relay device

Abstract

The present invention provides a relay device that assesses a user's ability to cope with attack emails under desired stressful conditions. [Solution] The relay device 10 includes a relay circuit 13 that relays a user terminal 20 connected via LAN to the communication network, and a control circuit 15 that monitors and controls data communication between the user terminal 20 and the communication network. The control circuit 15 includes a mail monitoring unit 15A that monitors received mail sent back from the mail server 30 in response to a mail reception request from the target user terminal of the target user and detects training mail for training against malicious attack mail, and a training control unit 15B that, in response to the detection of training mail, compares the stress status of the target user obtained from the biometric information of the target user with the training implementation conditions, relays all received mail including training mail to the target user terminal if the stress status matches the training implementation conditions, and relays received mail other than training mail to the target user terminal if it does not match.

Description

Technical Field

[0001] The present invention relates to a security countermeasure technology for training a user to correctly handle attack emails based on training emails that mimic malicious attack emails.

Background Art

[0002] In recent years, damage caused by malicious malware that uses emails as an infection route has been increasing rapidly. For example, according to "Emotet," which infects just by clicking and opening an attached file in a targeted attack email, not only email data registered on the user terminal but also important personal information including authentication information such as IDs and passwords is said to be leaked. Therefore, if such malware infection occurs, new attack emails are generated based on the leaked email data and the infection spreads to other users, confidential information is stolen by accessing the internal network based on the leaked authentication information, or it leads to extremely large damage such as infection with malicious programs typified by "Ransomware" that demands a ransom. Therefore, it is important to correctly handle attack emails, and users are required to master correct handling from day to day.

[0003] Conventionally, as a technology for grasping the user's correct handling ability for such attack emails, Patent Document 1 proposes a training device for training correct handling of attack emails that generates training emails that mimic malicious attack emails based on a preset template, transmits them to a user to be trained via a mail server, and detects that the user has received the training email on the user terminal and opened the attached file attached to the training email. Thereby, the user's correct handling ability for attack emails can be grasped, and it can be reflected in efforts to raise the user's security awareness and in improving the security literacy of the entire organization to which the user belongs.

Prior Art Documents

Patent Documents

[0004] [Patent Document 1] Japanese Patent Publication No. 2013-149063 [Overview of the project] [Problems that the invention aims to solve]

[0005] When users actually receive an attack email, their response will vary depending on the circumstances under which they receive it. For example, if a user is under low stress and has peace of mind, their security awareness regarding opening attachments is relatively high. However, if they are under high stress and have little peace of mind, their security awareness decreases, and they tend to open attachments carelessly. Therefore, the timing of sending training emails will affect users' ability to respond.

[0006] According to the conventional technology described above, while it is possible to arbitrarily adjust the date, time, and number of training emails sent, it is not possible to determine the timing of sending training emails according to the stress level of the users being trained. As a result, variations in users' response capabilities arise due to changes in their stress levels, and there is a problem in that it is not possible to accurately grasp the users' response capabilities.

[0007] This invention aims to solve these problems and provide security measures that can accurately grasp a user's ability to deal with attack emails under desired stressful conditions. [Means for solving the problem]

[0008] To achieve this objective, the relay device according to the present invention comprises a relay circuit configured to relay user terminals connected to it via a LAN to a communication network, and a control circuit configured to monitor and control data communication between the user terminals and the communication network via the relay circuit, wherein the control circuit comprises a mail monitoring unit configured to monitor received mail sent back to the target user terminal from a mail server on the communication network in response to a mail reception request from the target user terminal of the target user, and to detect training mail for training against malicious attack mail containing malware among the received mail, and a training control unit configured to compare the stress status of the target user obtained from the biometric information of the target user sequentially collected from the target user terminal with preset training conditions in response to the detection of the training mail by the mail monitoring unit, and relay forwards all of the received mail, including the training mail, to the target user terminal if the stress status matches the training conditions, and relay forwards all of the received mail, including the training mail, to the target user terminal if the stress status does not match the training conditions.

