KR100391319B1 - Electronic Mail Service Method and System Making Use of Dynamic IP Filtering - Google Patents

Abstract

The present invention relates to an e-mail service system and method that can continuously perform IP filtering without interruption of time intervals by using a dynamic Internet Protocol (IP) filtering module and method adopting the variable start time concept. The system according to the invention comprises a dynamic IP address filtering module and a Mail Transfer Agent (MTA), comprising means for receiving a connection request from a remote host, and an IP address consisting of an IP block consisting of a plurality of IP groups. IP block configuration means for determining whether to allow access for multiple access requests at the same time, and a value obtained by accumulating the connection request accumulated in the past and the current request by the corresponding IP address for a predetermined management time and a predetermined reference value. And means for determining whether to allow access by comparing, and the dynamic IP filtering module determines whether to allow access. Before, it comprises a means for initializing an access request count for the slices between the final access time and the present time. The dynamic IP address filtering method according to the present invention comprises the steps of: accepting a connection request from a remote host; searching for an IP block to extract a corresponding IP address of the host requesting the connection; and a slice between a last access time and a current time. Initializing a corresponding number of connection requests, and determining whether to allow access by comparing a value obtained by accumulating a connection request that the IP address has requested in the past and a sum of the current request with a predetermined reference value. Steps. According to the present invention, it is possible to apply a separate policy (management unit time, reference value, access denied time) to each IP group, it is possible to apply a different policy for each IP group for each time zone.

Description

Electronic Mail Service Method and System Making Use of Dynamic IP Filtering

The present invention relates to an e-mail service system and method, and more particularly, to continuously perform IP filtering using a dynamic Internet Protocol (IP) filtering module and method adopting the variable start time concept. The present invention relates to an e-mail service system and method capable of implementing a plurality of IP blocking policies for IP groups, and to realize a separate IP blocking policy for each IP group by time zone.

As information transmission and distribution through distributed computer networks such as the Internet have been expanded, the transmission of information between individuals through electronic mail systems has become increasingly common. An email system is a distributed client / server system with equivalent servers. Clients communicate with servers to send and receive emails, and servers are basically based on open systems that communicate with other servers. On the other hand, the openness of such e-mail systems is commonly referred to as 'Unsolicited Commercial Email' (UCE), such as increasing spam mail, junk mail, and e-mail bombs. The problem caused by 'spam e-mail' is exposed.

Spam e-mail is mostly used for low-cost advertising, which is a loss for both the Internet Service Provider (ISP) and the users who actually receive and process such e-mail. . For example, resources that ISPs need to pay extra to handle spam email include: Most spam e-mails are sent in large numbers to over 100,000 units and are more than a few gigabytes in size, resulting in loss of network resources and automatic return of spam e-mails to senders as a countermeasure against spam e-mails. Additional communication costs, human resources, and system resources are lost, such as how to do so, request removal from the list of email addresses, or return complaints about spam emails. On the other hand, even individual users who receive spam e-mails, along with system resources, cause a loss of work resources that separate the spam e-mails from normal e-mails and process them.

Conventional methods for solving the spam email problem include a recipient approach and an email service provider approach. The service provider approach is to control the Mail Transfer Agent (MTA) and contract to prevent spammers from using anonymous components and to prevent the relaying of Simple Mail Transfer Protocol (SMTP). On the other hand, the traffic of the service provider's mail server is 5-10 times more than the sending, with spam email accounting for 60-80%. The most obvious way to prevent spam e-mail is to distinguish between spam and normal e-mail by looking at the subject or body of the e-mail, which not only costs too much time and money for both the service provider or the user. The criteria for distinguishing e-mail are not clear, and judgment itself can be difficult.

Also, if the spam email is from an unknown source, the spam email may contain a virus. Opening this spam e-mail will launch a program that can damage the virus or the local computer, and thus provide a more effective way to compensate for the loss of spam e-mail for the e-mail community or the Internet community. There is an urgent need for provision.

