KR101288585B1 - Firewall setting method using #-mail white list - Google Patents

Abstract

PURPOSE: Method for configuring a firewall of a mail server using a sharp mail white list is provided to make operation of a sharp mail messaging server system convenient and to facilitate maintenance and repair. CONSTITUTION: A transmission messaging server requests a release of a firewall with a firewall of a reception messaging server (S1). The firewall of the reception messaging server verifies an electronic signature of the reception message and checks a sharp mail white list. The firewall of the reception messaging server responds to the transmission messaging server with a random value. When the transmission messaging server receives the random value, a message containing the random value and firewall release request internet protocol (IP) is transmitted (S6). The transmission messaging server verifies the random value of the firewall release request message and the release request IP, releases the firewall and transmits a response message (S7). [Reference numerals] (10S,10R) #-mail messaging server; (12R) Firewall; (AA) Institution A; (BB) Institution B; (S1) Request the release of the firewall; (S4) Respond with a random value; (S6) Transmit the random value and IP; (S7) Complete the release of the firewall and respond; (S8) Transmit # mail message

Description

How to set up firewall of mail server using shopmail white list {FIREWALL SETTING METHOD USING # -MAIL WHITE LIST}

The present invention relates to a security technology of an electronic mailing system, and more particularly, an authorized to use for electronic signatures of institution information and messages operating a #mail server in a shop-mail (# -mail) system, which is an authorized email. It relates to a firewall setting method of a mail server using a shop mail white list that can automatically configure a firewall of a # mail server using a #mail white list including certificate information.

With the development of electronic communication technology, document distribution is changing rapidly from the existing paper documents to the electronic document distribution method. Until recently, the most widely used electronic document distribution method is a general e-mail, and is widely used in many fields such as personal processing, personal processing, and system-to-system automation with the spread of the Internet.

However, the conventional e-mail (# -mail) is an authorized document distribution method that replaces the ordinary e-mail because of limitations in public distribution due to the problem of flooding spam and problems of stability and reliability. ) Has emerged.

Shop e-mail is a public e-mail that sends and receives electronic documents using a public e-mail address. The e-mail is a service that checks the user (sender and receiver), checks the transmission and reception status, denies the transmission and reception, and proves the contents of the transmission and reception. .

On the other hand, in order to operate a #mail messaging server, it must communicate with a number of #mail messaging servers and address directory servers on the Internet.

1 is a schematic diagram showing a firewall structure of a typical shopmail messaging server.

Referring to FIG. 1, a firewall 12 is installed in a DMZ area of each organization to prevent illegal intrusion into the corresponding #mail messaging server 10, and the messaging server 10 of each organization is provided with a firewall 12. Are exchanging messages with each other. Therefore, the #mail messaging server administrator must disable the firewall each time the IP address of the sending #mail messaging server is first transmitted. However, this method is not inconvenient when the number of transmit / receive servers is small, but as the transmit / receive servers increase, it is out of a range that can be managed by an administrator.

In addition, the NIPA manages, updates, and periodically distributes the mail white list to manage the information of the messaging server for sending and receiving mail. You can use the information on the white list to filter messages on the #mail server, but more fundamentally, to prevent system security issues, DDoS attacks, etc. It is necessary to block.

(Patent Document 1) KR10-1223674 B1

The present invention has been proposed to solve the above problems and to meet the necessity, an object of the present invention is to provide information and messages to the agency that operates the # mail server in the authorized e-mail shop (# -mail) system It provides a method of setting up a firewall of a mail server using a shop mail white list that can automatically configure a firewall of a # mail server using a #mail white list that includes public certificate information used for signing.

In order to achieve the above object, the method of the present invention comprises the steps of: requesting the firewall of the receiving messaging server to release the firewall from the sending messaging server; Verifying, by the firewall of the receiving messaging server, the electronic signature of the received message and checking the #mail white list; The firewall of the receiving messaging server responds randomly to the sending messaging server; When the sending messaging server receives the random value, transmitting a message including the random value and the firewall release request IP; and after verifying the random value and the release request IP of the firewall release request message, release the firewall and transmit a response message. Characterized in that it comprises a step.

The firewall setting method may further include receiving a #mail transmission message by a receiving messaging server when the sending messaging server transmits a #mail transmission message after the firewall is released.

The #mail white list is values that a #mail messaging server can obtain from an address directory server, and includes a sender / receiving entity registrant real name (PeerName), a business number of a sender / receiving entity (PeerIDN), and a send / receive entity authentication number (PeerRegNum). And a hash value (PeerCertHashValue) of the certificate used when signing the message. The firewall checks and verifies the white list of the #mail messaging server after receiving the firewall firewall request message. In this case, the firewall is divided into a #mail firewall support module for requesting a firewall release and processing a firewall release response.

According to the present invention, the firewall of each mail server system is automatically set by using the mail white list of the address directory server, so that the operation of the mail messaging server system is convenient and the maintenance of the mail messaging server is easy. .

