An email delivery forensics method, apparatus and readable medium

Abstract

The application discloses an email delivery evidence obtaining method, device and readable medium, which comprises the following steps: based on the email protocol, the user agent is used to complete the email sending process on the evidence mailbox, and after the email sending is completed, the evidence content of the email is extracted according to the evidence configuration, the evidence storage ID and the evidence result are generated, at least two different hash algorithms are used to calculate the corresponding sub-feature values of the email respectively, the first root feature value is calculated according to the corresponding sub-feature values of the email, and the evidence storage ID and the corresponding first root feature value are uploaded to the evidence storage alliance chain; in the verification process, at least two different hash algorithms are used to calculate the corresponding sub-feature values of the email to be verified respectively, the second root feature value is calculated, the corresponding first root feature value is extracted in the evidence storage alliance chain according to the evidence storage ID, and the second root feature value is verified, so that the verification result is obtained, the timeliness, convenience and fairness of the electronic delivery can be reflected.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of electronic information transmission, in particular to an email delivery evidence collection method, device and readable medium. BACKGROUND

[0002] Electronic delivery, with the aid of electronic information processing, storage and transmission technology, has become a more convenient, timely and cost-effective delivery method. However, due to the virtualization and digitization of the electronic data environment, viruses, hackers, network congestion and other problems make network transmission have certain security risks. Not only can the program itself be subject to malicious attacks, but the relevant information can also be maliciously tampered with. For example, in life, frauds using networks, telephones and short messages occur from time to time, which makes it impossible to guarantee the authenticity and integrity of the delivered information. Even if the document is safely delivered to the addressee, its content can be easily modified or deleted without being easily detected and verified. Once an error occurs in electronic delivery, it is likely to cause double damage to the procedural rights and substantive rights of the parties. Therefore, appropriate safeguards should be provided during the delivery process and the confirmation process to improve the relevant procedural issues. SUMMARY

[0003] The present application aims to provide an email delivery evidence collection method, device and readable medium to solve the above technical problems.

[0004] In a first aspect, the present application provides an email delivery evidence collection method, comprising the following steps:

[0005] Obtaining the sender's electronic mailbox and the corresponding third-party login authorization code, and logging into the sender's electronic mailbox based on the third-party login authorization code;

[0006] Setting an evidence collection configuration, which includes an evidence collection mailbox, an evidence collection time, an evidence collection mode, an evidence collection content and / or an evidence collection result. The evidence collection mailbox is the sender's electronic mailbox to be collected.

[0007] Based on the email protocol, the email sending process is completed on the evidence collection mailbox in the user agent mode. After the email sending is completed, the evidence collection content of the email is extracted according to the evidence collection configuration, and a storage ID and an evidence collection result are generated. The evidence collection content includes a metadata file, and the evidence collection result includes an original file and a storage log file. At least two different hash algorithms are used to calculate the corresponding sub-feature values of the email. The sub-feature values include at least two hash values of the original file, at least two hash values of the metadata file and at least two hash values of the storage log file. A first root feature value is calculated according to the corresponding sub-feature values of the email. The storage ID corresponds to the first root feature value. The storage ID and the corresponding first root feature value are uploaded to the storage alliance chain.

[0008] In the verification process, the storage ID, the original file, the metadata file and the storage log file corresponding to the email to be verified obtained by the sender and / or the receiver are calculated by at least two different hash algorithms to obtain the sub-feature values corresponding to the email to be verified, the second root feature value is calculated according to the sub-feature values corresponding to the email to be verified, the corresponding first root feature value is extracted in the storage alliance chain according to the storage ID, and the first root feature value is verified with the second root feature value. If the verification is passed, it is determined that the email to be verified has been delivered and the email content has not been tampered with, otherwise it is determined that the email content or metadata of the email to be verified has been tampered with or the email to be verified has not been stored.

[0009] As preferred, the forensics time is the time interval for one new email retrieval and extraction, the forensics mode is a single forensics mode or a batch forensics mode based on a screening condition retrieval, and the forensics content further includes a mail type and a mail content.

[0010] As preferred, the original file adopts an EML email file format, and the storage log file adopts a txt file format, including a forensics name, a forensics mailbox, a forensics configuration, a forensics environment, a forensics time, a storage time, a size of the original file, at least two hash values of the original file of the email and at least two hash values of the metadata file.

