JP4013835B2 - E-mail relay device and e-mail relay method used therefor - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an electronic mail relay device and an electronic mail relay method used therefor, and more particularly to a mail relay device for relaying electronic mail.
[0002]
[Prior art]
With the spread of the Internet, the mail system for sending and receiving e-mails is becoming larger. Large service providers, mail systems via mobile phones, large corporations, etc. have enormous numbers of users, so they receive mail by operating multiple mail servers in parallel.
[0003]
In addition, filtering on spam mail, advertisement mail, etc. (so-called spam mail) and rejecting reception with a program on a mail server used for electronic mail delivery has already been performed mainly for small servers ( For example, see Patent Documents 1 and 2).
[0004]
[Patent Document 1]
JP 2003-0667304 A (pages 8-11, FIG. 1)
[Patent Document 2]
JP-T-2002-537727 (pages 17-19, FIG. 1)
[0005]
[Problems to be solved by the invention]
However, in the conventional mail system, it is said that the proportion of electronic mail that does not desire the recipient, such as spam mail and advertisement mail, is very large among the electronic mail that actually flows on the Internet. For this reason, the conventional mail system has a problem that unnecessary capital investment is required.
[0006]
In addition, processing mail with a large number of recipients as represented by spam mail is a mail processing protocol exchanged between an e-mail client (sending mail server) and a server (receiving mail server). It will take time to process. For this reason, there is a situation in which capital investment is also required for relay network devices such as firewalls.
[0007]
Furthermore, in the conventional mail system, when spam mail filtering is performed, if a character string search of the body of an e-mail is performed in order to determine that the mail is spam mail, it takes time to receive each mail, and the unit Since the number of mails received per hour is limited, there is a problem that the number of mail servers must be increased as a result.
[0008]
Furthermore, in the conventional mail system, desirable e-mails that are not spam mails and e-mails classified as spam mails are processed in the same manner, so that the delay of the desired e-mail is delayed and the load on the entire system is increased. There is also the problem of doing.
[0009]
When such processing is performed by a personal mail server, it is possible to reject the reception of e-mails at the individual's responsibility, so misjudgment does not pose a problem, but it is discarded by misjudgment at a public service provider. It is not allowed to do.
[0010]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems, select a mail server according to the characteristics of the mail, and appropriately allocate server resources, and an electronic mail relay method used therefor Is to provide.
[0011]
[Means for Solving the Problems]
An e-mail relay apparatus according to the present invention is an e-mail relay apparatus that relays e-mails, and means for interpreting the e-mail protocol and filtering data contents, and according to preset conditions, Means for determining priority, and means for selecting a mail server that receives the electronic mail based on the determination result.
[0012]
An e-mail relay method according to the present invention is an e-mail relay method in an e-mail relay apparatus that relays an e-mail, and performs a protocol interpretation of the e-mail and filtering of data contents on the e-mail relay apparatus side; And determining a priority of the e-mail according to a preset condition, and selecting a mail server that receives the e-mail based on the determination result.
[0013]
That is, the electronic mail relay device of the present invention is a function that performs protocol interpretation and data content filtering in a gateway device that relays electronic mail, determines mail priority, and selects a received mail server based on this determination. Is provided.
[0014]
In addition, the electronic mail relay device of the present invention provides a function of limiting the reception band of electronic mail by flow control when low priority electronic mail occupies a certain band.
[0015]
As described above, the present invention does not cover the conventional countermeasures for refusing to receive unwanted mails, but prioritizes delivery mails and is suitable for each priority mail processing. Provide a method for load balancing to servers.
[0016]
In this case, it is possible to provide a means for determining the priority and limit the reception band of the low-priority mail, so that a desired electronic mail can be received with higher priority.
[0017]
In other words, the electronic mail relay device according to the present invention determines the transfer priority according to the information delivered by the mail delivery protocol [SMTP (Simple Mail Transfer Protocol; RFC821)] and the pattern included in the mail text, This is possible by selecting the destination mail server.
