KR100679108B1 - A method for filtering electronic mail - Google Patents

Abstract

The present invention relates to a method of filtering an e-mail by dividing and filtering an e-mail by each item in a switch and performing a search for a mail item and a factor by combining packets when the e-mail is received by dividing the packet into several packets.

Method for filtering e-mail in a switch according to an embodiment of the present invention comprises the steps of receiving a packet of the e-mail; Filtering a string of the sender's e-mail address when the received packet includes e-mail address information of a predetermined sender; Filtering a string of an e-mail address of a receiver when the received packet includes e-mail address information of a predetermined receiver; Filtering a string of the subject of the e-mail when the received packet includes the subject of the e-mail; And filtering the character string of the body of the e-mail when the received packet includes the body of the e-mail, wherein the character string of the sender's e-mail address, the character string of the recipient's e-mail address, and the e-mail. The filtering of the string of the subject of the mail or the string of the body of the e-mail may include searching for a predetermined string in the received packet; Determining whether the string matches a predetermined factor of an OR filter list or an AND filter list if the string exists, wherein the OR filter list compares the string with the factor according to an OR logic to filter the e-mail A list for filtering, said AND filter list for filtering said e-mail by comparing said string and said factor according to AND logic; And blocking the session of the e-mail when the character string matches the OR filter list or the factor of the AND filter list.

The present invention can improve the performance of the e-mail filtering by tracking the state of the SMTP connection protocol in the switch so as not to search for the e-mail items that do not need searching in the current state.

Email, filtering, recipient, sender, subject

Description

How to filter email {A METHOD FOR FILTERING ELECTRONIC MAIL}

1A is a diagram illustrating a connection state transition diagram for e-mail filtering according to an embodiment of the present invention.

1B is a diagram illustrating a data structure for storing session information of SMTP according to an embodiment of the present invention.

1C is a diagram illustrating a structure for storing filter information set by a user according to an exemplary embodiment of the present invention.

2 is a diagram illustrating a state transition diagram for performing a search for a mail item and a factor divided into several packets when filtering an e-mail according to an exemplary embodiment of the present invention.

3A is a flowchart illustrating an e-mail filtering method according to an exemplary embodiment of the present invention.

3B is a diagram illustrating a user interface command structure according to an embodiment of the present invention.

3C is a table illustrating restrictions of inputs by a sender, a receiver, and a title according to an embodiment of the present invention.

4 is a flowchart illustrating a method of filtering a sender's e-mail address according to an embodiment of the present invention.

5 is a flowchart illustrating a method of filtering a sender's e-mail address by an AND filter list according to an exemplary embodiment of the present invention.

6 is a flowchart illustrating a method of filtering an e-mail address of a receiver according to an embodiment of the present invention.

7 is a flowchart illustrating a method of filtering an e-mail address of another recipient by an AND filter list according to an embodiment of the present invention.

8 is a flowchart illustrating a method of managing a recipient matching list according to an embodiment of the present invention.

9 is a flowchart illustrating a method of filtering an electronic mail subject according to an embodiment of the present invention.

The present invention relates to a method of filtering an e-mail in a switch. More particularly, the e-mail is classified and filtered by each item in the switch. A method of filtering e-mail by performing a search.

In general, an e-mail is a communication method for exchanging letters or various information between computer users using a computer communication network. The e-mail may be sent when the sender wants it, or may be sent with a file attached.

These e-mails are flooded with advertisements that want to promote their products as their population grows exponentially. In addition, as an illegal attempt to achieve an illegal purpose using the characteristics of the electronic mail, a virus mail is transmitted to a random recipient. As such, there are frequent cases in which a great deal of mental and physical damage is caused to users who use e-mails due to advertisement mails or virus mails.

In general, the filtering method of e-mail is to check the status of the e-mail through spam mail or virus scan on the e-mail received from the mail server to delete the e-mail or delete the e-mail. This is done by informing the user that it is mail.