[0009] Furthermore, in one example of the configuration of the relay device according to the present invention, the user terminal is configured to acquire biometric information from the user of the user terminal and transmit it sequentially to the biometric server on the communication network, and the training control unit is configured to, when comparing the stress status with the training implementation conditions, acquire the stress status of the training target user from the stress status of the user that is sequentially calculated and recorded by the biometric server based on the biometric information received from the user terminal, and compare it with the training implementation conditions.

[0010] Furthermore, in one example of the configuration of the relay device according to the present invention, the user terminal is configured to acquire biometric information from the user of the user terminal and transmit it sequentially to the relay device, and the training control unit is configured to calculate and record the user's stress status based on the biometric information received from the user terminal, and when comparing the stress status with the training conditions, it is configured to acquire the stress status of the training target user from the recorded stress status and compare it with the training conditions.

[0011] Furthermore, in one example of the configuration of the relay device according to the present invention, the training control unit is configured to instruct the training device on the communication network to send the training email addressed to the training target user, based on pre-set implementation content data.

[0012] Furthermore, in one example of the configuration of the relay device according to the present invention, the training control unit is configured to generate the training email addressed to the training target user based on pre-set implementation content data and send it to the mail server. [Effects of the Invention]

[0013] According to the present invention, it is possible to accurately grasp a user's ability to cope with attack emails in a desired stressful situation. [Brief explanation of the drawing]

[0014] [Figure 1] Figure 1 is a block diagram showing the configuration of a relay device according to the first embodiment. [Figure 2] Figure 2 is an explanatory diagram showing an example of setting condition pattern data. [Figure 3] Figure 3 is an explanatory diagram showing an example of setting up implementation details data. [Figure 4] Figure 4 is a sequence diagram showing the operation of the relay device according to the first embodiment. [Figure 5] Figure 5 is a sequence diagram showing the operation of the relay device according to the second embodiment. [Embodiments for Carrying Out the Invention]

[0015] Next, embodiments of the present invention will be described with reference to the drawings.

[0016] [First Embodiment] First, referring to the block diagram of FIG. 1, the relay device 10 according to the first embodiment of the present invention will be described.

[0017] This relay device 10 is generally composed of a relay device such as a UTM (Unified Threat Management) device or a gateway, and relays and connects user terminals 20 such as a PC or a smartphone connected under it via a LAN (Local Area Network) to a higher-level communication network NW such as the Internet.

[0018] [Principle of the Present Invention] The user's response to a targeted attack email with an attached file containing malware varies depending on the user's stress situation. For example, when the user's stress is low and they have mental capacity, their security awareness regarding opening the attached file is relatively high. However, when the stress is high and they have no mental capacity, their security awareness decreases, and there is a tendency to carelessly open the attached file. Therefore, it is considered that the user's response ability changes depending on the timing of sending the training email.

[0019] Here, the relay device 10 is configured to monitor and control data communication, including email exchanges, between the user terminal 20 connected to it via LAN and the communication network NW, and can detect training emails from among the emails that the user terminal 20 receives in bulk from the email server 30. Furthermore, regarding the user's biometric information, for example, a technique is known in which the user's heart rate is detected by a heart rate sensor mounted on peripheral devices such as a pointing device, and the biometric server 32 on the communication network NW collects and records the information from the user terminal 20. Furthermore, regarding the user's stress level, a technique is known in which, like a typical smartwatch, the stress level is calculated from the heart rate and threshold processing is performed to classify it into several stress levels such as high stress, medium stress, and low stress and inform the user of these levels.

[0020] The present invention focuses on the fact that the relay device 10, with its inherent configuration for monitoring and controlling data communication, can detect training emails relayed from the mail server 30 to the target user terminal 20, and can obtain the user's stress status obtained from the user's biometric information from the biometric server 32. The relay device 10 is configured such that, in response to a request to receive email from the target user terminal 20, when the mail server 30 returns a training email that mimics a malicious attack email, it obtains the stress status of the target user, calculated based on the biometric information of the target user collected sequentially from the target user terminal 20, from the biometric server 32, compares it with the pre-set training conditions, and if the stress status matches the training conditions, it relays all received emails, including the training email, to the target user terminal 20. If the stress status does not match the training conditions, it relays all received emails other than the training email to the target user terminal 20.

