JP2014192573A - Information processing apparatus, information processing method and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique for improving the security of mails stored in an external mail server without increasing the management cost of keys used for encryption.SOLUTION: An information processing apparatus comprises: a key information storage unit 11; a transmission mail acquisition unit 12; a destination determination unit 13 which determines whether or not the destination of a mail for transmission is an internal account whose mail is held in an external mail server 90; an encryption unit 14 which encrypts the mail for transmission for the internal account by using key information; a mail transmission unit 15 which requests the mail server 90 to transmit the encrypted mail; a browsing mail acquisition unit 16 which acquires a browsing object mail in the internal account from the mail server 90; an encryption determination unit 17 which determines whether or not the acquired mail is encrypted; a decryption unit 18 which decrypts the encrypted mail by using the key information; and a mail presentation unit 19 which presents the mail decrypted by the decryption unit 18 in response to the mail browsing request.

Description

  The present invention relates to a technique for protecting the security of mail data.

  Increasingly, organizations such as companies do not have a mail server and use cloud mail services. In this way, storing mail data in an external mail server without retaining it within the organization can reduce maintenance costs for disaster countermeasures for the mail server and additional hardware associated with an increase in mail data capacity. There is an advantage that you can. However, the mail data may include confidential information within the organization. If a mail server is installed in the network in the organization where security measures are taken, there is little possibility that confidential information in the mail data transmitted and received in the organization is leaked to the outside. However, when using the cloud mail service, mail data transmitted and received within the organization is also stored in an external mail server via an external network, which causes a security problem.

  Therefore, it is conceivable to encrypt the communication path from the network in the organization to the external mail server that provides the cloud mail service. However, simply encrypting the communication path does not encrypt mail data stored in an external mail server. For this reason, there is a problem that confidential information in the mail data is leaked from the external mail server, and there is a problem that the confidential information in the mail data can be easily browsed by an operator of the external mail server.

  In order to cope with such a problem, it is conceivable to encrypt mail data.

  As a mail data encryption technique, S / MIME (Secure / Multipurpose Internet Mail Extensions) is well known. S / MIME is a standard for mail data encryption and digital signature by public key cryptography. When sending / receiving mail using cloud mail service from devices in the organization, if mail sent / received using S / MIME is sent / received, mail data stored in an external mail server is also encrypted. It will be.

  Another related technique for encrypting mail data is described in Patent Document 1. In this related technology, the mail server in the organization manages the public keys of the users in the organization. Also, the authentication server in the organization manages the secret key of the user in the organization. Then, the mail server obtains the public key for each destination from the inside of the apparatus or the outside and encrypts and transmits the mail transmitted from the organization. The authentication server provides a secret key to terminals in the organization that have been successfully authenticated. Thereby, the user of the terminal in the organization can decrypt the mail addressed to him / herself.

  Still another related technique for encrypting mail data is described in Patent Document 2. This related art mail server provides a web mail service. This mail server stores an encryption key and encrypts and stores the received mail. The mail server decrypts and presents the mail to the user terminal that has been successfully authenticated.

  Also, Patent Document 3 describes a related technique for preventing information leakage from within an organization. In this related technology, the mail server in the organization performs mail transmission / reception in the organization without encryption. In addition, the encryption server in the organization encrypts mail to the outside of the organization and transmits it to the outside.

JP 2009-130749 A JP 2006-53610 A JP 2008-242769 A

  However, the related art described above has the following problems.

  When using S / MIME when using an external mail server, each user in the organization needs to have a private key and a public key. Therefore, there is a problem that the management cost of the secret key and the public key is high for the users in the organization.

  Further, when using a cloud mail service to which the related technology described in Patent Document 1 is applied, an external mail server manages the private key and public key of each user in the organization. Therefore, if the key is illegally used by an operator of an external mail server, the mail data can be decrypted, which causes a security problem.

  When using a cloud mail service to which the related technology described in Patent Document 2 is applied, an external mail server manages the encryption key and has a decryption unit. Therefore, mail data can be easily decrypted by an operator of an external mail server, and there is a security problem.

  In addition, when using a cloud mail service to which the related technology described in Patent Document 3 is applied, mail data transmitted / received within the organization is stored in an external mail server without being encrypted. . Therefore, in the related technique described in Patent Document 3, mail data transmitted / received inside the organization can be easily browsed by an operator of an external mail server, and there is a security problem.