It is an object of the present invention to minimize the loss of an email service provider due to spam email.

Another object of the present invention is to prevent the damage caused by spam email by efficiently maintaining and controlling the traffic of the email service provider from the spam email.

It is still another object of the present invention to provide an e-mail service system and method capable of applying a separate spam blocking policy for each IP group having an access request, and flexibly applying various policies to the same IP group.

1 is a block diagram showing the overall configuration of an e-mail network according to the present invention.

2 is a conceptual diagram showing the configuration of IP blocks, records in the email service system according to the present invention.

3 is a flowchart illustrating an entire process of a dynamic IP address filtering method in an e-mail service system according to the present invention.

4 is a block diagram illustrating multiple time policy application techniques for applying different IP blocking policies for different IP groups in accordance with the present invention.

5 is a block diagram illustrating a technique of applying different IP blocking policies for each IP group according to time zones according to the present invention.

Figure 6 is a block diagram of an e-mail service system implemented in the ASP (Application Service Provider) model according to the present invention.

<Explanation of symbols for the main parts of the drawings>

10: remote host

20, 220: Dynamic IP Address Filtering Module

30, 230: connection processing unit

40, 240: IP block

50: Mail Transfer Agent (MTA)

100, 210: email service system

200: IP Block policy

In order to solve this problem, the present invention determines the number of connection requests or the number of connection requests based on the IP address of the remote host to which the email is to be sent before receiving and processing the email. By denying the access request sent from the host of the IP address, the responsibility for retransmission of the e-mail to be transferred is transferred to the host, thus efficiently maintaining the traffic of the mail server.

The email service system according to the present invention comprises a dynamic IP address filtering module and a mail transfer agent (MTA), means for accepting a connection request from a remote host, and an IP address using, for example, a hash function. IP block configuration means for determining whether to allow access to multiple access requests at the same time by configuring an IP block, and a value that accumulates a connection request received in the past within a predetermined total management time and a current request. Means for determining whether to allow access by comparing the summed value with a predetermined reference value, and the dynamic IP filtering module determines the number of connections corresponding to a slice between the last access time and the current time before determining whether to allow access. And means for initializing.

In the e-mail service system according to the present invention, a dynamic IP address filtering method includes receiving an access request from a remote host, searching for an IP block, extracting a corresponding IP address of the host requesting the connection, the last access time and present Initializing the number of connections corresponding to the slices between the times, and allowing the connection by comparing a value obtained by accumulating a connection request that the IP address has requested in the past and a sum of the current request with a predetermined reference value. And determining whether or not.

According to another feature of the present invention, different IP blocking policies (administrative unit time, reference value, no access time) for different IP groups are applied or different IP blocking policies are applied over time for the same IP group. It is possible to manage traffic of mail service system more efficiently by applying multiple IP blocking policies such as, and to apply dynamic IP filtering technology more flexibly and variously.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

1 is a block diagram showing the overall configuration of an e-mail network according to the present invention. The e-mail network according to the present invention is a distributed computer system for composing, accessing, and sending e-mail, and is established based on a protocol such as IMAP (Internet Messaging Access Protocol), Post Office Protocol (POP), or Simple Mail Transfer Protocol (SMTP). do.

The remote host 10 is connected to the electronic mail service system 100 by a public network such as the Internet or a network such as a local area network (LAN). The remote host 10 may be a personal user client system or a server system equivalent to the email service system 100. The network has numerous access nodes and communicates using the Internet Protocol (IP). IP is widely known as the standard way of communicating data. High-level protocols such as HyperText Transfer Protocol (HTTP) and File Transfer Protocol (FTP) are responsible for communication at the application layer. Low-level protocols, such as Transmission Control Protocol / Internet Protocol (TCP / IP), provide communication between the transport and network layers. In charge. The mail message is sent to the address <receiver@terracetech.com>, for example, via the SMTP protocol.