[0018]
For example, in the electronic mail relay apparatus according to the present invention, a high-performance server is assigned to high-priority mail, a low-performance server is assigned to low-priority mail processing, or a user's mail storage area is delayed. As described above, it becomes possible to efficiently use servers having performance differences.
[0019]
Further, in the electronic mail relay device according to the present invention, when there is a lot of low-priority traffic and the transfer of high-priority traffic is prevented, bandwidth control by flow control is applied to low-priority traffic. It is possible to prevent the server and network resources from being wasted for unnecessary mail delivery.
[0020]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an electronic mail system according to an embodiment of the present invention. In FIG. 1, an electronic mail system according to an embodiment of the present invention includes a mail domain 1 and a mail client 6 (transmission side relay server).
[0021]
A mail domain 1 shows a system that is an electronic mail delivery destination, and includes a gateway device 2 that is an electronic mail relay device, mail servers 3-1 to 3-4, a user information DB (database) 4, and a terminal 5. It consists of and. The mail client 6 is located outside the mail domain 1 and transmits mail to user terminals belonging to the mail domain 1.
[0022]
The gateway device 2 in the mail domain 1 once receives an e-mail from the mail client 6, performs priority determination processing on the e-mail, and then delivers the e-mail to the mail servers 3-1 to 3-3. To do. A mail server 3-4 is arranged beyond the mail servers 3-1 to 3-3.
[0023]
The mail servers 3-1 to 3-4 perform mail reception processing with reference to the user information DB 4, and the emails stored in the mail servers 3-1 to 3-4 are notified to the terminal 5, or the terminal 5 Read by request from.
[0024]
When a mail client (mail sender) 6 outside the mail domain 1 transmits mail to a user belonging to the mail domain 1, the mail client 6 issues a mail delivery request to the gateway device 2.
[0025]
In the Internet, it is standard to deliver mail based on a rule called SMTP (Simple Mail Transfer Protocol; RFC821).
[0026]
The gateway device 2 determines the mail transfer priority based on the mail information obtained by the SMTP protocol processing from the mail client 6. Based on this priority, the gateway device 2 performs mail relay by selecting mail servers 3-1 to 3-3 to be relayed next. A specific priority determination method will be described later.
[0027]
The mail servers 3-1 to 3-3 determine the delivery method with reference to the user information database 4. For example, the mail servers 3-1 to 3-3 perform delivery processing based on reception refusal and reception permission address information registered for each user. Finally, the user's mail is stored in the mail server 3-4 and read from the terminal 5.
[0028]
Here, the mail server 3-4 is not limited to one, but refers to a mail server group that is directly accessed from the terminal 5. Further, the number of mail servers 3-1 to 3-3 is not limited to three, and a plurality of mail servers may be provided. This indicates a server group directly delivered from the gateway 2.
[0029]
More generally, the configuration according to this embodiment can be described by grouping a plurality of mail servers into N types of priorities. The mail servers representing the group at this time are represented as 3-1 to 3-3.
[0030]
In this embodiment, a method for selecting a server in a group will not be described. As this method, a sequential selection method called round robin or a method for selecting a server with a lower load by periodically checking the server load. Etc.
[0031]
The gateway device 2 measures the data transfer bandwidth of received mail transfer for each priority, performs flow control when the transfer bandwidth of low-priority mail exceeds a certain value, and transmits to the mail client 6 through the connection line 100. Control to lower
[0032]
FIG. 2 is a block diagram showing a configuration of the gateway device 2 of FIG. In FIG. 2, the gateway apparatus 2 is connected to the outside of the apparatus by connection lines 100 to the mail client 6 and connection lines 101 to 103 to the mail servers 3-1 to 3-3.
[0033]
The gateway device 2 includes flow search processing units 21 and 29 to 31, packet conversion processing units 22 and 32 to 34, a bandwidth measurement unit 23, a bandwidth control unit 24, a priority determination unit 25, and a packet switch 26. And a character string search unit 27 and a processor 28.