The e-mail filtering method in the conventional switch is a method of filtering the e-mail by comparing simple strings in packet units of the e-mail without tracking the state of the e-mail protocol. This conventional e-mail filtering method increases packet processing time and causes network performance degradation by performing the same search for all packets until the e-mail connection is terminated. For example, when filtering the subject of an e-mail, a search is performed on an attachment packet that does not need to be searched, and thus an unnecessary load is generated to filter the e-mail. In addition, since the string is filtered only by one packet unit, there is a problem in that the search is not possible when the mail item and the argument are divided into several packets.

The present invention has been made to solve the problems of the prior art, and to provide a method for filtering e-mail by combining packets for items to be filtered in a switch for switching the transmission of the e-mail. do.

Another object of the present invention is to provide a method of filtering an e-mail by combining packets to support filtering of a command that is split into several packets by tracking the protocol state of the e-mail in a switch.

It is also an object of the present invention to provide a method for filtering an e-mail that does not perform a search for an unnecessary e-mail item such as an attachment search in a switch.

In order to achieve the above object, a method for filtering an e-mail in a switch according to an embodiment of the present invention comprises the steps of receiving a packet of the e-mail; Analyzing the received packet; Combining the packet associated with the item when the analyzed packet includes a filtering item, wherein the filtering item includes one of sender information, recipient information, subject information, and a body. Includes-; Searching for a string to be filtered in the combined packet; And filtering the e-mail when the string to be filtered is found in the combined packet.

In addition, the method for filtering the e-mail in the switch according to another embodiment of the present invention includes the steps of receiving a packet of the e-mail; Filtering a string of the sender's e-mail address when the received packet includes e-mail address information of a predetermined sender; Filtering a string of an e-mail address of a receiver when the received packet includes e-mail address information of a predetermined receiver; Filtering a string of the subject of the e-mail when the received packet includes the subject of the e-mail; And filtering the character string of the body of the e-mail when the received packet includes the body of the e-mail, wherein the character string of the sender's e-mail address, the character string of the recipient's e-mail address, and the e-mail. The filtering of the string of the subject of the mail or the string of the body of the e-mail may include searching for a predetermined string in the received packet; Determining whether the string matches a predetermined factor of an OR filter list or an AND filter list if the string exists, wherein the OR filter list compares the string with the factor according to an OR logic to filter the e-mail A list for filtering, said AND filter list for filtering said e-mail by comparing said string and said factor according to AND logic; And blocking the session of the e-mail when the character string matches the OR filter list or the factor of the AND filter list.

The present invention supports base64 and quoted printable decoding, supports 2-byte character string input including Korean characters, and can support filtering of multiple e-mail transmissions in one SMTP connection.

The OR filter list used in the present invention is a list for filtering an e-mail by comparing a predetermined string and an argument according to OR logic, and the AND filter list filters an e-mail by comparing a predetermined string and an argument according to AND logic. It is a list to do.

Hereinafter, a method of filtering an e-mail according to the present invention will be described in detail with reference to the accompanying drawings.

1A is a diagram illustrating a state transition diagram for filtering an e-mail by tracing connection state of an SMTP session according to an embodiment of the present invention.

Referring to FIG. 1A, when the switch receives a packet including a first string (eg, “MAIL FROM:”) associated with a sender's e-mail address in an initial state (INIT) 100, the switch receives a sender receive state ( SENDER_RCVD) 110. The first string is a string for indicating that the subsequent string is the sender's e-mail address, such as "MAIL FROM:".

The switch transmits the sender's electronics contained in the received packet until all packets containing the second string (eg, "RCPT TO:") associated with the recipient's e-mail address are received in the sender reception state 110. Perform a filtering operation on the mail address. The second string is a string for notifying that the subsequent string is an e-mail address of the receiver, such as "RCPT TO:". The switch performs a filtering operation on the sender's e-mail address included in the received packet in the sender reception state 110 and stops receiving the e-mail when the filter is matched (DROPPED). 120). The switch transitions to a receiver reception state (RECIPIENT RCVD) 130 when all packets including the second string are received in the transmitter reception state 110.