The e-mail service system 100 may include one or more server computers and form part of a private network (intranet) connected to the public network. For security, communication between the Internet and intranet components can also be filtered and controlled using a firewall. Firewalls restrict external access to certain resources on the intranet. The server computer included in the e-mail service system 100 executes a server program for the client. The server computer maintains user accounts and receives and filters e-mail messages so that the e-mail messages can be found and restored regardless of the encoding of the message information. The server computer may include, for example, a web server, a CGI program unit, an account manager, and an SMTP mail server.

The e-mail service system 100 includes a dynamic IP address filtering module 20 and a mail transmission agent 50 such as Sendmail ^™ and Qmail ^™ . The MTA 50 includes a forwarding MTA, a receiving MTA, and a gateway MTA. The filtering module 20 includes a connection processor 30 and an IP block 40. The service system 100 receives a new e-mail message from the remote host 10 using, for example, the POP-3 protocol, and sends the e-mail message via, for example, the Simple Mail Transfer Protocol (SMTP) or the Extended SMTP (ESMTP) protocol. send.

The remote host 10 sends a connection request signal to the service system 100 and transmits an e-mail message, for example, MAIL From <spam@host.domain>, RCPT To <receiver@host.domain. Send> and messages, attachment data, and more. "MAIL From" contains a message that identifies the sender's email address. "RCPT To" contains a message that identifies the e-mail address of the message recipient. The connection processing unit 30 of the dynamic IP address filtering module 20 determines whether to permit connection with reference to the IP block 40 with respect to the connection request of the remote host 10. If the connection is allowed, data and messages transmitted from the remote host 10 are transferred to the MTA 50 and transmitted to the email recipient or another remote host. The determination of whether to allow the remote host 10 to access is determined by determining the number of connection requests or the number of connection requests based on the IP address of the remote host and determining whether the number exceeds a predetermined reference value, which will be described later.

2 is a conceptual diagram illustrating a configuration of an IP block and a record in an email service system according to the present invention. The IP block of the e-mail service system 100 is pre-stored data. When an access request is received from the remote host 10, the corresponding IP address corresponding to the host is registered. The IP block 40 is grouped into group units 40a, 40b, ..., 40k in which IP addresses are arranged on a predetermined basis. When receiving a connection request from the remote host 10, the connection processing unit 30 searches for and extracts an IP address corresponding to the remote host from the IP block. The IP address is preferably configured as an IP block using, for example, a hash function, so that it is possible to determine whether to allow access to several connection requests at the same time. One IP block group 40a is composed of a plurality of records # 1 to #m, and one record is formed for one IP address. Each record consists of a plurality of slices, for example n slices from 'slice 1' to 'slice n'. A slice is a unit of time-divided records. Each slice records the number of connection requests or the number of connection requests received from a remote host.

3 is a flowchart illustrating an entire process of a dynamic IP address filtering method in an e-mail service system according to the present invention.

