Email security processing device and its operating method for an email connection security system that provides email communication protocol-based connection management and blocking functions

Abstract

A method according to an embodiment of the present invention is an operating method of a mail security device that constitutes a security network of a mail connection security system and has a security threat inspection unit that inspects security threats corresponding to received mail and a mail processing unit that forwards mail after the security threat inspection has been completed to a mail server inside the security network, the method including the steps of: the mail security device receiving mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information that has been previously distributed outside the security network of the mail connection security system; the mail security device inputting the mail server connection request information into a communication protocol processing module for a mail engine used in the security threat inspection unit and the mail processing unit to obtain one or more detailed connection information included in the mail server connection request information; the mail security device determining whether or not to block the connection using the one or more detailed connection information; and the mail security device blocking the forwarding of the mail server connection request information to the mail server depending on whether or not the connection has been blocked as determined.

Description

[Technical field]

[0001] The present invention relates to an e-mail security processing device and an operating method thereof, and more particularly to an e-mail security processing device and an operating method thereof for an e-mail connection security system that provides connection management and blocking functions based on an e-mail communication protocol. [Background technology]

[0002] In today's society, with the development of computers and information and communication technology worldwide, cyber dependency is increasing in all areas of social life, and this trend is accelerating. Recently, 5G mobile communications, which boasts ultra-high speed, ultra-low latency, and ultra-high connectivity, have reached a commercial level, and with the emergence of new services based on this, the importance of cybersecurity systems is increasing.

[0003] With the construction of cyber security systems, technical fields such as the Internet of Things (IoT), cloud systems, big data, and artificial intelligence (AI) are being combined with information and communication technology to provide new service environments. Systems that provide such services are connected to PCs or portable terminal devices via the Internet or wireless networks and can be used in real life.

[0004] In particular, the electronic mail system utilized in information and communication technology can provide electronic mail services including content bodies so that users can exchange messages using communication lines via computer terminals. In this case, electronic mail can include electronic files including the content to be shared, or resource connection links (URLs: Uniform Resource Locators) can be written in the body of the email or embedded in the attached files.

[0005] However, security concerns regarding the exchange of e-mail and documents have been growing in recent years. In particular, as e-mail servers that process e-mail transmissions are exposed to various threats such as hacking, spoofed e-mails, account hijacking, and personal information leaks, the need for security for e-mail servers is increasing day by day.

[0006] As a result, various security system solutions have been developed and applied that construct separate security systems such as firewalls to protect mail servers, configure security networks to protect mail servers for receiving mail, detect basic threats to data packets received by the mail server from the outside, and report and filter when a threat is detected.

[0007] However, email hacking methods are also becoming increasingly sophisticated, and recently there have been attempts to bypass such security networks and spread malicious emails by hijacking emails or accounts using email server connection processes based on communication protocols for email engines that are difficult to detect by simply inspecting data packets for threats.

[0008] This attack utilizes a connection process based on a communication protocol for a mail engine that can connect directly to the mail server itself, exploiting a vulnerability in the system that makes it difficult for firewalls and normal security inspection systems alone to check the detailed content of email in the communication protocol packets for the mail engine.

[0009] More specifically, the communication protocol for the mail engine is a standard that allows direct communication with the mail server to send and receive e-mails if the connection address dedicated to the e-mail protocol of the mail server is confirmed, and is a pre-set communication protocol for e-mail, and the contents of the data cannot be confirmed unless there is a mail engine module that can decrypt and encrypt e-mails. These include the Simple Mail Transfer Protocol (SMTP) standard protocol, the Post Office Protocol 3 (POP3) standard protocol, the Internet Message Access Protocol (IMAP) standard protocol, and the Messaging Application Programming Interface (MAPI) standard protocol, in accordance with the e-mail standard.

[0010] Packets based on such communication protocols for mail engines are encrypted and sent and received based on the Transport Layer Security (TLS) protocol, and each mail server can have connection address information specific to the mail protocol for communicating based on such Transport Layer Security (TLS) protocol to send and receive email data.

[0011] Furthermore, the Outlook program and various mail client applications that are primarily installed in the external mail connection device are configured to allow the setting of connection address paths (information) and port information specific to each mail protocol, such as SMTP, POP3, IMAP, and MAPI. Once the connection address paths (information) and port information specific to the mail protocol are set, the external mail connection device becomes able to directly send and receive email packets to and from the mail server based on a communication protocol for the mail engine that is difficult to decipher using a normal security system.

[0012] However, current security systems that only detect firewalls or malicious code in packets are not equipped with a mail engine module that can check the contents of such email packets, and therefore cannot check the detailed contents of packets based on the communication protocol for the mail engine.As a result, even if an attacker with malicious intent repeatedly attempts connection attacks to hijack accounts by changing email IDs or passwords indefinitely to connection addresses dedicated to the communication protocol for the mail engine, or sends a large number of spam and malicious emails to the hijacked accounts, there is a problem that this cannot be detected.

[0013] Furthermore, when an attack based on a communication protocol connection for the mail engine is attempted, the current system is unable to determine what type of attack it is, such as whether it is an account takeover, the distribution of malicious email, or the leakage of personal information. Summary of the Invention [Problem to be solved by the invention]

[0014] The present invention has been devised to solve the above problems, and a security system is constructed based on a mail security device that maintains the existing mail server system while building a security network by inspecting security threats corresponding to mails sent and received by the mail server system in the middle to protect the mail server from email attacks.The present invention is configured to guide communication protocol-based connection path information for a mail engine to the mail security device so that malicious attempts to connect to a mail server based on the communication protocol for the mail engine can be detected and blocked in advance in the mail security device, thereby providing an email communication protocol-based connection management and blocking function that can efficiently protect the mail server from attacks based on the mail engine protocol against the mail server, and an object of the present invention is to provide a mail security processing device and an operating method thereof for a mail connection security system that provides email communication protocol-based connection management and blocking functions that can efficiently protect the mail server from attacks based on the mail engine protocol against the mail server. [Means for solving the problem]

[0015] A method according to an embodiment of the present invention for achieving the above-mentioned objectives includes an operating method of a mail security device that constitutes a security network of a mail connection security system and has a security threat inspection unit that inspects received mail for security threats corresponding to the security threats, and a mail processing unit that transfers the mail after the security threat inspection is completed to a mail server inside the security network, the operating method including the steps of: the mail security device receiving mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information that has been previously distributed outside the security network of the mail connection security system; the mail security device inputting the mail server connection request information into a communication protocol processing module for a mail engine used in the security threat inspection unit and the mail processing unit, and obtaining one or more detailed connection information contained in the mail server connection request information; the mail security device determining whether or not to block the connection using the one or more detailed connection information; and the mail security device blocking the transfer of the mail server connection request information to the mail server depending on whether or not the connection has been blocked as determined.

[0016] In addition, in order to achieve the above-mentioned objective, an apparatus according to an embodiment of the present invention provides a mail security device that constitutes a security network of a mail connection security system and is equipped with a security threat inspection unit that inspects security threats corresponding to received mail and a mail processing unit that transfers mail after the security threat inspection has been completed to a mail server within the security network, and is equipped with a communication unit that receives mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information that has been previously distributed outside the security network of the mail connection security system, a mail server connection request information processing unit that inputs the mail server connection request information to a communication protocol processing module for a mail engine used in the security threat inspection unit and the mail processing unit, and obtains one or more detailed connection information included in the mail server connection request information, a blocking / non-blocking determination unit in the mail security device that determines whether or not to block the connection using the one or more detailed connection information, and a connection blocking processing unit in the mail security device that blocks the transfer of the mail server connection request information to the mail server depending on whether or not the connection has been blocked. Effect of the Invention

[0017] According to an embodiment of the present invention, a mail security device constituting a mail connection security system receives mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information previously distributed outside the security network of the mail connection security system, inputs the mail server connection request information to a communication protocol processing module for a mail engine used in the security threat inspection unit and the mail processing unit, obtains one or more detailed connection information included in the mail server connection request information, and determines whether to block the connection using the one or more detailed connection information.

