KR20080071629A - System for blocking spam mail and method of the same - Google Patents

Abstract

A system and a method for blocking spam mails are provided to block the spam mails effectively by authenticating a sender of a received email with an authentication email and transferring the email received from the authenticated sender to an email account of a receiver. An email transceiver(10) receives/temporarily stores emails to a temporary storing part(20) after an authentication email is sent to a sender, deletes the stored emails when a response is not received, and transfers the stored emails to a receiver mail account of an email server(200) when the response is received. A black list(70) stores an email or IP(Internet Protocol) address of the senders refused by all receivers registered in the email server. A black list blocker(50) blocks the emails received from the email or IP address included in the blacklist among the received emails. A white list(30) stores the email address of the authenticated senders and the email address registered by the receiver. An authenticator(40) transmits the authentication email to the email address of the sender and authenticates the sender depending on the response of the sender when the email address of the sender is not found in the white list.

Description

SYSTEM FOR BLOCKING SPAM MAIL AND METHOD OF THE SAME}

1 is a block diagram of a spam mail blocking system according to the present invention.

2 is a flowchart of a spam mail blocking process according to the present invention;

3 is a flowchart illustrating a process of dividing an authentication mail into two steps.

4 is a block diagram of a spam mail blocking system using a blacklist according to the present invention.

5 is a flow chart of a spam mail blocking process using a blacklist according to the present invention.

6 is a block diagram of a spam blocking system to which a multi-blocking engine according to the present invention is applied.

7 is a flow chart of an e-mail multi-blocking process according to the present invention.

*** Explanation of symbols on the main parts of the drawing ***

10: mail transmission and reception unit 20: temporary storage unit

30: list of authenticators 40: authentication processing unit

50: black list blocking unit 60: black list processing unit

70: blacklist 80: fake account blocker

82: anti-virus section 84: spam pattern ranking section

100: spam blocking system 200, 300: mail server

400: internet or wired or wireless network

The present invention relates to a spam mail blocking system and method, and more specifically, spam mail for blocking the reception of spam mails, which are randomly sent in bulk for advertisement, etc. transmitted through the Internet or wired or wireless communication network. A blocking system and method are disclosed.

E-mail is a means of transmitting messages through the Internet or wired and wireless networks, and its use is increasing rapidly. As the use of e-mail is becoming more common and its weight is increasing, spam mail using e-mail is rapidly increasing as a medium of advertising / marketing targeting an unspecified majority. Therefore, the recipient may not only spend a lot of time and effort to identify and delete unnecessary spam mails, but may also be exposed to malicious codes, causing unnecessary waste of network and system resources.

The conventional techniques for blocking such spam mails typically include searching and filtering whether a specific word or the like is included in the subject or content of an email based on a common characteristic of spam mails, and particularly spam reported. There is a way to blacklist domains or email addresses to block email sent from those domains or email addresses.

However, in the case of searching and filtering a specific word, it is difficult to effectively block the e-mail spam evolving because it is based on the information inferred from the spam mail received in the past, and in the case of the spam mail composed of images rather than texts There was a problem that proper filtering was difficult. In addition, there is a problem in filtering the e-mail containing a specific word, such as to filter out the normal e-mail containing these words. In addition, in the case of using the black list, there is a problem that the sender of spam mail cannot block when using various sender e-mail addresses or creating a virtual e-mail address.

Accordingly, there is an urgent need for an effective technology that can effectively block randomly transmitted spam mails.

The present invention has been presented to solve the above problems, and an object of the present invention is to authenticate an e-mail sender with a predetermined authentication mail, and to receive and process an e-mail sent by an authenticated sender to a receiver as a normal e-mail to an unspecified recipient. It is to provide a spam blocking system and method that can effectively block spam sent randomly.

In addition, another object of the present invention is to provide an anti-spam system and method for receiving and checking e-mail sent by the sender arbitrarily before receiving a response of the authentication mail sent to authenticate the sender of the e-mail. To provide.

In addition, another object of the present invention is to send a second authentication mail without first sending the authentication mail as much as the number of e-mails sent by the sender of the received e-mail to authenticate the sender and then send the remaining authentication mail By using the transmission method, when spammers send spam mails using other people's e-mail addresses, a spam mail blocking system that prevents damage caused by sending a large amount of authentication mails to the corresponding e-mail addresses at one time. And a method.

In addition, another object of the present invention is to filter the received e-mail through a multi-blocking engine, filtering the e-mail containing viruses, spam mail and malicious code, etc., and then send the authentication mail in the final step, spam mail, malware The present invention provides a spam mail blocking system and method that can effectively block mails and virus mails and prevent waste and overload of system resources due to mass transmission of authentication mails.

In order to achieve the above object, a spam mail blocking system according to the present invention is located at the front end of a mail server that transmits and receives a plurality of emails, and authenticates the sender with an email address of a sender that transmits each of the emails. A spam mail blocking system that transmits an authentication mail for receiving a message and authenticates the sender according to whether or not the sender responds to the authentication mail, and receives / deletes the email. After the e-mail is sent, the e-mail is temporarily stored in the temporary storage unit for a set time, and if the sender's response is not received within the set time, the processing is deleted. Transmitting the temporarily stored e-mail to the mail account of the recipient of the mail server. Some transmission and reception; A blacklist for storing the sender's e-mail address or IP address which all the recipients registered in the mail server refuse to receive; A blacklist blocking unit positioned at a front end of the mail transmitting / receiving unit and blocking reception of an e-mail transmitted from an e-mail address or an IP address included in the blacklist among the received e-mails; An authenticator list for storing the sender's e-mail address authenticated through the authentication mail and an e-mail address of any sender registered by the receiver of the e-mail to receive the e-mail without the authentication; Search whether the sender's e-mail address is included in each recipient's authenticator list for each e-mail, and authenticating each e-mail with the sender's e-mail address not included in the authenticator list; An authentication processing unit for transmitting each mail and authenticating the sender for each of the recipients according to whether the sender accesses and responds through the authentication mail; A pending list which is a list linked to the temporary stored e-mail so that each recipient can arbitrarily select and receive and store the e-mail temporarily stored in the temporary storage unit; And an e-mail intermittently stored in the temporary storage unit for the set time in association with the temporary storage unit, the pending list, and the authenticator list, for which all recipients of the e-mail have not received through the pending list. Blacklist the sender's e-mail address or IP address of the e-mail with the same characteristics by comparing each characteristic including the sender's e-mail address, the sending IP, the subject of the e-mail, and the body of the e-mail. And a blacklist processing unit configured to register an e-mail address, and to delete a sender's e-mail address commonly included in the blacklist and the authenticator list from the blacklist by comparing the blacklist and the authenticator list in real time. The mail guides the authentication process through the picture of each recipient and the authentication mail. Guide information including at least one of an audio file and an image file, access information including a URL for the caller to access the authentication processing unit, and a unique key, wherein the authentication processing unit is temporarily stored in the temporary storage unit; A first authentication mail is respectively transmitted to the sender's e-mail address with respect to a first e-mail which is a part of a plurality of e-mails sent by the sender, and the sender for each of the first authentication mails is set within the set time. If a response of the received e-mail is sent to the sender's e-mail address to the second e-mail address of the second e-mail among the plurality of e-mails sent from the sender, respectively, and each of the first within the set time If the sender's response to the authentication mail is not received, both the first email and the second email It is characterized by the deletion process.

