JP2016063443A - Mail monitoring device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To transfer, even when an attachment file on which compression processing is performed is protected using a password, the attachment file after performing virus check on the attachment file.SOLUTION: A mail monitoring unit 17, when a compressed attachment file protected using a password is attached to reception mail, temporarily stores the compressed attachment file in a saving storage area as well as notifies a user terminal 20 of the storage. A decompression processing unit 14, on the basis of the password designated from the user terminal 20 in response to the notification of the storage, cancels password protection of the compressed attachment file before decompressing the file. An attachment file processing unit 18, when it is confirmed by a virus check on an attachment file obtained by the compression that virus infection does not exist, transfers the attachment file or the compressed attachment file in the saving storage area to the user terminal 20.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an email monitoring technique, and more particularly to an attached file monitoring technique for monitoring virus infection of an attached file attached to an email.

  The mail may contain malicious software, so-called virus (computer virus), and when opening the mail on the user terminal, it is necessary to check such virus infection, that is, virus check.

  Conventionally, as a mail monitoring technique for such mail, a gateway is arranged between a mail server in which mail is stored and a user terminal that browses the mail, and mail transferred from the mail server to the user terminal is Have been proposed (see, for example, Patent Document 1). According to the virus check using such a gateway, it is not necessary to install software for performing virus check on each user terminal, and the burden required for security management can be reduced.

  Recently, these gateways not only have a virus check function, but also a firewall function to prevent attacks from the network, and a web filtering function to prevent access to spyware sites and phishing sites. A mail monitoring apparatus having a UTM (Unified Threat Management) function having a function is also being used.

  In such a conventional mail monitoring technique, when an attached file is attached to the mail received from the mail server, a function of checking the attached file for viruses is provided. At this time, if no virus is detected from the attached file, a mail including the attached file is transferred to the user terminal, and if a virus is detected, the mail from which the attached file is deleted is transferred to the user terminal. Thereby, sufficient security is maintained for the attached file.

JP 2004-287790 A

When attaching a file to an email, compression processing (encoding processing) may be performed to reduce the size of the attached file. In addition, in order to prohibit unauthorized viewing by a third party during this compression process, the attached file may be protected with a password.
On the other hand, in a general virus check, file data of an attached file is searched to check whether a virus is included. Therefore, when the attached file is compressed, not only the file data but also the virus itself is encoded, so it cannot be checked whether or not a virus is included. For this reason, it is necessary to once decompress (decode) the compressed attachment file that has been subjected to compression processing, and check the original attachment file for viruses.

  However, according to the above-described prior art, when a compressed attached file is password protected, the attached file cannot be decompressed because the password is unknown. Therefore, when the password is protected, the attached file cannot be checked for viruses and may be transferred to the user terminal while being attached to the mail. For this reason, when the attached file is decompressed and opened on a user terminal that has not been protected against viruses, there is a possibility that the virus may be infected and sufficient security cannot be maintained.

  An object of the present invention is to provide an attached file monitoring technique capable of transferring an attachment file that has been virus-checked even when the attached file that has been compressed is password protected. .

  In order to achieve such an object, the mail monitoring apparatus according to the present invention performs a virus check on the attached file of the received mail transferred from the mail server to the user terminal, and confirms that the attached file has no virus infection. When the received mail is a mail monitoring device that forwards the received mail to the user terminal, and the compressed mail attachment with password protection is attached to the received mail, the compressed mail attachment is temporarily stored in the save storage area, and An email monitoring unit for notifying the user terminal of storage, and a decompression processing unit for decompressing the compressed attached file after releasing the password protection based on the password designated by the user terminal in response to the storage notification; , Virus detection by virus check on the attached file obtained by the decompression If none is confirmed, the compressed attachment of the attachment or the retracted storage area and a file attachment processing unit to be transferred to the user terminal.

  Also, in one configuration example of the mail monitoring apparatus according to the present invention, the attached file processing unit distributes a download screen of the compressed attached file to the user terminal during the transfer, and a download operation on the download screen Accordingly, the attached file or the compressed attached file in the save storage area is transferred to the user terminal.