[0034]
The flow search processing units 21 and 29 to 31 and the packet conversion processing units 22 and 32 to 34 perform reception direction processing for the respective connection lines 100 to 103. The bandwidth measuring unit 23 measures the reception bandwidth for each priority in the reception direction of the connection line 100 with the external mail client 6. The bandwidth control unit 24 controls the bandwidth for the transmission direction processing of the connection line 100.
[0035]
Based on the processing results of the processor 28 and the character string search unit 27, the priority determination unit 25 determines the priority and selects the outgoing mail server / output line using the calculated score. The character string search unit 27 performs a search process to determine whether a preset character string pattern is included in the packet contents. The processor 28 performs mail transfer protocol processing and flow registration processing in the flow search processing units 21 and 29 to 31 and the packet conversion processing units 22 and 32 to 34.
[0036]
Each of the above processing units is connected by a packet switch 26, and performs packet switching between the connection lines 100 to 103, the character string search unit 27, and the processor 28, respectively.
[0037]
The data flow in the gateway device 2 will be described with reference to FIG. The flow search processing unit 21 performs flow search on the data received from the connection line 100. In SMTP used on the Internet, it is transferred over TCP / IP (Transmission Control Protocol / Internet Protocol) and the TCP destination port number when connecting from the mail client 6 to the mail servers 3-1 to 3-3 is determined to be 25. It has been.
[0038]
Here, since the IP destination address is the IP address of the gateway device 2, the key necessary for the search is {IP transmission source address, TCP transmission source port number}. The IP transmission source address is the IP address of the mail client 6, and the TCP transmission source port number is an arbitrary value assigned when the mail client 6 starts SMTP.
[0039]
Since an external transfer request is made from an arbitrary mail client (transmission side server), the mail client 6 is not limited to one, but actually means an arbitrary server connected on the Internet.
[0040]
The flow specified by the search key specifies one of the SMTP sessions that the gateway device 2 is processing. This makes it possible to specify an SMTP session when the gateway apparatus 2 performs mail transfer processing from a plurality of mail clients 6 in parallel.
[0041]
By the flow search in the flow search processing unit 21, parameters necessary for the conversion process and information on output destinations (mail servers 3-1 to 3-3, connection lines 101 to 103, or character string search unit 27, processor 28, etc.) are obtained. get.
[0042]
The packet conversion processing unit 22 performs packet conversion processing when instructed to perform cut-through processing according to the result of the flow search processing unit 21. After the outgoing mail server is determined by the priority determination unit 25, parameters of TCP sessions between the mail client 6 and the gateway device 2 and between the gateway device 2 and the mail servers 3-1 to 3-3 are attached. In other words, the transfer is performed without going through the processor 28.
[0043]
For the packets received through the connection lines 101 to 103, the flow search processing units 29 to 31 perform flow search. Since the gateway device 2 performs mail delivery from the outside of the mail domain 1 to the inside of the mail domain 1, the packet in this direction is an SMTP response packet or a TCP control packet. In this direction, {IP source address, TCP destination port number} is the search key.
[0044]
This is because the IP destination address is the address of the gateway device 2 and the TCP transmission source port number is fixed to 25 indicating SMTP. Therefore, the SMTP session established between the mail servers 3-1 to 3-3 is specified by the IP transmission source address and the TCP destination port number.
[0045]
Flow information related to the same SMTP session (mail) is registered in the flow search processing unit 21 and the flow search processing units 29 to 31 so as to have a one-to-one correspondence. Registration is performed by the processor 28. Thus, the packet conversion processing unit 22 performs header information conversion in the direction of the connection lines 101 to 103, and the packet conversion processing units 32 to 34 perform header information conversion in the direction of the connection line 100, thereby realizing cut-through processing.