[0011] As preferred, the email sending process is completed on the forensics mailbox based on a user agent in a mail protocol, specifically including:

[0012] The sender calls the user agent to edit the email to be sent and selects to send, and the user agent sends the email to the mail server of the sender through the SMTP protocol;

[0013] After the mail server of the sender receives the email sent by the user agent, it is stored in the mail cache queue, the mail server of the sender establishes a TCP connection with the mail server of the receiver, and the email in the mail cache queue is sent to the mailbox server of the receiver;

[0014] After the mailbox server of the receiver receives the email, it is placed in the receiver's email box for the receiver to read the email.

[0015] As preferred, the nodes in the storage alliance chain include a mail operation service provider, a judicial authentication center, a notary office, a third-party forensics and storage system, and a judicial organ, and the storage ID and the corresponding first root feature value are stored synchronously in each node in the storage alliance chain.

[0016] As preferred, the first root feature value is calculated according to the sub-feature values corresponding to the email, specifically including:

[0017] The hash algorithm is used to calculate the sub-feature values corresponding to the email to obtain a first root feature value;

[0018] A second root feature value is calculated according to the sub-feature values corresponding to the email to be verified, and specifically includes:

[0019] The hash algorithm is used to calculate the sub-feature values corresponding to the email to be verified to obtain a second root feature value.

[0020] In a second aspect, the present application provides an email delivery forensics device, comprising:

[0021] The login module is configured to obtain a sender email address and a corresponding third-party login authorization code, and log in to the sender email address based on the third-party login authorization code;

[0022] The forensics setting module is configured to set a forensics configuration, the forensics configuration including a forensics email address, a forensics time, a forensics mode, a forensics content, and / or a forensics result, the forensics email address being the sender email address to be forensiced;

[0023] The forensics evidence storage module is configured to complete the email sending process on the forensics email address in the manner of user agent based on the email protocol, and extract the forensics content of the email according to the forensics configuration after the email sending is completed, and generate an evidence storage ID and a forensics result, the forensics content including a metadata file, the forensics result including an original file and an evidence storage log file, the sub-feature values corresponding to the email being calculated by at least two different hash algorithms respectively, the sub-feature values including at least two hash values of the original file, at least two hash values of the metadata file, and at least two hash values of the evidence storage log file, a first root feature value being calculated according to the sub-feature values corresponding to the email, the evidence storage ID corresponding to the first root feature value in one-to-one manner, and the evidence storage ID and the corresponding first root feature value being uploaded to the evidence storage alliance chain;

[0024] The verification module is configured to obtain the evidence storage ID, the original file, the metadata file, and the evidence storage log file corresponding to the email to be verified through the sender and / or the recipient in the verification process, the sub-feature values corresponding to the email to be verified being calculated by at least two different hash algorithms respectively, a second root feature value being calculated according to the sub-feature values corresponding to the email to be verified, the corresponding first root feature value being extracted from the evidence storage alliance chain according to the evidence storage ID, and the second root feature value being verified, if the verification is passed, it is determined that the email to be verified has been delivered and the email content has not been tampered with, otherwise it is determined that the email content or the metadata of the email to be verified has been tampered with or the email to be verified has not been stored.

[0025] In a third aspect, the present application provides an electronic device, comprising one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any implementation manner of the first aspect.

[0026] In a fourth aspect, the present application provides a computer-readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the method as described in any implementation manner of the first aspect.

[0027] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method as described in any implementation manner of the first aspect.

[0028] Compared with the prior art, the present application has the following beneficial effects:

[0029] (1) The electronic mail delivery evidence collection method proposed by the present application can better reflect the timeliness, convenience and fairness of electronic delivery. At the same time of electronic delivery, the delivery content and delivery action are fixed and preserved. The third-party electronic data evidence collection, storage and blockchain technology are introduced to collect, fix and store the original content of the electronic delivery process. The storage is used as a supplement to effective delivery to prove that the delivery content has not been tampered with.

[0030] (2) The electronic mail delivery evidence collection method proposed by the present application is based on the need for data objectivity. On the basis of calculating at least two hash values of the original file, at least two hash values of the metadata file and at least two hash values of the storage log file, the root characteristic value corresponding to the electronic mail is further calculated. The root characteristic value is used as the verification basis and is linked in real time, which further protects the electronic delivery data from being tampered with and does not affect the normal business process of the electronic delivery platform. It is flexible to connect and has strong operability.

