WO2013097482A1 - 邮件行为阻断方法、装置及网关 - Google Patents
邮件行为阻断方法、装置及网关 Download PDFInfo
- Publication number
- WO2013097482A1 WO2013097482A1 PCT/CN2012/080939 CN2012080939W WO2013097482A1 WO 2013097482 A1 WO2013097482 A1 WO 2013097482A1 CN 2012080939 W CN2012080939 W CN 2012080939W WO 2013097482 A1 WO2013097482 A1 WO 2013097482A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- client
- user
- mail server
- response
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
- H04L51/21—Monitoring or handling of messages
- H04L51/212—Monitoring or handling of messages using filtering or selective blocking
Definitions
- the present invention relates to the field of computer security management, and in particular, to a mail behavior blocking method, device and gateway. Background technique
- e-mail As the basic medium for daily communication, e-mail has become a key research area for application content security, including the management and control of network resource application behavior. Specifically, in practical applications, for work reasons, it is sometimes necessary to control the user's right to receive mail or send emails, for example: Some users only allow emails, while others only allow emails.
- the current commonly used methods include full proxy mode or streaming mode.
- the full proxy mode is specifically simulated by the intermediate device into a client and a server, and the intermediate device caches the mail sent by the user and parses the related content. If the email address that needs to be filtered is found, the related address information is deleted, so as to control the receiving or sending of the mail by the specific email address. Since the full proxy mode requires the intermediate device to cache related information, the memory consumption of the intermediate device is increased. When a large number of users send mail, there is a possibility that mail filtering cannot be implemented because the processing capacity of the intermediate device is limited.
- the user's permission to receive mail or send an email is controlled, that is, a streaming mode.
- the flow mode in the prior art detects the behavior of the mail.
- the sending or receiving behavior of the mail conforms to the set blocking rule, the TCP connection of the corresponding client of the mail is disconnected to block the behavior of the mail.
- the client using the SMTP/POP3 protocol can automatically re-establish the TCP connection after a short period of time, and continuously try to continue to send the mail, so that the related equipment needs to be unnecessary. Resources, resulting in waste of resources. Therefore, the way to disconnect TCP is not a good blocking method.
- the embodiment of the present invention provides a method, a device, and a gateway for blocking a mail behavior, by modifying a mail response information or an authentication password when the mail operation exceeds the authority, so that the mail server returns an error message to the client, to indicate the The client abandons the restricted mail operation, thereby reducing the resource consumption of the related device in the process of blocking the mail operation of the unauthorized user.
- a method for blocking email behavior including:
- the mail response information or the authentication password is modified to cause the mail server to return an error message to the client, the error information being used to instruct the client to abandon the restricted mail operation.
- a mail behavior blocking apparatus including: a detecting module, configured to monitor a mail operation of a client user; and acquiring a client end of the user Send the user ID in the SMTP command;
- the permission judging module is configured to judge whether the mail operation exceeds the authority by using the user identifier and the preset user corresponding authority;
- An error information generating module configured to: when the mail operation exceeds the permission, modify the mail response information or the authentication password, so that the mail server returns an error message to the client, where the error information is used to indicate that the client gives up the restricted Mail operation.
- a gateway including a mail behavior blocking device
- the mail behavior blocking device includes:
- a detecting module configured to monitor a mail operation of the client user; obtaining a user identifier in the SMTP command sent by the client of the user;
- the permission judging module is configured to judge whether the mail operation exceeds the authority by using the user identifier and the preset user corresponding authority;
- An error information generating module configured to: when the mail operation exceeds the permission, modify the mail response information or the authentication password, so that the mail server returns an error message to the client, where the error information is used to indicate that the client gives up the restricted Mail operation.
- the embodiment of the present invention changes the mail response information or the authentication password when the mail operation exceeds the authority, so that the mail server returns an error message to the client to instruct the client to abandon the restricted mail operation, because The method in the embodiment does not interrupt the TCP, so the client does not repeatedly establish a connection, thereby reducing the resource consumption of the related device.
- FIG. 1 is a schematic flowchart of a method for blocking an email behavior according to an embodiment of the present invention
- FIG. 2 is a schematic flowchart of sending an outgoing email according to an embodiment of the present invention
- FIG. 3 is a schematic flowchart of receiving an arrival mail in an embodiment of the present invention.
- FIG. 4 is a schematic structural diagram of a mail behavior blocking apparatus according to an embodiment of the present invention. detailed description
- the mentioned user specifically refers to an email received and transmitted by using a mail protocol, that is, an SMTP/POP3 protocol, and does not include an email transmitted through a webpage.
- a mail protocol that is, an SMTP/POP3 protocol
- an embodiment of the present invention provides a method for blocking email behavior, including:
- the filtering function is implemented based on the basic flow of the mail, that is, the mail operation of the client user connected to the mail server needs to be monitored, so that the mail operation of the user can be analyzed and judged.
- the mail operation of the user connecting to the mail server can be monitored through the gateway.
- the user identifier included in the SMTP command sent by the client's client to the server may be specifically obtained to identify the user.