Preferably, the spam mail blocking system is located at the front end of the mail transmission / reception unit and is not registered in the mail server of the e-mails through communication with the sender's mail server by an SMTP session. False account blocking unit for refusing to receive the e-mail to the recipient account; An anti-virus unit positioned at the front end of the authentication processing unit to block and delete an e-mail infected with a virus and a malicious code among e-mails received from the mail transmission / reception unit; And a spam pattern ranking unit positioned at a front end of the authentication processing unit to block and delete an e-mail including a specific word and a form extracted by the pattern analysis of the spam mail among the e-mails received from the mail transmission and reception unit. do. The mail transmitting / receiving unit transmits an e-mail selected by the recipient from the pending list to the mail account of the recipient of the mail server regardless of whether the recipient responds to the authentication mail. Add the sender's e-mail address for the e-mail selected by the recipient to the authenticator list. Further, the authentication processing unit stores the unique key for the authentication mail and a corresponding key value for verifying the sender's response to the unique key, and accessing the sender and the unique key through the authentication mail. The sender's response to the key value is compared with the key value to authenticate the sender, or display a special character pattern graphically displayed on a web page linked with the access information, and receives the special character pattern from the caller. The caller may be authenticated or a question having a correct answer may be provided in a web page linked with the access information, and after receiving the correct answer from the caller, the caller may be authenticated according to whether the correct answer is made.

In addition, in order to achieve the above another object, the spam mail blocking method according to the present invention, in the front end of the mail server for transmitting and receiving a plurality of email, the email address of the sender to send each of the emails; A spam mail blocking method for transmitting an authentication mail for authenticating a sender, authenticating the sender according to whether the sender responds to the authentication mail, and transmitting the electronic mail of an authenticated sender to a recipient. A first step of blocking reception of an e-mail sent from an e-mail address or an IP address included in a blacklist storing an e-mail address or an IP address of a sender whose all registered recipients refused to receive; A second step of receiving each e-mail not blocked in the first step; A third step of retrieving the sender's e-mail address from each authenticator list generated for each recipient of the e-mail, the sender's e-mail address being a list of sender's e-mail addresses authorized and approved for transmission to the recipient; A fourth step of sending, for a recipient having an authenticator list including the sender's email address, each email sent to the recipient to a mail account of the recipient of the mail server; A fifth step of temporarily storing each e-mail sent to the recipient for a recipient having an authenticator list not including the sender's e-mail address; Guide information including at least one of a picture of each recipient, a voice file and an image file for guiding an authentication process through the authentication mail, with respect to a first e-mail of a part of the temporarily stored e-mails; A sixth step of sending a first authentication mail to the sender's e-mail address by generating a first authentication mail including a unique key and access information including a URL for the sender to access a specific web page for authentication; If the sender's response to the first authentication mail is received within a set time, send the first email to the mail account of the recipient of the mail server, and send the sender's email address to the authenticator list of the recipient. Adding to the seventh step; At least one of a picture of each recipient and a voice file and a video file for guiding the authentication process through the authentication mail are received for the second e-mail other than the first e-mail among the temporarily stored e-mails. Generating a second authentication mail including guide information, a connection information including a URL for accessing a specific web page by the sender for authentication, and a unique key, and sending the second authentication mail to the sender's e-mail address. An eighth step of transmitting; If the sender's response to the second authentication mail is received within the set time, send the second email to the mail account of the recipient of the mail server, and send the sender's email address to the authenticator of the recipient. A ninth step of adding to the list; A tenth step of deleting the temporarily stored second e-mail when the sender's response to the second authentication mail is not received within the set time; An eleventh step of deleting all of the temporarily stored first and second e-mails when the response of the sender to the first authentication mail is not received within the set time; Twelfth step of respectively providing the recipient with a pending list which is a list linked with the first and second e-mails so that the recipient can confirm the temporarily stored first and second e-mails; The e-mail selected by the recipient from the pending list is transmitted to the mail account of the recipient of the mail server regardless of whether the sender responds to the first authentication mail and the second authentication mail, and the sender of the selected e-mail. A thirteenth step of adding the e-mail address of to the recipient's authenticator list; Among the e-mails temporarily stored in the fifth step, all recipients of the e-mails have the same characteristics by comparing the respective characteristics between each e-mail not selected through the pending list in the twelfth and thirteenth steps. A fourteenth step of registering an e-mail address or an IP address of an e-mail sender in the blacklist; And a fifteenth step of deleting, from the blacklist, an email address of a sender commonly included in the blacklist and each authenticator list by comparing the blacklist and each authenticator list in real time. Steps to the tenth step and the eleventh step are selectively performed, the ninth step and the tenth step are selectively performed, and the twelfth and thirteenth steps are the sixth to the tenth step. The step 15 may be performed regardless of the order, and the fifteenth step may be performed regardless of the order of the first to fourteenth steps.

Preferably, the fourteenth step is for each e-mail that is not selected by the recipient list in the twelfth and thirteenth steps of all the e-mails temporarily stored in the fifth step. And comparing the sender's email address and registering the sender's email address of the email having the same sender's email address in the blacklist when there are a plurality of emails having the same sender's email address. step; A step 14-2 of comparing sender IPs and registering a plurality of e-mails having the same outgoing IP, in the blacklist, an IP address of a sender of the e-mail having the same outgoing IP; Comparing the subjects of the e-mails and registering a plurality of e-mails having the same subject, registering the e-mail address or IP address of the sender of the same e-mail in the blacklist; And when there are a plurality of e-mails having the same converted codes by hashing the body content of the e-mail and converting them into codes, and comparing the converted codes, the e-mail address of the sender of the same e-mail, or Step 14-4 includes registering an IP address in the blacklist, and steps 14-1 to 14-4 are performed regardless of the order.

Hereinafter, with reference to the accompanying drawings will be described in detail the advantages, features and preferred embodiments of the present invention.

1 is a block diagram of a spam mail blocking system according to the present invention. As shown in FIG. 1, each mail server 200 or 300 transmits and receives mutual e-mail through the Internet or wired / wireless communication network 400, and the spam blocking system 100 according to the present invention includes a mail server 200. It is located at the front end. The mail servers 200 and 300 are general mail servers for sending and receiving e-mails, and mail accounts of senders and recipients for sending and receiving e-mails are registered. 1 illustrates an embodiment in which a spam mail blocking system is provided only in the mail server 200. The mail server 300 is a mail server in which a mail account of an e-mail sender is registered, and the mail server 200 is a mail account of an e-mail recipient. Represents this registered mail server.

Anti-spam system 100 according to the present invention, the mail server 300 and the e-mail transmission and reception unit 10 for sending and receiving e-mail, the temporary storage unit 20 for temporarily storing the received e-mail, spam blocking system ( 100 includes an authenticator list 30 for storing a list of authenticated senders and an authentication processor 40 for generating and transmitting an authentication mail to the sender to authenticate the sender. On the other hand, the transmission of the authentication mail may be performed by the mail transmission and reception unit 10, of course.

