KR20150089741A - System for converting e-mail attachment file and providing method thereof - Google Patents

Abstract

The present invention relates to a system for converting an attachment file of an e-mail and a providing method thereof, the system preventing a variety of malware from spreading via an attachment file of an e-mail. According to an aspect of the present invention, the system comprises: an extracting module extracting an attachment file from an original e-mail containing the attachment file; a converting module converting the extracted attachment file to generate a copied attachment file; a generating module attaching the generated copied attachment file to the original e-mail to generate a copied e-mail; and a transmitting module transmitting the generated copied e-mail to an account of the receiver of the original e-mail, wherein the converting module, when the attachment file is a document file which can be visualized by a viewer application or an editing application corresponding to the attachment file, generates the copied attachment file containing the visualized content of the document file.

Description

[0001] System for converting e-mail attachments [0002]

The present invention relates to an e-mail attachment file conversion system and a method for providing the same. More particularly, the present invention relates to an e-mail attachment file conversion system and a method for providing the e-mail attachment file conversion system that can prevent various malware from being propagated through an attachment file of an e-mail.

Recently, with the rapid spread of the Internet, it becomes common to exchange e-mail using the Internet. E-mail not only has a significantly faster transmission speed than conventional communication means such as letters, telephones, and telegrams, but also has the advantage that the same contents can be simultaneously transmitted to a large number of people.

1 schematically shows an operation of a conventional electronic mail system. Referring to FIG. 1, an e-mail service is performed through a sender's mail server 20 and a recipient's mail server 30. When a sender creates an e-mail including an attached file through a mail client provided in his / her terminal 10 and sends it to the receiver, the e-mail is transmitted to the sender's mail server 20 by SMTP (Simple Mail Transfer Protocol) do. The sender's mail server 20 uses the SMTP to send the e-mail to the recipient's mail server 30 to which the recipient subscribes. The mail sent to the recipient mail server 30 is sent to the recipient terminal 40 by POP3 (Post Office Protocol version 3) or IMAP (Internet Message Access Protocol) The received mail can be confirmed. In addition, not only simple text but also voice, image, moving picture files and various types of files used in various application programs can be attached to the e-mail, and the e-mail can also be used as a data transmission means.

Meanwhile, malicious code or malware is spreading rapidly through the network. Malware or malware is a generic term for all software that can harm your computer. Various malicious codes, such as spyware, malicious code that extracts user information, adware that automatically displays advertisements when a computer is used, hijackers that move to unintentional websites, and pop-up windows are appearing, . These malicious codes have been infected through the web in the past. However, recently, many users are exploiting the fact that they use the e-mail, and the spread of the malicious code through the e-mail is also increasing. In particular, these malicious codes are delivered as attachments of e-mails. When a user opens a file attached to an e-mail, the malicious code is automatically infected to the user's computer.

Conventionally, in order to prevent the malware from being propagated to an e-mail attachment file, the sender or the recipient directly inspects the attached file through various applications (for example, a vaccine program, etc.) , The mail server performs an inspection of the attached file, and if the attachment is infected with malware, the remedy is transmitted to the receiver.

However, if the performance of the malware inspection program installed on the user's terminal or the mail server is low or the update is not performed on time, the malware can not be detected, and the detection / Even if new malware appears, it will not be able to cope. Macro viruses, which are hidden in the form of macros in electronic documents that can be read by applications such as word processors and spreadsheets, are often difficult to detect with vaccine programs.

Disclosure of Invention Technical Problem [8] Accordingly, the present invention has been made in view of the above problems occurring in the prior art, and an object of the present invention is to provide a system and method for securely transmitting an attachment attached to an e- will be.

The present invention also provides a system and a method for allowing a recipient to confirm the content described in an attached file even if the attached file attached to the e-mail is infected with malware.

The present invention also provides a system and a method for allowing a recipient to receive an attachment with removed malware if the attachment attached to the email is infected with malware.

According to an aspect of the present invention, there is provided an information processing apparatus including an extraction module for extracting an original attachment file from an original e-mail including an original attachment file, a copy attaching file generation module for converting the extracted original attachment file to generate a copy attaching file, A copy e-mail generating module for attaching the copy attached file to the original e-mail to generate a copy e-mail, and a transfer module for transferring the generated copy e-mail to the recipient account of the original e-mail, Wherein the attachment file generation module is configured to generate the attachment file when the original attachment file is a document file that can be visualized by a viewer application or an editing application corresponding to the original attachment file, An e-mail attachment conversion system is provided that generates an attachment.

In one embodiment, the copy attachment file generation module may generate the copy attachment file containing the visualized contents of the document file as a file in a PDIF (PDF) format or an image format.

In one embodiment, the copy email creation module may remove the original attachment from the original email and generate the copy email by attaching the generated copy attachment.

In one embodiment, the e-mail attachment file conversion system may further include a storage module for storing the extracted original attachment file, wherein the copy e-mail creation module is configured to store the copy attachment file generated in the original e- And inserts a hyperlink indicating the original attached file to generate the copy e-mail.

In one embodiment, the e-mail attachment file conversion system further includes a storage module for storing the extracted original attachment file, wherein the copy attachment file generation module includes a hyperlink indicating the stored original attachment file The copy attaching file can be generated.

In one embodiment, the e-mail attachment file conversion system may further include a distortion file generation module that converts a file format of the original attachment file to generate a distortion file corresponding to the original attachment file, And an attachment file providing module for providing the generated distortion file in response to the generated attachment file.

