JP2013101687A - Electronic mail inspection device, control method therefor and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make work of an inspector who inspects an electronic mail more efficient, and to implement appropriate inspection.SOLUTION: An electronic mail monitoring server manages thread identification information of each electronic mail. Furthermore, when receiving setting information which indicates that other electronic mail of the same thread as electronic mail subjected to inspection is to be inspected, the electronic mail monitoring server retrieves the other electronic mail of the same thread identification information as the thread identification information of the electronic mail. When receiving setting information which indicates that an electronic mail with an attached file is not to be inspected, the electronic mail monitoring server sets the electronic mail and an electronic mail with no file attached thereto among the other electronic mails to be retrieved as inspected. Moreover, when receiving setting information which indicates that an electronic mail in which text is not quoted is not to be inspected, the electronic mail monitoring server sets the electronic mail and the other electronic mail quoted to the electronic mail among the other electronic mails to be retrieved as inspected.

Description

  The present invention relates to a technology that makes it possible to set whether or not auditing is performed up to another email in the same thread as the email to be audited.

  In recent years, leakage of personal information and confidential information has been affecting corporate trust. Information leakage may occur due to unauthorized access from the outside, but most are caused by carelessness of people inside the company, and information leakage is caused by inadvertent transmission of files using e-mail, etc. I sometimes get up. Since the Personal Information Protection Law was enforced in 2005, it has become an urgent task for companies to take measures against information leakage.

  Therefore, when an e-mail is sent from an internal network to an external network, measures against information leakage are introduced, such as by introducing an e-mail audit system that decides whether or not to permit delivery according to the content of the e-mail. I have taken.

  In addition, emails sent from corporate mail servers can be saved as log data, and in the unlikely event that a leak occurs, it is possible to investigate afterwards what kind of situation has occurred. I am doing so.

  In such a system, a keyword or the like is set, and mail that uses the keyword is made undeliverable, or delivery is permitted to the superior (administrator) of the employee who sent the e-mail. Notify you to choose. In general, mail transmission is controlled according to the selection by the administrator.

  As such prior art, Patent Document 1 discloses a mechanism for checking in advance the content of a mail to be transmitted and preventing an undesired mail from being transmitted in advance.

Also, in Patent Document 2, if it is determined that the email is transmitted from the email address of the email transmission destination, a list of approvers corresponding to the sender of the email is displayed, and the approver is selected and selected. It is disclosed that the mail is put on hold until it is approved by the approved approver.
JP 2007-272607 A JP 2007-65787 A

  However, in order to perform transmission control, such as disabling the delivery of emails that use a certain keyword, the delivery of emails that may not be delivered or emails that should not be delivered There is a possibility that it will be.

Therefore, an auditor who audits whether or not such e-mail transmission control is properly performed evaluates whether or not the e-mail after the transmission control is appropriate. Is required. However, as the number of e-mails evaluated by the auditor increases, the burden on the auditor increases. Therefore, it is necessary to reduce the burden on auditors by a mechanism that can perform audits in a batch.
Furthermore, while there is a request to reduce the burden on auditors, there is a high need for appropriate audits. In other words, there are cases in which the body of the parent email is quoted or not quoted in reply emails, so parent emails that are not quoted in reply emails are excluded from the scope of bulk audit (in reply emails) If setting is not possible (only the parent emails that are cited are subject to collective auditing), auditing will be performed without confirming the content of the parent email, and appropriate auditing according to the content of the parent email will be realized. I can't.

  An object of the present invention is to make it possible to make an evaluation work for an auditor who performs an audit of an e-mail more efficient by enabling a setting to be excluded from a batch evaluation object when a reply e-mail does not contain the contents of a parent e-mail. And provide a mechanism for appropriate auditing.

  The electronic mail auditing apparatus according to the present invention includes a management means for managing thread identification information for identifying a thread of each electronic mail, information indicating the electronic mail to be audited, and the same thread as the electronic mail to be audited Setting information receiving means for receiving from the external device setting information indicating whether or not to audit the e-mail and whether to audit an e-mail whose content is not included in the e-mail to be audited; When the setting information accepting unit accepts setting information for auditing the other email in the same thread as the email to be audited, the same thread as the thread identification information of the email to be audited Search means for searching for the other e-mail of thread identification information indicating the thread identification information managed by the management means; The citation determination means for determining whether or not the content of the email searched by the search means is included in the content of the email to be audited, and the email to be audited by the setting information reception means When setting information indicating that an email that does not contain content is not audited is received, the email to be audited is searched by the search means, and the audit is judged by the citation determination means Setting means for setting, as audited, an e-mail that is determined to contain content.

  The method for controlling an electronic mail auditing apparatus according to the present invention is a method for controlling an electronic mail auditing apparatus comprising management means for managing thread identification information for identifying the thread of each electronic mail. However, the information indicating the email to be audited, whether or not to audit another email in the same thread as the email to be audited, and the content to be included in the email to be audited A setting information accepting step for accepting setting information indicating whether or not to audit any e-mail from an external device, and the search means of the e-mail auditing device includes the other e-mail in the same thread as the e-mail to be audited When the setting information accepting unit accepts the setting information indicating that the mail is to be audited in the setting information accepting step, the electronic mail to be audited is received. A search step of searching the thread identification information managed by the management means for the other electronic mail of thread identification information indicating the same thread as the thread identification information of the thread identification information, and the citation determination means of the electronic mail auditing device, The citation determination step for determining whether or not the content of the email searched by the search means in the search step is included in the content of the email to be audited, and the setting means of the email auditing device includes the setting In the information receiving step, when the setting information receiving unit receives setting information indicating that the electronic mail whose content is not included in the audit target is not audited, the electronic mail to be audited; It is determined by the search means that the e-mail to be audited contains content by the citation determination means. Characterized in that it comprises a setting step of setting an e-mail as audited, the.

  The program of the present invention includes a management unit that manages thread identification information for identifying a thread of each email, a computer that serves as an email auditing device, information indicating an email to be audited, and an electronic to be audited Accepts from the external device setting information indicating whether to audit other emails in the same thread as the email and whether to audit emails that do not contain content in the audited email When the setting information accepting unit and the setting information accepting unit accepting the setting information for auditing the other email of the same thread as the email to be audited, the thread of the email to be audited A thread managed by the management means is used to manage the other electronic mail having thread identification information indicating the same thread as the identification information. Search means for searching from the identification information, citation determination means for determining whether or not the content of the email searched by the search means is included in the content of the email to be audited, and the setting information reception When the setting information indicating that the audit of the e-mail that is not included in the e-mail to be audited is not received by the means is searched by the e-mail to be audited and the search means, and It is made to function as a setting means which sets as an audited the e-mail which it was determined by the said quote determination means that the content of the e-mail to be audited contains.

  In the present invention, when setting information indicating that another email in the same thread as the email to be audited is received, not only the email to be audited but also another email in the same thread as the email to be audited It is configured to set as audited (batch audit). Therefore, according to the present invention, it is possible to improve the efficiency of the evaluation work of an inspector who audits electronic mail.

  In addition, because attachments that were attached to the parent email are not attached to the reply email, emails with attachments are excluded from the scope of batch evaluation (batch audit) (only emails without attachments are batched) By enabling the setting (to be evaluated), it is possible to prevent evaluation without confirming the content of the attached file, and to realize appropriate post-audit according to the content of the attached file.

  Furthermore, since there are cases where the body of the parent email is quoted or not quoted in the reply email, parent emails that are not quoted in the reply email are excluded from the scope of bulk evaluation ( By enabling the setting (only quoted parent mail is subject to batch evaluation), it is possible to prevent evaluation without checking the contents of the parent mail, and appropriate post-audit according to the contents of the parent mail Can be realized.

It is a figure which shows the structure of the information processing system which concerns on embodiment of this invention. It is a block diagram which shows the basic composition of an email monitoring server. It is a block diagram which shows the characteristic part of the function structure of an email monitoring server. It is a sequence chart which shows operation | movement of the information processing system which concerns on embodiment of this invention. It is a flowchart which shows the memory | storage process of the electronic mail which a electronic mail monitoring server performs, and a transmission permission determination process. It is a flowchart which shows the detailed process of step S502 of FIG. It is a figure which shows the thread | sled management table memorize | stored in memory | storage means, such as HDD of an electronic mail monitoring server. It is a flowchart which shows the detailed process of the pre-inspection (step S405-S408) shown in FIG. It is a figure which shows the structural example of a log table. It is a figure which shows the structural example of a prior audit screen. It is a flowchart which shows the detailed process of the post audit (step S409-S411) shown in FIG. It is a flowchart which shows the detailed process of step S1103 of the flowchart shown in FIG. It is a flowchart which shows the detailed process of the evaluation process of step S1119 of the flowchart shown in FIG. It is a flowchart which shows the detailed process of the evaluation process of step S1118 of the flowchart shown in FIG. FIG. 14 is a flowchart showing detailed processing of evaluation processing in step S1120 of the flowchart shown in FIG. 11, step S1303 of the flowchart shown in FIG. 13, and step S1402 of the flowchart shown in FIG. It is a flowchart which shows the detailed process of step S1504, step S1506, step S1508, and step S1510 of the flowchart shown in FIG. It is a figure which shows the structural example of group information and management object definition information. It is a figure which shows the structural example of an email search screen. It is a figure which shows the example of a part of header information of an email and the parent mail of the said email. It is a figure which shows an example of the search result list screen displayed by step S1105. It is a figure which shows the structural example of an evaluation screen. It is a figure which shows an example of the list display screen displayed by step S1105 when not collectively evaluating. It is a figure which shows an example of the list display screen displayed by step S1105 when the email of the same thread is evaluated collectively. It is a figure which shows an example of the list display screen displayed by step S1105 when the parent mail is collectively evaluated among the electronic mails of the same thread. FIG. 10 is a diagram showing an example of a list display screen displayed in step S1105 when batch e-mails of the same thread are evaluated and there is a mail with an attached file in the same thread. When the e-mails of the same thread are collectively evaluated and there is an e-mail with an attached file in the same thread and there is an unquoted e-mail, the list display screen displayed in step S1105 is displayed. It is a figure which shows an example. It is a figure which shows the structural example of ex post audit result DB. It is a figure which shows the example of a transmission impossible condition and a transmission suspension condition. It is a figure which shows the condition setting screen which sets the transmission impossible condition (a) shown in FIG. 28, and a transmission suspension condition (b). It is a figure which shows the example of the email text of the same thread.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments to which the invention is applied will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a diagram showing a configuration of an information processing system according to an embodiment of the present invention. In FIG. 1, reference numeral 101 denotes an electronic mail monitoring server. The e-mail monitoring server 101 stores the e-mail storage process instructed to be transmitted from the local network 105 to the wide-area line 120, the transmission permission / rejection determination / holding determination process, the transmission permission / rejection determination, and the conditions for determining the hold.・ Has a function to change. The e-mail monitoring server 101 has a configuration as an application example of the e-mail auditing apparatus of the present invention.

  The e-mail monitoring server 101 records a group configuration table and its representative in time series (group information 1701 and management target definition information 1702 shown in FIG. 17 described later). The email monitoring server 101 also has a function of determining an administrator who audits email according to the data.

  Reference numeral 102 denotes an electronic mail server. For example, the electronic mail server 102 transmits and receives mail between the information processing apparatus 104-1 and the information processing apparatus 104-2. The e-mail server 102 manages mail transmission / reception between the information processing apparatus 104-1 and an apparatus outside the local network 105 (the information processing apparatus 114 in the figure). As described above, the e-mail server 102 performs a process of transmitting mail to the transmission destination specified by the mail address. Since such a series of processes performed by the e-mail server 102 is well known, further explanation is omitted.