  The present invention has been made to solve the above-described problems, and provides a technique for further improving the security of mail data stored in an external mail server without increasing the management cost of a key for encryption. The purpose is to provide.

  An information processing apparatus according to the present invention includes a key information storage unit that stores key information for encryption and decryption, a transmission mail acquisition unit that acquires mail data for transmission, and a destination of the mail data for transmission is predetermined. An address determination unit for determining whether the mail data is stored in an external mail server, and the mail data for transmission determined by the address determination unit as being addressed to the internal account. An encryption unit that encrypts using the key information, a mail transmission unit that requests the external mail server to transmit the mail data encrypted by the encryption unit, and a mail to be viewed in the internal account Browsing mail acquisition unit that acquires data from the external mail server, and whether the mail data acquired by the browsing mail acquisition unit is encrypted An encryption determination unit for determining the mail data, a decryption unit for decrypting the mail data determined to be encrypted by the encryption determination unit using the key information, and a request for browsing the mail data in the internal account And a mail presenting unit that presents the mail data decrypted by the decrypting unit to the transmission source of the browsing request.

  Also, the information processing method of the present invention stores encryption and decryption key information, and when sending mail data is acquired, the destination of the sending mail data is sent to a predetermined external mail server. It is determined whether the mail data is addressed to an internal account, the mail data for transmission determined to be addressed to the internal account is encrypted using the key information, and the encrypted mail data Requesting the external mail server for transmission, receiving the mail data to be viewed from the external mail server in response to receiving the mail data browsing request in the internal account, and the acquired mail data is encrypted Whether the encrypted mail data is encrypted or not is decrypted by using the key information, and the decrypted mail data is transmitted to the browsing request. Presented to the original.

  Further, the computer program of the present invention uses a key information storage unit that stores key information for encryption and decryption, a transmission mail acquisition step for acquiring transmission mail data, and the transmission mail data A destination determination step for determining whether a destination is addressed to an internal account in which mail data is held in a predetermined external mail server, and the transmission for which it is determined that the address is addressed to the internal account in the destination determination step An encryption step for encrypting the mail data using the key information, a mail transmission step for requesting the external mail server to transmit the mail data encrypted in the encryption step, and in the internal account A browsing request receiving step for receiving a browsing request for mail data, and a mail to be browsed from the external mail server. A browsing mail acquisition step for acquiring data, an encryption determination step for determining whether or not the mail data acquired in the browsing email acquisition step is encrypted, and encryption in the encryption determination step A decryption step for decrypting the determined mail data using the key information, and a mail presentation step for presenting the mail data decrypted in the decryption step to the transmission source of the browsing request are executed on a computer device. Let

  The present invention can provide a technique for further improving the security of mail data stored in an external mail server without increasing the management cost of a key for encryption.

It is a functional block diagram of an information processor as a 1st embodiment of the present invention. It is a hardware block diagram of the information processing apparatus as a 1st embodiment of the present invention. It is a figure which shows an example of the mail data encrypted in the 1st Embodiment of this invention. It is a flowchart explaining the mail transmission operation | movement of the information processing apparatus as the 1st Embodiment of this invention. It is a flowchart explaining the mail presentation operation | movement of the information processing apparatus as the 1st Embodiment of this invention. It is a functional block diagram of an information processor as a 2nd embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 shows a functional block configuration of the information processing apparatus 1 as the first embodiment of the present invention. In FIG. 1, the information processing apparatus 1 includes a key information storage unit 11, a transmission mail acquisition unit 12, a destination determination unit 13, an encryption unit 14, a mail transmission unit 15, a browsing mail acquisition unit 16, and a cipher. A determination unit 17, a decryption unit 18, and a mail presentation unit 19.

  Here, as shown in FIG. 2, the information processing apparatus 1 includes, for example, a CPU (Central Processing Unit) 1001, a RAM (Random Access Memory) 1002, a ROM (Read Only Memory) 1003, and a storage device such as a hard disk. 1004 and a network device 1005 can be used. In this case, the key information storage unit 11 is configured by the storage device 1004. The outgoing mail acquisition unit 12, the mail transmission unit 15, the browsing mail acquisition unit 16, and the mail presentation unit 19 store the computer program and various data stored in the network interface 1005, the ROM 1003, and the storage device 1004. The CPU 1001 is loaded into the RAM 1002 and executed. The destination determination unit 13, the encryption unit 14, the encryption determination unit 17, and the decryption unit 18 read a computer program and various data stored in the ROM 1003 and the storage device 1004 into the RAM 1002 and execute the CPU 1001. Consists of. Note that the hardware configuration of the information processing apparatus 1 and each functional block thereof is not limited to the above-described configuration.