[0046]
The priority determination unit 25 performs priority determination regarding the SMTP session specified by the flow search processing unit 21. Before describing priority determination, a mail transmission sequence in SMTP will be described with reference to FIG.
[0047]
FIG. 3 is a sequence chart showing a typical operation when mail is transmitted from the mail client 6 of FIG. 1 to the mail servers 3-1 to 3-3. Although not shown in FIG. 3, the mail client 6 and the mail servers 3-1 to 3-3 first initialize with a message called HELO / EHLO, and then notify mail-specific information.
[0048]
As shown in FIG. 3, the mail client 6 notifies the mail servers 3-1 to 3-3 of the destination, mail size, and transmission source information. If there is no problem in the information, the mail servers 3-1 to 3-3 return an OK response.
[0049]
Upon receiving OK, the mail client 6 transmits mail data to the mail servers 3-1 to 3-3. Although it does not respond as SMTP until mail data (header + text) is received, the TCP layer returns an acknowledgment called ACK (ACKnowledgement) as needed to guarantee reliable data transfer.
[0050]
When the mail servers 3-1 to 3-3 receive the packet marked to indicate the end of the mail data, if the received data is received correctly, Ok is returned and the SMTP session is terminated. As shown in FIG. 3, when the priority is determined based on the destination, size, transmission source information, etc., it can be determined at the timing indicated as priority determination # 1, and the contents included in the mail data (email In the case of determining the priority based on the header, the subject, and the character string in the text, the priority can be determined at the timing of priority determination # 2.
[0051]
FIG. 4 is a flowchart showing the priority determination operation by the gateway device 2 of FIG. The priority determination operation by the gateway device 2 will be described with reference to FIGS. In general, the spam filter program combines various elements as shown in this flow to score (score) whether or not it is spam, and performs processing such as reception rejection and discarding.
[0052]
The present embodiment is characterized in that the calculated score is used for priority determination, the connected mail server is selected with the obtained priority, and cut-through processing determination is performed.
[0053]
The gateway device 2 determines whether or not the client information (IP transmission source address) used in the flow determination is on the black list (step S1 in FIG. 4). If the condition is met, the score is X1 (a preset numerical value). Are added (step S2 in FIG. 4).
[0054]
The gateway device 2 determines whether or not the number of destinations passed by the “RCPT TO” command is one (step S3 in FIG. 4), and subtracts X2 (a preset numerical value) from the score if the condition is met (FIG. 4). Step S4).
[0055]
Further, the gateway device 2 determines whether or not the number of destinations passed by the “RCPT TO” command is greater than or equal to N (N is an integer equal to or greater than 2) (step S5 in FIG. 4). The numerical value set in advance) is added (step S6 in FIG. 4).
[0056]
This is because it is possible to determine that a mail having a plurality of addresses is an unnecessary mail such as a mail magazine or spam, or a mail with low immediacy. In particular, when there is only one destination, it is an email addressed to an individual and is considered to have a high priority.
[0057]
The gateway device 2 determines whether the score is equal to or greater than a threshold value M (M is a positive integer) (step S7 in FIG. 4). This determination is a branch for making a determination corresponding to “priority determination # 1” in FIG.
[0058]
If the score is lower than the threshold value M at this point, the gateway device 2 determines the size (step S8 in FIG. 4). When the size is larger than the threshold value S (S is a positive integer), the effect of cut-through can be expected. Therefore, the gateway device 2 determines the priority (step S9 in FIG. 4), obtains the transfer destination, Perform cut-through processing. When the size is smaller than the threshold value S, the gateway device 2 determines that the transfer by the processor 28 is sufficient and does not perform the cut-through process (step S12 in FIG. 4).
[0059]
When the score is larger than the threshold value M, the gateway device 2 executes content filtering (steps S10 to S12 in FIG. 4). Specifically, the character string search unit 27 searches for a character string registered in advance. If they match, the score associated with the character string is added. However, it is easy to score only by whether or not they match, but it is divided into character string groups according to the score, and it is searched whether or not each group matches. It is calculated | required by the method of integrating | accumulating the score of.