  Reference numeral 103 denotes an LDAP server that provides a directory service for managing corporate directory information, that is, corporate directory information such as a mail address of a user who uses a network and information on an organization. The directory service applicable to the present invention is not limited to LDAP, but may be other services. For example, it may be Active Directory or NDS (Network Directory Service). LDAP is an abbreviation for Lightweight Directory Access Protocol.

  Reference numerals 104-1, 104-2, and 104-3 are information processing apparatuses, which are ordinary computers, and have an e-mail transmission / reception function. In addition, the information processing apparatuses 104-1, 104-2, and 104-3 operate as clients of the WEB service.

  The information processing apparatus 104-3 is a terminal used by an administrator, and is a terminal that audits an email whose transmission is suspended by the email monitoring server 101 and an audit of the transmitted email. In this embodiment, the information processing apparatus 104-3 is described as a terminal used by an administrator.

  An information processing device 114 and an e-mail server 112 are connected to the local network 115, which are the same as the information processing device 104, the e-mail server 102, and the local network 105, and thus description thereof is omitted. .

  FIG. 2 is a block diagram showing a basic configuration of the email monitoring server 101 shown in FIG. In FIG. 2, reference numeral 201 denotes a CPU that controls the entire email monitoring server 101 using programs and data stored in the RAM 202 and the ROM 203 and executes each process described below performed by the email monitoring server 101. .

  A RAM 202 includes an area for temporarily storing programs and data loaded from the HDD 204 and the recording medium drive 206 and data received via the network I / F (interface) 205. The RAM 202 includes a work area that is used when the CPU 201 executes various processes. A ROM 203 stores setting data, a boot program, and the like of the e-mail monitoring server 101.

  Reference numeral 204 denotes an HDD, which stores an OS (Operating System) and programs and data for causing the CPU 201 to execute each process described later performed by the e-mail monitoring server 101. Some or all of these programs and data are loaded into the RAM 202 in accordance with the control of the CPU 201, and the CPU 201 performs processing using this, whereby the e-mail monitoring server 101 executes each processing described below.

  Reference numeral 205 denotes a network I / F for connecting the e-mail monitoring server 101 to the local network 105, and the e-mail monitoring server 101 can perform data communication with an external device via the network I / F 205. it can.

  Reference numeral 206 denotes a recording medium drive, which reads out programs and data recorded on a storage medium such as a CD-ROM, CD-R / RW, DVD-ROM, DVD-R / RW, and DVD-RAM and outputs them to the RAM 202. This reading operation is controlled by the CPU 201.

  A keyboard 207 can input various instructions to the CPU 201. A pointing device 208 such as a mouse can input various instructions to the CPU 201.

  Reference numeral 209 denotes a video I / F (interface) which functions as an I / F for supplying an image to be displayed on the display device 210 to the display device 210 as a signal. A display device 210 includes a CRT, a liquid crystal screen, and the like, and can display a processing result by the CPU 201 using an image, characters, or the like.

  Reference numeral 211 denotes a peripheral device I / F, which includes a USB port, an IEEE1394 port, and the like, and can be connected to the peripheral device via the peripheral device I / F 211. The connection form with the peripheral device may be wired or wireless. A bus 212 connects the above-described units. The e-mail servers 102 and 112, the LDAP server 103, and the information processing apparatuses 104 and 114 shown in FIG.

  FIG. 3 is a block diagram showing the characteristic part of the functional configuration of the e-mail monitoring server 101 in this embodiment. As shown in FIG. 3, the email monitoring server 101 includes a management unit 301, a reception unit 302, a search unit 303, and a setting unit 304 as its characteristic functional configuration. The management unit 301 manages the thread ID and parent mail ID of each e-mail described later using the thread management table (FIG. 7).

  The accepting unit 302 accepts information indicating an email to be audited by the administrator, setting information indicating whether to audit another email in the same thread as the email, or the like from the administrator terminal 104.

  When the receiving unit 302 receives setting information indicating that the email of the same thread as the audit target email is to be audited, the search unit 303 manages other emails having the same thread ID as the thread ID of the email. Search from the unit 301. The setting unit 304 sets the audited email and other emails searched by the search unit 303 as audited.

  In particular, if the setting information received by the receiving unit 302 includes information indicating that auditing of all other emails in the same thread as the email to be audited is performed, the search unit 303 All other emails having the same thread ID as the thread ID are searched. The setting unit 304 sets all the searched emails as audited together with the email to be audited.

  When the setting information received by the receiving unit 302 includes information indicating that the parent mail of the audit target email is to be audited, the search unit 303 has the same thread ID as the email. In addition, another electronic mail having a parent mail ID corresponding to the parent mail of the electronic mail is searched. Similarly, the setting unit 304 sets the email searched by the search unit 303 together with the email to be audited as audited.

  FIG. 4 is a sequence chart showing the operation of the information processing system according to the embodiment of the present invention. Here, a case will be described in which information processing apparatus 104-1 instructs external information processing apparatus 114 to transmit an e-mail.

  First, when the information processing apparatus 104-1 transmits an e-mail (step S401), the e-mail server 102 that has acquired the e-mail transmits the e-mail to the e-mail monitoring server 101 (step S402).

  Then, when the e-mail monitoring server 101 acquires the e-mail, whether or not the e-mail matches a filtering rule (transmission disable condition or transmission hold condition shown in FIG. 28) stored in the e-mail monitoring server 101. Determine whether.

  Here, the case where the e-mail monitoring server 101 acquires an e-mail to be transmitted from the information processing apparatus 104-1 to the external information processing apparatus 114 has been described. However, the e-mail monitoring server 101 may acquire an e-mail addressed to the information processing apparatus 104-1 transmitted from the external information processing apparatus 114. Of course, the configuration may be such that the e-mail monitoring server 101 acquires an e-mail transmitted from the information processing apparatus 104-1 to the information processing apparatus 104-2 and determines whether or not the filtering rule is met.

  Here, the transmission disabling condition (a) and the transmission hold condition (b) shown in FIG. 28 will be described. FIG. 28A is an example of a transmission disabling condition that is a filtering rule. FIG. 28A shows an example of condition 1, condition 2, condition 3, condition 4, condition 5, and five transmission disabled conditions.

The CPU 201 of the e-mail monitoring server 101 determines whether the transmitted e-mail is an e-mail that meets any one of the five conditions. If they match, the CPU 201 of the email monitoring server 101 cancels the transmission of the email and notifies the information processing apparatus 104-1 that is the transmission source that the transmission of the email has been stopped (step). S403).
Hereinafter, each condition of the transmission disabling condition (a) shown in FIG. 28 will be described.
Condition 1: “*** 1.co.jp” (predetermined domain name) is included in the mail address of the e-mail destination.
Condition 2: A predetermined character string “XX company” is included in the mail text of the e-mail.
Condition 3: A predetermined character string “confidential” is included in the attached data of the e-mail.
Condition 4: The total file size of the attached data of the e-mail exceeds 1 MB (megabyte).

  Condition 5: “*** 2.ne.jp” (predetermined domain name) is included in the e-mail destination mail address, and a predetermined character string “△ Company” is included in the e-mail body of the e-mail. A predetermined character string “confidential” is included in the attached data of the e-mail, and the total file size of the attached data of the e-mail exceeds 0.9 MB (megabytes).

  Next, the transmission suspension condition shown in FIG. FIG. 28B is an example of a transmission suspension condition that is a filtering rule. FIG. 28B shows an example of condition 1, condition 2, condition 3, condition 4, condition 5 and five transmission suspension conditions.

  The CPU 201 of the e-mail monitoring server 101 determines whether or not the acquired e-mail is an e-mail that matches any one of the five conditions. If it is determined that the e-mail matches, the CPU 201 does not send the e-mail and holds it. To do. That is, the electronic mail is stored in storage means such as the HDD 204 or the RAM 202 of the electronic mail monitoring server 101.

As described above, when the transmission monitoring condition is satisfied, the CPU 201 of the email monitoring server 101 determines that the email is an email that needs to be audited by the administrator, and requests the administrator terminal to make a pre-audit request. (Step S405).
Hereinafter, each condition of the transmission suspension condition shown in FIG.
Condition 1: “tana@***.co.jp.” (Predetermined mail address) is included in the mail address of the e-mail destination.
Condition 2: A predetermined character string “XX company” is included in the mail text of the e-mail.
Condition 3: A predetermined character string “limited to related parties” is included in the attached data of the e-mail.
Condition 4: The total file size of the attached data of the e-mail exceeds 0.7 MB (megabytes).

  Condition 5: “*** 2.ne.jp.” (Predetermined domain name) is included in the e-mail destination mail address, and a predetermined character string “△ Company” is included in the e-mail body of the e-mail. A predetermined character string “copy prohibited” is included in the attached data of the e-mail, and the total file size of the attached data of the e-mail exceeds 0.5 MB (megabytes).

  In addition, the CPU 201 of the email monitoring server 101 determines whether the email transmitted from the information processing apparatus 104-1 is in either the transmission disabling condition (FIG. 28 (a)) or the transmission suspension condition (FIG. 28 (b)). If it is determined that the condition is not met, the electronic mail is transmitted to the information processing apparatus 114 via the external network (wide area line) 120 (step S404).

  As described above, the CPU 201 of the e-mail monitoring server 101 transmits (relays) the e-mail to the destination set in the e-mail according to the acquired e-mail data, the transmission disabled condition, and the transmission hold condition. Or, it is determined whether to hold without transmitting or to cancel without transmitting. When the transmission of the e-mail is suspended, the CPU 201 of the e-mail monitoring server 101 causes the administrator to perform a preliminary audit (steps S405 to S408). Specifically, the CPU 201 of the email monitoring server 101 makes an audit request for the email to the administrator terminal 104-3 (step S405).

  When the CPU 201 of the administrator terminal 104-3 receives the audit request, the CPU 201 displays the fact that the audit request has been received on the display device 210 of the administrator terminal 104-3.

  When the CPU 201 of the administrator terminal 104-3 receives an instruction to display a list screen of emails to be pre-audited from the administrator, the CPU 201 requests the email monitoring server 101 to display a list of emails to be pre-audited ( Step S406).

  The CPU 201 of the e-mail monitoring server 101 that has received the e-mail list display request displays a list display screen (FIG. 10) (hereinafter also referred to as a pre-audit screen) of e-mails whose transmission is suspended and to be pre-audited. Information to be generated, and the generated information is transmitted to the administrator terminal 104-3 (step S407).

  Next, the CPU 201 of the administrator terminal 104-3 displays a list display screen of e-mails to be pre-audited based on the information, and accepts whether or not the displayed e-mail can be transmitted from the administrator. Then, the CPU 201 of the administrator terminal 104-3 transmits the result of the pre-audit received from the administrator (whether the electronic mail can be transmitted or suspended) to the electronic mail monitoring server 101 (step S408).

  The CPU 201 of the e-mail monitoring server 101 that has received the result of the preliminary audit stores the result in a storage unit such as the HDD 204 and executes processing corresponding to the result.

  That is, if transmission of an email is permitted, the CPU 201 of the email monitoring server 101 transmits the email to the information processing apparatus 114 (step S404). On the other hand, if the transmission of the e-mail is rejected, the CPU 201 of the e-mail monitoring server 101 stops the transmission of the e-mail and notifies the information processing apparatus 104-1 to that effect (step S403). If the transmission of the email is suspended, the CPU 201 of the email monitoring server 101 stores the email in the storage unit such as the HDD 204 as the email to be pre-audited.