  In FIG. 1, the information processing apparatus 1 is connected to a user terminal 80 via a network 800. The network 800 is configured by, for example, a local area network (LAN) or a dedicated line in an organization such as a company, and security is secured by a proxy server (not shown) that restricts communication with the outside of the organization. The information processing apparatus 1 is connected to an external mail server 90 via an external network 900 to which the internal network 800 is connected via the proxy server described above. The network 900 is configured by the Internet, a LAN, a public line network, a wireless communication network, or a combination thereof. 1 shows one information processing apparatus 1, one user terminal 80, and one external mail server 90. However, the user terminal and external mail to which the information processing apparatus of the present invention is connected are shown. It does not limit the number of servers.

  The user terminal 80 is a terminal that connects to the information processing apparatus 1 and uses a mail transmission / reception service. The user terminal 80 has a function for inputting mail data for transmission transmitted from the user's account, a function for inputting a browsing request for mail data transmitted / received in the user's account, and a mail data to be viewed. It has a function to do.

  The external mail server 90 is a device that provides a cloud-type mail service. The mail server 90 has a function of transmitting and receiving mail for registered accounts. The external mail server 90 has a function of holding mail data transmitted and received for each registered account and presenting corresponding mail data in response to a browsing request. For example, the external mail server 90 may transmit / receive mail data based on SMTP (Simple Mail Transfer Protocol) and present the mail data based on IMAP (Internet Message Access Protocol).

  In addition, the external mail server 90 registers an account of a user who belongs to an organization where the network 800 is laid. Hereinafter, such an account is also referred to as an internal account. The external mail server 90 can store the transmitted / received mail data in the storage device for each registered internal account.

  Next, details of each functional block of the information processing apparatus 1 will be described.

  The key information storage unit 11 stores key information for encryption and decryption. For example, the key information may be a common key of a common key cryptosystem. Alternatively, the key information may be a pair of keys in encryption schemes having different encryption keys and decryption keys. In addition, the key information may be key information in another encryption method as long as the data can be encrypted and decrypted. The key information storage unit 11 only needs to store key information common in the organization, and does not need to store different key information for each internal account.

  The transmission mail acquisition unit 12 acquires transmission mail data from the user terminal 80. For example, the transmission mail acquisition unit 12 may acquire mail data for transmission input via the user interface by presenting a user interface screen for mail creation on the user terminal 80. Specifically, for example, the outgoing mail acquisition unit 12 may be configured by an HTTP (Hypertext Transfer Protocol) server application. In this case, the transmission mail acquisition unit 12 may transmit the mail creation web page stored in the storage device 1004 to the user terminal 80. Then, the user terminal 80 displays a web page for mail creation on the display device using a web browser. Then, the user terminal 80 transmits the mail data for transmission input to the web page to the information processing apparatus 1 in response to a click operation on the transmission button. In this way, the transmission mail acquisition unit 12 may acquire transmission mail data input at the user terminal 80. The transmission mail acquisition unit 12 may set the internal account of the user of the user terminal 80 as the sender of the transmission mail data acquired in this way.

  The address determination unit 13 determines whether the address of the mail data for transmission is addressed to the internal account. As described above, an internal account is an account of a user belonging to an organization. Therefore, it may be considered that the domain information included in the e-mail address assigned to the user's internal account represents the corresponding organization. Therefore, for example, the destination determination unit 13 determines whether the destination of the mail data for transmission is addressed to the internal account based on whether the domain information of the mail address included in the destination of the mail data for transmission represents the corresponding organization. It may be determined whether or not.

  Further, the destination determination unit 13 determines that the destination of the mail data for transmission is the internal address when a plurality of destinations are set for the mail data for transmission, and all of the plurality of destinations are addressed to the internal account. It may be determined that it is addressed to an account.

