KR102526530B1 - blocking method for Web mail and system thereof - Google Patents

Abstract

A web mail blocking system according to the present invention, which may improve the quality of a mail security service, comprises: a web mail blocking service client unit that is installed in a user terminal; and a web mail blocking service server that collects web data of a web server to which the user terminal is connected through the web mail blocking service client installed on the user terminal, determines when the web data has an input type with a predetermined number or more and includes a specific letter as web data for a web mail service, checks whether the web server providing the web data is registered in a blacklist, and commands the user terminal to block the connection with the web server providing the web data when the web server is registered in the blacklist and to display the web data of the web server when the web data is not for the web mail service.

Description

Method for blocking use of web mail and system therefor {blocking method for Web mail and system thereof}

The present invention relates to a webmail management technology, and more particularly, to block the use of webmail using unreliable web service providers and to effectively manage blacklist information of web service providers that provide webmail services. It relates to a method for blocking the use of web mail and a system accordingly.

E-Mail, which sends and receives mail through the network, provides not only basic postal functions but also the ability to transmit files. It is widely used because of its advantages.

Despite this convenience, if an employee of a company intentionally or not sends confidential documents within the company by e-mail, there is a risk that the company's confidential information will be leaked immediately. Accordingly, companies are preparing a system to monitor whether or not confidential information is included in e-mails sent to the outside.

In such a conventional security system, an administrator manually extracts words included in a confidential document to build a separate database, and determines whether or not a confidential document is included in an email based on whether or not an outgoing email includes words stored in the database. Determine Then, e-mails containing confidential documents are separately classified and managed.

However, in such a conventional security system, since a manager manually reviews and manually extracts important words from a vast amount of company documents, word extraction is very difficult and takes a long time. It was also a very difficult problem for administrators to decide which words to extract when reviewing confidential documents.

As a prior art to solve this problem, there is a patent application No. 10-2001-0063063 filed with the Korean Intellectual Property Office under the name of an email monitoring method and system. Classifying as a general document; converting the document into a form applicable to a Support Vector Machine (SVM) algorithm; The plurality of converted documents are learned using the SVM algorithm to obtain a hyper-plane, which is a boundary that divides the confidential document and a general document, and a support vector, which is a vector of documents closest to the hyper-plane. a document learning step to calculate; sniffing e-mails sent out from within the group; converting the sniffed email into a form applicable to the SVM algorithm; Disclosed is a monitoring technology that includes determining whether the sniffed email is a confidential document by applying a support vector calculated as a learning result and an email converted into a vector form to an SVM algorithm.

In this way, as it is conventionally implemented to sniff all e-mail contents transmitted to the outside and determine whether all of the sniffed e-mail contents are confidential documents, when the scale of the company is large and the amount of e-mail transmitted is large, the data throughput is large and the processing time is large. There was a problem with this taking a lot.

Accordingly, in the related art, a method of managing web mail service providers that provide malicious web mail services as a blacklist has been adopted.

However, it was virtually impossible to find, verify, and register all of the tens or hundreds of webmail services around the world.

Accordingly, in the prior art, it is urgently required to develop a technology capable of effectively blocking and permitting webmail services and effectively managing a blacklist of webmail service providers to improve the quality of mail security services.

Furthermore, it is necessary to develop a technology capable of blocking only the web mail service while enabling web search, so that web documents provided by web service providers around the world can be viewed, but internal information cannot be leaked through the web mail service.

Republic of Korea Patent Registration No. 10-0999977 Republic of Korea Patent Registration No. 10-0483602 Republic of Korea Patent Registration No. 10-800776

An object of the present invention is to provide a method for blocking use of webmail and a system according to the method capable of effectively blocking and allowing webmail service and effectively managing a blacklist of webmail service providers to improve the quality of mail security service. do.

In addition, another object of the present invention is to block only the web mail service while enabling web search, so that web documents provided by web service providers around the world can be retrieved, but internal information is leaked through the web mail service provided by the web service provider. It is to provide a method of blocking the use of web mail and a system accordingly.