In one embodiment, the e-mail attachment file conversion system includes a distortion file generation module that inserts predetermined padding information into a padding area of the original attachment file and generates a distortion file corresponding to the original attachment file, And an attachment file providing module for providing the generated distortion file in response to the transmission request of the original attachment file.

In one embodiment, the padding information is hashing the input value including at least one of the original e-mail information, the original attached file information, or the user's identification information corresponding to the user terminal requesting the original attached file, And a hash value generated by the hash value generating unit.

In one embodiment, the e-mail attachment file conversion system may convert the file format of the original attachment file to generate a distorted file corresponding to the original attachment file, or may include predetermined padding information in the padding area of the original attachment file And a distortion file generation module for generating a distortion file corresponding to the original attachment file by inserting the distortion correction file into the copy attachment file, wherein the copy attachment file generation module generates the copy attachment file so that the generated distortion file is further included in the copy attachment file. Can be generated.

In one embodiment, the e-mail attachment file conversion system executes the original attachment file in a virtual environment, and when a predetermined executable file or script is generated by execution of the original attachment file, the original attachment file is referred to as malware And an attaching file providing module for providing the original attached file in response to the request for transmission of the original attached file, when the original attached file is determined not to be malware.

According to another aspect of the present invention, there is provided an information processing apparatus including an extraction module for extracting an original attachment file from an original e-mail including an original attachment file, a conversion module for converting the file format of the original attachment file, A copy file creation module for creating a copy file by attaching a copy attaching file including the generated distortion file to the original electronic mail to generate a copy electronic mail, An e-mail attachment conversion system is provided that includes a delivery module for delivering to a recipient account.

According to another aspect of the present invention, there is provided an information processing apparatus including an extraction module for extracting an original attachment file from an original e-mail including an original attachment file, an insertion module for inserting predetermined padding information into the padding area of the original attachment file, A copy file creation module for creating a copy file by attaching a copy attachment file including the generated distortion file to the original electronic mail, and a copy file creation module for creating a copy file To a recipient account of the original e-mail, is provided.

According to another aspect of the present invention, there is provided a method of extracting an original attachment from an original e-mail including: (a) extracting the original attachment from an original e-mail including an original attachment; (b) (c) attaching the copy attaching file to the original e-mail to generate a copy e-mail; and (d) transferring the generated copy e-mail to the recipient account of the original e-mail, Wherein the step (b) includes the steps of: (b ') if the original attached file is a document file that can be visualized by a viewer application or an editing application corresponding to the attached file, the copy including the visualized contents of the document file There is provided a method of providing an e-mail attachment file conversion system including generating an attachment file.

In one embodiment, the step (b ') may include generating the copy attachment file including the visualized contents of the document file as a file of a PDIF format or an image format.

In one embodiment, the step (c) may include removing the attachment from the original electronic mail, and attaching the generated copy attachment to the original electronic mail to generate a copy e-mail .

In one embodiment, the method for providing an e-mail attachment file conversion system further includes storing the extracted attachment file, wherein the step (c) includes attaching the copy attachment file generated in the original e- And generating a copy e-mail by inserting a hyperlink indicating the stored original attachment file.

In one embodiment, the method for providing an e-mail attachment file conversion system further includes storing the extracted original attachment file, wherein (b) includes a hyperlink indicating the stored original attachment file And creating the copy attachments.

In one embodiment, the method for providing an e-mail attachment file conversion system includes converting a file format of the original attachment file to generate a distortion file corresponding to the original attachment file, And providing the generated distortion file.

In one embodiment, the method for providing an e-mail attachment file conversion system includes the steps of: inserting predetermined padding information into a padding area of the original attachment file to generate a distortion file corresponding to the original attachment file; And providing the generated distortion file in response to the transmission request of the distortion file.

In one embodiment, the method of providing an e-mail attachment file conversion system may include converting a file format of the original attachment file to generate a distortion file corresponding to the original attachment file, Further comprising the step of inserting the information to generate a distorted file corresponding to the original attached file, wherein the step (b) may further include causing the generated distorted file to be included in the copy attached file .

In one embodiment, the method of providing an e-mail attachment file conversion system may include: executing the original attachment file in a sandbox environment, and when a predetermined executable file or script is generated by execution of the original attachment file, Determining whether the original attachment file is malware, and providing the original attachment file when it is determined that the original attachment file is not malware, in response to the transmission request of the original attachment file.

According to another aspect of the present invention, there is provided a method of extracting an original attached file, the method including extracting the original attached file from an original e-mail including an original attached file, converting the file format of the original attached file, Adding a copy attached file containing the generated distortion file to the original e-mail to generate a copy e-mail, and delivering the generated copy e-mail to the recipient account of the original e-mail A method of providing an e-mail attachment file conversion system is provided.

According to another aspect of the present invention, there is provided a method for extracting an original attached file from an original e-mail including an original attached file, Generating a copy file by attaching a copy attached file containing the generated distortion file to the original electronic mail, and creating the copied electronic mail by copying the generated copy electronic mail to the recipient account of the original electronic mail A method of providing an e-mail attachment file conversion system, the method comprising:

According to another aspect of the present invention, there is provided a computer-readable recording medium on which a program for performing the above-described method is recorded.

According to another aspect of the present invention there is provided an electronic mail attachment conversion system comprising a processor and a memory for storing a computer program executed by the processor, wherein the computer program, when executed by the processor, There is provided an e-mail attachment file conversion system for causing a mail attachment file conversion system to perform the above-described method.

According to an embodiment of the present invention, even if the attachment attached to the original e-mail created by the sender is infected with malware, the recipient does not receive the attachment file as it is, have.