  The encryption unit 14 encrypts the mail data for transmission determined to be addressed to the internal account by the destination determination unit 13 using the key information stored in the key information storage unit 11. If the key information storage unit 11 stores a common key of the common key encryption method shared by the organization, the encryption unit 14 may encrypt the mail data using the common key. If the key information storage unit 11 stores a pair of encryption and decryption keys shared by the organization, the mail data may be encrypted using the encryption key.

  For example, the encryption unit 14 may extract the main body portion that does not include the mail header from the mail data for transmission addressed to the internal account and perform encryption. The body part includes the mail text and attached files. In this case, the encryption unit 14 adds a mail header indicating that the mail data is encrypted to the original mail header. An example of encrypted mail data is shown in FIG. In FIG. 3, underlined portions A and B represent added mail headers. For example, the row “X-Encrypted: 1” (underlined portion A) represents the added header field and its value. In this case, the header field “X-Encrypted” is an extension field, and the value “1” indicates that the main body portion is encrypted by the encryption unit 14. In FIG. 3, “X-AES256” (underlined portion B) added to the value of the “Content-Transfer-Encoding” field indicates that the encryption method by the encryption unit 14 is “AES256”. Yes. In this case, the encryption unit 14 adds the added value “X-AES256” and the original value “7bit” so as to leave the information “7bit” that is the original value of the “Content-Transfer-Encoding” field. The value of this field is a character string concatenated with "/". In FIG. 3, a part C represents a main part encrypted by the encryption method “AES256”. As described above, the encryption unit 14 may generate mail data including a mail header to which information indicating that the mail data is encrypted and an encrypted main body portion are added.

  The mail transmission unit 15 requests the external mail server 90 to transmit the mail data encrypted by the encryption unit 14. For example, the mail transmission unit 15 may request transmission of encrypted mail data by connecting to an SMTP server of the external mail server 90. As a result, the encrypted mail data is transmitted to the internal account as the destination by the external mail server 90. Here, the destination internal account is an account registered in the external mail server 90. Therefore, the encrypted mail data is stored in the external mail server 90 as mail data of the internal account that is the destination.

  The mail transmitting unit 15 transfers the mail data acquired by the transmitted mail acquiring unit 12 to the external mail server 90 as it is for the mail data for transmission determined by the destination determining unit 13 as not addressed to the internal account. And request transmission.

  The browsing mail acquisition unit 16 receives a browsing request for mail data in the internal account from the mail presentation unit 19 described later. Then, the browsing mail acquisition unit 16 acquires browsing target mail data from the external mail server 90. For example, the browsing mail acquisition unit 16 may acquire the mail data to be browsed by connecting to the IMAP server of the external mail server 90.

  The encryption determination unit 17 determines whether the mail data acquired by the browsing mail acquisition unit 16 is encrypted. For example, consider a case where a mail header representing encrypted mail data is added by the encryption unit 14. In this case, the encryption determination unit 17 may determine whether or not the mail data is encrypted based on the mail header of the mail data acquired by the browsing mail acquisition unit 16. For example, the encryption determination unit 17 may perform determination processing based on whether or not the corresponding mail data includes a mail header “X-Encrypted: 1”.

  The decryption unit 18 decrypts the mail data determined to be encrypted by the encryption determination unit 17 using the key information stored in the key information storage unit 11. If the key information storage unit 11 stores a common key of the common key encryption method shared by the organization, the decryption unit 18 may decrypt the mail data using the common key. If the key information storage unit 11 stores a pair of encryption and decryption keys shared by the organization, the mail data may be decrypted using the decryption key.

  Further, for example, a case is assumed in which information representing an encryption method is included in the mail header of the mail data to be decrypted. For example, as described above, the information indicating the encryption method may be included in the value of the header field “Content-Transfer-Encoding”. In this case, the decryption unit 18 may decrypt the main body portion using the key information stored in the key information storage unit 11 based on the information representing the corresponding encryption method. Then, the decryption unit 18 outputs the decrypted mail data to the mail presentation unit 19.

  In response to the reception of the mail data browsing request in the internal account, the mail presenting unit 19 presents the browsing target mail data decrypted by the decrypting unit 18 to the viewing request transmission source. Specifically, the mail presentation unit 19 outputs a browsing request received from the user terminal 80 to the browsing mail acquisition unit 16. The mail presenting unit 19 may transmit the mail data output from the decrypting unit 18 to the user terminal 80.