The mail transmitting and receiving unit 10 according to the present invention transmits and receives e-mails through the Internet or wired or wireless communication network (400). Therefore, the e-mail transmitted by the sender from the mail server 300 is received by the mail transmission / reception unit 10 and stored in the temporary storage unit 20. The temporary storage unit 20 temporarily stores the e-mail until the authentication is determined by the authentication processing unit 40, and classifies and stores the e-mail according to the recipient of the e-mail. In addition, the mail transmission / reception unit 10 transmits or deletes the corresponding e-mail to the mail server 200 according to whether the authentication processing unit 40 is authenticated. In detail, when authentication is completed by the authentication processing unit 40, the mail transmitting and receiving unit 10 extracts the corresponding e-mail from the temporary storage unit 20 and transmits the e-mail to the corresponding recipient e-mail address of the mail server 200. The e-mail transmitted to the mail server 200 is stored in a separate storage area (not shown) assigned to the corresponding recipient, so that the recipient can receive and check it. On the other hand, when authentication is not performed by the authentication processing unit 40, that is, when it is determined that the e-mail is spam mail, the mail transmission and reception unit 10 deletes the e-mail stored in the temporary storage unit 20.

The authenticator list 30 according to the present invention is a list of the e-mail addresses of the senders whose e-mails have been approved / authenticated for the recipients. The sender's e-mail address included in the authenticator list 30 includes the sender's e-mail address that has been authenticated by the authentication processing unit 40, and the sender's e-mail address individually registered by the recipient.

The authentication processing unit 40 according to the present invention is a component that blocks spam mail transmitted from spammers by authenticating the sender of the electronic mail through the authentication mail. Specifically, the authentication processing unit 40 searches for the sender of the received e-mail in the authenticator list 30, and generates and transmits an authentication mail when the sender is not included in the authenticator list 30. The authentication mail includes access information such as a URL for the sender to access the authentication processing unit 40. In addition, the authentication processing unit 40 stores a unique key for the authentication mail and a key value corresponding thereto. The corresponding key value is a value for verifying the sender's response to the unique key, wherein the authentication processing unit transmits the unique key in the authentication mail and compares the sender's response with the corresponding key value to authenticate the sender. do. Preferably, the authentication mail according to the present invention and guide information for guiding the authentication process to be performed by the sender to be included in the authentication mail. The guide information may include at least one of a picture, an audio file, and an image file of a receiver registered in the mail server 200. Specifically, the authentication processing unit 40 receives a picture of the receiver or a voice and video file for explaining and guiding the authentication contents and the authentication process according to the present invention from each recipient, and authenticates the registered picture, voice file and the video file. Insert as guide information when creating mail. In this case, when only the picture of the receiver is inserted as guide information, a message (text) describing the authentication contents and the authentication process is included in the authentication mail. Therefore, the sender can easily understand the authentication content and the authentication process, it is possible to effectively solve the caller's rejection due to the authentication according to the present invention. Meanwhile, the specific authentication process of the authentication processing unit 40 using the unique key and the corresponding key value may be implemented in various forms. For example, the authentication processing unit 40 may access the web page through which the caller accesses through the access information. That is, it displays a special character pattern graphicized on a web page linked with the access information and requests input of the special character pattern in response. The graphic special character pattern is a character pattern that the sender can instantly analyze or read the meaning with the naked eye, thereby requiring the public authentication. When the sender enters a special character pattern in response, the authentication processor authenticates the sender by comparing it with the stored value. As another example of the authentication process of the authentication processing unit 40, the authentication processing unit displays a question with a correct answer on a web page linked with the access information, receives a correct answer from the sender, compares the correct answer, and authenticates the sender according to the correct answer. At this time, the displayed question allows the sender to use a question of difficulty that can immediately find the correct answer. Therefore, a sender (spammer) who sends a large amount of spam mail or a spam mail using a randomly generated false account cannot receive the authentication mail or must respond in one hand, thereby effectively identifying the sender of the spam mail. . The authentication processing unit 40 adds the sender's e-mail address to the authenticator list 30 and transmits a message indicating the completion of authentication to the mail transmitting / receiving unit 10 when the authentication is completed by the sender's response to the authentication mail. do. On the other hand, if the response is not received from the sender within the set time, the authentication processor 40 determines that the e-mail as spam mail and transmits a message indicating the authentication failure to the mail transmission and reception unit. Therefore, the mail transmission / reception unit 10 transmits or deletes the e-mail stored in the temporary storage unit 20 according to the authentication completion or authentication failure message of the authentication processing unit 40 to the mail server 200.

On the other hand, each e-mail stored in the temporary storage unit 20 in the state that the authentication of the sender is not complete may be provided to the corresponding recipient in the form of a list. That is, the mail account registrant (recipient) of the mail server 200 may check a list of e-mails for which authentication has not been completed (hereinafter referred to as a 'pending list'), and selectively receive e-mails from the lists. . In this case, the mail transmission / reception unit 10 extracts the e-mail selected by the recipient from the temporary storage unit 20 and transmits the e-mail selected by the recipient to the corresponding recipient mail account of the mail server 200. Therefore, the e-mail received by the receiver through the above process is not deleted regardless of the sender's authentication.

2 is a flowchart illustrating a spam mail blocking process according to the present invention. Referring to Figure 2 describes the spam block process according to the present invention.

When the e-mail is transmitted from the mail server 300, the mail transmitting and receiving unit 10 receives the e-mail and the received e-mail is stored in the temporary storage unit 20 (ST200).

The authentication processing unit 40 searches whether the sender of the e-mail is included in the authenticator list 30 (ST210). Specifically, the sender e-mail address included in the e-mail is searched in the authenticator list 30.

If the sender's e-mail address is included in the authenticator list 30, the mail transmission / reception unit 10 transmits the e-mail stored in the temporary storage unit 20 to the mail account of the receiver of the mail server 200. (ST220, ST230).

On the other hand, if the sender's e-mail address is not in the list of authenticators, the authentication processing unit 40 generates an authentication mail and transmits it to the sender's e-mail address (ST220, ST240). At this time, the authentication mail is preferably generated using a pre-stored generation format (text content, access information, code, etc.). The authentication mail includes access information such as a URL for the sender to access the authentication processing unit 40, a unique key for authenticating the sender, and authentication information and guide information for guiding the authentication process. The guide information includes at least one of a picture, an audio file, and an image file of a receiver registered in the mail server 200.

The authentication processing unit 40 waits for the sender's response to the authentication mail for a preset time (ST250).

If there is a response from the sender within the set time, the authentication processing unit 40 compares the response and a key value corresponding to the unique key to authenticate the sender, and then registers the sender's e-mail address in the authenticator list 30. (ST260, ST270). Specifically, when the sender accesses the web page linked with the access information of the authentication mail and views and displays the graphic processed special character pattern, or inputs the correct answer to the question displayed on the web page, the authentication processing unit checks this. After authenticating the sender, register the sender's e-mail address in the list of authenticators. Therefore, the e-mail received from the sender's e-mail address is then sent directly to the mail server 200 without authentication through the authentication mail.

In addition, the mail transmission / reception unit 10 transmits the e-mail temporarily stored in the temporary storage unit 20 to the recipient mail account of the mail server 200 (ST230).

On the other hand, if the caller does not access the authentication processing unit 40 within the set time, the authentication processing unit transmits a message indicating the authentication failure to the mail transmission and reception unit 10, the electronic transmission and reception unit electronic stored in the temporary storage unit 20 The mail is deleted (ST260, ST280).