  As described above, in the present embodiment, it is determined whether to transmit (relay) an e-mail according to the transmission disabling condition and the transmission suspension condition or the administrator's determination in the preliminary audit.

  However, since the information processing system according to the present embodiment is intended to perform “audit” related to transmission / reception of electronic mail, it is required that the administrator himself / herself audits as much as possible.

  In other words, it is necessary to audit (recognize) after the determination whether the e-mail can be transmitted (relayed) or the e-mail that should be stopped. . The outline of the post-audit will be described below using steps S409 to S411 shown in FIG.

  The CPU 201 of the administrator terminal 104-3 transmits a request for performing post-audit to the electronic mail monitoring server 101 (step S409). The CPU 201 of the e-mail monitoring server 101 that has received the request generates information for displaying a list display screen (FIG. 20) of e-mails that should be audited, and uses the generated information as the administrator terminal 104-3. (Step S410).

  Then, the CPU 201 of the administrator terminal 104-3 displays a list display screen of emails to be audited based on the information, and receives evaluation of the displayed emails from the administrator. Here, as an evaluation result received from the administrator, for example, “transmission allowed / transmission rejected / check required / neither” can be cited. Then, the CPU 201 of the administrator terminal 104-3 transmits the evaluation result of the email received from the administrator to the email monitoring server 101 (step S411).

  The CPU 201 of the e-mail monitoring server 101 that has received the e-mail evaluation result stores the evaluation result in a storage unit such as the HDD 204 in association with the e-mail.

  In the following, with reference to FIG. 5, the e-mail storage process and the transmission permission / inhibition determination process performed by the e-mail monitoring server 101 will be described. FIG. 5 is a flowchart showing an email storage process and a transmission permission / inhibition determination process performed by the email monitoring server 101. This process is performed by the CPU 201 of the e-mail monitoring server 101 according to control by a program recorded in the HDD 204. Further, the HDD 204 of the email monitoring server 101 temporarily suspends the transmission of the email for the transmission disabling condition (FIG. 28A) indicating the condition for stopping the transmission of the email (not relaying) and the preliminary audit. A transmission hold condition (FIG. 28B) indicating a condition is stored. The filtering rule is stored in the HDD 204. The HDD 204 of the email monitoring server 101 stores group information (group information 1701 shown in FIG. 17 described later) and administrator information (managed object definition information 1702 shown in FIG. 17 described later). In the present embodiment, it is possible to specify the group to which the mail sender belongs and the manager of the group using this group information.

  First, the CPU 201 of the e-mail monitoring server 101 obtains an e-mail (SMTP packet) sent from the network 105 to the wide area line 120 (step S501). In the present embodiment, a case where an e-mail sent to the wide area line 120 is acquired will be described. However, the CPU 201 of the email monitoring server 101 may acquire an email received from the wide area line 120 and determine whether to send the email to the local network 105 based on a filtering rule.

  Next, the CPU 201 of the email monitoring server 101 registers information (Message-ID) that identifies the email included in the header information of the email acquired in step S501 in the thread management table (FIG. 7) (step 7). S502). Detailed processing in step S502 will be described later with reference to FIG. The thread management table shown in FIG. 7 is a configuration that is an application example of the management means of the present invention.

  Next, the CPU 201 of the e-mail monitoring server 101 determines whether or not the e-mail acquired in step S501 matches the transmission disabling condition (FIG. 28A) that is a filtering rule stored in the HDD 204. (Step S503).

  If the CPU 201 of the e-mail monitoring server 101 determines that the e-mail acquired in step S501 matches the transmission disabled condition (YES in step S503), the process proceeds to step S504. Then, the CPU 201 of the email monitoring server 101 stops sending the email (step S504).

  Then, the CPU 201 of the e-mail monitoring server 101 transmits an e-mail to the effect that the e-mail has not been transmitted because the e-mail sender address is met because the e-mail sender address is met (step S505).

  If it is determined in step S503 that the e-mail acquired in step S501 does not match the transmission disabling condition (NO in step S503), the CPU 201 of the e-mail monitoring server 101 determines that the e-mail acquired in step S501 is pending transmission. It is determined whether the condition (FIG. 28B) is met (step S506).

  If it is determined in step S506 that the email acquired in step S501 does not match the transmission suspension condition (NO in step S506), the CPU 201 of the email monitoring server 101 sends the email to the wide area line 120. It is sent out (step S507). Here, in the case of the electronic mail received (acquired) from the wide area line 120 in step S501, the electronic mail is transmitted (relayed) to the local network 105.

  On the other hand, if it is determined in step S506 that the transmission suspension condition is met (YES in step S506), the CPU 201 of the email monitoring server 101 “holds” the email transmission processing acquired in step S501. (Step S508). Then, the CPU 201 of the email monitoring server 101 advances the processing to step S509. Note that the e-mail suspended here becomes an e-mail subject to a pre-inspection in which the administrator of the e-mail sender makes an instruction to determine whether transmission is possible / not possible after visual confirmation. Next, the CPU 201 of the email monitoring server 101 identifies the sender of the email (step S509).

  The sender of the mail is specified by acquiring the mail address of the sender of the electronic mail from the header information of the electronic mail and specifying the user to whom the mail address is assigned.

  Then, the CPU 201 of the email monitoring server 101 identifies the sender of the email (sender), and then identifies the administrator of the email sender (step S510).

  This is based on group information (group information 1701 shown in FIG. 17 described later) and manager information (managed object definition information 1702 shown in FIG. 17 described later) stored in the HDD 204 of the email monitoring server 101. This is done by specifying the manager of the group to which the sender belongs. Here, the group information 1701 and the management target definition information 1702 illustrated in FIG. 17 will be described.

  The group information 1701 stores at least “group name”, “valid period”, “mail address”, and “user name (not shown) to which a mail address is assigned” corresponding to each other.

  Therefore, it is possible to specify the group name to which the user belongs from the user's mail address or user name. The “valid period” indicates a period in which each user belongs to the group. That is, for example, in the case of the first record, the user “alice@example.com” (mail address) belongs to “Group-A” (group name) from January 1, 2006 to March 31, 2006. It shows that it was. Further, a record in which no end date is input indicates that the user set in the record still belongs to the group set in the record.

  The management target definition information 1702 stores “administrator ID”, “management target group”, “validity period”, and “e-mail address (not shown) corresponding to the administrator ID” correspondingly. Yes. Therefore, by referring to the management target definition information 1702, it is possible to specify the manager of each group or the mail address of the manager.

  That is, by referring to the group information 1701 and the management target definition information 1702, it is possible to specify the manager (group manager) of the group to which the sender of the e-mail belongs.

  Next, the CPU 201 of the e-mail monitoring server 101 notifies the administrator terminal 104-3 of the administrator identified in step S510 so as to perform e-mail pre-inspection. As this notification, for example, the CPU 201 of the e-mail monitoring server 101 may send an e-mail indicating that a pre-audit is to be performed to the e-mail address assigned to the administrator. Note that the mail address assigned to the administrator can be specified from the data stored in the LDAP server 103.

  Further, when the administrator logs in to the application of the e-mail monitoring server 101, a message may be displayed so that pre-audit of the e-mail is performed.

  Then, after executing any one of steps S504, S508, and S507, the CPU 201 of the e-mail monitoring server 101 stores (saves) the e-mail acquired in step S501 in a storage unit such as the HDD 204. At that time, the CPU 201 of the e-mail monitoring server 101 sets the e-mail filtering result (data indicating the state of sending / holding / deleting) in association with the e-mail (stored in the HDD 204) (step S511). ).

  That is, after executing step S504, data indicating “deletion (not transmitted)” when transmission of an electronic mail is stopped is set in association with the electronic mail as a filtering result. After executing step S508, data indicating “hold” when the transmission of the electronic mail is suspended is set in association with the electronic mail as a filtering result. After executing step S507, data indicating “sending” in the case of transmitting an e-mail is set in association with the e-mail as a filtering result.

  Specifically, the log table shown in FIG. 9 stores (saves) the e-mail (data constituting the e-mail) acquired in step S501 and the filtering result correspondingly.

  In FIG. 9, the mail ID of the e-mail, each data composing the e-mail (sender's e-mail address, e-mail address of the recipient, e-mail body, attached file, transmission date / time, etc.) and filtering result correspond respectively. And remembered.

  In step S511, the CPU 201 of the email monitoring server 101 registers the email ID numbered in step S602 (FIG. 6), which will be described later, in the email ID of the email included in the log table (FIG. 9). After the process of step S511, this process ends.

  FIG. 6 is a flowchart showing detailed processing in step S502 of FIG. Note that the CPU 201 of the email monitoring server 101 executes the processing from step S601 to step S612 shown in FIG.

  Steps S601 and S612 in FIG. 6 mean that the processing from step S602 to step S611 or S608 is repeatedly executed for all emails acquired by the CPU 201 of the email monitoring server 101.

  The CPU 201 of the email monitoring server 101 assigns a unique email ID to the email acquired in step S501 (step S602).

  The CPU 201 of the e-mail monitoring server 101 acquires Message-ID that is data unique to the e-mail added to the e-mail from the e-mail header information acquired in step S501 (step S603).

  Next, the CPU 201 of the email monitoring server 101 sets (registers) the Message-ID acquired in step S603 in the thread management table shown in FIG. 7 in association with the mail ID numbered in step S602 (step S604). ).

  Then, the CPU 201 of the e-mail monitoring server 101 searches for “In-Reply-To” contained in the reply mail in the header information of the e-mail acquired in step S501 (step S605).

  Next, the CPU 201 of the email monitoring server 101 determines whether or not “In-Reply-To” has been searched in step S605 (step S606). That is, it is determined whether or not the electronic mail is a reply mail.

  If the CPU 201 of the e-mail monitoring server 101 determines that it is a reply mail in step S606 (when it is determined that “In-Reply-To” exists) (YES in step S606), the “In-Reply” The Message-ID of “-To” is searched from the thread management table (FIG. 7) (step S607).

  Then, the CPU 201 of the email monitoring server 101 determines whether or not the Message-ID of the “In-Reply-To” has been searched in step S607 (step S609). That is, it is determined whether or not a parent mail corresponding to the electronic mail is registered in the thread management table.

  If the CPU 201 of the email monitoring server 101 determines in step S609 that the Message-ID of the “In-Reply-To” has been retrieved (the parent email corresponding to the email is registered in the thread management table). If it is determined that the thread ID associated with the retrieved Message-ID is obtained from the thread management table, the obtained thread ID is associated with the Message-ID set in Step S604. At the same time, it is registered (set) in the thread management table (step S610). The thread ID is a configuration that is an application example of the thread identification information of the present invention.

  Next, the CPU 201 of the e-mail monitoring server 101 acquires the mail ID corresponding to the Message-ID of the parent mail searched and identified in step S607 from the thread management table. Then, the CPU 201 of the email monitoring server 101 registers the acquired mail ID as a “parent mail ID” in the thread management table in association with the Message-ID set in step S604 (step S611). The parent mail ID is a configuration that is an application example of the parent mail identification information of the present invention.

  On the other hand, if it is determined in step S606 that “In-Reply-To” has not been searched in step S605 (if it is determined not to be a reply mail) (NO in step S606), the process proceeds to step S608. In step S609, when it is determined that the Message-ID of “In-Reply-To” has not been searched (when it is determined that the parent mail corresponding to the e-mail is not registered in the thread management table). (NO in step S609) also shifts to the processing in step S608.