When the connection request is received from the remote host (step 110), the IP block is retrieved (step 115) to extract the corresponding IP address of the remote host that has requested the connection (step 120). On the basis of the cumulative number of access requests of the IP address, it is determined whether to allow access of the remote host (step 130). Determining whether to allow access is a value obtained by accumulating the number of connections recorded in the slice corresponding to the past time within the predetermined total management time at the past access request time (ie, the last access time) closest to the current time of the access request (this is a connection). Cumulative number of connection requests recorded in the slice corresponding to the past unit management time within the total management time based on the current time when the request is received) and 'number of connections recorded in the slice corresponding to the current time.' Is first performed by determining whether the sum result (hereinafter, referred to as "accumulated connection number") is equal to or greater than a predetermined reference value or exceeds the reference value (step 135). For example, suppose you have 10 slices in a record, and these 10 slices are managed in 10-minute increments. Assume that there is a current connection request at 12:13, and the last connection request was at 12:11. lets do it. The cumulative number of connections is the number of connections recorded in slice 4-10 (that is, the slice corresponding to the time from 12:03 to 12:10) and slice 1 (that is, 12 o'clock). The number of connections recorded in the slice corresponding to the time from 10 minutes to 12:11) and the number of connections of the slice corresponding to the current time, and the cumulative number of connections is determined in step 135. Compare with The reference value is determined by comprehensively considering the system resource of the e-mail service provider, the size of the user, the traffic, and the like, and is expressed in units of times per hour. If the cumulative number of accesses exceeds the threshold, the connection to the remote host corresponding to the IP address is blocked (step 145). Determine if it is (step 140). If the connection dead time has not yet passed, the connection to the remote host corresponding to the IP address is blocked. If the connection dead time has elapsed or there is no case in which the connection is not allowed, the connection to the remote host is allowed (Step) 150) The e-mail message and data are delivered to the MTA to perform normal e-mail transmission processing. According to one example of the present invention, for an e-mail service provider operating with two system resources of the SUN220R, the user has 3 million users for one day. In case of traffic of 3 million traffics, it is possible to set a connection disallowed time for 12 hours with a management time of 10 seconds and a reference value of 20. As another example, if the user of the system resources of one SUN3500 is 30,000 and the traffic of 200,000 traffic during the day, the connection time can be set to 30 minutes with a management time of 30 seconds and a reference value of 20. On the other hand, if an e-mail service provider running 3 Linux systems has 5 million users and 2 million traffic a day, a 24-hour deadline is applied for an IP requesting 60 mails per 3 hours. For the non-spam IP, the differential policy may be applied according to the IP by applying 3 hours of management time and 1,000 hours of non-access time to the reference value. This differential policy is as described below with reference to FIG. 4.

Current time sliced Last connection time One 2 3 4 5 6 7 8 9 10 12:10 12:01 12:02 12:03 12:04 12:05 12:06 12:07 12:08 12:09 (12:10) 12:09 12:11 12:11 12:02 12:03 12:04 12:05 12:06 12:07 12:08 12:09 (12:10) 12:09 12:12 12:11 (12:12) 12:03 12:04 12:05 12:06 12:07 12:08 12:09 (12:10) 12:11 12:13 12:11 (12:12) 12:13 12:04 12:05 12:06 12:07 12:08 12:09 (12:10) 12:11

After determining whether to allow the connection, the process returns to step 110 for accepting a new connection request. You may also consider not rescanning the IP block for the same IP address by storing the IP address that determines whether to allow access, but given the system resources needed to associate and store IP address data with access permission, It is more preferable to search the block and extract the corresponding IP address.

According to the dynamic IP address filtering technique of the present invention, it is possible to apply multiple time policies to one data structure.

4 is a block diagram illustrating a multiple time policy technique with a separate policy applied to each of several IP groups. Policy A 200a, which is applied to IP Group A 40a, applies Policy B 200b, Policy C 200c, which is applied to other IP Groups B and C 200b, 200c, and management unit time, baseline, and no access. The time is different. Here, 'management unit time' refers to a management period used to add up the number of accesses requested in the determination step 135 of FIG. 3, and 'reference value' refers to the number of access accumulated during the management unit time and the current access request. Refers to the reference value for comparing the sum. The multi-time policy description is, for example, for IP group A 40a having an IP address of 210.220.10.0-210.220.250.255, the management unit time a1 is 1 hour, the reference value a2 is set to 10 times, and the connection time a3 is 2 hours. For the IP group B 40b with the IP addresses 210.0.10.0-210.220.0.0, the administrative unit time b1 = 10 minutes, the reference value b2 = 10 times, and the time for which the connection is not allowed b3 = 30 minutes. ) Can be explained by applying. When applying a large number of time policies, it is desirable to have a default policy be applied to an IP group to which a special policy does not apply. If you want to check whether an IP is blocked for a specific IP, you can bring the values related to the policy for the IP group to which the IP belongs among multiple policies. The policy value (for example, management unit time, reference value, and no access time) obtained is calculated by applying the IP blocking algorithm.