The suspended state 120 is a state in which a session is dropped, and when the FIN / RST is received, the suspended state 120 enters the terminated state 170. All packets of the session are dropped without checking.

The receiver reception state 130 is a state in which all packets including the second string indicating that the data associated with the receiver's electronic mail address are received. When the switch receives the data command in response to receiving a plurality of packets including the second string when the number of recipients of the e-mail is received in the receiver 130, the second string is no longer received. I judge it. The switch performs a filtering operation on the recipient's e-mail address in the recipient reception state 130 and transitions to the interruption state 120 which stops receiving the electronic mail when the filter is matched. The switch retrieves a third string (e.g., "Subject:") associated with the subject of the received e-mail in a recipient reception state 130, and, if the third string is found, a SUBJECT RCVD ( 140). The third string is a string for indicating that the subsequent string is the subject of the received e-mail, such as "Subject:". The switch enters the SUBJECT NONE 150 when the search limit is reached while searching for the third string in the receiver reception state 130. The switch searches for a delimiter when the third string is present in the packet in the receiver reception state 130 and defines a string between them as a body string. Since the body is searched in the electronic mail data, the position in the packet is variable and can be divided into several packets. The switch transitions to the DATA FINISHED 160 when EOM (End Of Mail, CRLF.CRLF) is received in the recipient reception state 130.

The subject reception state 140 is a state in which the third string is successfully searched in the e-mail body, and filtering of the subject of the e-mail body is performed.

The subject search abandoned state 150 is a state in which the search for the third character string is abandoned in the mail body by a value set as a search limit.

The data end state 160 is a state in which the EOM is received and the reception of the mail body is terminated. When the FIN / RST is received, the data end state 160 enters the end state 170. The switch then closes the connection or attempts to send a new e-mail starting with the first string.

The state of the SMTP session is stored in a session entry. When the SMTP packet is received, the session information is first retrieved to obtain the current state, and other operations are performed according to the state.

The present invention uses a data structure as shown in FIG. 1B to store session information of SMTP.

In the session information according to the present invention, since information needs to be aggregated over several packets to be compared with a filter, not only the state of the session but also information necessary to match the filter is stored.

Referring to FIG. 1B, the mail session table piosec_mail_session_table is a session hash table that is a hash index of a session IP / port. The mail list m_list of the session entry smtp_session_entry is connected, and a collision occurs. Is added after. The mail expiration list (piosec_mail_expire_list) is an expiration list for deleting an expired session. The expiration list (expire_list) of the session entry (smtp_session_entry) is connected, arranged by access time (access_time), and session information is displayed. Upon reading, the access time is updated.

The destination port is fixed at 25 and contains the following Src Ports to avoid collisions when multiple sessions connect on the same source IP / DstIP. You can use the (hash) function.

(Source IP Address + Destination IP Address + Source Port)% HASH_TABLE_SIZE

The hash key is used as an index to search for sessions whose source address (saddr), destination address (daddr) and source port (sport) match in the linked list of the Session Table.

The retrieved session entry sets the access time to the current time and moves to the tail of the expired list.

In the present invention, a structure as shown in FIG. 1C may be used to store filter information set by a user.

Referring to FIG. 1C, the first mail filter list pisec_mail_and_filter is a list of filters whose state is and, and the second mail filter list piosec_mail_or_filter is a list of filters whose state is or.

Each filter is managed as a separate list because the main state uses different comparison methods according to AND / OR.

The structure of an instruction according to an embodiment of the present invention is as follows.

<COMMAND> <ARGUMENT> <DELIMITER>

If the command <COMMAND> is found, then the delimiter <DELIMITER> is searched and the string between the command <COMMAND> and the delimiter <DELIMITER> is considered as the argument <ARQUMENT>. The command is for distinguishing receiver information, sender information, and title information.

The delimiter <DELIMITER> normally uses CRLF, but can only retrieve CRs.

Therefore, the parts that can be divided into several packets are the command <COMMAND> and the argument <ARGUMENT>.