[0021] Thus, when the stress situation of the training target user when the training email is returned from the mail server 30 meets the preset conditions, the training email is relayed and transferred to the target user terminal 20. Therefore, if the response content to the training email of the training target user is inappropriate thereafter, the malware of the attached file attached in the same manner as the known technology is activated, and it is notified that the training device 31 on the communication network NW has been infected with malware. On the other hand, when the stress situation of the training target user does not match the conditions, the training email is not relayed and transferred to the user but is discarded. Also, the returned training email may be saved, and the training email may be relayed and transferred to the user at the timing when the stress situation of the training target user meets the conditions.

[0022] Therefore, when the stress situation of the training target user is different from the desired stress situation, training is not performed on the training target user, and training is only performed on the training target user when it is the desired stress situation. Thus, it becomes possible to accurately grasp the user's coping ability with respect to the attack email in the desired stress situation.

[0023] [Detailed Configuration of Relay Device] Next, referring to the block diagram of FIG. 1 described above, the detailed configuration of the relay device 10 according to the present embodiment will be described.

[0024] The relay device 10 according to the present embodiment includes a network I / F 11, a LAN I / F 12, a relay circuit 13, a memory circuit 14, and a control circuit 15 as main circuit configurations.

[0025] [Network I / F] The network I / F 11 is connected to the communication network NW via the communication line L and is configured to perform data communication with the communication network NW based on an instruction from the control circuit 15.

[0026] [LAN I / F] The LAN I / F 12 is connected to the LAN and is configured to perform data communication with the LAN based on an instruction from the control circuit 15.

[0027] [Relay Circuit] It is connected to the network interface 11 and LAN interface 12, and is configured to relay data communication between the network interface 11 and LAN interface 12 in response to instructions from the control circuit 15.

[0028] [Memory circuit] The memory circuit 14 consists of a storage device such as a semiconductor memory or a hard disk, and is configured to store processing data and program 14P used in the training email control processing executed by the control circuit 15.

[0029] The main processing data stored in the memory circuit 14 includes pattern data 14A and execution content data 14B.

[0030] [Pattern data] Pattern data 14A is pattern data used to select training content in order to understand the training target user's ability to respond correctly to attack emails, and is pre-set in the memory circuit 14 by the training administrator. The main patterns set in pattern data 14A are conditional pattern data.

[0031] The condition pattern data is compared in the control circuit 15 with the stress level of the target user upon receiving the training email, and is used to determine whether or not the training email needs to be relayed to the target user terminal 20 of the target user, i.e., whether or not the training should be conducted. This makes it possible to identify the stress level of the target user when conducting the training.

[0032] Figure 2 shows three condition patterns SA, SB, and SC as examples of setting condition pattern data from pattern data 14A. For example, condition pattern SA is set to the condition "high stress", condition pattern SB is set to the condition "medium stress", and condition pattern SC is set to the condition "low stress".

[0033] A user's stress level can be classified into several stress levels, such as "high stress," "medium stress," and "low stress," by calculating a stress level (0-100) from their heart rate (variability in heart rate intervals) and applying threshold processing. Therefore, if the biometric server 32 on the communication network collects heart rate data sequentially from the target user terminal 20 and records the stress level obtained from the heart rate, the control circuit 15 can obtain the latest stress level information for the training target user from the biometric server 32 when determining whether or not to relay the training email.

[0034] [Implementation details data] The implementation content data 14B is data used to set the content of the training to be actually conducted using training emails, and is pre-set in the memory circuit 14 by the training administrator. Note that the data set in the implementation content data 14B is not limited to the data described below, and other data used to create training emails, such as personal information such as the affiliation of the training target users, may also be set in the implementation content data 14B.

[0035] In the example settings shown in Figure 3, the username of the user to be trained is set to "Saxa Taro," and the email address of the user to be trained is set to "saxa.taro@saxa.jp." As a result, training will be conducted on the user named "Saxa Taro," and training emails will be sent to the email address "saxa.taro@saxa.jp."

