screen of the suspended emails based on the information (step S806). . 10 and 32 are shown as examples of the list screen.

  The screen shown in FIG. 10 is an example of a screen displayed when all emails are set as audit targets in step S2914. That is, all e-mails acquired in step S2901 are displayed.

  FIG. 32 shows a list screen displayed when “Max Displayed Items” e-mails are set as audit target e-mails in steps S2915, S2911, and S2913.

  That is, e-mails corresponding to “Max display number” (for example, 15) are displayed in descending order of evaluation value.

  10 and 32, the items are “number of cases”, “audit status”, “mail subject (title)”, “source address”, “destination address”, “send date”, “evaluation”, and “estimation”. "Evaluation value" is displayed. Here, the “number of cases” stores the number of cases to be audited. In the example of FIG. 32, the number of emails to be audited is 15 in total. The “audit status” stores whether auditing has been completed. If it is not yet, it indicates that it has not been audited yet. The “mail subject (title)” stores the title (subject) of the e-mail. Further, the “sender address” stores the sender address of the e-mail.

  The “destination address” stores the destination address of the e-mail. In addition, “transmission date / time” stores the transmission date / time of the e-mail. The “estimated evaluation value” stores the estimated evaluation value evaluated in step S2902 for each e-mail. “Evaluation” indicates a symbol for visually displaying the estimated evaluation value. If the estimated evaluation value is high (low evaluation), many ■ are displayed in the “Evaluation” column.

  10 and 32 are used when a manager (group manager) of a group to which the sender of the email belongs in advance audits the email whose transmission is suspended by the email monitoring server 101. It is a figure which shows an example of the screen displayed.

  Through the operation via the screen of FIG. 10 or FIG. 32, the group administrator gives an instruction to transmit / delete (not transmit) the suspended mail.

  On this screen, the CPU 201 of the administrator terminal 104-3 clicks the mail address of the sender (sender) in the mail sender column, and the CPU 201 displays the mail content confirmation screen (FIG. 33) on the display device. To control.

  As described above, the CPU 201 of the administrator terminal 104-3 receives an instruction to select an electronic mail to be “sent” or “deleted” (step S807).

  Then, the CPU 201 of the administrator terminal 104-3 receives an instruction for selecting an e-mail from the administrator, and “sends” or “deletes” the e-mail via the displayed mail content confirmation screen (FIG. 33). Is received (step S808).

  Specifically, the CPU 201 of the administrator terminal 104-3 receives a “send” instruction when the radio button (send) 3301 is pressed and the confirmation button 3304 is pressed by the administrator. Further, the CPU 201 of the administrator terminal 104-3 accepts a “delete” instruction when the radio button (delete) 3302 is pressed and the confirmation button 3304 is pressed by the administrator.

  Then, the CPU 201 of the administrator terminal 104-3 transmits the instruction received in step S808 to the email monitoring server 101 (step S809).

  Subsequently, the CPU 201 of the administrator terminal 104-3 determines whether an end instruction from the administrator has been received (step S810). When the termination instruction from the administrator is not received (NO in step S810), the CPU 201 of the administrator terminal 104-3 displays the pre-audit screen shown in FIG. 10 or FIG. 32 until the termination instruction is received. On the other hand, when an end instruction from the administrator is received (YES in step S810), the process ends.

  The CPU 201 of the e-mail monitoring server 101 receives a change instruction indicating sending / deleting (not sending) e-mail from the administrator terminal 104-3 (step S811).

  Then, the CPU 201 of the email monitoring server 101 determines whether or not the received change instruction is transmission (transmission) (step S812). If it is determined to be sent (YES in step S812), the CPU 201 of the administrator terminal 104-3 sends the e-mail instructed to be sent to the wide area network 120 (step S813). On the other hand, if it is determined that the transmission is not performed, the process proceeds to step S815.

  The CPU 201 of the email monitoring server 101 changes the filtering result of the email table sent to the wide area line 120 in the log table (FIG. 9) to “send after transmission” (step S814), and shifts the processing to step S815.

  Subsequently, the CPU 201 of the email monitoring server 101 determines whether or not the change instruction received in step S811 is deletion (not transmitted) (step S815). As a result, if it is determined to be deleted (not transmitted) (YES in step S815), the email monitoring server 101 deletes the email without sending it (step S816). Subsequently, the email monitoring server 101 changes the filtering result of the email in the log table (FIG. 9) to “delete after hold” (step S817), and proceeds to step S802.

  On the other hand, if the CPU 201 of the email monitoring server 101 determines that the change instruction received in step S811 is not deletion (not transmitted), the process proceeds to step S803.

  In the above-described configuration, the example in which the pre-inspection is performed on the transmission mail has been described. However, the pre-inspection may be performed on both the reception mail and the transmission / reception mail. When auditing a received mail, a plurality of received addresses are described, and when the plurality of received addresses straddle a plurality of groups, the received mail is configured to be audited by a plurality of administrators.

  FIG. 11 is a flowchart showing detailed processing of the post-audit (steps S409 to S411) shown in FIG. 4, and shows processing for the administrator to perform post-audit of e-mail. Hereinafter, processing for performing post-audit of electronic mail will be described with reference to FIG.

  FIG. 11 corresponds to the processing performed by the email monitoring server 101 and the administrator terminal 104-3 in the post-audit of email. This process is performed by the CPU 201 of the e-mail monitoring server 101 and the administrator terminal 104-3 according to control by a program recorded in the HDD 204.

  The CPU 201 of the administrator terminal 104-3 transmits a request for performing post-audit to the electronic mail monitoring server 101 (step S1101).