  Also, in one configuration example of the mail monitoring apparatus according to the present invention, the attached file processing unit summarizes the contents of the attached file obtained by decompressing the compressed attached file when distributing the download screen. Images are arranged and distributed on the download screen.

  One example of the configuration of the mail monitoring apparatus according to the present invention is that when the attached file processing unit confirms that there is a virus infection by a virus check on the attached file obtained by the decompression, the attached file processing unit starts from the save storage area. The compressed attached file is deleted to prevent transfer to the user terminal.

  Also, in one configuration example of the mail monitoring apparatus according to the present invention, when the mail monitoring unit attaches a password-protected compressed attachment file to the received mail, the compressed mail attachment is deleted from the received mail. In addition, a message for notifying the storage is added to the body of the received mail, and then the received mail is transferred to the user terminal.

  Also, in one configuration example of the mail monitoring apparatus according to the present invention, when the mail monitoring unit attaches a password-protected compressed attachment file to the received mail, the compressed mail attachment is deleted from the received mail. In addition, after attaching an attached file including a message for notifying the storage to the received mail, the received mail is transferred to the user terminal.

  In addition, the mail monitoring method according to the present invention checks the attached file of the received mail transferred from the mail server to the user terminal for viruses, confirms that the attached file is free of virus infection, and then sends the received mail to the user terminal. When the received mail includes a password-protected compressed attachment attached to the received mail, the compressed attachment is temporarily stored in the save storage area and the storage is notified to the user terminal. A mail monitoring step, a decompression processing step for decompressing the compressed attached file after releasing password protection based on a password designated by the user terminal in response to the storage notification, and an attachment obtained by the decompression Virus check on file confirms no virus infection If was, the compressed attachment of the attachment or the retracted storage area and a file attachment process step of transferring to the user terminal.

According to the present invention, the password-protected compressed attached file attached to the e-mail is password-protected and decompressed by the password from the user terminal, and is subjected to a Will check, after confirming that there is no virus infection, It is transferred to the user terminal.
As a result, password-protected compressed attachments are not transferred to the user terminal without being checked. Therefore, sufficient security can be maintained even if the compressed attachments are password-protected. It becomes.

It is a block diagram which shows the structure of a mail monitoring apparatus. It is a flowchart which shows a mail monitoring process. It is an example of a structure of a storage notification message. It is a flowchart which shows a compression attachment file transfer process. It is a structural example of a file selection screen. It is a structural example of a password input screen. It is a structural example of a download screen. It is a structural example of a deletion notification screen. It is a sequence diagram which shows the operation example of a mail monitoring apparatus. It is a connection example of a mail monitoring apparatus.

Next, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
First, the mail monitoring apparatus 10 according to the first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing the configuration of the mail monitoring apparatus.

  This mail monitoring device 10 is composed of a communication processing device such as a gateway device or a server device, and is connected between the mail server 30 and the user terminal 20 to monitor the reception of mail from the mail server 30 by the user terminal 20, When receiving this mail, the body of the received mail and the attached file transferred from the mail server 30 to the user terminal 20 are checked for viruses, and after confirming that there is no virus infection, the received mail is transferred to the user terminal 20. ing.

  The mail monitoring apparatus 10 includes, as main functional units, an upper communication I / F unit 11, a lower communication I / F unit 12, a relay processing unit 13, a virus check unit 15, a decompression processing unit 14, an attached file storage unit 16, A mail monitoring unit 17 and an attached file processing unit 18 are provided.

  Among these functional units, the upper communication I / F unit 11 and the lower communication I / F unit 12 are composed of communication modules having a data communication function, and the attached file storage unit 16 is a storage device such as a semiconductor memory or a hard disk. It is composed of Further, the relay processing unit 13, virus check unit 15, decompression processing unit 14, mail monitoring unit 17, and attached file processing unit 18 are read out and executed by the CPU by reading a program stored in a storage unit (not shown). It is comprised from the arithmetic processing part which implement | achieves a processing function. This program is stored in advance in a storage unit from an external device or a recording medium (both not shown) connected via a communication line.