That is, there may be a kind of malware which can not be detected by the malware inspection program. Therefore, there is a limitation in the conventional method of inspecting the attached file of the mail with the malware inspection program installed on the terminal (mailer or receiver) none. However, according to the technical idea of the present invention, since a copy attaching file containing only the visualized contents of the attached file is delivered to the recipient, the attached file attached to the original electronic mail may not be transmitted to the terminal of the recipient even if infected by the malware . In particular, even when a macro or script type malware automatically executed by an application program such as a word processor S / W or a spreadsheet S / W is inserted in a document file, the recipient can confirm the contents of the attached file, Malware may not be propagated to the terminal.

Also, according to an embodiment of the present invention, a distorted file generated by transforming the attached file may be provided instead of the original of the attached file. Since the malware included in the attached file may be removed in the process of generating the distorted file, the malware may not be transmitted to the terminal of the user receiving the distorted file.

Therefore, even when malware of the form that is not detected by the recipient terminal or the anti-virus software installed in the mail system is inserted in the attachment file, the effect can be blocked.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
1 is a diagram schematically showing an operation of a conventional electronic mail system.
2 is a schematic diagram for explaining an e-mail attachment file conversion system according to an embodiment of the present invention.
3 is a block diagram schematically showing the configuration of an e-mail attachment file conversion system according to an embodiment of the present invention.
4 is a flowchart illustrating a method for checking malware in an e-mail attachment file conversion system according to an embodiment of the present invention.
5 is a diagram illustrating a method of inserting padding information in a padding area according to an e-mail attachment file conversion system according to an embodiment of the present invention.
6A and 6B are diagrams for explaining an e-mail attachment file conversion system according to another embodiment of the present invention.
7 to 10 are views for explaining an operation method of an e-mail attachment file conversion system according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component. Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

Hereinafter, the present invention will be described in detail with reference to the embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

2 is a schematic diagram for explaining an e-mail attachment file conversion system according to an embodiment of the present invention.

Referring to FIG. 2, an e-mail attachment file conversion system 100 may be provided to implement a method of providing an e-mail attachment file conversion system according to an embodiment of the present invention. The e-mail attachment file conversion system 100 receives the original e-mail to be transmitted from the sender terminal 10, converts the original attachment file included in the original e-mail into a predetermined method as described below, Can be generated. Also, the e-mail attachment file conversion system 100 may transmit a copy e-mail having the copy attaching file attached thereto instead of the original attachment file to the recipient's e-mail account. As shown in FIG. 2, the e-mail attachment file conversion system 100 according to the present embodiment can transmit the copy e-mail to the sender's mail server 20 to the recipient's e-mail account. In this case, the e-mail attachment file conversion system 100 can implement the technical idea of the present invention by transmitting / receiving predetermined information to / from the sender terminal 10 and / or the sender's mail server 20 via a wire / wireless network.

2, the e-mail attachment file conversion system 100 may be implemented as a server separate from the sender mail server 20. In this case, the e-mail attachment file conversion system 100 may include The sender terminal 10 intercepts the e-mail sent to the sender's mail server 20 and can perform the above-described procedure. 2, in another embodiment at least some of the components of the e-mail attachment file conversion system 100 may be implemented within the sender's mail server 20.

3 is a block diagram schematically showing the configuration of an e-mail attachment file conversion system 100 according to an embodiment of the present invention.

3, the e-mail attachment file conversion system 100 includes an extraction module 110, a storage module 120, a copy attachment file creation module 130, a copy e-mail creation module 140, 150, a distortion file generation module 160, an attachment file determination module 170, and an attachment file provision module 180. According to an embodiment of the present invention, some of the above-mentioned components may not necessarily correspond to the components necessary for the implementation of the present invention, and the e-mail attachment file conversion system 0.0 > 100 < / RTI > may include more components. For example, the e-mail attachment file conversion system 100 may include other components included in the e-mail attachment file conversion system 100 (e.g., extraction module 110, storage module 120, (E.g., a file creation module 130, a copy email creation module 140, a delivery module 150, a distortion file creation module 160, an attachment file determination module 170, and / or an attachment file provision module 180) And a control module (not shown) for controlling functions and / or resources.

The e-mail attachment file conversion system 100 may include hardware resources and / or software required to implement the technical idea of the present invention, and may be a single physical component or a single device It does not mean anything. That is, the e-mail attachment file conversion system 100 may mean a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, The present invention may be embodied as a set of logical structures for realizing the technical idea of the present invention. Also, the e-mail attachment file conversion system 100 may mean a set of configurations separately implemented for each function or role for implementing the technical idea of the present invention. For example, the extraction module 110, the storage module 120, the copy attachment file creation module 130, the copy email creation module 140, the delivery module 150, the distortion file creation module 160, The determination module 170 and / or the attachment file provision module 180 may be located in different physical devices or may be located in the same physical device. According to an embodiment of the present invention, the extraction module 110, the storage module 120, the copy attachment file creation module 130, the copy email creation module 140, the delivery module 150, the distortion file creation module 160 ), The attachment file determination module 170, and / or the attachment file provision module 180 are also located in different physical devices, and the detailed elements located in different physical devices are organized May be combined to realize the functions performed by each individual module.

In this specification, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the module may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and it does not necessarily mean a physically connected code or a kind of hardware But can be easily deduced to the average expert in the field of the present invention.

The extraction module 110 may extract the attached file from the original electronic mail including the attached file.

The original e-mail may be an e-mail created by a sender using a mail client installed in the terminal 10 of the sender. When the sender terminal 10 transmits the original e-mail to the sender's mail server, the extracting module 110 analyzes the original e-mail and separates the attachment file from the original e-mail That is, extraction).