  For example, the mail presentation unit 19 may acquire a browsing request via the user interface by presenting a user interface screen for browsing mail on the user terminal 80. Specifically, for example, the mail presentation unit 19 may be configured by an HTTP server application. In this case, the mail presentation unit 19 may transmit the mail browsing web page stored in the storage device 1004 to the user terminal 80. Then, the user terminal 80 displays a web page for mail browsing on a display device using a web browser. Then, the user terminal 80 transmits, to the information processing apparatus 1, a mail data browsing request in the internal account of the user who is using the user apparatus in response to a click operation on the reception button or the like in the web page. In this way, the mail presentation unit 19 may acquire a browsing request for the designated internal account from the user terminal 80. Then, the mail presenting unit 19 may transmit the mail data output from the decrypting unit 18 to the user terminal 80 by including it in a web page for mail browsing. Thereby, the mail presentation unit 19 can display the mail data of the corresponding internal account.

  The mail presenting unit 19 may present the mail data acquired by the browsing mail acquiring unit 16 as it is for the mail data determined not to be encrypted by the encryption determining unit 17. For example, the mail presenting unit 19 may include the unencrypted mail data acquired by the browsing mail acquiring unit 16 as it is included in the mail browsing web page and transmit it to the user terminal 80. .

  The operation of the information processing apparatus 1 configured as described above will be described with reference to FIGS.

  First, the mail transmission operation of the information processing apparatus 1 is shown in FIG.

  In FIG. 4, the transmission mail acquisition unit 12 first acquires mail data for transmission from the user terminal 80 (step S1). For example, as described above, the transmission mail acquisition unit 12 acquires the information input in the input area of the web page as transmission mail data by transmitting the mail input web page to the user terminal 80. May be.

  Next, the destination determination unit 13 determines whether or not the destination of the mail data for transmission acquired in step S1 is addressed to the internal account (step S2). For example, as described above, the destination determination unit 13 may perform the determination process based on the domain information included in the destination mail address. In addition, when a plurality of destinations are set, the destination determination unit 13 may determine that the destination is addressed to the internal account when any of the destinations is addressed to the internal account.

  Here, when it is determined that the address is addressed to the internal account, the encryption unit 14 acquires key information from the key information storage unit 11 (step S3).

  Next, the encryption unit 14 encrypts the mail data for transmission acquired in step S1 using the key information acquired in step S3 (step S4). For example, as described above, the encryption unit 14 may encrypt a main body portion (a text, an attached file, etc.) that does not include a mail header in the mail data for transmission. In this case, the encryption unit 14 may add information indicating that the data is encrypted mail data to the mail header.

  Next, the mail transmitting unit 15 requests transmission of the mail data encrypted in step S4 by connecting to the external mail server 90 (step S5).

  On the other hand, if it is determined in step S2 that the address is not addressed to the internal account, the mail transmitting unit 15 connects to the external mail server 90 to request transmission of the mail data for transmission acquired in step S1 (step S6). ). In steps S5 and S6, the mail transmitting unit 15 may request transmission of corresponding mail data by connecting to an SMTP server of the external mail server 90, for example.

  Thus, the information processing apparatus 1 ends the mail transmission operation.

  Next, the mail presenting operation of the information processing apparatus 1 is shown in FIG.

  In FIG. 5, first, the mail presentation unit 19 acquires a request for browsing mail data in the internal account from the user terminal 80 (step S <b> 11). For example, as described above, the mail presentation unit 19 transmits a web page for mail browsing to the user terminal 80, thereby viewing information transmitted in response to the click operation of the reception button on the web page. You may receive as.

  Next, the browsing mail acquisition part 16 acquires the mail data of the browsing object used as the object of the browsing request acquired by step S11 from the external mail server 90 (step S12). For example, the browsing mail acquisition unit 16 may acquire the browsing target mail data by connecting to the IMAP server of the external mail server 90.

  Next, the encryption determination unit 17 determines whether the mail data to be browsed acquired in step S12 is encrypted (step S13). For example, the encryption determination unit 17 determines whether or not the corresponding mail data includes a mail header (such as “X-Encrypted: 1” described above) indicating that the mail data is encrypted. A determination process may be performed.