  In step S608, the CPU 201 of the email monitoring server 101 assigns a unique new thread ID, and sets (registers) the thread ID in association with the Message-ID set in step S604 (step S608). As a result, each piece of data indicating the relationship of each email thread can be registered in the thread management table shown in FIG.

  FIG. 19 is a diagram illustrating an example of a part of header information of an electronic mail and a parent mail of the electronic mail. 19 indicates a part of header information of the e-mail, and 1901 of FIG. 19 indicates a part of header information of the parent mail of the e-mail. As indicated by 1902, “In-Reply-To” is added to the header information of the e-mail. Accordingly, in step S606, the electronic mail is determined as a reply mail. Further, Message-ID of “In-Reply-To” of the electronic mail is registered in the header information 1901. For this reason, if the same Message-ID is registered in the thread management table, it is determined in step S609 that the parent mail of the electronic mail is registered in the thread management table.

  FIG. 7 is a diagram showing a thread management table stored in a storage unit such as the HDD 204 of the email monitoring server 101. The thread management table has items of mail ID, parent mail ID, thread ID, and Message-ID. The Message-ID is information unique to each e-mail as described above, and is represented by each symbol as shown in FIG. 7, for example. The mail ID is unique information for identifying each electronic mail in the thread management table.

  The thread ID is information for identifying whether each electronic mail is an electronic mail of the same thread. In the example of FIG. 7, the same thread ID indicates that the electronic mail is the same thread.

  Next, the parent mail ID will be described. In the example of FIG. 7, the electronic mail of the first record indicates that it is the original electronic mail (parent mail) transmitted first because there is no parent mail ID. In the second record, since the mail ID of the first record is registered in the parent mail ID field, the second record e-mail indicates that it is a reply e-mail of the first record e-mail.

  FIG. 8 is a flowchart showing detailed processing of the pre-audit (steps S405 to S408) shown in FIG. 4, and shows processing for the administrator to perform pre-audit of e-mail. Note that the processing of steps S801 and S805 to 810 is executed by the CPU 201 in accordance with control by a program recorded in the HDD 204 of the administrator terminal 104-3. Further, the processing of steps S802 to 804 and S811 to 818 is executed by the CPU 201 in accordance with control by a program recorded in the HDD 204 of the e-mail monitoring server 101. First, the CPU 201 of the administrator terminal 104-3 transmits a request for performing a pre-audit to the e-mail monitoring server 101 (step S801).

  When the CPU 201 of the e-mail monitoring server 101 receives a request for performing the preliminary audit from the administrator terminal 104-3 (step S802), the CPU 201 first checks the authority of the user who has made the request.

  Here, the CPU 201 of the email monitoring server 101 determines whether the user is a user having group administrator authority based on the management target definition information 1702 recorded in the storage unit such as the HDD 204. . Specifically, it is determined whether the user ID (administrator ID) included in the request data received in step S <b> 802 is stored in “administrator ID” of the management target definition information 1702. If it is determined that the user ID (administrator ID) included in the request data received in step S802 is stored in the “administrator ID” of the management target definition information 1702, the administrator ID is stored in the administrator ID. The “effective period” stored correspondingly is acquired from the management target definition information 1702. Whether or not the administrator who made the request is a past or current administrator can be determined based on whether or not the end date is registered in the “valid period” acquired here. With the above processing, it is determined whether the user is a group manager in the past or the present.

  When it is determined that the user who made the request is not a group administrator, that is, neither a group administrator in the past nor the present (that is, the user ID (administrator ID included in the request data received in step S802) ) Is not stored in the “manager ID” of the management target definition information 1702), the CPU 201 of the e-mail monitoring server ends this process (not shown).

  On the other hand, if it is determined that the user who made the request is a group administrator (that is, the user ID (administrator ID) included in the request data received in step S802 is “administrator” in the management target definition information 1702). CPU 201 of the e-mail monitoring server 101 determines that the filtering result of the management target user specified based on the group information 1701 recorded in the HDD 204 is “Pending”. The e-mail set to “” is extracted from the log table (FIG. 9) stored in the storage means of the e-mail monitoring server 101 (step S803).

  Hereinafter, a method for extracting the email to be audited will be described. For example, when the user ID (administrator ID) included in the request data received in step S802 is “Admin-A2”, referring to the management target definition information 1702, the administrator with the administrator ID “Admin-A2” Is the manager of the group name “Group-A”. Further, referring to the management target definition information 1702, it can be seen that this administrator is an administrator of the group name “Group-A” since January 1, 2006, and is still an administrator. Referring to the group information 1701, the group name “Group-A” includes user 1 “alice@example.com” and user 2 “cab@example.com” from April 1, 2006 to the present. I understand that.

  That is, the administrator of the group name “Group-A” uses the electronic mail in which the user 1 “alice@example.com” and the user 2 “cab@example.com” are set as the transmission destination or transmission source to be audited. It will be audited as email.

  At this time, among e-mails in which user 1 “alice@example.com” and user 2 “cab@example.com” are set as transmission destinations or transmission sources, “filtering result” is registered as “hold”. The electronic mail is identified by referring to the log table (FIG. 9). Then, all the e-mails specified here are extracted from the log table (FIG. 9).

  Subsequently, the CPU 201 of the email monitoring server 101 executes an automatic evaluation process similar to step S1214 described later on the email extracted in step S803 (step S818).

  Then, the CPU 201 of the e-mail monitoring server 101 generates information for displaying the extracted e-mail list screen and transmits the information to the administrator terminal 104-3 (step S804).

  Next, when the CPU 201 of the administrator terminal 104-3 receives the information for displaying the list screen (step S805), the CPU 201 displays a list screen of the suspended emails based on the information (step S806). . Here, for example, the pre-audit screen shown in FIG. 10 is displayed.

  FIG. 10 is a screen used when a manager (group manager) of a group to which the sender of the email belongs in advance audits the email whose transmission is suspended by the email monitoring server 101. It is a figure which shows an example. Through the operation via this screen 1000, the group administrator gives an instruction to transmit / delete (not transmit) the suspended mail.

  On this screen, the CPU 201 of the administrator terminal 104-3 causes the CPU 201 to display a mail content confirmation screen (not shown) on the display device by clicking the mail address of the sender (sender) in the mail sender column. To control.

  The CPU 201 of the administrator terminal 104-3 receives an instruction to select an email to be “sent” or “deleted” from the administrator (step S807), and receives an instruction to change “send” or “delete” (step S808). . Then, the CPU 201 of the administrator terminal 104-3 transmits the change instruction received in step S808 to the email monitoring server 101 (step S809).

  Subsequently, the CPU 201 of the administrator terminal 104-3 determines whether an end instruction from the administrator has been received (step S810). If the termination instruction from the administrator is not received (NO in step S810), the CPU 201 of the administrator terminal 104-3 displays the pre-audit screen shown in FIG. 10 until the termination instruction is received. On the other hand, when an end instruction from the administrator is received (YES in step S810), the process ends.

  The CPU 201 of the e-mail monitoring server 101 receives a change instruction indicating sending / deleting (not sending) e-mail from the administrator terminal 104-3 (step S811).

  Then, the CPU 201 of the email monitoring server 101 determines whether or not the received change instruction is transmission (transmission) (step S812). If it is determined to be sent (YES in step S812), the CPU 201 of the administrator terminal 104-3 sends the e-mail instructed to be sent to the wide area line 120 (step S813). On the other hand, if it is determined that the transmission is not performed, the process proceeds to step S815.

  The CPU 201 of the e-mail monitoring server 101 changes the filtering result of the e-mail sent to the wide area line 120 to “transmission after holding” (step S814), and the process proceeds to step S815.

  Subsequently, the CPU 201 of the email monitoring server 101 determines whether or not the change instruction received in step S811 is deletion (not transmitted) (step S815). As a result, if it is determined to be deleted (not transmitted) (YES in step S815), the email monitoring server 101 deletes the email without sending it (step S816). Subsequently, the e-mail monitoring server 101 changes the filtering result of the e-mail to “delete after hold” (step S817), and proceeds to step S802.

  On the other hand, if the CPU 201 of the email monitoring server 101 determines that the change instruction received in step S811 is not deletion (not transmitted), the process proceeds to step S803.

  In the above-described configuration, the example in which the preliminary audit is performed on the outgoing mail has been described. However, the preliminary audit may be performed on both the incoming mail and the transmitted / received mail. When auditing a received mail, a plurality of received addresses are described, and when the plurality of received addresses straddle a plurality of groups, the received mail is configured to be audited by a plurality of administrators.

  FIG. 11 is a flowchart showing detailed processing of the post-audit (steps S409 to S411) shown in FIG. 4, and shows processing for the administrator to perform post-audit of e-mail. Hereinafter, processing for performing post-audit of electronic mail will be described with reference to FIG.

  FIG. 11 corresponds to the processing performed by the email monitoring server 101 and the administrator terminal 104-3 in the post-audit of email. This process is performed by the CPU 201 of the e-mail monitoring server 101 and the administrator terminal 104-3 according to control by a program recorded in the HDD 204. The CPU 201 of the administrator terminal 104-3 transmits a request for performing post-audit to the electronic mail monitoring server 101 (step S1101).

  When the CPU 201 of the e-mail monitoring server 101 receives the request from the administrator terminal 104-3 (step S1102), the CPU 201 generates information on a list display image of e-mails to be subjected to the post-audit and generates the administrator terminal 104-3. (Step S1103). Detailed processing of this processing will be described later with reference to FIG.

  The CPU 201 of the administrator terminal 104-3 receives information on a list image of e-mails to be subjected to the post-audit from the e-mail monitoring server 101 (step S1104).

  Subsequently, based on the received information, the CPU 201 of the administrator terminal 104-3 displays a list display screen (FIG. 20) of e-mails to be subjected to the post-audit on the display device 210 of the administrator terminal 104-3. (Step S1105).

  Next, the CPU 201 of the administrator terminal 104-3 determines whether or not selection of an e-mail from e-mails displayed on the list display screen (FIG. 20) has been accepted (step S1106). For example, when the administrator selects an email subject displayed on the list display screen (FIG. 20), the CPU 201 of the administrator terminal 104-3 accepts selection of an email corresponding to the email subject.

  When the request for displaying the e-mail data is received, the CPU 201 of the administrator terminal 104-3 transmits the display request for the e-mail that has received the request to the e-mail monitoring server 101 (step S1107).

  Next, when the CPU 201 of the e-mail monitoring server 101 receives an e-mail display request from the administrator terminal 104-3 (YES in steps S 1108 and S 1109), the e-mail data received for the display is stored in the log table. (Figure 9). The e-mail data is data such as a mail text, a recipient address, a sender address, and an attached file. On the other hand, when an e-mail display request is not received from the administrator terminal 104-3, the CPU 201 of the e-mail monitoring server 101 continues to wait until an e-mail display request is received from the administrator terminal 104-3 (step S1109). NO).

  Next, the CPU 201 of the email monitoring server 101 generates information for displaying an evaluation screen (FIG. 21) for the administrator to evaluate from the email data acquired from the log table, and the generated information is displayed. It transmits to the administrator terminal 104-3 (step S1110).

  Then, when receiving the information for displaying the evaluation screen (FIG. 21), the CPU 201 of the administrator terminal 104-3 displays the evaluation screen on the display unit based on the information (steps S1111 and S1112).

  For example, in step S1106, an e-mail with “transmission source” displayed on the list display screen (FIG. 20) as “Toru Hoshi” and “transmission destination” as “aaa@example.jp” is selected by the administrator. Shall be. In this case, the CPU 201 of the administrator terminal 104-3 displays the evaluation screen illustrated in FIG. 21 in step S1112.

