JP2010273311A - Mail encryption composite control apparatus and control method thereof, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent information from being leaked by electronic mail sent to an external network by using data of electronic mail of the same thread as a common key. <P>SOLUTION: When new electronic mail that is not a reply is transmitted, route mail is generated which becomes common key data for encrypting and decrypting the new electronic mail, and the common key data obtained from the route mail are used to encrypt the new electronic mail. Furthermore, when electronic mail of a reply is transmitted, common key data obtained from reply source mail are used to encrypt the electronic mail of the reply, and the common key data included in the route mail and the electronic mail in an encryption mail thread are used to decrypt the electronic mail which is encrypted and transmitted from the outside. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a mail encryption composite control system, and more particularly to a control technique for encrypted electronic mail.

  With the development of network technology in recent years, the cost of information exchange has dropped dramatically. Individuals and companies can efficiently communicate information by using various services using the Internet such as e-mail and web services. I can do it now.

  Beginning with the enforcement of the Personal Information Protection Law in 2005, organizations such as companies are required to take strict measures for information management. For example, the contents of e-mails sent outside the company as measures against information leakage It is common to introduce a transmission control system that permits information transmission to the outside only when the organization meets predetermined criteria, such as by checking.

  However, even with the introduction of such a transmission control system, accidents related to information leakage, such as erroneous transmission, will not stop. Therefore, organizations that consider the use of encrypted mail as a multi-level defense measure in information security. is there.

  Currently, S / MIME, PGP (Pretty Good Privacy), products that perform encrypted communication only on the transmission path, and the like are available as technologies that can be used as encrypted mail. Virus check at a mail gateway in a company is now common, but since encrypted mail has an End-To-End mechanism, such virus check of encrypted mail cannot be performed. In such a case, a virus can be sent directly from outside the organization to the inside of the organization. Furthermore, since it is impossible to confirm whether confidential information has been transmitted from within the organization by using encrypted mail, there is a concern about the active use of encrypted mail.

Under such circumstances, many people use a password-protected ZIP archive as an attached file. In this method, a mail with a password-protected ZIP archive attached is sent, and the password is written in another mail and sent to the same destination again. In this method,
・ It is very likely that the eavesdropper will eavesdrop unless the password is sent via another route, and the attached file cannot be protected. It has its characteristics and is not an intrinsically safe method. However, from the viewpoint of organization information management, it is possible to confirm encrypted attachments later by storing all sent and received e-mails and to take measures against increased human costs. This is one of the reasons why it is actively used even if it is not intrinsically safe.
In addition, as a technique for encrypting and transmitting content, the technique disclosed in Patent Document 1 discloses a method for decrypting content using a plurality of keys embedded in a plurality of contents received and stored in advance. is doing.

JP 2008-165486 A

In this way, when using encrypted mail, there are conflicting demands for information protection (encryption) and information monitoring (content audit). There is a problem of reducing cost as much as possible.
Furthermore, it has been difficult to confirm that the email has not been tampered with on a thread basis (it was difficult to guarantee the originality of the email on a thread basis).
That is, it is difficult to provide a mechanism that can monitor information while suppressing the operating cost of an encrypted mail system and that does not easily leak information even if erroneous transmission to a third party occurs.
In addition, information leakage is prevented by preventing outsiders (such as ISPs) from viewing the contents of e-mails sent to external networks provided by Internet service providers (ISPs). It was difficult.

  An object of the present invention is to provide a mechanism for preventing information leakage due to an e-mail sent to an external network by using e-mail data of the same thread as a common key.

  The present invention is a mail encryption composite control apparatus that controls encryption and decryption of an electronic mail, and when a new electronic mail that is not a reply is transmitted, the new electronic mail is encrypted and decrypted. First mail for encrypting the new e-mail using the root mail generating means for generating the root mail as the common key data and the common key data obtained from the root mail generated by the root mail generating means Generated by the encryption means, the second encryption means for encrypting the reply e-mail using the common key data obtained from the reply source mail, and the route mail generation means when sending the reply e-mail Routed mail, electronic mail encrypted by the first encryption means, electronic mail encrypted by the second encryption means, and encrypted Storage means for storing e-mail sent from the unit, and e-mail that is the parent of the e-mail that is encrypted and sent from the outside, up to the root mail, of the data stored in the storage means Extraction means for extracting the encrypted mail thread from the inside, and using the common key data included in the root mail and e-mail in the encrypted mail thread extracted by the extraction means And decrypting means for decrypting an electronic mail transmitted from the outside.

  According to the present invention, by using e-mail data of the same thread as a common key, information leakage due to e-mail sent to an external network can be prevented.

It is a schematic diagram which shows the structural example of the system which concerns on embodiment of this invention. It is a figure which shows the hardware constitutions of the encryption mail transmission apparatus 100 of embodiment of this invention. It is a figure which shows an example of the mail summary of embodiment of this invention. It is a figure which shows the structural example of the encryption mail thread | sled of embodiment of this invention. It is a figure which shows the structural example of the encryption mail thread containing the transfer process of embodiment of this invention. It is a flowchart which shows new preparation of the encryption mail of embodiment of this invention. It is an example of the rule management part 105 of embodiment of this invention. It is a flowchart which shows the mail encryption process of embodiment of this invention. It is a flowchart which shows the mail reception process of embodiment of this invention. It is a flowchart which shows the route mail reception process of embodiment of this invention. It is a flowchart which shows the related mail movement process of embodiment of this invention. It is a flowchart which shows the encryption mail reception process of embodiment of this invention. It is a flowchart which shows the parent mail search process of embodiment of this invention. It is a flowchart which shows the search condition selection process of embodiment of this invention. It is a flowchart which shows the reply process of the encryption mail of embodiment of this invention. It is a flowchart which shows the decoding process of the encryption mail of embodiment of this invention. It is a flowchart which shows the reception process of all the parent threads in the encryption mail thread | sled of embodiment of this invention. It is a flowchart which shows the transfer process of the encryption mail of embodiment of this invention. It is a figure which shows an example of the root mail information of embodiment of this invention. It is a figure which shows the Example of the route mail information of embodiment of this invention. It is a figure which shows the Example of the mail thread | sled of embodiment of this invention. It is a figure which shows the Example of the encryption mail thread | sled of embodiment of this invention. It is a flowchart which shows the parent mail search condition selection process of embodiment of this invention.