[0031] (3) The electronic mail delivery evidence collection method proposed by the present application extracts, fixes and links the electronic delivery information in real time, effectively standardizes the delivery behavior, maintains the legal rights and interests of the delivery unit and the parties from an objective and fair third-party perspective, has a wide application range, strong practicability and broad prospects. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0033] Figure 1A flowchart of an email delivery forensics method of an embodiment of the present application;

[0034] Figure 2 A flowchart of extracting a mail of an email delivery forensics method of an embodiment of the present application;

[0035] Figure 3 A flowchart of SM3 algorithm and SHA-256 algorithm of an email delivery forensics method of an embodiment of the present application;

[0036] Figure 4 A schematic diagram of calculating a root hash value of an email delivery forensics method of an embodiment of the present application;

[0037] Figure 5 A schematic diagram of a verification process of an email delivery forensics method of an embodiment of the present application;

[0038] Figure 6 A schematic diagram of an email delivery forensics device of an embodiment of the present application;

[0039] Figure 7 A hardware structure schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0041] Figure 1 An email delivery forensics method provided by an embodiment of the present application is shown, which includes the following steps:

[0042] S1, obtaining a sender's electronic mailbox and a corresponding third-party login authorization code, and logging in the sender's electronic mailbox based on the third-party login authorization code.

[0043] Specifically, the email delivery forensics method proposed by the embodiment of the present application is applied to a forensics system, and the method is realized and executed on the forensics system. After the sender's electronic mailbox of the email is determined, a complete mailbox address needs to be filled in. The third-party login authorization code of the sender's electronic mailbox is obtained, which facilitates the forensics system to obtain the authorization of the forensics mailbox, and enables the forensics system to log in the corresponding electronic mailbox, i.e., the sender's electronic mailbox.

[0044] S2, setting the evidence configuration, the evidence configuration including the evidence mailbox, the evidence time, the evidence mode, the evidence content and / or the evidence result, the evidence mailbox being the sender's electronic mailbox to be evidence.

[0045] In specific embodiments, the evidence time is the time interval for retrieving and extracting a new email once, the evidence mode is a single evidence mode or a batch evidence mode based on screening conditions, and the evidence content further includes the email type and the email content.

[0046] Specifically, the evidence configuration is one of the effective components of the evidence storage system, which can selectively and targetedly extract the sent email, thereby playing an effective evidence and storage role, and preventing the storage of other non-delivery files or sensitive files. The specific content of the evidence configuration is as follows:

[0047] 1. Evidence mailbox: The sender's electronic mailbox to be evidence is explicitly defined and configured, and the evidence storage system supports changing and switching multiple target evidence addresses.

[0048] 2. Evidence time: The evidence time is configured as the online time of the evidence storage system, and a certain time interval, such as 10s, 30s, or 60s, can be set. After the time interval, a new email retrieval and extraction is performed.

[0049] 3. Evidence mode: Based on time setting or specified keyword screening conditions, the "single evidence mode" and "batch evidence mode" can be performed.

[0050] 4. Evidence content:

[0051] Email type: The specified keyword can be used to extract the email, such as the sender's and receiver's email with "notification", "delivery" or "receipt" in the email title.

[0052] Email content: The overall email content and attachments.

[0053] Email metadata: Sender, receiver, sending time, delivery time, and basic element information such as email title.

[0054] 5. Evidence result: The original file in EML email file format and the evidence storage log file in txt format are generated.

[0055] S3, based on the mail protocol, using the user agent to complete the email sending process on the forensic mailbox, and extracting the forensic content of the email according to the forensic configuration after the email sending is completed, and generating a storage ID and a forensic result, the forensic content includes a metadata file, and the forensic result includes an original file and a storage log file, at least two different hash algorithms are used to calculate the corresponding sub-feature values of the email, the sub-feature values include at least two hash values of the original file, at least two hash values of the metadata file and at least two hash values of the storage log file, a first root feature value is calculated according to the corresponding sub-feature values of the email, the storage ID is one-to-one corresponding to the first root feature value, and the storage ID and the corresponding first root feature value are uploaded to the storage alliance chain.

[0056] In specific embodiments, the original file adopts an EML email file format, and the storage log file adopts a txt file format, including a forensic name, a forensic mailbox, a forensic configuration, a forensic environment, a forensic time, a storage time, a size of the original file, at least two hash values of the original file of the email and at least two hash values of the metadata file.