  The host communication I / F unit 11 has a function of transmitting and receiving various data such as mail and content by performing data communication with a network device such as the mail server 30 via the communication network NW.

  The lower communication I / F unit 12 has a function of transmitting and receiving various data such as mail and content by performing data communication with each user terminal 20 via the communication line L.

  The relay processing unit 13 has a function of relaying data communication such as mail transmission / reception and Web page browsing between various network devices such as the mail server 30 and the user terminal 20 via the communication network NW.

  The decompression processing unit 14 decompresses (decodes) the compressed attached file attached to the received mail received from the mail server 30 to generate the original attached file, and the password notified from the user terminal 20. Based on this, it has a function of decompressing (decrypting) the compressed file after the password protection of the password-protected compressed attachment file is released, and generating the original attached file.

  The virus check unit 15 has a function of performing a virus check on the body and attached file of the received mail received from the mail server 30 and the original attached file decompressed by the decompression processing unit 14. As the virus check method, a known method may be used.

  The attached file storage unit 16 has a function of temporarily storing a password-protected compressed attached file in a save storage area provided in a storage unit (not shown).

  When the received mail received from the mail server 30 is attached with a password-protected compressed attached file, the mail monitoring unit 17 temporarily stores the compressed attached file in the attached file storage unit 16, and from the received mail In addition to deleting the compressed attached file and adding a message for notifying storage to the text of the received mail, the function has a function of transferring the received mail to the user terminal 20.

  When it is confirmed that there is no virus infection by the virus check of the virus check unit 15 for the attached file obtained by the decompression by the decompression processing unit 14, the attached file processing unit 18 selects the attached file or the compressed attached file in the save storage area. The function of transferring to the user terminal 20 and the download screen of the compressed attachment file are distributed to the user terminal 20 at the time of the transfer, and the attached file or the compressed attachment of the save storage area according to the download operation on the download screen And a function of transferring the file to the user terminal 20.

  In addition, when distributing the download screen, the attached file processing unit 18 arranges and distributes thumbnail images summarizing the contents of the attached file obtained by decompressing the compressed attached file on the download screen, and the decompression. A function for inhibiting the transfer to the user terminal 20 by deleting the compressed attachment file from the save storage area when the virus check on the attached file obtained by the above is confirmed by the virus check, and the compressed attachment file And a function of delivering a deletion notification screen indicating deletion to the user terminal 20.

[Operation of First Embodiment]
Next, the operation of the mail monitoring apparatus 10 according to the present embodiment will be described with reference to FIG. FIG. 2 is a flowchart showing the mail monitoring process.
The mail monitoring device 10 constantly monitors the reception of mail from the mail server 30 by the user terminal 20, and among the received mail transferred from the mail server 30 to the user terminal 20, the received mail to which the attached file is attached is received. The mail monitoring process of FIG. 2 is executed.

  It should be noted that a known mail monitoring process is performed for a virus check on a received mail or mail body without an attached file, and a description thereof is omitted here. Further, when a plurality of attached files are attached to one received mail, the same processing is executed for each attached file.

  First, the decompression processing unit 14 confirms whether or not the attached file of the received mail received from the mail server 30 via the communication network NW and the upper communication I / F unit 11 has been compressed (step 100). If the file is a compressed attached file that has undergone compression processing (step 100: YES), it is confirmed whether the compressed attached file is password protected (step 101).

  Here, when the compressed and compressed attachment file is not password protected (step 101: NO), the decompression processing unit 14 decompresses the compression of the compressed and compressed attachment file, and generates an uncompressed original attachment file (step). 102).

Next, the virus check unit 15 performs a virus check on the original attached file decompressed by the decompression processing unit 14 (step 103).
In step 100, if the attached file is an uncompressed attached file (step 100: NO), the process proceeds to step 103, and the attached file is checked for viruses (step 103).