[0018] As a result, the security system of an embodiment of the present invention maintains the existing mail server system, but builds a security system based on a mail security device that builds a security network by inspecting security threats corresponding to mails sent and received by the mail server system along the way to protect the mail server from email attacks.However, the security system is configured to guide connection path information based on the communication protocol for the mail engine to the mail security device, so that the mail security device can detect and block malicious attempts to connect to the mail server based on the communication protocol for the mail engine in advance, thereby making it possible to efficiently protect the mail server from attacks based on the mail engine protocol against the mail server.

[0019] By configuring the security system according to an embodiment of the present invention in this manner, malicious attempts to connect directly to a mail server based on a communication protocol for the mail engine are blocked, which not only reduces the load on the mail server, but also makes it possible to decode information on direct connections to a malicious mail server based on a communication protocol for the mail engine to detect each type of attack and take appropriate countermeasures, thereby having the advantage of making it possible to build an email security system more efficiently. [Brief description of the drawings]

[0020] [Figure 1] 1 is a conceptual diagram illustrating an overall system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram showing in more detail a mail security device according to an embodiment of the present invention. [Diagram 3] 3 is a block diagram showing in more detail a security threat inspection unit and a mail processing unit according to the embodiment of the present invention. FIG. [Figure 4] 4 is a block diagram showing in more detail a mail server connection security authentication processing unit of the mail security apparatus according to the embodiment of the present invention. FIG. [Diagram 5] 4 is a flowchart illustrating an operation of the email security device according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] The following merely illustrates the principles of the present invention. Therefore, those skilled in the art can invent various devices and methods that embody the principles of the present invention and are included in the concept and scope of the present invention, even if not explicitly described or illustrated in the present specification. It should be understood that all conditional terms and embodiments listed in the present specification are, in principle, clearly intended only for the purpose of making the concept of the present invention understandable, and are not limited to the embodiments and conditions specifically listed in this specification.

[0022] Moreover, all detailed descriptions reciting specific embodiments as well as principles, aspects, and embodiments of the present invention are intended to include structural and functional equivalents of such items, which should be understood to encompass not only currently known equivalents, but also equivalents developed in the future, i.e., any elements invented that perform the same function, regardless of structure.

[0023] Thus, for example, the block diagrams herein should be understood to illustrate a conceptual view of illustrative circuitry embodying the principles of the invention. Similarly, all flow charts, state transition diagrams, pseudocode, and the like, may be substantially represented on a computer readable medium and should be understood to illustrate various processes performed by a computer or processor, whether or not a computer or processor is explicitly shown.

[0024] Additionally, the explicit use of terms such as processor, control, or similar concepts should not be construed as exclusively referring to hardware capable of executing software, but should be understood to implicitly include, without limitation, digital signal processor (DSP) hardware, read only memory (ROM), random access memory (RAM), and non-volatile memory for storing software. Other hardware commonly known and commonly used may also be included.

[0025] The above-mentioned objects, features and advantages will become more apparent from the following detailed description in conjunction with the accompanying drawings, which will enable a person having ordinary skill in the art to which the present invention pertains to easily implement the technical ideas of the present invention. Note that, in implementing the present invention, if it is deemed that a detailed description of known technologies related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

[0026] The terms used in this application are merely used to describe certain embodiments and are not intended to limit the present invention. Singular expressions include plural terms unless the context clearly indicates otherwise. In this application, terms such as "comprise" or "have" are merely used to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should be understood not to preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0027] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate overall understanding, the same components in the drawings are given the same reference numerals, and duplicate descriptions of the same components are omitted.

[0028] The term "mail" as used herein can collectively refer to electronic mail, webmail, electronic mail, electronic mail, and other terms that are exchanged by users using a computer communication network via a terminal device and a client program or website installed thereon.

[0029] FIG. 1 is a conceptual diagram showing an entire system according to one embodiment of the present invention.

[0030] Referring to FIG. 1, the system according to an embodiment of the present invention includes a user terminal 10, an incoming e-mail security device 100, an outgoing e-mail security device 200, a mail server 300, and an external mail connection device 400.

[0031] More specifically, the incoming mail security device 100, the outgoing mail security device 200, and the mail server 300 can constitute a separately secured security network. The security network is a security network in which mail transmission to the mail server 300 cannot be performed without passing through the incoming mail security device 100 and the outgoing mail security device 200, and each device may have a secured internal network and security device based on various network interface environments for this purpose.

[0032] Here, each device constituting the network may be connected to each other via a wired / wireless network, and devices or terminals connected to each network can communicate with each other via a secured network channel between them.

[0033] Here, each of the networks may be realized by any type of wired / wireless network, such as a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN), a mobile radio communication network, or a satellite communication network.

[0034] The user terminal 10 and the external mail connection device 400 described in this specification include personal computers (PCs), laptop computers, mobile phones, tablet PCs, personal digital assistants (PDAs), portable multimedia players (PMPs), etc., but the present invention is not limited to these and may include a wide variety of devices that can be connected to the mail server 300 or the incoming mail security device 100 via an internal network, a public network, or a private network. In addition to these, the user terminal 10 and the external mail connection device 400 may be a wide variety of devices that can input and output information using application driving or web browsing.

[0035] The incoming email security device 100 and the outgoing email security device 200 can inspect for security threats in email data sent and received from the external email connection device 400 via the mail server 300 to the account of the user terminal 10, and can form an email security system that blocks or allows the sending and receiving of emails that have completed security threat inspection.

[0036] In FIG. 1, the incoming email security device 100 and the outgoing email security device 200 are shown configured separately, however, according to an embodiment of the present invention, the incoming email security device 100 and the outgoing email security device 200 may be configured as a single email security device.

[0037] Unlike such a security network system and operation, the external mail connection device 400 located in the external network can be connected to a public network by either wired or wireless connection to transmit and receive data. The public network is a communication network built and managed by the country or a communication carrier, and generally includes telephone networks, data networks, CATV networks, mobile communication networks, etc., and can provide connection services so that an unspecified number of general public can connect to other communication networks or the Internet.

[0038] According to the above-mentioned background art, the external mail connection device 400 can check the connection information based on the communication protocol for the mail engine of the mail server 300 and attempt a connection based on the communication protocol for the mail engine based on the connection information in order to attempt a direct connection to a malicious mail server based on the communication protocol for the mail engine. Such a communication protocol for the mail engine may be composed of packets encrypted based on the Transport Layer Security (TLS) protocol, and the connection information based on the communication protocol for the mail engine of the mail server 300 is usually delivered to the external mail connection device 400.

[0039] As described above, the communication protocol for the mail engine may include at least one of the following: the Simple Mail Transfer Protocol (SMTP) standard protocol, the Post Office Protocol 3 (POP3) standard protocol, the Internet Message Access Protocol (IMAP) standard protocol, and the Messaging Application Programming Interface (MAPI) standard protocol.