To achieve the above object, a webmail blocking system according to the present invention includes a webmail blocking service client unit installed in a user terminal; and web data of a web server accessed by the user terminal is collected through a web mail blocking service client installed in the user terminal, and if the web data has a predetermined number or more input types and includes specific characters, the web mail service is executed. If the web data is web data for the web mail service, it is checked whether the web server providing the web data is registered in the blacklist, and if the web server is registered in the blacklist, and a webmail blocking service server for blocking the connection with the web server that provided the web data and instructing the user terminal to display the web data of the web server if the web data is not for the web mail service. to be

The present invention effectively blocks and permits web mail service and effectively manages a blacklist of web mail service providers, thereby providing an effect of enhancing the quality of mail security service.

In addition, the present invention blocks only the web mail service while enabling web search, so that web documents provided by web service providers around the world can be retrieved, but internal information is not leaked through the web mail service provided by the web service provider. It provides an effect that can be done.

1 is a block diagram of a system for blocking the use of webmail according to a preferred embodiment of the present invention.
2 is a functional configuration diagram of the web mail blocking service server of FIG. 1;
3 is a flowchart of a method for blocking use of web mail according to a preferred embodiment of the present invention.
4 to 6 are diagrams illustrating an analysis process according to a preferred embodiment of the present invention.
7 is a diagram showing a process of collecting web mail data according to a preferred embodiment of the present invention.
8 is a diagram showing a process of analyzing web mail data according to a preferred embodiment of the present invention.
9 is a diagram showing a web mail data analysis result processing process according to a preferred embodiment of the present invention.
Figure 10 illustrates an application architecture according to a preferred embodiment of the present invention.
Figure 11 illustrates a webmail blocking architecture in accordance with a preferred embodiment of the present invention.

According to the present invention, the quality of mail security service can be improved by effectively blocking and allowing web mail service and effectively managing a blacklist of web mail service providers.

In addition, the present invention blocks only the web mail service while enabling web search, so that web documents provided by web service providers around the world can be retrieved, but internal information is not leaked through the web mail service provided by the web service provider. can do.

A web mail usage blocking method and system according to the present invention will be described in detail with reference to the accompanying drawings. Hereinafter, the embodiments to be described are provided so that those skilled in the art can easily understand the technical spirit of the present invention, and the present invention is not limited thereto. In addition, matters represented in the accompanying drawings may be different from those actually implemented in the drawings schematically illustrated to easily explain the embodiments of the present invention.

<Configuration Diagram of Web Mail Usage Blocking System>

1 is a block diagram of a system for blocking the use of web mail according to a preferred embodiment of the present invention. The webmail blocking system is composed of a webmail blocking service server 100, a database 102, and a webmail blocking service client 104.

The webmail blocking service server 100 performs an operation for a webmail usage blocking service according to a preferred embodiment of the present invention.

More specifically, the webmail blocking service server 100 is the web data of the web server 300 accessed by the user terminal 200 through the webmail blocking service client 104 installed in the user terminal 200. is collected, and if the web data has an input type of more than a predetermined number and includes a specific character, it is determined as web data for the web mail service, and if the web data is web data for the web mail service, the web data It is checked whether the web server 300 providing the web server 300 is registered as a blacklist, and if the web server 300 is registered as a blacklist, the connection with the web server 300 that provided the web data is blocked, and the web server 300 is blocked. If the web data is not for the mail service, the user terminal 200 is instructed to display the web data of the web server 300 .

Also, if the web server 300 is registered as a blacklist, the web mail blocking service server 100 blocks the connection with the web server 300 that provided the web data, and then redirects the connection to a predetermined URL. .

In addition, the webmail blocking service server 100, if the web server 300 is registered as a whitelist, maintains a connection state with the web server 300 and displays the web data to the user terminal 200. instruct with

The web mail blocking service server 100 determines that the web data is web data for a web mail service if there are more than a predetermined number of input types and a specific character is included in the web data and maintained for a predetermined time or longer.