  Here, when it is confirmed that there is no virus infection by the virus check on the attached file (step 104: NO), the mail monitoring unit 17 converts the received mail attached with the attached file or the compressed attached file to the lower communication I / O. The data is transferred from the F unit 12 to the user terminal 20 via the communication line L (step 105), and the series of mail monitoring processes is terminated.

  On the other hand, if it is confirmed in step 104 that there is a virus infection by a virus check on the attached file (step 104: YES), the mail monitoring unit 17 deletes the attached file or the compressed attached file from the received mail, The data is transferred from the communication I / F unit 12 to the user terminal 20 via the communication line L (step 106), and the series of mail monitoring processes is terminated.

  If the compressed attached file is password protected in step 101 (step 101: YES), the mail monitoring unit 17 does not check the virus by compressing and decompressing the compressed attached file. Are stored temporarily in a save storage area provided in a storage unit (not shown) of the attached file storage unit 16 together with a received mail ID for identifying the received mail (step 110).

Thereafter, the mail monitoring unit 17 deletes the complemented compressed attached file from the received mail (step 111), adds a message for notifying storage to the body of the received mail, and then sends the received mail to the lower level communication. The data is transferred from the I / F unit 12 to the user terminal 20 via the communication line L (step 112), and the series of mail monitoring processes is terminated.
Thereby, when the user confirms the text of the received mail on the user terminal 20, the user is notified that the password-protected compressed attached file is stored in the mail monitoring apparatus 10.

  FIG. 3 is a configuration example of the storage notification message. In this storage notification message, the fact that the password-protected compressed attachment file is stored in the mail monitoring apparatus 10 and the name of the stored compressed attachment file are described, and the stored compressed attachment file is downloaded. As the operation symbol, for example, a link symbol for transmitting an attachment file acquisition request to the mail monitoring apparatus 10 is provided. This attached file acquisition request includes a received mail ID for identifying a received mail to be downloaded.

Next, the compressed attached file transfer process in the mail monitoring apparatus 10 according to the present embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing the compressed attached file transfer process.
The mail monitoring apparatus 10 executes the compressed attachment file transfer of FIG. 4 based on the attachment file acquisition request notified from the user terminal 20 in response to the notification of the storage of the password-protected compressed attachment file to the user terminal 20. .

  First, in response to an attachment file acquisition request from the user terminal 20, the attachment file processing unit 18 specifies an e-mail subject to the attachment file acquisition request based on the received mail ID specified in the attachment file acquisition request. The attached file storage unit 16 confirms the compressed attached file attached to the e-mail and displays a file selection screen for selecting a download target from these compressed attached files from the lower communication I / F unit 12 to the communication line L. (Step 120).

FIG. 5 is a configuration example of the file selection screen. Here, information for confirming the target received mail, the file name of the compressed attachment file to be downloaded, a selection button for selecting the compressed attachment file, and further instructing deletion of the compressed attachment file A delete button is provided.
In this file selection screen, when the user selects a compressed attachment file to be downloaded, the user terminal 20 notifies the mail monitoring apparatus 10 via the communication line L of a file designation request that designates the compressed attachment file. The

  Subsequently, in response to the file designation request from the user terminal 20, the attached file processing unit 18 displays a password input screen for inputting a password for canceling password protection regarding the compressed attached file designated by the file designation request. Distribution is performed from the lower communication I / F unit 12 to the user terminal 20 via the communication line L (step 121).

FIG. 6 is a configuration example of a password input screen. Here, a file name of a compressed attached file to be downloaded, a password input field, and an OK button for confirming the input are provided.
When the user inputs and confirms the password on this password input screen, the input password is notified from the user terminal 20 to the mail monitoring apparatus 10 via the communication line L.

  In response to the notification of the password, the decompression processing unit 14 reads out the compressed attachment file to be downloaded from the save storage area (step 122), decompresses (decrypts) the compression after releasing the password protection, and attaches the original attachment. A file is generated (step 123), and the virus check unit 15 checks the original attached file decompressed by the decompression processing unit 14 for a virus (step 124).