  When the CPU 201 of the e-mail monitoring server 101 receives the request from the administrator terminal 104-3 (step S1102), the CPU 201 generates information on a list display image of e-mails to be subjected to the post-audit and generates the administrator terminal 104-3. (Step S1103). Detailed processing of this processing will be described later with reference to FIG.

  The CPU 201 of the administrator terminal 104-3 receives information on a list image of e-mails to be subjected to the post-audit from the e-mail monitoring server 101 (step S1104).

  Subsequently, based on the received information, the CPU 201 of the administrator terminal 104-3 displays a list display screen (FIG. 19) of e-mails to be subjected to the post-audit on the display device 210 of the administrator terminal 104-3. (Step S1105).

  Next, the CPU 201 of the administrator terminal 104-3 determines whether or not selection of an e-mail from e-mails displayed on the list display screen (FIG. 19) has been accepted (step S1106). For example, when the administrator selects an email subject displayed on the list display screen (FIG. 19), the CPU 201 of the administrator terminal 104-3 accepts selection of an email corresponding to the email subject.

  When the request for displaying the e-mail data is received, the CPU 201 of the administrator terminal 104-3 transmits the display request for the e-mail that has received the request to the e-mail monitoring server 101 (step S1107).

  Next, when the CPU 201 of the e-mail monitoring server 101 receives an e-mail display request from the administrator terminal 104-3 (YES in steps S 1108 and S 1109), the e-mail data received for the display is stored in the log table. (Figure 9). The e-mail data is data such as a mail text, a recipient address, a sender address, and an attached file. On the other hand, when an e-mail display request is not received from the administrator terminal 104-3, the CPU 201 of the e-mail monitoring server 101 continues to wait until an e-mail display request is received from the administrator terminal 104-3 (step S1109). NO).

  Next, the CPU 201 of the email monitoring server 101 generates information for displaying an evaluation screen (FIG. 20) for the administrator to evaluate from the email data acquired from the log table, and the generated information is displayed. It transmits to the administrator terminal 104-3 (step S1110).

  When the CPU 201 of the administrator terminal 104-3 receives the information for displaying the evaluation screen (FIG. 20), the CPU 201 displays the evaluation screen on the display unit based on the information (steps S1111 and S1112).

  For example, in step S1106, an e-mail with “transmission source” displayed on the list display screen (FIG. 19) as “Toru Hoshi” and “transmission destination” as “aaa@example.jp” is selected by the administrator. Shall be. In this case, the CPU 201 of the administrator terminal 104-3 displays the evaluation screen shown in FIG. 20 in step S1112.

  FIG. 20 shows the transmission date and time, the transmission source (sender), the destination (To, Cc, and Bcc can be displayed), the e-mail subject (title), the e-mail body, and the e-mail of the selected e-mail. The attached file is displayed. These data are data acquired from the log table, and are data acquired from the email management server 101 in steps S1110 and S1111.

  On the evaluation screen (FIG. 20), an “evaluation” column 2001 and a “collective evaluation” column 2002 are displayed below the mail text of the evaluation screen.

  As shown in FIG. 20, in the “evaluation” column 2001, evaluations “emission possible”, “transmission impossible”, “required check”, and “neither” can be performed for the e-mail displayed on the evaluation screen. The radio button that accepts from the administrator is displayed.

  In the “collective evaluation” column 2002, a check box for selecting “collective evaluation” for setting whether or not the administrator performs collective evaluation, and an email of the same thread as the e-mail displayed on the evaluation screen are displayed. A radio button for selecting “all threads” to evaluate all emails and “all parent emails” to evaluate all parent emails displayed on the evaluation screen, and emails that have already been evaluated A check box for selecting “Exclude Evaluated Mail” is set to set whether or not to exclude the evaluation.

  When the radio button for “send possible” displayed in the “evaluation” column 2001 is selected by the administrator, the administrator has evaluated that the e-mail displayed on the evaluation screen may be sent. Means.

  In addition, when the “transmission disabled” radio button displayed in the “evaluation” column 2001 is selected by the administrator, the administrator makes an evaluation “not to send” the e-mail displayed on the evaluation screen. Means that.

  Further, when the “check required” radio button displayed in the “evaluation” column 2001 is selected by the administrator, the e-mail displayed on the evaluation screen is managed with an evaluation “check (confirmation) is required”. Means that it was made by a person.

  In addition, when the radio button of “Neither” displayed in the “Evaluation” column 2001 is selected by the administrator, the e-mail displayed on the evaluation screen “can be sent according to the content to be sent, destination, etc. This means that the administrator has made an evaluation that “there may be a case where the transmission is not possible or the transmission may be impossible”.

  When the check box for selecting “collective evaluation” displayed in the “collective evaluation” column 2002 is checked, that is, when other e-mails are set to be evaluated together, the electronic data displayed on the evaluation screen is displayed. The same evaluation as the evaluation performed in the “evaluation” column 2001 is set for at least one other electronic mail among the electronic mails of the same thread as the mail. In this way, by checking the “evaluate collectively” check box, not only the evaluation of the e-mail displayed on the evaluation screen but also the other evaluations of other e-mails in the same thread can be performed in the same evaluation. It becomes possible.

  Further, when the radio button of “all threads” displayed in the “collectively evaluate” column 2002 is selected by the administrator, all e-mails of the same thread as the e-mail displayed on the evaluation screen are collectively evaluated. Settings are made.

  Further, when the radio button of “all parent mails” displayed in the “collective evaluation” column 2002 is selected by the administrator, among the emails of the same thread as the email displayed on the evaluation screen, the evaluation screen displays Only the parent mail of the displayed e-mail is set to be evaluated together.