  Hereinafter, the present invention will be described in detail according to preferred embodiments with reference to the accompanying drawings.

  FIG. 1 is a schematic diagram showing a system configuration example of an electronic mail management apparatus according to an embodiment of the present invention.

  In FIG. 1, reference numeral 100 denotes an encrypted mail transmission device, which is a schematic diagram showing a function of transmitting an encrypted mail. Reference numeral 110 denotes an encrypted mail receiving apparatus, and is a schematic diagram illustrating a function of receiving an encrypted mail. The wide area network 120 is a network including the Internet.

  The encrypted mail transmission device 100 includes a mail input unit 101, a mail body changing unit 102, a thread search unit 103, a thread encryption unit 104, a rule management unit 105, a transmission unit 106, a mail storage unit 107, A route mail creation unit 108.

  The mail input unit 101 inputs data to the encrypted mail transmission device 100 and is an input device such as a keyboard and a mouse. The mail input by the mail input unit 101 is changed to the encrypted text by the mail text change unit 102 and is transmitted as an encrypted mail by the transmission unit 106. The mail body changed by the mail body changing unit 102 is sent to the thread encryption unit 104, and the e-mail thread searched by the thread search unit 103 from the mail storage unit 107 or the route mail created by the route mail creating unit 108. Based on encryption. Details of the series of mail thread encryption processing will be described later.

  The encrypted mail receiving apparatus 110 includes a receiving unit 111, a rule management unit 112, a thread decryption unit 113, a thread search unit 114, a mail storage unit 115, and a display unit 116.

  The encrypted mail received by the receiving unit 111 is stored in the mail storage unit 115. When the user desires to view the encrypted mail, the thread decryption unit 113 that has received the instruction searches the email storage unit 115 for an email thread including the encrypted mail via the thread search unit 114, and After executing the thread decoding process, the information is displayed on the display unit 116. Details of the series of thread decoding processes will be described later.

The thread search unit 103 and the thread search unit 114, the rule management unit 105 and the rule management unit 112, the mail storage unit 107, and the mail storage unit 115 have the same function.
Further, in FIG. 1, for ease of explanation, the encrypted mail transmitting device 100 and the encrypted mail receiving device 110 have been described separately. However, the function and configuration shown in the encrypted mail transmitting device 100 are encrypted. The encrypted mail transmitting apparatus 100 also has the functions and configuration shown in the encrypted mail receiving apparatus 110. Therefore, the encrypted mail transmitting device 100 and the encrypted mail receiving device 110 can send and receive encrypted mail to each other.

  FIG. 2 is a block diagram illustrating a hardware configuration of the encrypted mail transmission device 100 (mail encryption composite control device) and the encrypted mail reception device 110 (mail encryption composite control device).

  In FIG. 2, reference numeral 201 denotes a CPU that controls the entire encrypted mail transmission apparatus 100 using programs and data stored in the RAM 202 and ROM 204, and implements each process described below performed by the encrypted mail transmission apparatus 100. To do.

  The RAM 202 is an area for temporarily storing programs and data loaded from the HDD (hard disk drive) 204 and the storage medium drive 206, programs and data received from the outside via the network I / F (interface) 205, and the like. In addition, various areas such as a work area used when the CPU 201 executes various processes can be provided as appropriate.

  The ROM 203 stores setting data of the encrypted mail transmission device 100, a boot program, and the like.

  The HDD 204 is used to store an OS (Operating System) and programs and data for causing the CPU 201 to execute processes to be described later performed by the encrypted mail transmission apparatus 100, and these are appropriately stored in the RAM 202 according to control by the CPU 201. To be processed by the CPU 201.

  The network I / F 205 is for connecting the encrypted mail transmitting apparatus 100 to the wide area network 120, and the encrypted mail transmitting apparatus 100 is connected to the wide area network 120 through the network I / F 205. Data communication with each device can be performed.

  The storage medium drive 206 reads a program and data recorded on a storage medium such as a CD-ROM, CD-R / RW, DVD-ROM, DVD-R / RW, and DVD-RAM, and outputs them to the RAM 202 and the HDD 204. . A part of the information stored in the RAM 202 or the HDD 204 may be recorded on this storage medium.

  A keyboard 207 and a pointing device 208 configured with a mouse, a joystick, and the like can input various instructions to the CPU 201 when operated by an operator of the encrypted mail transmission apparatus 100.

  The display unit 209 is configured by a CRT, a liquid crystal screen, or the like, and can display the processing result by the CPU 201 with images, characters, and the like.

  The external device connection I / F 210 is an interface for connecting peripheral devices to the encrypted mail transmission device 100. The encrypted mail transmission device 100 performs data transmission / reception with the peripheral device via the external device connection I / F 210. The external device connection I / F 210 is configured by USB, IEEE1394, or the like, and usually has a plurality of external device connection I / Fs. The connection form with the peripheral device may be wired or wireless.

  The bus 211 connects the above-described units.

  Note that the hardware configuration of the encrypted mail transmitting apparatus 100 is described as having the structure shown in FIG. 2, but is not necessarily limited to having the structure shown in FIG. 2, and the processing performed by the encrypted mail transmitting apparatus 100 As long as the following processing described below can be executed, the configuration of the encrypted mail transmission device 100 may be modified as appropriate.

  The hardware configuration of the encrypted mail receiving apparatus 110 is generally the same as that shown in FIG. 2 because a general computer is applied thereto. Furthermore, the encrypted mail transmitting device 100 and the encrypted mail receiving device 110 may be configured on the same hardware.

  Next, the mail thread will be described with reference to FIGS.

  FIG. 3 is a diagram showing an example of a mail summary. The mail summary 300 displays a part of the mail stored in the user's client terminal device. In addition, a mail thread is an arrangement of a plurality of mails exchanged between a sender and a mail recipient in a time series for one topic.

  In the mail summary 300, the mail 302, the mail 303, the mail 304, and the mail 305 based on the mail 301 constitute a first mail thread. The mail 302, the mail 303, the mail 304, and the mail 305 all indicate reply processing to the previous mail.

