JP3866051B2 - E-mail relay system and e-mail relay method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic mail relay system and an electronic mail relay method for avoiding abnormal operation of a computer due to electronic mail and abnormal operation of an electronic mail system due to electronic mail.
[0002]
[Prior art]
Electronic mail is relayed through several mail servers. Electronic mail via a network to which a large number of users are connected, such as the Internet, can be exchanged between an unspecified number of users and is used conveniently. On the other hand, there is a possibility that an e-mail transmitted from a malicious user is received.
[0003]
One type of e-mail sent from a malicious user is an e-mail that contains a computer virus. Computer viruses lurking in e-mails can be broadly divided into those that destroy the resources on the terminal or connected network used for reception, and those with malicious intent regardless of the recipient's consciousness by performing reception operations. There are those that newly send mail, and those that attempt to leak security information on the terminal used for reception or the connected network.
[0004]
Conventionally, as a system or method for preventing damage caused by e-mail with a computer virus hidden in a mail server or a receiving terminal, computer virus countermeasure software is used in a database and an electronic computer having a known computer virus pattern. If the email matches, the email is recognized as having a computer virus hidden in it, and the user is warned not to open the email, the computer virus is automatically removed, There are known devices that deal with measures such as deleting emails.
[0005]
[Problems to be solved by the invention]
However, in the above-described system or method, computer virus pattern databases are often created by experts and are effective only for known computer viruses. Cannot be prevented, and damage cannot be prevented until a database of unknown computer virus patterns is created by experts.
[0006]
Therefore, the present invention has been made in view of the above, and an e-mail in which a computer virus is lurked from a malicious user without using a computer virus pattern database or the like created by an expert. It is an object of the present invention to provide a means for detecting.
[0007]
[Means for Solving the Problems]
An e-mail relay system and an e-mail relay method according to the present invention relay an e-mail to an e-mail receiving terminal, and open or execute the received e-mail, and the e-mail execution means And e-mail relay means for relaying the e-mail to an e-mail receiving terminal only when a predetermined abnormal action does not occur in the e-mail execution means. It is to be prepared.
[0008]
According to the e-mail relay system and the e-mail relay method of the present invention, the e-mail relay unit monitors whether or not a predetermined abnormal operation occurs in the e-mail execution unit by opening or executing the received e-mail. However, since the e-mail is relayed only when a predetermined abnormal operation does not occur in the e-mail execution means, even if the computer virus pattern database has not been created, the received e-mail may be a computer virus. It is possible to determine in advance whether or not the electronic mail contains a message, and damage due to the electronic mail can be prevented.
[0009]
In the e-mail relay system and e-mail relay method according to the above-described invention, a plurality of e-mail execution means are provided, operate based on different environment settings for opening or executing the received e-mail, and e-mail relay means It is preferable to relay the e-mail to the e-mail receiving terminal only when a predetermined abnormal operation does not occur in all of the plurality of e-mail execution means.
[0010]
In this case, the received e-mail is opened or executed by a plurality of e-mail execution units operating based on different environment settings, and the e-mail relay unit generates a predetermined abnormal operation in all of the plurality of e-mail execution units. Since this e-mail is relayed only when the e-mail is not received, damage caused by e-mail including a computer virus that causes an abnormal operation in the e-mail receiving terminal only in a specific environment setting can be prevented.
[0011]
In the electronic mail relay system and the electronic mail relay method according to the above-described invention, when the electronic mail relay means does not relay the electronic mail to the electronic mail receiving terminal, it is preferable to transmit a warning mail indicating that fact.
[0012]
In this case, the original recipient or administrator who is the destination of the e-mail has received the e-mail containing the above-described computer virus by the e-mail relay system by the warning mail transmitted by the e-mail relay unit. You can recognize what was not done.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
(E-mail relay system configuration)
An embodiment of the present invention will be described with reference to FIG. FIG. 1 is a schematic configuration diagram showing an electronic mail network system including an electronic mail relay system 1 according to the present embodiment.
[0014]
As shown in the figure, the electronic mail relay system 1 according to the present embodiment is connected to another mail server 2 connected to the Internet 3 and a user mail system 5 via a router 4 and is specialized. This is a means for detecting an electronic mail transmitted from a malicious user and containing a computer virus without using a computer virus pattern database created by a house.
