JP2019008727A - Relay device and electronic mail relay method - Google Patents

Abstract

To provide a mail transfer technology for monitoring the presence/absence of malware in a password-protected compression file without making a user input a password for cancelling the password-protected compression file.SOLUTION: The relay device comprises: disclosed file virus presence/absence determination means for, when password-added electronic mail detection means detects electronic mail added with a password, disclosing a password-protected attachment file detected by password-added attachment file electronic mail detection means by using the password, and for checking the virus of the disclosed attachment file, and for determining whether or not the virus is included in the disclosed attachment file; and disclosed attachment file-added electronic mail transmission means for, when it is determined that the virus is not included in the disclosed attachment file by the disclosed file virus presence/absence determination means, attaching the disclosed attachment file to the password-added electronic mail detected by the password-added electronic mail detection means, and for transferring the electronic mail to a client.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a relay device, and more particularly to a relay device that relays an electronic mail between a mail server and a client and has a virus check function for a password-protected compressed file.

When the attachment file of an e-mail is invaded by a virus, for example, malware, there is a method of checking whether the attachment file of the e-mail contains malware as a method for preventing infection by the malware. Note that malware is a generic term for malicious software and malicious code created with the intention of operating illegally and harmfully, and is a computer virus or worm.
However, malware cannot be detected if the attached file is compressed by password protection.

As a technique for solving such a problem, for example, there is a technique described in JP-A-2006-63443 (Patent Document 1).
In this publication, when a gateway including a mail monitoring device is provided between a mail server and a user terminal, and a password-protected compressed file is attached to an email relayed by the gateway, the password protection is performed. When the received compressed file is temporarily stored, a message prompting the user terminal to which the e-mail is transmitted to input the protected password is notified, and the e-mail in which the password is input by the user is received, the gateway Describes a technique for confirming the presence or absence of malware by releasing / decompressing the password of the password-protected compressed file based on the password.

JP 2006-63443 A

According to the invention described in Patent Document 1, it is possible to detect malware even when the attached file is compressed by password protection, and to prevent infection by malware. Play.
However, in Patent Document 1, the user is prompted to input a password for releasing the password-protected compressed file, and the user inputs the password of the password-protected compressed file from the terminal. Each time, the user had to enter a password, which was cumbersome.
In addition, a password for releasing the password-protected compressed file is included separately from an email attached with a password-protected compressed file (hereinafter referred to as a password-attached file email) from the email sender. Although an e-mail (hereinafter referred to as a password-added e-mail) may be sent, e-mail monitoring in this case is not considered.

  Therefore, in view of the above problems, the present invention provides an e-mail transfer technique that allows a user to monitor the presence or absence of malware in a password-protected compressed file without inputting a password for releasing the password-protected compressed file. The purpose is to do.

In order to solve the above problems, one of the representative relay devices and e-mail relay methods of the present invention is:
A relay device having a virus check function for an attached file attached to an e-mail transferred from a mail server to a client,
A password-attached file e-mail detecting means for detecting a password-attached e-mail including a password-protected attachment in an e-mail transferred from the mail server to the predetermined client;
When the password-attached file e-mail detection means detects that the password-protected attachment is attached to the e-mail, the e-mail is excluded from the e-mail except for the password-protected attachment. An attachment-free e-mail transfer means for transferring to the client;
An e-mail in which a password is added to an e-mail transferred from the mail server to the client after the non-attached e-mail transfer means transfers an e-mail excluding the password-protected attached file to the client. A password-added e-mail detecting means for detecting
When the password-added e-mail detection means detects an e-mail with the password, the password-protected attachment detected by the password-attached e-mail detection means is opened using the password. , Checking the virus of the opened attached file, and determining whether or not the opened attached file contains a virus,
When the opened file virus presence / absence determining means determines that the opened attachment file does not contain a virus, the opened attachment file is attached to the email detected by the password-added email detection means to the client. An e-mail transmission means with an attached file to be transferred;
It is characterized by having.