- a typical SMTP command that contains a consumer ID includes the MAIL FROM command and the PASS command.
- permissions can be set for the user, such as the user ID of the user, that is, the user name is aaa, the user's right is set to restrict sending of mail; and the user bbb, the user's right is set.
- the user ID of the user that is, the user name is aaa
- the user's right is set to restrict sending of mail
- the user bbb the user's right is set.
- Mail operations exceed permissions, generally including exceeding send permissions or exceeding receive permissions, that is, restricting users from sending mail or restricting users from receiving mail.
- the mail server can be modified as the client.
- the response code fed back by the MAIL FROM command so that the mail server returns a response failure message to the client. In this way, the client will not continue to perform subsequent mail sending operations because it receives a response code indicating that the server process is in error.
- the specific process of sending an outgoing mail by the client of the user may be performed according to the following steps:
- the handshake is first performed with the mail server, and the sending response code 220 of the mail server indicates that the mail service of the server is ready to operate, and the handshake is completed.
- the client After the client receives the response code 220 of the mail server, the client notifies the mail server of the host name of the client by using a HELO instruction.
- the HELO command can be HELO aaa.com, indicating that the host name of the guest 1 is 3aa.com.
- the mail server After confirming the host name number, the mail server returns a response code 250 to indicate that the system instruction is processed correctly. The two parties have established a connection and the mail server is ready to receive outgoing mail.
- the client uses the MAIL FROM command to notify the mail server of the user who sent the outgoing mail.
- the MAIL FROM command can be MAIL a@aaa.com, indicating that the user who sent the outgoing mail is a@aaa.com.
- the mail server After receiving the MAIL FROM command, if the mail address of the user who sent the outgoing mail is correct, the mail server returns a response code 250 indicating that the system instruction is processed correctly, so that the system instruction is correctly processed.
- the gateway when the gateway detects that the user aaa@aaa.com sends the outgoing mail, and the authority of the user is restricted transmission, in this case, the gateway forwards the MAIL FROM instruction of the mail server to the client.
- the response code 250 which originally represents the correct processing of the system command, is changed to a response code 451 indicating that the system command is processed incorrectly.
- the response code indicates an error in the server processing. Therefore, the client will not continue to perform subsequent operations, and the outgoing mail content of the user will not be sent out, and the TCP connection will not be interrupted at this time. The client will not repeat the connection.
- the authentication code sent by the client to the mail server may be modified to make the mail
- the server returns an authentication failure message to the client.
- the authentication password included in the PASS command of the user who receives the incoming mail may be modified, so that the mail server returns a response to the authentication failure to the client, thereby disconnecting the TCP connection between the client and the mail server, thereby blocking Broken user receiving mail.
- the specific process of receiving the arrival email by the client of the user may be performed according to the following steps:
- the client queries the mail server to support SSL-encrypted mail transmission through the AUTH Outlook client extension instruction.
- the mail server returns a response ERR to indicate that it is not supported.
- the client authenticates by using the USER command, and notifies the user name of the client to which the mail server is connected.
- the username of the email address aaa@bbb.com is aaa.
- the client After the client successfully authenticates the username, the client sends a password corresponding to the username to the mail server by using the PASS command.
- the user rights can be preset by the user, it is possible to determine whether the user has the right to receive the mail.
- the mail operation of the user connected to the mail server can be monitored through the gateway. Therefore, the user name of the received mail can be detected by the USER command in step S34. In this way, when the user who receives the mail is a restricted sending user, the correct username password that was originally sent to the mail server can be modified to the wrong username password by modifying the password in the PASS command.
- the gateway detects that the user receives the mail, the gateway sends the forwarding client to the mail server.
- the client that restricts the sending user will receive the response of the mail server authentication failure - ERR invalid username.
- the TCP connection between the client and the mail server is disconnected, thereby blocking the user from receiving the mail.
- the mail server after detecting the mail operation of the user connected to the mail server, after obtaining the user identifier in the SMTP command, determining whether the user who receives the mail is a preset restriction receiving user, when the user is a restricted receiving user, the modification is performed.
- the password in the PASS command modifies the correct username and password that was originally sent to the mail server to the wrong username and password. Therefore, the mail server sends a response to the authentication failure to the client that restricts the receiving user, thereby disconnecting the TCP connection between the client and the mail server, thereby blocking the user receiving the mail.
- the embodiment of the present invention further provides a mail behavior blocking device, as shown in FIG. 4, including a detecting module 11, an authority determining module 12, and an error information generating module 13;
- the detecting module 11 is configured to monitor the mail operation of the client 3 user; obtain the user identifier in the SMTP command sent by the client 3 of the user;
- This embodiment implements the filtering function based on the basic flow of the mail, that is, it is necessary to monitor the mail operation of the client 3 user connected to the mail server 2, so that the mail operation of the user can be analyzed and judged.
- the mail operation of the user connected to the mail server 2 can be monitored through the gateway 1.
- the user identifier included in the SMTP command sent by the client's client 3 to the mail server 2 can be specifically identified to identify the user.
- a typical SMTP command containing a user ID includes a MAIL FROM command and a PASS command.