On the other hand, the authenticator list 30 can be changed by the recipient directly access to add or delete the sender's e-mail address, and can be set to prohibit the reception of the specific sender's e-mail address. If the recipient deletes the registered sender's e-mail address from the list of authenticators, then the e-mail received from the sender's e-mail address can be received after re-authentication through the authentication process of steps ST240 to ST270. . In addition, it is desirable to prevent the authentication of the e-mail address that is set as non-receipt before the recipient releases it separately. In this case, the mail transmission / reception unit 10 allows the e-mail transmitted from the e-mail address forbidden to be immediately deleted from the temporary storage unit 20 without an authentication process.

In addition, as described above, the mail transmission / reception unit 10 may provide each recipient with a pending list for the e-mail stored in the temporary storage unit 20. In this case, when the corresponding recipient selects to store a specific e-mail among the e-mails of the pending list, the mail transmission / reception unit 10 transmits the selected e-mail to the recipient mail account of the mail server 200. Accordingly, the selected e-mail is not deleted regardless of whether the ST250 and ST260 respond to the authentication mail, and the receiver can quickly receive and confirm the e-mail required before the sender's authentication response. In addition, of course, the sender of the selected e-mail may be configured to automatically add an e-mail address to the authenticator list 30.

On the other hand, in sending an authentication mail to the sender who sent the e-mail and authenticating the sender according to the response, if the actual sender of the e-mail is not the sender, that is, a spammer or a malicious sender is an e-mail of a third party. When sending an e-mail through an address, a problem may occur in which a large amount of authentication mail is sent to the third party. For example, a spammer with an e-mail address of a@a.com may use a third-party e-mail address b@b.com as a sender to a large number of recipients who have mail accounts on mail server C (c.com). If a large amount of e-mail is transmitted and the spam blocking system 100 according to the present invention is applied to the mail server C, authentication mail is transmitted to b@b.com as much as the amount of e-mail transmitted. In this case, the same number of authentication mails are transmitted not only when the number of recipients is large but also when a large number of electronic mails are sent to one recipient. In general, the mail server has a limit of 256 messages, which can be handled at the same time, no matter how many e-mails are sent at the same time. Could be. Therefore, the spam blocking system 100 according to the present invention, in transmitting the authentication mail for the received e-mail, does not transmit the authentication mail for the e-mail sent from the same sender at a time, authentication of a part of the e-mail The mail is transmitted first, and then the authentication mail for the remaining e-mails is transmitted or the e-mail is deleted according to whether the sender responds. Hereinafter, a two-step transmission process of the authentication mail will be described in detail.

3 is a flowchart illustrating a process of dividing an authentication mail into two steps. In FIG. 3, it is assumed that a large amount of e-mails are received at the same time from the same sender. Referring to Figure 3 describes the process of dividing the authentication mail in two steps as follows.

When the e-mail is transmitted from the mail server 300, the mail transmitting and receiving unit 10 receives the e-mail (ST300).

The authentication processing unit 40 searches whether the sender of the e-mail is included in the authenticator list 30 (ST305). In this case, if the received e-mail is an e-mail transmitted to a plurality of recipients, it is searched whether each recipient is included in the authenticator list.

If there is no authenticator list in which the sender's e-mail address is registered, the authentication processing unit 40 generates and transmits an authentication mail for some of the received e-mails (ST310 and ST315). Preferably, the authentication mail is transmitted to a predetermined number of e-mails according to the receiving order of the e-mails. For example, if 256 e-mails with 256 mail account registrants are received, authentication mails are first transmitted to the two received e-mails. At this time, the mail transmission and reception unit 10 stores the received e-mail in the temporary storage unit 20. Hereinafter, the selected partial e-mail will be referred to as 'first e-mail', and the authentication e-mail transmitted to the first e-mail will be referred to as 'first authentication e-mail'.

The authentication processing unit 40 waits for the sender's response to the first authentication mail for a preset time (ST320).

If there is no response from the sender for the set time, that is, if the caller does not access the authentication processing unit 40 through the access information included in the first authentication mail within the set time, the authentication processing unit fails to authenticate. The message is transmitted to the mail transmission / reception section 10, and the mail transmission / reception section deletes all e-mails stored in the temporary storage section 20 (ST325, ST330). In other words, in the above example, the sender is regarded as a spam mail sender, and the first two e-mails from which the first authentication mail is transmitted, as well as the remaining 254 e-mails from which the authentication mail is not transmitted, are also authenticated. Delete without sending mail.

On the other hand, when there is a response from the sender within the set time, that is, when the sender accesses the authentication processing unit 40 through the access information of the first authentication mail and inputs a correct answer to a character pattern or question, etc. The sender's e-mail address is registered in the authenticator list 30 of the corresponding recipient (ST325, ST335). At this time, the mail transmitting and receiving unit 10 of course transmits the first e-mail of the e-mail stored in the temporary storage unit 20 to the mail account of the corresponding recipient of the mail server 200. In addition, the authentication processing unit 40 generates and transmits an authentication mail for the remaining e-mails except the first e-mail among the e-mails transmitted by the sender (ST340). Hereinafter, e-mails other than the first e-mail are referred to as "second e-mails", and authentication e-mails transmitted to the second e-mails are referred to as "second e-mails."

The authentication processing unit 40 waits for the sender's response for a set time for each second authentication mail, and then, for the second authentication mail for which the response is received, the sender's e-mail in the authenticator list 30 of the corresponding receiver. The address is registered, and the mail transmission / reception unit 10 transmits the second e-mail from the temporary storage unit 20 to the mail account of the corresponding recipient of the mail server 200, respectively (ST345 to ST355). On the other hand, the mail transmission / reception unit 10 deletes the second electronic mail stored in the temporary storage unit 20 for the second authentication mail for which the response is not received for the set time (ST350 and ST360).

On the other hand, if there is a recipient whose sender of the e-mail is registered in the authenticator list 30 in ST305, the mail transmitting / receiving unit 10 sends the received e-mail to the corresponding recipient of the corresponding mail server 200. Transfer to a mail account (ST310, ST365). In addition, the remaining e-mail not included in each recipient's authenticator list 30 is stored in the temporary storage unit 20, and after generating and transmitting authentication mails for some of the remaining e-mails, the sender Depending on whether or not the response is sent to the mail server 200 or delete processing (ST370, ST320 to ST360).

Meanwhile, as described above, the e-mail stored in the temporary storage unit 20 is provided to each recipient through a pending list, and the recipient selectively receives the e-mail stored in the temporary storage unit through the pending list, Of course, it can be registered in the authenticator list (30). In detail, the recipient may check and receive not only the electronic mail in which the authentication mail is transmitted in the ST315, ST340, and ST370, but also the electronic mail in which the authentication mail is not transmitted in the ST315 and ST370. Therefore, it is possible to prevent the e-mail that has not been sent the authentication mail from ST315 and ST370 being excessively delayed and received by the recipient.

On the other hand, when authenticating an incoming e-mail through an authentication mail, if a large amount of e-mail is received, system resources may be wasted and overloaded by sending the authentication mail one by one. This wastes resources. In addition, a large amount of authentication mails may be transmitted to the other party's mail server, resulting in unnecessary system resources and overload of the other party's mail server. Therefore, the spam blocking system 100 according to the present invention blocks the obvious spam mails which do not require authentication through the authentication mails among the received e-mails before they are received by the mail transmission / reception unit 10 and authenticates the remaining e-mails. Authenticate via Hereinafter, an embodiment of the spam blocking system 100 for filtering obvious spam mail will be described.