[0040] However, according to an embodiment of the present invention, the communication protocol-based connection information for the mail engine of the mail server 300 may be replaced with communication protocol-based connection information for the mail engine of the incoming mail security device 100 and distributed. That is, the distribution of the TLS communication protocol connection path information for the mail server 300 itself may be blocked in advance, and such a path may be deactivated in advance. For example, the mail server 300 may also be deactivated in advance by setting a port block so as not to allow a connection to the existing TLS communication protocol connection path itself.

[0041] By carrying out such a process of deactivating the connection path, it becomes possible for the external mail connection device 400 to connect to the mail server 300 only via the incoming mail security device 100, and a TLS communication protocol connection path may be formed for this purpose. In order to form the TLS communication protocol connection path, the incoming mail security device 100 can replace the communication protocol-based connection information for the mail engine of the mail server 300 with communication protocol-based connection information for the mail engine of the incoming mail security device 100 and deliver it, as described above.

[0042] As a result, the incoming email security device 100 can receive email server connection request information received from the external email connection device 400 on behalf of the incoming email security device 100 based on email communication protocol-based connection path information that has been delivered in advance outside the security network of the email connection security system.

[0043] The incoming email security device 100 can input the mail server connection request information to a communication protocol processing module for a mail engine used in a security threat inspection unit and a mail processing unit deployed for the sending and receiving security of emails as described above, and obtain one or more detailed connection information contained in the mail server connection request information.

[0044] The incoming mail security device 100 can determine whether to block the connection using one or more detailed connection information, and can block or allow the transfer of the mail server connection request information to the mail server 300 depending on whether the connection is blocked or not.

[0045] Here, the one or more detailed connection information may include at least one of email user identification information, encrypted email user password information, device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the email engine, so that the incoming email security device 100 can determine whether or not to block the connection when blocking policy information pre-configured corresponding to the email user identification information matches at least one of the device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the email engine.

[0046] Furthermore, the blocking policy information may include learning-based blocking policy information that is variably configured based on learning data of activity information collected in advance corresponding to the email user identification information, and the activity information may include at least one of device identification information corresponding to the email user identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for a mail engine.

[0047] Furthermore, when the communication protocol identification information for the mail engine, which is preset in correspondence with the mail user identification information, is different from the communication protocol identification information for the mail engine, the incoming mail security device 100 can inquire of the user terminal 10, which is preset in correspondence with the mail user identification information, whether the mail server connection request information is blocked or not. In this case, the incoming mail security device 100 can determine whether the connection is blocked or not as to be blocked or allowed, based on the response data received from the user terminal 10 in response to the inquiry.

[0048] In addition, the incoming mail security device 100 is not blocked according to a decision on whether or not to block the connection, and as a result, based on the permitted mail server connection request information, it can transfer authentication inquiry information including the mail user identification information and the encrypted mail user encryption information to the mail server 300, and can transfer and process the mail server connection request information to the mail server 300 according to the authentication response of the mail server 300 corresponding to the authentication inquiry information.

[0049] In this case, the incoming mail security device 100 can obtain mail server connection response information corresponding to the mail server connection request information from the mail server 300 and transmit the mail server connection response information to the external mail connection device 400 .

[0050] With this system configuration, even if the external mail connection device 400 performs TLS-based communication using a communication protocol for the mail engine such as SMTP, POP3, IMAP, or MAPI, it is only possible to send and receive email data with the mail server 300 via the incoming mail security device 100.The incoming mail security device 100 uses an email engine module for security threat inspection to decrypt at least a portion of the email packet based on the communication protocol for the mail engine, and can compare it with a preset policy to block it, or determine whether or not an attack has occurred and the type of attack and notify the user terminal 10.

[0051] As a result, the email security system according to an embodiment of the present invention can identify and block direct connection attacks based on a protocol for a mail engine against the mail server 300 without building a separate additional system, while retaining the existing mail server-based security system for receiving and sending emails, and in the case of a normal protocol-based connection request for a mail engine, allows the exchange of emails with the mail server 300, thereby enabling the construction of an efficient and secure security system for receiving and sending emails.

[0052] 2 to 4 are block diagrams for more specifically explaining the incoming e-mail security device 100 according to an embodiment of the present invention.

[0053] Referring to Figures 2 to 4, first, an incoming email security device 100 according to one embodiment of the present invention may include a control unit 110, a collection unit 120, a security threat inspection unit 130, a relationship analysis unit 140, an email processing unit 150, a user information management unit 160, a record management unit 170, a vulnerability testing unit 180, a communication unit 125, and a mail server connection security authentication processing unit 190.

[0054] The control unit 110 may be realized by one or more processors for controlling the overall operation of each component of the received e-mail security device 100 .

[0055] In addition, control unit 110 is equipped with a communication protocol processing module for the mail engine, and can enable data processing of communication protocol packets for the mail engine by decrypting, encrypting, and modulating data based on the e-mail communication protocol processed in each component.

[0056] The communication unit 125 may comprise one or more communication modules for communicating with the user terminal 10 or the network in which the mail server 300 is located or with an external mail connection device 400 .

[0057] The collection unit 120 can recover communication protocol packets for the mail engine transmitted and received from the mail server 300 or the external mail connection device 400, and collect mail information of the transmitted and received e-mail packet data. The mail information may include e-mail header information, e-mail title, the main text of the e-mail content, and the number of times the e-mail has been received in a certain period of time.

[0058] Specifically, the email header information may include the mail sending server IP address, mail sending server host name information, sender mail domain information, sender email address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient email address, mail protocol information, mail reception time information, mail sending time information, etc.

[0059] The email header may also include network route information required in the process of sending and receiving emails, and protocol information used between email service systems for exchanging emails.

[0060] Additionally, the mail information may include an attachment extension, hash information of the attachment, an attachment name, a body of the attachment content, Uniform Resource Locator (URL) information, etc. The attachment may include further content for transferring additional information or requesting a reply in addition to the content of the mail body that the sender intends to forward to the recipient.

[0061] The content may include text, images, videos, etc. The recipient can execute an application corresponding to the file attached to the email to check the content. The recipient can also download the file attached to the email to a local storage device for storage and management.

[0062] The file extension of the attached file can distinguish the format or type of the file. The file extension of the attached file may generally be distinguished by a character string indicating the file attribute or the application that generated the file. For example, a text file may be distinguished by an extension such as [filename].txt, an MS Word file may be distinguished by an extension such as [filename].doc (docx), and a Hangul file may be distinguished by an extension such as [filename].hwp. Also, an image file may be distinguished by an extension such as gif, jpg, png, tif, etc.

[0063] Additionally, executable files, which are computer files that perform designated tasks according to coded instructions, may be identified as [filename].com, [filename].exe, [filename].bat, [filename].dll, [filename].sys, [filename].scr, etc.

[0064] The hash information of the attachment can check for forgery of information and ensure the integrity of the information. The hash information or hash value may be mapped to a bit string of a certain length for any data of any length using a hash function.

[0065] As a result, the hash information output through the hash function for the initially generated attachment has a unique value. The output hash information or hash value is one-way, meaning that data input to the function cannot be extracted. In addition, the hash function can guarantee collision avoidance, which means that it is computationally impossible for other input data to provide the same output as the output hash information or hash value for one given input data. Thus, if data is modified or added to the attachment, the output value of the hash function is returned differently.

