Mail processing method, program product, storage medium and equipment

Abstract

The invention provides a mail processing method, a program product, a storage medium and a device, in the method, an Nginx proxy server is deployed in a gateway device, when a mail sent by a client passes through the gateway device, the mail is intercepted by the Nginx proxy server, the gateway device extracts mail content information from the mail and carries out sensitive data detection on the mail content information, and the mail content information is sent to the client through the Nginx proxy server. And when detecting that the mail content information does not contain the sensitive data, the Nginx proxy server sends the mail content information to a mailbox server in a proxy manner, and when detecting that the mail content information contains the sensitive data, the Nginx proxy server constructs an interaction ending message, sends the interaction ending message to the client and ends the proxy. Therefore, the mailbox server does not receive the mail containing the sensitive data, the sensitive data is effectively prevented from being leaked, and the security of mail information is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an email processing method, program product, storage medium and device. Background Art

[0002] In the daily work of enterprise users, the mailbox system plays a vital role. It is not only a bridge for internal communication and collaboration, but also a key channel for exchanging information with external customers and partners. However, with the increasingly complex and changeable network environment, the mailbox system is facing security challenges from weak passwords, OA phishing, spam and virus emails. These challenges threaten the information security of enterprises. Therefore, it is particularly important to provide a solution that can protect email security. Summary of the invention

[0003] The purpose of this application is to provide an email processing method, program product, storage medium and device, aiming to solve the problem of low security of email information existing in related technologies.

[0004] In the first aspect, the present application provides an email processing method, which is applied to a gateway device; an Nginx proxy server is deployed on the gateway device; the method includes: intercepting emails sent by a client through the Nginx proxy server, and extracting email content information from the email; performing sensitive data detection on the email content information; if it is detected that the email content information does not contain sensitive data, the email content information is sent to a mailbox server through the Nginx proxy server; if it is detected that the email content information contains sensitive data, an interaction end message is constructed through the Nginx proxy server, the interaction end message is sent to the client and the proxy is ended.

[0005] In the above implementation process, an Nginx proxy server is deployed in the gateway device. When the email sent by the client passes through the gateway device, the email will be intercepted by the Nginx proxy server. The gateway device extracts the email content information from the email and performs sensitive data detection on it. When it is detected that the email content information does not contain sensitive data, the Nginx proxy server sends the email content information to the mailbox server. When it is detected that the email content information contains sensitive data, the Nginx proxy server constructs an interaction end message, sends the interaction end message to the client and ends the proxy. In this way, the mailbox server will not receive emails containing sensitive data, effectively preventing the leakage of sensitive data and improving the security of email information.

[0006] Furthermore, in some embodiments, before intercepting the email sent by the client through the Nginx proxy server, it includes: updating the configuration file of the Nginx proxy server according to the port information of the mailbox server, and then starting the Nginx proxy server.

[0007] In the above implementation process, the configuration file of the Nginx proxy server is updated according to the port information of the mailbox server, and then the Nginx proxy server is started to make the changes take effect, thereby realizing the monitoring and capture of the mail port data.

[0008] Further, in some embodiments, extracting the email content information from the email includes: matching a start flag field in the email according to the SMTP email protocol; if the start flag field is matched, continuing to match the end flag field in the email, and extracting the email content information based on the matching result; if the start flag field is not matched, sending the email agent to the mailbox server.

[0009] In the above implementation process, the intercepted emails are parsed in combination with the format and regulations of the SMTP email protocol to obtain complete email data, laying a good foundation for the subsequent steps of checking sensitive data in the emails.

[0010] Furthermore, in some embodiments, after extracting the email content information from the email, the method includes: storing the extracted email content information in a normalized data structure in a target memory; the target memory is the memory requested by the Nginx proxy server.

[0011] In the above implementation process, the extracted email content information is saved in the memory applied for by the Nginx proxy server in a normalized data structure to achieve caching of email information and facilitate subsequent sensitive data detection.

[0012] Furthermore, in some embodiments, the method further includes: if it is detected that the email content information contains sensitive data, writing the email content information in the target memory into a disk in the form of a file.

[0013] In the above implementation process, the gateway device writes the email content of the identified sensitive data email to the disk in the form of a file for subsequent analysis, which helps to trace the source of sensitive data leakage.

[0014] Furthermore, in some embodiments, it also includes: constructing an SMTP message based on the original recipient information and email content in the file in the disk, and reconstructing the first target field in the SMTP message based on the email account of the target user; the first target field is a field for specifying the email recipient; after establishing a connection with the email server, passing the SMTP message to the email server.