  If it is determined that the mail data is encrypted, the decryption unit 18 acquires key information from the key information storage unit 11 (step S14).

  Next, the decryption unit 18 decrypts the mail data to be browsed acquired in step S12 using the key information acquired in step S14 (step S15). For example, the decryption unit 18 may perform decryption processing using key information based on encryption method information added to a mail header (such as a “Content-Transfer-Encoding” field).

  Next, the mail presentation unit 19 presents the mail data decrypted in step S15 to the user terminal 80 (step S16). For example, the mail presenting unit 19 may transmit the mail data decrypted in step S15 to the user terminal 80 by including it in a web page for mail presentation.

  On the other hand, when it is determined in step S13 that the mail data is not encrypted, the mail presenting unit 19 presents the mail data to be browsed acquired in step S12 to the user terminal 80 (step S17). . For example, the mail presentation unit 19 may transmit the mail data to be browsed acquired in step S12 to the user terminal 80 by including it in a web page for mail presentation.

  Thus, the information processing apparatus 1 ends the mail presentation operation.

  Next, effects of the first exemplary embodiment of the present invention will be described.

  The information processing apparatus as the first exemplary embodiment of the present invention can further improve the security of mail data stored in an external mail server without increasing the management cost of a key for encryption. .

  The reason is that the key information storage unit stores key information shared in the organization, and the destination determination unit has an external mail server for the destination of the mail data for transmission transmitted from the organization. Whether or not it is addressed to the internal account that holds the mail data, and for the mail data for transmission addressed to the internal account, the encryption unit uses the key information stored in the key information storage unit This is because the mail transmission unit requests the external mail server for transmission after encryption. Then, the browsing mail acquisition unit acquires the mail data to be browsed from an external mail server in response to the mail data browsing request in the internal account, and the encryption determination unit checks whether the mail data to be browsed is encrypted. If it is determined that the data is encrypted, the decryption unit decrypts it using the key information stored in the key information storage unit, and then the mail presentation unit displays the mail data to be viewed. This is because it is presented to the source of the browsing request.

  As a result, mail data transmitted / received between internal accounts in the organization is transmitted to an external network after being encrypted by the information processing apparatus of the present embodiment, and in an encrypted state in an external mail server. It will be saved as mail data addressed to the internal account. The key information used for such encryption and decryption is stored in the key information storage unit of the information processing apparatus of the present embodiment installed in the network in the organization. Therefore, it is difficult for an operator of an external mail server to decrypt and browse mail data transmitted / received between internal accounts in the organization. Therefore, even when an external mail server is used without having a mail server in the organization, the information processing apparatus according to the present embodiment further improves the security of mail data transmitted and received between internal accounts in the organization. Can be improved. Moreover, in the present embodiment, key information shared within the organization may be stored in the key information storage unit installed in the network within the organization, and key information is managed for each user within the organization. There is no need. Therefore, the present embodiment can reduce the management cost of key information for encrypting mail data stored in an external mail server.

(Second Embodiment)
Next, a second embodiment of the present invention will be described in detail with reference to the drawings. Note that, in each drawing referred to in the description of the present embodiment, the same reference numerals are given to the same configuration and steps that operate in the same manner as in the first embodiment of the present invention, and the detailed description in the present embodiment. Description is omitted.

  FIG. 6 shows a functional block configuration of the information processing apparatus 2 as the second embodiment of the present invention. In FIG. 6, the information processing apparatus 2 includes a web mail system 101, a simultaneous delivery system 102, and a key information storage unit 11. In FIG. 6, the information processing apparatus 2 is connected to a user terminal 80 via an in-house network 800 and is connected to an external network in the same manner as the information processing apparatus 1 as the first embodiment of the invention. It is connected to an external mail server 90 via 900.

  The web mail system 101 includes functional blocks other than the key information storage unit 11 among the functional blocks that configure the information processing apparatus 1 according to the first embodiment of this invention. The outgoing mail acquisition unit 12 and the mail presentation unit 19 are configured by an HTTP server application, and provide a user interface screen for mail creation and mail browsing to the user terminal 80.

  The simultaneous delivery system 102 includes a transmission mail acquisition unit 22, a destination determination unit 13, an encryption unit 14, and a mail transmission unit 15.