1 is a schematic diagram showing a firewall structure of a general mail server;
2 is a schematic diagram showing an electronic document distribution system to which the present invention can be applied;
3 is a flowchart illustrating a firewall setting procedure of a #mail messaging server according to the present invention;
4 is a flowchart illustrating a #mail message transmission procedure according to the present invention;
5 is a schematic diagram showing a procedure for securing a white list in the present invention;
6 is a schematic diagram showing in detail a firewall of a mailing server in which the present invention is implemented.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings. The following examples are merely illustrative of the present invention and are not intended to limit the scope of the present invention.

2 is a schematic diagram showing an electronic document distribution system to which the present invention can be applied.

The electronic document distribution system for public standard electronic document distribution, as shown in FIG. 2, establishes an electronic document distribution hub 20 that can be managed in a country, and also sends mail messages to each company, a public institution, or a message distribution center. A server 10 is built to distribute electronic documents through a client application 30 between a company, an institution, and an individual.

According to the recently revised Electronic Document and Electronic Commerce Basic Law, a certified electronic address is information consisting of letters and numbers to identify a person who sends or receives an electronic document. It is an officially registered address. It consists of "User Account (ID) + Separator (#) + Company / Personal Unique Name. Attributes.kr". As such, the mailing system based on the authorized electronic address is called a shop mail (# -mail) because it uses "#" instead of the conventional "@" as a separator, and thus "@" as a separator as in the prior art. The system using is called e-mail.

Certified Electronic Address System User Account (ID) + Separator (#) + Company / Personal Unique Name. Example 1 jin # docgojin.pe.kr Example 2 plan # ABC.com Example 3 e-docu # nipa.or.kr

2, the electronic document distribution hub 20 includes an address directory server 21, a distribution relay server 22, an electronic document form register 23, a distribution certificate issuing server 24, and each company A corporate user is connected to the #mail messaging server 10 of the company, and users of individuals or small businesses are connected to the #mail messaging server 10 of the message distribution center to distribute electronic documents according to the #mail addressing system based on P2P communication. I can do it.

The address directory server 21 is a server that registers and manages a public electronic address for a transceiving entity and a lower user account participating in distribution, and provides physical addresses and security information for recipients required for electronic document distribution. In addition, the address directory server 21 has a #mail white list used in the present invention, the #mail white list information is configured as shown in Table 2 below.

Information name Information Description PeerName Transceiver Object Registrant Real Name PeerIDN Operator number of the sending and receiving object PeerRegNum Sending and receiving object authentication number PeerCertHashValue Hash value of the certificate used to sign the message

Referring to Table 2, the white list information is values that the #mail messaging server 10 can obtain from the address directory server 21, and 'PeerName' is a real name of a sender / receiver entity registrant. , 'PeerIDN' is the business number of the sending and receiving entity, 'PeerRegNum' is the sending and receiving entity authentication number, and 'PeerCertHashValue' is the hash value of the certificate used when signing the message.

The #mail sending messaging server sends the digitally signed message, and the receiving #mail messaging server performs the digital signature verification on the digitally signed message and compares the certificate hash value of the whitelist information with the certificate included in the digital signature. Checks if is a sender registered on the white list.

The #mail messaging server 10 provides a message sending / receiving function for distributing electronic documents based on the #mail messaging server standard, and physically has a single electronic address but issues a plurality of user accounts for subordinate users. And each user account has one public electronic address.

The client application 30 is an application that provides a UI for sending and receiving documents, viewing and managing received documents for users who participate in document distribution, and cannot independently transmit and receive documents. Should be linked.

The electronic document relay server 22 is a system that attempts to transmit a document on behalf of the sender when the sender attempts to distribute the document to the receiver. The electronic document relay server 22 is a third authority that can prove the sender's transmission effort. When the transmission agent is requested to prove the effort, the transmission certificate is issued to the sender.

The standard electronic form register 23 registers, manages, and registers document forms for use by user applications such as the client application 30, while registering and managing standard document forms to assist users in creating electronic documents more easily. This system supports downloading and deleting.

The distribution certificate issuing server 24 receives and stores the contents of the distribution fact (distribution confirmation) through the relay system in order to secure the legal basis for the distribution of electronic documents between companies, institutions, and individuals. When issuing a certificate.

3 is a flow chart illustrating a firewall setting procedure of a #mail messaging server according to the present invention, and FIG. 4 is a flowchart illustrating a message transmission procedure according to the present invention.