[0015]
The electronic mail relay system 1 includes a test incoming mail server 101, a test outgoing mail server 102, and a mail test terminal group 103 including a plurality of mail test terminals 1031 to 103n.
[0016]
The test incoming mail server 101 is connected to the router 4, the test outgoing mail server 102, and the mail test terminal group 103. The test incoming mail server 101 receives e-mails sent from other mail servers 2 via the router 4, In response to an abnormal email detection signal that indicates whether or not a predetermined abnormal operation has occurred in the mail test terminal group 103 or the test outgoing mail server 102, the email is sent to the user mail system 5 via the router 4. It is an electronic mail relay means for relaying or discarding. Specifically, as shown in FIG. 2, the test incoming mail server 101 includes an email receiving unit 101a, an email storage unit 101b, a reception notification signal sending unit 101c, an email sending unit 101d, An email detection signal receiving unit 101e and an email transfer unit 101f are included.
[0017]
The e-mail receiving unit 101a is connected to the reception notification signal transmitting unit 101b and the e-mail storage unit 101c, and receives an e-mail transmitted from another mail server 2. The e-mail receiving unit 101a receives e-mails transmitted from another mail server 2 in accordance with SMTP (Simple Mail Transport Protocol), for example.
[0018]
The e-mail storage unit 101b is connected to the e-mail reception unit 101a, the e-mail transmission unit 101d, and the e-mail transfer unit 101f, and temporarily receives the e-mail received by the e-mail reception unit 101a together with the attached file. Will accumulate. The e-mail storage unit 101b includes an auxiliary storage device such as an HDD.
[0019]
The reception notification signal transmitting unit 101c is connected to the e-mail receiving unit 101a, and a reception notification signal for notifying that the e-mail received by the e-mail receiving unit 101a is temporarily stored in the e-mail storage unit 101b. Is generated and transmitted to the mail test terminal group 103. When there are a plurality of mail test terminals, the reception notification signal transmission unit 101c transmits a reception notification signal to all the mail test terminals.
[0020]
The e-mail transmission unit 101d is connected to the e-mail storage unit 101b, and in response to e-mail transmission requests from the mail test terminals 1031 to 103n, the e-mail stored in the e-mail storage unit 101b This is transmitted to the test terminal groups 1031 to 103n. The e-mail transmission unit 101d transmits e-mail according to POP3 (Post Office Protocol version 3) or IMAP4 (Internet Messaging Access Protocol version 4), for example.
[0021]
The abnormal e-mail detection signal receiving unit 101e is connected to the e-mail transfer unit 101f, receives the abnormal e-mail detection signal transmitted from the test transmission mail server 102 or the mail test terminals 1031 to 103n, and receives the received abnormality. In response to the e-mail detection signal, it is determined whether or not this e-mail is to be relayed to the user mail system 5, and the determination result is notified to the e-mail transfer unit 101f. Specifically, the abnormal email detection signal receiving unit 101e has an abnormality detection flag that is set to “1” when it detects that an abnormal operation has occurred due to the corresponding email in the received abnormal email detection signal. When “0” is set, it is determined that the corresponding e-mail should be relayed to the user mail system 5 via the e-mail transfer unit 101f, and the abnormality detection flag is set to “1”. In this case, it is determined that the corresponding electronic mail should be discarded.
[0022]
When the abnormal email detection signal receiving unit 101e transmits the reception notification signal to a plurality of mail test terminals, the abnormal email detection signal receiving unit 101e receives the same number of abnormal email detection signals as the number of the received reception notification signals and then performs the above-described determination. . In this case, the abnormal e-mail detection signal receiving unit 101e sends the corresponding e-mail to the user via the e-mail transfer unit 101f when the abnormality detection flags of all abnormal e-mail detection signals are set to “0”. It is determined that it should be relayed to the mail system 5, and in other cases, it is determined that the corresponding electronic mail should be discarded.