[0060]
The gateway device 2 specifies the mail servers 3-1 to 3-3 to be transferred based on the priority obtained as described above. When the mail servers 3-1 to 3-3 are specified, an SMTP session is established between the gateway device 2 and the mail servers 3-1 to 3-3, and mail relay is performed. At this time, if it is determined in the previous determination that the cut-through process is to be performed, the cut-through process is performed.
[0061]
FIG. 5A is a sequence chart showing the operation of cut-through processing according to an embodiment of the present invention, and FIG. 5B is a diagram showing conversion of IP and TCP parameters in FIG. 5A. The mail relay by the cut-through process will be described with reference to FIGS.
[0062]
When it is determined that the cut-through process is to be performed, the fact is registered in the flow tables (not shown) of the flow search processing units 21, 29 to 31, and the conversion parameter is registered.
[0063]
The packet conversion processing units 22, 32-34 replace packet headers (IP, TCP header) based on the conversion parameters. In FIG. 5A, the portion from “conversion setting” to “conversion cancellation” corresponds to the relay processing by cut-through, and the correspondence between the IP and TCP headers is shown in FIG. 5B.
[0064]
Such a cut-through method is a method called TCP splicing, and is mainly used in an HTTP (Hyper Text Transfer Protocol) load distribution server. Specifically, conversion of IP DA (destination address), IP SA (source address), TCP dp (destination port), TCP sp (source port) and replacement of the sequence number included in the TCP header are performed. The packet is transferred without going through the TCP stack processing of the processor 28.
[0065]
FIG. 6 is a flowchart showing a bandwidth control operation according to an embodiment of the present invention, and FIG. 7 is a diagram showing an example of bandwidth allocation controlled by the operation shown in FIG. Band control according to an embodiment of the present invention will be described with reference to FIGS. 1, 2, 6, and 7. Bandwidth control is performed on data received from the connection line 100 on the mail client 6 side.
[0066]
The bandwidth measuring unit 23 measures the reception bandwidth of each SMTP session for each priority. A packet whose priority is undetermined is determined as a low priority or excluded from the measurement target. The bandwidth measuring unit 23 measures the reception bandwidth of each of the low priority mail and the high priority mail and sets them as W0 and W1 (step S21 in FIG. 6).
[0067]
The gateway device 2 determines whether W1 exceeds the high priority allocated bandwidth (WH) (step S22 in FIG. 6). If W1> WH, the gateway device 2 compares the low priority assigned bandwidth (WL) with W0 (step S24 in FIG. 6).
[0068]
Here, if W0> WL, it means that the high-priority mail and the low-priority mail each exceed the threshold value, so the gateway device 2 performs a flow control process to narrow down the bandwidth of the low-priority mail (see FIG. 6 step S25). Further, when the gateway device 2 does not satisfy the relationship of W1> WH during execution of the flow control (step S22 in FIG. 6), it means that the receiving link has a room, so the flow control for the low priority mail is canceled. (Step S23 in FIG. 6).
[0069]
A specific flow control process is realized by changing a TCP parameter in the bandwidth control unit 24. The TCP header has a parameter called window size, and can notify the octet size that can be received on the receiving side. When the size is reduced, the transmission side reduces the transmission band by reducing the size of the TCP segment (packet) or by increasing the transmission interval. Therefore, by changing the parameter of the TCP session corresponding to the low priority in the bandwidth control unit 24, the mail reception bandwidth of the low priority can be limited.
[0070]
As described above, in this embodiment, the transfer priority is determined according to the information delivered by the mail delivery protocol (SMTP) and the pattern included in the mail text, and the mail servers 3-1 to 3- By selecting 3, it is possible to select the mail servers 3-1 to 3-3 according to the characteristics of the mail, and it is possible to appropriately allocate server resources.
