JP2018061232A - Information processing device, information processing system, control method, and program - Google Patents

Abstract

To provide an information processing apparatus, an information processing system, a control method, and a program capable of improving security while performing flexible operation when sending and receiving an electronic mail having an attached file. When an attached file exists in an e-mail transmitted from a client terminal 101, an internal mail server 104 determines whether the attached file is an attached file to be separated, and attaches to be separated. If it is a file, the attached file is separated from the e-mail, and the e-mail provided with a URL for connecting to the system to obtain the attached file stored in the NFS server 105 via the Web server 106 is sent. The generated e-mail is generated by the second client receiving means 3 of the client terminal 109. And transmits it to the 3.
[Selection] Figure 4

Description

  The present invention relates to prevention of erroneous transmission of a file attached to an email.

  In recent years, in an e-mail system, e-mail is transmitted and received between client terminals via a network. However, it is used as a very convenient tool for exchanging information with a distant place.

  However, there are many cases in which highly confidential information is included in an e-mail and exchanged with the other party in an emergency or the like. In this case, the transmitted e-mail is sent to the other party's mail server. In the process, eavesdropping and tampering are performed, and there is a risk that highly confidential information cannot be transmitted safely.

  Therefore, a number of methods for encrypting e-mails have been proposed. For example, methods such as PGP (Pretty Good Privacy) and S / MIME (Secure / Multipurpose Internet Mail Extensions) have been proposed. By performing encryption and decryption on both the sending and receiving sides, the aforementioned risks are avoided.

  In order to use such a method, it is necessary to install software that provides functions for performing encryption and decryption for each client terminal. Consideration of the installation of these software (cost and safety) Etc.), installation work, and post-installation setting work, etc., there are some inconveniences for users.

  However, as a method of using electronic mail, there is a method in which information with low or no confidentiality is input in the body of the electronic mail, and a file containing information with high confidentiality is attached to the electronic mail and transmitted.

  In this case, it is not necessary to encrypt all the e-mails as in the method described above, and the files attached to the e-mails are separated and stored in a file storage server or the like and stored in the storage location. The URL is pasted to the email from which the file is separated, and the email is transmitted to the destination.

When the user who receives the e-mail accesses the URL, enters a password or the like and logs in to the file storage server, there is a mechanism for downloading the file that was scheduled to be sent to the user. (For example, refer to Patent Document 1).
JP 2007-251554 A

  However, some of the files attached to the e-mail include those that attach the file as it is to the e-mail, and others that incorporate an image such as a background of the e-mail and a company logo.

  In this case, it is troublesome for the recipient to download the background of the email and the image such as the company logo separately from the email.

  The present invention has been made to solve the above-described problems, and is an information processing apparatus, an information processing system, and a control that can be flexibly operated when sending and receiving an electronic mail having an attached file. It is an object to provide a method and a program.

The present invention for achieving the above object is an information processing apparatus for relaying an electronic mail transmitted from a client terminal, and includes attached file information indicating information on a file attached to the electronic mail as a header of the electronic mail And obtaining means for deciding processing for the file based on the attached file information obtained by the obtaining means.
It is.

  According to the present invention, there is an effect that a flexible operation can be performed when an electronic mail including an attached file is transmitted and received.

It is a block diagram which shows schematic structure of an information processing system. It is a block diagram which shows schematic structure of the hardware of various terminals. It is a block diagram which shows the function structure in an information processing system. It is a flowchart which shows the process which isolate | separates the attachment file of an email. It is a block diagram which shows the structure of a mail preparation screen. It is a block diagram which shows the structure of a mail preparation screen. It is a block diagram which shows the structure of an email. It is a block diagram which shows the structure of an email. It is a block diagram which shows the structure of the email with which URL was attached | subjected. It is a block diagram which shows the structure of the password notification mail. It is a block diagram which shows the structure of the email with which URL was attached | subjected. It is a block diagram which shows the structure of an email. It is a block diagram which shows the function structure in an information processing system. It is a flowchart which shows the process which encrypts and separates the attachment file of an email. It is a block diagram which shows the structure of an email. It is a block diagram which shows the structure of an email. It is a block diagram which shows the structure of an email. It is a block diagram which shows the structure of an email.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a diagram illustrating an example of a system configuration in an information processing system according to an embodiment of the present invention. Note that the configurations of the various terminals shown in FIG. 1 are merely examples, and it goes without saying that there are various configuration examples depending on the purpose and application.

  As shown in FIG. 1, the information processing system 100 according to the present embodiment includes a client terminal 101, an administrator client terminal 102 used by a system administrator, an internal mail server 104, an NFS server 105, and a Web server 106. These terminals are connected to each other via a local area network (LAN) 103 so that they can communicate with each other, and are constructed as an internal system.

  The client terminal 101 is connected to at least one or more external mail servers 108 via a wide area network 107 so as to be able to communicate with each other, and relays transmission / reception of electronic mail with the client terminal 109 existing in an external system. ing.

  Further, a firewall device (not shown) is installed between the LAN 103 and the wide area network 107, and communication control processing is performed according to a predetermined rule.

  The internal mail server 104 is a server device for relaying electronic mail by the client terminal 101. The internal mail server 104 specifies the SMTP communication content of the client terminal 101 and performs various processes described later according to the communication content.

  Although the internal mail server 104 is illustrated as a single case, the internal mail server 104 is not limited to such a configuration, and each case includes a mail server and a proxy server disposed outside the mail server. As a configuration including a body, the present invention may be executed by a proxy server, and the mail server may be configured to mainly handle delivery of electronic mail.

  The administrator client terminal 102 sets and manages the internal mail server 104.

  The NFS server 105 stores the file attached to the email relayed by the internal mail server 104 in a predetermined directory.

  Each time an attachment file is separated, a directory is created to store the attachment file, and the attachment file is saved under this directory. In addition, an area for storing an e-mail from which the attached file has been separated is also provided.

  When the Web server 106 accepts a request for downloading an attached file stored in the NFS server 105 from an e-mail transmission destination, the Web server 106 transmits the corresponding attached file acquired by the NFS server 105 to the request source.

