File management system, information processing device, program and information processing method

Abstract

To provide a server capable of more safely managing an attachment file of an e-mail.SOLUTION: A server stores an attachment file obtained by encrypting an attachment file of an e-mail transmitted from a sender in a storage unit, and generates inquiry information. Then, the server transmits, to a destination, an e-mail obtained by deleting the attachment file and inserting the inquiry information. Then, when receiving the inquiry information, the server notifies the destination associated to the inquiry information, of a password associated with the inquiry information. Then, when receiving the inquiry information, the server performs authentication based on the password, and if the authentication is permitted, the server controls a decrypted attachment file to be able to be downloaded or browsed to a user side.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a server. [Background technology]

[0002] Email has been used as a communication tool for a long time, and there is an MTA (Mail Transfer Agent) that accepts email from an MUA (Mail User Agent) and processes the email for delivery (distribution, sending, and forwarding).

[0003] Here, MUA is a client program used to send and receive email on a terminal on the Internet, and MTA is a server (mail server) that receives and delivers email on a network via SMTP (Simple Mail Transfer Protocol).

[0004] As a conventional technique, for example, there is a file management system that encrypts an attachment when it is present in an e-mail and delivers the e-mail with the encrypted file attached to the destination (Patent Document 1).

[0005] For example, according to Patent Document 1, when server 10 determines that a received e-mail contains an attachment, it encrypts the attachment and sends the e-mail to the destination. Then, by clicking on the URL (URL stands for Uniform Resource Locator; the same applies below) of the password inquiry information, destination user B can view the password for decrypting the encrypted file, and can decrypt the encrypted attachment, provided that the password is set to public (see 0061 to 0067 of Patent Document 1). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2017-215744 Summary of the Invention [Problem to be solved by the invention]

[0007] However, the conventional technology disclosed in Patent Document 1 has the risk that the attached file can be easily shared by someone other than the intended user B. For example, if the intended user B mistakenly forwards an email with an encrypted file to a third party user X and also forwards the URL of the password inquiry information, if the password is publicly available, user X may easily obtain the password and decrypt the encrypted file.

[0008] Furthermore, the conventional technology disclosed in Patent Document 1 has the problem that the user must decrypt the attached file, which is time-consuming.

[0009] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a server that manages email attachments more safely and improves user convenience. [Means for solving the problem]

[0010] (1) The present invention provides A server that manages attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generation unit that generates query information that associates the destination with the encrypted attachment; a sending unit that sends the email from which the attached file has been deleted and from which the inquiry information has been inserted to the destination; a notification unit that, when receiving the inquiry information, notifies the destination associated with the inquiry information of the password associated with the inquiry information; and a file control unit that, when receiving the inquiry information, performs authentication based on the password received from the user and the password associated with the inquiry information, and, if the authentication is permitted, decrypts the attachment associated with the inquiry information and controls the decrypted attachment so that it can be downloaded to the user side or so that it can be viewed.

[0011] The present invention also relates to a program that causes a computer to function as each part of the server, and to an information storage medium on which the program is stored.

[0012] Here, the "query information" may be, for example, a URL that uniquely specifies a web page on the Internet using a protocol such as HTTP (Hyper Text Markup Language) or HTTPS (Hyper Text Markup Language Secure). Note that the query information may also be information on a server that can send and receive data using other communication protocols such as FTP (File Transfer Protocol). Furthermore, "when query information is received" refers to, for example, when access to information specified by a URL is received.

[0013] According to the present invention, the destination user can obtain the password by accessing the query information, but users other than the destination user cannot obtain the password even if they access the query information. In other words, according to the present invention, since the password is notified to the destination, even if the query information becomes known to others, the password cannot be obtained by others.

[0014] Furthermore, according to the present invention, even if the inquiry information becomes known to others, the attachments are controlled so that they can be downloaded or viewed only by authenticated users, so that others cannot obtain or view the attachments, thereby enabling safe management of attachments.

[0015] Furthermore, according to the present invention, a user who has been authenticated can download or view the decrypted attachment, thereby eliminating the need to decrypt it on the user's terminal and improving convenience.

[0016] (2) The server, program, and information storage medium of the present invention are: The query information generation unit If one email contains multiple attachments, generate one query that associates the destination with the multiple encrypted attachments; The notification unit When the inquiry information is received, notifying the destination associated with the inquiry information of the one password associated with the inquiry information; The file control unit When the inquiry information is received, authentication is performed based on the password received from the user and the password associated with the inquiry information, and if the authentication is permitted, the multiple attachments associated with the inquiry information are decrypted, and the decrypted multiple attachments may be controlled so that they can be downloaded to the user side or viewed.