  FIG. 21 shows the date and time of transmission of the selected e-mail, sender (sender), destination (TO, CC, BCC can also be displayed), e-mail subject (title), e-mail body, e-mail. The attached file is displayed. These data are data acquired from the log table, and are data acquired from the email monitoring server 101 in steps S1110 and S1111. On the evaluation screen (FIG. 21), an “evaluation” column 2101 and a “collective evaluation” column 2102 are displayed below the mail text of the evaluation screen.

  As shown in FIG. 21, in the “evaluation” column 2101, an evaluation of “send possible”, “send impossible”, “required check”, and “cannot say either” is given for the e-mail displayed on the evaluation screen. The radio button that accepts from the administrator is displayed.

  In the “collective evaluation” column 2102, a check box for selecting “collective evaluation” for setting whether or not the administrator performs collective evaluation, and an electronic mail in the same thread as the email displayed on the evaluation screen are displayed. A radio button for selecting “all threads” for batch evaluation of emails and “all parent emails” for batch evaluation of parent emails displayed on the evaluation screen, and already evaluated emails for this evaluation Set whether or not to remove from e-mails with attachments and check box for selecting “Exclude Evaluated Mail” and set whether or not to remove e-mails with attachments from this evaluation target. And a check box for selecting “exclude unquoted mail” are displayed.

  When the radio button for “send possible” displayed in the “evaluation” column 2101 is selected by the administrator, the administrator made an evaluation “may send” the e-mail displayed on the evaluation screen. Means.

  In addition, when the “transmission disabled” radio button displayed in the “evaluation” column 2101 is selected by the administrator, the administrator makes an evaluation “not to send” the e-mail displayed on the evaluation screen. Means that.

  In addition, when the “check required” radio button displayed in the “evaluation” column 2101 is selected by the administrator, the e-mail displayed on the evaluation screen is managed by an evaluation that “check (confirmation) is required”. Means that it was made by a person.

  In addition, if the administrator selects the “Neither” radio button displayed in the “Evaluation” column 2101, the e-mail displayed on the evaluation screen is “can be sent according to the content to be sent, destination, etc. This means that the administrator has made an evaluation that “there may be a case where the transmission is not possible or the transmission may be impossible”.

  When the check box for selecting “collective evaluation” displayed in the “collective evaluation” column 2102 is checked, that is, when setting is made to evaluate other electronic mail collectively, the electronic mail displayed on the evaluation screen is displayed. The same evaluation as the evaluation performed in the “evaluation” column 2101 is set in the email of the same thread. In this way, by checking the “evaluate collectively” check box, not only the evaluation of the e-mail displayed on the evaluation screen but also the other evaluations of other e-mails in the same thread can be performed in the same evaluation. It becomes possible.

  In addition, when the administrator selects the “all threads” radio button displayed in the “collective evaluation” field 2102, the setting is to collectively evaluate all the emails of the same thread as the email displayed on the evaluation screen. Is made.

  Further, when the radio button of “all parent mails” displayed in the “collective evaluation” field 2102 is selected by the administrator, among the emails of the same thread as the email displayed on the evaluation screen, the evaluation screen displays Only the parent mail of the displayed e-mail is set to be collectively evaluated.

  If the administrator selects the “exclude evaluated email” check box displayed in the “collective evaluation” field 2102, the setting is made to exclude already evaluated emails from the target to be collectively evaluated this time. .

  In addition, when the “exclude mail with attached file” check box displayed in the “collective evaluation” field 2102 is selected by the administrator, the setting is made so that emails with attached files are excluded from the target of the current batch evaluation. The

  Further, when the “exclude unquoted mail” check box displayed in the “collective evaluation” field 2102 is selected by the administrator, the parent mail that is not quoted in the reply mail is excluded from the target of the batch evaluation this time. Settings are made.

  As described above, when other electronic mails are collectively evaluated, the same evaluation as the evaluation of the electronic mail displayed on the evaluation screen selected in the “evaluation” column is set for the other electronic mails.

  The CPU 201 of the administrator terminal 104-3 receives evaluations (evaluation results) such as “transmission possible” and “transmission impossible” in the “evaluation” column 2101, and “whether to collectively evaluate” in the “collective evaluation” column 2102. ”,“ Whether or not to evaluate all the same threads at once ”,“ Whether or not to evaluate parent mail in the same thread, ”and“ Whether to re-evaluate e-mails that have already been evaluated ” , Accepts a batch evaluation setting such as “whether or not to collectively evaluate e-mails with attached files” and “whether or not to collectively evaluate unquoted e-mails” (step S1113).

  Subsequently, when the confirmation button 2103 is pressed by the administrator, the CPU 201 of the administrator terminal 104-3 transmits the evaluation result and setting information of the batch evaluation to the e-mail monitoring server 101 (step S1114).

  The CPU 201 of the e-mail monitoring server 101 receives information indicating the e-mail to be audited, its evaluation result, and setting information for batch evaluation from the administrator terminal 104-3 (step S1115). Step S1115 is a processing example of the accepting unit of the present invention.

  Subsequently, the CPU 201 of the email monitoring server 101 determines whether or not to perform batch evaluation from the received batch evaluation setting information (step S1116). That is, the e-mail monitoring server 101 determines whether or not the “collective evaluation” check box in the “collective evaluation” column 2002 is checked, that is, whether or not collective evaluation is performed, from the batch evaluation setting information. .

  If it is determined in step S1116 that batch evaluation is performed (checked) (YES in step S1116), the CPU 201 of the e-mail monitoring server 101 determines “all threads” in the “collective evaluation” column 2102 from the batch evaluation setting information. It is determined whether or not the radio button “” has been selected or the radio button “all parent mails” has been selected (step S1117).

  On the other hand, if it is determined in step S1116 that batch evaluation is not performed (not checked) (NO in step S1116), the CPU 201 of the email monitoring server 101 shifts the processing to step S1120. In step S1120, the CPU 201 of the e-mail monitoring server 101 executes e-mail evaluation processing displayed on the evaluation screen.

  If the CPU 201 of the email monitoring server 101 determines in step S1117 that the “all threads” radio button in the “collectively evaluate” column 2102 has been selected (NO in step S1117), the process proceeds to step S1119. . In step S1119, the CPU 201 of the email monitoring server 101 executes a process for collectively evaluating emails of the same thread as the email displayed on the evaluation screen. Details of this processing will be described later with reference to FIG.

  If the CPU 201 of the e-mail monitoring server 101 determines in step S1117 that the “all parent mail” radio button in the “collective evaluation” column 2102 has been selected (YES in step S1117), the process advances to step S1118. Transition. In step S1118, the CPU 201 of the email monitoring server 101 executes a process for collectively evaluating the parent email of the email in the same thread as the email displayed on the evaluation screen. Details of this processing will be described later with reference to FIG.

  After executing the parent mail evaluation process in step S1118, the CPU 201 of the email monitoring server 101 stores the evaluation result (audit result) in the post-audit result database (post-audit result DB) (FIG. 27) (step S1121). ).

  In step S1119, the CPU 201 of the e-mail monitoring server 101 executes e-mail evaluation processing for the same thread, and then stores the evaluation result (audit result) in the post-audit result database (post-audit result DB) (FIG. 27). Store (step S1122).

  The CPU 201 of the e-mail monitoring server 101 executes the e-mail evaluation process displayed on the evaluation screen in step S1120, and then sends the evaluation result (audit result) to the post-audit result database (post-audit result DB) (see FIG. 27) (step S1123).

  Here, the post-audit result database will be described. The post-audit result database is stored in the e-mail monitoring server 101, and the results of the post-audits (results of evaluation) are stored and held. The post-audit audit result database shown in FIG. 27 has items of “mail ID”, “audit execution date / time”, “auditor”, and “evaluation (result)”.

  “Mail ID” of the post-audit result database is the mail ID of the evaluated email, and stores a value corresponding to the mail ID of the log table (FIG. 9). The “audit execution date / time” stores the date / time when the e-mail corresponding to the mail ID is evaluated.

  The “inspector” stores the name of the administrator who has evaluated the e-mail corresponding to the mail ID. In “Evaluation”, the result of evaluating the e-mail corresponding to the e-mail ID is input as a numerical value (evaluation value).

  For example, if “evaluation” column 2101 is evaluated as “transmittable”, the evaluation value is “0”, and if it is evaluated as “not transmittable”, the evaluation value is “100”. "50" is stored as the evaluation value. Thus, the evaluation (value) is stored corresponding to each mail ID.

  Returning to the flowchart of FIG. The CPU 201 of the e-mail monitoring server 101 determines whether or not an end instruction such as logout has been received from the administrator terminal 104-3 after the process of step S1121, step S1122, or step S1123 has been executed (step S1124). . The CPU 201 of the email monitoring server 101 executes the processing from step S1103 to step S1124 until an end instruction is received. On the other hand, when an end instruction is received (step S1124), the processing shown in this flowchart is ended.

  FIG. 12 is a flowchart showing detailed processing in step S1103 of the flowchart shown in FIG. First, the CPU 201 of the e-mail monitoring server 101 receives a post-audit execution request in step S1102. Then, the CPU 201 of the e-mail monitoring server 101 refers to the management target definition information 1702 in FIG. 17, identifies the management target group name corresponding to the administrator ID included in the request, and acquires the group name. (Step S1201).

  Then, the CPU 201 of the e-mail monitoring server 101 receives the information from a storage unit such as an HDD storing information for displaying a screen (e-mail search screen) (FIG. 18) for searching for an e-mail to be subjected to the post audit. Is acquired and transmitted to the administrator terminal 104-3 (step S1202).

  Next, the CPU 201 of the administrator terminal 104-3 receives information for displaying an email search screen from the email monitoring server 101 (step S1203). Subsequently, the CPU 201 of the administrator terminal 104-3 displays an email search screen (FIG. 18) according to the information (step S1204).

  Then, the CPU 201 of the administrator terminal 104-3 receives an input of search conditions from the administrator via the electronic mail search screen (step S1205). Subsequently, when a transmission button (not shown) is pressed, the CPU 201 of the administrator terminal 104-3 transmits the input search condition to the email monitoring server 101 (step S1206).

  Here, as an example of the search condition input on the e-mail search screen, for example, there are the following items. That is, “Send time”, “Send date”, “Send month”, “Send year”, “Sender's email address”, “Biller's email address (mail address set in CC or BCC) ) ”,“ E-mail subject (title) ”,“ E-mail size ”,“ Attached file size attached to the e-mail ”, and the like can be set as search conditions.

  In addition, e-mail data corresponding to these conditions is stored in log data, respectively, and e-mail data corresponding to these input search conditions can be acquired by searching log data. It is.

  Returning to the flowchart of FIG. The CPU 201 of the email monitoring server 101 receives the search condition input on the email search screen from the administrator terminal 104-3 (step S1207). Subsequently, the CPU 201 of the e-mail monitoring server 101 searches the log table (FIG. 9) for e-mail data in the search target period included in the search condition and acquires it (step S1208).

  Then, the CPU 201 of the email monitoring server 101 determines whether group information has already been set in the email data acquired in step S1208 (step S1209). That is, it is determined here whether there is information (group information) indicating a group in the “group information” column of the log data shown in FIG.

  If it is determined in step S1209 that a group has not yet been set in the e-mail data acquired in step S1208 (NO in step S1209), the CPU 201 of the e-mail monitoring server 101 determines the e-mail transmission date and time. The group name to which the sender of the electronic mail belongs is specified with reference to group information 1701 (FIG. 17), and the group name is set in the log table (FIG. 9) (step S1210). Then, the process proceeds to step S1211. On the other hand, if it is determined in step S1209 that group information is set in the e-mail data (YES in step S1209), the process proceeds to step S1211.