The switch according to the present invention needs to find sender, recipient, and subject information in order to filter the SMTP session. To find out each piece of information, do the following:

The switch searches for "CRLF" which is a delimiter when the first string is present in the packet received in the initial state 100. If the delimiter is found, the switch regards the string between the first string and the delimiter as a string associated with the sender's e-mail address. If the delimiter is not found, the switch considers the maximum e-mail length (256 bytes) as a string associated with the sender's e-mail address.

The switch searches for a delimiter when the second packet is present in the received packet in the sender reception state 110. If the delimiter is found, the switch considers the string between the second string and the delimiter as a string associated with the recipient's e-mail address. If the delimiter is not found, the switch considers a maximum e-mail length of up to 256 bytes as a string associated with the recipient's e-mail address. At this time, since the number of recipients who receive the electronic mail can be specified, a plurality of the second strings can be received.

The switch searches for a delimiter when the packet has the third string in the subject receiving state 140, and considers the string between the third string and the delimiter as a string associated with the subject of the received e-mail. Unlike the sender or the receiver, the title is searched in the data of the electronic mail, so the position in the packet is variable and can be divided into several packets.

E-mail data from the data command to the end of mail (CRLF.CRLF) can be divided into multiple packets, so when searching for keywords related to the subject of an e-mail, consider splitting into multiple packets. do. Upon entering the command search, the search status is recorded in the SMTP session information to enable the combination of several packets.

2 is a diagram illustrating a state transition diagram for performing a search for mail items and factors divided into packets according to an embodiment of the present invention.

Referring to FIG. 2, the switch transitions to the partial command state (PARTIAL_COMMAND) 210 when it detects a portion of the command at the end of the packet received in the NOTHING 200. The switch enters an abort state 220 when the search limit for the received packet is reached in the initial state 200.

Partial command state 210 is a state where a portion of a string associated with a receiver, sender, and subject is found at the end of the received packet. The partial instruction state 210 transitions to the initial state 200 when no combination of the instructions is made by combining the portion of the instruction found at the end of the received packet with the front portion of the next received packet after the packet. .

The command search state (COMMAND ONLY) 230 is a state in which only the command COMMAND is completely searched. The instruction search state 230 enters the partial argument state 240 when searching for delimiters in the packet, and enters the argument search state 250 when the delimiters are found.

PARTIAL ARGUMENT 240 searches for COMMAND but has not yet retrieved DELIMTER. The partial argument state 240 remains in the state until the delimiter is found and enters the argument search state 250 when the delimiter is found in the next packet or when the search limit is reached. .

The ARGUMENT FOUND 250 is a state in which the entire packet is searched from the received packet to the DELIMITER.

3A is a flow diagram of a method for filtering e-mail in a switch in accordance with an embodiment of the present invention.

Referring to FIG. 3A, in step 300 the switch receives a packet of electronic mail.

In step 310, the switch filters the string of the sender's e-mail address when the packet of the received e-mail includes the sender's e-mail address information. In step 310 of filtering the string of the sender's e-mail address, the switch searches whether the received packet contains the string of the sender's e-mail address. The switch determines whether the string of the retrieved sender's e-mail address matches a predetermined factor of an OR filter list or an AND filter list. The switch blocks the session of the received e-mail if the string of the sender's e-mail address matches the OR filter list or the factor of the AND filter list. When the switch receives a packet including a specific command, the switch extracts a predetermined argument and attempts to match the OR filter list and the AND filter list. If the argument matches the OR filter list or the AND filter list, the switch blocks the session including the factor and searches for the OR filter list having a high probability of matching since no further matching is required. The OR filter list is determined immediately if a match is made in the current state, and thus does not refer to the previous state. When comparing with the AND filter list, the switch may compare only the list of filters that matched in the previous state according to the state recorded in the session information. If a match is found, the switch determines whether the matched filter should also be compared with a later state condition. If a comparison with a later state condition is necessary, the switch adds the filter to the list and continues the comparison.