[0057] In specific embodiments, based on the mail protocol, the user agent is used to complete the email sending process on the forensic mailbox, specifically including:

[0058] The sender calls the user agent to edit the email to be sent and selects to send, and the user agent sends the email to the mail server of the sender through the SMTP protocol;

[0059] After the mail server of the sender receives the email sent by the user agent, the email is stored in the mail cache queue, the mail server of the sender establishes a TCP connection with the mail server of the recipient, and the email in the mail cache queue is sent to the mailbox server of the recipient;

[0060] After the mailbox server of the recipient receives the email, the email is put into the email box of the recipient for the recipient to read the email.

[0061] Specifically, at present, the email sending protocol is mainly SMTP protocol, a set of specifications for transmitting mail from the source address to the destination address, through which the transit mode of the mail is controlled. The mail receiving protocol mainly includes POP protocol and IMAP protocol, and the POP protocol is responsible for retrieving electronic mail from the mail server. The IMAP protocol can also download electronic mail, delete electronic mail from the server or inquire whether there is new electronic mail, can decide the way the client requests the mail server to submit the received electronic mail, and requests the mail server to download only the selected electronic mail instead of all electronic mail. The evidence extraction system can read the title and the name of the sender of the mail information first, and then decide whether to download this electronic mail.

[0062] Reference Figure 2 The evidence extraction system is based on the process of the mail server to extract electronic mail for evidence, and the sending and receiving process of electronic mail is realized by proxying the mail server. The specific process is as follows:

[0063] 1. The sender calls the user agent to edit the electronic mail to be sent.

[0064] 2. The sender clicks the "send mail" button on the screen, and hands over the work of sending the electronic mail to the user agent to complete. The user agent sends the electronic mail to the mail server of the sender through the SMTP protocol.

[0065] 3. After the mail server of the sender receives the mail sent by the user agent, it temporarily stores the received mail in the mail cache queue, and waits for the time to mature before sending it to the mail server of the recipient.

[0066] 4. The mail server of the sender sends the electronic mail in the mail cache to the mail server of the recipient. Before sending the electronic mail, the SMTP server of the mail server of the sender needs to establish a TCP connection with the SMTP server of the mail server of the recipient, and then send the electronic mail in the queue.

[0067] 5. After the SMTP server process in the mail server of the recipient receives the electronic mail, it puts the electronic mail into the user mailbox of the recipient, and waits for the recipient to read it.

[0068] 6. The evidence extraction system extracts through the user agent after the electronic mail is sent, configures the corresponding mail sending and receiving protocol (including mail server), encryption method and port number, and the content is as follows:

[0069] When the mail server supports SSL encryption method, SSL method can be selected in the configuration. Common configuration parameters are as follows:

[0070] 1) POP3 / SMTP protocol

[0071] Receiving mail server: pop.exmail.qq.com, using SSL, port number 995;

[0072] Sending mail server: smtp.exmail.qq.com, using SSL, port number 465;

[0073] 2) IMAP protocol

[0074] Receiving mail server: imap.exmail.qq.com, using SSL, port number 993;

[0075] Sending mail server: smtp.exmail.qq.com, using SSL, port number 465;

[0076] It should be noted that the port number 465 is an encrypted port, which is a variant of the SMTP protocol based on the SSL security protocol, which inherits the high security and reliability of asymmetric encryption of the SSL security protocol, and can prevent email leakage.

[0077] The evidence storage system can preserve the extracted emails in time, and calculate the hash value of the original file and its metadata.

[0078] Each email generates a corresponding evidence ID when it is stored, which is matched with the file name and the original file one by one.

[0079] The metadata of each email includes: email title, sender, recipient, sending time, delivery time, etc.

[0080] Considering subsequent original data verification, the present application can reasonably use two hash algorithms for calculation, including SM3 hash algorithm and SHA-256 hash algorithm. Figure 3 Taking the calculation process of SM3 hash algorithm as an example, the steps of SM3 hash algorithm are as follows:

[0081] Step 1: padding. Message padding is divided into two parts: additional padding bits and additional length, finally the entire message meets the specified structure, so that the processing can be unified and formatted.

[0082] Additional padding bits refer to padding at the end of the message, so that the length of the message after taking modulo 512 is 448. The additional length is to supplement the length information of the original data to the message that has been padded.