[0023]
The e-mail transfer unit 101f is connected to the e-mail storage unit 101b and the abnormal e-mail detection signal receiving unit 101e, and the corresponding e-mail is determined according to the determination result notified by the abnormal e-mail detection signal receiving unit 101e. Is relayed to the user mail system 5 or discarded. That is, the e-mail transfer unit 101f relays the corresponding e-mail to the user mail system 5 when the abnormality detection flags of all abnormal e-mail detection signals are set to “0”, and otherwise. Is to discard the corresponding e-mail. The e-mail transfer unit 101f transmits e-mail to the user mail system 5 according to SMTP, for example.
[0024]
When the e-mail transfer unit 101f discards the e-mail as described above, the e-mail transfer unit 101f can transmit a warning e-mail to that effect to a preset e-mail administrator. In addition, the e-mail transfer unit 101f extracts destination information (for example, e-mail address) from the e-mail received by the e-mail receiving unit 101a, and notifies the user of the user terminal 5021 related to the destination information to the warning mail described above. Can also be sent.
[0025]
The mail test terminals 1031 to 103n are connected to the router 4, the test reception mail server 101, and the test transmission mail server 102, and are used for the test in accordance with the reception notification signal transmitted from the test reception mail server 101. It is an e-mail execution unit that receives e-mail stored in the received mail server 101, opens the received e-mail, and executes the attached file. Further, the mail test terminals 1031 to 103n create an abnormal e-mail detection signal according to the monitoring result described above and transmit it to the test incoming mail server 101. If there are multiple mail test terminals 1021 to 103n, each mail test terminal 1021 to 103n can operate based on different environment settings for opening or executing an e-mail, for example, different operating systems, It is configured to work with a mail client program (mailer). Here, the predetermined abnormal operation includes an operation system rewrite operation, a file rewrite operation of a file rewrite operation unrelated to e-mail transmission / reception, memory waste, and the like.
[0026]
Specifically, as shown in FIG. 3, the mail test terminal 1031 includes an email receiving unit 1031a, an email opening unit 1031b, an attached file executing unit 1031c, a monitoring unit 1031d, an email sending unit 1031e, and an abnormal email detection. A signal transmission unit 1031f and a reception notification signal reception unit 1031g are included.
[0027]
The reception notification signal receiving unit 1031g is connected to the electronic mail receiving unit 1031a and receives the reception notification signal transmitted from the test reception mail server.
[0028]
The e-mail receiving unit 1031a is connected to the e-mail opening unit 1031b, the attached file executing unit 1031c, and the reception notification signal receiving unit 1031g, and in response to receiving the reception notification signal, the electronic mail receiving unit 1031a receives the electronic mail from the test reception mail server 101. Receive mail. The e-mail receiving unit 1031a receives e-mail according to POP3 or IMAP4, for example.
[0029]
The e-mail opening unit 1031b is connected to the e-mail receiving unit 1031a and the monitoring unit 1031d, and opens the e-mail received by the e-mail receiving unit 1031a. The e-mail receiving unit 1031a and the e-mail opening unit 1031b are configured using a mail client program. The attached file execution unit 1301c is connected to the e-mail receiving unit 1031a and the monitoring unit 1031d, and when there is an attached file in the e-mail received by the e-mail receiving unit 1031a, The attached file is automatically executed.
[0030]
The monitoring unit 1031d is connected to the e-mail unsealing unit 1031b, the attached file executing unit 1031c, the e-mail transmitting unit 1031e, and the abnormal e-mail detection signal transmitting unit 1031f, and receives and opens e-mails and executes attached files. When a predetermined abnormal operation occurs in the mail test terminal 1031, an abnormal email detection signal with the abnormality detection flag set to “1” is transmitted to the abnormal email detection signal transmission unit 1031 f. The monitoring unit 1031d stores the initial state of the mail test terminal 1031 and transmits an abnormal email detection signal to the test incoming mail server 101 via the abnormal email detection signal transmission unit 1031f, and then the mail test terminal 1031. Is restored to the initial state before abnormal operation.