- the permission judging module 12 is configured to judge whether the mail operation exceeds the authority by using the user identifier and the preset user corresponding authority;
- the user ID that is, the user name is aaa, the user's authority is set to restrict sending of mail; and the user bbb, the user's authority is set to restrict receiving mail.
- the error information generating module 13 is configured to modify the mail response information or the authentication password when the mail operation exceeds the authority, so that the mail server returns an error message to the client 3, where the error information is used to indicate that the client 3 gives up the restricted Mail operation.
- the mail operation exceeds the permission, which generally includes exceeding the sending permission or exceeding the receiving right, that is, restricting the user from sending mail or restricting the user from receiving the mail.
- the error information generating module may include a response code modifying unit and an authentication code modifying unit.
- the response code modification unit is configured to: when the mail operation exceeds the permission to exceed the send permission, that is, when the user who sends the mail belongs to the user who restricts the sending of the mail, the mail server can be modified by modifying the MAIL FROM command of the client 3
- the response code is such that the mail server 2 returns a response failure message to the client 3. In this way, the client 3 will not continue to perform subsequent mailing operations because it receives a response code indicating that the mail server 2 has processed an error.
- the gateway when the gateway detects that the user aaa@aaa.com sends an outgoing mail, and the authority of the user is restricted transmission, in this case, the gateway forwards the response code of the MAIL FROM instruction returned by the mail server to the client.
- the response code 250 which originally indicates that the system instruction is processed correctly, is modified to a response code 451 indicating that the system instruction is processing an error.
- the response code indicates an error in the server processing. Therefore, the client will not continue to perform subsequent operations, and the outgoing mail content of the user will not be sent out.
- the TCP connection will not be interrupted, and the client will not repeatedly establish a connection.
- the authentication code modification unit is configured to modify the client 3 to send to the mail server 2 when the mail operation exceeds the permission to exceed the receiving authority, that is, when the user who sends the mail belongs to the user who restricts receiving the mail.
- the authentication code is such that the mail server 2 returns the authentication failure information to the client 3. Specifically, you can modify the PASS of the user who receives the incoming mail.