[0036] Furthermore, in the example settings shown in Figure 3, the training execution conditions are set to the pattern "SA" from Figure 2, and the date and time of sending the training email from the training device 31 is set to "2024 / 07 / 22 10:00".

[0037] As a result, a training email is sent from the training device 31 to the mail server 30 at "2024 / 07 / 22 10:00". In response to a subsequent email reception request from the target user terminal 20, if the stress level of the target user at the time the training email is returned from the mail server 30 is "high stress", the training email is relayed from the relay device 10 to the target user terminal 20 of the target user, and the training is carried out.

[0038] [program] Program 14P is a program that, in cooperation with the CPU of the control circuit 15, realizes various processing units for executing training email control processing in the control circuit 15. This program 14P is read from an external device or recording medium (neither of which are shown) and stored in the memory circuit 14 in advance.

[0039] [control circuit] The control circuit 15 has a CPU and its peripheral circuits, and is configured to execute training email control processing by having the CPU and the program 14P of the memory circuit 14 cooperate to realize various processing units.

[0040] The main processing units implemented in the control circuit 15 are the email monitoring unit 15A and the training control unit 15B.

[0041] [Email Monitoring Department] The email monitoring unit 15A monitors data communication between the user terminal 20 and the communication network NW via the relay circuit 13 based on the implementation data 14B, and is configured to detect training emails for training against malicious attack emails containing malware from among the received emails sent back to the user terminal 20 from the email server 30 in response to email reception requests from the user terminal 20.

[0042] [Training Control Unit] The training control unit 15B is configured to, when a training email is detected by the email monitoring unit 15A, acquire the stress status of the target user from the biometric server 32 on the communication network NW, compare it with the training conditions of the pre-configured implementation data 14B, and if the stress status matches the training conditions, relay all received emails, including the training email, to the target user terminal 20. If the stress status does not match the training conditions, relay all received emails other than the training email to the target user terminal 20.

[0043] Furthermore, the training control unit 15B is configured to instruct the training device 31 to send a training email containing each item of the implementation details data 14B via the network interface 11, communication line L, and communication network NW. In this case, the training control unit 15B should instruct the training device 31 to send the training email in advance so that it arrives in time for the training email transmission date and time of the implementation details data 14B.

[0044] [Operation of the first embodiment] Next, the operation of the relay device 10 according to the first embodiment will be described. In the following description, the case in which the contents shown in Figure 3 above are pre-set in the implementation data 14B of the memory circuit 14 will be described as an example. Furthermore, the case in which heart rate is used as the user's biometric information will be described as an example.

[0045] First, we will explain the stress situation recording operation by referring to the sequence diagram in Figure 4.

[0046] Each user terminal 20 connected to the LAN detects the heart rate of the corresponding user using a heart rate sensor mounted on peripheral devices such as pointing devices, and notifies the bio-server 32 via the LAN, relay device 10, and communication network NW (step 100). The bio-server 32 consists of a general information collection server, collects the heart rates notified from each user terminal 20, calculates and records the stress level of each user (step 101). In this case, instead of targeting all user terminals 20 connected to the LAN, the system may be configured to detect the heart rate and notify the bio-server 32 only for target user terminals 20 of pre-configured training target users.

[0047] Next, the training email control processing operation will be explained with reference to the sequence diagram in Figure 4.

[0048] In the control circuit 15 of the relay device 10, the training control unit 15B sets the implementation content data 14B in response to instructions from the user terminal 20 used by the training administrator, received via LANI / F12 (step 110), and the email monitoring unit 15A starts training using training emails to the training target users based on the implementation content data 14B (step 111).

[0049] After this, the training control unit 15B confirms that the timing for sending the training email instruction to the training device 31 has arrived (step 120), and processing related to the training email is started in accordance with the arrival of the sending timing.

[0050] First, the training control unit 15B sends a training email transmission instruction, including each item of the implementation content data 14B, to the training device 31 on the communication network NW via the network I / F 11 (step 121). Based on the contents of the training email transmission instruction from the relay device 10, the training device 31 generates a training email addressed to the email address of the training target user and sends it to the mail server 30 at the training email transmission date and time (step 122). From this point onward, whenever a mail reception request is sent from the target user terminal 20 to the mail server 30, the mail reception response will always include the training email.