  Here, when it is confirmed that there is no virus infection by the virus check on the attached file obtained by decompression (step 125: NO), the attached file processing unit 18 displays a download screen for downloading the compressed attached file at the lower level. Distribution is performed from the communication I / F unit 12 to the user terminal 20 via the communication line L (step 126), and the series of compressed attached file transfer processing ends.

  FIG. 7 is a configuration example of the download screen. This download screen is the same as the file selection screen in FIG. 5 described above, and a download button is provided instead of the selection button for a compressed attached file for which no virus infection has been confirmed.

  When the user downloads a compressed attachment file to be downloaded on this download screen, the user terminal 20 notifies the mail monitoring apparatus 10 via the communication line L of a download request designating the compressed attachment file. In response to this, the attached file processing unit 18 of the mail monitoring device 10 reads the compressed attached file designated from the save storage area and transfers it to the user terminal 20. At this time, the decompressed attached file may be transferred instead of the compressed attached file. Thereby, the user's password input at the time of decompressing the compressed attached file on the user terminal 20 can be omitted.

On the other hand, when it is confirmed in step 126 that there is a virus infection by virus check on the attached file obtained by decompression (step 125: YES), the attached file processing unit 18 deletes the compressed attached file from the save storage area. Then, the transfer to the user terminal 20 is suppressed (step 127), and a deletion notification screen indicating deletion of the compressed attached file is distributed to the user terminal 20 (step 128), and the series of compressed attached file transfer processes ends. To do.
FIG. 8 is a configuration example of the deletion notification screen. Here, the fact that the compressed attached file has been deleted because it was confirmed that there was a virus infection and the name of the compressed attached file are described.

[Operation example]
Next, an operation example of the mail monitoring apparatus 10 according to the present embodiment will be described with reference to FIG. FIG. 9 is a sequence diagram illustrating an operation example of the mail monitoring apparatus. Here, a case where the password-protected compressed attached file attached to the received mail is not virus-infected and is downloaded by the user terminal 20 will be described as an example.

  First, the mail monitoring apparatus 10 receives a received mail transferred from the mail server 30 to the user terminal 20 in response to a mail reception request from the user terminal 20 to the mail server 30 (step 130), and is password protected. Since the compressed attached file is attached, the compressed attached file is stored in the save storage area (step 131), and after the compressed attached file is deleted from the received mail (step 132), it is shown in FIG. The received mail with the storage notification message added is transferred to the user terminal 20 (step 133).

The user terminal 20 notifies the mail monitoring apparatus 10 of an attachment file acquisition request in response to an attachment file acquisition operation by the user who has confirmed the received mail text storage notification message (step 134).
In response to this, the mail monitoring apparatus 10 delivers the file selection screen shown in FIG. 5 to the user terminal 20 (step 135).

The user terminal 20 notifies the mail monitoring apparatus 10 of a file selection request in response to a file designation operation by the user on this file selection screen (step 136).
In response to this, the mail monitoring apparatus 10 delivers the password input screen shown in FIG. 6 to the user terminal 20 (step 137).

The user terminal 20 notifies the input password to the mail monitoring apparatus 10 in response to the password confirmation operation by the user on the password input screen (step 138).
In response to this, the mail monitoring apparatus 10 cancels the password protection of the compressed attached file read from the save storage area based on this password, decompresses the compressed file (step 139), and then checks for viruses (step 140).

Here, if it is confirmed that there is no virus infection, the mail monitoring apparatus 10 distributes the download screen shown in FIG. 7 to the user terminal 20 (step 141).
The user terminal 20 notifies the download request to the mail monitoring apparatus 10 in response to the download operation by the user on this download screen (step 142).

In response to this, the mail monitoring apparatus 10 transfers the designated compressed attached file to the user terminal 20 (step 143). At this time, the decompressed attached file may be transferred instead of the compressed attached file.
Based on the password input by the user, the user terminal 20 cancels the password protection of the compressed attached file and decompresses the compressed file (step 144). Thereby, the original attached file is confirmed by the user.