According to the present invention, as shown in Fig. 5, it is possible to apply different policies for each time zone even for one IP group 40n. This allows you to manage traffic on your mail server more efficiently by dynamically applying specially enforced policies for times of high spam requests.

6 is a block diagram of an e-mail service system according to the present invention implemented as an ASP (Application Service Provider) model. The e-mail service system 210 receives a connection request signal of the remote host 10, a signal necessary for transmitting an e-mail message, a message, and attachment file data, and the dynamic IP filtering module 220 connects to the remote host 10. Determine whether to allow access to the request. If the connection is allowed, the e-mail service system 210 according to the present invention transmits an e-mail message to an e-mail destination server among a plurality of remote servers 300a, 300b, and 300c connected through the communication network 400, for example, the Internet. And so on. The dynamic IP filtering module 220 includes a connection processor 230 and an IP block 240 similarly to the dynamic IP filtering module 20 of the e-mail system 100 of FIG. 1. Remote servers 300a, 300b, and 300c include respective MTAs 250a, 250b, and 250c, which may include a forwarding MTA, a receiving MTA, and a gateway MTA.

As described above, when the e-mail service system is implemented using the ASP model, each remote server 300a, 300b, or 300c may use an IP filtering module by external resources, thereby saving its own resources.

Although specific embodiments of the present invention have been described above with reference to the drawings, this is for the purpose of description and is not intended to limit the scope of the invention. Accordingly, it will be readily understood by one of ordinary skill in the art that the embodiments described in the specification may be modified or modified without departing from the scope of the invention.

As described above, according to the present invention, since IP filtering can be performed continuously without interruption of time intervals, it is possible to efficiently maintain and control traffic of an email service provider from spam email. In addition, according to the system and method of the present invention, it is possible to minimize the resource loss of the e-mail service provider due to spam e-mail.

In addition, according to the present invention, by applying a different IP blocking policy to different IP groups, it is possible to variably apply the management unit time, reference value, and access disallowed time, even for one IP group different IP over time By applying multiple IP blocking policies such as blocking policy, it is possible to manage traffic of mail service system more efficiently and to apply dynamic IP filtering technology more flexibly and variously.

In addition, according to the present invention, by implementing the dynamic IP filtering module in the ASP model, it is possible to save the remote server's own resources, while minimizing the loss of the remote server due to spam e-mail and to maintain efficient traffic.

Claims (14)