  The outgoing mail acquisition unit 22 accepts a connection from a simultaneous delivery client application operating on the user terminal 80. And the transmission mail acquisition part 22 acquires the mail data for simultaneous delivery as mail data for transmission. For example, the outgoing mail acquisition unit 22 may be configured by an SMTP server application.

  In addition, when the transmission mail acquisition unit 22 acquires mail data for simultaneous distribution from the user terminal 80, the transmission mail acquisition unit 22 may set one or more internal accounts to be the simultaneous distribution destination as the destination. Such a simultaneous delivery destination may be acquired together with the mail data for simultaneous delivery. Alternatively, the outgoing mail acquisition unit 22 may store in advance internal accounts of all users who are broadcast destinations in the organization, and set them as destinations of the acquired mail data for simultaneous delivery.

  The key information storage unit 11 stores key information as in the first embodiment of the present invention. Note that the encryption unit 14 and the decryption unit 18 of the web mail system 101 and the encryption unit 14 of the simultaneous delivery system 102 can acquire key information from the key information storage unit 11.

  The operation of the information processing apparatus 2 configured as described above will be described.

  The web mail system 101 performs a mail transmission operation and a mail presentation operation in the same manner as the information processing apparatus 1 according to the first embodiment of the present invention described with reference to FIGS. 4 and 5.

  The simultaneous delivery system 102 performs the simultaneous delivery operation in substantially the same manner as the mail transmission operation in the first embodiment of the present invention described with reference to FIG. 4, but the details of the operation in step S1 are different. In step S <b> 1, the transmission mail acquisition unit 22 acquires mail data for simultaneous delivery from the user terminal 80, and sets an internal account that is a broadcast destination as the destination. Thereafter, the simultaneous delivery system 102 operates in the same manner as in the first embodiment of the present invention from step S2 to S5, thereby encrypting the mail data for simultaneous delivery and then connecting to the external mail server 90. Request transmission.

  Above, description of operation | movement of the information processing apparatus 2 is complete | finished.

  Next, the effect of the second exemplary embodiment of the present invention will be described.

  The information processing apparatus according to the second embodiment of the present invention is distributed all over the organization without increasing the key management cost for encryption even when an external mail server is used. Can improve the security of email data.

  The reason is that when the transmission mail acquisition unit of the simultaneous distribution system acquires mail data for simultaneous distribution and sets the internal account of the simultaneous distribution destination as the destination, the destination determination unit determines that it is addressed to the internal account, This is because the encryption unit encrypts the mail data for simultaneous delivery and requests transmission to external mail data.

  As a result, the mail data distributed simultaneously in the organization is stored as mail data for each internal account that is the simultaneous distribution destination in the external mail server while being encrypted. The user terminal can decrypt and browse the broadcast mail data encrypted and stored in the external mail server via the web mail system.

  In the present embodiment, the web mail system and the simultaneous delivery system may be realized so as to share some or all of the functional blocks other than the transmission mail acquisition unit. Alternatively, in the present embodiment, the web mail system, the simultaneous delivery system, and the key information storage unit may be realized by being distributed among a plurality of devices connected to the network in the organization.

  In each of the embodiments of the present invention described above, the transmission mail acquisition unit and the mail presentation unit authenticate the corresponding internal account before the transmission mail data acquisition process and the mail data browsing request acquisition process. Processing may be performed.

  Further, in each of the embodiments of the present invention described above, the key information storage unit has been described as storing key information shared within the organization, but the number of key information shared within the organization is not limited to one. If a plurality of pieces of key information are stored in the key information storage unit, the encryption unit and the decryption unit may perform encryption and decryption using key information selected from the plurality of key information.

  In each embodiment of the present invention, a plurality of information processing apparatuses according to the present embodiment may be installed in a network within an organization. In that case, the plurality of information processing apparatuses according to the present embodiment are configured to share information related to the internal account and key information.

  In each embodiment of the present invention, each functional block of the information processing apparatus may be realized by being distributed to a plurality of apparatuses.

  In each of the embodiments of the present invention described above, the operation of the information processing apparatus described with reference to the flowcharts is stored in a storage device (storage medium) of the computer apparatus as a computer program of the present invention. Such a computer program may be read and executed by the CPU. In such a case, the present invention is constituted by the code of the computer program or a storage medium.

  Further, the present invention is not limited to the above-described embodiment, and can be implemented in various modes.