[0066] In this way, the unique hash information of the attachment can be used to check whether the file has been modified, forged, or altered by comparing the hash information or hash value of the file exchanged via email. In addition, since the hash information is fixed to a unique value, it is possible to take preventive measures by utilizing reputation information, which is a database of past history of files created with malicious intent. Additionally, the hash function can be used as a technology and version that can guarantee one-way and collision avoidance.

[0067] For example, the hash information can be used as search information for the presence or absence of malicious code in a file via the Virus Total website or the Malwares website. Information such as the file provider and the file hash value can be provided via a website that provides analysis of the file hash information. In addition, the results of a search for file hash information can be cross-checked with reputation information determined by a number of global companies that provide IT information security solutions, making it possible to make a judgment based on more reliable information.

[0068] The security threat inspection unit 130 processes stage-by-stage matching of the email security process corresponding to the email information according to a preset security threat architecture, inspects the email information using the matching-processed email security process, and stores and manages email security inspection information associated with the inspection results.

[0069] The security threat architecture may be classified into spam mail security threats, malicious code security threats, social engineering security threats, internal information leakage security threats, etc. Security threat types / levels / processes / priorities / processing orders may be set according to the security threat architecture.

[0070] The email security process corresponding to the security threat architecture may include a spam email security process, a malicious code security process, a spoofed email security process, an email export security process, and the like.

[0071] The email security process may be determined to be different from each other depending on the security threat architecture, whether the email is an incoming email or an outgoing email, and the inspection order or inspection level of the email security process may be determined by a preset security step and architecture.

[0072] The email security process is a method of dynamically allocating resources, in which independently divided processes are allocated as resources when email information for receiving or sending is transmitted from the user terminal 200, and can be immediately executed in the inspection area allocated by the email information, which can be explained as a concept of virtual space. In the method of allocating resources to virtual space, the email security process can immediately process work in the inspection area allocated by the sequentially incoming email information when processing is completed.

[0073] In contrast, in a virtual environment, such as a virtual machine, where a certain number of processes are assigned to a resource with limited processing capacity, other processes may have idle time to wait for a particular process to complete processing a requested task. Thus, in an analysis method using processes, floating resources can have an advantage in terms of processing speed and performance when compared to fixed resources.

[0074] The security threat inspection unit 130 can distinguish emails according to the purpose of receiving or sending based on the email information collected by the collection unit 120. Then, the security threat inspection unit 130 can obtain email security inspection information for each email by matching and analyzing the email security processes sequentially or based on a set priority.

[0075] As shown in FIG. 3( a ), the security threat inspection unit 130 includes a spam mail inspection unit 131 , a malicious code inspection unit 132 , a spoofed mail inspection unit 133 , and a mail output inspection unit 134 .

[0076] First, spam mail (also called junk mail, junk mail, or bulk mail) security threats may include a type of mail that is unilaterally and indiscriminately distributed to a large number of unspecified people in large quantities with the aim of publicity and announcements between unrelated senders and recipients. In addition, large amounts of spam mail can put a strain on the data processing capacity of the mail system, which can result in a decrease in the system's processing capacity. In addition, spam mail can cause users to unintentionally connect to indiscreet information contained in the content body, etc., and there is a risk that the information may be disguised as information for potential phishing scams.

[0077] In order to detect and filter such spam mails, the security threat inspection unit 130 may include a spam mail inspection unit 131. When the mail security process is a spam mail security process, the spam mail inspection unit 131 can match the mail information including mail header information, mail title, mail content body, number of times received in a certain period, etc. with a preset spam index in stages.

[0078] The spam mail inspection unit 131 performs a certain pattern inspection for distinguishing spam mail from mail information including mail header information, mail title, mail body, etc., and can use it as an inspection item in the spam index. Through this, the spam mail inspection unit 131 can obtain, store, and manage spam mail inspection information by matching the spam index step by step.

[0079] The spam index may be set with a level value using inspection items and inspections based on items included in the mail information for each level. According to an embodiment of the present invention, the spam index may be configured by being subdivided and graded into Level 1, Level 2, Level 3, ..., Level [n].

[0080] The spam index Level 1 can match email title data included in email information based on big data and reputation information. Through this, the spam index Level 1 can obtain an evaluated level value as the inspection information of the spam index Level 1. The level value may be set to quantitatively measurable information. For example, when the email title, which is an inspection item, contains phrases such as "advertisement" or "public relations", the inspection information of the spam index Level 1 can be evaluated as "1" in a level value divided into 0 and 1 if it matches information defined as spam email in the big data and reputation information. Through this, the inspection information of the spam index Level 1 can be obtained as "1".

[0081] Additionally, the spam index Level 2 can match data included in the email information based on user-specified keywords. Through this, the spam index Level 2 can obtain an evaluated level value as the inspection information of the spam index Level 2. For example, when the inspection item of the email content includes keywords including "bargain price", "super cheap price", "sale", "sale", "sold out", etc., and the inspection information of the spam index Level 2 matches the information defined as spam email by the user-specified keywords, the inspection information of the spam index Level 2 can be evaluated as "1" in the level value divided into 0 and 1. Through this, the inspection information of the spam index Level 2 can be obtained as "1".

[0082] As a next step, the spam index Level 3 can match data included in the email information based on image analysis. Through this, the spam index Level 3 can obtain an evaluated level value as the inspection information of the spam index Level 3. For example, when the data extracted by analyzing images included in the body of the email content, which is an inspection item, includes a telephone number starting with "080", if the data matches the information defined as spam email in the image analysis, the inspection information of the spam index Level 3 can be evaluated as "1" in the level value divided into 0 and 1. Through this, the inspection information of the spam index Level 3 can be obtained as "1".

[0083] In this way, the inspection information acquired by the spam index level using the spam mail security process may be finally added up ("3") and stored and managed as spam mail inspection information. The spam mail inspection information thus added up may be included in the mail security inspection information and managed, and may be utilized as information for determining security threats in the mail processing unit 150.

[0084] The security threat inspection unit 130 may further include a malicious code inspection unit 132. When the email security process is a malicious code security process, the malicious code inspection unit 132 may perform step-by-step matching of the email information, which further includes an attachment extension, hash information of the attachment, an attachment name, a body of the attachment content, URL (Uniform Resource Locator) information, and the like, with a preset malicious code index.

[0085] The malicious code inspection unit 132 can use the attachment file extension, hash information of the attachment file, attachment file name, etc., which can be confirmed from the attribute value of the attachment file, as well as the body of the attachment file content and URL (Uniform Resource Locator) information embedded in the body of the content, as the inspection items of the malicious code index. Through this, the malicious code inspection unit 132 can obtain, store, and manage the malicious code inspection information by matching the malicious code index step by step according to each type and item.

[0086] The malicious code index may be set with a level value using inspection items and inspections based on items included in the mail information for each level. According to an embodiment of the present invention, the malicious code index may be configured by being subdivided and graded into Level 1, Level 2, Level 3, ..., Level [n].

[0087] The malicious code index Level 1 can match the attachment file name and the attachment file extension included in the mail information based on the big data and the reputation information. Through this, the malicious code index Level 1 can acquire the evaluated level value as the inspection information of the malicious code index Level 1. For example, when the inspection information of the malicious code index Level 1 includes the inspection item of the attachment file name "Trojan" and the attachment file extension "exe", if it matches the information defined as malicious code in the big data and the reputation information, it can be evaluated as "1" in the level value divided into 0 and 1. Through this, the inspection information of the malicious code index Level 1 can be acquired as "1".