[0083] Second step: grouping. Message grouping refers to grouping the filled information according to 512 bits per group. If it is divided into n groups, it is B0, B1, …, Bn-1 groups.

[0084] Third step: iterative operation. The SM3 hash algorithm performs 64 rounds of iterative operation on the input message, and outputs a 256-bit hash value.

[0085] Fourth step: output the final hash value.

[0086] Finally, the evidence taking system uploads the hash values obtained by the two hash algorithms to the evidence alliance chain through the data interface.

[0087] Reference Figure 4 The on-chain data includes the evidence ID, the root characteristic value (hash value) of the stored data, and the evidence ID corresponds to the root characteristic value. Among them, the root characteristic value is a hash value calculated on the basis of three sub-characteristic values. Taking two hash algorithms as an example, the three sub-characteristic values are the main characteristic value of the original file of the email (containing the hash values of the two hash algorithms), the auxiliary characteristic value of the metadata file (containing the hash values of the two hash algorithms), and the auxiliary characteristic value of the storage log (containing the hash values of the two hash algorithms). The root characteristic value obtained by layer-by-layer weighting operation can further guarantee data security.

[0088] When the on-chain saving is successful, the corresponding transmission success value is fed back to the evidence taking system.

[0089] The nodes of the evidence alliance chain can include email operation service providers (electronic delivery platforms), judicial authentication centers, notarization offices, third-party evidence taking systems, courts, and other node units.

[0090] It should be noted that the original content of the evidence is preserved in the evidence taking system, and the hash value of the original content is chained. Saving the hash value can avoid leakage of the original content data and ensure data security. The original content includes the original file, the metadata file, and the evidence log file.

[0091] When the evidence is completed, the evidence taking system automatically generates an evidence log file. This evidence log file is a process log for taking evidence, fixing evidence, and storing evidence of an electronic email, and the content includes:

[0092] 1. Evidence name: generally the title of the email;

[0093] 2. Evidence mailbox: complete mailbox address;

[0094] 3. Evidence configuration: configuration condition description;

[0095] 4. Evidence environment: network information of the evidence taking system, email client information;

[0096] 5, Forensic time: the time of the original text forensics;

[0097] 6, Storage time: the storage time of the original text;

[0098] 7, File size: the size of the original file;

[0099] 8, Hash value: the hash value of the original file using sm3 algorithm, the hash value of the original file using sha-256 algorithm, the hash value of the metadata file using sm3 algorithm, and the hash value of the metadata file using sha-256 algorithm.

[0100] The "electronic delivery" mentioned in the embodiments of the present application focuses on a specific application scenario, that is, the electronic document delivery, evidence collection and storage preservation for administrative organs and judicial organs, which avoids the situation that the sender claims to have delivered the document while the recipient claims not to have received it. Therefore, the present application provides a guarantee for the delivery of administrative documents. The evidence collection and storage system mentioned in the embodiments of the present application is generally applied to the sender, but the information of the sender's email client is not directly stored on the blockchain. Instead, the information of the email client is extracted, the root eigenvalue is calculated, and then it is further stored on the chain, which embodies the process of email server-evidence collection-storage-blockchain, and has the objectivity of a third party.

[0101] S4, in the verification process, the storage ID, the original file, the metadata file and the storage log file corresponding to the electronic mail obtained by the sender and / or the recipient need to be verified, and at least two different hash algorithms are used to calculate the sub-eigenvalue corresponding to the electronic mail to be verified. The second root eigenvalue is calculated according to the sub-eigenvalue corresponding to the electronic mail to be verified, and the corresponding first root eigenvalue is extracted in the storage alliance chain according to the storage ID, and is verified with the second root eigenvalue. If the verification is passed, it is determined that the electronic mail to be verified has been delivered and the mail content has not been tampered with, otherwise it is determined that the mail content or metadata of the electronic mail to be verified has been tampered with or the electronic mail to be verified has not been stored.

[0102] In specific embodiments, the nodes in the storage alliance chain include a mail operation service provider, a judicial authentication center, a notary office, a third-party evidence collection and storage system, and a judicial organ, and the storage ID and the corresponding first root eigenvalue are stored synchronously in each node in the storage alliance chain.