  Next, the hardware configuration of various terminals of the internal mail server 104 shown in FIG. 1 will be described with reference to FIG. Since the client terminal 101, the administrator client terminal 102, the NFS server 105, and the Web server 106 have the same configuration, the description thereof is omitted.

  The CPU 201 comprehensively controls each device and controller connected to the system bus 204. In addition, the ROM 202 or the external memory 211 is provided with a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS), which is a control program for the CPU 201, or a function executed by each server or each client device. Various necessary programs to be described later are stored.

  The RAM 203 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program necessary for execution of processing into the RAM 203 and executing the program.

  An input controller (input C) 205 controls input from an input unit 209 indicating a pointing device such as a keyboard or a mouse (not shown). A video controller (VC) 206 controls display on a display device such as a CRT display (CRT) 210. The display device may be a liquid crystal display as well as a CRT.

  A memory controller (MC) 207 is a hard disk (HD), floppy disk (registered trademark FD) or PCMCIA card slot for storing boot programs, browser software, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a CompactFlash (registered trademark) memory connected via an adapter.

  A communication I / F controller (communication I / FC) 208 is connected to and communicates with an external device via a network, and executes communication control processing in the network. For example, Internet communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing outline font rasterization processing on a display information area in the RAM 203, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display device 210.

  A program or the like for executing a password notification mail transmission process for realizing the present invention is stored in the external memory 211 and is executed by the CPU 201 by being loaded into the RAM 203 as necessary.

  Definition information and various information tables used by each process according to the present invention are also stored in the external memory 211. Detailed description thereof will be described later.

  FIG. 3 is a schematic diagram illustrating a functional configuration according to the information processing system 100, and an outline of each function will be described. The contents of each function will be described in conjunction with the flowchart shown in FIG.

  As shown in FIG. 3, the client terminal 101 includes a first client transmission unit 301, and the first client transmission unit 301 is connected to the internal mail server 104 via the LAN 103.

  The first client transmission unit 301 has a function realized by software for instructing transmission of an e-mail. For example, the first client transmission unit 301 displays a mail creation screen 500 shown in FIG. The e-mail transmission source address is displayed, and the user uses the input unit 209 to display the e-mail transmission destination address 502, CC (Carbon Copy) 503, e-mail title 504, electronic Input or attachment is performed on the attached file 505 indicating the file attached to the mail, the electronic mail text 506, or the like.

  When the user transmits an e-mail, the user presses a send button 507 provided on the e-mail creation screen 500 to send the e-mail created using the input unit 209 to the destination 502 and the CC 503 set. Send to the destination address.

  The mail creation screen 500 also includes an attachment button 508. When the user attaches the attachment file 505 to the e-mail, the user designates a file existing in the client terminal 101 by pressing the attachment button 508. A display screen (not shown) is displayed on the display device 210, and a file to be attached is attached to an e-mail by selecting and specifying from the file displayed on the screen using the input unit 209.

  In addition, as shown in FIG. 6, when the user creates an e-mail based on HTML, the e-mail creation screen 500 displays an image owned by the user as an image 509 as an e-mail background or the company's logo. Etc. can be inserted into the body of the e-mail.

  Furthermore, in the case of the mail creation screen 500 shown in FIG. 6, it is possible to attach to an e-mail together with the attached file by inserting the image as described above. The attached file 505 can be attached to an e-mail.

  The client terminal 101 includes first client receiving means 302, and the first client receiving means 302 is connected to the internal mail server 104 via the LAN 103.

  The first client receiving unit 302 receives an e-mail from the client terminal 101 existing in the internal system or a client terminal existing in an external system other than the internal system via the internal mail server 104.

  The internal mail server 104 includes server mail reception means 303, and the server mail reception means 303 is connected to at least one or more external mail servers 108 via the client terminal 101 or the wide area network 107.

  The server mail receiving unit 303 receives an electronic mail from the client terminal 101 existing in the internal system or the client terminal 109 existing in an external system other than the internal system.

  The internal mail server 104 includes separation determination means 304, attached file extraction means 305, attached file storage request means 306, mail generation means 307, password notification mail generation means 308, server mail transmission means 309, and original mail storage means 310. ing.

  The separation determination unit 304 is connected to the server mail reception unit 303 and the attached file extraction unit 305.

  When the server mail receiving unit 303 receives the notification that the e-mail has been received, the separation determination unit 304 analyzes the content of the e-mail, but the outline of the analysis content is to be separated from the e-mail. If an e-mail has an attached file, the e-mail is subject to filtering.

  An example of a method for determining whether or not an attached file exists in an e-mail will be described using the configuration diagram of the e-mail shown in FIG. Each of these parts exists as header information of an electronic mail (the same applies hereinafter).

  The e-mail shown in the upper part of FIG. 7 is divided into parts, and the e-mail configuration, for example, the e-mail corresponds to the part 600 representing the multipart format, text format, HTML format, etc., and the body of the e-mail. A part 602 corresponding to an attached file, and a part 606 corresponding to another attached file.

  In this example, in the multipart format e-mail, the user creates an e-mail on a text basis and indicates that there are two attached files.

  The e-mail shown in the lower part of FIG. 7 is a configuration when the user creates an e-mail based on HTML in the multipart format e-mail, and corresponds to the part 608 corresponding to the text format text and the HTML text. The configuration includes a part 610, a part 612 corresponding to the attached file, and a part 614 corresponding to the other attached file.

  In an e-mail having such a configuration, when a value is set in filename in part 604, part 606, part 612, and part 614 corresponding to the attached file, it is determined that the attached file exists in the e-mail. Is done.

  However, by making this determination, when the user creates an HTML-based e-mail, if the user owns an image that is inserted into the e-mail itself and created, these images will be the background image of the e-mail, Even if it is an image showing a company logo and it is an image with low confidentiality, there is a case where a value is set in the above-mentioned filename, so it does not necessarily need to be separated. A problem that an attached file may be a separation target may occur.

