WO2008151542A1

WO2008151542A1 - Method for controlling accessing to an electronic mail and electronic mail server

Info

Publication number: WO2008151542A1
Application number: PCT/CN2008/071120
Authority: WO
Inventors: Mingqiang Li
Original assignee: Tencent Technology (Shenzhen) Company Limited
Priority date: 2007-06-14
Filing date: 2008-05-28
Publication date: 2008-12-18
Also published as: CN101083524A

Abstract

A method for controlling accessing to an electronic mail and an electronic mail server, the method includes steps of: receiving a selection to encrypt at least a folder in an electronic mailbox, and receiving an inputted first encryption password, encrypting the selected folder using the first encryption password (S101); receiving a request to access the encrypted folder, and receiving an inputted second encryption password, judging whether the first encryption password is same as the second encryption password, if they were, permitting to access the encrypted folder (S102). An electronic mail server corresponding to the method mentioned above is also provided. The method encrypts the folder in the electronic mailbox again, and offers a secondary password protection of the electronic mail in the encrypted folder, thus ensuring the security of the electronic mail.

Description

E-mail access control method and mail server

The invention belongs to the field of communication security, and in particular relates to an access control method for an email and a mail server. Background of the invention

Nowadays, with the development and popularization of the Internet, e-mail has become an important communication tool, and its security has received more and more attention.

At present, the security of the email is guaranteed by the login password of the email. The email is stored in the plaintext (unencrypted) on the mail server. When the user logs in to the mailbox through the password, the email includes the sent email. All mail information, such as received mail, will be displayed at a glance, making the security of user emails more vulnerable. The login password of the user's mailbox is easily stolen. For example, when the user selects the password remember function of the browser, as long as the user's computer password is stolen, the user's mailbox can be freely logged in; when the user logs in to the mailbox, the user temporarily leaves, or passes other When the login password of the user's mailbox is revealed, the security of the email in the user's mailbox cannot be guaranteed, which may cause irreparable damage to many enterprises, especially business people. Summary of the invention

An object of the embodiments of the present invention is to provide an email access control method and a mail server, which are intended to provide better security protection for emails in an email mailbox.

An embodiment of the present invention provides an access control method for an email, comprising the steps of: receiving an encryption selection of at least one folder in an email box, and receiving the input first password, using the first password pair to select the selected The folder is encrypted. Receiving an access request to the encrypted folder, and receiving the input second password, determining whether the second password and the first password are the same, and if the same, allowing access to the encrypted folder.

The embodiment of the invention further provides a mail server, which comprises the following components:

An interface unit, configured to receive an encryption selection of at least one folder in the email when encrypting, and receive the input first password, receive an access request to the encrypted folder, and receive the input second when accessing password.

The control unit is configured to encrypt the selected folder by using the first password, determine whether the second password and the first password are the same, and if the same, allow access to the encrypted folder.

In the embodiment of the present invention, an encryption key is generated according to the input encryption password, and the folder in the mailbox selected by the user is encrypted, and the email in the encrypted folder is provided with two passwords other than the email login password. The second password protection ensures the security of the email in the mailbox, especially the important security data of the user. BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart of an implementation of an email access control method according to an embodiment of the present invention. 2 is a flow chart of accessing an encrypted folder according to an embodiment of the present invention.

FIG. 3 is a flowchart of implementing an email decryption method according to an embodiment of the present invention.

4 is a structural diagram of a mail server according to an embodiment of the present invention.

FIG. 5 is a structural diagram of an extended mail server according to an embodiment of the present invention. Mode for carrying out the invention

In order to make the objects, the technical solutions and the advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In the embodiment of the present invention, the encrypted password input by the user, that is, the first password is received, according to The encrypted password generates an encryption key to encrypt the folder selected by the user in the mailbox, thereby realizing the secondary password protection of the email in the encrypted folder in the mailbox, thereby ensuring the security of the user's email.

FIG. 1 is a flowchart showing an implementation process of an access control method for an email provided by an embodiment of the present invention, which is described in detail as follows:

In step S101, an encryption selection of at least one folder in the electronic mailbox is received, and the input first password is received, and the selected folder is encrypted using the first password.