Example 1

The first embodiment of the spam blocking system 100 according to the present invention for filtering out obvious spam is that the spammer manages a reliable email address, IP address or domain as a blacklist, and the email address is included in the blacklist. , Block the reception of the mail transmission / reception unit 10 with respect to the e-mail transmitted from the IP address or the domain and deletes it. The spam mail blocking process using the black list will be described with reference to FIGS. 4 and 5.

4 is a block diagram of a spam mail blocking system using a black list according to the present invention, which primarily filters spam mail using the black list 70 and then performs authentication through authentication mail on the remaining e-mails. Figure shows an embodiment. As shown in FIG. 4, the anti-spam system 100 according to the present invention includes a blacklist blocking unit 50 for blocking an e-mail included in the black list 70 among e-mails received from the mail server 300. ), A mail sending / receiving unit 10 for receiving an e-mail passing through the blacklist blocking unit, a temporary storage unit 20 for temporarily storing the received e-mail, and a list of senders authenticated by the spam blocking system 100 Authenticator list 30 to authenticate, authentication processing unit 40 for authenticating the sender of the e-mail using the authentication mail, blacklist processing unit for creating and managing a black list in conjunction with the temporary storage unit, pending list and authenticator list ( 60) and a blacklist 70 that stores a list of sender's email addresses, IP addresses or domains to block emails. Hereinafter, each component of the spam blocking system 100 will be described, but portions overlapping with the above description will be omitted.

The blacklist 70 according to the present invention is a list of sender's e-mail addresses, IP addresses or domains which will block the transmission of e-mails to all users of the mail server 200, ie all recipients. The blacklist 70 is a list of e-mail addresses, IP addresses or domains determined to be definite spam senders that all the recipients of the mail server 200 do not want to receive, and the e-mail addresses and IP addresses included in the black list. Alternatively, the e-mail transmitted from the domain is blocked by the blacklist blocking unit 50. Unlike the authenticator list 30 and the pending list, the black list 70 is generated and managed in units of mail servers. The black list 70 is generated and managed by the black list processing unit 60.

The blacklist blocking unit 50 is disposed at the front end of the mail transmitting and receiving unit 10 and among the e-mails received by the mail server 200, e-mails included in the black list 70, that is, e-mail addresses included in the black list. This will block and delete e-mail sent from IP addresses or domains. As described above, the blacklist 70 includes an e-mail address of a sender whose all registered recipients of the mail server 200 do not want to receive e-mails, i.e., an e-mail address and IP of a verified spam sender. Since it is an address or a domain, when the authentication mail is transmitted to the electronic mail, unnecessary system resources are wasted on the mail server 200 as well as the other mail server 300. Therefore, after blocking the e-mail included in the black list 70 in the black list blocking unit 50, only the remaining e-mails are received by the mail transmitting and receiving unit 10 and performing authentication through the authentication mail, thereby greatly increasing system resources. Savings and improving the processing efficiency of the e-mail.

The blacklist processing unit 60 according to the present invention generates and manages the blacklist 70 in association with the temporary storage unit 20 and the pending list. The blacklist processing unit 60 is an e-mail in which all recipients of the e-mail are temporarily stored in the temporary storage unit 20 for a set period after the authentication processing unit 40 transmits the authentication mail. Analyzes and compares each characteristic of the e-mail to the blacklist 70 to register the e-mail address, IP address, or domain of the sender of the e-mail having the same characteristics. At this time, the blacklist processing unit 60 searches the certifier list 30 before registering the sender's e-mail address, IP address or domain in the blacklist 70, and the sender e-mail address and IP included in the certifier list. Do not blacklist addresses or domains. The characteristics analyzed by the blacklist processing unit 60 include the sender's e-mail address, the originating IP, the subject of the e-mail, and the body content of the e-mail. In addition, various characteristics may be compared and analyzed. The blacklist processing unit 60 has a plurality of e-mails which are registered in the pending list and stored in the temporary storage unit 20 and have the same e-mail having any one of the same characteristics as the e-mail address, IP, subject and body content of the same sender. If the e-mail is not stored by all recipients through the pending list, the sender e-mail address, IP address or domain of the e-mail is registered in the blacklist 70. If described in more detail for each characteristic as follows.

First, when analyzing the sender's e-mail address, by comparing the sender e-mail address of the e-mail stored in the temporary storage unit 20, the number of e-mails sent from the same sender e-mail address and the e-mail sent by the sender If all of the recipients of the e-mail have not stored the sender's e-mail via the pending list during the storage period of the temporary storage, the blacklist processing unit 60 blacklists the sender e-mail address, IP address or domain of the e-mail. Register). Preferably, the number of the e-mails transmitted, the storage period, and the frequency (number of times) of transmitting the e-mails are ranked, and the senders having a predetermined rank or higher are included in the blacklist 70. For example, if sender A sent 100 emails and sender B sent 10 emails, but both sender A's email and sender B's email were not saved by the recipient from the pending list, sender A would It is ranked higher than the sender B and included in the blacklist 70. On the other hand, if any one of the recipients of the e-mail stores the e-mail from the pending list, the sender of the e-mail is not included in the black list (70).

Next, in the case of analyzing the originating IP, comparing the originating IPs of the e-mails stored in the temporary storage unit 20, regardless of whether the sender's e-mail address is the same, the number of e-mails transmitted from the same originating IP is many and corresponding. Allow all recipients of an e-mail to register with the blacklist 70 all sender e-mail addresses, IP addresses or domains of these e-mails that have not stored the e-mail via the pending list. Therefore, it is also possible to effectively block spam mails sent using an email auto-generator that automatically generates a sender's e-mail address and automatically sends it to the same or multiple recipients. In addition, when analyzing the subject of the e-mail or the content of the body of the e-mail, by comparing the subject or body content of the e-mail stored in the temporary storage unit 20 with each other to correlate whether the sender's e-mail address or the sending IP is the same If there are multiple emails with the same subject or the same body content and all recipients of the email have not been saved via the pending list during the storage period of the temporary store, then the email address, IP address or domain of the sender of the email is The blacklist 70 is registered. In particular, when analyzing the body content of each e-mail, the body content is hashed (hashed), converted into codes, and the converted codes are compared with each other to determine whether they are the same. In case of analyzing the originating IP, the subject or the body content, the ranking can also be ranked and blacklisted more than a certain rank. If there is an e-mail saved by the recipient, the blacklist should not be registered.

In addition, the blacklist processing unit 60 according to the present invention, in conjunction with the authenticator list 30, if the e-mail address, IP address or domain included in the blacklist 70 is included in the authenticator list, the corresponding e-mail. It will delete the address, IP address or domain from the blacklist. The blacklist processing unit 60 compares the blacklist 70 and the authenticator list 30 of each recipient on a predetermined period basis. Preferably, when the recipient's authenticator list 30 is updated, for example when the recipient includes a new email address or the like in the authenticator list, or has stored an email from a pending list, or the sender has authenticated mail. In the case where authentication is performed through the blacklist processing unit 60, the blacklist processing unit 60 compares the updated list of authenticators with the blacklist 70. Therefore, the e-mail that one recipient wants to receive is not blocked by the blacklist blocking unit 50 and can be selectively received by each recipient, thereby preventing the necessary e-mail from being lost and matching the characteristics of the recipient. By running a blacklist, you can effectively block spam without harming recipients.