  In order to distinguish between an attached file indicating a file attached to an e-mail and an attached file indicating an image inserted in the e-mail, a description will be given with reference to the configuration diagram of the e-mail shown in FIG.

  The email shown in FIG. 8 is a configuration when the user creates an email based on HTML in the multipart format email, and has the same configuration as the email shown in the lower part of FIG. Different.

  As shown in the part 614, in the example of FIG. 8, ContentID is set, and in the case of the part in which this ContentID is set, even if this attached file has a value set in filename, It is limited to an attached file indicating an image inserted in the main part of the e-mail.

  Therefore, it is possible to determine whether the file is an attached file indicating an image inserted in the main part of the e-mail depending on whether ContentID is set.

  The attached file extraction unit 305 is connected to the separation determination unit 304 and the attached file storage request unit 306.

  When the separation determination unit 304 receives a notification that there is an attachment file to be separated from the email, the attachment file extraction unit 305 acquires the attachment file from the email.

  The attached file storage request unit 306 is connected to the attached file extraction unit 305, the attached file storage unit 311, and the mail generation unit 307.

  When the attached file storage requesting unit 306 receives the notification that the attached file has been separated by the attached file extracting unit 305, the attached file storage requesting unit 306 requests the NFS server 105 to store the separated file.

  The mail generation unit 307 is connected to the attached file storage request unit 306 and the password notification mail generation unit 308.

  When the attached file storage request means 306 stores the attached file, the mail generation means 307 sends the attached file stored in the NFS server 105 via the Web server 106 to the e-mail from which the attached file is separated. A URL for connecting to the system for acquisition is given.

  Examples thereof are shown in FIGS. An e-mail 800 shown in FIG. 9 is based on the e-mail created on the e-mail creation screen 500 shown in FIG. 5, and includes a sender 801 indicating the e-mail transmission source address and a destination 802 indicating the e-mail transmission destination address. CC (Carbon Copy) 803, a subject 804 indicating the title of the email, a message 805 newly inserted into the email body, the URL 806 described above, and a body 807 of the original email.

  On the other hand, the e-mail 800 shown in FIG. 11 is based on the e-mail created on the e-mail creation screen 500 shown in FIG. 6, and shows the sender 801 indicating the e-mail transmission source address and the e-mail transmission destination address. Destination 802, CC (Carbon Copy) 803, subject 804 indicating the title of the email, message 805 newly inserted in the email body, URL 806 described above, original email body 807, original email image 509 and image 809 corresponding to image 509 and image 510 are provided.

  In other words, the attached file displayed in the attached file 505 is separated from the e-mail, the URL is attached, and the image 509 and the image 510 inserted in the e-mail body are not separated from the e-mail. The e-mail is sent.

  The password notification mail generation unit 308 is connected to the mail generation unit 307 and the server mail transmission unit 309.

  The password notification mail generation unit 308 transmits the e-mail generated by the mail generation unit 307 to the destination, and then, when the user who receives the e-mail accesses the NFS server 105 using the URL described above, the password notification e-mail generation unit 308 In order to request input, an e-mail for notifying information such as a password necessary for the input is generated.

  An example is shown in FIG. The password notification mail 900 shown in FIG. 10 is based on the email created on the email creation screen 500, and includes a sender 901 indicating the email source address, a destination 902 indicating the email destination address, and A CC (Carbon Copy) 903, a subject 904 indicating the title of the e-mail, and a message 905 indicating information such as the above-described password (e-mail address, e-mail ID, password, etc.) are provided.

  Information such as the password is stored in a predetermined area of the NFS server 105 and used when the user accesses the NFS server 105.

  The server mail transmission unit 309 is connected to at least one external mail server 108 via the client terminal 101 or the wide area network 107.

  Specifically, the server mail transmission unit 309 is connected to the mail generation unit 307, the password notification mail generation unit 308, the first client reception unit 302, and the second client reception unit 313.

  When the server mail transmission unit 309 receives notification that the e-mail has been generated by the mail generation unit 307, the server mail transmission unit 309 transmits the e-mail to the destination. When the password notification email generation means 308 receives a notification that the password notification email has been generated, the password notification email is first sent to the sender. , Send the e-mail.

  The original mail storage unit 310 is connected to the server mail receiving unit 303 and stores the electronic mail received by the server mail receiving unit 303.

  The NFS server 105 includes an attached file storage unit 311 and an attached file acquisition unit 312.

  The attached file storage unit 311 is connected to the attached file storage request unit 306 and the attached file acquisition unit 312. Upon receiving a request for storing an attached file from the attached file storage request unit 306, the attached file storage unit 311 stores the attached file. For this purpose, a directory is created, and the attached file is stored under this directory.

  As described above, each time an attachment file is separated, a directory is created to store the attachment file, and the electronic mail is stored in an area for storing the electronic mail generated by the mail generation means 307. Also save.

  The attached file acquisition unit 312 is connected to the attached file storage unit 311, the attached file reception unit 316, and the attached file transmission unit 317.

  When the attached file acquisition unit 312 receives a request for downloading an attached file from the attached file receiving unit 316 from the client terminal 109 that has received the e-mail with the URL attached thereto, the attached file acquiring unit 312 is requested to store the attached file in the attached file storage unit 311. The attached file is acquired, and the attached file is output to the attached file transmitting means 317.

  The client terminal 109 includes second client receiving means 313, attached file requesting means 314, and attached file receiving means 315.

  The second client reception unit 313 is connected to the server mail transmission unit 309 and receives an e-mail and a password notification mail.

  The attached file requesting unit 314 is connected to the attached file receiving unit 316, and when the user clicks the URL attached to the e-mail, the attached file receiving unit 316 displays a screen (not shown) to the user. The user is requested to input information related to the message 905 notified by the password notification mail.

  The input information is compared with information such as a password stored in a predetermined area of the NFS server 105, and authentication is performed if they match.

  When authentication is performed, an attached file that can be referred to by the user is displayed on a screen (not shown), and the user designates an attached file that the user desires to download, and accepts a download execution request.