  Further, when the “exclude evaluated email” check button displayed in the “collective evaluation” column 2002 is selected by the administrator, settings are made so that already evaluated emails are excluded from the targets to be evaluated collectively. The

  Thus, when evaluating at least one other e-mail collectively, the same evaluation as the evaluation of the e-mail displayed on the evaluation screen selected in the “Evaluation” column is set for the other e-mail as well. Is done.

  The CPU 201 of the administrator terminal 104-3 receives evaluations (evaluation results) such as “transmission is possible” and “transmission is not possible” in the “evaluation” column 2001, and “whether evaluation is performed collectively” in the “collective evaluation” column 2002. ”,“ Whether or not to evaluate all the same threads together ”,“ Whether or not to evaluate the parent emails in the same thread ”and“ Whether to evaluate already evaluated emails in a lump ” The setting of summary evaluation such as "" is accepted (step S1113).

  Subsequently, when the confirmation button 2003 is pressed by the administrator, the CPU 201 of the administrator terminal 104-3 transmits the evaluation result and setting information of summary evaluation to the e-mail monitoring server 101 (step S1114).

  The CPU 201 of the e-mail monitoring server 101 receives information indicating the e-mail to be audited, its evaluation result, and setting information for summary evaluation from the administrator terminal 104-3 (step S1115). Step S1115 is a processing example of the accepting unit of the present invention.

  Subsequently, the CPU 201 of the email monitoring server 101 determines whether or not to collectively evaluate from the received summary evaluation setting information (step S1116). That is, the e-mail monitoring server 101 determines whether or not the “collective evaluation” check box in the “collective evaluation” column 2002 is checked, that is, whether or not collective evaluation is performed, from the setting information of the collective evaluation. To do.

  If it is determined in step S1116 that the evaluation is performed collectively (checked) (YES in step S1116), the CPU 201 of the e-mail monitoring server 101 determines “thread” in the “collective evaluation” column 2002 based on the setting information of the collective evaluation. It is determined whether the “all” radio button has been selected or whether the “all parent mail” radio button has been selected (step S1117).

  On the other hand, if it is determined in step S1116 that the evaluation is not performed collectively (not checked) (NO in step S1116), the CPU 201 of the email monitoring server 101 shifts the processing to step S1120. In step S1120, the CPU 201 of the e-mail monitoring server 101 executes e-mail evaluation processing displayed on the evaluation screen.

  If the CPU 201 of the e-mail monitoring server 101 determines in step S1117 that the “all threads” radio button in the “collectively evaluate” column 2002 is selected (NO in step S1117), the process proceeds to step S1119. . In step S1119, the CPU 201 of the email monitoring server 101 executes a process of collectively evaluating emails of the same thread as the email displayed on the evaluation screen. Details of this processing will be described later with reference to FIG.

  If the CPU 201 of the e-mail monitoring server 101 determines in step S1117 that the “all parent mail” radio button in the “collective evaluation” column 2002 is selected (YES in step S1117), the process advances to step S1118. Transition. In step S1118, the CPU 201 of the email monitoring server 101 executes a process of collectively evaluating the parent email of the email in the same thread as the email displayed on the evaluation screen. Details of this processing will be described later with reference to FIG.

  After executing the parent mail evaluation process in step S1118, the CPU 201 of the email monitoring server 101 stores the evaluation result (audit result) in the post-audit result database (post-audit result DB) (FIG. 24) (step S1121). ).

  The CPU 201 of the e-mail monitoring server 101 executes e-mail evaluation processing for the same thread in step S1119, and then stores the evaluation result (audit result) in the post-audit result database (post-audit result DB) (FIG. 24). Store (step S1122).

  The CPU 201 of the e-mail monitoring server 101 executes the e-mail evaluation process displayed on the evaluation screen in step S1120, and then sends the evaluation result (audit result) to the post-audit result database (post-audit result DB) (see FIG. 24) (step S1123).

  Here, the post-audit result database will be described. The post-audit result database is stored in the e-mail monitoring server 101, and the results of the post-audits (results of evaluation) are stored and held.

  The post-audit result database shown in FIG. 24 has items of “mail ID”, “audit execution date / time”, “auditor”, and “evaluation (result)”.

  “Mail ID” of the post-audit result database is the mail ID of the evaluated email, and stores a value corresponding to the mail ID of the log table (FIG. 9).

  The “audit execution date / time” stores the date / time when the e-mail corresponding to the mail ID is evaluated.

  The “inspector” stores the name of the administrator who has evaluated the e-mail corresponding to the mail ID.

  In “Evaluation”, the result of evaluating the e-mail corresponding to the e-mail ID is input as a numerical value (evaluation value).

  For example, “0” is evaluated as “evaluable” in the “evaluation” column, “100” is evaluated as “evaluable”, and “100” is evaluated as “evaluable”. “50” is stored as the evaluation value. Thus, the evaluation (value) is stored corresponding to each mail ID.

  Returning to the flowchart of FIG. The CPU 201 of the e-mail monitoring server 101 determines whether or not an end instruction such as logout has been received from the administrator terminal 104-3 after the process of step S1121, step S1122, or step S1123 has been executed (step S1124). . The CPU 201 of the email monitoring server 101 executes the processing from step S1103 to step S1124 until an end instruction is received. On the other hand, when an end instruction is received (step S1124), the processing shown in this flowchart is ended.

  FIG. 12 is a flowchart showing detailed processing in step S1103 of the flowchart shown in FIG.

  First, when the CPU 201 of the e-mail monitoring server 101 receives a request for performing a pre-audit in step S1102, the management target corresponding to the administrator ID included in the request is referred to the management target definition information 1602 in FIG. The group name is specified, and the group name is acquired (step S1201).