The storage module 120 may store the extracted attachment file in a predetermined storage space (e.g., a database DB).

The copy attached file generation module 130 may convert the attached file extracted from the original electronic mail (hereinafter, referred to as 'original attached file') to generate a copy attachment file.

The original attachment may be a viewer application corresponding to the original attachment or a document file that can be visualized by an editing application. For example, the attachment may be a .doc type file that can be edited by a Microsoft word processor application (MS Word), or a .xls type of file that can be edited by Microsoft's spreadsheet application (MS Exel). File or an .html type file that can be opened by a web browser application. In addition, application software capable of viewing or editing a file of a corresponding type may be varied according to the type of the attached file. For example, the application software can be easily edited by a person .

If the original attached file is a document file that can be visualized by a viewer application or an editing application corresponding to the original attached file, the copy attached file generation module 130 generates a copy attached file containing the visualized contents of the document file File can be generated. In this specification, the fact that the document file can be visualized means that it can be loaded by the viewer application or the editing application corresponding to the document file and output to the display device, The document file may be a result output by a predetermined display device or a printer device by a viewer application or an editing application.

If the document file includes a macro or an action script for performing a predetermined action defined by the creator, the copy attached file creation module 130 may include a macro or an action script in the copy attachment file So that the conversion module can include only the contents in which the document file is visualized. At this time, if the macro or the action script satisfies a predetermined condition (for example, when a user inputs a specific key or a file is opened or closed), the creator may perform a desired command group And the like.

To this end, the copy attached file generation module 130 generates the copy attached file including the visualized contents of the document file as a file of a PDF (Portable Document Format) or an image format can do. PDF is an electronic document format developed by Adobe Systems Incorporated. It can include general documents and characters, shapes, drawings, and fonts. If the copy attached file generated by the copy attached file generation module 130 is an image, the image may be JPEG, GIF, TIFF or the like according to an embodiment.

Since the copy attached file generation module 130 converts the document file into a FEP or an image, the copy attached file may include only the visualized contents of the document file. Thus, according to an embodiment of the present invention, even if a malicious document such as a macro or a script is infected with a document file, the copy attachment file may not include the malware. Therefore, when a copy attachment file is sent to a recipient instead of a document file included in the original electronic mail, the recipient's terminal can be safe even in the form of a macro or a script that is difficult for malware to detect.

In an embodiment, the copy attachment file generation module 130 may use a file printer to convert a document file into a PDIF format or an image format. That is, the copy attached file generation module 130 may generate the copy attached file by outputting the document file to a file printer that outputs the document file in the PDIF format or the image format. The file printer may be a virtual printer, which is a type of computer software that outputs input data as a digital document of a specific file type. A virtual printer is similar to a physical printer because its user interface and application programming interface (API) are similar to a physical printer, so that a user or developer has the same user experience as a physical printer, but the output can be in the form of a file. In addition, when the copy attached file generation module 130 generates a copy attached file using a file printer, the generated copy attached file contains only the visualized contents of the document file, so that the visualized contents (E.g., malware that may be included in the document file, etc.) may not be included in the copy attachments.

According to an embodiment, the copy attachment file generation module 130 may convert the document file using a predetermined viewer application or an editing application capable of reading a document corresponding to the type of the document file. That is, the copy attachment file generation module 130 calls a predetermined application that can read a document corresponding to the type of the document file, and the called application reads the document file, drives the file printer, A document file may be transmitted to the file printer to control the copy attached file to be generated. Also, according to the embodiment, the copy attached file generation module 130 can check the file type of the document file to be converted and then call an application capable of reading the digital document of the file type. For example, the copy attached file generation module 130 may classify the file type through the extension of the file, but depending on the embodiment, the copy attached file generation module 130 may store internal metadata (file header, magic number) or external metadata (Mac OS type code, (UTI, OS / 2 extensions, POSIX extensions, MIME types, file format identifiers (FFIDs), and file content-based format authentication). Meanwhile, the copy attached file generation module 130 may select an application to be called according to the type of document file to be converted, and may select a file printer depending on whether the type of the copy attached file is FDF or image.

According to an embodiment, the method for converting the document attachment file creation module 130 may vary. For example, the copy attachment file generation module 130 may include a predetermined rule list for converting a document file into a copy attachment file, and the copy attachment file generation module 130 may generate a copy attachment file, The copy attachment file can be generated by extracting the elements constituting the document file by parsing the file and converting each element of the document file into elements corresponding to the copy attachment file using the rule list.

Meanwhile, the e-mail attachment file conversion system 100 may provide the original attachment to the requester in response to the user's original attachment attachment request.

To that end, in one embodiment, the storage module 120 may generate information about a hyperlink that points to the stored attachment, and then a given user terminal (e.g., 10 or 40) The attachment file may be transmitted to the requested user terminal (for example, 10 or 40).

In one embodiment, the copy attachment file generation module 130 may generate the copy attachment file including a hyperlink that points to the original attachment file stored by the storage module 120. In this case, the copy attached file may be a PDAF document or a text document including a hyperlink of the original attachment file. Also, according to an embodiment, the copy attachment file may include information on the original attachment file (e.g., name, type, size, creator, etc.).

The hyperlink to the original attachment created by the storage module 120 may be included in the copy email itself rather than in a copy attachment. To this end, the copy email creation module 140 may insert information about a hyperlink that indicates the original attachment file stored by the storage module 120 into the copy email.

Meanwhile, the attached file determination module 170 may perform malware inspection on the original attached file. The attached file determination module 170 may use various known malware inspection methods (for example, a method using a vaccine or a malicious code checking program) and perform malware inspection on the original attached file using the virtual environment can do.