According to the present invention, when a password-protected attached file e-mail with password protection is received, the user does not need to input for password cancellation of the password-protected compressed file each time, and the password The virus check of the protected compressed file can be automatically performed, and high security can be maintained.
Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

The figure which shows the state which connected the relay apparatus of this invention, the mail server, and the client with the network. The functional block diagram which shows the structural example of the relay apparatus in FIG. The figure which shows the structural example of a RETR response message table. The sequence diagram which shows one Example of this invention, and shows the sequence between the relay apparatus which detects and acquires an attached file electronic mail with a password, a client, and a mail server. The sequence diagram which shows one Example of this invention, and shows the sequence between the relay apparatus which detects and acquires an electronic mail with a password, a client, and a mail server. The flowchart which shows the processing flow of the relay apparatus in one Example of this invention. The flowchart which shows the DELE reception process of the relay apparatus in one Example of this invention. The flowchart which shows the QUIT reception process of the relay apparatus in one Example of this invention. The flowchart which shows the process in case there exists RETR response message record of the relay apparatus in one Example of this invention.

  The present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram illustrating a state in which a relay device, a mail server, and a client of the present invention are connected via a network.

  When the relay apparatus 10 is installed between the client 20 and the network 40 and acquires an e-mail addressed to the client from the client 20, for example, the RETR message number that is a mail message request for acquiring an attached file e-mail with a password is set. When received, the mail server 30 connected to the network 40 acquires an attached file electronic mail with a password addressed to the client (a RETR response message corresponding to the RETR message number), and transmits and forwards it to the client 20.

  In other words, when the relay device 10 receives the password-attached file e-mail, it temporarily stores it, relays the e-mail from which the attached file in the password-attached e-mail is deleted, and then the opening password is appended. When receiving an e-mail, the attached file in the password-attached e-mail with temporary storage is opened, and if there is no virus, the opened attachment is attached to the e-mail with the opening password attached and relayed. is there.

FIG. 2 is a block diagram illustrating a configuration example of the relay apparatus 10 according to the present invention.
The relay device 10 includes an input / output interface device 11, a storage device 12, and an arithmetic device (control device) 13.

  The input / output interface device 11 transmits and receives information between the client 20 and the mail server 30.

  The storage device 12 has a storage unit for storing the attached file electronic mail with a password, for example, a client IP address from the client 20, a message number, and a RETR response message table 121 for storing a RETR response message from the mail server 30.

  The arithmetic device 13 includes an e-mail detection unit 131, an attached file virus presence / absence determination unit 132, an e-mail transfer unit 133, an e-mail deletion request 134, a deletion request detection / deletion response creation / deletion response transmission unit 135 for an e-mail with attachment file. And controls the operation of the relay device 10 according to a program stored therein.

  The e-mail detection unit 131 includes a password-attached file e-mail detection unit 1311 and a password-added e-mail detection unit 1312.

The attached file e-mail detection unit 1311 with password detects and outputs an e-mail addressed to the client from the mail server 30 in response to an e-mail acquisition request from the client 20. Detects a password-added e-mail with a password to open the attached compressed file and outputs the password.

  The attached file virus presence / absence determining unit 132 includes an attached file extracting unit 1321, an attached file opening unit 1322, and an attached file virus checking unit 1323.

  The attached file extraction unit 1321 extracts the password-protected compressed file attached to the password-attached file e-mail.

  The attached file opening unit 1322 cancels / decompresses the extracted password-protected compressed file with the password detected by the password-added electronic mail detecting unit 1312 and opens the file.

  The attached file virus check unit 1323 checks whether or not a virus (malware) is included in the opened attached file, and notifies the e-mail transfer unit of the result.

  The e-mail transfer unit 133 includes an attached file deletion unit 1331, a message attaching unit 1332, an attached file no e-mail transfer unit 1333, and an unattached attached file e-mail transfer unit 1334.

  The attached file deleting unit 1331 deletes the password-protected compressed file from the attached file electronic mail with password detected by the attached file electronic mail detecting unit 1311 with password.