  Then, the CPU 201 of the e-mail monitoring server 101 receives the information from a storage unit such as an HDD storing information for displaying a screen (e-mail search screen) (FIG. 17) for searching for an e-mail to be subjected to the post audit. Is acquired and transmitted to the administrator terminal 104-3 (step S1202).

  Next, the CPU 201 of the administrator terminal 104-3 receives information for displaying an email search screen from the email monitoring server 101 (step S1203). Subsequently, the CPU 201 of the administrator terminal 104-3 displays an e-mail search screen (FIG. 17) according to the information (step S1204).

  Then, the CPU 201 of the administrator terminal 104-3 receives an input of search conditions from the administrator via the electronic mail search screen (step S1205). Subsequently, when the search button 1701 is pressed, the CPU 201 of the administrator terminal 104-3 transmits the input search condition to the email monitoring server 101 (step S1206).

  Here, examples of search conditions (1703, 1704) to be entered on the e-mail search screen include the following items. That is, “Send time”, “Send date”, “Send month”, “Send year”, “Send e-mail address”, “Bill e-mail address (mail address set in Cc or Bcc) ) ”,“ E-mail subject (title) ”,“ E-mail size ”,“ Attached file size attached to the e-mail ”, and the like can be set as search conditions.

  In addition, e-mail data corresponding to these conditions is stored in log data, respectively, and e-mail data corresponding to these input search conditions can be acquired by searching log data. It is.

  Returning to the flowchart of FIG. The CPU 201 of the email monitoring server 101 receives the search condition input on the email search screen from the administrator terminal 104-3 (step S1207).

  In step S1208, “URL” and “password” corresponding to the administrator ID (account) included in the request data received in step S1102 are acquired from the schedule definition table, and schedule management is performed based on the “URL”. The server 105 is accessed, and the account acquired in step S1102 and the password are transmitted.

  Then, the CPU 201 of the schedule management server 106 performs an authentication process using the account and password acquired from the e-mail monitoring server 101, and when authenticated, the schedule event information table corresponding to the account (administrator ID) ( Schedule (schedule information)) is transmitted to the email monitoring server 101. Then, the CPU 201 of the email monitoring server 101 receives the schedule event information table from the schedule management server 106.

  Through the above processing, the e-mail monitoring server 101 can acquire schedule information from the schedule management server 106 (step S1208).

  Next, when acquiring the schedule information acquired in step S1208, the CPU 201 of the email monitoring server 101 stores the schedule information in a storage unit such as an HDD or a RAM of the email monitoring server 101 (step S1209). The schedule information stored here is the same as the schedule event information table shown in FIG.

  Then, the CPU 201 of the email monitoring server 101 sorts (resorts) the records of the stored schedule information in the order of “start date”, “start time”, “end date”, “end time”. ) Process is performed (step S1210). Then, the CPU 201 of the e-mail monitoring server 101 obtains the current time from the OS, and calculates the free time until the nearest event after the current time (step S1211). Thus, the manager's free time is obtained by calculating the difference between the start time of the schedule (event) closest to the current time after the current time and the current time.

  Next, the CPU 201 of the e-mail monitoring server 101 specifies (selects) the number of e-mails that can be audited in accordance with the calculated administrator idle time (step S1212).

  Details of this processing will be described later with reference to FIG.

  Next, the CPU 201 of the e-mail monitoring server 101 acquires e-mails for the number of cases that can be audited during the administrator's idle time specified in step S1211 and sets the e-mails as audit targets (step S1212).

  The details of this process are shown in FIG. 28 and are as described above, and can be described by replacing step S2704 with step S1211 in the description of FIG.

  Next, the CPU 201 of the email monitoring server 101 executes the process of step S1212, and then proceeds to the process of step S1213.

  Next, the description returns to FIG.

  Subsequently, the CPU 201 of the e-mail monitoring server 101 searches the log table (FIG. 9) for e-mail data in the search target period included in the search condition and acquires it (step S1208).

  Then, the CPU 201 of the email monitoring server 101 determines whether group information has already been set in the email data acquired in step S1213. That is, it is determined here whether there is information (group information) indicating a group in the “group information” column of the log data shown in FIG.

  If it is determined in step S1213 that the group has not yet been set in the email data acquired, the CPU 201 of the email monitoring server 101 belongs to the sender of the email at the time of the email transmission date and time. The group name is specified with reference to the group information 1601 (FIG. 16), and the group name is set in the log table (FIG. 9). On the other hand, if it is determined that group information is set in the e-mail data, the process proceeds to step S1217.

  In step S1214, the CPU 201 of the e-mail monitoring server 101 audits (evaluates) the e-mail acquired in step S1213 by the administrator identified by the administrator ID included in the post-audit implementation request received in step S1102. It is determined whether the e-mail is to be sent (step S1214).

  This is because the group name corresponding to the email address of the e-mail source acquired in step S1208 is acquired from the group information 1601 (FIG. 16), and the manager ID of the group is defined as the management target definition from the acquired group name. Obtained from information 1602. Then, it is determined whether or not the acquired administrator ID is the same as the administrator ID included in the post-audit implementation request received in step S1102. As a result, if they are the same administrator ID, it is determined that the email is to be audited (evaluated) (YES in step S1214), and the process proceeds to step S1215. On the other hand, if the administrator ID is different, it is determined that the email is not audited (evaluated) (NO in step S1214), and the process proceeds to step S1215. Here, when the post-audit has already been completed for the mail, it may of course be controlled not to be audited.

  In step S1215, the CPU 201 of the email monitoring server 101 determines whether the email acquired in step S1208 matches the other search conditions input via the email search screen.