The web mail blocking service server 100, if the web server 300 is not registered in the black or white list, blocks the connection state with the web server 300, and the web server 300 provides Crawl and store web data.

The webmail blocking service server 100 provides the crawled web data to an administrator terminal (not shown), and provides the web server 300 with the crawled web data according to a manager's request through the manager terminal. Register as a blacklist.

The database 102 stores various types of information for the webmail use blocking service according to a preferred embodiment of the present invention, and in particular, whitelist information, blacklist information, and web page crawling information according to a preferred embodiment of the present invention. save etc.

The webmail blocking service client 104 is installed in the user terminal 200 and performs operations for the webmail usage blocking service according to a preferred embodiment of the present invention.

More specifically, the webmail blocking service client 104 monitors access of the user terminal 200 to the web through the web browser 202 installed in the user terminal 200, and the web connected through the web. Web data provided by the server 300 is collected and provided to the webmail blocking service server 100, and upon request of the webmail blocking service server 100, the connection between the web servers 300 is blocked in advance. An operation such as redirecting to a predetermined URL or maintaining a connection with the web server 300 is performed.

<Functional configuration of web mail blocking service server 100>

2 is a functional configuration diagram of a webmail blocking service server 100 according to a preferred embodiment of the present invention. The webmail blocking service server 100 includes a validation unit, HTML analysis unit, data collection unit, and an agent.

The agent connects each part of the webmail blocking service server 100 and the user terminal 200 .

When the user terminal 200 accesses a web page for sending web mail, the validation unit inquires whether a service provider providing the web page is registered in the database 102 as a whitelist or a blacklist, and provides a result accordingly. A whitelist/blacklist detection module that receives and detects whether the service provider is a whitelist or a blacklist, a blocking processing module that blocks webmail service, a database connection module that is responsible for connecting to the database 102, and a webmail transmission module. If the service provider that provides the web page is not registered as a whitelist, it crawls the information about the webpage and provides the crawled information to the administrator to check whether it is added to the blacklist, and the information about the service provider is added to the blacklist. A blacklist management module to be added, and a redirection module that blocks webmail service by redirecting to a predetermined page if a service provider providing a webpage for sending webmail is not registered as a whitelist are included.

The HTML analysis unit analyzes an input type based on the HTML information connected by the web browser 202 of the user terminal 200, an event analysis unit analyzes an event, a specific character detector detects a specific character, and A parsing module that parses HTML information is included.

The data collecting unit collects HTML data, user input data, and URL data.

<Procedure diagram of web mail blocking service method>

3 is a diagram showing procedures of a webmail blocking service method applicable to the webmail blocking service system according to a preferred embodiment of the present invention.

3, when the web browser 202 of the user terminal 200 accesses the web server 300 of the web address entered according to the user's request and requests data, the web server according to the web address ( 300) transmits the requested data (step 500). When the requested data is received (step 502), the web server 300 returns web data according to the requested data to the corresponding user terminal 200. When the web data is received, the user terminal 200 temporarily stores it (step 506).

As described above, the e-mail blocking service client 104 installed in the user terminal 200 detects web access through the web browser 202 and transmits the corresponding web data to the web mail blocking service server 100 (step 508). ).

The web mail blocking service server 100 collects and analyzes the web data to determine whether the web data is for a web mail service, and if the web data is for a web mail service, whether the web service provider that provided the web data is whitelisted or not, the database A query is provided to (102), response data is provided, and analysis is performed (steps 510 and 512).

The webmail blocking service server 100 returns the analysis result of the web data to the webmail blocking service client 104 (step 514).

Thereafter, when the web mail blocking service server 100 is provided with an analysis result for the web data (step 515), it searches whether the web data is for the web mail service (step 516).

If the web data is not for the web mail service, the web mail blocking service server 100 instructs the web browser 202 to display the web data received from the web server 300 (step 517).

