Access control method and isolation device for POP3 mail protocol
By performing access control and content filtering on the POP3 mail protocol on the isolation control device, the problem that the POP3 mail protocol cannot be actively securely controlled is solved, and in-depth analysis and policy filtering of mail content is realized, which enhances security.
Patent Information
- Application Number
- CN202411690658.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-03-11
AI Technical Summary
In the prior art, the POP3 mail protocol cannot actively control security, resulting in the possibility of obtaining emails containing viruses or malicious files, causing security risks.
By adding new policy control to the isolation control device, access control is carried out on the POP3 mail protocol, mail received by the client from the POP3 mail server, and parsing and filtering the mail content according to the preset access control policy to ensure that only legitimate mail is delivered.
Effectively prevent the invasion of viral emails and malicious programs, enhance the security of personal terminal machines and enterprise content data, and realize active defense rather than just relying on passive isolation.
Smart Images
Figure CN119603022A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and in particular to an access control method and an isolation device for a POP3 mail protocol. Background Art
[0002] The current mail acquisition protocol is mainly the POP3 protocol. The POP3 protocol is a very simple and limited mail reading protocol that can send mails from the mail server to the personal terminal machine. In this process, there is no protocol regulation on the content of the mail. For the security of data, most companies install isolation cards, isolation control and other equipment to divide the company into two networks: the intranet and the extranet. The intranet is used for internal office automation, and the extranet is used to publish information to the outside world, obtain instant messages on the Internet, and communicate information by email. The internal part of the company communicates with the outside world through email. However, when the intranet actively obtains mail information from the extranet through the POP3 mail protocol, it may obtain mails containing viruses or malicious files, causing certain security risks. Summary of the invention
[0003] In view of the problems existing in the prior art, a method and an isolation device for access control of the POP3 mail protocol are provided. By adding a policy control method to the POP3 mail protocol on the basis of the isolation control device, the problem that the POP3 mail protocol cannot perform active security control is solved, thereby enhancing the security of personal terminal machines and enterprise content data.
[0004] The first aspect of the present invention provides an access control method for the POP3 mail protocol, which is applied to an isolation device between a client and a POP3 mail server, comprising:
[0005] Send access requests initiated by clients to the POP3 mail server according to the preset access control policy, and receive mails sent by the POP3 mail server;
[0006] Monitor and cache the emails received by the client from the POP3 mail server, parse and filter the email content according to the access control policy, and deliver the legitimate emails to the client.
[0007] As a preferred solution, the access control strategy includes:
[0008] Legal user list: used to specify users and IP addresses that are allowed to access the POP3 mail server;
[0009] Mail access permissions: used to specify whether to allow users to obtain all mails, or restrict access to certain mails;
[0010] Email content filtering rules: used to filter email subject, sender, recipient, and attachments;
[0011] Time limit: used to control the time of access to the mail server.
[0012] As a preferred solution, the sending of the client-initiated request to the POP3 mail server according to the preset access control policy specifically includes:
[0013] Determine whether the user is allowed to access the POP3 mail server based on the IP address and user name of the user logged in in the client. If allowed, forward the request to the POP3 mail server, otherwise send an error message to the client;
[0014] Determine whether the time when the client user initiates the access is a legal time in the access control policy. If so, forward the request to the POP3 mail server, otherwise send an error message to the client;
[0015] Determine whether to prohibit the acquisition of all mails. If so, send an error message to the client; otherwise, forward the request to the POP3 mail server.
[0016] As a preferred solution, the method of monitoring and caching the mails received by the client from the POP3 mail server, parsing and filtering the mail contents according to the access control policy, and delivering the legal mails to the client specifically includes:
[0017] After listening to the request of the mail client to obtain the mail content, the mail content obtained from the POP3 mail server is cached locally until all the mails are received;
[0018] Then, according to the access control policy, the email content is parsed and filtered. If the email content passes all policy checks, the complete email will be delivered to the user terminal; otherwise, the email will be ignored and will not be delivered to the terminal user.