  The mail 307 and the mail 308 form a second mail thread with the mail 306 as a base point. Note that the mail 308 indicates that the sender hayashi has forwarded the mail 306 to the destination umeda, not the reply process of the mail 307.

  As described above, as a first method for determining the configuration of a mail thread composed of a plurality of mails, each header information of Message-ID, In-Reply-To or Reference described in RFC (Request for Comments) 2822 is used. There is a method to refer to.

  The first method will be described in detail with reference to FIG. The mail 2101 is an example of an electronic mail, and has a Message-ID header 2102 for identifying that the mail 2101 is unique as described in RFC2822. A mail 2103 is an example when an electronic mail is returned, and a reply process for the mail 2101 is performed.

  As described in RFC2822, it is said that the identification information of the mail that is the reply source in the reply process should be described in the In-Reply-To header. In the mail 2103, the In-Reply-To header 2104 is The value of the Message-ID header 2102 of the mail 2101 is described as the value.

  The sender's client terminal apparatus that has sent the mail 2101 and received the mail 2103 can recognize that the reply of the mail 2101 is the mail 2103 by referring to these header information, so that the mail 2101 and the mail 2103 are mail. It can be determined that the thread is configured.

  Similarly, also in the mail 2106, the value of the In-Reply-To header 2108 is the value of the Message-ID header 2105 of the mail 2103. Therefore, it can be determined that the mail 2106 is also a part of the mail constituting the mail thread.

  As a second technique for determining that the mail is a mail thread, there is a technique that uses what is called an arbitrarily attached tag. The tag may be arbitrarily given by the client terminal user or may be automatically given by the e-mail system. In the case of automation by the system, for example, a group of a plurality of senders may be used, or certain specific header information may be assigned to the same.

  As a third method for determining the configuration of the mail thread, there is a method of collecting the same subject. In the case of a reply mail or forwarded mail, a formal character string such as “Re:” representing a reply or “Fw:” representing forward is added to the subject of the mail. Therefore, this is a technique for determining that the same mail having a subject excluding such a character string constitutes a mail thread.

  In the second and third methods, since a plurality of mails that meet the conditions are detected, the transmission time in each mail is referred to arrange them in time order.

  The mail thread configuration determination method has been described above. In the following examples, the first method (RFC2822) will be mainly described.

  Next, an outline of mail thread encryption using the mail thread structure will be described with reference to FIGS.

  FIG. 4 shows a part of a configuration example when the first mail thread based on the mail 301 in FIG. 3 is an encrypted mail thread. The encrypted mail structure 402 corresponds to the mail 301, and the encrypted mail structure 405 corresponds to the mail 302. At this time, the mail body part is in an encrypted state (403 and 406).

  The decryption process in the mail thread encryption method has a feature of using the body part of the parent mail of the mail as a common key file. Therefore, the decryption key of the encrypted text 406 is the mail text 404 obtained by decrypting the encrypted text 403 of the encrypted mail structure 402 corresponding to the parent mail. That is, the encrypted text 406 is decrypted using the mail text 404 as a common key file to obtain the mail text 407.

  At this time, in order to obtain the mail text 404 that is a common key file, the encrypted text 403 must be decrypted. The decryption key is the root mail text 401 of the root mail structure 400. Details of the route mail will be described later.

  FIG. 5 shows a part of a configuration example when the second mail thread based on the mail 303 in FIG. 3 is an encrypted mail thread. The encrypted mail structure 502 corresponds to the mail 306, the encrypted mail structure 505 corresponds to the mail 307, and the encrypted mail structure 508 corresponds to the mail 308. The encrypted mail structure 508 has a transfer processing relationship with the encrypted mail structure 502. Accordingly, the common key file for decrypting the encrypted body 509 of the encrypted mail structure 508 is the decrypted mail body 504 of the encrypted mail structure 502, and the common key file for decrypting the encrypted body 506 of the encrypted mail structure 505. Is the same.

  Thus, in the mail thread encryption method, it is necessary to decrypt the parent mail in a chain in order to decrypt the encrypted body part. Therefore, the encrypted text cannot be decrypted unless all mails constituting the mail thread including the root mail are possessed.

  Next, a procedure for creating a new mail in the mail thread encryption method will be described with reference to FIGS. 1, 6, 7, and 8. FIG.

  FIG. 6 shows a flow for creating a new encrypted mail. In step S601, a user creates a new mail by operating the mail input unit 101 in FIG. The newly created mail is called the first mail, and at this point, the first mail is not encrypted.

  Subsequently, in step S602, it is confirmed whether or not the first mail is an encryption target. That is, the rule management unit 105 refers to the operation rule for the first mail sent to the mail body changing unit 102 in FIG.

  FIG. 7 shows an example of the operation rule 700. The operation rule is a management table that describes what operation the system performs in accordance with various conditions such as the contents of the created mail and the destination. For example, the operation rule 701 indicates “encrypt if the destination includes outside the organization”, the operation rule 702 indicates “encrypt if the result of keyword inspection includes“ confidential ””, and the operation rule 703. Indicates “encrypt if there is an attached file”.

  Returning to FIG. 6, if “No” in step S 602, that is, if it is determined that the mail is not encrypted, the first mail is sent to the transmitting unit 106 in an unencrypted state in step S 610. The transmission process is completed. In subsequent step S609, the first mail is stored in the mail storage unit 107 in an unencrypted state.

  If it is determined that the first mail is an object to be encrypted (“Yes” in step S602), the process proceeds to step S603 to manage whether the user who created the first mail has permission to create a new thread. Reference is made to part 105. For example, the operation rule 704 in FIG. 7 indicates that “users Hayashi and Tanaka have permission for new creation”. If the user does not have permission to create a new thread (if “NO” in step S603), the user is notified of the fact and the process is stopped.

  If the user has permission to create a new thread (“Yes” in step S603), the process proceeds to step S604, and the route mail creation unit 108 creates a route mail. The root mail is a special mail as a base point of the encrypted mail thread as shown in the encrypted mail structure 400 and the encrypted mail structure 500, and is common to the encryption / decryption processing of the body part of the first mail. This email is a key file. Details of the route mail will be described later.