  The attached file receiving unit 315 is connected to the attached file transmitting unit 317 and receives the attached file acquired by the NFS server 105 from the attached file transmitting unit 317.

  The Web server 106 includes an attached file receiving unit 316 and an attached file transmitting unit 317.

  The attached file reception unit 316 is connected to the attached file request unit 314 and the attached file acquisition unit 312.

  As described above, when the attached file receiving unit 316 receives a request for downloading an attached file from the attached file requesting unit 314, the attached file receiving unit 316 notifies the attached file obtaining unit 312 of the request.

  The attached file transmission unit 317 is connected to the attached file acquisition unit 312 and the attached file reception unit 315.

  The attached file transmitting unit 317 transmits the attached file acquired by the attached file acquiring unit 312 to the attached file receiving unit 315 that has requested the attached file.

  FIG. 4 is a flowchart showing processing for separating an attached file of an electronic mail in the information processing system according to the embodiment of the present invention. In addition, about the process performed by each step, a process is performed under control of CPU201 of the internal mail server 104. FIG.

  In step S401, the server mail receiving unit 303 receives the e-mail transmitted by the first client transmitting unit 301 of the client terminal 101. In step S402, the separation determining unit 304 separates the e-mail received in step S401. It is determined whether there is an attached file to be processed.

  In order to make this determination, as described above, the part corresponding to the attached file is referred to, and if the value is set in filename, the attached file exists, but further, ContentID is set. In this case, even if a value is set in filename, it is determined that the attached file does not exist even if a value is set in filename.

  Furthermore, when attaching to an e-mail together with an attached file by inserting an image as described above using the mail creation screen 500 shown in FIG. 6, for example, the file selected by the user is used as the attached file 505. When attaching to an e-mail, the attachment by inserting an image is not considered as the attachment to be separated, and the attachment attached to the e-mail is not attached as the attachment to be separated. I will look down.

  If it is determined that the attached file exists, the process proceeds to step S403. If it is not determined that the attached file exists, the process proceeds to step S412.

  In step S403, the attached file extracting unit 305 acquires an attached file to be separated from the e-mail, and the attached file storage requesting unit 306 stores the attached file in the NFS server 105. The attached file storage unit 311 stores the attached file in the NFS server 105.

  In step S404, the mail generation unit 307 adds an URL for connecting to the system in order to acquire the attached file stored in the NFS server 105 via the Web server 106, which is an email with the attached file separated. Generated emails For example, the e-mail shown in FIG. 9 or FIG. 11 is generated.

  In step S405, the server mail transmission unit 309 transmits the electronic mail generated in step S404 to the second client reception unit 313 of the client terminal 109.

  Furthermore, the e-mail generated in step S404 can be stored in a predetermined area of the NFS server 105.

  In step S406, the password notification mail generation unit 308 requests input of a password or the like when the user who is the transmission destination of the email accesses the NFS server 105 by clicking the URL attached to the email. Therefore, a password notification mail is generated to notify information such as a password necessary for the input. For example, the e-mail shown in FIG. 10 is set, and the mail address of the transmission source of the original e-mail is set as the destination.

  In step S407, the server mail transmission unit 309 transmits the password notification mail generated in step S406 to the first client reception unit 302 of the client terminal 101.

  In step S408, the password notification mail generation unit 308 determines whether or not a predetermined time has elapsed since the password notification mail was transmitted in step S406. If it is determined that the predetermined time has elapsed, the process proceeds to step S409.

  In step S409, the password notification mail generation unit 308 generates a password notification mail as in step S406. In this case, for example, the password notification mail generation unit 308 generates an e-mail shown in FIG. Unlike step S406, the destination e-mail address is set as the destination.

  In step S410, the server mail transmission unit 309 transmits the password notification mail generated in step S410 to the second client reception unit 313 of the client terminal 109.

  In step S411, the original mail storage unit 310 stores the email received in step S401 in a predetermined area of the internal mail server 104.

  In step S412, the server mail transmission unit 309 transmits the electronic mail received in step S401 to the second client reception unit 313 of the client terminal 109.

  In this embodiment, referring to the part corresponding to the attached file, if a value is set in filename, it is assumed that the attached file exists, and further, if ContentID is set, this attached file is Even if a value is set in filename, it is determined that the attached file does not exist as an attached file indicating an image.

  In order to perform more accurate judgment than this judgment method, refer to the part corresponding to the attached file, the value is set in filename, and Content-Type is the type in which the attached file is an attached file indicating an image. Furthermore, when ContentID is set, it may be determined that the attached file does not exist as an attached file indicating an image. In this case, for example, a value indicating an image such as image / * is set in Content-Type.

  As an example of this determination, in the configuration of the e-mail shown in FIG. 12, in parts 616, 618, 620, and 622 corresponding to the attached file, values are set for filenames in all the parts. Is determined that there is no ContentID set and there is an attached file indicating a file attached to the e-mail. On the other hand, since Part 620 and Part 622 are set with ContentID, they are inserted into the e-mail. It is determined that there is no attached file indicating that there is an attached file indicating the selected image.

  As described above, in order to perform a more accurate determination, the determination may be performed on the condition that the value of image / * is set in the Content-Type for all parts.

  In addition, when a user creates an e-mail on an HTML basis, the e-mail may be decorated using a style sheet (CSS).

  Even in this case, the decoration itself is regarded as a separation target because a value is set in filename because a style sheet is incorporated in the e-mail even though the confidentiality is low.

  Therefore, similarly, referring to the part corresponding to the attached file, if the value is set in filename and ContentID is set, the style sheet will be separated by not considering it as a separation target Can be prevented.

  In addition, as described above, in order to make a more accurate determination, reference is also made to Content-Type, and the determination is made on the condition that a value indicating a style sheet such as text / css is set in Content-Type. May be.

  Similarly, as an example of this determination, in the configuration of the e-mail shown in FIG. 12, since the ContentID is set in the part 624 corresponding to the attached file, it is excluded from the separation target.

  Furthermore, referring to Content-Type, since text / css is set, since this part 624 relates to the style sheet, it can be determined not to be a separation target.