- the authentication password included in the command causes the mail server 2 to return a response to the authentication failure to the client 3, thereby disconnecting the TCP connection between the client 3 and the mail server 2, thereby blocking the user from receiving the mail.
- the gateway when the user bbb@aaa.com is included in the list of restricted sending users, when the gateway detects that the user receives the mail, the gateway sends the PASS command to the mail server when the forwarding client sends the PASS command to the correct username.
- the password was changed to the wrong username and password.
- the embodiment of the present invention further provides a gateway, and the gateway includes the mail behavior blocking device in the embodiment corresponding to FIG. 4, because the structure, principle, and diagram of the mail behavior blocking device in the embodiment of the present invention
- the mail behavior blocking device in the corresponding embodiment is similar, and its role is also the same, and will not be described here.
- the functions, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium.
- the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
- the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
- the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM, a random access memory), a magnetic disk, or an optical disk, and the like.
- the medium of the code includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM, a random access memory), a magnetic disk, or an optical disk, and the like.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Information Transfer Between Computers (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明公开了邮件行为阻断方法、装置及网关,其中邮件行为阻断方法包括:监测客户端用户的邮件操作;获取该用户的客户端所发送SMTP指令中的用户标识;通过用户标识和预设的用户对应权限判断所述邮件操作是否超出权限;当邮件操作超出权限时,修改邮件响应信息或认证密码,以使邮件服务器向客户端返回错误信息,错误信息用于指示客户端放弃被限制的邮件操作。本实施例通过向客户端返回错误信息来指示客户端放弃被限制的邮件操作,从而阻断受限用户发送邮件,由于本实施例中的方法不会中断TCP,所以客户端不会重复的建立连接,进而节约了设备的消耗。
Description
邮件行为阻断方法、 装置及网关 本申请要求于 2011 年 12 月 31 日提交中国专利局、 申请号为 201110459892.8、 发明名称为 "邮件行为阻断方法、 装置及网关" 的中国 专利申请的优先权, 以及要求于 2012年 2月 17日提交中国专利局, 申请 号为 201210037249.0, 发明名称为 "邮件行为阻断方法、 装置及网关" 的 中国专利申请的优先权,上述两个专利申请的全部内容通过引用结合在本 申请中。 技术领域
本发明涉及计算机安全管理领域, 具体涉及一种邮件行为阻断方法、 装置及网关。 背景技术
电子邮件作为日常交流的基本媒介, 已成为应用内容安全的重点研究 领域, 其中包括了网络资源应用行为的管理和控制。 具体的, 在实际应用 中, 出于工作原因, 有时需要对用户接收邮件或发送电子邮件的权限进行 控制, 比如: 有些用户只允许发送邮件, 而有些用户只允许接收邮件。
在实现对用户接收邮件或发送电子邮件的权限进行控制时, 目前一般 所釆用的方式包括全代理模式或流模式。
其中, 全代理模式具体为通过中间设备分别模拟成客户端和服务器, 中间设备将用户发送的邮件緩存并解析相关内容。如果发现需要被过滤的 邮件地址, 则将相关地址信息删除, 从而达到控制特定邮件地址接收或发 送邮件的目的。 由于全代理模式需要中间设备緩存相关信息, 所以增加了 中间设备的内存消耗。 当有大量用户发送有邮件时, 由于中间设备的处理 能力有限, 所以有可能存在无法实现邮件过滤的情况。
为了避免由于中间设备负载有限所造成的邮件过滤失败的问题,还存
在另一种对用户接收邮件或发送电子邮件的权限进行控制方式, 即, 流模 式。
现有技术中的流模式通过检测邮件行为, 当邮件的发送或接收行为符 合设定的阻断规则时, 断开该邮件相应客户端的 TCP连接, 以实现该邮 件行为的阻断。
发明人经研究发现, 现有的流模式至少存在以下缺陷:
虽然断开 TCP连接可以阻断邮件,但釆用 SMTP/POP3协议的客户端 会在一小段时间后可以自动重新建立 TCP连接, 并不断地尝试继续发送 邮件, 从而使得相关设备需要耗费不必要的资源, 造成资源浪费。 所以釆 用断 TCP连接的方式并不是一种好的阻断方法。 发明内容
有鉴于此, 本发明实施例提供邮件行为阻断方法、 装置及网关, 通过 在邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使邮件服务器 向客户端返回错误信息, 以指示所述客户端放弃被限制的邮件操作, 进而 在实现阻断越权用户的邮件操作的过程中减少了相关设备的资源消耗。
本发明实施例的具体内容如下:
一种邮件行为阻断方法, 包括:
监测客户端用户的邮件操作;获取该用户的客户端所发送 SMTP指令 中的用户标识;
通过所述用户标识和预设的用户对应权限判断所述邮件操作是否超 出权限;
当所述邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使邮 件服务器向客户端返回错误信息, 所述错误信息用于指示所述客户端放弃 被限制的邮件操作。
此外, 在本发明实施例中, 还提供了一种邮件行为阻断装置, 包括: 检测模块, 用于监测客户端用户的邮件操作; 获取该用户的客户端所
发送 SMTP指令中的用户标识;
权限判断模块,用于通过所述用户标识和预设的用户对应权限判断所 述邮件操作是否超出权限;
错误信息生成模块, 用于当所述邮件操作超出权限时, 修改邮件响应 信息或认证密码, 以使邮件服务器向客户端返回错误信息, 所述错误信息 用于指示所述客户端放弃被限制的邮件操作。
此外, 在本发明实施例中, 还提供了一种网关, 包括邮件行为阻断装 置;
邮件行为阻断装置包括:
检测模块, 用于监测客户端用户的邮件操作; 获取该用户的客户端所 发送 SMTP指令中的用户标识;
权限判断模块,用于通过所述用户标识和预设的用户对应权限判断所 述邮件操作是否超出权限;
错误信息生成模块, 用于当所述邮件操作超出权限时, 修改邮件响应 信息或认证密码, 以使邮件服务器向客户端返回错误信息, 所述错误信息 用于指示所述客户端放弃被限制的邮件操作。
综上所述, 本发明实施例通过在邮件操作超出权限时, 修改邮件响应 信息或认证密码, 使得邮件服务器向客户端返回错误信息, 以指示所述客 户端放弃被限制的邮件操作, 由于本实施例中的方法不会中断 TCP, 所以 客户端不会重复的建立连接, 从而减少了相关设备的资源消耗。 附图说明
图 1为本发明实施例中的邮件行为阻断方法的流程示意图; 图 2为本发明实施例中发送外发邮件的流程示意图;
图 3为本发明实施例中接收到达邮件的流程示意图;
图 4为本发明实施例中的邮件行为阻断装置的结构示意图。
具体实施方式
本发明实施例中提供了邮件行为阻断方法、 装置及网关, 下面结合实 施例进行说明。
在本实施例中,所提及的用户特指通过使用邮件协议,即, SMTP/POP3 协议接收和发送的电子邮件, 并不包括通过网页发送的电子邮件。
参照图 1 , 本发明实施例提供了一种邮件行为阻断方法, 包括:
511、 监测连接邮件服务器的用户的邮件行为;
本实施例基于邮件的基本流程来实现过滤功能, 即, 需要监测与邮件 服务器连接的客户端用户的邮件操作, 这样, 才能对用户的邮件操作进行 分析和判断。 在实际应用中, 可以通过网关来实现监测连接邮件服务器的 用户的邮件操作。 在检测过程中, 具体可以通过获取用户的客户端向服务 器发送的 SMTP指令中所包括的用户标识, 以识别用户。 典型的包含有用 户标识的 SMTP指令包括 MAIL FROM指令和 PASS指令。
512、 通过用户标识和预设的用户对应权限判断邮件操作是否超出权 限;
为了限制特定用户的邮件操作, 可以为用户设置权限, 比如用户的用 户标识, 也就是用户名为 aaa, 该用户的权限被设定为限制发送邮件; 而 用户 bbb, 该用户则的权限被设定为限制接收邮件。
通过从 SMTP指令中获取的用户标识, 根据预设的用户权限, 即可以 判断用户的邮件操作是否超出其对应的权限。
513、 当邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使 邮件服务器向客户端返回错误信息,错误信息用于指示所述客户端放弃被 限制的邮件操作。
邮件操作超出权限, 一般包括超出发送权限或超出接收权限, 即, 限 制用户发送邮件或限制用户接收邮件。
具体的, 当邮件操作超出权限为超出发送权限时, 也就是当发送邮件 的用户属于限制发送邮件的用户时,可以通过修改邮件服务器为客户端的
MAIL FROM指令而反馈的响应码, 以使邮件服务器向客户端返回响应失 败信息。 这样, 客户端会因为接收到表示服务器处理过程出错的响应码, 从而不再继续执行后续的发送邮件操作。
参考图 2, 本发明实施例中, 通过用户的客户端发送外发邮件的具体 过程可以按照以下步骤进行:
521、 客户端按照 TCP协议发送外发邮件时, 首先要与邮件服务器完 成握手,邮件服务器的发送响应码 220表示服务器的邮件服务已准备运作, 握手完成。
522、当客户端接收到邮件服务器的响应码 220后,客户端通过 HELO 指令通知邮件服务器该客户端的主机名。 例如, HELO指令可以为 HELO aaa.com, 表示该客 1端的主机名为 3aa.com。
523、 当邮件服务器在确认该主机名号后, 返回响应码 250以表示系 统指令处理正确。 双方已经建立好连接, 邮件服务器已经做好接收外发邮 件的准备。
524、 当客户端接收到邮件服务器的响应码 250后,客户端通过 MAIL FROM指令来通知邮件服务器此次发送外发邮件的用户。
例如, MAIL FROM指令可以为 MAIL a@aaa.com, 表示此次发送外 发邮件的用户为 a@aaa.com。
S25、 邮件服务器在收到 MAIL FROM指令后, 如果发送外发邮件的 用户的邮件地址正确, 会返回表示系统指令处理正确的响应码 250 , 以表 示系统指令处理正确。
具体的, 例如, 在网关检测到用户 aaa@aaa.com发送外发邮件, 而该 用户的权限为限制发送时, 在这种情况下, 网关在转发邮件服务器向客户 端返回的 MAIL FROM指令的响应码时,将本来表示系统指令处理正确的 响应码 250 爹改为表示系统指令处理错误的响应码 451。 这样, 该响应码 表示服务器处理过程出错。 从而客户端就不会再继续执行后续操作, 该用 户的外发邮件内容也不会被发送出去, 而此时 TCP连接也不会被中断,
客户端也不会重复建立连接。