[0088] Additionally, the malicious code index Level 2 can match hash information of email attachments based on big data and reputation information. Through this, an evaluated level value can be obtained as the inspection information of the malicious code index Level 2. For example, when the inspection item of the malicious code index Level 2, attachment hash information is analyzed as "a1b2c3d4", if it matches information defined as malicious code in the reputation information, the inspection information of the malicious code index Level 2 can be evaluated as "1" in a level value divided into 0 and 1. Through this, the inspection information of the malicious code index Level 2 can be obtained as "1".

[0089] As a next step, the malicious code index Level 3 can match URL (Uniform Resource Locator) information embedded in the attachment or the body of the mail content based on the URL reputation information. Through this, the evaluated level value can be acquired as the inspection information of the malicious code index Level 3. For example, when the URL information, which is an inspection item, is confirmed to be "www.malicious-code.com", if it matches the information defined as a harmful site including a malicious code file in the URL reputation information, the inspection information of the malicious code index Level 3 can be evaluated as "1" in the level value divided into 0 and 1. Through this, the inspection information of the malicious code index Level 3 can be acquired as "1". And, the malicious code inspection unit 132 can respond to zero-day attacks that may be leaked from the URL reputation information. The malicious code inspection unit 132 can change the link IP address related to the URL without reputation information to the IP address of a specific system, and provide the changed IP address to the user terminal 200. When the user terminal 200 attempts to connect to the URL, it may connect to the IP address of the specific system changed by the malicious code inspection unit 132. Prior to this, the specific system changed to the link IP address for the URL may continuously check whether it contains malicious code up to the end point of the URL.

[0090] In this way, the inspection information acquired by the malicious code index level unit using the malicious code security process may be finally added up ("3") and stored and managed as malicious code inspection information. The malicious code inspection information thus added up may be included in the mail security inspection information and managed, and may be utilized as security threat discrimination information in the mail processing unit 150.

[0091] The security threat inspection unit 130 may further include a spoofed mail inspection unit 133. When the mail security process is a spoofed mail security process, the spoofed mail inspection unit 133 may perform step-by-step matching of relationship analysis information acquired through the relationship analysis unit 140 with a pre-set relationship analysis index. The relationship analysis information may be acquired by analyzing mail information including mail information and attribute information of mails confirmed to be normal.

[0092] The spoofed mail inspection unit 133 can use the receiving mail domain, sending mail domain, receiving email address, sending email address, email routing, and mail content body information, which can be extracted from emails determined to be normal, as inspection items of the relational analysis index. Through this, the spoofed mail inspection unit 133 can obtain, store, and manage spoofed mail inspection information by matching the relational analysis index step by step according to the item. Through this, the spoofed mail inspection unit 133 can detect similar domains and filter out emails that may pose a security threat by tracking or verifying the mail delivery route.

[0093] The relationship analysis index may be set with a level value using a test item and a test based on the relationship analysis information for each level. According to an embodiment of the present invention, the relationship analysis index may be configured by being subdivided and graded into Level 1, Level 2, Level 3, ..., Level [n].

[0094] The relationship analysis index Level 1 can match the domain of a sender email, the address of a sender email, etc., based on the reputation information. Through this, the relationship analysis index Level 1 can obtain an evaluated level value as the inspection information of the relationship analysis index Level 1. For example, when the domain of a sent email, which is an inspection item, is "@spoof.com" and the address of a sender email contains "spoof@", if it matches information defined as malicious code in the reputation information, the inspection information of the relationship analysis index Level 1 can be evaluated as "1" in level values ​​divided into 0 and 1.

[0095] Additionally, the relationship analysis index Level 2 can match the domain of the sender email, the address of the sender email, etc., based on the relationship analysis information. Through this, the relationship analysis index Level 2 can obtain an evaluated level value as the inspection information of the relationship analysis index Level 2. For example, when the domain of the sent email, which is an inspection item, is "@spoof.com" and the address of the sender email contains "spoof@", if it does not match the information defined as the attribute information of a normal email in the relationship analysis information, the inspection information of the relationship analysis index Level 2 can be evaluated as "1" in the level value divided into 0 and 1. Through this, the inspection information of the relationship analysis index Level 3 can be obtained as "1".

[0096] As a next step, the relationship analysis index Level 3 can match mail routing information, etc., based on the relationship analysis information. Through this, the relationship analysis index Level 3 can obtain an evaluated level value as the inspection information of the relationship analysis index Level 3. For example, when the mail routing information, which is an inspection item, is confirmed to be "1.1.1.1", "2.2.2.2", or "3.3.3.3", the inspection information of the relationship analysis index Level 3 can be evaluated as "1" in a level value divided into 0 and 1 if the routing information, which is an email delivery path, does not match the information defined as attribute information of normal email in the relationship analysis information. Through this, the inspection information of the relationship analysis index Level 3 can be obtained as "1".

[0097] In this way, the inspection information acquired by the malicious code index level unit using the malicious code security process can be finally added up ("3") and stored and managed as malicious code inspection information. The spoofed e-mail inspection information thus added up may be included in the e-mail security inspection information and managed, and may be utilized as security threat discrimination information in the e-mail processing unit 150.

[0098] The security threat inspection unit 130 may include a mail export inspection unit 134 to deal with security threats of internal information leakage. When the mail security process is a mail export security process, the mail export inspection unit 134 may perform step-by-step matching with a pre-set mail export management index based on the mail information.

[0099] The mail output inspection unit 134 can use attribute information of the mail information as an inspection item of the mail output management index. In addition, the assigned IP address information of the user terminal 200 managed internally can be used as an inspection item of the management index.

[0100] The mail output management index may be configured with a level value using a test item and a test that are preset for each level. According to an embodiment of the present invention, the mail output management index may be configured by being subdivided and graded into Level 1, Level 2, Level 3, ..., Level [n].

[0101] The mail delivery management index may include an item for controlling that only permitted IP addresses among the IP addresses assigned to the user terminal 200 for checking the sending environment can register mail information. Since unauthenticated user terminals are relatively likely to leak internal information and pose a security threat via mail, a management index that can block them in advance can be managed.

[0102] Also, the mail output inspection unit 134 can use the mail output management index as a mail output management index by classifying the mail output management index into inspection items such as IP address information, sending count information, etc. Also, the mail output inspection unit 134 can reduce the threat of internal information leakage by further including a control unit such as an approval process as an inspection item of the mail sending environment. Through this, the mail output inspection unit 134 can store and manage the level value calculated by matching with the inspection item using the mail output process as mail output inspection information.

[0103] The relationship analysis unit 140 can store and manage the email information and relationship analysis information acquired based on the trust authentication log analysis. When the record management unit 170 processes the email information as a normal email based on the security threat determination information, the trust authentication log may include record information including a receiving email domain, a sending email domain, a receiving email address, a sending email address, email routing, and body information of the email content.

[0104] The mail processing unit 150 can process the mail status based on the mail security inspection information and the security threat discrimination information acquired by analyzing the mail information.

[0105] The mail processing unit 150 may perform the mail security process according to a preset priority. When the security threat discrimination information using the mail security process is determined to be an abnormal mail, the mail processing unit 150 may determine whether to interrupt the subsequent mail security process and process the mail status. Through this, when a problem is found in the inspection stage according to the priority, the mail processing unit 150 may perform only the processing required in that stage, and may determine whether the inspection has ended and terminate the subsequent inspection stage without performing it. Through this, the efficiency of the mail security service may be ensured, the system complexity may be reduced, and processing efficiency may be improved.