In contrast, if the web data is for the web mail service, the web mail blocking service server 100 checks whether the corresponding web service provider is registered in the white list (step 518). If the web service provider is registered as a whitelist, the web mail blocking service server 100 displays the web data received from the web server 300 so that the next operation can be performed (step 520). Here, the next operation becomes the web mail service.

If the web data is for web mail and the corresponding web mail service provider is registered as a blacklist (step 522), the web mail blocking service server 100 blocks access to the web server 300 and By redirecting to a predetermined URL, the provision of the web mail service is blocked (step 524).

If the web data is for web mail and the data for the service provider of the corresponding web mail is not registered in the database 102 (step 526), crawling is performed and access to the web server 300 is blocked. In addition, the web mail service is blocked by redirecting to a predetermined URL. Here, the crawled data is provided to an administrator, etc. to determine whether to be registered as a blacklist or a whitelist, and according to the determination result, it is registered in the blacklist or whitelist for effective management of the blacklist or whitelist. make it possible to fulfill

Here, crawling collects, classifies, and stores websites, hyperlinks, data, and information resources in an automated way, and software developed for crawling is called a crawler. The crawler accesses a given Internet address (URL), finds a related URL, finds other hyperlinks in the found URLs, classifies, and stores them repeatedly, going around various web pages to find out what data is It plays the role of creating an index where it is located and storing it in the database (DB). Similar to the crawling, there is scraping (also called data scraping) in which data itself is extracted from a data source such as a target website through software and stored in a specific form. In big data analysis, the two technologies are sometimes used in combination, such as finding out where the necessary data is through crawling, collecting and storing it through scraping, and using it for analysis. If this crawling technology is abused to copy information without permission, intellectual property rights infringement may occur. To prevent such a case in advance, the web page owner uses the robots exclusion standard on the web page and describes the access restriction description in robots.txt. Alternatively, you can block search indexing by the crawler using the 'noindex' meta tag.

When the web browser 202 of the user terminal 200 is instructed to display the information received from the web server 300 by the web mail blocking service client 104 (step 530), the information received from the web server 300 is received. displayed data (step 532).

In contrast, when the web mail blocking service client 104 instructs to block and redirect the web server, the connection to the web server 300 is blocked and redirected to a predetermined URL (step 534).

As described above, the present invention analyzes web data and, if it is web data for web mail service, checks whether the web service provider is blacklisted or whitelisted to provide or block the webmail service. As for the web service provider, after blocking the web mail service, the corresponding web service provider is registered in the black or white list after being determined by the administrator, thereby enabling efficient management of the black or white list.

In addition, the present invention determines whether the web service provider is black or whitelisted only for the webmail service and provides or blocks the webmail service, so that when accessing the blacklisted web service provider for web data inquiry only allows web data to be provided and displayed.

4 to 5 illustrate a web screen for providing a web mail service, and the web screen illustrated in FIG. 4 (a) includes a web mail service URL (1), a sender (2), and a recipient (3). ), CC (4), BCC, Subject (6), File attachment (7), Text writing (8), Send mail button (9), and the sender (s) can be identified by web analysis It is expressed as @naver.com, and you must put "text@text.text" in the recipient, and if you send it to several people, the format is the same. And if you expand the cc, the Bcc is displayed. The format is the same. The title is text. File attachments support various formats, here is a file search button and cloud, etc. And a mail send button is included as a must.

In the web screen illustrated in FIG. 4 (b), the webmail service URL (1), sender (2), recipient (3), CC (4), BCC, subject (6), file attachment (7) , text writing (8), mail sending button (9) are included, and the sender is ID@nate.com after analyzing the web. And you have to put "text@text.text" in the recipient. The title is written in text, and file attachments support various formats. This includes a Find Files button. And the send mail button is a must.

On the web screen illustrated in FIG. 5 (a), the mail service URL (1), sender (2), recipient (3), CC (4), BCC, subject (6), file attachment (7), It includes text writing (8) and mail sending button (9), and the sender is ID@hanmail.net after analyzing the web. And "text@text.text" must be put in the recipient. The subject is written in text, and file attachments support various formats. This includes a button to find files. And a button to send mail is essential.