[0103] In specific embodiments, the first root eigenvalue is calculated according to the sub-eigenvalue corresponding to the electronic mail, specifically including:

[0104] The sub-eigenvalue corresponding to the electronic mail is calculated by using a hash algorithm to obtain the first root eigenvalue;

[0105] According to the sub-feature value corresponding to the email to be verified, a second root feature value is calculated, specifically comprising:

[0106] The hash algorithm is used to calculate the sub-feature value corresponding to the email to be verified, and a second root feature value is obtained.

[0107] Specifically, referring to Figure 5 , the storage system provides a query retrieval interface for the recipient or sender to timely review, download the original file, metadata file and storage log file, and supports the recipient or sender to download the original file, metadata file and storage log file to provide to the corresponding certification agency / judicial organ for on-chain verification in the case of subsequent disputes. The specific process is as follows:

[0108] 1. The recipient or sender downloads the original file, metadata file and storage log file of the email to be verified through the storage system as a third party.

[0109] 2. The recipient or sender submits a certification application according to actual needs, including original email information.

[0110] 3. The certification agency and other judicial organs calculate the root feature value based on the original content of the email to be verified, and the calculation process is consistent with the process of calculating the root feature value when storing, and extract the corresponding hash value in the corresponding alliance chain node server according to the storage ID, and perform on-chain verification. After verification, the corresponding certification report is provided. If the verification is passed, the certification result in the certification report is that the sender successfully sent the email with the title of ___ on __, __, __, __, and the recipient is __, the email content is ____, and the email is the original email after sending without being tampered with; if the verification is not passed, the certification result in the certification report is that the email content or metadata has been tampered with or the email has not been stored in the storage system. Further guarantee the authenticity, accuracy and objective effectiveness of electronic delivery.

[0111] The present application can effectively extract, fix and store the email delivery scene data in electronic delivery, actively extract the email delivery data in the email server of the electronic delivery platform through the email protocol, including the sender, recipient, sending time / delivery time, email title, email content, email attachment and other information, and finally fix and store in the "eml" file format. Based on the need for data objectivity, the root feature value corresponding to the email is calculated and uploaded in real time, further ensuring that the electronic delivery data cannot be tampered with, and the whole process can be operated without feeling, without affecting the normal business process of the electronic delivery platform, flexible docking and strong operability.

[0112] The above steps S1-S4 do not necessarily represent the order between the steps, but the step symbols, and the order between the steps can be adjusted.

[0113] Further referring to Figure 6 , as an implementation of the method shown in the above figures, the present application provides an embodiment of an email delivery evidence taking device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied in various electronic devices.

[0114] The present application embodiment provides an email delivery evidence taking device, which comprises:

[0115] The login module 1 is configured to obtain a sender's email and a corresponding third-party login authorization code, and log in to the sender's email based on the third-party login authorization code;

[0116] The evidence taking setting module 2 is configured to set the evidence taking configuration, which includes the evidence taking mailbox, the evidence taking time, the evidence taking mode, the evidence taking content and / or the evidence taking result, and the evidence taking mailbox is the sender's email to be taken evidence of;

[0117] The evidence taking and storing module 3 is configured to complete the email sending process on the evidence taking mailbox in the way of user agent based on the email protocol, and extract the evidence taking content of the email according to the evidence taking configuration after the email sending is completed, and generate the storing ID and the evidence taking result, the evidence taking content includes the metadata file, and the evidence taking result includes the original file and the storing log file, and the sub-feature values corresponding to the email are calculated by using at least two different hash algorithms respectively, the sub-feature values include at least two hash values of the original file, at least two hash values of the metadata file and at least two hash values of the storing log file, a first root feature value is calculated according to the sub-feature values corresponding to the email, the storing ID corresponds to the first root feature value one by one, and the storing ID and the corresponding first root feature value are uploaded to the storing alliance chain;

[0118] The verification module 4 is configured to obtain the storing ID, the original file, the metadata file and the storing log file of the email to be verified by the sender and / or the receiver in the verification process, and the sub-feature values corresponding to the email to be verified are calculated by using at least two different hash algorithms respectively, a second root feature value is calculated according to the sub-feature values corresponding to the email to be verified, the corresponding first root feature value is extracted in the storing alliance chain according to the storing ID, and the verification is performed with the second root feature value, if the verification is passed, it is determined that the email to be verified has been delivered and the email content has not been tampered with, otherwise it is determined that the email content or the metadata of the email to be verified has been tampered with or the email to be verified has not been stored.