[0106] The email security inspection information may utilize information that is obtained by integrating the spam mail inspection information, malicious code inspection information, spoofed mail inspection information, and email delivery inspection information calculated by the security threat inspection unit 130. For example, when the security threat inspection unit 130 processes the email information, if the score calculated as the spam mail inspection information is "3", the score calculated as the malicious code inspection information is "2", the score calculated as the spoofed mail inspection information is "1", and the score calculated as the email delivery inspection information is "0", the total score of the email security inspection information may be obtained as "7". In this case, based on the predetermined security threat discrimination information, the email may be classified as a normal email when the total score is in the range of 0 to 3, as a gray email when the total score is in the range of 4 to 6, and as an abnormal email when the total score is in the range of 7 to 12. As a result, an email with the email security inspection information of "7" can be determined to be an abnormal email. The result value of each test information item included in the test information of the email information can be assigned an absolute priority depending on the item, or the priority can be determined based on information corresponding to a weighting value.

[0107] As a result, as shown in FIG. 3( b ), the mail processing unit 150 includes a mail sorting processing unit 151 , a mail discard processing unit 152 , and a mail sanitization processing unit 153 .

[0108] The mail processing unit 150 may include a mail sorting processing unit 151 that processes mail determined to be normal mail based on the security threat discrimination information into a receiving or sending state that can be processed by the user terminal.

[0109] In addition, the email processing unit 150 may further include an email discard processing unit 152 that processes emails that are determined to be abnormal emails based on the security threat discrimination information so that they cannot be accessed by the user terminal.

[0110] Additionally, the mail processing unit 150 may further include a mail neutralization processing unit 153 that converts mail determined to be graymail based on the security threat discrimination information into non-executable file content and provides the user terminal with the ability to selectively process the status of the mail.

[0111] In general, the graymail may be classified as spam mail or junk mail, or may be classified as normal mail. In the present invention, the graymail may be defined as a type of mail classified when security threat discrimination information is calculated as an intermediate value within a certain range that cannot be determined as normal or abnormal. The mail sanitization processor 153 may convert the graymail including a body of suspicious content into an image file and provide it in a mail state that the user terminal 200 can confirm. The mail sanitization processor 153 may also remove or modify a portion of an attachment that is suspected to be malicious code and provide it to the user terminal 200.

[0112] Meanwhile, the user information management unit 160 can store and manage user information of the user terminal 10, and the user information may include, for example, at least one of user name information, email account information, connection IP information, phone number information, connection device information, MAC information, etc.

[0113] The record management unit 170 can store and manage the mail information processed based on the identification information of the security threat as record information. The record management unit 170 may further include a relationship information management unit 171 that stores and manages the record information including a receiving mail domain, a sending mail domain, a receiving mail address, a sending mail address, mail routing, and body information of the mail content as a trust authentication log when the mail information is processed as a normal mail based on the identification information of the security threat. Through this, the trust authentication log can be used to analyze trustworthy relationship information for the mail information of the recipient and the sender. In addition, the information included in the trust authentication log can be guaranteed to be reliable while data is continuously accumulated by mutual information exchange.

[0114] In addition, when the record management unit 170 processes an email as an abnormal email based on the security threat discrimination information, the record information including the receiving email domain, sending email domain, receiving email address, sending email address, email routing, and email content body information can be used as an index for determining whether the email is abnormal when performing an email security process.

[0115] The vulnerability test unit 180 may convert the abnormal mail determined to be an abnormal mail based on the security threat discrimination information into a non-executable file content and provide the abnormal mail for receiving or sending processing at the user terminal. The vulnerability test unit 180 may include a vulnerability information management unit 181 that acquires identification information of the user terminal that has received or sent the abnormal mail and stores and manages the identification information as vulnerability information by type.

[0116] On the other hand, when the mail server connection security authentication processing unit 190 receives mail server connection request information from the external mail connection device 400 based on mail communication protocol-based connection path information previously distributed outside the security network of the mail connection security system via the communication unit 125, it inputs the mail server connection request information to the security threat inspection unit 130 and the communication protocol processing module for the mail engine used in the mail processing unit 150, obtains one or more detailed connection information included in the mail server connection request information, and performs authentication processing to determine whether to block the connection using the one or more detailed connection information.

[0117] To this end, referring to FIG. 4, the mail server connection security authentication processing unit 190 includes a mail server connection request information processing unit 191, a cutoff / non-cutoff determining unit 193, a connection cutoff processing unit 195, an authentication processing unit 197, and a connection information monitoring unit 199.

[0118] More specifically, first, the mail server connection request information processing unit 191 can receive and process mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information that has been delivered in advance to outside the security network of the mail connection security system via the communication unit 125.

[0119] For this purpose, the mail server connection request information processing unit 191 can configure connection path information based on a mail communication protocol that is preset corresponding to the mail security device 100, and deliver the connection path information based on the mail communication protocol that is preset to the external mail connection device 400. Here, the delivery method can be various, such as broadcasting via a public network or other private server, uploading onto a web page provided by a separate information server that can be accessed, or transferring to an e-mail or other electronic message in various formats.

[0120] This enables the mail server connection request information processing unit 191 to receive the mail server connection request information of the external mail connection device 400, which is composed of a communication protocol for the mail engine encrypted based on the Transport Layer Security (TLS) protocol, via the communication unit 125. As described above, as the communication protocol for the mail engine encrypted by the TLS method, at least one of the Simple Mail Transfer Protocol (SMTP) standard protocol, the Post Office Protocol 3 (POP3) standard protocol, the Internet Message Access Protocol (IMAP) standard protocol, and the Messaging Application Programming Interface (MAPI) standard protocol can be used.

[0121] The mail server connection request information processing unit 191 can input the mail server connection request information to a communication protocol processing module for a mail engine of the control unit 110 used in the security threat inspection unit 130 and the mail processing unit 150, and obtain one or more detailed connection information included in the mail server connection request information, and the detailed connection information may be transferred to the blocking / non-blocking determination unit 193.

[0122] Here, the detailed connection information is obtained by decrypting at least a portion of the email server connection request packet in accordance with a communication protocol for the mail engine, and may include at least one of mail user identification information, encrypted mail user encryption information, device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the mail engine.

[0123] In other words, the mail server connection request information is request information for connecting to a conventional mail server 300 in the external mail connection device 400, which is encrypted according to a communication protocol for the mail engine, and the mail server connection request information processing unit 191 can decrypt at least a portion of the mail server connection request information using a communication protocol processing module for the mail engine, extract detailed connection information, and transfer it to the blocking / non-blocking determination unit 193.

[0124] Then, the blocking / non-blocking determination unit 193 uses the detailed connection information to pre-calculate the possibility that the mail server connection request information corresponds to a connection attack based on a communication protocol for the mail engine, and if the possibility that the mail server connection request information corresponds to a connection attack based on a communication protocol for the mail engine is equal to or greater than a threshold, it can process blocking of the mail server connection request information.

[0125] To this end, the cut-off determination unit 193 can determine whether or not there is a connection attack based on a communication protocol for a mail engine using the detailed connection information and whether or not to cut it off according to a preset connection cut-off algorithm.

[0126] For example, the blocking / non-blocking determination unit 193 can determine whether to block the connection when blocking policy information preconfigured in response to the email user identification information matches at least one of the device identification information, the connection IP information, the connection location information, the connection time information, and the communication protocol identification information for the email engine.

[0127] Such blocking policy information may include learning-based blocking policy information that is variably configured based on learning data of activity information previously collected corresponding to the email user identification information, and the activity information may include at least one of device identification information corresponding to the email user identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for a mail engine.