[0031]
In addition, when an event of creating / sending a new e-mail occurs due to reception / opening of the e-mail and execution of the attached file, the monitoring unit 1031d creates the new e-mail and transmits it to the e-mail transmission unit 1031e. Is. When the monitoring unit 1031d does not detect a predetermined abnormal operation and an event for creating / transmitting a new e-mail, the monitoring unit 1031d creates an abnormal e-mail detection signal with an abnormality detection flag set to “0” to detect an abnormal e-mail. It transmits to the signal transmission part 1031f.
[0032]
The e-mail transmission unit 1031e is connected to the monitoring unit 1031d, and transmits the above-described new e-mail created by the monitoring unit 1031d to the test transmission mail server 102. The e-mail receiving unit 102a transmits e-mail according to, for example, SMTP. The abnormal e-mail detection signal transmission unit 1031f is connected to the monitoring unit 1031d, and transmits the above-described abnormal e-mail detection signal generated by the monitoring unit 1031d to the test incoming mail server 101.
[0033]
The test outgoing mail server 102 is connected to the test incoming mail server 101 and the mail test terminal group 103, receives the above-mentioned new e-mail transmitted from the mail test terminal group 103, and sends the new e-mail to the new e-mail. In response, an abnormal e-mail detection signal is transmitted to the test incoming mail server 101. Specifically, as shown in FIG. 4, the test outgoing mail server 102 includes an electronic mail receiving unit 102a, a monitoring unit 102b, and an abnormal electronic mail detection signal transmitting unit 102c.
[0034]
The e-mail receiving unit 102 a is connected to the monitoring unit 102 b and receives the above-described new e-mail transmitted from the mail test terminal group 103. The e-mail receiving unit 102a receives e-mail according to, for example, SMTP.
[0035]
The monitoring unit 102b is connected to the e-mail receiving unit 102a and the abnormal e-mail detection signal transmitting unit 102c, and whether or not the above-described new e-mail received by the e-mail receiving unit 102a has been created for a valid reason. When an abnormal operation such as sending a large amount of new e-mail is confirmed, an abnormal e-mail with an abnormality detection flag set to “1” is transmitted to the test incoming mail server 101. The detection signal is transmitted to the abnormal email detection signal transmission unit 102c. If no abnormal operation is confirmed, an abnormal email detection signal with the abnormality detection flag set to “1” is transmitted to the abnormal email detection signal transmitter 102c.
[0036]
The abnormal e-mail detection signal transmission unit 102c is connected to the monitoring unit 102b and transmits the abnormal e-mail detection signal transmitted by the monitoring unit 102b to the test reception mail server 101.
[0037]
The other mail server 2 connected to the Internet 3 is for relaying the electronic mail transmitted by the user to the user mail server 501 via the router 4 and the electronic mail relay system 1. Communication between the mail server 2 and the user mail server 501 is performed according to, for example, SMTP.
[0038]
The user mail system 5 includes a user mail server 501 and a user terminal group 502 including a plurality of user terminals 5021 to 501m. The user mail server 501 receives the electronic mail transmitted by the test incoming mail server 101 and transmits it to each user terminal 5021 to 5021m. Here, the received e-mail is not an e-mail that is transmitted from a malicious user and has a computer virus lurking because it is transmitted through the e-mail relay system 1 described above. Communication between the user mail server 501 and the user terminal group 502 is performed according to, for example, POP3 or IMAP4.
[0039]
(E-mail relay method using e-mail relay system)
The e-mail relay method using the e-mail relay system having the above configuration can be implemented by the following procedure. 5 and 6 are diagrams showing an electronic mail relay method using the electronic mail relay system according to the present embodiment.
[0040]
As shown in FIGS. 5 and 6, in step S <b> 1, the mail server 2 transmits the electronic mail transmitted by the user to the test reception mail server 101 via the Internet 3 and the router 4. Then, the e-mail receiving unit 101a of the test incoming mail server 101 receives the e-mail. In step S2, the e-mail received by the e-mail receiving unit 101a is stored in the e-mail storage unit 101b of the test incoming mail server 101.