[0015] In the above implementation process, the gateway device resends the sensitive data email, constructs an SMTP message according to the email protocol, reconstructs the field used to specify the email recipient in the SMTP message according to the target user's email account, and initiates a new SMTP message interaction with the email server. In this way, the target user will receive the complete sensitive data email, and then determine the original sender and recipient based on the email content. In this way, email recipient redirection is achieved, and security issues can be traced back in a timely manner.

[0016] Further, in some embodiments, constructing an SMTP message based on the original recipient information and email content in the file in the disk includes: reading the original recipient information and email content in the file in the disk; the email content includes the original envelope content and the original body content; modifying the content of the second target field in the original envelope content to the original recipient information, and modifying the content of the third target field in the original envelope content to the email account of the target user; the second target field is a field for specifying the carbon copy recipients of the email; the third target field is a field for specifying the direct recipients of the email; constructing an SMTP message based on the modified envelope content and the original body content.

[0017] In the above implementation process, when the email recipient is redirected, the email information is reconstructed, and the email account of the original recipient is offset to the field in the envelope content for specifying the carbon copy recipients of the email, and the field in the envelope content for specifying the direct recipients of the email is modified to the email account of the added recipient, so that the target user can more clearly understand the sending and receiving information of the email based on the email content, thereby improving the efficiency of tracing the source of leakage of sensitive email data.

[0018] In the second aspect, the present application provides an email processing device, which is applied to a gateway device; an Nginx proxy server is deployed on the gateway device; the device includes: an interception module, which is used to intercept emails sent by a client through the Nginx proxy server and extract email content information from the email; a detection module, which is used to perform sensitive data detection on the email content information; a sending module, which is used to send the email content information to a mailbox server through the Nginx proxy server if it is detected that the email content information does not contain sensitive data, and if it is detected that the email content information contains sensitive data, construct an interaction end message through the Nginx proxy server, send the interaction end message to the client and end the proxy.

[0019] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0021] In a fifth aspect, the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0022] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0023] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of an email processing method provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the architecture of an email security protection system in a sensitive data email interception and recipient redirection solution provided in an embodiment of the present application;

[0027] Figure 3 A block diagram of a mail processing device provided in an embodiment of the present application;

[0028] Figure 4 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0030] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0031] As described in the background art, there is a problem in the related art that the security of email information is low. Based on this, the embodiment of the present application provides an email processing solution to solve the above problem.

[0032] Next, the implementation process of the embodiment of the present application is introduced:

[0033] like Figure 1 As shown, Figure 1 This is a flowchart of an email processing method provided in an embodiment of the present application, and the method is applied to a gateway device; an Nginx proxy server is deployed on the gateway device. The gateway device here refers to a mailbox server gateway device, which is an intermediate device connecting different email servers or networks, and is responsible for receiving, processing, forwarding and filtering emails. The gateway device is deployed at the front end of the email system as the entrance and exit of email traffic. Nginx is a lightweight Web server, reverse proxy server and email proxy server, which is characterized by occupying less memory and having strong concurrency capabilities. In the scheme of this embodiment, an Nginx proxy server is deployed on the mailbox server gateway device, and the efficient proxy characteristics of Nginx are used to implement security protection of emails and prevent sensitive data leakage.

[0034] The method comprises:

[0035] Step 101: intercepting the email sent by the client through the Nginx proxy server, and extracting email content information from the email;

[0036] The client mentioned in this step may refer to an interface or program for a user to interact with a mailbox server, which allows a user to send, receive, and manage emails through a graphical interface or a command line interface. In this embodiment, when the email sent by the client passes through a gateway device deployed with an Nginx proxy server, the data will be captured and not sent to the mailbox server temporarily.

[0037] In some embodiments, before intercepting the email sent by the client through the Nginx proxy server mentioned in this step, it can include: updating the configuration file of the Nginx proxy server according to the port information of the mailbox server, and then starting the Nginx proxy server. That is to say, after the Nginx proxy server is deployed on the gateway device, the configuration file of the Nginx proxy server can be updated according to the port information of the mailbox server, such as the port number, and then the Nginx proxy server is started to make the changes effective. At this time, the Nginx proxy server will monitor the port of the mailbox server and start to receive all data sent to the port. In this way, the monitoring and capture of the mail port data is realized.