According to the present invention, a procedure of automatically setting a firewall using a white list of #mails is performed by the sending messaging server 10S at the firewall 12R of the receiving messaging server 10R, as shown in FIGS. 3 and 4. Requesting to release the firewall (S1), the firewall 12R of the receiving messaging server verifies the digital signature of the received message and checks the #mail white list (S2, S3), the firewall 12R of the receiving messaging server Responding to the sending messaging server 10S with a random value (S4), and when the sending messaging server 10S receives the random value, sending a digitally signed message carrying the random value and the firewall release request IP (S5, S6). ), After the firewall 12R of the receiving messaging server verifies the random value of the firewall release request message and the release request IP, the firewall 12R releases the firewall 12R and transmits a response message (S7). Sending outgoing messages In step S8, the receiving messaging server 10R is configured to receive a #mail transmission message (S9).

Referring to FIGS. 3 and 4, the identity of the #mail transmission / reception target is basically identified by a white list of the ICT Industry Promotion Agency. Accordingly, the present invention uses the white list information to determine whether the sending messaging server 10S uses the white list information. The server sending the electronically signed message is believed to release the firewall 12R at the receiving messaging server 10R.

If the firewall is not turned off when the sending message server 10S wants to send a message to the receiving message server 10R, the flow for firewall release requests (S1) firewall release, as shown in FIG. It responds (S4), transmits a random value and IP (S6), responds to the firewall release completion (S7), and sends a #mail message (S8) when the firewall is released.

In addition, when the sender sends a message to the receiver, the flow of transmit / receive values is as shown in FIG. 4, and the firewall release request message is electronically signed by the sending messaging server 10S to the firewall 12R of the receiving messaging server 10R. Transmitting (S1), the firewall of the receiving messaging server receives the firewall release request message (S2), verifying the digital signature of the received message and checking the #mail white list (S3), the receiving messaging server The firewall responds with a random value (S4), the transmitting messaging server 10S receives the random value (S5), and transmits an electronically signed message including the received random value and the firewall release request IP ( S6), after verifying the random value of the firewall release request message and the release request IP, releasing the firewall and transmitting a response message (S7), and sending the #mail transmission message by the sending messaging server 10S ( S8), the receiving messaging server 10R is configured to receive the #mail transmission message (S9).

Figure 5 illustrates the process of the firewall to obtain a white list from the messaging server in the present invention.

Referring to FIG. 5, the address directory server 21 of the electronic document distribution hub 20 has a white list, and the #mail messaging server 10 obtains and manages the height list from the address directory server 21. When the firewall 12 receives the firewall release request, the firewall 12 checks the white list of its #mail messaging server 10 to verify the message server that requested the release.

FIG. 6 is a diagram of a firewall to which the present invention is applied, divided into a general firewall 12-1, which is a legacy system, and a #mail support firewall module 12-2. And the #mail firewall support module 12-2 for performing the function according to the present invention, the #mail firewall support module 12-2 may query the white list of the #mail messaging server 10. .

Referring to FIG. 6, the #mail firewall support module 12-2 implemented according to the present invention has a general firewall 12-1 having a firewall release, a request related message interpretation function, an electronic signature verification function, a white list acquisition function, and the like. ) Has a function to support. That is, when the #mail firewall support module 12-2 receives the firewall release request message, the #mail firewall support module 12-2 searches and verifies the white list of the #mail messaging server, and if the registered authority requests the firewall release from the general firewall 12-1, Handle the firewall disable response.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

10: #mail messaging server 10S: sending messaging server
10R: Incoming Messaging Server 12,12R: Firewall
12-1: Generic Firewall 12-2: #Mail Firewall Support Module
20: Electronic Document Distribution Hub 21: Address Directory Server
22: distribution relay server 23: electronic document register
30: Client Application

Claims (4)

Requesting, by the sending messaging server, the firewall of the receiving messaging server to release the firewall;
Verifying, by the firewall of the receiving messaging server, the electronic signature of the received message and checking the #mail white list;
The firewall of the receiving messaging server responds randomly to the sending messaging server;
When the sending messaging server receives a random value, transmitting a message including a random value and a firewall release request IP; and
A method of setting a firewall of a mail server using a shopmail white list, comprising: verifying a random value of a firewall release request message and a release request IP, and then releasing the firewall and sending a response message.
According to claim 1, The firewall setting method,
And if the sending messaging server transmits the #mail transmission message after the firewall is released, the receiving messaging server further includes the step of receiving the #mail transmission message.
The method of claim 1 or claim 2, wherein the #mail white list is
# Values that the mail messaging server can obtain from the address directory server, which are the sender / receiver entity registrant name (PeerName), the provider number of the sender / receiver entity (PeerIDN), the sender / receiver entity authentication number (PeerRegNum), and A method of setting up a firewall of a mail server using a shopmail white list, which includes a certificate certificate hash value (PeerCertHashValue).
The system of claim 1 or 2, wherein the firewall is
Legacy firewalls, which are legacy systems,
When receiving the firewall release request message, the white mail list of the #mail messaging server is searched and verified. If the registered agency requests the firewall to be released to the general firewall, it is divided into a #mail firewall support module that processes the firewall release response. How to set up firewall of mail server using shopmail white list.

Images