  In step S402, if there is no attachment to be separated, the conventional filtering process is performed by applying a rule to the e-mail before the process of step S412, and the e-mail is transmitted. It is also possible to hold or ban.

  When the suspension is made, the process in step S412 may be performed after approval by the auditor.

  In addition, even when there is an attachment file to be separated, after step S403, the conventional filtering process is performed by applying the rule to the email from which the attachment file is separated and the attachment file. It is also possible to suspend or prohibit transmission of e-mail.

  When suspended, the process of step S404 may be performed after approval by the auditor.

[Second Embodiment]
Next, the second embodiment will be described. In the first embodiment, it is determined whether or not the attachment file is to be separated. In the second embodiment, the attachment file is determined. Then, it is determined whether or not it is an encryption target.

  In addition, since the structure and process in 2nd Embodiment perform the structure and process substantially the same as 1st Embodiment, description is abbreviate | omitted about the same structure and process, and it demonstrates using the same code | symbol. .

  FIG. 13 is a schematic diagram illustrating a functional configuration according to the information processing system 100, and an outline of each function will be described. This schematic diagram is an improvement of FIG.

  The difference from FIG. 3 is that the internal mail server 104 includes an encryption determination unit 318 and an encryption unit 319.

  The encryption determination unit 318 is connected to the server mail reception unit 303 and the attached file extraction unit 305. When the server mail reception unit 303 receives a notification that the email has been received, the encryption determination unit 318 analyzes the content of the email. However, as an outline of the analysis content, if an email has an attached file to be encrypted, the email is subject to filtering.

  As a method for determining whether or not an attached file to be encrypted exists in an e-mail, the same method as that described in the first embodiment is used. In the second embodiment, the first embodiment is used. In the case where there is an attachment file to be encrypted if there is an attachment file to be separated, on the other hand, in the first embodiment, an attachment to be encrypted if there is no attachment file to be separated Judged as if the file does not exist.

  When the attached file extracting unit 305 receives from the e-mail the notification that there is an attached file to be encrypted, the attached file extracting unit 305 acquires the attached file from the e-mail.

  The encryption unit 319 is connected to the attachment file extraction unit 305 and the mail generation unit 307. The encryption unit 318 encrypts the attachment file to be encrypted by the encryption determination unit 318 and sets a password for decryption. Issue.

  When the attached file is encrypted by the encrypting unit 319, the mail generating unit 307 attaches the encrypted attached file to the e-mail.

  The password notification mail generation unit 308 generates an e-mail for notifying the password issued by the encryption unit 319 after transmitting the e-mail generated by the mail generation unit 307 to the transmission destination.

  Upon receiving notification that the e-mail has been generated by the mail generation unit 307, the server mail transmission unit 309 transmits the e-mail to the destination, and the password notification e-mail generation unit 308 generates a password notification e-mail. Upon receiving the notification that the password has been sent, the password notification mail is sent to the sender, the destination, or both.

  It should be noted that it may be set in advance whether to determine the received e-mail by the separation determination unit 304 or the encryption determination unit 318, or to determine which transmission is used. Depending on the destination, it may be determined which determination is to be performed.

  FIG. 14 is a flowchart showing the processing for the attached file of the e-mail in the information processing system according to the embodiment of the present invention. In addition, about the process performed by each step, a process is performed under control of CPU201 of the internal mail server 104. FIG.

  In step S420, the server mail receiving unit 303 determines whether to perform separation determination or encryption determination on the electronic mail received in step S401, and if it is determined to perform separation determination, If the process proceeds to S428 and it is determined that the encryption determination is to be performed, the process proceeds to step S421.

  As an example of this determination method, as described above, which determination is used may be set in advance, or which determination is performed may be set according to the transmission destination.

  Further, the determination may be performed not only by the server mail reception unit 303 but also by the separation determination unit 304 or the encryption determination unit 318.

  In step S421, the encryption determination unit 318 determines whether or not there is an attached file to be encrypted in the email received in step S401. If it is determined that the attachment exists, the process proceeds to step S422. If not determined to exist, the process proceeds to step S427.

  As an example of this determination method, as described above, in the second embodiment, when there is an attachment file to be separated in the first embodiment, an attachment file to be encrypted exists, In the first embodiment, the case where there is no attachment file to be separated is determined as the case where there is no attachment file to be encrypted.

  In step S422, the attached file extracting unit 305 acquires an attached file to be encrypted from the e-mail, and the encrypting unit 319 encrypts the attached file and issues a password for decrypting.

  In step S423, the mail generation unit 307 generates an e-mail that has been replaced with the attached file encrypted in step S422.

  In step S424, the server mail transmission unit 309 transmits the email generated in step S423 to the second client reception unit 313 of the client terminal 109.

  In step S425, the password notification mail generation unit 308 generates a password notification mail for notifying information such as a password for combining the encrypted attached file issued in step S422.

  In step S426, the server mail transmission unit 309 sends the password notification mail generated in step S425 to the first client reception unit 302 of the client terminal 101, the second client reception unit 313 of the client terminal 109, or the client terminal 101. The data is transmitted to both the first client receiving unit 302 and the second client receiving unit 313 of the client terminal 109.

  In step S427, the server mail transmission unit 309 transmits the email received in step S401 to the second client reception unit 313 of the client terminal 109.

  In step S428, separation processing is performed. For details, the processing from step S402 to step S412 shown in FIG. 4 is performed.

  The result of this processing is shown in FIG. Since part 616 and part 618 (see FIG. 12) are to be encrypted (because ContentID is not included), the encrypted attached file is, for example, a file such as encrypted ZIP ( Are attached to the e-mail as part of XXX.zip.) Since the parts 620, 622, and 624 are not to be encrypted, they remain as parts.

  In step S421, if there is no attached file to be encrypted, a conventional filtering process is performed by applying a rule to the e-mail before the process of step S427, and the e-mail is transmitted. It is also possible to hold or forbid.

  When the suspension is made, the process of step S427 may be performed after approval by the auditor.

  If there is an attached file to be encrypted, the transmission of the e-mail may be suspended once, and after the approval by the inspector, the processing after step S422 may be performed.