[0038] After the Nginx proxy server intercepts the mail, it parses it and extracts the mail content information. The mail content information here may include the mail envelope, subject, body and attachment information. In some embodiments, the extraction of the mail content information from the mail mentioned in this step may include: according to the SMTP mail protocol, matching the start mark field in the mail; if the start mark field is matched, continue to match the end mark field in the mail, and extract the mail content information according to the matching result; if the start mark field is not matched, send the mail proxy to the mailbox server. In other words, considering that the current mailbox system generally uses SMTP (Simple Mail Transfer Protocol) to realize the delivery of mail information, the intercepted mail can be parsed in combination with the format and regulations of the SMTP mail protocol. When implemented, the gateway device searches for the start mark field that complies with the SMTP protocol in the mail, and the start mark field usually includes the start mark of the sender, receiver, mail subject and mail body of the mail; if not found, the proxy sends it to the mailbox server; if found, the mailbox server is not sent for the time being, and the gateway device continues to check the mail to find the mark field indicating the end of the mail content, so as to obtain the complete mail data. This lays a good foundation for the subsequent steps of checking sensitive data in emails.

[0039] In addition, in some embodiments, after extracting the email content information from the email mentioned in this step, the following steps may be included: storing the extracted email content information in a target memory in a normalized data structure; the target memory is the memory requested by the Nginx proxy server. That is, after extracting the email content information, the information may be stored in a normalized data structure in the memory requested by the Nginx proxy server to achieve caching of the email information, facilitating subsequent sensitive data detection.

[0040] In step 102, sensitive data detection is performed on the email content information;

[0041] The sensitive data mentioned in this step may include personal privacy information, business secrets, business operation information, etc. For the email content information stored in the memory, the gateway device can detect sensitive data according to the pre-set detection rules. These detection rules can contain strings and conditions to be matched. During the detection, the corresponding regular expressions can be used for matching, so as to accurately detect whether the email content information contains sensitive data. In addition, the function of performing sensitive data detection on the email content information can be integrated in the Nginx proxy server, or it can be implemented by another process on the gateway device, and this application does not limit this.

[0042] In step 103, if it is detected that the email content information does not contain sensitive data, the email content information is sent to the mailbox server through the Nginx proxy server. If it is detected that the email content information contains sensitive data, an interaction end message is constructed through the Nginx proxy server, and the interaction end message is sent to the client to end the proxy.

[0043] This step means: after performing sensitive data detection on the content information of the email, for emails that do not contain sensitive data, the Nginx proxy server sends its proxy to the mailbox server, so that emails that do not contain key information can be sent and received normally; for sensitive data emails that are identified, the Nginx proxy server constructs an interaction end message, sends the proxy to the client corresponding to the email sender, and ends the proxy, so that the email sender's client displays that the sending is successful, so the sender is unaware, the mailbox server will not receive the email content, and sensitive data will not be leaked, thereby achieving timely interception of sensitive data emails and improving information security. Among them, the interaction process between the Nginx proxy server and the mailbox server and client can refer to the introduction of the Nginx proxy function in the relevant technology, and this application will not be repeated here.

[0044] In some embodiments, the method further includes: if it is detected that the email content information contains sensitive data, writing the email content information in the target memory to the disk in the form of a file. In other words, for the identified sensitive data email, the gateway device can write the complete email content to the disk in the form of a file for subsequent analysis, which helps to trace the source of sensitive data leakage.

[0045] In some embodiments, it also includes: constructing an SMTP message according to the original recipient information and email content in the file in the disk, and reconstructing the first target field in the SMTP message according to the target user's email account; the first target field is a field for specifying the email recipient; after establishing a connection with the email server, the SMTP message is passed to the email server. That is to say, after detecting a sensitive data email, in addition to intercepting the sensitive data email to prevent sensitive data leakage, the gateway device can also send the sensitive data email a second time, construct an SMTP message according to the email protocol, and reconstruct the field in the SMTP message used to specify the email recipient, that is, the "RCPT TO:" field, according to the target user's email account, and initiate a new SMTP message interaction with the email server, so that the target user will receive the complete sensitive data email, and then determine the original sender and recipient according to the email content. In this way, the email recipient redirection is achieved, and security issues can be traced back in time. Among them, the target user can be a person responsible for handling information security, such as an enterprise network security manager, a security operation and maintenance engineer, etc. In addition, the function of redirecting the email recipient can be integrated into the Nginx proxy server, or it can be implemented as another process on the gateway device, and this application does not impose any restrictions on this.