  If the CPU 201 of the e-mail monitoring server 101 determines in step S1215 that the other search conditions are met (YES in step S1215), the CPU 201 sets the e-mail as an e-mail subject to pre-inspection (step S1216). . On the other hand, if it is determined in step S1215 that the other search conditions are not met (NO in step S1215), the CPU 201 of the email monitoring server 101 proceeds to step S1215.

  Next, the CPU 201 of the e-mail monitoring server 101 executes mail acquisition / sort processing for the e-mail set as a post-audit target in step S1216 (step S1218).

  The details of the process shown in step S1218 are the same as those in the flowchart shown in FIG. 29, and only the differences will be described here.

  The e-mail acquisition process in step S2901 is not executed here because the e-mail is acquired in step S1213. That is, here, the electronic mail acquired in step S2901 can be described by replacing it with step S1213.

  In the automatic evaluation process shown in FIG. 30, the process of step S3012 is not executed in the case of the pre-audit, but the process of step S3012 shown in FIG. 30 is executed in the case of the post-audit.

  Here, description will be made with reference to flowcharts (FIGS. 34 and 35) showing the detailed processing of step S3012 shown in FIG.

  FIG. 34 is a flowchart showing a process for calculating a thread estimated evaluation value for only the parent mail of the same thread.

  FIG. 35 is a flowchart showing a process of calculating thread estimation evaluation values for e-mails of all the same threads.

  Here, the thread estimated evaluation value (thread evaluation information) refers to an evaluation value obtained by calculating an average value of estimated evaluation values of electronic mail of the same thread or parent mail of the same thread.

  First, the flowchart shown in FIG. 34 will be described.

  The CPU 201 of the email monitoring server (email audit server) 101 executes the processing from step S3402 to step S2407 for all the emails acquired in step S1213.

  First, a parent mail ID corresponding to the mail ID of the electronic mail acquired in step S1213 is searched from the thread management table (step S3402). If the parent mail ID is searched in step S3402 (step S3403: Y), it is acquired from the log table storing the estimated evaluation value of the searched parent mail ID (step S3407).

  On the other hand, if the parent mail ID is not searched in step S3402 (step S3403: N), a thread estimated evaluation value is calculated from the currently acquired estimated evaluation value (step S3404) and stored (step S3405). Specifically, the thread estimated evaluation value can be calculated by calculating the average value of the estimated evaluation values acquired in step S3407.

  That is, by the above processing, the thread estimation evaluation value of only the parent mail of the same thread can be calculated from the estimation evaluation value of only the parent mail of the same thread.

  Next, the flowchart shown in FIG. 35 will be described.

  The CPU 201 of the email monitoring server (email audit server) 101 executes the processing from step S3502 to step S2507 for all the emails acquired in step S1213.

  First, a mail ID of the same thread corresponding to the mail ID of the electronic mail acquired in step S1213 is searched from the thread management table (step S3502). If a mail ID is searched in step S3502 (step S3503: Y), it is acquired from the log table storing the estimated evaluation value of the searched mail ID (step S3507).

  On the other hand, if the mail ID is not searched in step S3502 (step S3503: N), a thread estimated evaluation value is calculated from the currently acquired estimated evaluation value (step S3504) and stored (step S3505). Specifically, the thread estimated evaluation value of the same thread can be calculated by calculating the average value of the estimated evaluation values acquired in step S3407.

  In other words, the thread estimation evaluation value of the email of the same thread can be calculated from the estimated evaluation value of each email of the same thread by the above processing.

  As the process of step S3012, either process of FIG. 34 or FIG. 35 may be executed.

  Returning to the description of FIG.

  Next, the CPU 201 of the e-mail monitoring server 101 extracts a list of e-mails extracted from the log table (FIG. 9) in step S1213 and set as audit targets in steps S2916, S2915, S2911, S2913, and S2914. Information for displaying the screen is generated (step S1219) and transmitted to the administrator terminal 104-3 (step S1220). The information includes, for example, e-mail data set as an audit target, an estimated evaluation value corresponding to the e-mail, and information (for example, a symbol) indicating the degree of the estimated evaluation value.

  Here, the information transmitted by the email monitoring server 101 is received by the administrator terminal 104-3 in step S1104 (FIG. 11) (step S1104). Then, the CPU 201 of the administrator terminal 104-3 displays the screen of FIG. 19 based on the information received in step S1104 (step S1105).

  FIG. 19 is a screen displayed when all e-mails are set as monitoring targets in step S2914.

  FIG. 21 is a screen showing a case where only an email with the number “6” is audited.

  FIG. 22 shows a screen when e-mails corresponding to the “Max display number” are set as audit targets in steps S2915, S2911, and S2913. FIG. 22 shows a case where the emails of the same thread of the emails whose number is “6” are collectively audited.

  FIG. 23 shows a screen when e-mails corresponding to the “Max display number” are set as audit targets in steps S2915, S2911, and S2913, and is a screen when auditing only the parent e-mail collectively. .

  The estimated thread evaluation value is displayed on any of the screens of FIG. 19, FIG. 21, and FIG. 22, thereby efficiently auditing a set of emails (thread unit) that must be actively audited. can do.

  By default, the CPU 201 of the e-mail monitoring server 101 sorts and displays e-mails displayed as a list on this screen in descending order of estimated evaluation values shown in the evaluation column (that is, in ascending order of evaluation). To control.

  Further, items other than the evaluation column, that is, items such as audit status, mail title, sender address, recipient / broadcast address, and transmission date / time may be configured to be sortable.

  In FIG. 19, all emails are displayed regardless of whether auditing is completed or not. However, only audited emails are set to be displayed, and only unaudited emails are displayed. Setting is also possible. Further, for unaudited mails, when an estimated evaluation value is instructed to be clicked, control may be performed so that the audited mail used for calculating the estimated evaluation value of the mail is displayed.