[0051] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 130), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0052] In response, if an incoming email is returned from the mail server 30 (step 131), the mail monitoring unit 15A temporarily receives the incoming email from the relay circuit 13 and detects training emails from these incoming emails (step 132).

[0053] Next, since the received emails include training emails, the training control unit 15B accesses the bio-server 32 via the communication network NW from the network I / F 11 to obtain the latest stress status of the training target user (step 133) and compares it with the pre-configured training conditions (step 134). If the stress status does not match the training conditions (step 134: NO), the training control unit 15B relays all emails other than training emails from the received emails to the target user terminal 20 via the relay circuit 13 and LAN I / F 12 (step 135), returns to step 110 described above, and waits until the next transmission timing arrives.

[0054] Therefore, in step 131, if two incoming emails, including the training email, are returned, and the stress level does not meet the training conditions, in step 135, the one incoming email other than the training email will be relayed to the target user terminal 20.

[0055] On the other hand, in step 134, if the stress situation matches the training conditions (step 134: YES), the training control unit 15B relays all of these received emails, including the training emails, from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 140).

[0056] Therefore, in step 131, if two incoming emails, including the training email, are returned, and the stress level matches the training conditions, then in step 140, the two incoming emails, including the training email, will be relayed to the target user terminal 20.

[0057] After this, the training control unit 15B notifies the training device 31 from the network interface 11 of training processing details such as the date and time of relaying the training email to the target user terminal 20 and the stress status (step 141), and then ends the series of training for the target user using the training email (step 142).

[0058] As a result, the training email is relayed to the target user terminal 20 only if the stress level of the training user when the training email is returned from the mail server 30 matches the pre-set conditions. Therefore, if the training user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the training device 31 on the communication network NW is notified of the malware infection, which is then collected as a training result. On the other hand, if the stress level of the training user does not match the conditions, the training email is not relayed to the target user terminal 20 and is discarded.

[0059] [Effects of the First Embodiment] As described above, in this embodiment, the relay device 10 is configured such that when a training email is returned from the mail server 30 in response to a request to receive an email from the target user terminal 20 of the user to be trained, the stress status of the user to be trained is obtained from the bio-server 32 and compared with the pre-set training conditions. If the stress status matches the training conditions, all received emails, including the training email, are relayed to the target user terminal 20. If the stress status does not match the training conditions, all received emails other than the training email are relayed to the target user terminal 20.

[0060] Therefore, if the stress level of the trained user differs from the desired stress level, training will not be conducted for that user. Training will only be conducted if the stress level is as desired, making it possible to accurately grasp the user's ability to deal with attack emails under the desired stress level.

[0061] [Second Embodiment] Next, a relay device 10 according to a second embodiment of the present invention will be described. In the first embodiment described above, the case in which the transmission of training emails and the collection of training results are performed by an existing training device 31 on a communication network NW was described as an example. In this embodiment, the case in which the configuration of the training device 31 is implemented in the control circuit 15 of the relay device 10 will be described as an example. Furthermore, in the first embodiment described above, the case in which the collection of biological information and the recording of stress status are performed by a biological server 32 was described as an example. In this embodiment, the case in which the configuration of the biological server 32 is implemented in the control circuit 15 of the relay device 10 will be described as an example.

[0062] The configuration of the relay device 10 according to this embodiment is almost the same as the block diagram shown in Figure 1 above, but some of the configurations of the training control unit 15B of the control circuit 15 are different.

[0063] [Training Control Unit] The training control unit 15B is configured to generate training emails based on each item in the implementation details data 14B and send them to the mail server 30 via the communication line L and communication network NW from the network I / F 11. In this case, the training control unit 15B only needs to send the training emails in advance so that they arrive in time for the training email transmission date and time specified in the implementation details data 14B.

[0064] Furthermore, the training control unit 15B is configured to collect training results related to the target user terminal 20 and store them in the memory circuit 14 if it is notified that malware attached to a training email has been activated and the target user terminal 20 has been infected with malware.