[0046] Further, in some embodiments, the aforementioned construction of an SMTP message based on the original recipient information and email content in the file in the disk may include: reading the original recipient information and email content in the file in the disk; the email content includes the original envelope content and the original body content; modifying the content of the second target field in the original envelope content to the original recipient information, and modifying the content of the third target field in the original envelope content to the email account of the target user; the second target field is a field for specifying the carbon copy recipient of the email; the third target field is a field for specifying the direct recipient of the email; constructing an SMTP message based on the modified envelope content and the original body content. That is, when redirecting the email recipient, the email information can be reconstructed, the email account of the original recipient is offset to the field in the envelope content for specifying the carbon copy recipient of the email, i.e., the "CC:" field, and the field in the envelope content for specifying the direct recipient of the email, i.e., the "TO:" field, is modified to the email account of the added recipient, and the modified envelope content is combined with the original body content to form a new email content. In this way, the target user can more clearly grasp the sending and receiving information of the email based on the content of the email, and improve the efficiency of tracing the source of sensitive email data leakage. In addition, during implementation, the operation of reconstructing the email information can be performed only when non-blind transmission is required.

[0047] In the embodiment of the present application, an Nginx proxy server is deployed in a gateway device. When an email sent by a client passes through the gateway device, the email will be intercepted by the Nginx proxy server. The gateway device extracts the email content information from the email and performs sensitive data detection on it. When it is detected that the email content information does not contain sensitive data, the Nginx proxy server sends the email content information to the mailbox server. When it is detected that the email content information contains sensitive data, the Nginx proxy server constructs an interaction end message, sends the interaction end message to the client and ends the proxy. In this way, the mailbox server will not receive emails containing sensitive data, effectively preventing sensitive data leakage and improving the security of email information.

[0048] In order to explain the solution of this application in more detail, a specific embodiment is introduced below:

[0049] This embodiment provides a sensitive data email interception and recipient redirection solution, which can be applied to the enterprise email service system gateway to prevent sensitive data leakage and trace the source of leakage for the enterprise email system, and provide an efficient email security protection system implementation plan. Figure 2As shown, the email security protection system includes an enterprise mailbox server gateway 21, an email sender client 22 and an enterprise mailbox server 23, wherein an Nginx proxy module 24 and a gateway email sending module 25 are deployed on the enterprise mailbox server gateway 21.

[0050] The specific process of the program includes:

[0051] S201, the enterprise mailbox server gateway 21 starts the Nginx proxy module 24 to transmit the proxy email content; specifically, when the Nginx proxy module 24 is deployed on the enterprise mailbox server gateway 21, the Nginx configuration file can be updated according to the port information of the enterprise mailbox server 23 through methods such as webui configuration, and then the Nginx proxy module 24 is started to monitor and capture the email port data;

[0052] S202, the email sender client 22 sends an email;

[0053] S203, Nginx proxy module 24 extracts and saves the email content; specifically, after the data sent by the email sender client 22 reaches the enterprise mailbox server gateway 21, it is intercepted by the Nginx proxy module 24, and the Nginx proxy module 24 extracts the email envelope, subject, body, and attachment information according to the SMTP email protocol format and regulations, and saves it in the memory applied by Nginx in a normalized data structure, and temporarily does not send it to the enterprise mailbox server 23 as a proxy;

[0054] S204, the Nginx proxy module 24 performs sensitive data detection on the email content stored in the memory;

[0055] S205, the Nginx proxy module 24 determines whether the email content contains sensitive data according to the detection result, and if so, executes S207, otherwise executes S206;

[0056] S206, the Nginx proxy module 24 sends the non-sensitive email proxy to the enterprise mailbox server 23;

[0057] S207, the Nginx proxy module 24 writes the email information in the memory to the disk in the form of a file, and constructs an interaction end message;

[0058] S208, the Nginx proxy module 24 sends the interaction end message to the mail sender client 22;

[0059] S209, the Nginx proxy module 24 disconnects from the corporate mailbox server 23, and ends the proxy;

[0060] S210, the gateway mail sending module 25 obtains the original recipient information and mail content in the sensitive mail file in the disk according to the SMTP mail protocol;

[0061] S211. The gateway mail sending module 25 constructs a new recipient and sends a sensitive data mail to the enterprise mail server 23; specifically, the gateway mail sending module 25 reconstructs the "RCPT TO:" field of the recipient authentication interaction message, adds the email account of the recipient to be added, and deletes the email account of the original recipient. For example, if the recipient to be added is an enterprise network security manager, and his email account is "example@mail.com", the gateway mail sending module 25 will send the mail content in the protocol format of "RCPT TO: example@mail.com", and other recipients will not be able to see the user; if non-blind mailing is required, the gateway mail sending module 25 modifies the original envelope content, offsets it to the "TO:" field or the "CC:" field in the envelope, adds the recipient account, and sends it with the original text content.