DESCRIPTION OF SYMBOLS 1, 2 Information processing apparatus 11 Key information storage part 12, 22 Transmission mail acquisition part 13 Destination determination part 14 Encryption part 15 Mail transmission part 16 Browse mail acquisition part 17 Encryption determination part 18 Decryption part 19 Mail presentation part 80 User Terminal 90 Mail server 101 Web mail system 102 Simultaneous delivery system 800, 900 Network 1001 CPU
1002 RAM
1003 ROM
1004 Storage device 1005 Network interface

Claims (7)

A key information storage unit for storing key information for encryption and decryption;
An outgoing mail acquisition unit that acquires mail data for transmission;
An address determination unit that determines whether the address of the mail data for transmission is addressed to an internal account in which the mail data is held in a predetermined external mail server;
An encryption unit that encrypts the transmission mail data determined to be addressed to the internal account by the destination determination unit using the key information;
A mail transmission unit that requests the external mail server to transmit the mail data encrypted by the encryption unit;
A browsing mail acquisition unit that acquires mail data to be viewed in the internal account from the external mail server;
An encryption determination unit that determines whether or not the mail data acquired by the browsing mail acquisition unit is encrypted;
A decryption unit that decrypts the mail data determined to be encrypted by the encryption determination unit using the key information;
In response to a mail data browsing request in the internal account, a mail presenting section that presents mail data decrypted by the decrypting section to a transmission source of the browsing request;
An information processing apparatus comprising: The encryption unit extracts a main body part that does not include a mail header from the mail data for transmission addressed to the internal account, encrypts it using the key information, and is encrypted mail data. Generate encrypted email data by adding an email header that represents
The information processing apparatus according to claim 1, wherein the encryption determination unit determines whether the mail data acquired by the mail acquisition unit is encrypted based on the mail header.   When a plurality of destinations are set in the transmission mail data, and when all of the plurality of destinations are addressed to the internal account, the destination determination unit determines whether the destination of the transmission mail data is the internal address The information processing apparatus according to claim 1, wherein the information processing apparatus determines that the account is addressed. Store key information for encryption and decryption,
When you get mail data for sending,
Determining whether the destination of the mail data for transmission is to an internal account in which the mail data is held in a predetermined external mail server;
The mail data for transmission determined to be addressed to the internal account is encrypted using the key information,
Request the external mail server to send encrypted mail data,
In response to receiving a mail data browsing request in the internal account, obtain mail data to be viewed from the external mail server,
Determine whether the acquired mail data is encrypted,
Decrypt mail data determined to be encrypted using the key information,
An information processing method for presenting decrypted mail data to a source of the browsing request. When encrypting the mail data for transmission determined to be addressed to the internal account, the main mail part not including the mail header is extracted from the mail data for transmission and encrypted using the key information. At the same time, the encrypted mail data is generated by adding the mail header indicating the encrypted mail data,
5. The information processing method according to claim 4, wherein it is determined based on the mail header whether the mail data to be browsed acquired from the external mail server is encrypted. Using a key information storage unit that stores key information for encryption and decryption,
An outgoing mail acquisition step for acquiring mail data for transmission;
A destination determination step of determining whether a destination of the mail data for transmission is addressed to an internal account in which mail data is held in a predetermined external mail server;
An encryption step of encrypting the transmission mail data determined to be addressed to the internal account in the destination determination step using the key information;
A mail transmission step for requesting the external mail server to transmit the mail data encrypted in the encryption step;
A browsing request receiving step for receiving a browsing request for mail data in the internal account;
A browsing mail acquisition step of acquiring mail data to be viewed from the external mail server;
An encryption determination step for determining whether or not the mail data acquired in the browsing mail acquisition step is encrypted;
A decryption step of decrypting the mail data determined to be encrypted in the encryption determination step using the key information;
A mail presenting step of presenting the mail data decrypted in the decrypting step to a transmission source of the browsing request;
Is a computer program that causes a computer device to execute. In the encryption step, the main part not including a mail header is extracted from the mail data for transmission addressed to the internal account, and is encrypted using the key information, and is encrypted mail data. Generate encrypted email data by adding an email header that represents
7. The computer program according to claim 6, wherein in the encryption determination step, it is determined based on the mail header whether the mail data acquired in the browsing mail acquisition step is encrypted.

Images