On the web screen illustrated in (b) of FIG. 5, the mail service URL (1), sender (2), recipient (3), CC (4), BCC, subject (6), file attachment (7), It includes text writing (8) and mail sending button (9), and the sender is ID@gmail.com after analyzing the web. And "text@text.text" must be put in the recipient. The subject is written in text, and file attachments support various formats. This includes a button to find files. And a button to send mail is essential.

As described above, characteristics of HTML data for providing web mail services based on web screens for various web mail services are summarized as follows.

1. There are at least 3 input spaces in the HTML body.

To (required)

CC (required), BCC (required)

Title (required)

Content input space (required)

2. Input type exists.

Receiver/Sender

Subject

Contents

CC/BCC

Apply additional alternative words

3. There is a button event.

attachment

send button

A method for determining whether a web mail service is provided based on characteristics of HTML data for providing the above web mail service will be described.

That is, in the present invention, '@', '.' character exists, '@' + '. 2 or more', it is recognized as a webmail service outgoing page unconditionally.

In addition, the present invention recognizes the webmail service sending page by checking whether a send or parameter (message, email, mail) event exists.

In addition, the present invention recognizes the web mail service sending page by checking whether the user stays on the same page for a certain period of time and checking whether there is a drop-down tag for entering a domain (Textbox + @ + Dropbox).

6 illustrates an operation process for sending web mail according to a preferred embodiment of the present invention. Referring to FIG. 6, the operation on the web front side receives a user's input value, and then transmits the user's input value to the server along with a request when an event occurs. On the server side, logic is executed according to the request. At this time, the input value is set according to the format according to the API or email client used.

As described above, the present invention provides or blocks the web mail service by determining whether or not the web mail sending service is provided using HTML data, which will be described in more detail.

7 illustrates a process of collecting data based on HTML data according to a preferred embodiment of the present invention.

The webmail blocking service server 100 checks an outgong packet from the user terminal 200 in real time (80, 443) or receives HTML data whenever a refresh or new event occurs (step 600). The HTML data includes input types and identification information for text boxes and buttons.

If the number of text boxes is less than three, the webmail blocking service server 100 determines that it is not a webmail service and performs a corresponding operation (step 610).

In contrast, if there are three or more text boxes, the webmail blocking service server 100 detects text boxes and buttons and IDs (steps 604 and 606).

8 illustrates a process of verifying a webmail service using information on text boxes and buttons according to a preferred embodiment of the present invention.

When the input type is detected in the HTML data (step 700), the webmail blocking service server 100 detects identification information of text boxes and buttons (step 706), and determines whether the structure of the web page is for webmail service. (step 710). That is, there are three or more text boxes, specific characters (@,.) exist in the sender and receiver fields of the ID of the input type, and '@' + '. 2 or more', or if there is send (SEND) or specific parameters (MESSAGE, EMAIL, MAIL) among button IDs, it is a web page structure for web mail service.

If the HTML data indicates the web page structure for the web mail service (step 712), the web mail blocking service server 100 checks whether or not the user stayed on the corresponding web page for more than 5 minutes (step 714). Here, the time is to check the time to write mail, collect data for reference, and in the case of an environment where analysis is not possible, time can also be used as data.

The webmail blocking service server 100 provides a blocking service for the webmail service if the user stays on the web page for more than 5 minutes (step 716).

Unlike the above, if the input type is not detected in the HTML data, the webmail blocking service server 100 checks whether it is a dropbox type (TEXT + @ + DROPBOX) (step 702). The webmail blocking service server 100 provides a blocking service for web services (step 716).

Now, the web mail blocking service process will be described in detail with reference to FIG. 9 .

When the webmail blocking service server 100 is requested to block webmail (step 800), the webmail blocking service server 100 notifies via a pop-up that the webmail is to be blocked, simultaneously blocks web access and redirects to a predetermined URL (steps 802 and 804).