[0119] Figure 7A hardware structure schematic diagram of an electronic device provided by the embodiment of the present application is shown in the figure. Figure 6 The electronic device of the embodiment includes a processor 701 and a memory 702, wherein the memory 702 is used for storing computer execution instructions, and the processor 701 is used for executing the computer execution instructions stored in the memory to realize each step performed by the electronic device in the above embodiment. For details, please refer to the related description in the foregoing method embodiment.

[0120] Optionally, the memory 702 can be independent or integrated with the processor 701.

[0121] When the memory 702 is independently arranged, the electronic device further includes a bus 703 for connecting the memory 702 and the processor 701.

[0122] The embodiment of the present application further provides a computer storage medium, and the computer storage medium stores computer execution instructions. When the processor executes the computer execution instructions, the method described above is realized.

[0123] The embodiment of the present application further provides a computer program product, and the computer program product includes a computer program. When the computer program is executed by the processor, the method described above is realized.

[0124] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the modules is only a logical function division. There can be another division manner in actual implementation, for example, a plurality of modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the modules shown or discussed can be indirect coupling or communication connection through some interfaces, devices or modules, and can be electrical, mechanical or in other forms.

[0125] The modules illustrated as separate components can or can not be physically separate, and the components illustrated as modules can or can not be physical units, i.e. can be located in one place, or can be distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to implement the embodiment scheme.

[0126] In addition, each functional module in each embodiment of the present application can be integrated in one processing unit, or each module can be physically present independently, or two or more modules can be integrated in one unit. The unit formed by the above modules can be realized in the form of hardware, or in the form of hardware plus software function unit.

[0127] The integrated modules realized in the form of software function modules can be stored in a computer readable storage medium. The software function modules are stored in a storage medium and include a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute part of the steps of the method of each embodiment of the present application.

[0128] It should be understood that the processor described above can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0129] The memory can include a high-speed RAM memory, and can also include a non-volatile storage NVM, for example at least one disk memory, and can also be a U disk, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0130] The bus can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0131] The storage medium described above can be realized by any type of volatile or non-volatile storage device or their combination, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0132] An exemplary storage medium is coupled to the processor such that the processor can read information from, and can write information to, the storage medium. Of course, the storage medium can be a part of the processor. Consistent with the teachings provided herein, the processor and the storage medium can be implemented as a system-on-a-chip (SOC) where the processor and the storage medium are integrated into a single chip or as part of a system on package (SOP) where the processor and the storage medium are integrated on the same package. Alternatively, the processor and the storage medium can be implemented as discrete components in a system or host device.

[0133] Those skilled in the art can understand that all or part of the steps of the methods disclosed above can be completed by a program instructing relevant hardware. The foregoing program can be stored in a computer readable storage medium. When the program is executed, the steps of the methods disclosed above are performed; and the foregoing storage medium includes various media that can store program codes, such as ROM, RAM, magnetic disk, or optical disk.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit the present application; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some or all of the technical features can be replaced by equivalent replacements; and these modifications or replacements do not cause the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. An email delivery forensics method, characterized by, The method comprises the following steps: obtaining a sender's electronic mailbox and a corresponding third-party login authorization code, and logging in the sender's electronic mailbox based on the third-party login authorization code; setting a forensic configuration, the forensic configuration comprising a forensic mailbox, a forensic time, a forensic mode, a forensic content and / or a forensic result, the forensic mailbox being the sender's electronic mailbox to be forensically investigated; completing an electronic mail sending process on the forensic mailbox in a user agent manner based on a mail protocol, extracting the forensic content of the electronic mail according to the forensic configuration after the completion of the electronic mail sending, and generating a storage ID and a forensic result, the forensic content comprising a metadata file, the forensic result comprising an original file and a storage log file, each of the original file, the metadata file and the storage log file being calculated by at least two different hash algorithms to obtain a corresponding sub-feature value of the electronic mail, the sub-feature value comprising a main feature value of the original file, an auxiliary feature value of the metadata file and an auxiliary feature value of the storage log file, each of the main feature value and the auxiliary feature value comprising hash values of at least two different hash algorithms, a first root feature value being calculated by a hash algorithm according to each sub-feature value of the electronic mail, the storage ID corresponding to the first root feature value, and the storage ID and the corresponding first root feature value being uploaded to a storage alliance chain; in a verification process, the storage ID, the original file, the metadata file and the storage log file of the electronic mail to be verified being obtained by the sender and / or the receiver, each of the original file, the metadata file and the storage log file being calculated by at least two different hash algorithms to obtain a corresponding sub-feature value of the electronic mail to be verified, a second root feature value being calculated by a hash algorithm according to each sub-feature value of the electronic mail to be verified, the corresponding first root feature value being extracted from the storage alliance chain according to the storage ID, and being verified with the second root feature value, if the verification is passed, it is determined that the electronic mail to be verified has been delivered and the mail content has not been tampered with, otherwise it is determined that the mail content or the metadata of the electronic mail to be verified has been tampered with or the electronic mail to be verified has not been stored.