  In step S1211, the CPU 201 of the e-mail monitoring server 101 audits (evaluates) the e-mail acquired in step S1208 by the administrator identified by the administrator ID included in the post-audit request received in step S1102. It is determined whether the e-mail is to be sent (step S1211).

  This is because the group name corresponding to the email address of the e-mail source acquired in step S1208 is acquired from the group information 1701 (FIG. 17), and the administrator ID of the group is defined as the management target from the acquired group name. Obtained from information 1702. Then, it is determined whether or not the acquired administrator ID is the same as the administrator ID included in the post-audit implementation request received in step S1102. As a result, if the administrator ID is the same, it is determined that the email is to be audited (evaluated) (YES in step S1211), and the process proceeds to step S1212. On the other hand, if the manager ID is different, it is determined that the email is not audited (evaluated) (NO in step S1211), and the process proceeds to step S1215. Here, when the post-audit has already been completed for the mail, it may of course be controlled not to be audited.

  In step S1212, the CPU 201 of the e-mail monitoring server 101 determines whether the e-mail acquired in step S1208 matches other search conditions input via the e-mail search screen.

  If the CPU 201 of the e-mail monitoring server 101 determines in step S1212 that the other search conditions are satisfied (YES in step S1212), the CPU 201 sets the e-mail as an e-mail to be subjected to post-audit (step S1213). . On the other hand, if the CPU 201 of the email monitoring server 101 determines in step S1212 that the other search conditions are not met (NO in step S1212), the process proceeds to step S1215.

  Next, the CPU 201 of the e-mail monitoring server 101 executes automatic evaluation processing on the e-mail set as a post-audit target in step S1213 (step S1214).

  Here, the automatic evaluation process will be described. The CPU 201 of the e-mail monitoring server 101 performs a similar sentence search of the e-mail from previously evaluated e-mails stored in the HDD 204 using a known similar search technique. The evaluation value is stored in the HDD 204 as shown in FIG.

  Then, the CPU 201 of the e-mail monitoring server 101 obtains and averages e-mail evaluations having a certain similarity or higher from e-mail data evaluated in the past, and estimates the e-mail evaluation. Note that, as another example of the estimation method of the e-mail evaluation, evaluations of e-mails with a certain similarity or higher may be distributed according to the similarities, and an average value may be taken.

  Then, the CPU 201 of the electronic mail monitoring server 101 adds the estimated evaluation to the predetermined storage area in the RAM 202 in association with the electronic mail. As will be described later, when this evaluation value is high (evaluation is low), many ■ are displayed in the “evaluation” column shown in FIG.

  For example, an e-mail that has been evaluated in the past having a similarity of 20% or more with the e-mail has an evaluation of 100 with a similarity of 90%, an evaluation of 100 with a similarity of 60%, an evaluation of 50 with a similarity of 50, and a similarity of 20% Assume that the evaluation is 50. When these are averaged, the evaluation value of the e-mail is estimated to be “75”.

  Returning to the flowchart of FIG. The CPU 201 of the e-mail monitoring server 101 calculates an evaluation value for the e-mail acquired in step S1208 (step S1214). Subsequently, the CPU 201 of the e-mail monitoring server 101 determines whether there is an e-mail that has not been subjected to the processing from step S1209 to step 1214 among all e-mails acquired in step S1208 (step S1215). ). If the CPU 201 of the email monitoring server 101 determines that there is an email that has not been executed (YES in step S1215), the process returns to step S1208, and the email that has not been executed is also executed in step S1209. To Step 1214.

  On the other hand, if it is determined that the processing from step S1209 to step 1214 has been executed for all the emails acquired in step S1208 (NO in step S1215), the CPU 201 of the email monitoring server 101 searches in step S1212. Information for displaying a display screen (FIG. 20) of a list of e-mails subject to the post-audit that matches the conditions is generated (step S1216). Subsequently, the CPU 201 of the email monitoring server 101 transmits the information to the administrator terminal 104-3 (step S1217).

  Here, the information transmitted from the email monitoring server 101 is received by the administrator terminal 104-3 in step S1104 (FIG. 11). Then, the CPU 201 of the administrator terminal 104-3 displays the screen of FIG. 20 based on the information received in step S1104 (step S1105).

  Here, the evaluation column in the screen shown in FIG. 20 will be described. The information shown in the evaluation column is an e-mail (similar e-mail) that is determined to have a certain degree of similarity by searching for an e-mail similar to the e-mail in advance using a known similar sentence search technique or the like. It is the estimated evaluation value which computed the evaluation value (estimated evaluation value) based on the evaluation of other group managers. In the case of auditing, the confirmed evaluation value is displayed in the evaluation column. The evaluation column in FIG. 20 indicates that the more the ■, the lower the evaluation (the evaluation value is high), and it is necessary to actively audit.

  Of course, it is possible to sort the e-mails displayed on this screen. Therefore, when the estimated evaluation values (evaluation) are sorted in descending order, it is possible to pre-audit e-mails that are likely to be unsuccessful, and post-audit other group administrators thereafter. It is possible to accumulate data that can serve as an index for auditing more quickly.

  By default, the CPU 201 of the e-mail monitoring server 101 sorts and displays e-mails displayed as a list on this screen in descending order of estimated evaluation values shown in the evaluation column (that is, in ascending order of evaluation). (In FIG. 20, it is displayed at random). Further, items other than the evaluation column, that is, items such as audit status, mail title, sender address, recipient / broadcast address, and transmission date / time may be configured to be sortable.

  In FIG. 20, all mails are displayed regardless of whether auditing is completed or not. However, only audited mails are set as display targets, and only unaudited mails are displayed. Setting is also possible. Further, for unaudited mails, when an estimated evaluation value is instructed to be clicked, control may be performed so that the audited mail used for calculating the estimated evaluation value of the mail is displayed.

  FIG. 13 is a flowchart showing detailed processing of the evaluation processing in step S1119 of the flowchart shown in FIG. The processing from step S1301 to step S1305 shown in FIG. 13 is executed by the CPU 201 of the e-mail monitoring server 101. This process is a process for collectively evaluating other e-mails in the same thread as the e-mail displayed on the evaluation screen (FIG. 21).

  In other words, on the evaluation screen, one of “Send possible”, “Send impossible”, “Check required”, or “Neither” can be evaluated, and the “Evaluate all together” check box is checked. This process is executed when the “” radio button is set.

  First, the CPU 201 of the e-mail monitoring server 101 searches the thread management table for an e-mail having the same thread ID as the e-mail thread ID evaluated on the evaluation screen (FIG. 21) (step S1301). ). Step S1301 is a processing example of the search means of the present invention.

  Then, the CPU 201 of the email monitoring server 101 determines whether an email of the same thread has been searched (step S1302). If an email of the same thread is retrieved, the process proceeds to step S1303. If an email of the same thread is not retrieved, the process proceeds to step S1122 in FIG.

  In step S1303, the CPU 201 of the email monitoring server 101 performs processing for setting the evaluation received on the evaluation screen (FIG. 20) for the email searched in step S1301. The evaluation received on the evaluation screen (FIG. 20) here is an evaluation of any one of “transmission enabled”, “transmission disabled”, “check required”, and “cannot say either”. Details of the processing are shown in FIGS. 15 and 16 and will be described later.

  Next, after executing the evaluation process in step S1303, the CPU 201 of the e-mail monitoring server 101 determines whether or not all e-mails searched in step S1301 have been executed (step S1304). If it is determined that the process has been executed for all e-mails, the process proceeds to step S1122 in FIG. On the other hand, if it is determined that it has not been executed for all e-mails, the CPU 201 of the e-mail monitoring server 101 sets other e-mails that have not been subjected to the evaluation process as evaluation process target mails of the evaluation process. (Step S1305). Note that the evaluation process here refers to the process of step S1303.

  FIG. 14 is a flowchart showing detailed processing of the evaluation processing in step S1118 of the flowchart shown in FIG. The processing from step S1401 to step S1405 shown in FIG. 14 is executed by the CPU 201 of the e-mail monitoring server 101.

  This process is a process for collectively evaluating the parent mail of the e-mail in the same thread as the e-mail displayed on the evaluation screen (FIG. 21). In other words, on the evaluation screen, one of “Send OK”, “Send Not Available”, “Check Required”, or “Neither” is checked, the “Summary” check box is checked, and “Parent Mail” is checked. This process is executed when the “all” radio button is set.

  First, the CPU 201 of the email monitoring server 101 searches and acquires the email ID of the email evaluated on the evaluation screen (FIG. 21) from the thread management table (step S1401).

  Then, the CPU 201 of the e-mail monitoring server 101 performs a process of setting the evaluation received on the evaluation screen (FIG. 21) for the e-mail corresponding to the e-mail ID acquired in step S1401 (step S1402). Note that the evaluation received on the evaluation screen (FIG. 21) is an evaluation of any one of “transmission enabled”, “transmission disabled”, “check required”, and “cannot say either”. Details of the processing are shown in FIGS. 15 and 16, and the description thereof will be described later.

  Next, the CPU 201 of the email monitoring server 101 sends the email ID (parent email ID) of the parent email set in the item “parent email ID” of the thread management table for the email that has been evaluated in step S1402. Is acquired (step S1403). Then, the process proceeds to step S1404.

  In step S1403, the CPU 201 of the email monitoring server 101 determines whether or not the parent mail ID has been acquired (step S1404). If it cannot be acquired (NO in step S1404), the process proceeds to step S1121. .

  On the other hand, if it is determined in step S1404 that the parent mail ID has been acquired (YES in step S1404), the CPU 201 of the email monitoring server 101 sets the same value as the acquired parent mail ID in the item of “mail ID”. The e-mail being received is set as an evaluation target (step S1405). Then, the process proceeds to step S1402.

  FIG. 15 is a flowchart showing detailed evaluation processing in step S1120 in the flowchart shown in FIG. 11, step S1303 in the flowchart shown in FIG. 13, and step S1402 in the flowchart shown in FIG. Note that the processing from step S1501 to step S1510 shown in FIG. 15 is executed by the CPU 201 of the e-mail monitoring server 101.

  First, the CPU 201 of the email monitoring server 101 determines whether or not the email to be evaluated has been evaluated (step S1501). Specifically, the CPU 201 of the email monitoring server 101 refers to the post-audit result DB (FIG. 27), and stores the evaluation (evaluation value) of the mail ID corresponding to the e-mail to be evaluated in the post-audit result DB. It is determined whether or not it has been done. If an evaluation value is not set in the post-audit result DB, the CPU 201 of the e-mail monitoring server 101 determines that the e-mail has not been evaluated. On the other hand, if an evaluation value is set, the CPU 201 of the e-mail monitoring server 101 determines that the e-mail has been evaluated.

  If it is determined in step S1501 that the e-mail to be evaluated has been evaluated (step S1501: YES), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1502 and is displayed on the evaluation screen (FIG. 21). Further, it is determined whether or not “Exclude Evaluated Mail” is checked in “Bulk Evaluation” 2102 (step S1502). If it is determined that the electronic mail is checked (step S1502: YES), the electronic mail is excluded from the target of the current batch evaluation, and thus this process is terminated.

  On the other hand, if it is determined that it is not checked (step S1502: NO), the process proceeds to step S1503, and the CPU 201 of the email monitoring server 101 determines whether or not an attached file is attached to the email to be evaluated. judge. Specifically, the CPU 201 of the email monitoring server 101 refers to the log table (FIG. 9) and determines whether an attached file is attached to the evaluation target email. When it is determined that an attached file is not attached to the e-mail to be evaluated (step S1503: NO), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1504 and performs the citation determination process shown in FIG. .