[0017] According to the present invention, even if there are multiple attachments in one email, the user can obtain or view the decrypted multiple attachments using one password associated with one inquiry information, thereby improving convenience for the user.

[0018] (3) The present invention is A server that manages attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generation unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that sends the email from which the attachment has been deleted and from which the first inquiry information has been inserted to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; and a file control unit that, when receiving the second query information, decrypts the attachment associated with the second query information and controls the decrypted attachment so that it can be downloaded to the user or viewed.

[0019] The present invention also relates to a program that causes a computer to function as each part of the server, and to an information storage medium on which the program is stored.

[0020] According to the present invention, the destination user can obtain the second query by accessing the first query, but users other than the destination user cannot obtain the second query even if they access the first query. In other words, according to the present invention, since the second query is notified to the destination user, even if others become aware of the first query, they cannot obtain the second query.

[0021] In other words, according to the present invention, even if the first query information is known to another person, the other person can be prevented from obtaining and viewing the attached file, thereby enabling the attached file to be managed safely.

[0022] Furthermore, according to the present invention, a user who accesses the system using the second query information can download or view the decrypted attachment, thereby eliminating the need for the user to decrypt the attachment on their terminal and improving convenience.

[0023] (4) The server, program, and information storage medium of the present invention are: The query information generation unit If one email contains multiple attachments, generate one first query and one second query that associate the destination with the encrypted multiple attachments; The file control unit When the second inquiry information is received, the multiple attachment files associated with the second inquiry information may be decrypted, and the decrypted multiple attachment files may be controlled so that they can be downloaded or viewed by the user.

[0024] According to the present invention, even if a single email contains multiple attachments, the user can obtain or view the decrypted multiple attachments all at once, thereby improving convenience for the user.

[0025] (5) The server, program, and information storage medium of the present invention are: The file control unit The decrypted attachment may be subjected to anti-virus processing before being downloaded to the user's terminal or before being viewed. According to the present invention, anti-virus processing is performed on the attachment at the receiving end, thereby further improving security.

[0026] (6) The server, program, and information storage medium of the present invention are: The file control unit Before downloading or viewing the file to the user's terminal, it may be determined whether a predetermined condition is met, and if the predetermined condition is met, the decrypted attachment may be controlled to be downloadable or viewable to the user, or may be prohibited from being downloaded or viewed to the user's terminal. According to the present invention, whether or not an attachment can be downloaded or viewed can be controlled in accordance with predetermined conditions, thereby further improving security. [Brief explanation of the drawings]

[0027] [Figure 1] FIG. 2 is a diagram showing an outline of attachment management according to the present embodiment. [Figure 2] FIG. 2 is a diagram showing an outline of password notification according to the present embodiment. [Figure 3] FIG. 1 is an example of a network diagram of a file management system according to an embodiment of the present invention. [Figure 4] FIG. 2 is a functional block diagram of the server 10 according to the present embodiment. [Figure 5] 10 is an example of a password issuance screen according to the present embodiment. [Figure 6] 10 is an example of a password input screen according to the present embodiment. [Figure 7] 10 shows an example of a download screen according to the present embodiment. [Figure 8] 3 shows an example of a management data storage unit according to the present embodiment. [Figure 9A] FIG. 4 is a flowchart showing the flow of processing according to the present embodiment. [Figure 9B] FIG. 4 is a flowchart showing the flow of processing according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0028] The present embodiment will be described below. Note that the present embodiment described below does not unduly limit the content of the present invention described in the claims. Furthermore, not all of the configurations described in the present embodiment are necessarily essential constituent elements of the present invention.

[0029] [1] Overview The file management system of this embodiment relates to the control of an email relay server managing attachments to emails. For example, a case will be described in which user A (sender A@xxx.com) sends an email with an attachment to user B (recipient B@yyy.com).

[0030] For example, as shown in FIG. 1, the server 10 receives an email M (email ID=001) sent from a sender (A@xxx.com) and addressed to a destination (B@yyy.com). The server 10 then receives the email (which includes the attachment). The server 10 then determines whether or not an attachment exists. If an attachment exists, the server 10 encrypts the attachment and stores the encrypted attachment (an encrypted attachment is also referred to as an encrypted file; the same applies hereinafter) in the storage unit 30.

[0031] Then, the server 10 generates query information L (URL) that associates the destination (B@yyy.com) with the identification information of the attached file. The identification information of the attached file is information that can uniquely identify the attached file. For example, the server 10 generates query information L (URL) based on the destination (B@yyy.com) and the identification information of the attached file. In other words, the query information L is information that can identify the destination and the attached file. Note that the attached file that can be identified by the query information L is an encrypted attached file.