2. The method of claim 1, wherein, The forensic time is a time interval for searching and extracting a new mail once, the forensic mode is a single forensic mode or a batch forensic mode based on a screening condition, and the forensic content further comprises a mail type and a mail content.

3. The method of claim 1, wherein, The original file adopts an EML electronic mail file format, and the storage log file adopts a txt file format, comprising a forensic name, a forensic mailbox, a forensic configuration, a forensic environment, a forensic time, a storage time, a size of the original file, at least two hash values of the original file of the electronic mail and at least two hash values of the metadata file.

4. The method of claim 1, wherein, The electronic mail sending process on the forensic mailbox in the user agent manner based on the mail protocol specifically comprises: the sender calling a user agent to edit an electronic mail to be sent and selecting to send, and the user agent sending the electronic mail to a mail server of the sender through an SMTP protocol; The mail server of the sender stores the email sent by the user agent in a mail cache queue, and establishes a TCP connection between the mail server of the sender and the mail server of the receiver, and then sends the email in the mail cache queue to the mail server of the receiver; The mail server of the receiver stores the email in the mailbox of the receiver for the receiver to read the email.

5. The method of claim 1, wherein, The nodes in the evidence storage alliance chain include a mail operation service provider, a judicial authentication center, a notary office, a third-party evidence storage system, and a judicial agency, and the evidence storage ID and the corresponding first root characteristic value are synchronously stored in each node in the evidence storage alliance chain.

6. An apparatus for email delivery forensics, comprising: Comprise: A login module configured to obtain a sender's email address and a corresponding third-party login authorization code, and log in to the sender's email based on the third-party login authorization code; An evidence setting module configured to set evidence configuration, the evidence configuration including an evidence mailbox, an evidence time, an evidence mode, an evidence content, and / or an evidence result, the evidence mailbox being the sender's email to be taken as evidence; An evidence storage module configured to complete the email sending process on the evidence mailbox in the manner of a user agent based on a mail protocol, and extract the evidence content of the email according to the evidence configuration after the email sending is completed, and generate an evidence storage ID and an evidence result, the evidence content including a metadata file, the evidence result including an original file and an evidence storage log file, each being calculated by at least two different hash algorithms to obtain a corresponding sub-characteristic value of the email, the sub-characteristic value including a main characteristic value of the original file, an auxiliary characteristic value of the metadata file, and an auxiliary characteristic value of the evidence storage log file, each of the main characteristic value and the auxiliary characteristic value including hash values of at least two different hash algorithms, a first root characteristic value being calculated by a hash algorithm according to each sub-characteristic value corresponding to the email, the evidence storage ID corresponding to the first root characteristic value, and the evidence storage ID and the corresponding first root characteristic value being uploaded to an evidence storage alliance chain; A verification module configured to, in a verification process, obtain the evidence storage ID, the original file, the metadata file, and the evidence storage log file of the email to be verified by the sender and / or the receiver, each being calculated by at least two different hash algorithms to obtain a sub-characteristic value corresponding to the email to be verified, a second root characteristic value being calculated by a hash algorithm according to each sub-characteristic value corresponding to the email to be verified, the first root characteristic value corresponding to the evidence storage ID being extracted from the evidence storage alliance chain, and being verified with the second root characteristic value, if the verification is passed, it is determined that the email to be verified has been delivered and the email content has not been tampered with, otherwise it is determined that the email content or metadata of the email to be verified has been tampered with or the email to be verified has not been stored.

7. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement a method as claimed in any of claims 1-5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program, which when executed by a processor, implements a method as claimed in any of claims 1-5.

9. A computer program product comprising a computer program, characterized in that, The computer program, which when executed by a processor, implements a method as claimed in any of claims 1-5.

Images