[0128] Here, the learning-based blocking policy information variably configured based on the learning data may be configured by a machine learning model that associates and learns the device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the mail engine, corresponding to the email user identification information, with learning data of pre-set attack cases based on deep planning.Here, various machine learning techniques such as well-known CNN (convolutional neural network), DNN (deep neural network), RNN (recurrent neural network), LSTM (long short-term memory), and regression analysis can be used as the association learning technique based on deep planning.

[0129] For example, the blocking / non-blocking determination unit 193 according to an embodiment of the present invention can block the connection of the external mail connection device 400 if the IP information of the detailed connection information obtained from the communication protocol-based connection request information for the mail engine of the external mail connection device 400 is different from the IP address previously learned or specified in the blocking policy information.

[0130] In addition, for example, the blocking / non-blocking determination unit 193 according to an embodiment of the present invention can block the connection of the external mail connection device 400 when the connection country information of the detailed connection information obtained from the communication protocol-based connection request information for the mail engine of the external mail connection device 400 is different from the country information previously learned or specified in the blocking policy information.

[0131] Also, for example, the cutoff / non-cutoff determining unit 193 according to the embodiment of the present invention can cut off the connection of the external mail connection device 400 when the communication protocol identification information for the mail engine of the detailed connection information acquired from the communication protocol-based connection request information for the mail engine of the external mail connection device 400 is different from the communication protocol identification information for the mail engine that has been learned in advance or that has been specified in the cutoff policy information. More specifically, the cutoff / non-cutoff determining unit 193 can cut off the connection of the external mail connection device 400 when a specific user has been using an e-mail application using only the POP3 protocol for a certain period of time or more, but suddenly a connection using another protocol such as IMAP occurs in the external mail connection device 400 a certain number of times or more within a certain period of time.

[0132] Also, for example, the cut-off / non-cut-off determination unit 193 according to an embodiment of the present invention can cut off the connection of the external mail connection device 400 even if the device identification information of the detailed connection information obtained from the communication protocol-based connection request information for the mail engine of the external mail connection device 400 is different from the device identification information that has been learned in advance or specified in the cut-off policy information.

[0133] The cut-off / non-cut-off determining unit 193 may preset a certain time condition and a certain number of times condition for such cut-off. For example, if the possibility of attack is determined to be higher than a threshold value, or if communication protocol-based connection request information for a mail engine having detailed connection information that does not match the cut-off policy is received a certain number of times within a certain time period, the connection may be cut off. The time and number of times may be set differently for each type and category of detailed connection information.

[0134] Meanwhile, the connection cutoff processing unit 195 can cut off the connection of the mail server 300 of the external mail connection device 400 determined to be cut off by the cutoff / non-cutoff determining unit 193. However, prior to the cutoff processing, the connection cutoff processing unit 195 can check response information associated with an inquiry to the user terminal 10 and determine whether or not to cut off the connection according to the response information.

[0135] For example, in response to communication protocol-based connection request information for a mail engine that is determined to be blocked by the blocking / non-blocking determining unit 193 because the communication protocol identification information for the mail engine and the communication protocol identification information for the mail engine are different from each other, the connection blocking processing unit 195 can inquire of the user terminal 10 that is preset corresponding to the mail user identification information as to whether the mail server connection request information is blocked or not, and can determine whether the connection is blocked or not as to be blocked based on response data received from the user terminal 10 in response to the inquiry, and can block the connection with the external mail connection device 400. The connection blocking processing unit 195 can compose blocking response information associated with the connection blocking, and transmit it to the external mail connection device 400.

[0136] As a result, in the external mail connection device 400 determined to be an attacker, communication with the mail server 300 based on a communication protocol for a mail engine is blocked, and only after the blockage is lifted via a separate route, such as by performing identity authentication, can data be sent and received with the normal mail server 300 based on a communication protocol for a mail engine.

[0137] Furthermore, the connection cutoff processing unit 195 can transfer detailed connection information of the communication protocol-based connection request information for the mail engine for which the connection cutoff processing has been performed to the connection information monitoring unit 199 .

[0138] The connection information monitoring unit 199 can analyze detailed connection information of the communication protocol-based connection request information for the mail engine that has been subjected to the connection blocking process, and classify and determine the type of attack. For example, the connection information monitoring unit 199 can determine that a password hijacking attack is detected when repeated attempts to log into an e-mail account corresponding to the same account are confirmed, and can also determine that a spam or malicious code attack is detected when a large number of accounts are connected in completely different countries.

[0139] The access information monitoring unit 199 can configure the classified attack type information as a report interface and provide it to the user terminal 10.

[0140] Meanwhile, the authentication processing unit 197 can transfer authentication inquiry information including the mail user identification information and the encrypted mail user encryption information to the mail server 300 based on the mail server connection request information that is not blocked in accordance with the determination of whether or not to block the connection, and transfer the mail server connection request information to the mail server 300 in accordance with the authentication response of the mail server 300 corresponding to the authentication inquiry information.

[0141] The authentication processing unit 197 can obtain mail server connection response information corresponding to the mail server connection request information from the mail server 300 and transmit the mail server connection response information to the external mail connection device 400 .

[0142] This enables the authentication processing unit 197 to allow connections based on the communication protocol for a normal mail engine that has not been blocked, and mail data sent or received after connection authentication is protected and processed via the security threat inspection unit 130 and the mail processing unit 150, thereby eliminating system vulnerabilities and providing a secure mail security system.

[0143] In the embodiment of the present invention, the description has been focused on the operation of the incoming mail security device 100, but the blocking function and operation of the mail server connection request information based on the protocol for the mail engine can be configured in the same way in the outgoing mail security device 200. Therefore, the mail server connection security authentication processing unit 190 according to the embodiment of the present invention can operate in the same manner even when linked with the outgoing mail security device 200. That is, as described above, the incoming mail security device 100 and the outgoing mail security device 200 according to the embodiment of the present invention can configure a single mail security device that commonly includes the mail server connection security authentication processing unit 190, and are not limited by their names.

[0144] FIG. 5 is a flowchart for explaining the operation of the email security device according to the embodiment of the present invention.

[0145] Referring to FIG. 5, the email security device 100 according to an embodiment of the present invention first receives email server connection request information from the external email connection device 400 based on email communication protocol-based connection path information previously distributed outside the security network (S101).

[0146] Then, the mail security device 100 inputs the mail server connection request information to a communication protocol processing module for a mail engine, and obtains one or more pieces of detailed connection information included in the mail server connection request information (S103).

[0147] After that, the mail security device 100 determines whether to cut off the connection based on the detailed connection information (S105).

[0148] If it is determined that the connection should be blocked, the mail security device 100 transfers authentication inquiry information including the mail user identification information and the encrypted mail user encryption information to the mail server 300 (S109).

[0149] Then, the mail security device 100 acquires mail server connection response information corresponding to the mail server connection request information from the mail server 300, and transmits it to the external mail connection device (S111).

[0150] Thereafter, the email security device 100 monitors the sending and receiving of email data with the authenticated external email connection device (S113), performs security threat inspection, and can further block spam emails, malicious emails, social engineering attacks, etc. based on the email content.

[0151] On the other hand, if it is determined in step S105 that the connection should be blocked, the mail security device 100 blocks the transfer of the mail server connection request information of the external mail connection device 400 to the mail server 300 (S107).