  The attached file-less e-mail transfer unit 1333 transfers the e-mail from which the password-protected compressed file is deleted, that is, the attached file-less e-mail without the password-protected compressed file, to the client 20.

  When the attached file virus presence / absence determination unit 132 checks for viruses as a result of the virus check, the unattached attached file-attached e-mail transfer unit 1334 attaches the unattached attached file to the password-added e-mail and transfers it to the client 20. . If there is a virus, the e-mail body with a message to that effect is transferred to the client 20.

When the attached file non-email is transferred to the client 20, the message appending unit 1332 appends, for example, a message “Attached file is attached after virus check” to the body of the email.
In addition, if there is a virus as a result of the virus check by the attached file virus presence / absence determination unit 132, a message stating that “the attached file has been deleted because it contains malware” is received in the e-mail body. Is added.

  When receiving an e-mail deletion request from the client 20, the e-mail deletion request unit 134 transmits the e-mail deletion request to the mail server 30.

  The deletion request detection / deletion response creation / deletion response transmission unit 135 of the attached file-attached e-mail has the following functions. That is, when a deletion request for a password-attached file e-mail is received from the client 20, a delete response indicating that the password-attached file e-mail is deleted without transferring the deletion request to the mail server 30, for example, DELE A message is created, and the deletion response (DELE message) is transmitted (notified) to the client 20.

FIG. 3 is a diagram showing a configuration example of the RETR response message table 3.
The RETR response message table 3 includes items in which, for example, a client IP address 31 indicating a client 20 address, a message number 32, and a response message 33 are recorded. In the response message 33, an attached file electronic mail with a password (RETR response message corresponding to the RETR message number) transmitted from the mail server 30 is recorded.

FIG. 4 is a sequence diagram showing a sequence between the relay device 10 for detecting and acquiring the password-attached file electronic mail, the client 20 and the mail server 30 according to an embodiment of the present invention.
The operation based on the sequence of FIG. 4 is as follows.

  First, the processing when an attached file electronic mail with password is received will be described.

  Step S401: Upon receiving a mail message acquisition request, for example, a RETR message number, from the client 20, the relay device 10 extracts the client IP address and message number of the client 20. Then, the RETR message number is transmitted to the mail server 30.

  Step S402: When the relay apparatus 10 receives the RETR response message (attached file e-mail with password) for the RETR message number (mail message acquisition request) from the mail server 30, the relay apparatus 10 executes the following processing.

First, it is determined whether or not the RETR response message includes an attached file with a password. If the attached file with password is included, the client IP address, message number, and RETR response message extracted in step S401 are stored in the RETR response message table of the storage unit.
Next, the attached file with password is deleted from the RETR response message, and for example, a message “attached file is sent after virus check” is added to the body of the RETR response message. To the client 20.

  Step S403: When the relay device 10 receives a mail message deletion request from the client 20, for example, a DELE message number, the relay device 10 extracts the client IP address and the DELE message number.

Step S404: The relay device 10 determines whether or not the RETR response message at the client IP address extracted in Step S403 is stored in the RETR response message table of the storage unit.
When the RETR response message is stored in the RETR response message table, a DELE response message is created and the DELE response message is transmitted to the client 20.

  Step S405: When receiving the mail logout (QUIT) corresponding to the DELE response message from the client 20, the relay apparatus 10 extracts the client IP address. Then, a mail logout (QUIT) is transmitted to the mail server 30.

Step S406: The relay apparatus 10 receives a QUIT response message for mail logout (QUIT) from the mail server 30, and transmits the QUIT response message to the client 20.
At this time, it is determined whether or not the RETR response message at the client IP address extracted in step S405 is stored in the RETR response message table.
If the RETR response message is stored in the RETR response message table, the RETR response message (including the client IP address and message number) is deleted, and the process proceeds to step S501 in FIG.

  Next, processing when a password-added e-mail is received will be described.

  FIG. 5 is a sequence diagram showing a sequence between the relay device that detects and acquires the password-added electronic mail, the client, and the mail server. The operation based on the sequence of FIG. 5 is as follows.