  Using the root mail created in step S604 as a common key file, the first mail is encrypted in step S605. Here, the encryption process will be described with reference to FIG.

  In step S801 of FIG. 8, the mail text that is the encryption target of the first mail is extracted. In step S802, the mail text extracted from the root mail as a common key file is encrypted. At this time, by specifying the use of the passphrase when creating the root mail, the user can input the passphrase and the encryption strength can be improved. Details of the route mail including the pass phrase will be described later.

  In the following step S803, the encrypted mail body is converted into a text string so that it can be processed by the mail server, and replaced with the body of the first mail. In addition, an In-Reply-To (or Reference header) based on RFC2822 is assigned to the header portion of the first mail in order to indicate that it is chained from the root mail. At this time, the Message-ID identifier assigned to the root mail is assigned as a header value. Details of the chain relationship based on these route mails will be described later.

  Returning to FIG. 6, the route mail is transmitted from the transmitting unit 106 in step S <b> 606. Subsequently, the first mail encrypted in step S <b> 607 is transmitted from the transmission unit 106. After the transmission is completed, in step S608, the route mail is stored in the mail storage unit 107, and in the subsequent step S609, the encrypted first mail is also stored in the mail storage unit 107, and the new creation process is terminated.

  Here, the route mail created in step S604 will be described.

As described above, the root mail is the base point of the encrypted mail thread, and is automatically created when the first mail is created. At the time of creating the route mail, the route mail includes one or more of the following information.
(1) Information related to mail identifier (2) Auxiliary information for encryption (3) Information related to mail thread management method (4) Information proving transmission information of first mail For such route mail information, FIG. 19 is used. FIG. 20 shows an embodiment.

  The route mail information 1900 in FIG. 19 shows an example of route mail information described in the route mail. The root mail identifier 1901 and the first mail identifier 1902 are information regarding the mail identifier. The root mail identifier 1901 is arbitrary character string information for determining that the root mail is unique, and corresponds to the Message-ID of RFC2822. Moreover, the 1st mail identifier 1902 shows Message-ID of the said 1st mail produced | generated by step S601 in FIG. 6, for example.

  In FIG. 20, a root mail 2000 shows an example of a root mail. Header information 2001 (Message-ID) is an example of the root mail identifier 1901, and header information 2002 (X-CryptThread-Mail) is an example of the first mail identifier 1902.

  The encryption auxiliary character string 1903 describes a random character string in advance in order to strengthen the encryption strength when the root mail itself is used as a common key file. In FIG. 20, an encryption auxiliary character string 2003 is an example of the encryption auxiliary character string 1903. The encryption auxiliary character string 2003 is described in the mail body area.

  The root mail identifier 1901, the first mail identifier 1902, and the auxiliary encryption character string 1903 are essential items as root mail information.

  The mail thread management information includes a disclosure range 1904, an expiration time 1905, and a passphrase 1906. These pieces of information are information related to mail thread management based on the first mail, and are optional items. The open range 1904 restricts mail transmission outside the range specified in advance. This is used in a reply or transfer process from an encrypted mail thread to be described later. The expiration time 1905 specifies the expiration time of the encrypted mail thread.

  The passphrase 1906 forces the user to input a passphrase in mail encryption and decryption processing. For example, in the process of encrypting the mail text in step S802, if a passphrase is described in the root mail of the encrypted mail thread, the input of the passphrase is compelled and the input passphrase and the root mail are described. If the passphrases do not match, the encryption process will fail. In the passphrase 1906, the passphrase to be input is not described as it is, but for example, the value of a hash function such as SHA (Secure Hash Algorithm) is described. A method of comparing with a hash value is desirable.

  Information that proves the transmission information of the first mail includes a certificate 1907 and a transmission time 1908. The certificate 1907 proves the sender of the first mail, and the transmission time 1908 indicates information (time stamp) that proves the transmission time of the first mail. Since the proof information increases the management cost as described above, it is an optional item so that it can be used in consideration of the balance between the security and reliability of the encryption system.

  In FIG. 20, an area 2004 is an example of the mail thread management information and information related to the certificate. An area 2004 is a mail text, which is distinguished from the encryption auxiliary character string 2003 with a blank line in between. In the example of FIG. 20, the disclosure range is set to * @ example. co. It is limited to jp, the passphrase is validated, and the expiration time, sender certificate and transmission time certificate are not set. In other words, the encrypted mail thread based on the root mail 2000 requires the input of a passphrase for the encryption / decryption processing, and the example. co. It is managed that transmission to other than the jp domain is not possible.

  Here, an example of an encrypted mail thread based on the root mail 2000 is shown in FIG. The mail 2201 is the root mail 2000. The mail 2201 is given header information 2202 (Message-ID) which is a mail identifier. Since the mail 2201 is a root mail, the header information 2203 indicating the first mail identifier is assigned, and the value thereof is the same as the value of the header information 2205 that is the mail identifier of the mail 2204.

  Further, the mail 2204 has header information 2206 (In-reply-to) for indicating a mail thread based on the root mail 2201. The value of the header information 2206 is the same as the value of the root mail identifier 2202. In the same manner, the mail 2207, the mail 2208 and the encrypted mail thread are configured in the same manner.

  Further, the header information 2209 (Content-type) indicates that the value is application / x-cryptthread-mail and that it is an encrypted mail constituting an encrypted mail thread.

  Next, encrypted mail reception processing in the encrypted mail receiving apparatus 110 in FIG. 1 will be described with reference to FIGS. 9 to 14 and FIG.

  In creating a new encrypted mail (FIG. 6), the root mail is transmitted in step S606, and the first mail encrypted in step S607 is transmitted. As described above, in this system, since a plurality of types of mail are transmitted, it is necessary for the receiving unit 111 in the encrypted mail receiving apparatus 110 to perform processing according to the type of received mail. FIG. 9 shows mail reception processing.

  It is determined whether the mail received in step S901 is a root mail. For example, the determination criterion can be determined by whether or not the route mail identifier 2203 in FIG. 22 is present. If it is determined that it is a root mail (in the case of “Yes” in step S901), the process proceeds to step S902, and a root mail receiving process is performed.