In step 320, if the received packet includes e-mail address information of a predetermined receiver, the switch filters a string of the e-mail address of the receiver. In step 320, the string of the recipient's e-mail address is filtered to determine whether the received packet includes the string of the recipient's e-mail address. In step 320, it is determined whether the string of the retrieved recipient's e-mail address matches a predetermined factor of an OR filter list or an AND filter list. The switch blocks the session of the received e-mail if the string of the recipient's e-mail address matches the OR filter list or the factor of the AND filter list. When a packet containing the recipient's e-mail address is received, a string associated with the recipient's e-mail address is extracted from the received packet. In the case of the receiver, the OR filter list must be compared against all filters. However, in the case of the AND filter list, only the filters registered in the sender matching list of the session need to be checked. If a match is found in the AND filter list, the title condition is immediately blocked. If there is a subject condition, the filter is registered in the recipient matching list and the comparison is made with the next filter. Multiple recipients are allowed, so multiple recipient email addresses are allowed. So, we need to look at several packets to check for receiver matching according to sub condition. When the sub condition of the receiver is OR, it is possible to compare whether the string associated with the current receiver's e-mail address matches the filter and determine that the receiver is matched immediately. If the receiver's subconditions are AND, then a packet containing multiple recipients' e-mail addresses must be checked to see if they match all the strings in the filter to determine if the recipients match. Thus, a session matched with a filter whose receiver subcondition is AND records the index of the string matched with the filter in the receiver matching list of session information. In the future, if all string indices of a filter are marked as matched, then the receiver condition of that filter is matched. The receiver condition comparison continues until a data packet is received and, if the data packet is received, deletes the recipient matching list.

In step 330, the switch filters the string of the subject of the electronic mail if the received packet includes the subject of the electronic mail. The switch searches for the string associated with the subject of the email in the received packet to filter the string associated with the subject of the email. The switch determines whether the string associated with the title of the retrieved e-mail matches a predetermined factor of an OR filter list or an AND filter list. The switch blocks the session of the received e-mail if the string associated with the e-mail subject matches the OR filter list or the argument of the AND filter list. The subject of the electronic mail is included in the data of the electronic mail received after the data packet. Therefore, the subject of the electronic mail can be found anywhere in the received packet, and the command itself can be divided into several packets. The string associated with the subject of the e-mail may be encoded. If it is encoded as base64 or quoted printable, it is decoded and compared with the filter. In the case of matching the AND filter list with the string associated with the subject of the e-mail, only the filters in the recipient matching list of the session need to be compared.

In the present invention, as shown in FIG. 3B, a plurality of strings may be input for each of a sender, a receiver, and a title, and all may be combined by AND / OR. The input string may limit the input as shown in FIG. 3C. When the filtering item of the e-mail according to an embodiment of the present invention is a subject, a long sentence including a space may be input, and the subject may be input of a 2-byte character including Korean.

4 is a flowchart illustrating a method of filtering a sender's e-mail address according to an exemplary embodiment of the present invention.

Referring to FIG. 4, in step 410, the switch retrieves a first string (e.g., " MAIL FROM: ") associated with the sender's e-mail address in the received packet in an initial state at which the packet was received. In step 420, the switch determines whether the first string exists. If the first string exists, in step 430, the switch searches for a predetermined delimiter by searching the string after the first string. In step 440, the switch determines whether the delimiter is present.

If the delimiter is present, in step 450 the switch considers the string between the first string and the delimiter as a string associated with the sender's e-mail address. In step 460, the switch sequentially matches a string associated with the sender's e-mail address with a factor included in the OR filter list and the AND filter list.

In step 470, the switch determines whether the string associated with the sender's e-mail address matches a factor included in the OR filter list and the AND filter list. If the string associated with the sender's e-mail address matches the factor, then the switch stops packet inspection of the e-mail at step 480.

5 is a flowchart illustrating a method of filtering a sender's e-mail address by an AND filter list according to an exemplary embodiment of the present invention.