4 is a diagram for explaining a method of performing malware inspection on an original attachment file according to an embodiment of the present invention.

Referring to FIG. 4, the attached file determination module 170 creates a virtual environment (S100) and executes the original attached file in the created virtual environment (S110).

The virtual environment may be formed by predetermined virtual environment provisioning software executed in a computing machine (host). The program driven in the virtual environment can not directly use the execution environment and / or the local resources included in the host, and instead can be limited to use only the execution environment and / or resources provided by the virtual environment provision software . Also, the execution result of the program executed in the virtual environment may not affect the execution environment of the host and / or the local resources. Accordingly, the attachment file determination module 170 can prevent the e-mail attachment file conversion system 100 itself from being exposed / infected by malware by executing the original attachment file in the virtual environment.

In one embodiment, the virtual environment may be implemented by a sandbox or virtual machine.

Meanwhile, the attached file determination module 170 can determine whether a separate executable file or script is generated by execution in the virtual environment of the original attached file (S120), and the executable file or script is generated , It can be determined that the original attached file is malware (S130). The attached file determination module 170 can monitor files created in the virtual environment and / or the virtual environment to determine whether a separate executable file or script has been generated by execution of the original attached file have.

The copy attached file may include a malware inspection result of the original attached file. The recipient of the mail can determine whether to download the original attached file by viewing the information about the original attached file attached to the original e-mail included in the copy attachment file converted according to the present embodiment, The original attached file can be downloaded through the hyperlink of the included original attached file.

The copy e-mail generation module 140 may generate a copy e-mail corresponding to the original e-mail transmitted by the sender terminal 10, and the transfer module 150 may transmit the generated copy e- You can forward it to the recipient account of the original e-mail. In the embodiment as shown in FIG. 2, the forwarding module 150 may send the copy e-mail to the sender's mail server 20 via SMTP to be forwarded to the recipient's mail account.

The copy e-mail generated by the copy e-mail generation module 140 may be attached to the copy attached file generated by the copy attached file generation module 130. According to an embodiment, The controller 140 may generate the copy e-mail by removing the original attachment file included in the original e-mail and attaching the copy attachment file instead.

Also, the copy e-mail generation module 140 may set the sender and receiver of the copy e-mail to be the same as the original e-mail, and contents other than the original attachment file are included in the copy e-mail .

Meanwhile, the distortion file generation module 160 may generate a distortion file corresponding to the original attachment file included in the original electronic mail, and the attachment file provision module 180 may generate a distortion file corresponding to the original attachment file, , And may provide the distortion file generated by the user terminal requesting the original attachment file. That is, when the user requests transmission of the original attachment file, the e-mail attachment file conversion system 100 provides a distorted file to the original attachment file, instead of directly providing the original attachment file, Even if the original attached file is malware or infected with malware, it is possible to provide a technical idea of securing the security of the user terminal receiving the original attached file.

The manner in which the attachment file provision module 180 provides the distortion file may vary. In one embodiment, the attachment file provision module 180 may transmit the distortion file created in the user terminal requesting the original attachment file, but may generate a hyperlink to the distortion file as described above, The mail may include a hyperlink to the distorted file so that the user terminal downloads the distorted file via the hyperlink.

In one embodiment, the distortion file generation module 160 may convert the file format of the original attachment file to generate a distortion file corresponding to the original attachment file.

The distortion file generation module 160 checks the extension of the original attachment file or the internal metadata to determine a file format of the original attachment file and then outputs a different file format corresponding to the file format of the original attachment file . ≪ / RTI >

The distortion file generation module 160 may store conversion rules between file formats. For example, if the original attachment file is a document file, the distortion file generation module 160 may convert the original attachment file into a document file of another format. For example, the distortion file generation module 160 may convert a .hwp document, which is a format that the original attachment file is supported by a word processor of Hangul and computer, into a .doc or .docx format, which is a document format of Microsoft word processor, The file format can be converted to the .pdf format, and if the original attachment is an image in .jpg format, it can be converted to another format image such as .gif, .bmp, or .tiff. This format conversion can remove malware code that may be included in the original attachment.

In particular, when the original attachment file is an image file, the distortion file generation module 160 changes the image quality of the image or moves (shifts) the position of each pixel included in the image to a certain degree, May be generated. This process also removes the malware code that may be hidden in the image.

In another embodiment, the distortion file generation module 160 may insert predetermined padding information into a padding area of the original attachment file to generate a distortion file corresponding to the original attachment file.

When data is stored in a data storage space in a typical file system, the data is divided and stored in a predetermined unit block (for example, a cluster). However, the divided data (divided data) does not always have the size of a unit block, and divided data smaller in size than the unit block may be stored in the unit block. Therefore, there may be extra space that is not used in the actual storage space, and a lot of malware codes may be infected to the file in such a manner that it is inserted into this extra space. Accordingly, the distortion file generation module 160 can remove the malware code that may be hidden in the padding space by overwriting the predetermined padding data in the extra space (i.e., the padding space).

The distortion file generation module 160 can determine the structure of the original attachment file from the file system information (e.g., file allocation table) of the data storage space in which the original attachment file is stored. For example, the distortion file generation module 160 determines information on a data block storing the original attached file and information on a space where the divided data of the original attached file is actually stored in each data block And the padding space of the original attachment file can be determined therefrom.

5 is a diagram for explaining a method of removing the malware code by inserting the padding information into the padding area by the distortion file generation module 160. [ 5 (a) shows the structure of the original attached file. As shown in FIG. 5 (a), the original attached file may be divided and stored in three unit blocks b1, b2, and b3, and each of the three unit blocks b1, b2, The padding space p1, p2, p3 may be included. On the other hand, the malware code may be stored in the padding space (p1, p2, p3).