  Furthermore, even when there is an attachment file to be encrypted, in step S422, by applying a rule to the email from which the attachment file is acquired and the attachment file, the conventional filtering process is performed, It is also possible to defer or prohibit sending email

[Third Embodiment]
Next, the third embodiment will be described. In the first embodiment and the second embodiment, separation and encryption are avoided for images and style sheets attached to HTML-format e-mails. However, the third embodiment relates to separation and encryption for an email in rich text format.

  Rich text e-mail that can be decorated to e-mail from client terminals in an e-mail system environment based on Exchange and Office365 (registered trademark), which are products of Microsft (registered trademark) Is transmitted as a message in a predetermined format, and an e-mail attached with a file (winmail.dat, win.dat, hereinafter, a decoration file) is transmitted.

  Therefore, when the internal mail server 104 receives such an e-mail, it detects that the file is attached, and the user does not intend to attach the file to the e-mail. The file is separated or encrypted.

  For example, the upper part of FIG. 16 shows each part of the email created in the rich text format, but the part 1000 includes the part 1002 related to the body of the email and the email created in the rich text format. And an electronic mail having this configuration is transmitted from the client terminal.

  Then, in the conventional method, since the value (winmail.dat) is set in filename in the conventional method, the internal mail server 104 regards it as a separation target or considers it as an encryption target, and automatically sets it in the system. The attached decoration file is separated or encrypted.

  Then, when the recipient of the e-mail sees the e-mail attached with the URL indicating the destination where the e-mail is stored separately or an encrypted decoration file, it feels strange that an unexpected file is attached. Or the confirmation of the attached decoration file, etc., there is a problem that the work is hindered.

  Further, in the system environment on the e-mail receiving side, such a file may be misunderstood as a malicious file attached to the e-mail and processed.

  In addition, depending on the user, there are many users who are not particular about the decoration given in the rich text format, so a method for solving such a problem will be described below.

  First, as in part 1000 shown in the upper part of FIG. 17, a part 1002 related to the body of the email, a part related to the email created in the rich text format, and a part related to the decoration file that is not intentionally attached by the user. Assume that an e-mail composed of 1008 is transmitted from the first client transmission unit 301 of the client terminal 101.

  In this case, in step S402, the separation determination unit 304 determines whether or not an attachment file to be separated exists in the email received in step S401.

  To make this determination, refer to the part corresponding to the attached file, and if filename is set (winmail.dat, win.dat is set), it is assumed that the attached file exists. If Content-Type is a type (application / ms-tnef) that is a decoration file automatically attached by the system by an email created in rich text format, the value of this attachment is set to filename Even if it is, it is assumed that the attached file does not exist.

  However, as a result of analyzing (developing) the decoration file, if it can be specified that the file that the user intentionally attached exists in the decoration file, it is determined that the attachment file to be separated exists.

  Note that the decoration file has a configuration including a file containing the body of the e-mail and information related to the decoration of the body, and a file intentionally attached by the user.

  Then, as pre-processing in step S412, the attached file extraction unit 305 separates the decoration file from the email, and in step S412, the server mail transmission unit 309 sends the email from which the decoration file is separated to the client terminal 109. To the second client receiving means 313.

  An example of this is shown in the lower part of FIG. 17, and the e-mail is transmitted with the part 1002 relating to the body of the e-mail remaining and the part 1008 relating to the e-mail created in the rich text format being deleted.

  On the other hand, in step S421, the encryption determination unit 318 determines whether or not there is an attachment file to be encrypted in the email received in step S401. If it is determined that the attachment exists, the process proceeds to step S422. If it is determined not to exist, the process proceeds to step S427.

  As an example of this determination method, as described above, when there is an attachment file to be separated, there is an attachment file to be encrypted, and when there is no attachment file to be separated, encryption is performed. It is determined that there is no attached file to be converted.

  Then, as pre-processing in step S427, the attached file extraction unit 305 separates the decoration file from the email, and in step S427, the server mail transmission unit 309 sends the email from which the decoration file is separated to the client terminal 109. To the second client receiving means 313.

  Next, as in the part 1000 shown in the upper part of FIG. 18, the part 1010 related to the body of the email, the part related to the email created in the rich text format, and the file (AAAAA.docs, Assume that an e-mail composed of a part 1012 related to BBBBB.xlsx is transmitted from the first client transmission unit 301 of the client terminal 101.

  In step S402, the separation determination unit 304 performs the processing as described above. After the file is regarded as a decoration file, the decoration file is analyzed (expanded), and a file intentionally attached by the user exists. Can be identified (AAAAAA.docs and BBBBB.xlsx files exist in the decoration file), it is determined that there is an attached file to be separated.

  In step S403, the attachment file extraction unit 305 acquires an attachment file (AAAAAA.docs and BBBBB.xlsx files for decoration) to be separated from the e-mail, and the attachment file storage request unit 306 acquires the attachment file. In order to store in the NFS server 105, the attachment file storage unit 311 is requested to store the attachment file, and the attachment file storage unit 311 stores the attachment file in the NFS server 105.

  It should be noted that the file containing the text of the e-mail and information relating to the decoration of the text is deleted, and the NFS server 105 is not requested to store the file. Then, the process after step S404 is performed.

  On the other hand, in step S421, in the same determination method as the process performed in step S402 described above, the case where the attachment file to be separated exists is the case where the attachment file to be encrypted exists, The case where there is no attached file is determined as the case where there is no attached file to be encrypted.

  In step S422, the attached file extracting unit 305 acquires an attached file to be encrypted (AAAAA.docs and BBBBB.xlsx files for decoration) from the e-mail, and the encrypting unit 319 encrypts the attached file. And issue a password for compounding.

  At this time, the body of the e-mail included in the decoration file and the file including the information related to the decoration of the body are deleted, and encryption is not performed.

  In step S423, the mail generation unit 307 generates an electronic mail that has been replaced with the encrypted attached file (AAAAA.docs, BBBBB.xlsx file).