  FIG. 13 is a flowchart showing detailed processing of the evaluation processing in step S1119 of the flowchart shown in FIG.

  The processing from step S1301 to step S1305 shown in FIG. 13 is executed by the CPU 201 of the e-mail monitoring server 101. This process is a process for collectively evaluating other e-mails in the same thread as the e-mail displayed on the evaluation screen (FIG. 20).

  In other words, on the evaluation screen, one of “Send possible”, “Send impossible”, “Check required”, or “Neither” can be evaluated, and the “Evaluate all together” check box is checked. This process is executed when the “” radio button is set.

  First, the CPU 201 of the e-mail monitoring server 101 searches the thread management table for an e-mail having the same thread ID as the e-mail thread ID evaluated on the evaluation screen (FIG. 20) (step S1301). ). Step S1301 is a processing example of the search means of the present invention.

  Then, the CPU 201 of the email monitoring server 101 determines whether an email of the same thread has been searched (step S1302). If an email of the same thread is retrieved, the process proceeds to step S1303. If an email of the same thread is not retrieved, the process proceeds to step S1112 in FIG.

  In step S1303, the CPU 201 of the email monitoring server 101 performs processing for setting the evaluation received on the evaluation screen (FIG. 20) for the email searched in step S1301. The evaluation received on the evaluation screen (FIG. 20) here is an evaluation of any one of “transmission enabled”, “transmission disabled”, “check required”, and “cannot say either”. Details of the processing are shown in FIG. 15 and will be described later.

  Next, after executing the evaluation process in step S1303, the CPU 201 of the e-mail monitoring server 101 determines whether or not all e-mails searched in step S1301 have been executed (step S1304). If it is determined that the process has been executed for all e-mails, the process proceeds to step S1112 in FIG. On the other hand, if it is determined that it has not been executed for all e-mails, the CPU 201 of the e-mail monitoring server 101 sets other e-mails that have not been subjected to the evaluation process as evaluation process target mails of the evaluation process. (Step S1305). Note that the evaluation process here refers to the process of step S1303.

  FIG. 14 is a flowchart showing detailed processing of the evaluation processing in step S1118 of the flowchart shown in FIG. The processing from step S1401 to step S1405 shown in FIG. 14 is executed by the CPU 201 of the e-mail monitoring server 101.

  This process is a process for collectively evaluating the parent mail of the e-mail in the same thread as the e-mail displayed on the evaluation screen (FIG. 20). In other words, on the evaluation screen, one of “Send OK”, “Send Not Available”, “Check Required”, or “Neither” is checked, the “Summary” check box is checked, and “Parent Mail” is checked. This process is executed when the “all” radio button is set.

  First, the CPU 201 of the email monitoring server 101 searches and acquires the email ID of the email evaluated on the evaluation screen (FIG. 20) from the thread management table (step S1401).

  Then, the CPU 201 of the email monitoring server 101 performs processing for setting the evaluation received on the evaluation screen (FIG. 20) for the email corresponding to the email ID acquired in step S1401 (step S1402). Note that the evaluation received on the evaluation screen (FIG. 20) is an evaluation of any one of “transmission enabled”, “transmission disabled”, “check required”, and “cannot say either”. Details of the processing are shown in FIG. 15 and will be described later.

  Next, the CPU 201 of the email monitoring server 101 sends the email ID (parent email ID) of the parent email set in the item “parent email ID” of the thread management table for the email that has been evaluated in step S1402. Is acquired (step S1403). Then, the process proceeds to step S1404.

  In step S1403, the CPU 201 of the email monitoring server 101 determines whether or not the parent mail ID has been acquired (step S1404). If it cannot be acquired (NO in step S1404), the process proceeds to step S1121. .

  On the other hand, if it is determined in step S1404 that the parent mail ID has been acquired (YES in step S1404), the CPU 201 of the email monitoring server 101 sets the same value as the acquired parent mail ID in the item of “mail ID”. The e-mail being received is set as an evaluation target (step S1405). Then, the process proceeds to step S1402.

  FIG. 15 is a flowchart showing detailed evaluation processing in step S1120 in the flowchart shown in FIG. 11, step S1303 in the flowchart shown in FIG. 13, and step S1402 in the flowchart shown in FIG. Note that the processing from step S1501 to step S1503 shown in FIG. 15 is executed by the CPU 201 of the e-mail monitoring server 101.

  This process is a process for setting the evaluation received on the evaluation screen (FIG. 20). In other words, this is a process of setting any of the evaluations “transmission enabled”, “transmission disabled”, “check required”, and “neither” accepted on the evaluation screen.

  First, the CPU 201 of the email monitoring server 101 determines whether or not the email of the email to be evaluated has been evaluated (step S1501). Specifically, the CPU 201 of the e-mail monitoring server 101 refers to the post search result DB (FIG. 24), and stores the evaluation (evaluation value) of the mail ID corresponding to the e-mail to be evaluated in the post search result DB. It is determined whether or not it has been done. If the evaluation value is not set in the post-search result DB, the CPU 201 of the e-mail monitoring server 101 determines that the e-mail has not been evaluated. On the other hand, if an evaluation value is set, the CPU 201 of the e-mail monitoring server 101 determines that the e-mail has been evaluated.

  Next, the CPU 201 of the e-mail monitoring server 101 determines whether or not “exclude evaluated mail” is checked in “collective evaluation” 2002 displayed on the evaluation screen (FIG. 20) (step S1502). ). If it is determined that it is checked (YES in step S1502), this process ends. On the other hand, if it is determined that the check is not made, the CPU 201 of the email monitoring server 101 sets the evaluation received on the evaluation screen (FIG. 20) in the post-audit database (FIG. 24) (step S1503). Step S1503 is a processing example of the setting means of the present invention.