[0071]
For example, a high-performance server is assigned to high-priority mail, a low-performance server is assigned to low-priority mail processing, or a write process to the user's mail storage area is delayed. A server can be used efficiently.
[0072]
Also, in this embodiment, when there is an increase in traffic with low priority and the transfer of traffic with high priority is hindered, bandwidth control by flow control is applied to traffic with low priority, which seems unnecessary. It is possible to prevent waste of server and network resources for mail delivery.
[0073]
【The invention's effect】
As described above, the present invention is configured and operated as described above, so that it is possible to select a mail server according to the characteristics of the mail, and to obtain an effect that server resources can be appropriately allocated. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an electronic mail system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of the gateway device of FIG. 1;
FIG. 3 is a sequence chart showing a typical operation when mail is transmitted from the mail client of FIG. 1 to the mail server.
4 is a flowchart showing a priority determination operation by the gateway device of FIG. 2;
FIG. 5A is a sequence chart showing an operation of cut-through processing according to an embodiment of the present invention, and FIG. 5B is a diagram showing conversion of IP and TCP parameters in FIG.
FIG. 6 is a flowchart illustrating a bandwidth control operation according to an embodiment of the present invention.
7 is a diagram showing an example of bandwidth allocation controlled by the operation shown in FIG. 6; FIG.
[Explanation of symbols]
1 Mail domain 2 Gateway devices 3-1 to 3-4 Mail server 4 User information DB
5 Terminal 6 Mail client 21, 29 to 31 Flow search processing unit 22, 32 to 34 Packet conversion processing unit 23 Band measurement unit 24 Band control unit 25 Priority determination unit 26 Packet switch 27 Character string search unit 28 Processors 100 to 103 Connection Line

Claims (12)

An e-mail relay device for relaying e-mail, means for interpreting protocol of the e-mail and filtering of data content, means for determining the priority of the e-mail according to preset conditions, and An e-mail relay apparatus comprising: a mail server that receives the e-mail based on a determination result. And a means for narrowing a band and securing the transfer band for a high-priority e-mail when a transfer band of a low-priority e-mail exceeds a threshold based on the determination result. 1. The electronic mail relay device according to 1. 3. The electronic mail relay apparatus according to claim 2, wherein when the low priority electronic mail occupies a certain band, the reception band of the electronic mail is limited by flow control. The means for determining the priority of the e-mail determines the priority according to information passed in a mail delivery protocol and a pattern included in a body of the e-mail. Item 4. The electronic mail relay device according to any one of items 3 to 4. 5. The server according to claim 2, wherein a high-performance server is assigned to the high-priority email processing, and a low-performance server is assigned to the low-priority email processing. E-mail relay device. 6. The electronic mail relay apparatus according to claim 2, wherein a write process to the storage area for the low priority electronic mail is delayed. An e-mail relay method in an e-mail relay apparatus for relaying an e-mail, wherein the e-mail relay apparatus side performs protocol interpretation and data content filtering on the e-mail relay apparatus side, and according to preset conditions An e-mail relay method comprising: determining a priority of the e-mail; and selecting a mail server that receives the e-mail based on the determination result. A step of narrowing the bandwidth and securing the transfer bandwidth for the high-priority e-mail when the transfer bandwidth of the low-priority e-mail exceeds the threshold based on the determination result on the e-mail relay device side. The electronic mail relay method according to claim 7, further comprising: 9. The e-mail relay method according to claim 8, wherein the e-mail reception band is limited by flow control when the low priority e-mail occupies a certain band. The step of determining the priority of the e-mail determines the priority in accordance with information delivered by a mail delivery protocol and a pattern included in a body of the e-mail. Item 10. The electronic mail relay method according to Item 9. 11. The server according to claim 8, wherein a high-performance server is assigned to the high-priority e-mail processing, and a low-performance server is assigned to the low-priority e-mail processing. Email relay method. 12. The e-mail relay method according to claim 8, wherein a writing process of the low priority e-mail in a storage area is delayed.

Images