  The route mail receiving process is shown in FIG. In step S <b> 1001, it is determined based on the operation rule of the rule management unit 112 whether the user has permission to receive route mail. In the operation rule 700 illustrated in FIG. 7, the operation rule 705 relates to the root mail reception permission. In the example of the operation rule 705, the root mail reception permission is given to the users Hayashi and Tanaka.

  If there is permission to receive route mail (if “Yes” in step S1001), the process proceeds to step S1002, and the received route mail is stored in the mail storage unit 115. In the subsequent step S1003, the mail to be searched (search mail) is set as the root mail, and the related mail movement process is performed in step S1004.

  The related mail movement process is a process that considers delayed delivery of electronic mail. E-mail is not a system that guarantees reception in the order of transmission. For example, in the new creation of the encrypted mail in FIG. 6, when the root mail and the first mail are transmitted, the first mail may be received first. At this time, since there is no root mail as a base point of the first mail, an encrypted mail thread cannot be configured. This process is performed when the root mail is received in such a situation.

FIG. 11 shows the related mail movement process, and FIG. 14 shows the search condition selection process.
In step S1401, “No” is determined in the case of WEB mail. Also, mail sent and received by SMTP is determined as “Yes” in step S1401. That is, WEB mail generally does not have a Message-ID. Therefore, in the case of WEB mail, the process of step S1404 or S1405 is executed. The same applies to FIG. 23 described later. In other words, “NO” is determined in S2301 in the case of WEB mail. In addition, mail transmitted / received by SMTP is determined as “Yes” in step S2301.

  In step S1101, search conditions are selected. Moving to FIG. 14, in step S1401, it is confirmed whether Message-ID header information exists in the mail set as the search mail. Here, since the root mail is set as the search mail in step S1003 in FIG. 10, the root mail identifier exists, and the process proceeds to step S1402, where the Message-ID value and the search range are set to “none”. The reason why the search range is not specified is that a mail can be uniquely specified only by Message-ID.

  If “NO” in the step S1401, that is, if the Message-ID header information does not exist, the process proceeds to a step S1403. In step S1403, it is confirmed whether a tag is attached to the search mail. If a tag is given (in the case of “Yes” in step S1403), the process proceeds to step S1404, in which the tag value and the search range are set as the search key and “time (future)”. The time (future) indicates a time that is in the future from the time when the search mail is transmitted. The purpose of the related mail movement process is to detect a mail based on a search mail received before a search mail that has been delayed. That is, it is to confirm whether an email that should be received after the search email is received first.

  If no tag has been assigned in step S1403 (in the case of “No”), the process proceeds to step S1405, where the subject is set as the search key and the search range is set to “time (future)”. Hereinafter, a case where a Message-ID value is set as a search key will be described as an example.

  Returning to FIG. 11, in step S1102, the mail having the set search key (Message-ID value) in the In-reply-to header information is searched from the temporary storage area. The temporary storage area is an area for temporarily storing a mail that does not have a base point that is delayed and delivered, such as the first mail. Since the search key is the Message-ID value, the search result is uniquely determined.

  If there is a search result ("Yes" in step S1103), the process proceeds to step S1104, the search mail is set as the search result mail, and the search result mail is moved from the temporary storage to the normal storage area (step S1105). . Thereafter, the process returns to step S1101, and a temporarily stored mail search (search for a mail whose parent is the mail found in the search result) is performed again. That is, the series of processes is a process for searching all mails constituting the encrypted mail thread from the temporarily stored mails. When all the mails are searched (in the case of “No” in step S1103), the related mail movement process is terminated.

Returning to FIG. 10, when the related mail movement process is performed in step S1004,
When receiving in the order of root mail → first mail, only the root mail is received. When receiving in order of first mail → root mail, the root mail and the first mail are stored in the mail storage unit 115. The process when the first mail is received first will be described later.

  If there is no permission to receive route mail (in the case of “No” in step S1001), an encrypted mail thread based on the received route mail cannot be received, and therefore it is determined whether to notify the sender (step S1001). S1005). In the operation rule 700 illustrated in FIG. 7, the operation rule 706 relates to the sender notification. In the example of the operation rule 706, the sender notification permission is given to the users Hayashi, Tanaka, and Umeda.

  If the sender notification is permitted (“YES” in step S1005), the sender notification is performed (step S1006). In this case, it is notified that the root mail cannot be received. If the sender notification is not permitted (if “NO” in step S1005), step S1006 is skipped.

Subsequently, if the mail constituting the encrypted mail thread based on the root mail that cannot be received is temporarily stored, all of these are deleted. In step S1007, the root mail is set as the search mail, and the mail is searched from the temporary storage and deleted as in the related mail movement process in FIG. 11 (steps S1008 to S1001). After searching and deleting all related mails (in the case of “No” in step S1009), the root mail reception process is terminated as reception rejection.
Note that the processing from step S1007 to S1011 may be executed periodically.

  Returning to FIG. 9, if it is determined in step S901 that it is not a root mail (in the case of “No”), it is determined whether it is an encrypted mail (step S903). The determination criterion can be determined based on whether the value of the header information 2209 (Content-type) is application / x-cryptthread-mail. If it is determined that it is an encrypted mail (“Yes” in step S903), the process proceeds to step S904, and an encrypted mail reception process is performed.

  The encrypted mail reception process is shown in FIG. The received encrypted mail needs to specify the parent mail for configuring the encrypted mail thread. In step S1201, the received encrypted mail is set in the search mail, and the parent mail is searched in step S1202.

FIG. 13 shows parent mail search processing, and FIG. 23 shows parent mail search condition selection processing.

  In step S1301, parent mail search conditions are selected. Moving to FIG. 23, in step S2301, it is confirmed whether the In-reply-to header information exists in the encrypted mail set in the search mail. For example, the encrypted mail 2204 in FIG. 22 has header information 2206 (In-reply-to). Accordingly, the process proceeds to step S2302, and the search key is set to the In-reply-to value and the search range is set to “none”. The reason why the search range is not specified is that the mail can be uniquely specified only by the Message-ID that is the In-reply-to value.