Referring to FIG. 5, in step 510, the switch attempts to match the AND filter list with a string associated with the sender's e-mail address. In step 520, the switch determines whether a match of the string associated with the sender's e-mail address in the AND filter list is successful. If the matching is successful, in step 530 the switch retrieves a matching condition for the recipient's email address or the subject of the email. In step 540, the switch determines whether a matching condition exists for the recipient's email address or the subject of the email. If the matching condition exists, in step 550, the switch performs e-mail filtering on the matching condition. If the matching condition does not exist, in step 560 the switch immediately blocks the packet of the e-mail.

6 is a flowchart illustrating a method of filtering an e-mail address of a receiver according to an embodiment of the present invention.

Referring to FIG. 6, in step 610, the switch searches the received packet to see if there is a second string associated with the recipient's e-mail address in the received packet. In step 620, the switch determines whether the second string exists in the received packet. If the second string exists, in step 630, the switch searches for the string after the second string in the received packet to determine whether a predetermined delimiter exists after the second string. In step 640, the switch determines whether a predetermined delimiter exists in the searched string. If the delimiter is present, in step 650 the switch considers the string between the second string and the delimiter as a string associated with the recipient's e-mail address. In step 660 the switch compares the string associated with the recipient's e-mail address with a factor of the OR filter list or the AND filter list.

In step 670, the switch determines whether the string associated with the recipient's e-mail address and the factors of the OR filter list or the AND filter list match. If the string associated with the recipient's email address and the argument of the OR filter list or the AND filter list match, the switch stops packet inspection of the email in step 680. When there are a plurality of recipients, a string associated with the recipient's e-mail address is searched for by the recipients.

7 is a flowchart illustrating a method of filtering an e-mail address of another recipient by an AND filter list according to an embodiment of the present invention.

Referring to FIG. 7, in step 710, the switch determines whether the AND filter list matches. In case of a match of the AND filter list, in step 720, the switch checks only a filter registered in the sender matching filter. In step 730, the switch matches the string associated with the recipient's email address with the AND filter list.

In step 740, the switch determines whether the string associated with the recipient's e-mail address matches the AND filter list. If matched with the AND filter list, a matching condition for the subject of the e-mail is searched for in step 750. In step 760, it is determined whether there is a matching condition for the subject of the electronic mail. If there is no matching condition for the subject of the e-mail, in step 770 the switch blocks the e-mail. If there is a matching condition for the subject of the e-mail, in step 780 the switch includes registering the filter in a matching list of predetermined recipients and comparing the next filter.

8 is a flowchart illustrating a method of managing a recipient matching list according to an embodiment of the present invention.

Referring to FIG. 8, in step 810, the switch matches all strings of the AND filter to determine whether to match a string associated with the recipient's e-mail address according to the AND filter list. In step 820, the switch determines whether the receiver is plural. When there are a plurality of recipients, in step 830, the switch records the information about the matched session in the matching list of the receiver in the list corresponding to the filter and the index corresponding to the string.

In step 840, it is determined whether a predetermined data packet is received. Matching of the recipient's e-mail address is continued until the data packet is received. When the data packet is received, in step 850 the switch deletes the recipient's matching list.

9 is a flowchart illustrating a method of filtering an electronic mail subject according to an embodiment of the present invention.

Referring to FIG. 9, in step 910, the switch searches for the packet to determine whether there is a third string associated with the subject of the e-mail while all packets are received. In step 920, the switch determines whether the third string exists in the retrieved packet. If the third string exists, in step 930, the switch searches for the string after the third string to determine whether a predetermined delimiter exists. In step 940, the switch determines whether the delimiter exists in the searched string. If the separator exists, in step 950 the switch regards the string between the third string and the separator as the subject of the e-mail. In step 960, the switch matches a string associated with the subject of the e-mail with a predetermined factor of the OR filter list or the AND filter list. In step 970, the switch determines whether the string associated with the subject of the e-mail and a predetermined factor of the OR filter list or the AND filter list match. If the string associated with the subject of the email matches a predetermined factor of the OR filter list or the AND filter list, the switch stops filtering the email in step 980.

On the other hand, when the string associated with the subject of the e-mail is divided into packets, the multiple packets are combined to filter the string associated with the subject of the e-mail.