[Effect of the first embodiment]
As described above, in the present embodiment, when the received mail is attached with a password-protected compressed attached file, the mail monitoring unit 17 temporarily stores the compressed attached file in the save storage area and stores the compressed attached file. The user terminal 20 is notified, and the decompression processing unit 14 decompresses the compressed file after releasing the password protection of the compressed attached file based on the password designated by the user terminal 20 in response to the storage notification, and the attached file processing unit 18 However, when it is confirmed that there is no virus infection by a virus check on the attached file obtained by decompression, the attached file or the compressed attached file in the save storage area is transferred to the user terminal 20.

As a result, the password-protected compressed attached file attached to the e-mail is subjected to the password protection cancellation and compression / decompression with the password from the user terminal 20 and is subjected to a Will check. 20.
Therefore, since the password-protected compressed attachment is not transferred to the user terminal 20 without being subjected to the Will check, even if the compressed attachment is password-protected, the virus-checked attachment is stored in the user terminal 20. Can be transferred to. For this reason, it is possible to maintain sufficient security.

  In the present embodiment, when the attached file processing unit 18 transfers the compressed attachment file to the user terminal 20, the download screen of the compressed attachment file is distributed to the user terminal 20, and the download operation on the download screen is performed. Accordingly, the attached file or the compressed attached file in the save storage area may be transferred to the user terminal 20. Thereby, it is possible to select and download an attached file required by the user.

  Further, when distributing the download screen, the attached file processing unit 18 may arrange and distribute thumbnail images summarizing the contents of the attached file obtained by decompressing the compressed attached file on the download screen. . Thereby, the user of the contents of the attached file can be confirmed, and the necessity of downloading can be easily determined.

  Further, in the present embodiment, when the attached file processing unit 18 confirms that there is a virus infection by a virus check on the attached file obtained by decompression, the compressed attached file is deleted from the save storage area, and the user terminal The transfer to 20 may be suppressed. As a result, the compressed attached file that is confirmed to have a virus infection is not transferred to the user terminal 20, and high security can be obtained.

  In the present embodiment, when the received mail is attached with a password-protected compressed attachment, the mail monitoring unit 17 deletes the compressed attachment from the received mail and stores it in the body of the received mail. After adding a message for notifying the user, the received mail may be transferred to the user terminal 20. As a result, contents other than the password-protected compressed attached file can be transferred to the user terminal 20 while maintaining high security, and can be stored in the received mail without using a separate storage notification means. Can be notified.

[Second Embodiment]
Next, the mail monitoring apparatus 10 according to the second embodiment of the present invention will be described.
In the first embodiment, the case where the storage notification message indicating that the password-protected compressed attached file is stored in the save storage area is added to the body of the received mail transferred to the user terminal 20 has been described as an example. However, the storage notification is not limited to this.
In the present embodiment, a case will be described in which an attached file including a storage notification message is attached to an e-mail and transferred to the user terminal 20 instead of the deleted compressed attached file.

  In other words, in the present embodiment, when a password-protected compressed attached file is attached to the received mail, the mail monitoring unit 17 deletes the compressed attached file from the received mail and notifies the received mail of storage. After attaching an attached file containing a message to be sent, the received mail is transferred to the user terminal 20.

  Therefore, specifically, when the compressed attached file is deleted from the received mail and transferred to the user terminal 20 in step 106 of FIG. 2 described above, for example, a new text file including the storage notification message shown in FIG. The attached file is attached to the e-mail and transferred to the user terminal 20.

  At this time, the file name of the deleted compressed attachment file may be used as the file name of the new attachment file. As a result, it can be seen that the original compressed attached file is stored in the mail monitoring apparatus 10 when the user accesses the attached file. For this reason, the user confirms the storage notification message only when the original compressed attachment is necessary for the user, and the burden on the user can be reduced.

[Third Embodiment]
Next, with reference to FIG. 10, a mail monitoring apparatus 10 according to a third embodiment of the present invention will be described. FIG. 10 is a connection example of the mail monitoring apparatus.
Although the first embodiment has been described on the assumption that one mail monitoring device 10 is provided for one mail server 30, the present invention is not limited to this.