[0032] Then, the server 10 deletes the data portion of the attached file of the email M and instead inserts the query information L. Then, the server 10 sends the email M to the destination (B@yyy.com).

[0033] 2, when the server 10 receives access to the query L, it identifies the destination (B@yyy.com) from the query L and notifies the identified destination (B@yyy.com) of the password. Therefore, when user B of the legitimate destination (B@yyy.com) clicks on the query L, the password can be notified.

[0034] When the server 10 receives access to the query information L, it performs password authentication, and if the authentication is permitted, it decrypts the encrypted attachment and controls the decrypted attachment so that it can be downloaded or viewed.

[0035] Therefore, even if user B mistakenly sends (mistransfers) email M to another user X by mistake, or if the inquiry information L is fraudulently known to user X, the destination of the password notification is limited to user B, so control can be exercised to prevent the password from being notified to user X. In other words, according to this embodiment, even if the inquiry information is known to another user X, user X can be prevented from obtaining the password, and passwords can be managed safely. This makes it possible to control so that user X cannot fraudulently download or view attachments.

[0036] In the following explanation, an example will be given in which a sender, user A (A@xxx.com), creates an e-mail with an attachment, and the destination of the e-mail M is user B (B@yyy.com).

[0037] [2] Network 3 shows an example of a network diagram of a file management system. In the file management system of this embodiment, a server 10 and a user terminal 20 are connected via a network (such as the Internet or an intranet).

[0038] The server 10 is an information processing device capable of providing a mail service using a terminal 20 connected for communication via the Internet.

[0039] The server 10 of this embodiment has a mail server function (MTA function) that receives an email consisting of an envelope destination, an envelope sender, and a message, and delivers the email. The server 10 is also called a "relay device" or "information processing device" that controls the relay of email.

[0040] The terminal 20 is a client device, and is an information processing device such as a smartphone, mobile phone, PHS, computer, game device, PDA, or image generating device, and is a device that can be connected to the server 10 via a network such as the Internet (WAN) or LAN.

[0041] The server 10 includes a storage unit 30 that stores files. The storage unit 30 functions as a file server that manages files. The storage unit 30 may be provided in a device separate from the server 10.

[0042] [3] Configuration Fig. 4 is an example of a functional block diagram of the server 10 of this embodiment. Note that the server 10 of this embodiment does not need to include all of the components in Fig. 1, and may have a configuration in which some of them are omitted.

[0043] The storage unit 170 stores programs and various data for causing a computer to function as each unit of the processing unit 100, and also functions as a storage area for the processing unit 100.

[0044] The memory unit 170 includes a temporary storage area and storage. Storage refers to a device that permanently stores data, such as a hard disk, optical disk, flash memory, or magnetic tape. The memory unit 170 may also store programs and data stored in the information storage medium 180.

[0045] The storage unit 170 of this embodiment includes a main storage unit 171 used as a work area, a user information storage unit 172, and a management data storage unit 173. Note that some of these may be omitted.

[0046] The main memory unit 171 can be realized by a RAM or the like. The main memory unit 171 is a storage area used in the processing of this embodiment. The user information memory unit 172 stores user information (user account, password, email address, etc.). The user information memory unit 172 may be configured by a DB (DB is an abbreviation for database, the same applies hereinafter).

[0047] The management data storage unit 173 stores at least identifiable and unique query information (URL) for each attached file, a destination, and information about the attached file (for example, a file name), each associated with the other. The management data storage unit 173 may be configured with a DB. The management data storage unit 173 may also store a generated password, a flag indicating validity or invalidity (1 is valid and 0 is invalid), an expiration date, the number of accesses K, and the like.

[0048] Furthermore, the management data storage unit 173 may store an email ID (message ID) for identifying an email with an attached file.

[0049] The information storage medium 180 (computer-readable medium) stores programs, data, etc., and its functions can be realized by storage such as an optical disk (CD, DVD), a magneto-optical disk (MO), a magnetic disk, a hard disk, a magnetic tape, or a memory (ROM).

[0050] The communication unit 196 performs various controls for communicating with the outside (e.g., terminals, other servers, or other network systems), and its functions can be realized by hardware such as various processors or communication ASICs, or programs.

[0051] The processing unit 100 performs various processes of this embodiment based on programs (data) stored in the storage unit 170 or the information storage medium 180 .

[0052] The processing unit 100 (processor) performs various processes using a main memory unit 171 in the memory unit 170 as a work area. The functions of the processing unit 100 can be realized by hardware such as various processors (CPU, DSP, etc.) or by a program.