In order to match a string associated with the subject of the e-mail with a predetermined factor of the OR filter or the AND filter list, a string associated with the subject of the e-mail is a predetermined factor of the OR filter list or the AND filter list at the end of the packet. If a part is found, the end of the packet is combined with the first part of the next packet of the packet, and then the matching packet is compared with the factor in the combined packet to determine whether there is a matching string.

When a packet including the sender's e-mail address is received, a string associated with the sender's e-mail address is extracted, and since there is no previous state, all OR filter lists and AND filter lists are matched in sequence.

If a match is successful in the AND filter list, if the filter has a receiver or a subject condition, the filter is added to the sender matching list of the session, and the next filter is compared. If there is no recipient or subject condition, block immediately.

The switch may match the OR filter list with the factor before the AND filter list when determining whether a predetermined factor with respect to the string matches the OR filter list or the AND filter list. The factor may be a specific character related to the recipient, sender, and subject information to be filtered in the electronic mail.

Although the present invention has been described with an embodiment of filtering an email for a sender, a receiver, and a subject as an email filtering factor (item), an item to be filtered on a packet received from a switch is not limited to filtering related to the sender, the receiver, and a subject. If included, it is applied to a method of filtering an e-mail by combining the received packets.

When the switch determines whether a predetermined factor is matched with the OR filter list or the AND filter list for the string, the switch matches the filters that succeeded in the previous state according to the state recorded in the session information. You can also compare only lists.

The switch further includes maintaining a session expiration list that sorts the session of the e-mail according to access time and deleting the session of the e-mail with no activity for a predetermined time with reference to the session expiration list. You may. The switch must maintain session information for a certain period of time in order to prevent the retransmission packet from being passed until a separate FIN / RST packet is received in the case of the session in which the packet was interrupted. The switch must release session information that has not been active for a long time in case the memory is exhausted and the session is not deleted due to abnormal network conditions. The switch does not set one timer for each session, but deletes inactive sessions at a time through the global timer. To do this, the switch maintains a session expiration list, sorted according to the access times of sessions separate from the session table for one session entry. The session expiration list is arranged in order from the oldest session to the newest session.

The switch sets the access time to the current time when the session entry is created and adds it to the tail of the session expiration list. When a predetermined packet is received, the switch updates the access time when taking the information of the session entry, and moves the session entry to the end of the expiration list. The timer for deleting the expired sessions is set to execute a timer function at each set time. The switch proceeds from the head of the session expiration list in order and deletes the session if the access time and the current time differ by more than a predetermined time. Since the session expiration list is sorted in chronological order, the switch stops searching immediately when an unexpired session comes out.

Embodiments of the invention also include computer-readable media containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above-described embodiments, which can be variously modified and modified by those skilled in the art to which the present invention pertains. Modifications are possible.

Accordingly, the spirit of the present invention should be understood only by the claims set forth below, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

According to the present invention, the performance of the e-mail transmission can be improved by tracing the state of the SMTP connection protocol in the switch so as not to search the e-mail item which is unnecessary in the current state.

In addition, according to the present invention, it is possible to increase the accuracy of the e-mail filtering by searching for a string after recombining the items and factors of the e-mail is divided into several packets.

In addition, according to the present invention, it is possible to set a keyword search range for an item that is selectively present, such as a subject of an e-mail, and to periodically remove sessions that have elapsed a certain time in abnormal network conditions.

Claims (12)