5 is a flowchart illustrating a spam mail blocking process using a blacklist according to the present invention. Referring to FIG. 5, the spam mail blocking process using the blacklist according to the present invention will be described.

When the e-mail is transmitted from the mail server 300, the blacklist blocking unit 50 searches whether the sender of the e-mail is included in the blacklist 70 (ST400). That is, the sender e-mail address, IP address or domain of the e-mail is searched in the blacklist.

If the sender of the corresponding e-mail is included in the black list 70, the black list blocking unit 50 blocks and deletes the e-mail (ST410 and ST420).

If the search result of the ST400 does not include the sender of the e-mail in the blacklist 70, the blacklist blocking unit 50 passes the e-mail and the e-mail is received by the e-mail transmitting and receiving unit 10 and temporarily stored. It is stored in the unit 20 (ST410, ST430).

The authentication processing unit 40 performs authentication through the authentication mail on the electronic mail stored in the temporary storage unit 20 (ST440). In detail, an authentication process of steps ST210 to ST280 of FIG. 2 or an authentication process of steps ST305 to ST370 of FIG. 3 is performed.

Apart from the e-mail authentication process of the authentication processing unit 40, the blacklist processing unit 60 is connected to the temporary storage unit 20, the pending list and the authenticator list 30, and the sender e-mail address, It manages adding or deleting IP addresses or domains.

First, the blacklist processing unit 60 is transmitted to each recipient of the mail server 200 and analyzes the characteristics of the e-mail not selected from the pending list until the set storage period of e-mails stored in the temporary storage unit 20 elapses. The sender e-mail address, IP address or domain of the e-mail having the same characteristics is registered in the blacklist 70 (ST450). Specifically, the blacklist processing unit 60 provided the list of e-mails stored in the temporary storage unit 20 as a pending list after transmitting the authentication mail, but there was no authentication of the sender for the corresponding e-mail, and the receiver was also a temporary storage unit. The e-mail is analyzed for the unsaved e-mail from the pending list until the time period set to be stored in the e-mail is registered, and then the e-mail is registered in the black list 70. These e-mails are not only authenticated by the sender but also don't want the recipient to receive them. As described above, the characteristics of the e-mail analyzed at this time include the sender's e-mail address, originating IP, the subject of the e-mail and the contents of the e-mail. The blacklist processing unit 60 compares and analyzes the characteristics of the sender e-mail address, the originating IP, the subject and the body content for each e-mail not stored by the receiver through the pending list after being stored in the temporary storage unit 20. If there are multiple e-mails with the same characteristics: e-mails sent from the same sender e-mail address, e-mails sent from the same originating IP, e-mails of the same subject, or with the same body content, the e-mails can be guaranteed. The sender e-mail address, IP address or domain is registered in the blacklist 70 as spam mail. Preferably, in consideration of the number of e-mails having the same characteristics, storage period, transmission frequency, etc., the possibility of spam mail is ranked by rank, and the sender is included in the blacklist 70 for the upper part of the e-mails. In addition, the blacklist processing unit 60 retrieves a sender e-mail address, an IP address, or a domain to be registered in the black list 70 from the authenticator list 30 of each recipient registered in the mail server 200, and the corresponding e-mail. Only blacklist if there is no list of authenticators with addresses, IP addresses or domains. Therefore, since all the recipients registered in the mail server 200 which received the e-mail from the sender do not want to receive the e-mail, they are registered in the blacklist 70, so that only the e-mail sent from a certain spammer can be blocked. The damage of the caller can be prevented.

In addition, the blacklist processing unit 60 compares the authenticator list 30 and the blacklist 70 at regular intervals, and the value included in the authenticator list among the sender e-mail address, IP address, or domain included in the blacklist is determined. If it is present, it is deleted (ST460, ST470). Preferably, when the authenticator list 30 of each recipient is updated, the blacklist processing unit 60 compares the updated authenticator list with the blacklist to determine whether there is a commonly included e-mail address, IP address or domain. In response, the e-mail address, IP address or domain included in both the authenticator list and the blacklist is deleted from the blacklist. When the authenticator list 30 is updated, each recipient registers a new e-mail address or the like in the authenticator list, each recipient stores an e-mail from the pending list, and the sender authenticates through the authentication mail. This includes the case where: Therefore, it is possible for the receiver to prevent the sender who wants to receive the e-mail from being registered in the blacklist 70 and the process is performed in real time, thereby preventing the desired e-mail from being blocked.

Example 2

The second embodiment of the anti-spam system 100 according to the present invention for filtering explicit spam mails is an explicit spam mail that does not require authentication via an authentication mail and a mail containing a virus or malware through a multi-blocking engine. After multiple blocking, the remaining e-mails should be authenticated through authentication mails. The spam mail blocking process using multiple blocking will be described with reference to FIGS. 6 and 7.

6 is a block diagram of a spam blocking system to which a multi-blocking engine according to the present invention is applied. As shown in FIG. 6, the anti-spam system 100 to which the multi-blocking engine according to the present invention is applied includes the mail transmitting and receiving unit 10, the temporary storage unit 20, and the authenticator list 30 shown in FIG. 1. And, along with the authentication processing unit 40, the false account blocking unit 80 to block the e-mail to the non-existent account, the anti-virus unit 82 to block the e-mail containing a virus or malware, and the like; The apparatus further includes a spam pattern ranking unit 84 for blocking spam mail by searching for a pattern of spam mail or a specific word included in an e-mail.

The false account blocking unit 80 according to the present invention is an engine that blocks an e-mail transmitted by using a false account that does not exist in the mail server 100 as a recipient only by communication with the sender side mail server. This is the same as a Simple Mail Transfer Protocol (SMTP) session of general mail servers, which communicates only with the sender's mail server, noting that there is no recipient account for the e-mail, and rejecting the reception of the actual e-mail data itself. In the past, spammers collected e-mail addresses from internet bulletin boards and cafes to obtain e-mail addresses for spam mails. However, recently, instead of collecting these e-mail addresses, random accounts are randomly generated for specific domains. Regardless of whether or not there is an e-mail account, a method of transmitting spam mail to the created account is used. Therefore, if the recipient e-mail address of the transmitted e-mail is an e-mail addressed to a mail account not registered in the mail server 100, the e-mail address is immediately blocked without receiving the e-mail. The e-mail passing through the false account blocking unit 80 is received by the mail transmitting and receiving unit 10.

The anti-virus unit 82 according to the present invention is an engine for filtering and blocking an e-mail infected with a virus or a malicious code among the e-mails received at the mail transceiving unit 10, and includes a virus engine based on an open source. Block emails infected with virus or malware. Specifically, the anti-virus unit 82 checks viruses and malicious codes of attached files or compressed files attached to the e-mail, and blocks the infected e-mail.

The spam pattern ranking unit 84 according to the present invention is an engine that patterns and analyzes the characteristics of spam mails and blocks spam mails using them. Unlike regular filtering engines, this engine blocks e-mail by checking whether it was written according to a set of rules and sent in a specific format sent by spammers worldwide.