[0053] The processing unit 100 includes a receiving unit 111, an analyzing unit 112, an encryption processing unit 113, a transmitting unit 114, a notifying unit 115, a storage processing unit 116, a query information generating unit 117, a password generating unit 118, a file control unit 119, and a Web processing unit 120.

[0054] The receiving unit 111 receives e-mails over the network via SMTP. That is, the receiving unit 111 performs processing to receive e-mails sent by the MUA of the sender terminal 20 and with a destination specified in the envelope.

[0055] The analysis unit 112 performs processing to analyze received e-mails. For example, it performs processing to analyze the envelope destination, the envelope sender, the message header, and the main text portion of the message body. For example, it performs processing to extract the domain from the envelope destination, processing to extract To, Cc, Bcc, Subject, and Message-ID from the message header, processing to extract the main text from the message body portion, and processing to extract attached files from the message body portion.

[0056] If an email received by the receiving unit 111 includes an attached file, the encryption processing unit 113 performs processing to encrypt the attached file.

[0057] The sending unit 114 sends (deliveries, distributes, relays, and transfers) e-mails over the network via SMTP. That is, the sending unit 114 performs processing to send e-mails received by the receiving unit 111 to their destinations.

[0058] Here, sending an e-mail includes the process of sending a received e-mail to another MTA via SMTP, the process of sending to a local delivery agent MDA (Mail Delivery Agent) for sending to a user who has an account in the same system where server 10 is running, and the process of sending to a user who has an account in the same system where server 10 is running without going through an MDA.

[0059] In particular, the transmission unit 114 of this embodiment transmits query information to a destination. The query information is associated with at least the destination and the attached file (encrypted attached file), and is information that can identify the destination and the attached file.

[0060] The sending unit 114 deletes the attached file and sends the email with the query information inserted to the destination.

[0061] That is, in the present embodiment, when an email received by the receiving unit 111 includes an attachment, the sending unit 114 deletes the attachment and sends the email to the destination with the query information inserted (added) in place of the attachment. Note that when the first query and the second query are generated, the sending unit 114 inserts the first query information in place of the attachment.

[0062] Furthermore, in the case where an email received by the receiving unit 111 includes an attached file, the sending unit 114 of this embodiment may encrypt the attached file before sending it to the destination.

[0063] When the notification unit 115 receives the inquiry, it notifies the destination associated with the inquiry of the password associated with the inquiry. The notification may be at least one of the following: sending to the user's terminal 20 by email (which may be a mail magazine, etc.) sent and received via SMTP; sending by a given protocol, not limited to SMTP; sending a push notification; presenting (controlling to make it displayable and viewable) a predetermined screen (banner display screen, notice screen, pop-up screen, etc.) of a predetermined application; or notifying by the server 10 via a web page, and indicates that the server 10 actively sends to the user's terminal 20. Note that a form of "notification" may also be when the server 10 sends information to the requested terminal 20 in response to a request from the user's terminal 20. Note that a push notification is when a message window is displayed in a partial area (such as the top edge) of the screen of the terminal (smartphone).

[0064] Furthermore, when the notification unit 115 receives the query, it notifies the destination associated with the query of the password associated with the query. That is, the query and the password have a one-to-one relationship.

[0065] In addition, when the first query information and the second query information are generated, and the notification unit 115 receives the first query information, it notifies the destination associated with the first query information of the second query information.

[0066] The storage processing unit 116 performs processing to store the encrypted attached file in the storage unit 30 (storage area).

[0067] The query generator 117 generates query information that associates the destination with the encrypted attached file.

[0068] Furthermore, when one e-mail has multiple attachments, the query generating unit 117 generates one query that associates the destination with the encrypted multiple attachments.

[0069] Furthermore, the query generating unit 117 may generate the first query and the second query in which the destination and the encrypted attached file are associated with each other.

[0070] In addition, when one email has multiple attachments, the query information generation unit 117 may generate one first query information and one second query information that associate the destination with the multiple encrypted attachments.

[0071] In addition, when one email has multiple attachments, the query information generation unit 117 may generate one first query information and one second query information that associate the destination with the multiple encrypted attachments.

[0072] The password generating unit 118 generates a password required to download the attached file.

[0073] The file control unit 119 decrypts the encrypted attached file and controls the decrypted attached file so that it can be downloaded or viewed by the user.

[0074] For example, when the file control unit 119 receives query information, it performs authentication based on the password received from the user and the password associated with the query information (a password registered and managed on the server side), and if the authentication is permitted, it decrypts the encrypted attachment associated with the query information and controls the decrypted attachment so that it can be downloaded to the user side or viewed.