  Step S501: When the mail server 30 receives a mail message acquisition request from the client 20 in a state where the mail server 30 receives the password-added electronic mail, the relay apparatus 10 extracts the client IP address and the message number from the mail message acquisition request. Then, the mail message acquisition request is transmitted to the mail server 30.

  Step S502: When receiving the RETR response message for the mail message acquisition request from the mail server 30, the relay device 10 executes the following processing.

First, it is determined whether or not the RETR response message includes an attached file with a password.
If the attached file with password is included, the client IP address and message number extracted in step S501 and the RETR response message are stored in the RETR response message table of the storage unit,
Delete the attached file with password from the RETR response message of the mail server 30,
The fact that “attached file is sent after virus check is sent” is added to the body of the RETR response message, and the RETR response message is transmitted to the client 20.

  Step S503: Upon receiving the mail message acquisition request corresponding to the RETR response message from the client 20, the relay device 10 extracts the client IP address and the message number. Then, the received mail message acquisition request is transmitted to the mail server 30.

  Step S504: When receiving the RETR response message for the mail message acquisition request from the mail server 30, the relay device 10 executes the following processing.

First, it is determined whether or not the RETR response message includes an attached file with a password.
If the attached file with password is not included, it is determined whether or not the subject of the RETR response message includes the subject of the RETR response message stored in the RETR response message table.
If the subject is included, the password is extracted from the RETR response message, and the password attached to the attached file in the RETR response message in the RETR response message table is unlocked, decompressed, and opened using the extracted password.

Determine whether the opened attachment with password contains malware.
When malware is included, the attached file in the RETR response message table, that is, the attached file with password is deleted, and for example, “the attached file with password contains malware is included in the body of the RETR response message received from the mail server. Therefore, it is deleted ”and the RETR response message is transmitted to the client 20.
Then, the RETR response message stored in the RETR response message table is deleted.

  FIG. 6 is a flowchart for explaining the processing procedure of the relay apparatus 10 in FIG. 5 in more detail. The operation based on the flowchart of FIG. 6 is as follows.

Step S601: The relay device 10 receives a mail message acquisition request (a RETR message including a RETR message number) from the client 20.
If a mail message acquisition request (RETR message: including RETR message number) is received from the client 20 (Yes), the process proceeds to step S602, and if not received (No), the process proceeds to step S610.

  Step S602: The relay device 10 extracts a client IP address and a message number.

  Step S603: The relay device 10 transmits a RETR message to the mail server 30.

  Step S604: The relay device 10 receives the RETR response message from the mail server 30.

Step S605: The relay device 10 determines whether or not an attached file with a password is included in the RETR response message.
If an attached file with a password is included (Yes), the process proceeds to step S606, and the processes of steps S606 to S609 are executed.

  Step S606: The relay device 10 stores the client IP address, message number, and RETR response message extracted in step S602 in the RETR response message table.

  Step S607: The relay device 10 deletes the password-attached file from the RETR response message.

  Step S608: The relay apparatus 10 adds a message “Attached file with password is sent after virus check” to the body of the RETR response message.

  Step S609: A RETR response message is transmitted to the client 20, and the process returns to step S601.

Step S610: The relay apparatus 10 determines whether or not a mail message deletion request (DELE message number) has been received from the client 20.
If a mail message deletion request (DELE message number) is received (Yes), the process proceeds to step S611. If not received (No), the process proceeds to step S620.

  Step S611: The relay device 10 executes a DELE reception process and returns to Step S601. This DELE reception process will be described later.

  Step S620: The relay apparatus 10 determines whether or not a mail logout (QUIT) has been received from the client 20. If a mail logout (QUIT) is received (Yes), the process proceeds to step S621, where a QUIT reception process is executed in step S621, and then the process returns to step S601. This process will be described later.

  In step S605, if the attached file with password is not included (No), the process proceeds to step S630.