在本发明实施例中, 当邮件操作超出权限为超出接收权限时, 也就是 当发送邮件的用户属于限制接收邮件的用户时,可以修改客户端发送给邮 件服务器的认证码, 以使所述邮件服务器向所述客户端返回认证失败信 息。 具体的, 可以通过修改所述接收到达邮件的用户的 PASS指令中包含 的认证密码, 以使邮件服务器向客户端返回认证失败的响应, 从而使客户 端与邮件服务器的 TCP连接断开, 进而阻断了用户接收邮件。
参考图 3 , 本发明实施例中, 通过用户的客户端接收到达邮件的具体 流程可以按照以下步骤进行:
531、 在客户端接收到达邮件, 首先要通过与邮件服务器完成握手来 建立 TCP连接。
532、 接着, 客户端通过 AUTH这一 Outlook客户端扩展指令来询问 邮件服务器是否支持 SSL加密的邮件传输。
533、 邮件服务器返回响应 ERR来表示不支持。
534、 接着, 客户端通过 USER指令来进行认证, 通知邮件服务器与 之连接的客户端的用户名。比如,邮件地址 aaa@bbb.com的用户名为 aaa。
535、 邮件服务器认证用户名成功后, 向客户端返回响应 OK user accepted。
536、 客户端在认证用户名成功后, 通过 PASS指令来向邮件服务器 发送与用户名相应的密码。
由于可以通过为限用户预设用户权限,从而可以判定用户是否有权限 接收邮件。 由于在本发明实施例中, 可以通过网关来实现监测连接邮件服 务器的用户的邮件操作,所以可以通过步骤 S34中的 USER指令检测到接 收邮件的用户名。 这样, 将当接收邮件的用户为限制发送用户时, 可以通 过修改 PASS指令中的密码, 将本来向邮件服务器发送的正确的用户名密 码修改为错误的用户名密码。
具体的, 例如, 当限制发送用户列表中包括了用户 bbb(¾aaa.com时,
在网关检测到该用户接收邮件时, 网关在转发客户端向邮件服务器发送
PASS指令时, 将 PASS指令中本来正确的用户名密码修改为错误的用户 名密码。
537、 限制发送用户所在的客户端将会收到邮件服务器认证失败的响 应 -ERR invalid username。
538、 客户端与邮件服务器的 TCP连接断开, 从而阻断了用户接收邮 件。
本发明实施例通过检测连接邮件服务器的用户的邮件操作, 在获取 SMTP指令中的用户标识后, 判定接收邮件的用户是否为预设的限制接收 用户, 当该用户为限制接收用户时, 通过修改 PASS指令中的密码, 将本 来向邮件服务器发送的正确的用户名密码修改为错误的用户名密码。从而 使得邮件服务器向限制接收用户所在的客户端发送认证失败的响应,进而 使得客户端与邮件服务器的 TCP连接断开, 由此阻断了用户接收邮件。
此外, 本发明实施例还提供了一种邮件行为阻断装置, 如图 4所示, 包括检测模块 11、 权限判断模块 12和错误信息生成模块 13;
检测模块 11用于监测客户端 3用户的邮件操作; 获取该用户的客户 端 3所发送 SMTP指令中的用户标识;
本实施例基于邮件的基本流程来实现过滤功能, 即, 需要监测与邮件 服务器 2连接的客户端 3用户的邮件操作, 这样, 才能对用户的邮件操作 进行分析和判断。 在实际应用中, 可以通过网关 1来实现监测连接邮件服 务器 2的用户的邮件操作。 在检测过程中, 具体可以通过获取用户的客户 端 3向邮件服务 2器发送的 SMTP指令中所包括的用户标识,以识别用户。 釆用 SMTP/POP3协议的邮件系统中, 典型的包含有用户标识的 SMTP指 令包括 MAIL FROM指令和 PASS指令。
权限判断模块 12用于通过所述用户标识和预设的用户对应权限判断 所述邮件操作是否超出权限;
为了限制特定用户的邮件操作, 可以为用户设置权限, 比如用户的用
户标识, 也就是用户名为 aaa, 该用户的权限被设定为限制发送邮件; 而 用户 bbb, 该用户则的权限被设定为限制接收邮件。
错误信息生成模块 13用于当所述邮件操作超出权限时, 修改邮件响 应信息或认证密码, 以使邮件服务器向客户端 3返回错误信息, 所述错误 信息用于指示客户端 3放弃被限制的邮件操作。
通过从 SMTP指令中获取的用户标识, 根据预设的用户权限, 即可以 判断用户的邮件操作是否超出其对应的权限。
在实际应用中, 邮件操作超出权限, 一般包括超出发送权限或超出接 收权限, 即, 限制用户发送邮件或限制用户接收邮件。 为此, 在本发明实 施例中, 错误信息生成模块可以包括响应码修改单元和认证码修改单元。
具体的, 响应码修改单元用于当邮件操作超出权限为超出发送权限 时, 也就是当发送邮件的用户属于限制发送邮件的用户时, 可以通过修改 邮件服务器为客户端 3的 MAIL FROM指令而反馈的响应码,以使邮件服 务器 2向客户端 3返回响应失败信息。 这样, 客户端 3会因为接收到表示 邮件服务器 2处理过程出错的响应码,从而不再继续执行后续的发送邮件 操作。
例如, 在网关检测到用户 aaa@aaa.com发送外发邮件, 而该用户的权 限为限制发送时, 在这种情况下, 网关在转发邮件服务器向客户端返回的 MAIL FROM指令的响应码时, 将本来表示系统指令处理正确的响应码 250修改为表示系统指令处理错误的响应码 451。 这样, 该响应码表示服 务器处理过程出错。 从而客户端就不会再继续执行后续操作, 该用户的外 发邮件内容也不会被发送出去, 而此时 TCP连接也不会被中断, 客户端 也不会重复建立连接。
在本发明实施例中,认证码修改单元用于当邮件操作超出权限为超出 接收权限时, 也就是当发送邮件的用户属于限制接收邮件的用户时, 可以 修改客户端 3发送给邮件服务器 2的认证码, 以使邮件服务器 2向客户端 3返回认证失败信息。具体的,可以通过修改接收到达邮件的用户的 PASS
指令中包含的认证密码, 以使邮件服务器 2向客户端 3返回认证失败的响 应, 从而使客户端 3与邮件服务器 2的 TCP连接断开, 进而阻断了用户 接收邮件。
例如, 当限制发送用户列表中包括了用户 bbb@aaa.com时,在网关检 测到该用户接收邮件时, 网关在转发客户端向邮件服务器发送 PASS指令 时, 将 PASS指令中本来正确的用户名密码修改为错误的用户名密码。
此外, 本发明实施例还提供了一种网关, 网关包括了与图 4所对应实 施例中的邮件行为阻断装置, 由于在本发明实施例中, 邮件行为阻断装置 的结构和原理与图 4所对应的实施例中邮件行为阻断装置相似,其起到的 作用也一样, 在此就不再赘述。