delete A method for filtering an e-mail in switch means for switching the packet transmission of the e-mail, Receiving a packet of the e-mail; Analyzing a packet of the received e-mail, and combining a packet related to the filtering item when the packet of the analyzed e-mail includes a predetermined filtering item; And Filtering a string of an e-mail address of a sender, a string of an e-mail address of a receiver, a string of a subject of an e-mail, or a string of a body of the e-mail in the combined packet; Maintaining a session expiration list that sorts the sessions of the e-mail according to access time; And Deleting the session of the e-mail with no activity for a predetermined time by referring to the session expiration list Including, The filtering of the string of the sender's email address, the string of the recipient's email address, the string of the subject of the email or the string of the body of the email in the combined packet may include: Searching for the presence of a predetermined string in the combined packet; Determining whether the string matches a predetermined factor of an OR filter list or an AND filter list, if the string exists; And Blocking the session of the e-mail if the string matches the OR filter list or the factor of the AND filter list. E-mail filtering method comprising a. The method of claim 2, The step of filtering the string of the sender's e-mail address Determining whether a first string associated with the sender's e-mail address is present in the combined packet; Searching for a character string after the first character string to determine whether a predetermined delimiter exists when the first character string exists; If the delimiter exists, considering a string between the first string and the delimiter as a string of the sender's e-mail address; Matching a string of the sender's e-mail address with a factor included in the OR filter list or the AND filter list; And Stopping packet inspection of the e-mail when the character string of the sender's e-mail address matches the factor. E-mail filtering method comprising a. The method of claim 2, The step of filtering the string of the recipient's email address Determining whether a second string associated with the recipient's e-mail address is present in the combined packet; Searching for a character string after the second character string to determine whether a predetermined delimiter exists when the second character string exists; If the delimiter is present, considering a string between the second string and the delimiter as a string associated with a recipient's e-mail address; Matching a string of the recipient's e-mail address with a factor included in the OR filter list or the AND filter list; And Stopping packet inspection of the e-mail when the string of the e-mail address of the receiver and the argument match. Including, And searching for a string of the e-mail address of the recipient for each of the recipients when the number of recipients is plural. The method of claim 4, wherein Matching the string of the recipient's e-mail address with a factor included in the OR filter list or the AND filter list Checking only filters registered in the sender matching filter in the case of the AND filter list; Determining whether a string of the recipient's e-mail address matches the AND filter list; Determining whether there is a matching condition with respect to a subject of the e-mail when the AND filter list is matched; Blocking the e-mail when there is no matching condition for the subject of the e-mail; And Registering the filter in a matching list of recipients when there is a matching condition with respect to a subject of the e-mail, and comparing the next filter. The method of claim 4, wherein Matching the string of the recipient's e-mail address with a factor included in the OR filter list or the AND filter list Determining whether or not all strings included in the AND filter list are matched to determine whether or not a string of the e-mail address of the receiver is matched according to the AND filter list; And And when the plurality of recipients are present, recording the information on the matched session in an index of a string matching the corresponding filter in a matching list of the recipients. The method of claim 6, Matching the string of the recipient's e-mail address with a factor included in the OR filter list or the AND filter list Continuing matching of the recipient's e-mail address until a predetermined data packet is received; And And when the data packet is received, deleting the matching list of the recipients. The method of claim 2, The filtering of the subject of the e-mail is Determining whether the packet has a third character string associated with a subject of the electronic mail when all the packets are received; Searching for a character string after the third character string to determine whether a predetermined delimiter exists when the third character string exists; If the delimiter exists, considering a string between the third string and the delimiter as a subject of the e-mail; Matching a string of a subject of the e-mail with a factor included in the OR filter list or the AND filter list; And Stopping filtering of the e-mail when a character string of the subject of the e-mail and a factor included in the OR filter list or the AND filter list match. Including, And when the character string of the subject of the e-mail is divided into multiple packets, searching for the combination of the various packets. The method of claim 8, The step of matching the string of the subject of the e-mail and the factors included in the OR filter list or the AND filter list is Combining the end of the packet with the first part of the next packet of the packet when a part of a predetermined factor of the OR filter list or the AND filter list is found at the end of the packet of the string of the subject of the e-mail; And And combining the packets and comparing the packets with each other to determine whether they match. The method of claim 2, In the case where the string exists, the step of determining whether a predetermined factor for the string matches the OR filter list or the AND filter list When matching with the AND filter list, the electronic mail filtering method, characterized in that only comparing the list of the filter that succeeded in the previous state according to the state recorded in the session information. delete A computer-readable recording medium for recording a program for executing the method of any one of claims 2 to 10 on a computer.

Images