[0152] Here, cut-off response information associated with the cut-off may be constructed and transferred to the external mail connection device 400. The cut-off response information may include, for example, separate external user authentication request information. In this case, the external mail connection device 400 may perform separate external user authentication, construct mail server connection request information including an authentication value, and make a request again to the mail security device 100. When the mail server connection request information including such an authentication value is received, the mail security device 100 may release the connection cut-off and perform steps S109 to S113 again.

[0153] The above-mentioned method according to the present invention can be created as a program to be executed on a computer and stored in a computer-readable recording medium. Examples of computer-readable recording media include read only memory (ROM), random access memory (RAM), compact disc read only memory (CD-ROM), magnetic tape, floppy disk, optical data storage device, etc.

[0154] In addition, the computer-readable recording medium may be distributed among computers connected via a network, so that the computer-readable code may be stored and executed in a distributed manner.Functional programs, codes, and code segments for implementing the above method may be easily construed by a programmer skilled in the art to which the present invention pertains.

[0155] Furthermore, while the preferred embodiments of the present invention have been illustrated and described above, the present invention is in no way limited to the specific embodiments described above, and it goes without saying that various modifications can be made by a person having ordinary knowledge in the technical field to which the invention pertains without departing from the gist of the present invention as claimed in the claims, and these modified embodiments should not be understood individually from the technical ideas and perspectives of the present invention.

Claims

1. A method for operating a mail security device that constitutes a security network of a mail connection security system and includes a security threat inspection unit that inspects security threats corresponding to received mail and a mail processing unit that transfers the mail that has been inspected for security threats to a mail server inside the security network, comprising: receiving mail server connection request information from an external mail connection device based on mail communication protocol-based connection path information previously distributed outside the security network of the mail connection security system; The email security device inputs the email server connection request information to a communication protocol processing module for a mail engine used in the security threat inspection unit and the email processing unit, and obtains one or more detailed connection information included in the email server connection request information; determining whether to block a connection using the one or more pieces of detailed connection information in the email security device; in the mail security device, blocking transfer of the mail server connection request information to the mail server depending on whether the connection has been blocked or not determined; A method of operating an email security device, comprising:

2. The mail server connection request information is 2. The method of claim 1, wherein the communication protocol comprises a communication protocol for a mail engine that is encrypted based on the Transport Layer Security (TLS) protocol.

3. 3. The method of claim 2, wherein the communication protocol for the mail engine includes at least one of the following: Simple Mail Transfer Protocol (SMTP) standard protocol, Post Office Protocol 3 (POP3) standard protocol, Internet Message Access Protocol (IMAP) standard protocol, and Messaging Application Programming Interface (MAPI) standard protocol.

4. The method for operating an email security device as described in claim 1, wherein the one or more detailed connection information includes at least one of email user identification information, encrypted email user encryption information, device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the email engine.

5. The step of determining whether the connection is interrupted includes: An operating method of an email security device as described in claim 4, comprising a step of determining whether the connection is blocked or not as blocked when blocking policy information preconfigured corresponding to the email user identification information matches at least one of the device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the email engine.

6. The blocking policy information includes learning-based blocking policy information that is variably configured based on learning data of activity information previously collected corresponding to the mail user identification information, A method for operating an email security device as described in claim 5, wherein the activity information includes at least one of equipment identification information corresponding to the email user identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for a mail engine.

7. The step of determining whether the connection is interrupted includes: When the communication protocol identification information for the mail engine, which is preset in correspondence with the mail user identification information, is different from the communication protocol identification information for the mail engine, inquiring of a user terminal, which is preset in correspondence with the mail user identification information, as to whether the mail server connection request information is blocked or not; determining whether the connection is blocked based on response data received from the user terminal in response to the inquiry; 5. A method of operating a mail security device according to claim 4, comprising:

8. transferring authentication inquiry information including the mail user identification information and the encrypted mail user encryption information to a mail server based on the mail server connection request information that is not blocked according to the determination of whether the connection is blocked; transferring the mail server connection request information to the mail server in response to an authentication response of the mail server corresponding to the authentication inquiry information; 5. A method of operating a mail security device according to claim 4, comprising:

9. obtaining, from the mail server, mail server connection response information corresponding to the mail server connection request information; transmitting the mail server connection response information to the external mail connection device; 9. A method of operating a mail security device according to claim 8, comprising:

10. An e-mail security device that constitutes a security network of an e-mail connection security system and includes a security threat inspection unit that inspects security threats corresponding to received e-mails and an e-mail processing unit that transfers the e-mails that have been inspected for security threats to a mail server inside the security network, a communication unit for receiving mail server connection request information received from an external mail connection device based on mail communication protocol-based connection path information previously distributed outside the security network of the mail connection security system; a mail server connection request information processing unit that inputs the mail server connection request information to a communication protocol processing module for a mail engine used in the security threat inspection unit and the mail processing unit, and acquires one or more detailed connection information included in the mail server connection request information; a cut-off / non-cutoff determination unit for determining whether to cut off a connection using the one or more pieces of detailed connection information, in the email security device; a connection cutoff processing unit in the mail security device that cuts off transfer of the mail server connection request information to the mail server depending on whether or not the connection has been cut off; An email security device comprising:

11. The mail server connection request information is 11. The mail security device according to claim 10, wherein the communication protocol is comprised of a communication protocol for a mail engine that is encrypted based on the Transport Layer Security (TLS) protocol.

12. 12. The email security device of claim 11, wherein the communication protocol for the email engine includes at least one of the following: a Simple Mail Transfer Protocol (SMTP) standard protocol, a Post Office Protocol 3 (POP3) standard protocol, an Internet Message Access Protocol (IMAP) standard protocol, and a Messaging Application Programming Interface (MAPI) standard protocol.

13. 11. The method of claim 10, wherein the one or more detailed connection information includes at least one of mail user identification information, encrypted mail user password information, device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the mail engine. Email security appliance.

14. The connection cutoff processing unit is An email security device as described in claim 13, which determines whether the connection is blocked when blocking policy information pre-configured corresponding to the email user identification information matches at least one of the device identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for the email engine.

15. The blocking policy information includes learning-based blocking policy information that is variably configured based on learning data of activity information previously collected corresponding to the mail user identification information, 15. The email security device according to claim 14, wherein the activity information includes at least one of device identification information corresponding to the email user identification information, connection IP information, connection location information, connection time information, and communication protocol identification information for a mail engine.

16. The connection cutoff processing unit is An email security device as described in claim 13, wherein when the communication protocol identification information for a mail engine that is preset in correspondence with the email user identification information and the communication protocol identification information for the mail engine are different from each other, a user terminal that is preset in correspondence with the email user identification information is inquired via the communication unit as to whether the mail server connection request information has been blocked, and whether the connection has been blocked is determined to be blocked based on response data received from the user terminal via the communication unit in response to the inquiry.

17. The email security device of claim 13 further comprises an authentication processing unit that transfers authentication inquiry information including the email user identification information and the encrypted email user encryption information to a mail server based on the email server connection request information that is not blocked in response to a decision on whether or not to block the connection, and transfers the mail server connection request information to the mail server in response to an authentication response of the mail server corresponding to the authentication inquiry information.

18. The authentication processing unit:

18. The mail security device according to claim 17, further comprising: acquiring mail server connection response information corresponding to the mail server connection request information from the mail server; and transmitting the mail server connection response information to the external mail connection device.

19. A computer program stored in a computer-readable non-volatile recording medium for causing a computer to execute the invention according to any one of claims 1 to 9.

Images