[0041]
In step S <b> 3, the reception notification signal transmission unit 101 c of the test reception mail server 101 transmits a reception notification signal notifying that the electronic mail is temporarily stored to the mail test terminal 1031. Then, the reception notification signal receiving unit 1031g of the mail test terminal 1031 receives this reception notification signal. When there are a plurality of mail test terminals, the reception notification signal transmission unit 101c of the test reception mail server 101 transmits a reception notification signal to all the mail test terminals. Thereafter, the test incoming mail server 101 waits for an abnormal email detection signal transmitted from the mail test terminal group 103 or the test outgoing mail server 102. When there are a plurality of mail test terminals, this waiting state continues until the test incoming mail server 101 receives the abnormal email detection signals from all the mail test terminals 1031 to 103n.
[0042]
In step S4, the e-mail receiving unit 1031a of the mail test terminal 1031 is stored in the e-mail storage unit 101b of the test incoming mail server 101 in accordance with the reception notification signal received by the reception notification signal receiving unit 1031g. The corresponding electronic mail is received via the electronic mail transmitting unit 101d of the test incoming mail server 101.
[0043]
In step S5, the e-mail opening unit 1031b of the e-mail test terminal 1031 opens the e-mail received by the e-mail receiving unit 1031a.
[0044]
In branch 1, the attached file execution unit 1031c of the mail test terminal 1031 determines whether or not there is an attached file in the received e-mail. If there is an attached file, the attached file is executed and attached in step S6. If there is no file, proceed to the next step without executing the attached file.
[0045]
In branch 2, when the monitoring unit 1031 d of the mail test terminal 1031 monitors the occurrence of a predetermined abnormal operation in the mail test terminal 1031 and detects a predetermined abnormal operation, in step S 7, before the abnormal operation of the mail test terminal 1031. In step S8, the abnormal e-mail detection signal is generated, and the process proceeds to step S15. On the other hand, if no abnormal operation is detected, the process proceeds to the next step.
[0046]
In branch 3, the monitoring unit 1031 d of the mail test terminal 1031 checks the occurrence of an event that the mail test terminal 1031 creates and sends a new email, and if this event is detected, the new email is sent in step S 10. The e-mail transmission unit 1031e transmits the e-mail to the test transmission mail server 102, and the e-mail reception unit 102a of the test transmission mail server 102 receives the e-mail. In step S10, the monitoring unit 102b of the test outgoing mail server 102 checks whether or not the electronic mail is created for a valid reason, and in step S11, a predetermined amount of new electronic mail is transmitted. When an abnormal operation is confirmed, an abnormal e-mail detection signal having an abnormality detection flag set to “1” is created. When this predetermined abnormal operation is not confirmed, the abnormality detection flag is “0”. The abnormal e-mail detection signal set to “1” is created, and this abnormal e-mail detection signal is transmitted via the abnormal e-mail detection signal transmission unit 102c.
[0047]
In branch 3, if the monitoring unit 1031d of the mail test terminal 1031 does not detect an event that the mail test terminal 1031 creates or sends a new email, the abnormality detection flag is set to “0” in step S12. An abnormal email detection signal is created, and in step S13, this abnormal email detection signal is transmitted via the abnormal email detection signal transmission unit 1031f. Then, the abnormal email detection signal receiving unit 101e of the test incoming mail server 101 receives this abnormal email detection signal.
[0048]
In step S14, after confirming that the abnormal email detection signal receiving unit 101e of the test incoming mail server 101 has received this abnormal email detection signal from all the mail test terminals 1031 to 103n, It is checked whether or not the abnormality detection flag of the mail detection signal is “0”. If the abnormality detection flags of all abnormal electronic mail detection signals are “0”, the electronic mail transfer unit 101f relays the corresponding electronic mail to the user mail server 501 of the user mail system 5 in step S15. On the other hand, if the abnormality detection flags of all abnormal email detection signals are not “0”, the abnormal email detection signal receiving unit 101e discards the corresponding email.
[0049]
In step S <b> 16, the user terminal group 502 receives an email stored in the user mail server 501.
[0050]
(Operation and effect of the e-mail relay system and e-mail relay method)
According to the e-mail relay system and the e-mail relay method according to the present embodiment, the mail test terminal 1031 opens or executes the received e-mail, and the test reception mail server 101 performs predetermined processing in the mail test terminal group 1031. Monitors whether abnormal operation occurs and relays this e-mail only when the specified abnormal operation does not occur. Therefore, even if the database of computer virus patterns has not been created, the received electronic Whether or not the mail is an electronic mail containing a computer virus can be determined in advance, and damage caused by the electronic mail can be prevented.