  If “NO” in the step S2301, that is, if the In-reply-to header information does not exist, the process proceeds to a step S2303. In step S2303, it is confirmed whether or not a tag is attached to the search mail. If a tag has been assigned (in the case of “Yes” in step S2303), the process proceeds to step S2304, in which the tag value and the search range are set as the search key and “time (past)”. The time (past) indicates a time that is earlier than the time when the search mail is transmitted. In the parent mail search process, it is not necessary to search for future mails rather than search mails.

  If no tag is assigned in step S2303 (if “No”), the process proceeds to step S2305, where the subject and the search range are set as the search key and “time (past)”. Hereinafter, a case where an In-reply-to value is set as a search key in step S2302 will be described as an example.

  Returning to FIG. 13, in step S1302, the stored mail is searched for mail having the set search key (In-reply-to value) in the Message-ID header information. Since the search key is an In-reply-to value (Message-ID), the search result is uniquely determined. In step S1303, the search result is confirmed. If the mail having the search key is not stored (“No” in step S1303), the parent mail search fails. If there is an email having a search key (“Yes” in step S1303), the process advances to step S1304.

  If the search key is not an In-reply-to value, that is, if the search key is a tag or subject, the process proceeds to step S1305, and the latest mail is selected from the search results, and this is set as the parent mail. To do. If the search key is an In-reply-to value, the search result is uniquely determined, so step S1305 is skipped and the parent mail search process is terminated.

  Returning to FIG. 12, if the parent mail search is successful in step S1203 (in the case of “Yes”), the process proceeds to step S1204, and the received encrypted mail is stored in the mail storage unit 115. In step S1205, the encrypted mail is set as the search mail. In step S1206, it is confirmed whether the encrypted mail having the encrypted mail as a parent is temporarily stored, and the encrypted mail receiving process is terminated. .

  If the parent mail is not detected in the parent mail search (“No” in step S1203), the process proceeds to step S1207, and it is confirmed by the operation rule of the rule management unit 112 whether the sender notification is permitted. If the sender notification is permitted (“Yes” in step S1207), the sender notification is executed in step S1208. In this case, it is notified that the parent mail could not be found when receiving the encrypted mail. If the sender notification is not permitted (in the case of “No” in step S1207), step S1208 is skipped. In step S1209, the encrypted mail in the previous period is stored in the temporary storage area, and the encrypted mail receiving process is terminated.

  Returning to Fig. 9, if it is determined in step S903 that it is not an encrypted mail (in the case of "No", the process proceeds to step S905, where it is determined whether or not it is all parent thread mail. If it is determined that the message is all-parent thread mail, the process advances to step S906 to perform all-parent thread mail reception processing.

  If it is determined that the mail is not an all-parent thread mail (“No” in step S905), the process proceeds to step S907, and it is determined whether the notification is a sender notification. If it is determined that the notification is a sender notification (“Yes” in step S907), a sender notification reception process is performed (step S908). In the sender notification reception process, the received notification data is displayed on the display unit 116, or a notification mark is automatically given to the encrypted mail that causes the notification, thereby notifying the user. To do.

  Mail that does not satisfy the above conditions (in the case of “No” in step S907) proceeds to step S909 and is received as a normal mail.

  Next, encrypted mail reply processing will be described with reference to FIG.

  In step S1501, the mail to be returned is set as a search mail. In the subsequent step S1502, the mail decryption process is performed. In the case of the encrypted mail thread structure in the present invention, in order to decrypt the encrypted mail to be returned, the encrypted mail thread is changed to the root mail, It is necessary to decrypt sequentially from one mail.

  Such decryption processing of the encrypted mail will be described with reference to FIG.

  In step S1601, the stack for storing the encrypted mail is initialized. In step S1602, the encrypted mail to be decrypted is set in the search mail, and in order to search and decrypt the parent mail in step S1603, mail that constitutes all encrypted mail threads including the parent mail is required. Therefore, when the parent mail search fails (in the case of “No” in step S1604), the decryption process of the encrypted mail fails and ends.

  If the parent mail search is successful (in the case of “Yes” in step S1604), it is determined in the subsequent step S1605 whether the search result mail is a root mail. If it is not a root mail (“No” in step S1605), the process proceeds to step S1606, and the search result mail is pushed to the mail stack. In step S1607, the search result encrypted mail is set in the search mail, and the process returns to step S1603. By performing these series of processes, it is possible to extract the encrypted mail thread from the decryption target mail to the root mail.

  If it is a root mail in step S1605 (if “Yes”), the root mail information is extracted in step S1608. In subsequent step S1609, the mail thread management information in the root mail information is referred to, for example, by checking the expiration time 1905 in FIG. 19, to determine whether the encryption is valid. If it is determined that the encryption is invalid (“No” in step S1609), the mail decryption process fails and ends.

  If it is determined that the encryption is valid (“Yes” in step S1609), decryption processing using the encrypted mail thread is performed. In step S1610, root mail is set as a common key file. In subsequent step S1611, while the mail stack is not empty, the encrypted mail is extracted from the mail stack (step S1612), and the encrypted mail text is decrypted with reference to the common key file (step S1613). At this time, if necessary, input of a passphrase 1618 is required.

  If the decryption of the encrypted mail fails (“No” in step S1614), the mail decryption process fails and ends. If the decryption is successful (“Yes” in step S1614), the decrypted encrypted mail text is set in the common key file (step S1615), and the process returns to step S1611. In this way, the encrypted mail is decrypted until the mail stack becomes empty, and the parent mail of the decryption target mail is decrypted.

  In step S1619, the decryption target mail is decrypted using the parent mail text as a common key file. If the decryption process in step S1619 fails (in the case of “No” in step S1620), the mail decryption process fails and ends. If the decryption process is successful (“YES” in step S1620), the mail decryption process ends.

  Returning to FIG. 15, when the decryption process of the reply source mail fails in step S1503, the mail reply process is terminated. If the decryption processing is successful, the decrypted reply source mail is presented to the user and the reply mail is input (step S1504).