The distortion file generation module 160 may store predetermined padding information in the padding spaces p1, p2, and p3 included in the three unit blocks b1, b2, and b3. The distortion file generation module 160 divides the padding information by the size of each padding space p1, p2, p3 included in each unit block b1, b2, b3 to form each padding space p1, p2, p3 ). ≪ / RTI > 5 (b) shows the structure of the distortion file generated by the distortion file generation module 160. FIG. In the example of FIG. 5 (b), the padding information may be I1 + I2 + I3.

Meanwhile, the padding information may be null data, but the distortion file generation module 160 may use various management information and / or tracking information as padding information. For example, the padding information may include at least one of the original e-mail information, the original attachment information, or the identification information of the user corresponding to the user terminal requesting the original attachment file. The original e-mail information may include sender information, recipient information, title information, etc. of the original e-mail, and the original attachment file information may include the title, size, and producer information of the original attached file. In particular, by allowing the padding information to include identification information of a user corresponding to the user terminal requesting the original attachment file, the user who has requested the distortion file can be traced by analyzing the distortion file.

On the other hand, there are cases where the size of the padding space may be small enough to contain all the information described above. Therefore, in one embodiment, the padding information may include the original e-mail information, Or a hash value generated by hashing an input value including at least one of identification information of a user corresponding to a user terminal requesting a file. When the hash value is generated, the padding information is formed in a relatively small size, so that the padding information can be sufficiently stored even if the size of the padding space is small.

In this way, according to the technical idea of the present invention, when an original attached file is requested, a distortion is applied to the original attached file instead of the original attached file, and a distortion file having the same or corresponding content as the original attached file, There is an effect that the malware is not propagated to the terminal of the user who receives the distortion file.

Meanwhile, the e-mail attachment file conversion system 100 may provide the distortion file described above when the user requests the original attachment file. However, the distortion file may be attached to the copy e-mail and sent to the recipient of the original e- May also be present. In this case, the copy email creation module 140 may attach a copy attaching file including the generated distortion file to the original email to generate a copy email.

Meanwhile, as described above, the e-mail attachment file conversion system 100 may be implemented between the sender terminal 10 and the sender mail server 20 (see FIG. 2) or within the sender mail server, , The e-mail attachment file conversion system 100 may be implemented at various locations other than that shown in FIG. 6A and 6B are diagrams for explaining an e-mail attachment file conversion system according to another embodiment of the present invention.

Referring to FIG. 6A, the e-mail attachment file conversion system 100 may be installed between a sender's mail server 20 and a recipient's mail server 30. In this case, the e-mail attachment file conversion system 100 receives or eavesdrops the original e-mail transmitted through the SMTP from the sender's mail server 20 and generates a copy e-mail by the method described above To the post-recipient mail server (30).

Referring to FIG. 6B, the e-mail attachment file conversion system 100 may be located between the recipient mail server 30 and the recipient terminal 40. In this case, the e-mail attachment file conversion system 100 receives the original e-mail from the recipient's mail server 30 via POP3 / IMAP or the recipient's mail server 30 transmits the original e- The original e-mail is hooked, and a copy e-mail is generated by the above-described method and transmitted to the receiver terminal 40.

Also, it will be readily appreciated by those skilled in the art that, according to an embodiment, the e-mail attachment file conversion system 100 may be implemented within the recipient mail server 20.

7 and 8 are views for explaining an operation method of the e-mail attachment file conversion system according to an embodiment of the present invention. FIG. 7 shows an example in which the attachment attached to the original e-mail created by the sender is a document file that can be visualized by a viewer application or an editing application, and FIG. 8 shows an example in which the attachment file can not be visualized .

7, the e-mail attachment file conversion system 100 extracts an original attachment file a.doc (2) included in the original e-mail 1 when receiving an original e-mail (S210) (S220). Also, the e-mail attachment file conversion system 100 may store the extracted original attachment file a.doc (2) in a predetermined DB 160 and generate hyperlink information indicating the stored original attachment file (S230 ).

Since the attachment file 2 is a .doc file editable by Microsoft word processor, the e-mail attachment file conversion system 100 converts the original attachment file a.doc (2), for example, a copy of the PDF type An attachment file a.pdf (4) may be generated (S240). According to an embodiment, the e-mail attachment file conversion system 100 may convert the original attachment a.doc (2) into an image type (e.g., JPEG, TIFF, etc.).

The e-mail attachment file conversion system 100 may generate a copy e-mail 3 including the converted copy attachment file a.pdf (S250). The generated copy e-mail 3 may include a message (excluding the original attachment file) included in the original e-mail, and may include the original attachment file a.doc stored in the DB 160 And a hyperlink 5 indicating a hyperlink.

Then, the regular e-mail attachment file conversion system 100 can forward the generated copy e-mail 3 to the recipient account (S260).

8, the e-mail attachment file conversion system 100 extracts an original attachment file b.exe (6) contained in the original electronic mail 1 when receiving the original e-mail (S310) (S320). The e-mail attachment file conversion system 100 may store the extracted attachment file b.exe 6 in a predetermined DB 160 and generate hyperlink information indicating the stored original attachment file in operation S330. .

In the example of FIG. 6, the original attachment file 6 is an executable file in the form of an. Exe, which is not a document file of a type that can be visualized, so that the e-mail attachment file conversion system 100 converts the original attachment file b.exe The copy attachment file b.pdf (7) of the PDF type including the hyperlink information of the PDF file (640) (S340). According to an embodiment, the e-mail attachment file conversion system 100 may convert the original attachment file b.doc (2) into a file type capable of expressing hyperlink information of the attachment file, such as a text type.