  FIG. 19 is a diagram showing an example of the search result list screen displayed in step S1105. In this search result list screen, items of “audit status”, “mail subject”, “transmission source”, “transmission destination”, “transmission date / time”, and “evaluation” are displayed.

  The “audit status” indicates whether or not the evaluation process shown in FIG. 15 has been executed (evaluated). That is, “Done” indicates that evaluation has been completed, and “Not yet” indicates that evaluation has not yet been performed.

  “Mail subject” indicates the subject (title) of the mail. “Sender” indicates the name or email address of the sender of the email. “Transmission destination” indicates an electronic mail address of an electronic mail transmission destination. “Transmission date and time” indicates the date and time when the electronic mail is transmitted. “Evaluation” indicates the automatic evaluation result automatically evaluated in step S1214.

  FIG. 21 is a diagram illustrating an example of a list display screen displayed in step S1105 when evaluation is not performed collectively (when No is determined in step S1116 and evaluation processing is performed in step S1120).

  In this example, it is shown that only the e-mails whose “number” is “6” among the e-mails displayed as a list in FIG. 19 are evaluated. That is, the “audit status” of the e-mail whose “number of cases” is “6” is changed to “completed”.

  FIG. 22 is a diagram illustrating an example of a list display screen displayed in step S1105 when e-mails of the same thread are collectively evaluated (when No is determined in step S1117 and the process in step S1119 is performed). is there. Further, FIG. 22 shows an example of a list display screen when the “Max display number” e-mails are set as audit targets in step S2915, step S2911, and step S2913.

  In this example, among the e-mails displayed as a list in FIG. 19, when the e-mail whose evaluation has been accepted in step S1113 is an e-mail whose “number (name)” is 2 to 6, It shows that the emails of the same thread were evaluated together.

  In other words, all e-mails with “number (name)” of 2 to 6 that are e-mails of the same thread have been evaluated together (“audit status” is displayed as “done”). It is shown that.

  FIG. 23 shows a list display screen displayed in step S1105 when the parent mail is collectively evaluated among e-mails in the same thread (when YES is determined in step S1117 and the process in step S1118 is performed). It is a figure which shows an example.

  In this example, when the e-mail whose evaluation is accepted in step S1113 among the e-mails displayed as a list in FIG. 23 is an e-mail whose “number (name)” is 6, the parent of the e-mail It shows that the mail was evaluated together.

  That is, it is shown that the e-mails with “number (name)” of 2, 5, and 6 are collectively evaluated and changed to “evaluated” (“audit status” is displayed as “completed”).

  FIG. 26 is a diagram showing a condition setting screen for setting the transmission disabling condition (a) and the transmission hold condition (b) shown in FIG.

  The condition setting screen shows an example of setting a condition ID (corresponding to information for identifying each condition such as “condition 1” and “condition 2” shown in FIG. 25) and a keyword included in the mail text. ing.

  For example, in the condition setting screen shown in FIG. 26, the keyword “confidential” or “only relevant person” is entered in the keyword input field 2601, and “confidential” or “ When there is a keyword “limited”, it is possible to set a setting that disables transmission or puts transmission on hold.

  As described above, in the present embodiment, when setting information indicating that another email of the same thread as the email to be audited is received from the administrator terminal 104-3, not only the email to be audited but also the email to be audited. In addition, it is configured so that other emails in the same thread as the email are set as audited. Therefore, according to the present embodiment, it is possible to improve the efficiency of the evaluation work of an auditor who performs an electronic mail audit.

  In particular, when setting information for auditing all other emails in the same thread as the email to be audited is received from the administrator terminal 104-3, all other emails in the same thread as the email E-mail can be audited.

  Further, when setting information for auditing another email corresponding to the parent email is received from the administrator terminal 104-3 for the email to be audited, the same thread as that email and the parent email It is also possible to audit other e-mails corresponding to e-mails.

  Each means and each step constituting the embodiment of the present invention described above can be realized by operating a program stored in a RAM, a ROM, or the like of a computer. This program and a computer-readable recording medium recording the program are included in the present invention.

  Further, the present invention can be implemented as, for example, a system, apparatus, method, program, or recording medium, and may be applied to an apparatus composed of a single device.

  The present invention supplies a software program for realizing the functions of the above-described embodiments directly or remotely to a system or apparatus. In addition, this includes a case where the system or the computer of the apparatus is also achieved by reading and executing the supplied program code.

  Accordingly, since the functions of the present invention are implemented by computer, the program code installed in the computer also implements the present invention. In other words, the present invention includes a computer program itself for realizing the functional processing of the present invention. In that case, as long as it has the function of a program, it may be in the form of object code, a program executed by an interpreter, script data supplied to the OS, and the like.

  Further, the functions of the above-described embodiments are realized by the computer executing the read program. Furthermore, based on the instructions of the program, an OS or the like running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments can be realized by the processing.

  As another method, a program read from a recording medium is first written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Then, based on the instructions of the program, the CPU or the like provided in the function expansion board or function expansion unit performs part or all of the actual processing, and the functions of the above-described embodiments are also realized by the processing.