  Step S630: The relay apparatus 10 determines whether there is a record of the RETR response message at the client IP address extracted in Step S602 in the RETR response message table. If there is a record of the RETR response message (Yes), the processing with the record of the RETR response message is performed in step S631, and the process returns to step S601. This process will be described later.

  In step S630, if there is no record of the RETR response message at the client IP address extracted in step S602 (No), the process proceeds to step S641.

  Step S641: The relay apparatus 10 transmits to the RETR response message client, and returns to Step S601.

  FIG. 7 is a flowchart showing the DELE reception process. The operation based on the flowchart of FIG. 7 is as follows.

  Step S701: The relay device 10 extracts a client IP address and a message number.

  Step S702: The relay device 10 determines whether there is a record of the RETR response message in the client IP address in the RETR response message. If there is a record of the RETR response message (Yes), the process proceeds to step S703, and if not (No), the process proceeds to step S705.

  Step S703: The relay device 10 determines whether or not the message number extracted in Step S701 matches the message number in the RETR response message table. If they match (Yes), the process proceeds to step S704. If they do not match (No), the process proceeds to step S705.

  Step S704: The relay apparatus 10 creates a DELE response message, transmits it to the client 20, and ends the process.

  Step S705: The relay device 10 transmits a DELE message to the mail server 30.

  Step S706: The relay device 10 receives the DELE response message from the mail server 30.

  Step S707: The relay device 10 transmits a DELE response message to the client 20, and ends the process.

  FIG. 8 is a flowchart showing the QUIT reception process. The operation based on the flowchart of FIG. 8 is as follows.

  Step S801: The relay device 10 extracts a client IP address.

  Step S802: The relay device 10 transmits a QUIT message to the mail server 30.

  Step S803: The relay device 10 receives a QUIT response message from the mail server 30.

  Step S804: The relay device 10 transmits a QUIT response message to the client 20.

  Step S805: The relay device 10 determines whether there is a record of the RETR response message at the client IP address extracted in Step S801 in the RETR response message table. If there is (Yes), the process proceeds to step S806, and if not (N0), the process ends.

Step S806: The relay device 10 deletes the record (client IP address, message number, RETR response message) from the RETR response message table, and ends the process.
It should be noted that a predetermined time has elapsed since the relay device 10 added a record to the RETR response message table, or the number of RTER response messages received from the mail server 30 exceeds a predetermined number. The record may be deleted.

  FIG. 9 is a flowchart showing processing with a RETR response message record. The operation based on the flowchart of FIG. 9 is as follows.

  Step S901: The relay device 10 extracts the subject of the RETR response message and refers to the RETR response message table.

  Step S902: The relay device 10 determines whether there is a record in the RETR response message table that matches the subject of the RETR response message extracted in Step S901. If there is a matching record (Yes), the process proceeds to step S903. If there is no record (No), the process proceeds to step S912.

  Step S903: The relay device 10 extracts a password from the RETR response message received from the mail server 30.

  Step S904: The relay device 10 extracts the attached file with password from the RETR response message stored in the record of the matched RETR response message table from Step S902, and uses the password extracted in Step S903 to attach the attached file with password. Cancel the password.

  Step S905: If the password can be canceled in Step S904 (Yes), the relay device 10 proceeds to Step S906, and if it cannot be canceled (No), the relay device 10 proceeds to Step S912.

  Step S906: The relay device 10 decompresses and opens the attached file with password.

  Step S907: The relay device 10 checks whether malware is included in the opened attached file with password.

  Step S908: When the malware is included in Step S907 (Yes), the relay device 10 proceeds to Step S910, and when not included (No), the relay device 10 proceeds to Step S909.

  Step S <b> 910: The relay device 10 adds a message stating that “the attached file contains malware and has been deleted” to the body of the RETR response message received from the mail server 30.

  Step S909: The relay device 10 attaches the opened attached file with password to the RETR response message received from the mail server 30.

  Step S911: The relay device 10 deletes the record (client IP address, message number, and RETR response message) that matched in step S902 from the RETR response message table.