  After the reply mail is input in step S1504, the reply mail is delivered. At this time, the reply destination may be modified by the user with respect to the reply source mail. In this case, in the encrypted mail thread method according to the present invention, there is no series of parent mails up to the reply source mail including the root mail constituting the encrypted mail thread on the new destination side. Even if it is received, its contents cannot be decrypted, so it is necessary to divide only the newly added destination. Therefore, it is confirmed whether or not there is an additional destination in the reply mail created in step S1505.

  If there is no additional destination (“No” in step S1505), the reply mail created using the reply source mail as a common key file is encrypted (step S1506). In subsequent steps S1507 and S1508, the encrypted reply mail is distributed to all reply destinations.

  After completing the reply to all destinations, the encrypted mail created in step S1509 is stored in the mail storage unit 115, and the mail reply process is terminated.

  If a destination has been added in step S1505 (in the case of “Yes”), the process proceeds to step S1510, and the following processing is performed for all the added destinations.

  In step S1511, the operation rule is confirmed, and it is determined whether the rule is to be encrypted based on the destination or the content of the reply mail. If the rule is not for encryption (if “NO” in step S1511), the reply to the encrypted mail will be unencrypted, so the process proceeds to step S1521, a message indicating that the reply is prohibited is displayed, and the process returns to step S1510.

  If it is a rule to be encrypted (in the case of “Yes” in step S1511), the process proceeds to step S1512, where the operation rule is confirmed, and whether or not all the parent threads can transmit is confirmed. When a new destination receives an encrypted reply mail, it must have the encrypted mail thread including the root mail for decryption. The all parent thread means all the parent mails constituting the encrypted mail thread. In the operation rule 700 illustrated in FIG. 7, the operation rule 707 is an example of permitting all threads to be received by the users Hayashi and Tanaka.

  If there is permission to send all parent threads to the destination (“Yes” in step S1512), all parent threads are extracted from the mail storage unit 107 (step S1513). In subsequent step S1514, as in step S1506, the reply mail created by using the parent mail as a reply source as the common key file is encrypted. In step S1515, all the parent threads are transmitted. In step S1516, the encrypted reply mail is transmitted, and the process returns to step S1510.

  If it is determined that all the parent threads cannot be transmitted (in the case of “No” in step S1512), since it is determined that the mail should be encrypted in the immediately preceding step S1511, can it be created as a new thread in step S1517? Check whether or not the action rule. If there is no permission to create a new thread (“No” in step S1517), the process proceeds to step S1521, and a message indicating that the reply is prohibited is presented to the user.

  If there is permission to create a new thread (if “Yes” in step S1517), a root mail is created (step S1518), and the reply mail is encrypted using the root mail as a common key file (step S1519). In step S1520, the root mail is transmitted. In step S1516, the encrypted reply mail is transmitted, and the process returns to step S1510.

  In step S1510, when the reply process for all the additional destinations is completed, the process proceeds to step S1522. As a result of referring to the operation rule, when there is an additional destination and no reply process is performed on the additional destination (“No” in step S1522), it is considered that the designation of the destination is invalid. The mail reply process is terminated regardless of whether there is an existing destination. If there is a reply to the additional destination (“Yes” in step S1522), the process proceeds to step S1506, and a reply process for the existing destination is performed.

  All the parent thread mails transmitted in step S1515 in FIG. 15 are processed through step S906 in the mail reception process in FIG. The all-parent thread reception process will be described with reference to FIG.

  In step S1701, the operation rule is referred to, and it is confirmed whether or not reception of all parent threads is permitted. If there is no reception permission (“NO” in step S1701), the process proceeds to step S1705, and it is confirmed by the operation rule whether or not the sender notification is permitted. If the sender notification is permitted (“Yes” in step S1705), the sender is notified that all parent threads cannot be received (step S1706). If there is no sender notification permission (“NO” in step S1705), step S1706 is skipped and reception of all parent threads is rejected.

  If reception of all parent threads is permitted (“YES” in step S1701), all parent threads are stored in the mail storage unit 115 (step S1702). In the subsequent step S1703, the final mail in all the parent threads is set as the search mail, and the related mail movement process is performed (step S1704). This is a process for confirming whether an encrypted mail following all parent threads has been received first.

  Next, the encrypted mail transfer process will be described with reference to FIG.

  In step S1801, a mail to be transferred is set as a search mail. In the subsequent step S1802, the encrypted mail to be transferred is decrypted as in the mail reply process. If the decryption process of the transfer source mail fails (in the case of “No” in step S1803), the mail transfer ends.

  If the transfer source mail is successfully decrypted (“Yes” in step S1803), the decrypted transfer source mail is presented to the user and the transfer mail is input (step S1804).

  Since the destination of the source mail is not inherited in the mail transfer, all destinations are targeted in the series of processing from step S1805. In step S1806, if it is not a rule for encryption (in the case of “No”), since the encrypted mail is transferred without encryption, the process proceeds to step S1816, and the transfer prohibition is presented to the user. The process returns to S1805.

  If it is a rule to be encrypted (in the case of “Yes” in step S1806), the process proceeds to step S1807, where the operation rule is confirmed, and whether or not all the parent threads can transmit is confirmed. When the destination receives an encrypted transfer mail, it must have the encrypted mail thread including the root mail for decryption.

  If there is permission to send all parent threads to the destination (“Yes” in step S1807), all parent threads are extracted from the mail storage unit 107 (step S1808). In subsequent step S1809, the transfer mail created using the parent mail as the transfer source as a common key file is encrypted. In step S1810, all the parent threads are transmitted. In step S1811, the encrypted transfer mail is transmitted, and the process returns to step S1805.

  If it is determined that all the parent threads cannot be transmitted (in the case of “No” in step S1807), since it is determined that the mail should be encrypted in the immediately preceding step S1806, can it be created as a new thread in step S1812? Check whether or not the action rule. If there is no permission to create a new thread (“No” in step S 1812), the process advances to step S 1816 to present to the user that transfer is prohibited.

  If there is permission to create a new thread (if “Yes” in step S1812), a root mail is created (step S1813), and the forwarded mail created using the root mail as a common key file is encrypted (step S1814). Subsequently, the root mail is transmitted (step S1815), the encrypted transfer mail is transmitted (step S1811), and the process returns to step S1805.