  An example of the configuration of the e-mail generated by this processing is shown in the lower part of FIG. 18, except that the part 1010 relating to the body of the e-mail is left and the part 1012 relating to the e-mail created in the rich text format is deleted. In addition, an e-mail including part 1014 (AAAAAA.docs) and part 1016 (BBBBB.xlsx) related to the file intentionally attached by the user included in the decoration file is generated.

  Next, as in part 1000 shown in the lower part of FIG. 16, an e-mail composed of part 1002 related to the body of the e-mail and part 1006 indicating that the user intentionally attached a decoration file is sent to the client terminal 101. Is transmitted from the first client transmission unit 301.

  In this case, since the decoration file is not automatically attached by the system, it is set as a separation target and an encryption target.

  Therefore, in step S402 and step S421, if the content-type is a type (application / octet-stream) indicating that the user has intentionally attached a decoration file, it is determined that the attached file exists. .

  Note that, regardless of whether or not an attachment file exists in the decoration file, it is determined by the decoration file that an attachment file exists.

  Similarly to the first embodiment, when there is no attachment to be separated in step S402, the conventional filtering process is performed by applying a rule to the email before the process of step S412. It is also possible to suspend or prohibit transmission of the e-mail.

  When the suspension is made, the process in step S412 may be performed after approval by the auditor.

  In addition, even when there is an attachment file to be separated, after step S403, the conventional filtering process is performed by applying the rule to the email from which the attachment file is separated and the attachment file. It is also possible to suspend or prohibit transmission of e-mail.

  When the suspension is made, the process of step S404 may be performed after approval by the auditor.

  Further, as in the second embodiment, when there is no attachment to be encrypted in step S421, the conventional filtering is applied by applying a rule to the e-mail before the process of step S427. It is possible to suspend or prohibit transmission of the e-mail by performing processing.

  When the suspension is made, the process of step S427 may be performed after approval by the auditor.

  If there is an attached file to be encrypted, the transmission of the e-mail may be suspended once, and after the approval by the inspector, the processing after step S422 may be performed.

  Furthermore, even when there is an attachment file to be encrypted, in step S422, by applying a rule to the email from which the attachment file is acquired and the attachment file, the conventional filtering process is performed, It is also possible to suspend or prohibit transmission of e-mail.

  As another example of the configuration of the electronic mail, it is assumed that an email having no part (Content-Type is text / plain) related to the body of the electronic mail is transmitted from the first client transmission unit 301 of the client terminal 101.

  In this case, the decoration file is deleted as described above, but before the process of step S412, after step S403, before the process of step S427, and in step S422, a new part related to the body of the email is generated. Thus, the body of the e-mail in the decoration file and the body of the e-mail in the file including information relating to the decoration of the body are defined as the generated part.

  As described above, the file intentionally attached in the decoration file is attached to the e-mail.

Thereafter, filtering processing may be performed on the e-mail.
As described above, according to the present invention, it is possible to improve security while performing flexible operation when transmitting / receiving an electronic mail in which an attached file exists.

  Further, the present invention can take an embodiment as, for example, a method, a program, or a recording medium.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention. As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS or the like operating on the computer based on an instruction of the program is a part of the actual processing or It goes without saying that the case where the functions of the above-described embodiments are realized by performing all of the above processing is also included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention. In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 Information Processing System 101 Client Terminal 102 Administrator Client Terminal 103 Local Area Network (LAN)
104 Internal Mail Server 105 NFS Server 106 Web Server 107 Wide Area Network 108 External Mail Server 109 Client Terminal 201 CPU
202 RAM
203 ROM
204 System Bus 205 Input Controller 206 Video Controller 207 Memory Controller 208 Communication I / F (Interface) Controller 209 Input Unit 210 Display Device 211 External Memory

Claims (21)