The authentication processing unit 40 searches the authenticator list 30 for the e-mail passing through the spam pattern ranking unit 84, and the sender's e-mail included in the authenticator list is sent by the mail transmission / reception unit 10. The sender's e-mail, which is transmitted to the server 200 and is not included in the authenticator list, is stored in the temporary storage unit 20 and finally sent to the recipient mail account of the mail server 200 through the authentication process through the authentication mail. Will be. Therefore, after the e-mail is blocked through the false account blocking unit, the anti-virus unit, and the spam pattern ranking unit, the authentication mail is transmitted only to the remaining e-mails. This can prevent the mail server from being overloaded.

Meanwhile, in FIG. 6, the spam blocking system 100 is a false account blocking unit 80-> mail transmitting and receiving unit 10-> anti-virus unit 82-> spam pattern ranking unit 84-> Although the e-mail is blocked and transmitted in the order of the authentication processing unit 40, this shows a preferred embodiment for blocking spam mail and reducing unnecessary transmission of authentication mail, and may be performed in a different order. Of course.

7 is a flowchart of an e-mail multi-blocking process according to the present invention. Referring to Figure 7 describes the process of blocking the e-mail in the spam blocking system according to the present invention as follows.

When an e-mail transmission request is received through communication from the mail server 300, the false account blocking unit 80 checks whether the e-mail address of the recipient indicated in the e-mail is a mail account registered in the mail server 200. (ST500, ST505).

If the account is not registered as a result of the examination of the recipient e-mail address, that is, the e-mail sent to the false account, the e-mail data itself does not need to be received. Therefore, the transmission of the e-mail itself is blocked (ST510, ST515).

The e-mail that has passed through the false account blocking unit 80 is transmitted and received by the mail transmitting and receiving unit 10 and passes through the anti-virus unit 82.

The anti-virus unit 82 checks whether the virus and malicious code are infected with respect to the e-mail transmitted to the real account registered in the mail server 200 (ST520). As a result of the inspection, the e-mail infected with the virus or the malicious code is blocked or deleted, and the remaining e-mail is scanned by the spam pattern ranking unit 84 (ST525 and ST515).

The spam pattern ranking unit 84 searches for the e-mail with various conditions such as whether the e-mail complies with the rule and includes a specific pattern and blocks the e-mail if applicable (ST530, ST535, ST515). Also, for words such as (advertisement), (loan), (adult), etc. that are legally marked as spam mails, if the e-mail contains a predetermined number or more, the e-mail is regarded as spam mail and blocked. .

The authentication processing unit 40 searches for the sender in the authenticator list 30 of the receiver for the e-mail passing through the spam pattern ranking unit 84 (ST540). The e-mail transmitted by the sender included in the search result authenticator list is transmitted to the recipient mail account of the mail server 200 by the mail transceiving unit 10 (ST545, ST550). On the other hand, the e-mail sent by the sender not included in the authenticator list is stored in the temporary storage unit 20, and the sender authentication through the authentication mail is performed by the authentication processing unit 40 (ST545, ST555, ST560).

As described above, the spam mail blocking system and method according to the present invention can effectively block spam mail by authenticating the sender of the e-mail through the response to the authentication mail, and the spammer uses a third party's e-mail address. In the case of transmitting the e-mail, a large amount of authentication mail is transmitted to the third party, thereby having a significant effect of preventing unexpected damage.

In other words, the spam mail blocking system and method according to the present invention,

(1) Sends an authentication mail to the sender for an e-mail sent from an unregistered e-mail address, and authenticates the sender according to the response to the authentication mail. Can effectively block spam sent from fictitious email addresses,

(2) Since only the e-mail sent by the authenticated sender is received, unnecessary waste of time and resource consumption for the spam mail processing can be significantly reduced.

(3) Since the spam mail blocking function is handled by the sender side rather than the receiver side of the e-mail, unnecessary waste of resources in the recipient mail system can be prevented.

(4) Provide each recipient with a pending list, which is a list of e-mails stored in the temporary storage before receiving a response to the authentication mail, and temporarily send the e-mail in the absence of the sender's authentication according to the recipient's choice. Since it is sent from the storage to the recipient's mail account on the mail server, it is possible to quickly check the e-mail regardless of whether the sender is authenticated or to lose the e-mail even if the sender did not respond to the authentication mail by mistake. Prevent,

(5) Sending an authentication mail to a plurality of e-mails sent by the same sender in two steps, so that a large amount of unnecessary mail is unnecessarily large to the third party due to spammers who generate spam mails using the e-mail addresses of the third parties. You can prevent the damage caused by sending the authentication email,

(6) Blacklist all sender email addresses, IP addresses or domains for which all recipients registered on the mail server do not wish to receive emails, and send emails sent from blacklisted email addresses, etc. Since the reception and authentication of unnecessary e-mails are cut off at the reception and reception stages, the system not only wastes system resources and improves processing efficiency, but also prevents the system from being overloaded by sending unnecessary authentication mails to the other party's mail server. You can,

(7) Since all the recipients registered in the mail server do not want to receive the e-mail, they are registered in the black list only, so that the necessary e-mails can be prevented from being lost, thereby preventing the damage of the recipients and the bona fide senders. The blacklist is also compared and updated in real time, so that the sender who wants to receive the e-mail can be prevented from being registered in the blacklist, thus providing a blacklist considering the characteristics of the entire recipients of the mail server.

(8) By multi-blocking incoming e-mail through a multi-blocking engine, you can effectively block not only spam e-mails but also infected with viruses or malware.

(9) By blocking virus mail and verified spam mail without sending authentication mail through multi-blocking engine, it prevents waste and overload of system resources due to sending and processing a large amount of authentication mail and receives a large amount of authentication mail. To prevent the other party's mail server from being overloaded.

(10) In order to guide the authentication details and the authentication process, the guide information including the recipient's photo, audio file and video file is included in the authentication mail, so that the sender can easily understand the authentication details and the authentication process. By effectively eliminating the sender's rejection of the authentication process, non-spammers can be encouraged to accept authentication.

(11) It can be applied to other mail systems using the authentication method through authentication mail, so it is highly scalable.

While preferred embodiments of the present invention have been described using specific terms, such descriptions are for illustrative purposes only and it is understood that various changes and modifications may be made therein without departing from the spirit and scope of the following claims. You must lose.

Claims (8)