The e-mail attachment file conversion system 100 may generate a copy e-mail 3 including the copy attachment b.pdf (S350). The generated copy e-mail 3 may include a message (excluding the original attachment file) included in the original e-mail.

Thereafter, the regular e-mail attachment file conversion system 100 can forward the generated copy e-mail 3 to the recipient account (S360).

9 and 10 are views for explaining an operation method of an e-mail attachment file conversion system according to another embodiment of the present invention. 9 and 10 show an example in which the e-mail attachment file conversion system generates a distortion file.

9, the e-mail attachment file conversion system 100 can extract the original attachment A 8 included in the original e-mail 1 when receiving the original e-mail (S410) (S420).

The e-mail attaching file conversion system 100 may generate the distorted file A 'by distortion-transforming the extracted original attachment file A (8) by various distortion transform methods described above (S430). In addition, the e-mail attachment file conversion system 100 may generate a copy e-mail 3 including the converted distorted file A '9 (S440).

Then, the e-mail attachment file conversion system 100 can forward the generated copy e-mail 3 to the recipient account (S450).

10, the e-mail attachment file conversion system 100 extracts an original attachment file a.jpg (10) included in the original e-mail 1 when receiving the original e-mail (S510) The e-mail attachment file conversion system 100 can convert the extracted original attachment file a.jpg (10) to generate a PDF-type copy attachment file a.pdf (S520). The e-mail attachment file conversion system 100 may generate a copy e-mail 3 including the converted copy attachment file a.pdf 11 at operation S250. Meanwhile, the generated copy e-mail 3 may further include a hyperlink 12 for requesting the original attachment.

Then, the regular e-mail attachment file conversion system 100 can forward the generated copy e-mail 3 to the recipient account (S540).

Then, the user terminal of the user who has received the copy e-mail can request the original attachment file using the original attachment file request link 12 included in the copy e-mail (S550).

Then, the e-mail attachment file conversion system 100 can distort the original attached file a.jpg to generate the distorted file a'.jpg (S560).

Meanwhile, according to an exemplary embodiment, the e-mail attachment file conversion system 100 may request approval of whether the original attached file or the distorted file is transmitted to the user terminal by a predetermined approver terminal (S570). Then, the approver terminal can determine whether the predetermined policy for transmission is satisfied in the original attached file, and approve the transmission (S580).

Thereafter, the distorted file a'.jpg may be transmitted to the user terminal instead of the original attached file a.jpg (S590).

According to the technical idea of the present invention as described above, since the recipient receives the copy attached file instead of the attached file attached to the original electronic mail, the malware which may be included in the attached file may not be transmitted to the recipient's terminal . Also, since the copy attached file contains only the contents of the attached file, the macro file or the script type malware automatically executed by an application program such as a word processor S / W or a spreadsheet software is inserted in the document file Even if the recipient can confirm the contents of the attached file, the malware may not propagate to the recipient's terminal. Therefore, it is possible to block the malware of the form that is not detected by the recipient terminal or the recipient terminal or the anti-virus software installed in the mail system (20 or 30) or the mail system (20 or 30) .

Meanwhile, according to an embodiment, the e-mail attachment conversion system 100 may include a processor and a memory for storing a program executed by the processor. The processor may include a single-core CPU or a multi-core CPU. The memory may include high speed random access memory and may include non-volatile memory such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid state memory devices. Access to the memory by the processor and other components can be controlled by the memory controller. Here, when the program is executed by a processor, the program may cause the e-mail attachment file conversion system 100 according to the present embodiment to perform the above-described method of providing an e-mail attachment file conversion system.

Meanwhile, a method for providing an e-mail attachment file conversion system according to an embodiment of the present invention may be implemented in the form of computer-readable program instructions and stored in a computer-readable recording medium. In the control method according to an embodiment of the present invention, The program and the target program may also be stored in a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software.

Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk and a magnetic tape, optical media such as CD-ROM and DVD, a floptical disk, And hardware devices that are specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. The above-mentioned medium may also be a transmission medium such as a light or metal wire, wave guide, etc., including a carrier wave for transmitting a signal designating a program command, a data structure and the like. The computer readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner.

Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is intended that the present invention covers the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. .

Claims (25)