  Details of the processing shown in FIG. 16 will be described later. If it is determined in step S1503 that an attached file is attached to the e-mail to be evaluated (step S1503: YES), the process proceeds to step S1505, and the CPU 201 of the e-mail monitoring server 101 displays the evaluation screen (FIG. 21). It is determined whether or not “exclude mail with attached file” is checked in “collective evaluation” 2102 displayed in (step S1505). If it is determined that the electronic mail is checked (step S1505: YES), the electronic mail is excluded from the target of the current batch evaluation, and thus this process is terminated. On the other hand, if it is determined that it is not checked (step S1505: NO), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1506, and performs the citation determination process shown in FIG. Details of the processing shown in FIG. 16 will be described later.

  If it is determined in step S1501 that the e-mail to be evaluated has not been evaluated (step S1501: NO), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1507, and the e-mail to be evaluated It is determined whether or not an attached file is attached. If it is determined in step S1507 that the e-mail to be evaluated does not have an attached file (step S1507: NO), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1508, and the citation determination process shown in FIG. I do. Details of the processing shown in FIG. 16 will be described later.

  If it is determined in step S1507 that an attached file is attached to the e-mail to be evaluated (step S1507: YES), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1509 and displays the evaluation screen (FIG. 21). It is determined whether or not “exclude mail with attached file” is checked in the displayed “collective evaluation” 2102 (step S1509). If it is determined that the electronic mail is checked (step S1509: YES), the electronic mail is excluded from the target of the current batch evaluation, and thus this process is terminated. On the other hand, if it is determined that it is not checked (step S1509: NO), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1510 and performs the citation determination process shown in FIG. Details of the processing shown in FIG. 16 will be described later.

  Next, the flowchart shown in FIG. 16 will be described. The flowchart shown in FIG. 16 is a flowchart showing details of the processing in step S1504, step S1506, step S1508, and step S1510 in FIG. 15, and judges and evaluates whether or not to exclude an unquoted e-mail from the evaluation target. A process for setting the evaluation received on the screen (FIG. 21) (that is, setting one of the evaluations “transmission enabled”, “transmission disabled”, “check required”, and “cannot say” received on the evaluation screen) Processing). Note that the processing in steps S1601 to S1604 shown in FIG. 16 is executed by the CPU 201 of the email monitoring server 101.

  First, the CPU 201 of the electronic mail monitoring server 101 determines whether or not “exclude unquoted mail” is checked in the “collective evaluation” 2102 displayed on the evaluation screen (FIG. 21) (step S1501). ). If it is determined that it is not checked (step S1601: NO), the CPU 201 of the e-mail monitoring server 101 shifts the processing to step S1602, and the evaluation received on the evaluation screen (FIG. 21) is converted into the post-audit audit result database (FIG. 27) (step S1602).

  On the other hand, if it is determined that it is checked (step S1601: YES), the CPU 201 of the e-mail monitoring server 101 moves the process to step S1603. In step S1603, the CPU 201 of the email monitoring server 101 determines whether the content of the email to be evaluated is included (quoted) in the email displayed on the selected evaluation screen (FIG. 20). Determine whether. If it is determined that the content is included (step S1603: YES), the CPU 201 of the e-mail monitoring server 101 proceeds to step S1604, and the evaluation received on the evaluation screen (FIG. 21) Set in the database (FIG. 27) (step S1602). If it is not determined in step S1603 that the text has been quoted (step S1603: NO), the electronic mail is excluded from the target of the current batch evaluation, and thus this process ends.

  Whether or not to be a target of collective evaluation will be described using FIG. 30 as an example. Each of (a), (b), and (c) in FIG. 30 is an email of the same thread. At this time, it is assumed that all the same threads are subject to collective evaluation on the evaluation screen (FIG. 21), and the setting of “excludes unquoted mail” is accepted. In this case, it is assumed that the e-mail shown in (c) has been evaluated on the evaluation screen. The e-mail of (c) has the text "Thank you for your consideration." And "Good morning." Is quoted (the content of "Good morning" is included). Since the e-mail in (c) quotes “Good morning”, which is the body of the e-mail in (a), the e-mail shown in (a) is evaluated as a target of collective evaluation. Is set. On the other hand, the e-mail shown in (b) has the text “Thank you very much” and is not quoted in the e-mail shown in (c). .

  As described above, since it is possible to set the e-mail that has been evaluated to be excluded from the target of the collective evaluation (unevaluated e-mail is the target of the collective evaluation), appropriate post-audit can be realized.

  In the reply mail, the body of the parent mail is quoted, but the contents of the attached file are not quoted, so the contents of the file attached to the parent mail cannot be confirmed from the reply mail. Therefore, it is possible to evaluate without checking the content of the attached file by enabling the setting that excludes mail with attachments from the target of batch evaluation (only mail without attachments is subject to batch evaluation). This makes it possible to implement an appropriate post-audit according to the contents of the attached file.

  Furthermore, there is a parent mail that is not quoted in the reply mail. In this case, the parent mail that is not quoted cannot be confirmed from the reply mail. Therefore, it is possible to confirm the contents of unquoted e-mails by enabling the setting of excluding unquoted e-mails from the target of batch evaluation (only quoted e-mails are subject to batch evaluation). It is possible to implement an appropriate post-audit according to the contents of unquoted e-mails.

  FIG. 20 is a diagram showing an example of the search result list screen displayed in step S1105. In this search result list screen, items of “audit status”, “mail subject”, “transmission source”, “transmission destination”, “transmission date / time”, and “evaluation” are displayed.

  The “audit status” indicates whether or not the evaluation process shown in FIG. 16 has been executed (evaluated). That is, “Done” indicates that evaluation has been completed, and “Not yet” indicates that evaluation has not yet been performed.

  “Mail subject” indicates the subject (title) of the mail. “Sender” indicates the name or email address of the sender of the email. “Transmission destination” indicates an electronic mail address of an electronic mail transmission destination. “Transmission date and time” indicates the date and time when the electronic mail is transmitted. “Evaluation” indicates the automatic evaluation result automatically evaluated in step S1214.

  FIG. 22 is a diagram illustrating an example of a list display screen displayed in step S1105 when batch evaluation is not performed (NO in step S1116 and evaluation processing is performed in step S1120).

  In this example, among the emails listed in FIG. 20, only emails whose sender is “Hanagata Mitsuru” and whose transmission date is “February 3, 2008 13:51” were evaluated. It is shown that. That is, the “audit status” of the e-mail whose transmission source is “Hanagata Mitsuru” and whose transmission date and time is “February 3, 2008 13:51” is changed to “Done”.

  FIG. 23 is a diagram showing an example of a list display screen displayed in step S1105 when batch e-mails of the same thread are evaluated (when NO is determined in step S1117 and the process in step S1119 is performed). .

  In this example, among the e-mails displayed as a list in FIG. 20, the e-mail whose evaluation is accepted in step S1113 is the sender “Hanagata Man” and the transmission date and time “February 3, 2008 13:51”. E-mail for "Minute" or an e-mail with a transmission source of "Hanagata Manchuria" and a transmission date of "13:21 on February 3, 2008" or a transmission source of "Kazutoru Hoshi" and a transmission date of "February 2008" Email on 3rd March 13:29 "or email sent on" February 3, 2008 13:44 "or sent on" Yamada " Is one of the emails “February 3, 2008 13:33”, it indicates that the emails of the same thread have been collectively evaluated.

  That is, an e-mail of the same thread, an e-mail with a transmission source “Mana Hanagata” and a transmission date “February 3, 2008 13:51”, a transmission source “Mana Hanagata” and a transmission date “ "February 3, 2008 13:21" e-mail, the sender is "Kazutoru Hoshi" and the transmission date is "February 3, 2008 13:29", and the sender is "Hanagata Mitsuru" ”And the e-mail with the transmission date“ February 3, 2008 13:44 ”and the e-mail with the transmission source“ yamada ”and the transmission date“ February 3, 2008 13:33 ” Indicates that the status has been changed to evaluated ("audit status" is displayed as "done").

  FIG. 24 shows an example of a list display screen displayed in step S1105 when the parent mail is collectively evaluated among e-mails in the same thread (when YES is determined in step S1117 and the process in step S1118 is performed). FIG.

  In this example, among the e-mails displayed as a list in FIG. 20, the e-mail whose evaluation is accepted in step S1113 is the sender “Hanagata Man” and the transmission date and time “February 3, 2008 13:51”. This indicates that the parent mail of the e-mail is collectively evaluated.

  That is, the transmission source is “Yamada” and the transmission date and time is “Yamada”, which is the parent mail of the email whose transmission date and time is “February 3, 2008 13:51”, and the transmission date and time is “February 3, 2008 13:00”. E-mail of “33 minutes” and e-mail with the sender of “Hanagata Mitsuru” and the transmission date of “February 3, 2008 13:21” have been collectively evaluated (the “audit status” is displayed as “completed”) Has been changed).

  FIG. 25 shows a case where e-mails of the same thread are collectively evaluated (when NO is determined in step S1117), and “collected evaluation” 2102 “attached file attached” displayed on the evaluation screen (FIG. 21). FIG. 10 is a diagram showing an example of a list display screen displayed in step S1105 when “exclude mail” is checked. It is assumed that an attached file is attached only to an e-mail whose transmission source is “Toru Hoshi” and whose transmission date is “February 3, 2008 13:29”.

  In this example, among the e-mails displayed as a list in FIG. 20, the e-mail whose evaluation is accepted in step S1113 is the sender “Hanagata Man” and the transmission date and time “February 3, 2008 13:51”. E-mail of "minute" or an e-mail with a transmission source of "Hanagata Manchuria" and a transmission date of "February 3, 2008 13:21" or a transmission source of "Hanagata Manchuria" and a transmission date of "2008 2 If the e-mail is “Year 3rd 13:44” or the e-mail whose sender is “yamada” and the send date is “February 3, 2008 13:33” Indicates that the mail has been evaluated in bulk.

  That is, among the emails of the same thread, the attachment is not attached, the sender is “Hanagata Manchuria” and the transmission date and time is “February 3, 2008 13:51” and the sender is “Hanagata Manchuria”. ”And an e-mail with a transmission date and time“ February 3, 2008 13:21 ”, an e-mail with a transmission source“ Mana Hanagata ”and a transmission date and time“ February 3, 2008 13:44 ”, E-mail with sender “yamada” and sender date “February 3, 2008 13:33” changed to batch evaluated (“audit status” is displayed as “done”) and sent E-mails that were originally “Toru Hoshi” and whose transmission date was “February 3, 2008 13:29” have not been evaluated (the “audit status” is displayed as “not yet”). Show.

  In the case where an e-mail whose transmission source is not evaluated and whose transmission date is “February 3, 2008 13:29” is to be evaluated again, the process shown in the flowchart of FIG. 11 is performed. . At this time, by receiving an instruction such as clicking on an attached file displayed in the “attached file” field of the evaluation screen (FIG. 21), it is possible to accept an evaluation for an electronic mail with the attached file.

  FIG. 26 shows a case where e-mails of the same thread are collectively evaluated (when NO is determined in step S1117), and “attached file attachment” of “collective evaluation” 2102 displayed on the evaluation screen (FIG. 21). FIG. 10 is a diagram illustrating an example of a list display screen displayed in step S1105 when “exclude mail” and “exclude mail not quoted” are checked. Assume that an attached file is attached only to an e-mail with a transmission source of “Kazutoru Hoshi” and a transmission date of “13:29 on February 3, 2008”.