[0062] This embodiment scheme, through the combination of Nginx proxy and SMTP protocol parsing technology, can provide efficient security protection for the mail system, intercept illegal mails, prevent the leakage of sensitive data within the enterprise, and at the same time re-blind or copy the leaked source mail to the designated recipient, helping the enterprise to trace the security issues in time.

[0063] Corresponding to the embodiments of the aforementioned method, the present application also provides embodiments of a mail processing device and a terminal using the same:

[0064] like Figure 3 As shown, Figure 3 : is a block diagram of a mail processing device provided in an embodiment of the present application, the device is applied to a gateway device; an Nginx proxy server is deployed on the gateway device; the device includes:

[0065] The interception module 31 is used to intercept the email sent by the client through the Nginx proxy server and extract the email content information from the email;

[0066] A detection module 32, used to perform sensitive data detection on the email content information;

[0067] The sending module 33 is used to send the email content information to the mailbox server through the Nginx proxy server if it is detected that the email content information does not contain sensitive data; if it is detected that the email content information contains sensitive data, the Nginx proxy server constructs an interaction end message, sends the interaction end message to the client and ends the proxy.

[0068] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0069] This application also provides an electronic device, see Figure 4 , Figure 4 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 410, a communication interface 420, a memory 430, and at least one communication bus 440. The communication bus 440 is used to realize direct connection and communication between these components. The communication interface 420 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 410 may be an integrated circuit chip with signal processing capabilities.

[0070] The processor 410 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The processor 410 may be a microprocessor, or the processor 410 may be any conventional processor, etc.

[0071] The memory 430 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 430 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 410, the electronic device can execute the above-mentioned Figure 1 The method embodiment involves various steps.

[0072] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0073] The memory 430, storage controller, processor 410, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 440. The processor 410 is used to execute executable modules stored in the memory 430, such as software function modules or computer programs included in the electronic device.

[0074] The input and output unit is used to provide users with the task creation and to create a start optional time period or preset execution time for the task to realize the interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0075] Understandably, Figure 4 The structure shown is for illustration only, and the electronic device may also include Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown. Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0076] An embodiment of the present application further provides a storage medium having instructions stored thereon. When the instructions are run on a computer, the computer program is executed by a processor to implement the method described in the method embodiment. To avoid repetition, the method will not be described here.

[0077] The present application also provides a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0078] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0079] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0080] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0081] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0083] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A mail processing method, characterized in that: Applied to gateway devices; The gateway device is deployed with an Nginx proxy server; the method comprises: Intercepting emails sent by the client through the Nginx proxy server, and extracting email content information from the emails; Performing sensitive data detection on the email content information; If it is detected that the email content information does not contain sensitive data, the email content information is sent to the mailbox server through the Nginx proxy server. If it is detected that the email content information contains sensitive data, an interaction end message is constructed through the Nginx proxy server, and the interaction end message is sent to the client to end the proxy.

2. The method according to claim 1, characterized in that Before intercepting the email sent by the client through the Nginx proxy server, it includes: According to the port information of the mailbox server, the configuration file of the Nginx proxy server is updated, and then the Nginx proxy server is started.

3. The method according to claim 1, characterized in that The extracting the email content information from the email includes: According to the SMTP mail protocol, matching a start flag field in the mail; If the start mark field is matched, continue to match the end mark field in the email, and extract the email content information according to the matching result; If the start flag field cannot be matched, the mail proxy is sent to the mailbox server.

4. The method according to claim 1, characterized in that: After extracting the email content information from the email, the method includes: The extracted email content information is stored in a target memory in a normalized data structure; the target memory is the memory requested by the Nginx proxy server.

5. The method according to claim 4, characterized in that Also includes: If it is detected that the email content information contains sensitive data, the email content information in the target memory is written to the disk in the form of a file.

6. The method according to claim 5, characterized in that Also includes: Constructing an SMTP message according to the original recipient information and email content in the file on the disk, and reconstructing the first target field in the SMTP message according to the email account of the target user; The first target field is a field used to specify a mail recipient; After establishing a connection with the mailbox server, the SMTP message is delivered to the mailbox server.

7. The method according to claim 6, characterized in that The step of constructing an SMTP message according to the original recipient information and email content in the file on the disk includes: Reading the original recipient information and email content in the file in the disk; the email content includes the original envelope content and the original text content; Modify the content of the second target field in the original envelope content to the original recipient information, and modify the content of the third target field in the original envelope content to the email account of the target user; the second target field is a field for specifying the carbon copy recipient of the email; the third target field is a field for specifying the direct recipient of the email; An SMTP message is constructed according to the modified envelope content and the original body content.

8. A computer program product, characterized in that When the computer program product is executed on a computer, the computer is enabled to perform the method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images