  In FIG. 10, a plurality of mail monitoring devices 10 are connected in parallel to one mail server 30. For example, in a business use such as a company, an in-house network is divided for each department by a department network device such as a router or a switch, and one mail server 30 may be shared by each department. In such a case, the mail monitoring device 10 may be used as the department network device. Thereby, mail can be monitored for each department, and high operational efficiency can be obtained.

  Note that, in such an in-house network, the mail transmission source can be specified for the mail exchanged between the companies. Therefore, when a virus infection is confirmed from an attached file of an email in any of the email monitoring devices 10, even if the email monitoring device 10 notifies the user terminal 20 that is a sender of the email of the virus infection. Good. Thereby, the spread of virus infection can be suppressed at an early stage throughout the company.

[Extended embodiment]
The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In addition, each embodiment can be implemented in any combination within a consistent range.

  DESCRIPTION OF SYMBOLS 10 ... Mail monitoring apparatus, 11 ... Upper communication I / F part, 12 ... Lower communication I / F part, 13 ... Relay processing part, 14 ... Decompression processing part, 15 ... Virus check part, 16 ... Attached file storage part, 17 ... mail monitoring unit, 18 ... attached file processing unit, 20 ... user terminal, 30 ... mail server, NW ... communication network, L ... communication line.

Claims (7)

A mail monitoring device that checks the attached file of the received mail transferred from the mail server to the user terminal for viruses, confirms that the attached file is free of virus infection, and then forwards the received mail to the user terminal,
When a password-protected compressed attached file is attached to the received mail, the compressed attached file is temporarily stored in a save storage area, and a mail monitoring unit that notifies the user terminal of the storage;
Based on the password specified from the user terminal in response to the storage notification, a decompression processing unit that decompresses the compressed attached file after releasing the password protection;
An attachment file processing unit that transfers the attachment file or the compressed attachment file in the save storage area to the user terminal when it is confirmed that there is no virus infection by a virus check on the attachment file obtained by the decompression. E-mail monitoring device characterized by. The mail monitoring device according to claim 1,
The attached file processing unit distributes the download screen of the compressed attachment file to the user terminal at the time of the transfer, and the compressed attachment of the attachment file or the save storage area according to a download operation on the download screen. A mail monitoring apparatus for transferring a file to the user terminal. In the mail monitoring device according to claim 2,
When the download screen is distributed, the attached file processing unit arranges and distributes thumbnail images summarizing the contents of the attached file obtained by decompressing the compressed attached file on the download screen. Mail monitoring device. In the mail monitoring device according to any one of claims 1 to 3,
The attached file processing unit deletes the compressed attached file from the save storage area and transfers it to the user terminal when it is confirmed that there is a virus infection by a virus check on the attached file obtained by the decompression. A mail monitoring device characterized by deterrence. In the mail monitoring device according to any one of claims 1 to 4,
The mail monitoring unit deletes the compressed attachment from the received mail and notifies the storage in the body of the received mail when a password-protected compressed attached file is attached to the received mail. A mail monitoring apparatus that transfers the received mail to the user terminal after adding a message. In the mail monitoring device according to any one of claims 1 to 4,
The mail monitoring unit deletes the compressed attached file from the received mail when a password-protected compressed attached file is attached to the received mail, and displays a message for notifying the received mail of the storage. A mail monitoring apparatus, comprising: attaching an attached file including the received mail; and forwarding the received mail to the user terminal. An email monitoring method for checking an attachment file of a received mail transferred from a mail server to a user terminal for virus, and confirming that the attached file is free of virus infection, and then forwarding the received mail to the user terminal,
When a password-protected compressed attachment is attached to the received mail, the mail monitoring step of temporarily storing the compressed attachment in the save storage area and notifying the user terminal of the storage;
Based on the password specified from the user terminal in response to the storage notification, a decompression processing step of decompressing the compressed attachment after releasing the password protection of the compressed attached file;
An attachment file processing step of transferring the attachment file or the compressed attachment file in the save storage area to the user terminal when it is confirmed that there is no virus infection by a virus check on the attachment file obtained by the decompression. Mail monitoring method characterized by.

Images