[0051]
In addition, the received email is opened or executed by the plurality of mail test terminal groups 103 operating based on different environment settings, and the test reception mail server 101 has a predetermined value in all of the plurality of mail test terminals 1031 to 103n. Since this e-mail is relayed only when no abnormal operation occurs, it is possible to prevent damage caused by an e-mail including a computer virus that causes the e-mail receiving terminal to operate abnormally only in a specific environment setting.
[0052]
Further, the warning mail transmitted by the test incoming mail server 101 allows the original recipient or administrator who is the destination of the e-mail to receive the e-mail containing the above-mentioned computer virus by the e-mail relay system. It can be recognized that it was not relayed.
[0053]
【The invention's effect】
As described above, according to the present invention, a computer virus pattern database or the like created by an expert can be used to detect an email sent from a malicious user and containing a computer virus. Means can be provided.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram showing an electronic mail network system including an electronic mail relay system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a schematic function of a test incoming mail server according to an embodiment of the present invention.
FIG. 3 is a block diagram showing a schematic function of a mail test terminal according to an embodiment of the present invention.
FIG. 4 is a block diagram showing a schematic function of a test outgoing mail server according to an embodiment of the present invention.
FIG. 5 is a diagram showing an operation of an e-mail relay system according to an embodiment of the present invention.
FIG. 6 is a diagram showing an operation of the electronic mail relay system according to the embodiment of the present invention.
[Explanation of symbols]
1. E-mail relay system
2 ... Other mail servers
3 ... Internet
4 ... Router
5. User mail system
101 ... Test incoming mail server
101a, 102a, 1031a ... E-mail receiver
101b ... E-mail storage unit
101c ... Reception notification signal transmitter
101d: E-mail transmission unit
101e... Abnormal e-mail detection signal receiving unit
101f ... Email transfer unit
102 ... Test transmission mail server
103 ... Mail test terminal group
1031 to 103n ... Mail test terminal
1031b ... E-mail opening part
1031c ... Attached file execution unit
102b, 1031d ... monitoring unit
102c, 1031f ... abnormal email detection signal transmission unit
1031g ... Reception notification signal receiver
501: User mail server
502 ... User terminal group
5021 to 502m ... User terminal

Claims (5)

An email relay system that relays email to an email receiving terminal,
An email execution means for opening or executing the received email;
An electronic device that monitors whether or not a predetermined abnormal operation occurs in the e-mail execution unit, and relays the e-mail to an e-mail receiving terminal only when a predetermined abnormal operation does not occur in the e-mail execution unit Email relay means ,
The e-mail execution means is provided in plural, operates based on different environment settings for opening or executing the received e-mail,
The e-mail relay system relays the e-mail to an e-mail receiving terminal only when a predetermined abnormal operation does not occur in all of the plurality of e-mail execution means.   The e-mail relay system according to claim 1, wherein the e-mail relay unit transmits a warning mail indicating that the e-mail is not relayed to the e-mail receiving terminal.   The e-mail relay system according to claim 2, wherein the e-mail relay unit extracts destination information of the received e-mail and transmits the warning mail to an e-mail receiving terminal related to the extracted destination information. . An e-mail relay method for relaying an e-mail to an e-mail receiving terminal,
A first step of opening or executing the received email by the email execution means;
A second step of monitoring whether or not a predetermined abnormal operation occurs in the e-mail execution means;
A third step of relaying the e-mail to the e-mail receiving terminal only when a predetermined abnormal operation has not occurred in the e-mail execution means by the e-mail relay means;
In the first step, a plurality of e-mail execution means are provided and operate based on different environment settings for opening or executing the received e-mail,
An e-mail relay method characterized in that, in the third step, an e-mail is relayed to an e-mail receiving terminal only when a predetermined abnormal operation has not occurred in all of the plurality of e-mail execution means.   5. The e-mail relay method according to claim 4, further comprising a fourth step of transmitting a warning mail indicating that the e-mail is not relayed to the e-mail receiving terminal in the third step.

Images