In addition, the webmail blocking service server 100 collects data through crawling and registers it in a blacklist (steps 806 and 808).

10 shows an application architecture according to a preferred embodiment of the present invention. When a data request is generated and web operation is recognized through communication with a web server, the corresponding data is received and the received data (html body) is analyzed. It detects the input type and event by the received data analysis block, parses the input type and event, determines whether or not to block mail through the analysis result, and sends the resulting value to the data processing module. to provide. The data processing module recognizes a web mail service sending page based on a result of parsing the input type and event, and blocks and redirects the web page or sends web mail according to the result.

and Fig. 11 shows a web mail blocking architecture according to a preferred embodiment of the present invention.

The web mail interception architecture includes a crawling unit, a process data gathering unit, and a process data analysis unit (process dad analysis).

The process data collection unit collects data such as an outgoing packet, a URL, an input type, and a timer counting value through a web page accessed by a user and a crawling unit.

And the process data analysis unit recognizes the webmail service sending page based on the sender/receiver, subject/contents, dropbox, and special characters, and blocks the webpage according to the result. Redirect or allow web mail outgoing.

The embodiments of the present invention described above have been disclosed for illustrative purposes, and those skilled in the art will be able to make various modifications, changes, and additions within the spirit and scope of the present invention, and these modifications , changes and additions should be considered to fall within the scope of the claims.

100: Webmail blocking service server
102: database
104: Web mail blocking service client
200: user terminal
202: web browser

Claims (12)

In the method of blocking the use of web mail,
A first step in which a webmail blocking service server collects web data provided by a web server accessed by the user terminal through a webmail blocking service client installed in the user terminal;
a second step of determining that the web data is web data for a web mail service if more than a predetermined number of input types and specific characters are included in the web data and maintained for a predetermined time or more;
If the web data is web data for the web mail service, a third step of checking whether a web server providing the web data is registered in a blacklist or whitelist;
a fourth step of blocking the connection with the web server that provided the web data if the web server is registered as a blacklist;
a fifth step of instructing the user terminal to display web data provided by the web server if the web data is not web data for the web mail service; and
If the web data is web data for the web mail service and the web server is not registered as a black or white list, the connection state with the web server is blocked, and the web data provided by the web server is crawled. A sixth step of storing; a method for blocking use of web mail, comprising: According to claim 1,
and blocking the connection with the web server that provided the web data and then redirecting the web server to a predetermined URL if the web server is registered as a blacklist. According to claim 1,
and instructing the user terminal to maintain a connection with the web server and display the web data, if the web server is registered as a whitelist. delete delete According to claim 1,
providing the crawled web data to an administrator's terminal; and
and registering a web server that provided the crawled web data as a blacklist according to a request of the manager terminal. In the system for blocking the use of web mail,
a web mail blocking service client unit installed in a user terminal; and
Collecting web data of a web server accessed by the user terminal through a web mail blocking service client installed in the user terminal;
If the web data contains more than a predetermined number of input types and specific characters and is maintained for a predetermined time or more, it is determined that the web data is for web mail service;
If the web data is web data for the web mail service, checking whether a web server providing the web data is registered in a blacklist or whitelist;
If the web server is registered as a blacklist, blocking the connection with the web server that provided the web data;
If the web server is not registered as a black or white list, blocking the connection with the web server, crawling and storing web data provided by the web server,
and a webmail blocking service server instructing the user terminal to display the web data provided by the web server if the web data is not web data for the web mail service. According to claim 7,
The web mail blocking service server, if the web server is registered as a blacklist, blocks the connection with the web server that provided the web data and then redirects the web mail to a predetermined URL. . According to claim 7,
Wherein the webmail blocking service server instructs the user terminal to maintain a connection state with the web server and display the web data, if the web server is registered as a whitelist. . delete delete According to claim 7,
The webmail blocking service server provides the crawled web data to an administrator terminal;
and registering a web server that provided the crawled web data as a blacklist according to a request of the manager terminal.

Images