An information processing apparatus that relays an email sent from a client terminal,
An acquisition means for acquiring attachment file information indicating information on a file attached to the e-mail from a header of the e-mail;
A determining unit that determines processing for the file based on the attached file information acquired by the acquiring unit;
An information processing apparatus comprising:   The information processing apparatus according to claim 1, wherein the determination unit determines to perform processing for separating the file from the electronic mail or processing for encrypting the file as processing for the file. . When the attached file information is information indicating that the file is an image inserted into the e-mail,
The information processing apparatus according to claim 2, wherein the determination unit determines not to perform the separation process and the encryption process. The attached file information is a part related to an attached file among the parts constituting the e-mail, and an image in which a file of a part having a value set in ContentID in the part is inserted into the e-mail. If it is information indicating that,
The information processing apparatus according to claim 2, wherein the determination unit determines not to perform the separation process and the encryption process. When the attached file information is information indicating that the file is information indicating decoration on the electronic mail,
The information processing apparatus according to claim 2, wherein the determination unit determines not to perform the separation process and the encryption process. When the file indicating the decoration information includes a file attached to the e-mail,
The information processing apparatus according to claim 5, wherein the determination unit determines to perform the separation process or the encryption process on the attached file. A transmission means for transmitting the e-mail after the determination is made by the determination means;
If the file indicating the decoration information includes a file that decorates the body of the e-mail and a file attached to the e-mail,
The determination means determines to perform the separation process or the encryption process on the attached file,
7. The information processing according to claim 6, wherein the transmission unit transmits an e-mail obtained by performing the process determined by the determination unit without transmitting a file that decorates a body of the e-mail. apparatus. When the attached file information is information indicating that a file indicating information on decoration for the email is automatically attached to the email,
The information processing apparatus according to claim 5, wherein the determination unit determines that the separation process and the encryption process are not performed. When the attached file information is information indicating that a file indicating information on decoration for the e-mail is attached to the e-mail according to a user's intention,
The information processing apparatus according to claim 5, wherein the determination unit determines to perform the separation process and the encryption process. An information processing apparatus that relays an email sent from a client terminal,
Determining means for determining whether a file attached to the received e-mail is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination means is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the e-mail received by the determining means is not attached to the body of the e-mail, separating means for separating the attached file from the e-mail;
An e-mail from which the attached file is separated by the separating means or a sending means for sending an e-mail without separating the attached file;
An information processing apparatus comprising:   If the determination unit determines that the file attached to the body of the e-mail and the file not attached to the body of the e-mail are attached to the e-mail by the determination unit, The information processing apparatus according to claim 10, wherein a file that is not attached to the body of an e-mail is separated without separating a file attached to the body of an email. An information processing system in which a client terminal that transmits and receives electronic mail and an information processing apparatus are connected via a network,
The client terminal is
Client transmission means for transmitting the e-mail;
Client receiving means for receiving e-mail from the information processing apparatus transmitting means;
With
The information processing apparatus includes:
An information processing device receiving means for receiving an email sent by the client sending means;
Obtaining means for obtaining attached file information indicating information on a file attached to the e-mail received by the information processing apparatus receiving means from a header of the e-mail;
A determining unit that determines processing for the file based on the attached file information acquired by the acquiring unit;
An information processing apparatus transmitting means for transmitting an e-mail obtained by performing the processing determined by the determining means;
An information processing system comprising: An information processing system in which a client terminal that transmits and receives electronic mail and an information processing apparatus are connected via a network,
The client terminal is
Client transmission means for transmitting the e-mail;
Client receiving means for receiving e-mail from the information processing apparatus transmitting means;
With
The information processing apparatus includes:
An information processing device receiving means for receiving an email sent by the client sending means;
Determining means for determining whether a file attached to the e-mail received by the information processing apparatus receiving means is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination means is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the e-mail received by the determining means is not attached to the body of the e-mail, separating means for separating the attached file from the e-mail;
An information processing apparatus transmitting means for transmitting an e-mail without separating an attached file or an attached mail separated by the separating means; and
An information processing system comprising: A method for controlling an information processing apparatus that relays an email sent from a client terminal,
The information processing apparatus includes:
An acquisition step of acquiring attachment file information indicating information on a file attached to the e-mail from a header of the e-mail;
A determination step for determining processing for the file based on the attached file information acquired by the acquisition step;
A method for controlling an information processing apparatus, characterized by: A program that can be read and executed by an information processing device that relays an email sent from a client terminal,
The information processing apparatus;
An acquisition means for acquiring attachment file information indicating information on a file attached to the e-mail from a header of the e-mail;
A determining unit that determines processing for the file based on the attached file information acquired by the acquiring unit;
Program to make it function. A method for controlling an information processing apparatus that relays an email sent from a client terminal,
The information processing apparatus includes:
A determination step for determining whether a file attached to the received e-mail is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination step is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the email received by the determination step is not attached to the body of the email, a separation step of separating the attached file from the email;
A sending step of sending an email without separating the attached file or the email separated from the attached file by the separating step;
A method for controlling an information processing apparatus, characterized by: A program that can be read and executed by an information processing device that relays an email sent from a client terminal,
The information processing apparatus;
Determining means for determining whether a file attached to the received e-mail is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination means is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the e-mail received by the determining means is not attached to the body of the e-mail, separating means for separating the attached file from the e-mail;
An e-mail from which the attached file is separated by the separating means or a sending means for sending an e-mail without separating the attached file;
Program to make it function. In an information processing system in which a client terminal that transmits and receives electronic mail and an information processing apparatus are connected via a network,
The client terminal is
A client sending step for sending the email;
A client reception step for receiving an email from the information processing device transmission step;
Run
The information processing apparatus includes:
An information processing device receiving step for receiving the e-mail transmitted by the client transmitting step;
An acquisition step of acquiring attachment file information indicating information on a file attached to the e-mail received by the information processing device reception step from a header of the e-mail;
A determination step for determining processing for the file based on the attached file information acquired by the acquisition step;
An information processing apparatus transmitting step for transmitting an e-mail obtained by performing the processing determined in the determining step;
The control method of the information processing system characterized by performing this. In an information processing system in which a client terminal that transmits and receives electronic mail and an information processing apparatus are connected via a network,
The client terminal is
Client transmission means for transmitting the e-mail;
Client receiving means for receiving e-mail from the information processing apparatus transmitting means;
Function as
The information processing apparatus;
An information processing device receiving means for receiving an email sent by the client sending means;
Obtaining means for obtaining attached file information indicating information on a file attached to the e-mail received by the information processing apparatus receiving means from a header of the e-mail;
A determining unit that determines processing for the file based on the attached file information acquired by the acquiring unit;
An information processing apparatus transmitting means for transmitting an e-mail obtained by performing the processing determined by the determining means;
Program to make it function. A method for controlling an information processing system in which a client terminal that transmits and receives an e-mail and an information processing apparatus are connected via a network,
The client terminal is
A client sending step for sending the email;
A client reception step for receiving an email from the information processing device transmission step;
Run
The information processing apparatus includes:
An information processing device receiving step for receiving the e-mail transmitted by the client transmitting step;
A determination step of determining whether or not a file attached to the e-mail received by the information processing device receiving step is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination step is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the email received by the determination step is not attached to the body of the email, a separation step of separating the attached file from the email;
An information processing apparatus transmitting step for transmitting an e-mail without separating an e-mail or an attached file from which an attached file is separated by the separating step;
The control method of the information processing system characterized by performing this. In an information processing system in which a client terminal that transmits and receives electronic mail and an information processing apparatus are connected via a network,
The client terminal is
Client transmission means for transmitting the e-mail;
Client receiving means for receiving e-mail from the information processing apparatus transmitting means;
To function,
The information processing apparatus;
An information processing device receiving means for receiving an email sent by the client sending means;
Determining means for determining whether a file attached to the e-mail received by the information processing apparatus receiving means is attached to the body of the e-mail;
If it is determined that the file attached to the email received by the determination means is attached to the body of the email, without separating the attached file from the email,
on the other hand,
If it is determined that the file attached to the e-mail received by the determining means is not attached to the body of the e-mail, separating means for separating the attached file from the e-mail;
An information processing apparatus transmitting means for transmitting an e-mail without separating an attached file or an attached mail separated by the separating means; and
Program to make it function.

Images