Located at the front end of the mail server for transmitting and receiving a plurality of e-mails, and transmits an authentication mail for authenticating the sender to the sender's e-mail address to send each e-mail, and whether the sender responds to the authentication mail A spam mail blocking system for authenticating the sender and receiving / deleting the e-mail according to Receiving each of the e-mail, and temporarily stores each e-mail in the temporary storage for a set time after the authentication mail is transmitted, and delete if the sender's response is not received within the set time, A mail transmission / reception unit for transmitting the temporarily stored e-mail to a mail account of the receiver of the mail server when a response of the sender is received within a set time; A blacklist for storing the sender's e-mail address or IP address which all the recipients registered in the mail server refuse to receive; A blacklist blocking unit positioned at a front end of the mail transmitting / receiving unit and blocking reception of an e-mail transmitted from an e-mail address or an IP address included in the blacklist among the received e-mails; An authenticator list for storing the sender's e-mail address authenticated through the authentication mail and an e-mail address of any sender registered by the receiver of the e-mail to receive the e-mail without the authentication; Search whether the sender's e-mail address is included in each recipient's certifier list for each e-mail, and authenticating each e-mail with the sender's e-mail address not included in the authenticator list; An authentication processing unit for transmitting each mail and authenticating the sender for each of the recipients according to whether the sender accesses and responds through the authentication mail; A pending list which is a list linked to the temporary stored e-mail so that each recipient can arbitrarily select and receive and store the e-mail temporarily stored in the temporary storage unit; And In connection with the temporary storage unit, the pending list, and the authenticator list, each e-mail that is not received through the pending list by all recipients of the electronic mail among the e-mails temporarily stored in the temporary storage unit for the set time. Registering the sender's e-mail address or IP address of the e-mail having the same characteristics as the blacklist by comparing each property including the sender's e-mail address, originating IP, the subject of the e-mail, and the body content of the e-mail. And a blacklist processing unit which compares the blacklist and the authenticator list in real time and deletes an email address of a sender commonly included in the blacklist and the authenticator list from the blacklist, The authentication mail includes a picture of each recipient, guide information including at least one of a voice file and an image file for guiding an authentication process through the authentication mail, and a URL for the sender to access the authentication processing unit. Information and unique keys, The authentication processing unit transmits the first authentication mail to the sender's e-mail address, respectively, for the first e-mail which is part of the plurality of e-mails sent by the same sender temporarily stored in the temporary storage unit. When the sender's response to each of the first authentication mails is received within a set time, a second authentication mail is sent to the sender's e-mail address for the second e-mail which is the remaining e-mails among the plurality of e-mails sent by the sender. Respectively transmitting and transmitting the first and second e-mails if the sender's response to each of the first authentication e-mails is not received within the predetermined time period. . The method of claim 1, The spam email blocking system, Located at the front end of the mail transmission and reception section, through the communication with the sender's mail server by an SMTP session, it refuses to receive an e-mail whose recipient is a mail account not registered in the mail server. False account blocking unit; An anti-virus unit positioned at a front end of the authentication processing unit to block and delete an e-mail infected with a virus and a malicious code among e-mails received from the mail transmission / reception unit; And Located in the front end of the authentication processing unit, further comprising a spam pattern ranking unit for blocking and deleting the e-mail containing a specific word and format extracted by the pattern analysis of spam mail of the e-mail received in the mail transmission and reception unit; Spam mail blocking system, characterized in that. The method of claim 1, The mail transmitting and receiving unit transmits an e-mail selected by the recipient from the pending list to the mail account of the recipient of the mail server regardless of whether the mail is sent or not. And the authentication processing unit adds the sender's email address for the email selected by the recipient from the pending list to the authenticator list. The method according to any one of claims 1 to 3, The authentication processing unit stores the unique key for the authentication mail and a corresponding key value for verifying the sender's response to the unique key, and connects the sender through the authentication mail and for the unique key. And the sender's response is compared with the key value to authenticate the sender. The method according to any one of claims 1 to 3, And the authentication processing unit displays a special character pattern processed on a web page linked with the access information, receives the special character pattern from the sender, and authenticates the sender. The method according to any one of claims 1 to 3, And the authentication processing unit provides a question with a correct answer in a web page linked to the access information, and receives the correct answer from the sender and authenticates the sender according to whether the correct answer is received. In front of a mail server that transmits and receives a plurality of e-mails, an authentication mail for authenticating the sender is transmitted to an e-mail address of the sender that transmits each of the e-mails, and according to whether the sender responds to the authentication mail. A spam blocking method for authenticating the sender and sending the email of an authenticated sender to a recipient, A first step of blocking reception of an e-mail transmitted from an e-mail address or an IP address included in a blacklist storing an e-mail address or an IP address of a sender who has been rejected by all the recipients registered in the mail server; A second step of receiving each e-mail not blocked in the first step; A third step of retrieving the sender's e-mail address from each authenticator list generated for each recipient of the e-mail, the sender's e-mail address being a list of sender's e-mail addresses authorized and approved for transmission to the recipient; A fourth step of sending, for a recipient having an authenticator list including the sender's email address, each email sent to the recipient to a mail account of the recipient of the mail server; A fifth step of temporarily storing each e-mail sent to the recipient for a recipient having an authenticator list not including the sender's e-mail address; Guide information including at least one of a picture of each recipient, a voice file and an image file for guiding an authentication process through the authentication mail, with respect to a first e-mail of a part of the temporarily stored e-mails; A sixth step of sending a first authentication mail to the sender's e-mail address by generating a first authentication mail including a unique key and access information including a URL for the sender to access a specific web page for authentication; If the sender's response to the first authentication mail is received within a set time, send the first email to the mail account of the recipient of the mail server, and send the sender's email address to the authenticator list of the recipient. Adding to the seventh step; At least one of a picture of each recipient and a voice file and a video file for guiding the authentication process through the authentication mail are received for the second e-mail other than the first e-mail among the temporarily stored e-mails. Generating a second authentication mail including guide information, a connection information including a URL for accessing a specific web page by the sender for authentication, and a unique key, and sending the second authentication mail to the sender's e-mail address. An eighth step of transmitting; If the sender's response to the second authentication mail is received within the set time, send the second email to the mail account of the recipient of the mail server, and send the sender's email address to the authenticator of the recipient. A ninth step of adding to the list; A tenth step of deleting the temporarily stored second e-mail when the sender's response to the second authentication mail is not received within the set time; An eleventh step of deleting all of the temporarily stored first and second e-mails when the response of the sender to the first authentication mail is not received within the set time; Twelfth step of respectively providing the recipient with a pending list which is a list linked with the first and second e-mails so that the recipient can confirm the temporarily stored first and second e-mails; The e-mail selected by the recipient from the pending list is transmitted to the mail account of the recipient of the mail server regardless of whether the sender responds to the first authentication mail and the second authentication mail, Adding a sender's e-mail address to the recipient's authenticator list; Among the e-mails temporarily stored in the fifth step, all recipients of the e-mails have the same characteristics by comparing the respective characteristics between each e-mail not selected through the pending list in the twelfth and thirteenth steps. A fourteenth step of registering an e-mail address or an IP address of an e-mail sender in the blacklist; And And a fifteenth step of deleting from the blacklist an email address of a sender commonly included in the blacklist and each authenticator list by comparing the blacklist and the respective authenticator lists in real time. The seventh step to the tenth step and the eleventh step are selectively performed, the ninth step and the tenth step are selectively performed, and the twelfth and thirteenth steps are the sixth to And the fifteenth step is performed irrespective of the order of the tenth step, and the fifteenth step is performed regardless of the order of the first step to the fourteenth step. The method of claim 7, wherein Fourteenth step, For each of the e-mails temporarily stored in the fifth step, all the recipients of the e-mail have not selected through the pending list in the twelfth and thirteenth steps, Step 14-1 of comparing the sender's e-mail address and registering the sender's e-mail address of the same e-mail with the same sender's e-mail address in the blacklist when there are multiple e-mails with the same sender's e-mail address; ; A step 14-2 of comparing sender IPs and registering a plurality of e-mails having the same outgoing IP, in the blacklist, an IP address of a sender of the e-mail having the same outgoing IP; A step 14-3 of comparing the subjects of the e-mails and registering a plurality of e-mails having the same subject, in the blacklist, an e-mail address or an IP address of a sender of the same e-mail; And When the body of the e-mail is hashed, converted to a code, and the converted code is compared to have multiple e-mails having the same converted code, the e-mail address or IP of the sender of the same e-mail. And steps 14-4 of registering an address to the blacklist, The method for blocking spam mail, wherein steps 14-1 to 14-4 are performed regardless of the order.

Images