所属领域的技术人员可以清楚地了解到, 为描述的方便和简洁, 上述 描述的装置和模块的具体工作过程,可以参考前述方法实施例中的对应过 程, 在此不再赘述。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或 使用时, 可以存储在一个计算机可读取存储介质中。 基于这样的理解, 本 发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方 案的部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个 存储介质中,包括若干指令用以使得一台计算机设备(可以是个人计算机, 服务器, 或者网络设备等)执行本发明各个实施例所述方法的全部或部分 步骤。 而前述的存储介质包括: U盘、 移动硬盘、 只读存储器 (ROM, Read-Only Memory ). 随机存取存 4诸器 ( RAM, Random Access Memory )、 磁碟或者光盘等各种可以存储程序代码的介质。
而非对其限制; 尽管参照前述实施例对本发明实施例进行了详细的说明, 本领域的普通技术人员应当理解: 其依然可以对前述各实施例所记载的技 术方案进行修改, 或者对其中部分技术特征进行等同替换; 而这些修改或 者替换, 并不使相应技术方案的本质脱离本发明实施例各实施例技术方案 的^"神和范围。
Claims
1、 一种邮件行为阻断方法, 其特征在于, 包括:
监测客户端用户的邮件操作;获取该用户的客户端所发送 SMTP指令 中的用户标识;
通过所述用户标识和预设的用户对应权限判断所述邮件操作是否超 出权限;
当所述邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使邮 件服务器向客户端返回错误信息, 所述错误信息用于指示所述客户端放弃 被限制的邮件操作。
2、 如权利要求 1 所述邮件行为阻断方法, 其特征在于, 所述当所述 邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使所述客户端接 收到错误信息, 包括:
当所述邮件操作超出权限为超出发送权限时,修改所述邮件服务器为 客户端的 MAIL FROM指令而反馈的响应码,以使所述邮件服务器向所述 客户端返回响应失败信息。
3、 如权利要求 1 所述邮件行为阻断方法, 其特征在于, 所述当所述 邮件操作超出权限时, 修改邮件响应信息或认证密码, 以使所述客户端接 收到错误信息, 包括:
当所述邮件操作超出权限为超出接收权限时,修改客户端发送给邮件 服务器的认证码, 以使所述邮件服务器向所述客户端返回认证失败信息。
4、 如权利要求 2所述邮件行为阻断方法, 其特征在于, 所述修改邮 件服务器返回的邮件响应码, 包括:
修改邮件服务器返回的 SMTP响应码为 451。
5、 如权利要求 3所述邮件行为阻断方法, 其特征在于, 所述修改客 户端发送给邮件服务器的认证码, 包括:
修改客户端发送的 PASS指令中包含的认证密码。
6、 一种邮件行为阻断装置, 其特征在于, 包括:
检测模块, 用于监测客户端用户的邮件操作; 获取该用户的客户端所 发送 SMTP指令中的用户标识;
权限判断模块,用于通过所述用户标识和预设的用户对应权限判断所 述邮件操作是否超出权限;
错误信息生成模块, 用于当所述邮件操作超出权限时, 修改邮件响应 信息或认证密码, 以使邮件服务器向客户端返回错误信息, 所述错误信息 用于指示所述客户端放弃被限制的邮件操作。
7、 如权利要求 6所述邮件行为阻断装置, 其特征在于, 所述错误信 息生成模块, 包括:
邮件响应码修改单元, 用于当发送邮件操作被限制时, 修改邮件服务 器返回的邮件响应码, 以使所述邮件服务器向所述客户端返回响应失败信 息;
认证码修改单元, 用于当接收邮件操作被限制时, 修改客户端发送给 邮件服务器的认证码, 以使所述邮件服务器向所述客户端返回认证失败信 息。
8、 如权利要求 7所述邮件行为阻断装置, 其特征在于, 所述发送阻 断模块包括:
响应码修改单元, 用于当所述邮件操作超出权限为超出发送权限时, 修改所述邮件服务器为客户端的 MAIL FROM指令而反馈的响应码,以使 所述邮件服务器向所述客户端返回响应失败信息;
认证码修改单元, 用于当所述邮件操作超出权限为超出接收权限时, 修改客户端发送给邮件服务器的认证码, 以使所述邮件服务器向所述客户 端返回认证失败信息。
9、 如权利要求 8所述邮件行为阻断装置, 其特征在于, 所述修改所 述邮件服务器为客户端的 MAIL FROM指令而反馈的响应码包括:
将所述响应码 改为 451。
10、 一种网关, 其特征在于, 包括如权利要求 6至 9中任一所述邮件行为 阻断装置。
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201110459892 | 2011-12-31 | ||
CN201110459892.8 | 2011-12-31 | ||
CN201210037249.0 | 2012-02-17 | ||
CN201210037249.0A CN102801644B (zh) | 2011-12-31 | 2012-02-17 | 邮件行为阻断方法、装置及网关 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2013097482A1 true WO2013097482A1 (zh) | 2013-07-04 |
Family
ID=47200612
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2012/080939 WO2013097482A1 (zh) | 2011-12-31 | 2012-09-03 | 邮件行为阻断方法、装置及网关 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN102801644B (zh) |
WO (1) | WO2013097482A1 (zh) |
Families Citing this family (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN106936691A (zh) * | 2015-12-30 | 2017-07-07 | 上海格尔软件股份有限公司 | 一种控制客户端邮件操作权限的系统及其方法 |
CN106027498A (zh) * | 2016-05-05 | 2016-10-12 | 北京元心科技有限公司 | 一种提高企业移动管理系统邮件安全的方法和装置 |
CN107770137A (zh) * | 2016-08-22 | 2018-03-06 | 深圳市中兴微电子技术有限公司 | 一种信息处理方法和装置 |