[0019] As a preferred solution, the parsing and filtering of the email content specifically includes:
[0020] Parse the header information of the acquired POP3 mail protocol message to determine whether it is a legal message;
[0021] Parse the email body and attachments, extract the data information and compare it with the preset strategy to determine whether it is legal.
[0022] As a preferred solution, the parsing of the header information of the acquired POP3 mail protocol message specifically includes:
[0023] The recipient's email address and / or the sender's email address are matched with the legal email list in the access control policy. A successful match indicates that the email is a legal email. The email subject content is filtered according to the illegal subject keywords in the access policy.
[0024] As a preferred solution, the parsing of the email body and attachments specifically includes:
[0025] By checking the size, type and content of the attachment, we can determine whether there are any security risks. For text attachments, we will perform keyword matching on their content and filter out email attachments with illegal or sensitive words. For attachments that exceed the predefined size limit, we will directly refuse to receive them.
[0026] The second aspect of the present invention proposes an isolation device, which is arranged between an intranet and an extranet. It sends an access request initiated by a client to a POP3 mail server according to a preset access control policy, and receives mails sent by the POP3 mail server; it monitors and caches mails received by the client from the POP3 mail server, and parses and filters the mail content according to the access control policy, and delivers legal mails to the client.
[0027] As a preferred solution, the access control strategy includes:
[0028] Legal user list: used to specify users and IP addresses that are allowed to access the POP3 mail server;
[0029] Mail access permissions: used to specify whether to allow users to obtain all mails, or restrict access to certain mails;
[0030] Email content filtering rules: used to filter email subject, sender, recipient, and attachments;
[0031] Time limit: used to control the time of access to the mail server.
[0032] Compared with the prior art, the beneficial effects of adopting the above technical solution are:
[0033] The present invention solves the problem of insufficient protection of the isolation control device against mails, and filters mails directly on the isolation control device, which is transparent to the user, easy to use, and does not affect the operation of the mail client. Compared with the existing solutions, the present invention has the following significant advantages:
[0034] Active defense: Through in-depth analysis and policy filtering of email content, it can effectively prevent the intrusion of virus emails and malicious programs, and achieve active defense instead of just relying on passive isolation.
[0035] Transparency: When users use the POP3 mail client, the entire filtering process is completely transparent to the users and will not affect their normal operating experience.
[0036] Flexibility: Administrators can flexibly add, modify, and delete access control policies based on the enterprise's security needs, enhancing the adaptability of the system.
[0037] Efficiency: The cache mechanism ensures the efficiency of the system and will not affect the email transmission speed due to email filtering operations. BRIEF DESCRIPTION OF THE DRAWINGS
[0038] Figure 1 This is a flow chart of the access control method for the POP3 mail protocol proposed by the present invention.
[0039] Figure 2 The figure is a schematic diagram of the isolation device in one embodiment of the present invention. DETAILED DESCRIPTION
[0040] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar modules or modules with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be construed as limitations on the present application. On the contrary, the embodiments of the present application include all changes, modifications and equivalents that fall within the spirit and connotation of the appended claims.
[0041] In order to solve the problem that the POP3 mail protocol cannot be actively controlled for security, an embodiment of the present invention proposes an access control method for the POP3 mail protocol, which is applied to an isolation device between a client and a POP3 mail server, wherein the POP3 mail server is located in an external network and the client is located in an internal network. Figure 1 , the specific plan is as follows:
[0042] Step 1: Send the access request initiated by the client to the POP3 mail server according to the preset access control policy, and receive the mail sent by the POP3 mail server.
[0043] In this embodiment, the main control of email security is mainly achieved through the isolation device. In actual application, an access control policy will be set in advance, wherein the access control policy may include:
[0044] Legal user list: used to specify users and IP addresses that are allowed to access the POP3 mail server;
[0045] Mail access permissions: used to specify whether to allow users to obtain all mails, or restrict access to certain mails;
[0046] Email content filtering rules: used to filter email subject, sender, recipient, and attachments;
[0047] Time limit: used to control the time of access to the mail server.