It is a figure which shows the structure of the information processing system which concerns on embodiment of this invention. It is a block diagram which shows the basic composition of an email monitoring server. It is a block diagram which shows the characteristic part of the function structure of an email monitoring server. It is a sequence chart which shows operation | movement of the information processing system which concerns on embodiment of this invention. It is a flowchart which shows the memory | storage process of an email, and the transmission decision processing which an email monitoring server performs. It is a flowchart which shows the detailed process of step S502 of FIG. It is a figure which shows the thread | sled management table memorize | stored in memory | storage means, such as HDD of an electronic mail monitoring server. It is a flowchart which shows the detailed process of the pre-inspection (step S405-S408) shown in FIG. It is a figure which shows the structural example of a log table. It is a figure which shows the structural example of a prior audit screen. It is a flowchart which shows the detailed process of the post audit (step S409-S411) shown in FIG. It is a flowchart which shows the detailed process of step S1103 of the flowchart shown in FIG. It is a flowchart which shows the detailed process of the evaluation process of step S1119 of the flowchart shown in FIG. It is a flowchart which shows the detailed process of the evaluation process of step S1118 of the flowchart shown in FIG. FIG. 14 is a flowchart showing detailed processing of evaluation processing in step S1120 of the flowchart shown in FIG. 11, step S1303 of the flowchart shown in FIG. 13, and step S1402 of the flowchart shown in FIG. It is a figure which shows the structural example of group information and management object definition information. It is a figure which shows the structural example of an email search screen. It is a figure which shows the example of a part of header information of an email and the parent mail of the said email. It is a figure which shows an example of the search result list screen displayed by step S1105. It is a figure which shows the structural example of an evaluation screen. It is a figure which shows an example of the list display screen displayed by step S1105 when not evaluating collectively. It is a figure which shows an example of the list display screen displayed by step S1105 when evaluating the email of the same thread collectively. It is a figure which shows an example of the list display screen displayed by step S1105 when evaluating a parent mail collectively among the emails of the same thread. It is a figure which shows the structural example of ex post audit result DB. It is a figure which shows the example of a transmission impossible condition and a transmission suspension condition. FIG. 26 is a diagram showing a condition setting screen for setting the transmission disabling condition (a) and the transmission hold condition (b) shown in FIG. 25. It is a flowchart which shows the email extraction process which the email monitoring server 101 performs. It is a flowchart which shows the process (Detailed process of step S2705, step S1212) which specifies the number of the emails which the email monitoring server 101 makes audit object. It is a flowchart which shows the email / sort process (detailed process of step S2706, step S1214) which the email monitoring server 101 performs. It is a flowchart which shows the automatic evaluation process (detailed process of step S2902) which the email monitoring server 101 performs. The figure which shows an example of the schedule definition table memorize | stored in the email monitoring server 101, the schedule event information table memorize | stored in the schedule management server 106, and the remaining time-audit scenario correspondence table memorize | stored in the email monitoring server 101 It is. It is a figure which shows an example of the search result list screen displayed by step S806. It is a figure which shows an example of the audit | inspection screen which receives selection of transmission or deletion of an email in step S808. 12 is a flowchart illustrating an example of thread evaluation calculation processing (detailed processing in step S3012) performed by the email monitoring server 101. 12 is a flowchart illustrating an example of thread evaluation calculation processing (detailed processing in step S3012) performed by the email monitoring server 101.

Explanation of symbols

101 Email monitoring server 102, 112 Email server 103 LDAP server 104-1, 104-2, 114 Information processing device 104-3 Information processing device (administrator terminal)
105 local network 106 schedule management server 120 wide area line

Claims (5)

An email auditing device that can communicate with an administrator terminal used by an administrator who audits email,
Schedule acquisition means for acquiring the schedule information from schedule storage means in which the administrator's schedule information is stored;
E-mail storage means for storing the e-mail and evaluation information indicating the necessity of auditing the e-mail;
A specification that identifies an email to be audited from among the emails stored in the email storage unit according to the schedule information acquired by the schedule acquisition unit and the evaluation information of the email stored in the email storage unit Means,
Transmitting means for transmitting the audit target e-mail data specified by the specifying means to the administrator terminal;
An electronic mail auditing apparatus comprising: A number specifying means for specifying the number of e-mails to be audited by the administrator according to the audit time of the administrator specified from the administrator's schedule information acquired by the schedule acquiring means;
Further comprising
The specifying means selects the number of e-mails specified by the number specifying means from among e-mails indicating that the evaluation information stored in the e-mail storage means is more than a predetermined value. The electronic mail auditing apparatus according to claim 1, wherein   The electronic mail auditing apparatus according to claim 1 or 2, wherein the electronic mail data transmitted by the transmission means includes evaluation information of the electronic mail specified by the specifying means. An email auditing method for an email auditing device capable of communicating with an administrator terminal used by an administrator who audits email,
A schedule acquisition step in which the schedule acquisition unit of the email inspection apparatus acquires the schedule information from a schedule storage unit in which the schedule information of the administrator is stored;
An e-mail storage step in which the e-mail storage means of the e-mail audit apparatus stores the e-mail and evaluation information indicating the necessity of auditing the e-mail;
According to the schedule information acquired in the schedule acquisition step and the e-mail evaluation information stored in the e-mail storage step, the specifying means of the e-mail auditing device includes the e-mail stored in the e-mail storage step. A specific process for identifying emails to be audited from
A transmitting step in which the transmission means of the e-mail inspection device transmits the data of the e-mail to be audited specified in the specifying step to the administrator terminal;
An e-mail audit method comprising: A program executed by an e-mail auditing apparatus that can communicate with an administrator terminal used by an administrator who performs an e-mail audit,
The e-mail audit device;
Schedule acquisition means for acquiring the schedule information from schedule storage means in which the administrator's schedule information is stored;
E-mail storage means for storing the e-mail and evaluation information indicating the necessity of auditing the e-mail;
A specification that identifies an email to be audited from among the emails stored in the email storage unit according to the schedule information acquired by the schedule acquisition unit and the evaluation information of the email stored in the email storage unit Means,
A program that functions as transmission means for transmitting data of an electronic mail to be audited specified by the specifying means to the administrator terminal.

Images