An IP block composed of a record corresponding to each IP address of the access requester is used, and the record includes a plurality of slices and time of last access time separated by time, and the plurality of slices each have a predetermined total management time. As an e-mail service system, each corresponding to a plurality of unit management times divided by a fixed unit time, Connection request accepting means for receiving a connection request from a remote host, IP address extracting means for extracting the corresponding IP address of the host requesting the connection on an IP block basis; A value obtained by accumulating the number of past connection requests recorded in a slice corresponding to a past unit management time within the entire management time on the basis of the current time when the connection request receiving means receives the connection request from the host and corresponds to the current time. And a connection allowance determining means for denying the connection request if the summed value is equal to or greater than the reference value by comparing the sum of the number of connection requests recorded in the slice to be a predetermined reference value. Means for initializing the number of connection requests recorded in a slice corresponding to a unit management time existing between the last connection time and the current time before the connection permission determining means determines whether to allow the connection. Email service system. The method of claim 1, wherein when it is determined that the access permission is determined to deny the access request, a predetermined access disallow time is set for the corresponding IP address, and the access of the corresponding IP address is blocked during this access disallow time. Email Service System. 3. The IP block of claim 2, wherein the IP block includes a plurality of IP groups, and a policy applied to one IP group is different from a policy applied to another IP group, and the policy is determined by the predetermined administrative time, the predetermined And a reference value and a value for the predetermined connection disallowed time. 3. The IP block of claim 2, wherein the IP block includes a plurality of IP groups, and a plurality of policies are applied to one IP group, wherein the policy includes the predetermined management time, the predetermined reference value, and the predetermined disconnection time. An email service system comprising a value for. An email service system having a dynamic IP filtering module, The email service system is connected to a plurality of remote servers through a communication network, and the plurality of remote servers includes its own mail transfer agent (MTA), and the email service system includes: Connection request accepting means for receiving a connection request from a remote host, IP address extracting means for extracting the corresponding IP address of the host requesting the connection on an IP block basis; A value obtained by accumulating the number of past connection requests recorded in a slice corresponding to a past unit management time within the entire management time on the basis of the current time when the connection request receiving means receives the connection request from the host and corresponds to the current time. Connection allowance determining means for comparing the value obtained by adding up the number of connection requests recorded in the slice to be compared with a predetermined reference value and rejecting the connection request if the summed value is equal to or larger than the reference value; Means for initializing the number of connection requests recorded in a slice corresponding to a unit management time existing between the last connection time and the current time before the connection permission determining means determines whether to allow the connection; And means for transmitting an e-mail for a request for which the access is allowed by the access permission determining means to a corresponding remote server. 6. The electronic mail of claim 5, wherein, when the access is blocked by the access determining means, a predetermined access disallow time is set for the corresponding IP address, and the access of the corresponding IP address is blocked during the access disallowed time. Service system. A method of dynamically filtering IP addresses in an email service system. Accepting a connection request from a remote host, An IP address extraction step of extracting the corresponding IP address of the host requesting the connection on an IP block basis; A value obtained by accumulating the number of past connection requests recorded in the slice corresponding to the past unit management time within the entire management time based on the current time when the connection request is received from the host in the connection request reception step and corresponding to the current time Comparing the sum of the number of access requests recorded in the slice with a predetermined reference value and rejecting the access request if the sum is equal to or greater than the reference value; And prior to the determining whether to allow the access, initializing the number of connection requests recorded in the slice corresponding to the unit management time existing between the last access time and the current time. . The method of claim 7, wherein in the case of determining whether to deny the access request in the access permission determination step, a predetermined access disallow time is set in the corresponding IP address, and the access to the corresponding IP address is blocked during the access disallowed time. Dynamic IP address filtering method. The method of claim 7 or 8, wherein the IP block is composed of records corresponding to one IP address, each record is composed of a plurality of slices that are continuously managed based on a predetermined management time, and each slice Dynamic IP address filtering method characterized in that the number of access requests of the IP address is recorded. The method of claim 7 or 8, wherein the determining of whether to allow the access returns to the accepting of the access request. The method of claim 8, wherein the IP block includes a plurality of IP groups, and a policy applied to one IP group is different from a policy applied to another IP group, and the policy is determined by the predetermined management time and the predetermined time. And a reference value and a value for the predetermined access disallowed time. The IP block of claim 8, wherein the IP block includes a plurality of IP groups, and a plurality of policies are applied to one IP group, wherein the policy includes the predetermined management time, the predetermined reference value, and the predetermined disconnection time. Dynamic IP address filtering method comprising a value for. A method of dynamically filtering an IP address in an e-mail service system that is connected through a communication network with a plurality of remote servers having its own mail transfer agent. Accepting a connection request from the remote host to the plurality of remote servers; An IP address extraction step of extracting the corresponding IP address of the host requesting the connection on an IP block basis; A value obtained by accumulating the number of past connection requests recorded in the slice corresponding to the past unit management time within the entire management time based on the current time when the connection request is received from the host in the connection request reception step and corresponding to the current time Comparing the sum of the number of access requests recorded in the slice with a predetermined reference value and rejecting the access request if the sum is equal to or greater than the reference value; Initializing the number of connection requests recorded in the slice corresponding to the unit management time existing between the last access time and the current time before the access permission determination step; And transmitting an e-mail regarding a request for which the access is allowed to the corresponding remote server in the determining whether to permit the access. 15. The method of claim 13, wherein if it is determined that the access is not allowed in the access permission determination step, a predetermined access disallow time is set in the corresponding IP address, and the access to the corresponding IP address is blocked during the access disallowed time. Dynamic IP address filtering method.