[0048] It should be noted that the above strategy is only used as a reference example and can be adjusted as needed in actual applications.
[0049] When the isolation device is started, it will parse the access control policy, and then control it according to the parsed policy. When the client wants to initiate a POP3 mail server access request, the isolation device determines whether the user is allowed to access the POP3 mail server based on the IP address and user name of the user logged in in the client. If allowed, the request will be forwarded to the POP3 mail server, otherwise an error message will be sent to the client.
[0050] Furthermore, the isolation device also determines whether the time when the client user initiates the access is a legal time in the access control policy. If so, the request is forwarded to the POP3 mail server, otherwise an error message is sent to the client.
[0051] In addition, the isolation device also determines whether to prohibit the acquisition of all mails. If so, an error message is sent to the client; otherwise, the request is forwarded to the POP3 mail server.
[0052] It should be noted that if any one of the access control policies is not satisfied, the client is prohibited from initiating a request to the POP3 mail server.
[0053] In one embodiment, the isolation device can initialize a TCP server on the external network to listen to the POP3 mail synchronization connection request from the mail client. Upon receiving the connection request from the mail client, it creates a client thread for communicating with the mail client; at the same time, it initializes the communication channel with the high-speed data transmission module for high-speed data transmission; and binds the client thread to the communication channel.
[0054] Step 2: Monitor and cache the emails received by the client from the POP3 mail server, parse and filter the email content according to the access control policy, and deliver the legitimate emails to the client.
[0055] After sending the access request to the POP3 mail server, the mail sent by the POP3 mail server will continue to be received. The isolation device will continue to cache the mail content obtained from the POP3 mail server locally until all mails are received. After the mail is completely received and cached, the mail content is parsed and filtered according to the access control policy. If the mail content passes all policy checks, the complete mail will be delivered to the user terminal; if the mail does not meet the policy requirements, it will be ignored and will not be delivered to the terminal user.
[0056] In this embodiment, a process of parsing and filtering the email content is also specifically provided, specifically:
[0057] (1) Parse the header information of the acquired POP3 mail protocol message to determine whether it is a legal message. Match the recipient's mail address and / or the sender's mail address with the legal mail list in the access policy; filter the mail subject content according to the illegal subject keywords in the access policy.
[0058] (2) Parse the email body and attachments, extract the data information therein and compare it with the preset strategy to determine whether it is legal. By checking the size, type and content of the attachment, determine whether there are security risks. In particular, for text attachments, keyword matching will be performed on their content to filter out email attachments with illegal or sensitive words. Attachments that exceed the predefined size limit will be directly rejected to prevent large file viruses or malicious programs from spreading through emails. The present invention is not only based on traditional file type restrictions (such as exe, bat, etc.), but can also analyze the actual content of the attachment in real time to identify disguised files. For example, an attachment that appears to be a PDF file may contain malicious code. By comparing the file header and the actual byte stream, this type of attack can be accurately identified.
[0059] The embodiment of the present invention also provides an isolation device that can execute the aforementioned access control method for the POP3 mail protocol. Figure 2 Specifically, the isolation device is set between the intranet and the extranet, and sends the access request initiated by the client to the POP3 mail server according to the preset access control policy, and receives the mails sent by the POP3 mail server; monitors and caches the mails received by the client from the POP3 mail server, and parses and filters the mail content according to the access control policy, and delivers the legal mails to the client.
[0060] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program includes a program code for executing the method shown in the flowchart.
[0061] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.
[0062] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0063] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.
[0064] As another aspect, the present application also provides a computer program product or a computer program, the computer program product or the computer program includes a computer instruction, the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the access control method for the POP3 mail protocol described in the above embodiment.