Step S101 can be performed by: receiving an encrypted password input by the user and folder information in a mailbox selected by the user, such as an ID of the folder. The folder in the mailbox selected by the user may contain email information that the user needs to encrypt and protect, or an empty folder.

Then, according to the encrypted password input by the user, a corresponding encryption algorithm is used to generate an encryption key, and the folder in the mailbox selected by the user is encrypted. In the embodiment of the present invention, the corresponding encryption algorithm may be a public key algorithm (such as RSA encryption algorithm), a data encryption standard (DES) algorithm, a digital signature algorithm (such as ElGamal encryption algorithm, DSA encryption). Algorithm), MD5 encryption algorithm or FLOWFISH encryption algorithm. When the folder is encrypted, accessing any email in the folder requires entering the encrypted password of the folder, so that the email in the user's mailbox is twice encrypted, and the electronic in the encrypted folder is guaranteed. The security of the mail.

Set an access control attribute for each folder on the mail server. The access control attribute can be set to whether the folder needs to be accessed with a password. When the user selects a folder for encryption, the mail server is sent a selection of the folder to be encrypted and an encrypted password. The mail server sets the access control attribute to be accessed by the password, and the received encrypted password, that is, the first password, generates an encryption key, that is, the first key, by the encryption algorithm, and stores the first key. Further, the mail server stores the first key corresponding to the first key. Password.

In step S102, an access request to the encrypted folder is received, and the input second password is received, and it is determined whether the second password and the first password are the same. If the same, the access to the encrypted folder is allowed.

FIG. 2 shows a processing flow for accessing an encrypted folder according to an embodiment of the present invention.

As shown in Figure 2, the user selects the folder to be accessed. If the folder is not encrypted, the user can browse or operate the email normally. If the folder is encrypted, the user is prompted to input an encrypted password; verify the encryption input by the user. If the password is correct, go to the error handling process, such as prompting the user for a wrong password. If it is correct, the user can browse or operate the email normally.

Specifically, the mail server receives the access request sent by the user, determines whether the folder needs to be accessed by the password, and if necessary, requires the user to input the correct encrypted password. The mail server receives the password entered by the user, that is, the second password, and generates an encryption key, that is, the second key, by the encryption algorithm used when encrypting. Compare the second key with the stored first key, and if the two are the same, allow the user to access the folder.

In order to achieve a better password protection effect, in step S101, the embodiment of the present invention receives the encrypted password input by the user and the folder information in the mailbox selected by the user, and receives the password retrieval information input by the user, such as the password. Go back to the question, keep the email address, etc. and store the password to retrieve the information. At any time after step S101, the following steps may be further included: When the user loses the encrypted password of the encrypted folder, the encrypted password of the encrypted folder is retrieved according to the password retrieval information.

Specifically, the user sends a password retrieval request to the mail server. The mail server requires the user to input the password retrieval information. If the information input by the user is consistent with the stored password retrieval information, the mail server sends the first password to the user. For example, the password set by the user is retrieved. The information is a secret email address, and the mail server will ask the user to enter the correct secret email address, and compare the secret email address entered by the user with the secret email address in the password retrieval information. If the two are consistent, the mail server will use the first password. Send to the user.

When an email requiring encryption protection is not included in the encrypted folder, in order to encrypt and protect the email to be protected, the email encryption method may further include the following steps:

Receiving an email transfer instruction other than the encrypted folder that requires encryption protection, and transferring the encrypted-protected email to the encrypted folder according to the transfer instruction.

In the embodiment of the present invention, the following may be included in the embodiment of the present invention, in order to prevent the user from logging in to the mailbox and temporarily leaving during the browsing of the encrypted folder, or the user is logged out, and the email data in the encrypted folder is stolen by the user. Steps:

After the user stops browsing the encrypted folder for a period of time (such as 2 minutes), or after the user logs out of the mailbox, the encrypted folder is automatically locked according to the encrypted password received in step S101. When the user logs back in to the mailbox or revisits and manipulates the email in the encrypted folder in the mailbox, the encrypted password for the encrypted folder needs to be re-entered.

Specifically, the mail server can set a timer corresponding to the encrypted folder, and the timer is started when the mail server does not receive information on the operation of the encrypted folder. Before the timer expires, if the user receives information on the operation of the encrypted folder, the timer is reset; after the timer expires, the user's operation on the folder is rejected. The time of the timer can be set by the user or by the mail server. When the mail server receives the message that the user has logged out, the encrypted folder is also locked.