An extraction module for extracting the original attached file from the original e-mail including the original attached file;
A copy attachment file generation module for converting the extracted original attachment file to generate a copy attached file;
A copy e-mail generation module for attaching the generated copy attaching file to the original e-mail to generate a copy e-mail; And
And a delivery module for delivering the generated copy e-mail to the recipient account of the original e-mail,
The copy attached file generation module includes:
Wherein the original attachment is a viewer application corresponding to the original attachment or a document file that can be visualized by an editing application, the electronic file generating the copy attachment file containing the visualized contents of the document file, Mail attachment conversion system.
The method according to claim 1,
The copy attached file generation module includes:
Wherein the copy attaching file including the visualized contents of the document file is generated as a file in a PDF (Fifth) format or an image format.
The method according to claim 1,
The copy e-mail generation module includes:
An original attachment file is removed from the original e-mail, and the copy e-mail is generated by attaching the generated copy attachment file.
The electronic mail attachment conversion system according to claim 1,
And a storage module for storing the extracted original attachment file,
The copy e-mail generation module includes:
Attaching the copy attached file generated in the original electronic mail and inserting a hyperlink indicating the original attached file to generate the copy electronic mail.
The electronic mail attachment conversion system according to claim 1,
And a storage module for storing the extracted original attachment file,
The copy attached file generation module includes:
And generating the copy attachment file including a hyperlink indicating the stored original attachment file.
The electronic mail attachment conversion system according to claim 1,
A distortion file generation module for converting a file format of the original attached file to generate a distorted file corresponding to the original attached file; And
And an attachment file providing module for providing the distortion file generated in response to the transmission request of the original attachment file (to the user terminal requesting the original attachment file).
The electronic mail attachment conversion system according to claim 1,
A distortion file generation module that inserts predetermined padding information into a padding area of the original attachment file and generates a distortion file corresponding to the original attachment file; And
And an attachment file providing module for providing the generated distortion file in response to the transmission request of the original attachment file.
8. The method of claim 7,
The padding information includes:
Wherein the hash value is generated by hashing an input value including at least one of the original e-mail information, the original attached file information, or the identification information of the user corresponding to the user terminal requesting the original attached file. Mail attachment conversion system.
The electronic mail attachment conversion system according to claim 1,
A distortion file corresponding to the original attachment file is generated by converting the file format of the original attachment file or inserting predetermined padding information into the padding area of the original attachment file to generate a distortion file corresponding to the original attachment file A distortion file generation module,
The copy attached file generation module includes:
And generates the copy attachment file such that the generated distortion file is further included in the copy attachment file.
The electronic mail attachment conversion system according to claim 1,
An attached file determination module that executes the original attached file in a sandbox environment and determines that the original attached file is malware when a predetermined executable file or script is generated by execution of the original attached file; And
And an attachment file providing module for providing the original attachment file when it is determined that the original attachment file is not malware in response to the transmission request of the original attachment file.
An extraction module for extracting the original attached file from the original e-mail including the original attached file;
A distortion file generation module for converting a file format of the original attached file to generate a distorted file corresponding to the original attached file;
A copy e-mail generation module for attaching a copy attachment file including the generated distortion file to the original e-mail to generate a copy e-mail; And
And forwards the generated copy email to the recipient account of the original email.
An extraction module for extracting the original attached file from the original e-mail including the original attached file;
A distortion file generation module that inserts predetermined padding information into a padding area of the original attachment file and generates a distortion file corresponding to the original attachment file;
A copy e-mail generation module for attaching a copy attachment file including the generated distortion file to the original e-mail to generate a copy e-mail; And
And forwards the generated copy email to the recipient account of the original email.
(a) extracting the original attached file from an original e-mail including an original attached file;
(b) converting the extracted attachment file to generate a copy attachment file;
(c) attaching the copy attached file to the original e-mail to generate a copy e-mail; And
(d) delivering the generated copy email to the recipient account of the original email,
The step (b)
(b ') if the original attachment file is a document file that can be visualized by a viewer application or an editing application corresponding to the attachment file, generating the copy attachment file including the visualized content of the document file A method for providing an e-mail attachment file conversion system.
14. The method of claim 13,
The step (b ') comprises:
And generating the copy attached file including the visualized contents of the document file as a file of a PDIF format or an image format.
14. The method of claim 13,
The step (c)
Removing the attachment file from the original electronic mail and attaching the generated copy attachment file to the original electronic mail to generate a copy e-mail.
14. The method as claimed in claim 13,
Further comprising the step of storing the extracted attachment file,
The step (c)
Attaching the copy attachment file generated in the original electronic mail and inserting a hyperlink indicating the original attachment file to generate the copy email message.
14. The method as claimed in claim 13,
Further comprising the step of storing the extracted original attachment file,
The step (b)
And generating the copy attachment file including a hyperlink indicating the stored original attachment file.
14. The method as claimed in claim 13,
Converting a file format of the original attached file to generate a distorted file corresponding to the original attached file; And
Further comprising the step of providing the generated distortion file in response to the transmission request of the original attachment file.
14. The method as claimed in claim 13,
Inserting predetermined padding information into a padding area of the original attached file to generate a distorted file corresponding to the original attached file; And
Further comprising the step of providing the generated distortion file in response to the transmission request of the original attachment file.
14. The method as claimed in claim 13,
A distortion file corresponding to the original attachment file is generated by converting the file format of the original attachment file or inserting predetermined padding information into the padding area of the original attachment file to generate a distortion file corresponding to the original attachment file Further comprising:
The step (b)
And causing the generated distortion file to be included in the copy attaching file.
14. The method as claimed in claim 13,
Executing the original attached file in a sandbox environment and determining that the original attached file is malware when a predetermined executable file or script is generated by execution of the original attached file; And
Further comprising the step of providing the original attachment file when it is determined that the original attachment file is not malware, in response to the transmission request of the original attachment file.
Extracting the original attachment file from the original e-mail including the original attachment file;
Converting a file format of the original attached file to generate a distorted file corresponding to the original attached file;
Attaching a copy attaching file including the generated distortion file to the original electronic mail to generate a copy e-mail; And
And forwarding the generated copy e-mail to the recipient account of the original e-mail.
Extracting the original attachment file from the original e-mail including the original attachment file;
Inserting predetermined padding information into a padding area of the original attached file to generate a distorted file corresponding to the original attached file;
Attaching a copy attaching file including the generated distortion file to the original electronic mail to generate a copy e-mail; And
And forwarding the generated copy e-mail to the recipient account of the original e-mail.
A computer-readable recording medium on which a program for performing the method according to any one of claims 13 to 23 is recorded.
An e-mail attachment file conversion system,
A processor; And
A memory for storing a computer program executed by the processor,
The computer program, when executed by the processor, causes the email attachment conversion system to perform the method of any one of claims 13 to 23.

Images