[0065] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the access control method for the POP3 mail protocol described in the above embodiment.
[0066] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.
[0067] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.
[0068] For those skilled in the art, the specific meanings of the above terms in the present invention can be understood in specific situations; the drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.
[0069] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.
Claims
1. A method for controlling access to the POP3 mail protocol, characterized in that: Applied in the isolation device between the client and the POP3 mail server, including: Send access requests initiated by clients to the POP3 mail server according to the preset access control policy, and receive mails sent by the POP3 mail server; Monitor and cache the emails received by the client from the POP3 mail server, parse and filter the email content according to the access control policy, and deliver the legitimate emails to the client.
2. The access control method for the POP3 mail protocol according to claim 1, characterized in that: The access control strategy includes: Legal user list: used to specify users and IP addresses that are allowed to access the POP3 mail server; Mail access permissions: used to specify whether to allow users to obtain all mails, or restrict access to certain mails; Email content filtering rules: used to filter email subject, sender, recipient, and attachments; Time limit: used to control the time of access to the mail server.
3. The access control method for the POP3 mail protocol according to claim 1 or 2, characterized in that: The step of sending the client-initiated request to the POP3 mail server according to the preset access control policy specifically includes: Determine whether the user is allowed to access the POP3 mail server based on the IP address and user name of the user logged in in the client. If allowed, forward the request to the POP3 mail server, otherwise send an error message to the client; Determine whether the time when the client user initiates the access is a legal time in the access control policy. If so, forward the request to the POP3 mail server, otherwise send an error message to the client; Determine whether to prohibit the acquisition of all mails. If so, send an error message to the client; otherwise, forward the request to the POP3 mail server.
4. The access control method for the POP3 mail protocol according to claim 1, characterized in that: The monitoring and caching of emails received by the client from the POP3 mail server, parsing and filtering the email content according to the access control policy, and delivering the legitimate emails to the client specifically includes: After listening to the request of the mail client to obtain the mail content, the mail content obtained from the POP3 mail server is cached locally until all the mails are received; Then, according to the access control policy, the email content is parsed and filtered. If the email content passes all policy checks, the complete email will be delivered to the user terminal; otherwise, the email will be ignored and will not be delivered to the terminal user.
5. The access control method for the POP3 mail protocol according to claim 1, characterized in that: The parsing and filtering of the email content specifically includes: Parse the header information of the acquired POP3 mail protocol message to determine whether it is a legal message; Parse the email body and attachments, extract the data information and compare it with the preset strategy to determine whether it is legal.
6. The access control method for the POP3 mail protocol according to claim 5, characterized in that: The parsing of the header information of the acquired POP3 mail protocol message specifically includes: The recipient's email address and / or the sender's email address are matched with the legal email list in the access control policy. A successful match indicates that the email is a legal email. The email subject content is filtered according to the illegal subject keywords in the access policy.
7. The access control method for the POP3 mail protocol according to claim 5, characterized in that: The parsing of the email body and attachments specifically includes: By checking the size, type and content of the attachment, we can determine whether there are any security risks. For text attachments, we will perform keyword matching on their content and filter out email attachments with illegal or sensitive words. For attachments that exceed the predefined size limit, we will directly refuse to receive them.
8. An isolation device, characterized in that: Set up between the intranet and the extranet, send the access request initiated by the client to the POP3 mail server according to the preset access control policy, and receive the mails sent by the POP3 mail server; Monitor and cache the emails received by the client from the POP3 mail server, parse and filter the email content according to the access control policy, and deliver the legitimate emails to the client.
9. The isolation device according to claim 8, characterized in that The access control strategy includes: Legal user list: used to specify users and IP addresses that are allowed to access the POP3 mail server; Mail access permissions: used to specify whether to allow users to obtain all mails, or restrict access to certain mails; Email content filtering rules: used to filter email subject, sender, recipient, and attachments; Time limit: used to control the time of access to the mail server.