  Step S912: The relay device 10 transmits the RETR response message received from the mail server 30 to the client 20, and ends the process.

  According to the above embodiment, when the client 20 acquires (reads) an email from the mail server 30, the relay device 10 is an email including a password-protected compressed file. The password-protected compressed file is temporarily stored, and if the acquired email is an email including a password related to the email including the password-protected compressed file, the password protection is performed. When the password protection of the attached file attached to the e-mail including the compressed file is released, the virus check is performed, and the virus is not included, the client 20 receives the e-mail including the password in the password-protected compressed file. Attachments attached to emails containing By attaching the file and transferring it, the user does not need to input the password for the password-protected compressed file each time, and the password-protected compressed file is automatically checked for viruses. It is possible to keep the security high.

  Note that the present invention is not limited to the above-described embodiments, and various changes and modifications can be made by those skilled in the art within the scope of the technical idea disclosed in the present invention, and various modifications are included. It is. The above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

10 relay device 11 input / output interface device 12 storage device 121 RETR response message table 13 computing device (control device)
131 Email Detection Unit 1311 Attachment File with Password Email Detection Unit 1312 Email Detection Unit with Password 13 132 Attachment File Virus Presence Determination Unit 1321 Attachment File Extraction Unit 1322 Attachment File Opening Unit 1323 Attachment File Virus Check Unit 133 Email Transfer Unit 1331 Attached file deletion unit 1332 Message attachment unit 1333 Attached file no-email transfer unit 1334 E-mail transfer unit with unattached attachment file 134 E-mail deletion request unit 135 E-mail deletion request detection / deletion response creation / deletion response transmission unit with attached file

Claims (2)

A relay device having a virus check function for an attached file attached to an e-mail transferred from a mail server to a client,
A password-attached file e-mail detecting means for detecting a password-attached file e-mail including a password-protected attachment in an e-mail transferred from the mail server to a predetermined client;
When the password-attached file e-mail detecting means detects the password-attached file e-mail, the e-mail obtained by removing the password-protected e-mail from the password-attached e-mail is attached to the client. No e-mail transfer means;
An e-mail in which a password is added to an e-mail transferred from the mail server to the client after the non-attached e-mail transfer means transfers an e-mail excluding the password-protected attached file to the client. A password-added e-mail detecting means for detecting
When the password-added e-mail detection unit detects an e-mail with the password, the password-protected attachment detected by the password-attached file e-mail detection unit is opened using the password. And checking for a virus in the opened attachment file, and determining whether or not a virus is included in the opened attachment file;
When the unsealed file virus presence / absence judging means judges that the opened attachment file does not contain a virus, the password-attached e-mail detection means opens the attached file to the e-mail with the password attached An e-mail transmission means with an unsealed attachment file that attaches and transfers to the client;
A relay apparatus comprising: E-mail in a relay device comprising an e-mail detection means, an e-mail transfer means, and an attached file virus presence / absence judgment means, and having a function of performing a virus check on a file attached to an e-mail between a client and a mail server In the relay method,
When the relay device receives an e-mail message acquisition request from the client,
Detecting and acquiring a password-attached file email to which a password-protected file is attached from the mail server;
Detecting and acquiring a password-added e-mail with a password attached to open the password-protected file from the mail server;
When the e-mail detection means detects and acquires the attached file e-mail with password,
A non-attached email e-mail transfer step for transferring an e-mail with a password attached to the client in a state where the attached file with password in the attached e-mail with password is deleted;
When the attachment virus presence / absence determining means determines that the opened attachment with password does not contain a virus,
An e-mail transfer step with an unsealed attachment file that attaches the opened attachment file with a password to an e-mail with a password to which a password for unsealing the password-protected file is attached and transfers the attached file to the client;
When the email detection means detects and acquires the password-added email,
Using the password attached to the password-added email, opening the attached file with the password attached; and
An attachment virus check step for performing a virus check on the opened attached file with a password;
A determination step of determining that a virus is not included in the opened attached file with password,
An e-mail relay method characterized by the above.

Images