[0065] Furthermore, the training control unit 15B is configured to collect heart rate, which is biometric information detected by each user terminal 20, via the LAN and LANI / F 12, calculate the stress status of the corresponding user from the obtained heart rate, and record it in the memory circuit 14. In this case, instead of targeting all user terminals 20 connected to the LAN, it is also possible to collect heart rate only from the target user terminals 20 of pre-configured training target users.

[0066] [Operation of the second embodiment] Next, the operation of the relay device 10 according to the second embodiment will be described. In the following, the case in which the contents shown in Figure 3 above are pre-set in the implementation data 14B of the memory circuit 14, and a training email addressed to the training target user is sent from the relay device 10 will be described as an example. Furthermore, the case in which heart rate is used as the user's biometric information will be described as an example.

[0067] First, we will explain the stress situation recording operation by referring to the sequence diagram in Figure 5.

[0068] Each user terminal 20 connected to the LAN detects the heart rate of the corresponding user using a heart rate sensor installed in peripheral devices such as pointing devices, and notifies the relay device 10 via the LAN (step 200).

[0069] In the relay device 10, the training control unit 15B of the control circuit 15 collects the heart rate notified from the user terminal 20 via LANI / F12, calculates the corresponding user's stress status from the obtained heart rate, and records it in the memory circuit 14 (step 201).

[0070] Next, the training email control processing operation will be explained with reference to the sequence diagram in Figure 5.

[0071] In the control circuit 15 of the relay device 10, the training control unit 15B sets the implementation content data 14B in response to instructions from the user terminal 20 used by the training administrator, received via LANI / F12 (step 210), and the email monitoring unit 15A starts training using training emails to the training target users based on the implementation content data 14B (step 211).

[0072] After this, the training control unit 15B confirms the timing for sending the training email instruction to the training device 31 (step 220), and in response to the arrival of the sending timing, generates a training email addressed to the training target user's email address based on the content of the training email instruction and the template email data registered in the memory circuit 14, and sends it to the mail server 30 from the network I / F 11 (step 221). From this point onward, whenever a mail reception request is sent from the training target user's terminal 20 to the mail server 30, the mail reception response will always include the training email. The timing for sending the training email in the training control unit 15B should be determined at the same time as the training email sending date and time.

[0073] Subsequently, if a mail reception request is sent from the target user terminal 20 to the mail server 30 (step 230), the control circuit 15 relays and forwards the request to the mail server 30 on the communication network NW via LANI / F12, relay circuit 13, and network I / F11.

[0074] When a received email is returned from the mail server 30 in response to an email reception request (step 231), the control circuit 15 temporarily takes in the received email from the relay circuit 13, and the email monitoring unit 15A detects training emails from these received emails (step 232).

[0075] Next, the training control unit 15B, knowing that training emails are included among the received emails, obtains the latest stress status of the target user from the memory circuit 14 (step 233) and compares it with the pre-set training conditions (step 234). If the stress status does not match the training conditions (step 234: NO), the training control unit 15B relays all emails other than training emails from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 235), returns to step 220 described above, and waits until the next transmission timing arrives.

[0076] Therefore, in step 231, if two incoming emails, including the training email, are returned, and the stress situation does not meet the training conditions, in step 235, the one incoming email other than the training email will be relayed to the target user terminal 20.

[0077] On the other hand, in step 234, if the stress situation matches the training conditions (step 234: YES), the training control unit 15B relays all of these received emails, including the training emails, from the relay circuit 13 to the target user terminal 20 via LANI / F12 (step 240). At this time, if the implementation content data 14B has transfer pattern data set, the training control unit 15B adjusts the order of the training emails in these received emails based on the set transfer pattern, and then relays them to the target user terminal 20.

[0078] Therefore, in step 231, if two incoming emails, including the training email, are returned, and the stress level matches the training conditions, then in step 240, the two incoming emails, including the training email, will be relayed to the target user terminal 20.