  In this example, among the e-mails displayed as a list in FIG. 20, the e-mail whose evaluation was accepted in step S1113 is the transmission source “yamada” and the transmission date and time “February 3, 2008 13:33”. The e-mail has the sender “Mana Hanagata” and the date and time “February 3, 2008 13:21” and the sender is “Toru Hoshi”. Assume that the text of an e-mail whose transmission date is “February 3, 2008 13:29” is cited.

  That is, an e-mail and an evaluation in which the attached file is not attached and the sender of the quoted e-mail is “Hanagata Mitsuru” and the transmission date is “13:21 on February 3, 2008”. Only e-mails whose sender is “yamada” and whose transmission date is “February 3, 2008 13:33” have been evaluated (“audit status” is displayed as “done”) ).

  In addition, an e-mail that has been quoted but has an attached file has an e-mail with the sender “Kazutoru Hoshi” and a transmission date “February 3, 2008 13:29”, and an unquoted e-mail An e-mail with the sender “Hanagata Manchuria” and the date and time of transmission “February 3, 2008 13:44”, and the sender “Hanagata Manchuria” and the sender date and time “February 3, 2008 13” The e-mail at “time 51” is not evaluated (“audit status” is displayed as “not yet”).

  FIG. 29 is a diagram showing a condition setting screen for setting the transmission disabling condition (a) and the transmission hold condition (b) shown in FIG. The condition setting screen shows an example of setting a condition ID (corresponding to information for identifying each condition such as “condition 1” and “condition 2” shown in FIG. 28) and a keyword included in the mail text. ing.

  For example, in the condition setting screen shown in FIG. 29, the keyword “confidential” or “only for related parties” is entered in the keyword input field 2901. When there is a keyword “confidential” or “only for related parties” in the mail text, it is possible to set a setting that disables transmission or puts transmission on hold.

  As described above, in the present embodiment, when setting information for auditing another email of the same thread as the email to be audited is received from the administrator terminal 104-3, only the email to be audited is received. Instead, it is configured so that other emails in the same thread as the email are set as audited. Therefore, according to the present embodiment, it is possible to improve the efficiency of the evaluation work of an auditor who performs an electronic mail audit.

  In particular, when setting information for auditing all other emails in the same thread as the email to be audited is received from the administrator terminal 104-3, all other emails in the same thread as the email E-mail can be audited.

  Further, when setting information for auditing another email corresponding to the parent email is received from the administrator terminal 104-3 for the email to be audited, the same thread as that email and the parent email It is also possible to audit other e-mails corresponding to e-mails.

  In addition, as described above, when setting information for auditing another e-mail in the same thread as the e-mail to be audited is received from the administrator terminal 104-3, an attached file is attached to the setting information. If the email contains information indicating that it is excluded from the bulk assessment, only emails that have the same thread as that of the email in question but only those that do not have attachments. Auditing can be performed, and appropriate auditing is possible.

  Further, as described above, the setting information for auditing other emails in the same thread as the email to be audited is received from the administrator terminal 104-3, and is cited in the setting information. Information that excludes emails that are not included in the audit, not only emails that are audited, but emails that have the same text as the emails that are audited out of emails in the same thread as the email Only mail can be audited, and appropriate auditing is possible.

  Each means and each step constituting the embodiment of the present invention described above can be realized by operating a program stored in a RAM, a ROM, or the like of a computer. This program and a computer-readable recording medium recording the program are included in the present invention.

  Further, the present invention can be implemented as, for example, a system, apparatus, method, program, or recording medium, and may be applied to an apparatus composed of a single device.

  The present invention supplies a software program for realizing the functions of the above-described embodiments directly or remotely to a system or apparatus. In addition, this includes a case where the system or the computer of the apparatus is also achieved by reading and executing the supplied program code.

  Accordingly, since the functions of the present invention are implemented by computer, the program code installed in the computer also implements the present invention. In other words, the present invention includes a computer program itself for realizing the functional processing of the present invention. In that case, as long as it has the function of a program, it may be in the form of object code, a program executed by an interpreter, script data supplied to the OS, and the like.

  Further, the functions of the above-described embodiments are realized by the computer executing the read program. Furthermore, based on the instructions of the program, an OS or the like running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments can be realized by the processing.

  As another method, a program read from a recording medium is first written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Then, based on the instructions of the program, the CPU or the like provided in the function expansion board or function expansion unit performs part or all of the actual processing, and the functions of the above-described embodiments are realized by the processing.

101 Email monitoring server 102, 112 Email server 103 LDAP server 104-1, 104-2, 114 Information processing device 104-3 Information processing device (administrator terminal)
105, 115 Local network 120 Wide area line

Claims (13)

Management means for managing thread identification information for identifying each email thread;
Information indicating an email to be audited, whether to audit another email in the same thread as the email to be audited, and an email whose content is not included in the email to be audited Setting information receiving means for receiving setting information indicating whether or not to audit mail from an external device;
When the setting information accepting unit accepts setting information for auditing the other email in the same thread as the email to be audited, the same thread as the thread identification information of the email to be audited Search means for searching for the other e-mail of thread identification information indicating the thread identification information managed by the management means;
Citation determination means for determining whether or not the content of the email searched by the search means is included in the content of the email to be audited;
When the setting information accepting unit accepts setting information indicating that the e-mail that is not included in the e-mail to be audited is not audited, the e-mail to be audited and the search unit A setting means for setting, as audited, an e-mail that has been searched and determined that the e-mail to be audited includes content by the citation determination means;
An electronic mail auditing apparatus characterized by comprising: An attachment determination means for determining whether an attached file is attached to the email searched by the search means;
The setting information further includes information indicating whether to audit an email with an attached file,
If the setting information accepting setting information that the setting information accepting means does not audit the email with the attached file, the setting means is further searched by the e-mail to be audited and the search means, and The e-mail auditing apparatus according to claim 1, wherein an e-mail that has been determined by the attachment determination means that an attached file is not attached is set as audited.   The setting information further includes information indicating whether or not to audit all the other e-mails in the same thread as the e-mail to be audited, and the search means includes the e-mail to be audited If the setting information includes information indicating that all other emails of the same thread are audited, the thread identification information indicating the same thread as the thread identification information of the email to be audited 3. The electronic mail inspection apparatus according to claim 1, wherein all the other electronic mails are searched from thread identification information managed by the management unit. The management means further manages parent mail identification information for identifying a parent mail of each electronic mail,
The setting information further includes information indicating whether or not to audit the other e-mail that is a parent mail of the e-mail to be audited, and the search means includes the e-mail to be audited. If the setting information includes information indicating that the other email that is the parent email is to be audited, the thread identification information indicates the same thread as the thread identification information of the email to be audited. 4. The electronic mail audit apparatus according to claim 1, wherein the other electronic mail having the parent mail identification information corresponding to the parent mail of the electronic mail to be audited is searched. .   The setting means has audited the email to be audited if the setting information includes information indicating that the other email in the same thread as the email to be audited is not audited. The electronic mail auditing apparatus according to claim 1, wherein the electronic mail auditing apparatus is set as follows. The setting information received by the setting information receiving means further comprises a thread determination means for determining whether or not the information to audit the other email of the same thread as the email to be audited is included,
When the thread determination unit determines that the search unit includes information indicating that the other email in the same thread as the email to be audited is included in the setting information, 6. The thread identification information managed by the management means is searched for the other electronic mail having thread identification information indicating the same thread as the thread identification information of the target electronic mail. The electronic mail auditing device according to claim 1. Whether or not the e-mail is a reply mail of the parent mail by determining whether or not the e-mail transmitted from the information processing apparatus that is communicably connected includes the unique information of the parent mail of the e-mail A reply mail determination means for determining whether or not
A parent mail search means for searching for the parent mail of the specific information from the specific information managed by the management means when the reply mail determination means determines that the e-mail is a reply mail of the parent mail; ,
Further comprising
7. The electronic device according to claim 1, wherein thread identification information indicating the same thread as the parent mail searched by the parent mail searching unit is managed in association with the electronic mail. Mail audit device. The setting information receiving means further receives an audit result by an auditor of the email to be audited,
After receiving the setting information for auditing the other email in the same thread as the email to be audited and the audit result by the auditor of the email to be audited, the setting means further includes: 8. The audit result received by the setting information receiving means is set for the electronic mail to be audited and the other electronic mail searched by the search means. The electronic mail auditing device according to any one of the above items. The setting information receiving means further receives information indicating that the audit of the email set as audited is not performed,
In the setting information receiving means, setting information for auditing the other email in the same thread as the email to be audited, and information that the email set as audited is not audited The setting means receives the audit result received by the setting information receiving means for the e-mail not set as audited among the other e-mails searched by the search means. 9. The electronic mail audit apparatus according to claim 8, wherein the electronic mail audit apparatus is set. The setting means further includes:
When the setting information accepting unit accepts setting information indicating that the e-mail that is not included in the e-mail to be audited is not audited, the e-mail to be audited and the search unit The audit result received by the setting information receiving unit is set for the e-mail that is searched and determined that the e-mail to be audited contains content by the citation determination unit. The electronic mail auditing device according to claim 8 or 9. The setting means further includes:
When the setting information receiving unit accepts the setting information indicating that the e-mail attached with the attached file is not audited, the e-mail to be audited is searched by the searching unit, and the attachment determination 11. The audit result received by the setting information receiving unit is set for an e-mail that is determined not to have an attached file attached by the unit, according to any one of claims 8 to 10. Email auditing equipment. A method for controlling an electronic mail auditing apparatus comprising management means for managing thread identification information for identifying a thread of each electronic mail,
The setting information receiving means of the email auditing apparatus is configured to check the information indicating the email to be audited, whether to audit another email in the same thread as the email to be audited, and the audit target. A setting information receiving step for receiving setting information indicating whether or not to audit an e-mail whose content is not included in an e-mail from an external device;
When the setting information accepting unit accepts setting information indicating that the other email in the same thread as the email to be audited is audited by the search unit of the email auditing apparatus in the setting information accepting step A search step of searching for the other electronic mail of thread identification information indicating the same thread as the thread identification information of the electronic mail to be audited from the thread identification information managed by the management means;
The citation determination step of the e-mail audit device determines whether or not the content of the e-mail searched by the search unit in the search step is included in the content of the e-mail to be audited;
The setting unit of the e-mail audit device has received setting information indicating that the setting information receiving unit does not audit an e-mail whose content is not included in the e-mail to be audited in the setting information receiving step The audited e-mail and the e-mail that has been searched by the search unit and that has been determined by the citation determination unit to contain content in the audited e-mail as audited. A setting process to set;
An electronic mail audit apparatus control method comprising: A computer as an e-mail audit device
Management means for managing thread identification information for identifying each email thread;
Information indicating an email to be audited, whether to audit another email in the same thread as the email to be audited, and an email whose content is not included in the email to be audited Setting information receiving means for receiving setting information indicating whether or not to audit mail from an external device;
When the setting information accepting unit accepts setting information for auditing the other email in the same thread as the email to be audited, the same thread as the thread identification information of the email to be audited Search means for searching for the other e-mail of thread identification information indicating the thread identification information managed by the management means;
Citation determination means for determining whether or not the content of the email searched by the search means is included in the content of the email to be audited;
When the setting information accepting unit accepts setting information indicating that the e-mail that is not included in the e-mail to be audited is not audited, the e-mail to be audited and the search unit A program that functions as setting means for setting, as audited, an e-mail that has been searched and has been determined by the citation determination means that the e-mail to be audited contains content.

Images