It can be understood that the user can selectively encrypt the folder or email in the mailbox by using the above-mentioned email encryption method, and can set different passwords for different encrypted folders, thereby providing sufficient important data for the user. Security.

After encrypting the folder in the selected mailbox by the above method, the user does not know When the folder is encrypted, you cannot perform any operations on any email in the encrypted folder, such as browsing. In the process of the user opening and browsing the email through the encrypted password, if the user temporarily leaves, the security of the email is ensured by locking the encrypted folder.

In the actual application process, the user can select the folder to be encrypted through the folder management page of the mailbox, and input the encrypted password according to the requirements (such as entering the password twice) to encrypt the folder of the selected mailbox.

FIG. 3 is a flowchart showing an implementation process of a method for decrypting an email provided by an embodiment of the present invention, which is described in detail as follows:

In step S301, the decryption password input by the user and the encrypted folder information in the mailbox selected by the user are received. In the actual application process, the user selects the encrypted folder through the folder management page in the mailbox, and inputs a decryption password, which is the encrypted password input by the user when the folder is encrypted.

The process of this step is similar to the specific process of accessing an encrypted folder, and will not be described here.

In step S302, the selected encrypted folder is decrypted based on the encrypted password. After the encrypted folder is decrypted, the state of the encrypted folder is the same as before the encryption, and the mailbox user can browse or manipulate any email in the decrypted folder in the mailbox.

Specifically, the decryption may be to set the access control attribute to be accessed without a password and delete the stored first key. Further, the stored password retrieval information and the encrypted password are deleted.

FIG. 4 shows the structure of a mail server according to an embodiment of the present invention. For better description, only parts related to the embodiment of the present invention are shown.

As shown in FIG. 4, the interface unit 410 is configured to receive at least one of the email addresses when encrypting. The encryption of the folders is selected and the first password entered is received. At the time of access control, an access request to the encrypted folder is received, and the entered second password is received. The control unit 420 is configured to encrypt the selected folder by using the first password, determine whether the second password and the first password are the same, and if the same, allow access to the encrypted folder.

FIG. 5 is a schematic structural diagram of an extended mail server.

As shown in FIG. 5, the control unit 420 includes the following modules: The attribute setting module 421 is configured to set an access control attribute of the selected folder to be accessed by a password; and the key generation module 422 is configured to receive the interface unit 410. A password is generated by an encryption algorithm to generate a first key. The server further includes a storage unit 430 for storing the first key generated by the key generation module 422.

The key generation module 422 is further configured to generate a second key by using an encryption algorithm for the second password carried in the access request received by the 410 interface unit. The control unit 420 further includes an access control module 423 for determining whether the second key generated by the key generation module 422 and the first key stored by the storage unit 430 are the same, and if the same, the folder is allowed to operate.

The interface unit 410 is further configured to receive password retrieval information. The storage unit 430 is further configured to store the password retrieval information received by the interface unit 410. Interface unit 410 is further operative to receive a password retrieval request. The server further includes a password retrieval unit 440, configured to request input of password retrieval information, and determine whether the input password retrieval information is the same as the password retrieval information stored by the storage unit 430. If the same, the first password stored by the storage unit 430 is sent. .

The interface unit 410 is further for receiving a decryption request for the encrypted folder. The attribute setting module 421 is further configured to set the access control attribute of the encrypted folder to be accessed without a password. The storage unit 422 is further configured to delete the stored first key.

The server described above further includes a timer 450 for setting a timing time, and the interface unit 410 does not receive information for operating the encrypted folder, and the timer 450 is opened. At the beginning, if information about the operation of the encrypted folder is received before the timer 450 times out, the timer 450 restarts timing. The server further includes a locking unit 460, configured to reject the operation of the encrypted folder when the timer expires after the timer 450 times out.

As can be seen from the above technical solution, by encrypting the folder in the mailbox, the email in the user mailbox is twice encrypted, and the security of the email in the encrypted folder is ensured. At the same time, since the user does not have the management authority of the mail server, the operation of the mail server is not controlled by the user, so the security of the email in the encrypted folder is also increased.