CN108280360A (zh) * | 2017-01-05 | 2018-07-13 | 珠海金山办公软件有限公司 | 一种安全文档日志管理方法及服务器 |
CN109120510B (zh) * | 2018-08-01 | 2022-03-08 | 北京奇虎科技有限公司 | 基于权限控制的邮件发送方法、装置及系统 |
CN109787886B (zh) * | 2019-01-22 | 2021-03-02 | 北京北信源信息安全技术有限公司 | 一种邮件审计方法及系统 |
CN113159736A (zh) * | 2021-05-21 | 2021-07-23 | 北京天空卫士网络安全技术有限公司 | 一种邮箱管理方法和装置 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN1342013A (zh) * | 2000-08-24 | 2002-03-27 | 索尼公司 | 接收设备和方法、发送设备和方法、记录媒体及通信系统 |
CN1722710A (zh) * | 2004-11-23 | 2006-01-18 | 杭州华为三康技术有限公司 | 电子邮件管理系统及方法 |
CN102045271A (zh) * | 2010-12-07 | 2011-05-04 | 成都市华为赛门铁克科技有限公司 | 一种垃圾邮件处理方法、相关装置及系统 |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101216904A (zh) * | 2007-01-01 | 2008-07-09 | 王丹琳 | 一种可供多用户独立使用的电子邮箱技术 |
CN101714923A (zh) * | 2009-07-09 | 2010-05-26 | 成都飞鱼星科技开发有限公司 | 一种基于路由器的邮件收发监控审计的方法、系统及路由器 |
-
2012
- 2012-02-17 CN CN201210037249.0A patent/CN102801644B/zh active Active
- 2012-09-03 WO PCT/CN2012/080939 patent/WO2013097482A1/zh active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN1342013A (zh) * | 2000-08-24 | 2002-03-27 | 索尼公司 | 接收设备和方法、发送设备和方法、记录媒体及通信系统 |
CN1722710A (zh) * | 2004-11-23 | 2006-01-18 | 杭州华为三康技术有限公司 | 电子邮件管理系统及方法 |
CN102045271A (zh) * | 2010-12-07 | 2011-05-04 | 成都市华为赛门铁克科技有限公司 | 一种垃圾邮件处理方法、相关装置及系统 |
Also Published As
Publication number | Publication date |
---|---|
CN102801644A (zh) | 2012-11-28 |
CN102801644B (zh) | 2015-01-21 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2013097482A1 (zh) | 邮件行为阻断方法、装置及网关 | |
CN101557405B (zh) | 一种入口认证方法及其对应的网关设备、服务器 | |
CN104125141B (zh) | 一种通知消息的推送方法、服务器及系统 | |
JP2022003792A (ja) | 端末及び端末の方法 | |
WO2008157087A2 (en) | Proxy-based malware scan | |
CN101296182A (zh) | 一种数据传输控制方法以及数据传输控制装置 | |
CN102710659A (zh) | 一种无线接入设备及自动认证的方法 | |
CN101778059A (zh) | 邮件处理方法、网关设备及网络系统 | |
EP4224751A1 (en) | Network security protection method and protection device | |
CN102045379B (zh) | 一种进行ip存储的方法、系统和存储设备 | |
WO2012126286A1 (zh) | 一种aaa服务器服务状态检测方法及系统 | |
JP3941763B2 (ja) | クライアントサーバ型サービスにおける輻輳制御システム | |
CN101800677A (zh) | 一种双向转发检测报文的处理装置及方法 | |
CN101159713B (zh) | 一种限制即时通信应用的方法、系统和装置 | |
JP2006277633A (ja) | セキュリティ保証機能を備えたコンピュータネットワーク、セキュリティの保証方法、及び、プログラム | |
JPWO2006035928A1 (ja) | Ip電話端末装置、呼制御サーバ、ワクチンサーバ、保守用装置、ip電話システム、これらの制御方法及びプログラム | |
CN106549784A (zh) | 一种数据处理方法和设备 | |
WO2015158058A1 (zh) | 一种实现呼叫保存和恢复的方法及系统 | |
JP2005210240A (ja) | メールフィルタシステム、メールフィルタ装置及びそれらに用いるメールフィルタ方法並びにそのプログラム | |
CN101599858B (zh) | 主备机管理方法和服务器 | |
JP2005210455A (ja) | 電子メール中継装置 | |
JP6668960B2 (ja) | 情報処理装置及びプログラム | |
JP6126062B2 (ja) | ネットワーク装置及びネットワーク装置のmacアドレス認証方法 | |
JP5135292B2 (ja) | Ip電話交換機及びip電話システム | |
WO2014139281A1 (zh) | 一种彩信业务开销户方法和系统 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12862438 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 12862438 Country of ref document: EP Kind code of ref document: A1 |