[0079] After this, the training control unit 15B saves training processing details, such as the date and time of relaying the training email to the target user terminal 20 and the stress status, to the memory circuit 14 (step 241), and ends the series of training sessions for the target user using the training email (step 242).

[0080] As a result, the training email is relayed to the target user terminal 20 only if the stress level of the training user when the training email is returned from the mail server 30 matches the pre-set conditions. Therefore, if the training user's response to the training email is inappropriate, the malware in the attached file is activated, similar to known technologies, and the relay device 10 is notified that it has been infected with malware. On the other hand, if the training user's stress level does not match the conditions, the training email is not relayed to the target user terminal 20 and is discarded.

[0081] [Effects of the second embodiment] Thus, in this embodiment, the relay device 10 is configured to generate a training email addressed to the training target user based on pre-configured implementation data 14B and send it to the mail server 30. Furthermore, the relay device 10 is configured to collect biometric information detected by the user terminal 20, calculate the corresponding user's stress level, and record it in the memory circuit 14.

[0082] Therefore, it is possible to understand the user's ability to correctly respond to attack emails without using the training device 31, and the required configuration can be simplified. In addition, it is possible to record the user's stress level without using the biometric server 32, and the required configuration can be simplified.

[0083] In this embodiment, the case in which both the training device 31 and the biological server 32 are implemented in the relay device 10 was described as an example, but the invention is not limited to this, and either the training device 31 or the biological server 32 may be implemented in the relay device 10, and the corresponding effects can be obtained.

[0084] [Expansion of the embodiment] Although the present invention has been described above with reference to embodiments, the present invention is not limited to the above embodiments. Various modifications to the configuration and details of the present invention can be made within the scope of the present invention as can be understood by those skilled in the art. Furthermore, each embodiment can be arbitrarily combined and implemented without contradiction. [Explanation of Symbols]

[0085] 10...Relay device, 11...Network interface, 12...LAN interface, 13...Relay circuit, 14...Memory circuit, 14A...Pattern data, 14B...Implementation content data, 14P...Program, 15...Control circuit, 15A...Email monitoring unit, 15B...Training control unit, 20...User terminal, 20...Target user terminal, 30...Email server, 31...Training device, 32...Biological server, LAN...Local network, L...Communication line, NW...Communication network.

Claims

1. A relay circuit configured to relay user terminals connected to it via LAN to a communication network, The system includes a control circuit configured to monitor and control data communication between the user terminal and the communication network via the relay circuit, The aforementioned control circuit is A mail monitoring unit is configured to monitor received emails sent back to the target user terminal from a mail server on the communication network in response to an email reception request from the target user terminal of the target user, and to detect training emails for training against malicious attack emails containing malware among the received emails. A training control unit is configured to, upon detection of the training email by the email monitoring unit, compare the stress status of the training target user obtained from the biometric information of the training target user sequentially collected from the target user terminal with the pre-set training conditions, and if the stress status matches the training conditions, relay all of the received emails, including the training email, to the target user terminal; and if the stress status does not match the training conditions, relay all of the received emails other than the training email to the target user terminal. A relay device characterized by being equipped with the following features.

2. The user terminal is configured to acquire biometric information from the user of the user terminal and transmit it sequentially to the biometric server on the communication network. The training control unit is configured to compare the stress status with the training conditions by obtaining the stress status of the training target user from the user's stress status, which is sequentially calculated and recorded by the biometric server based on the biometric information received from the user terminal, and comparing it with the training conditions. The relay device according to claim 1.

3. The user terminal is configured to acquire biometric information from the user of the user terminal and transmit it sequentially to the relay device. The training control unit is configured to calculate and record the user's stress level based on the biometric information received from the user terminal, and to obtain the stress level of the training target user from the recorded stress levels and compare it with the training conditions when comparing the stress level with the training conditions. The relay device according to claim 1.

4. The training control unit is configured to instruct the training device on the communication network to send the training email addressed to the training target user, based on pre-configured implementation data. The relay device according to claim 2 or claim 3.

5. The training control unit is configured to generate the training email addressed to the training target user and send it to the mail server based on pre-configured implementation data. The relay device according to claim 2 or claim 3.

Images