In summary, in the embodiment of the present invention, an encryption key is generated according to an encrypted password input by a user, and a folder in a mailbox selected by the user is encrypted, so that the email in the encrypted folder is secondarily encrypted. At the same time, the email that needs to be encrypted and protected can be transferred to the encrypted folder, so that the security of the email in the user's mailbox is protected, and when the user stops browsing or operating the encrypted folder for a period of time, or when the user logs out of the mailbox, The encrypted folder is automatically re-encrypted according to the encrypted password input by the user. When the user re-browss or re-login to the mailbox, the password needs to be re-entered, so that the user will not be stolen after leaving the user for a certain period of time, further ensuring that the email is not stolen. User email security. In addition, when the user forgets the password of the encrypted folder, the user can retrieve the encrypted password by using the entered password retrieval information. When the user does not need to encrypt the email, the email decryption method provided by the embodiment of the present invention can cancel the password of the email, and the application is convenient and free.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection of the present invention. Within the scope.

Claims

Claim

An access control method for an email, comprising:

Receiving an encryption selection of at least one folder in the email box, and receiving the input first password, and encrypting the selected folder using the first password:

Receiving an access request to the encrypted folder, and receiving the input second password, determining whether the second password and the first password are the same, and if the same, allowing access to the encrypted folder.

2. The method according to claim 1, wherein the encrypting the selected folder by using the first password comprises:

Set the access control attribute of the selected folder to be accessed by password;

Generating the first password by using an encryption algorithm to generate a first key;

Storing the first key.

The method according to claim 2, wherein the determining whether the second password and the first password are the same comprises:

Generating the second password by using the encryption algorithm to generate a second key;

Determining whether the first key and the second key are the same.

4. The method according to claim 1, wherein the password retrieval information is further received;

Corresponding to storing the first password and password retrieval information;

Receiving a password retrieval request;

Require password input to retrieve information;

Determining whether the input information is the same as the stored password retrieval information, and if the same, transmitting the stored first password.

5. The method according to claim 2, further comprising: Receiving a decryption request for an encrypted folder;

Setting the access control attribute of the encrypted folder to be accessed without a password; deleting the stored first key.

6. A method according to any one of claims 1 to 5, characterized in that

Set the timing time;

When the information about the operation of the encrypted folder is not received, the timing is started; before the timeout period expires, if the information about the operation of the encrypted folder is received, the timing is restarted;

After the timeout expires, the operation of the encrypted folder is denied.

_7. A mail server, characterized by comprising: an interface unit for receiving the encrypted electronic mail to the selected at least one file folder at the time of encryption, and receiving a first input of a password when accessing, have been received Encrypting the access request of the folder and receiving the entered second password;

And a control unit, configured to encrypt the selected folder by using the first password, determine whether the second password and the first password are the same, and if the same, allow access to the encrypted folder.

8. The server according to claim 7, wherein the control unit comprises:

An attribute setting module, configured to set an access control attribute of the selected folder to be accessed through a password;

a key generation module, configured to generate a first key by using an encryption algorithm by using the first password received by the interface unit;

The server further includes a storage unit, configured to store the first key generated by the key generation module.

9. The server of claim 8 wherein: The key generation module is further configured to generate a second key by using the encryption algorithm by using a second password carried in the access request received by the interface unit;

The control unit further includes:

The access control module is configured to determine whether the second key generated by the key generation module and the first key stored by the storage unit are the same. If they are the same, the folder is allowed to operate.

10. The server of claim 8 wherein:

The server further includes a password retrieval unit, configured to request input of password retrieval information, and determine whether the input password retrieval information is the same as the password retrieval information stored by the storage unit, and if the same, send the storage unit to store First password.

11. The server of claim 8 wherein:

The interface unit is further configured to receive a decryption request for the encrypted folder; the attribute setting module is further configured to set an access control attribute of the encrypted folder to be accessed without using a password;

The storage unit is further configured to delete the stored first key.

12. A server according to any of claims 7 to 11, further comprising:

a timer, configured to set a timing time, the interface unit does not receive information about operating an encrypted folder, and the timer starts timing, if the encrypted file is received before the timer expires The information on the operation of the clip, the timer restarts timing.

The server according to claim 12, further comprising: a locking unit, configured to reject the operation of the encrypted folder when the timer expires.