  After performing a series of processes for all destinations from step S1805, the process proceeds to step S1817. If no transfer is performed (in the case of “No”), the mail transfer process is terminated. When the encrypted mail transfer process is performed to one or more destinations (in the case of “Yes” in step S1817), the created encrypted mail is stored in the mail storage unit 107 (step S1818).

  Next, a method for auditing encrypted mail transmitted / received on the mail gateway will be described.

  The encrypted mail thread method according to the present invention has a feature that the encrypted mail cannot be decrypted unless all mail including the root mail is possessed. However, the encrypted mail can be decrypted by possessing only the parent mail that is the common key file. Using this feature, when decrypting an encrypted mail on the mail gateway for auditing purposes, it should be possessed after the previous mail is decrypted.

  Although one embodiment has been described above, the present invention can take an embodiment such as a system, an apparatus, a method, a program, or a recording medium. Specifically, an encrypted mail transmission apparatus, The encrypted mail receiving apparatus may be applied to a system composed of a plurality of devices or a system composed of a single device.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it is needless to say that they are configured with various contents according to applications and purposes.

  Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program represented by software for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading out a program represented by software for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. It becomes.

In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

  According to the present invention, the body part of an electronic mail can be encrypted in a chain by the mail thread encryption method, and the original guarantee for each mail thread can be secured. In addition, when an erroneous transmission occurs, the contents cannot be browsed unless the erroneous transmission destination has the entire mail thread, so that information security can be ensured. Furthermore, the mail thread encryption method reduces the key management cost because the body part of the email becomes a common key file, and information can be monitored by storing the body part of the email on the mail gateway. In addition, the information described in the route mail has an effect that information management including transmission / reception of electronic mail can be performed for each mail thread.

DESCRIPTION OF SYMBOLS 100 Encrypted mail transmission apparatus 101 Mail input part 102 Mail text change part 103 Thread search part 104 Thread encryption part 105 Rule management part 106 Transmission part 107 Mail storage part 108 Root mail creation part 110 Encrypted mail reception apparatus 111 Reception part 112 Rule Management unit 113 Thread decryption unit 114 Thread search unit 115 Mail storage unit 116 Display unit 120 Wide area network 201 CPU
202 RAM
203 ROM
204 HDD
205 Network I / F
206 Storage medium drive 207 Keyboard 208 Pointing device 209 Display unit 210 External device connection I / F
211 Bus

Claims (5)

A mail encryption composite control apparatus that controls encryption and decryption of electronic mail,
Root mail generating means for generating a root mail serving as common key data for encrypting and decrypting the new e-mail when transmitting a new e-mail that is not a reply;
First encryption means for encrypting the new electronic mail using common key data obtained from the root mail generated by the root mail generation means;
A second encryption means for encrypting the reply e-mail using the common key data obtained from the reply source mail when sending the reply e-mail;
The root mail generated by the root mail generating means, the electronic mail encrypted by the first encryption means, the electronic mail encrypted by the second encryption means, and encrypted and transmitted from the outside Storage means for storing incoming e-mail;
An extraction means for extracting an encrypted mail thread by identifying an email that is a parent of an email that is encrypted and transmitted from the outside, up to the root mail, from data stored in the storage means;
Decryption means for decrypting the encrypted email transmitted from the outside using the common key data included in the root email and email in the encrypted email thread extracted by the extraction means; ,
A mail encryption composite control apparatus comprising: A determination means for determining whether a mail address that is not set as a destination of the reply source mail and a sender is newly added to the destination of the reply email when the reply email is transmitted;
When the determination unit determines that the mail address is added to the destination of the reply e-mail, the transmission unit transmits the encrypted mail thread extracted by the extraction unit to the added destination When,
The mail encryption composite control apparatus according to claim 1, further comprising: A transmission determination means for determining whether or not to transmit the added destination e-mail as the new e-mail when the determination means determines that the e-mail address has been added to the reply e-mail destination; Further comprising
The transmission means, when the transmission determination means determines to transmit as the new e-mail, the route mail generated by the route mail generation means and the new encryption encrypted by the first encryption means. 3. The mail encryption composite control apparatus according to claim 2, wherein an electronic mail is transmitted to the added destination. A control method in a mail encryption composite control apparatus that controls encryption and decryption of electronic mail,
A root mail generating step for generating a root mail as common key data for encrypting and decrypting the new e-mail when the root mail generating means transmits a new e-mail that is not a reply;
A first encryption step, wherein the first encryption means encrypts the new electronic mail using common key data obtained from the root mail generated by the root mail generation means;
A second encryption step of encrypting the reply e-mail using the common key data obtained from the reply source mail when the second encryption means transmits the reply e-mail;
The storage means is encrypted with the root mail generated by the root mail generating means, the electronic mail encrypted by the first encryption means, and the electronic mail encrypted by the second encryption means. A storage step for storing e-mails sent from outside,
The extraction unit extracts an encrypted mail thread by specifying, from the data stored in the storage unit, the electronic mail that is the parent of the electronic mail that is encrypted and transmitted from the outside, up to the root mail. An extraction process;
The decryption means decrypts the encrypted email transmitted from the outside using the common key data included in the root email and the email in the encrypted email thread extracted by the extraction means. A decryption step to
A control method in a mail encryption composite control apparatus, comprising: A program executable in a mail encryption composite control device that controls encryption and decryption of electronic mail,
The mail encryption composite control device,
Root mail generating means for generating a root mail serving as common key data for encrypting and decrypting the new e-mail when transmitting a new e-mail that is not a reply;
First encryption means for encrypting the new electronic mail using common key data obtained from the root mail generated by the root mail generation means;
A second encryption means for encrypting the reply e-mail using the common key data obtained from the reply source mail when sending the reply e-mail;
The root mail generated by the root mail generating means, the electronic mail encrypted by the first encryption means, the electronic mail encrypted by the second encryption means, and encrypted and transmitted from the outside Storage means for storing incoming e-mail;
An extraction means for extracting an encrypted mail thread by identifying an email that is a parent of an email that is encrypted and transmitted from the outside, up to the root mail, from data stored in the storage means;
Decryption means for decrypting the encrypted email transmitted from the outside, using the common key data included in the root email and email in the encrypted email thread extracted by the extraction means A program to make it work.

Images