[0075] Furthermore, when one e-mail contains multiple attachments, the file control unit 119 performs the following control: When the file control unit 119 receives query information, it performs authentication based on the password received from the user and the password associated with the query information, and if the authentication is permitted, it decrypts the multiple attachments associated with the query information and controls the decrypted multiple attachments so that they can be downloaded or viewed by the user.

[0076] Furthermore, when the file control unit 119 receives the second query information, it may decrypt the attachment associated with the second query information and control the decrypted attachment so that it can be downloaded to the user side or can be viewed.

[0077] Furthermore, when the file control unit 119 receives the second query information, it may decrypt the multiple attachments associated with the second query information, and control the decrypted multiple attachments to be downloadable or viewable to the user.

[0078] Furthermore, the file control unit 119 may perform anti-virus processing on the decrypted attached file before downloading it to the user's terminal or before viewing it.

[0079] In addition, the file control unit 119 may determine whether or not a predetermined condition is met before downloading or viewing the file to the user's terminal, and if the predetermined condition is met, may control the decrypted attachment file to be downloadable to the user or viewable, or may control the attachment file to be prohibited from being downloaded to the user's terminal or viewed.

[0080] The Web processing unit 120 processes HTML (HyperText Markup Language) in response to a request from client software such as a Web browser installed on the terminal 20 via HTTP (Hypertext Transfer Protocol). The server processes data such as documents and images (language), and receives data accepted by the terminal's web browser.The server then processes emails and updates the database based on the information received from the administrator and user terminals.

[0081] The Web processing unit 120 may perform processing to send (provide) management setting data, etc. to the administrator's terminal 20 in response to an access request from the web browser of the administrator's terminal 20, and may also perform processing to receive information from the administrator's terminal 20.

[0082] That is, the Web processing unit 120 may add, delete, update, etc. each piece of data to the DB based on input from the administrator. Note that only the administrator is authorized to access the web page (URL) for the administrator.

[0083] Furthermore, the Web processing unit 120 performs login processing and, in response to a request from the Web browser of the terminal 20, performs processing to control the Web page of information related to the logged-in user so that it can be viewed.

[0084] For example, the Web processing unit 120 may control a screen for inputting a password or a screen for downloading an attached file in response to a request from the Web browser of the terminal 20 so that the screen can be viewed.

[0085] The storage processing unit 116 performs processing to register, update, and delete data stored in the management data storage unit 173 and the storage unit 30. For example, the storage processing unit 116 performs processing to register, update, and delete data received from the terminal 20. The database may be updated based on the collected data.

[0086] Note that some or all of the processing of the processing unit 100 and the memory unit 170 may be executed by a single device, or each process may be distributed to different devices depending on the purpose of the process.

[0087] [4] Encryption and storage of attachments First, when the server 10 of this embodiment receives an e-mail sent from the MUA of the terminal 20, it analyzes the received e-mail and determines whether or not there is an attached file.

[0088] If the server 10 determines that the e-mail has an attachment, it performs a process of encrypting the attachment and generates an encrypted attachment.

[0089] The server 10 then stores the encrypted attachment in a memory area of ​​the storage unit 30. That is, the attachment is automatically encrypted when it is stored in the storage unit 30. Note that the (encrypted) attachment stored in the storage unit 30 is controlled so that it is decrypted when it is downloaded.

[0090] The storage unit 30 also accumulates and stores the encrypted attachments received from the server 10 in sequence.

[0091] The storage unit 30 may be a storage area of ​​the server 10 or a storage area on the cloud. That is, it may be a storage area (storage device) on the Internet that can be connected to the server 10 via the Internet.

[0092] According to this embodiment, the sender, user A, can avoid the trouble of performing encryption work, and the attachment is encrypted and stored in the storage unit 30, thereby preventing tampering with the attachment and information leakage from the attachment.

[0093] Furthermore, if an email contains multiple attachments, the server 10 may generate a single encrypted file for the multiple attachments, or may generate separate encrypted files for each of the multiple attachments.

[0094] In this way, the server 10 performs a process of encrypting the attached file when storing it in the storage unit 30. As will be described later, when the server 10 receives an instruction to download the attached file to the user's terminal 20, it decrypts the attached file and controls it so that it can be downloaded. Furthermore, when the server 10 receives an instruction to display (allow viewing) the attached file on the user's terminal 20, it performs a process of decrypting the attached file and displaying (allowing viewing).

[0095] [5] Email sending process Furthermore, if the server 10 determines that the email M has an attachment, it removes the attachment and inserts the query information. Then, it sends the email M including the query information to the destination. In other words, the server 10 separates the attachment from the email M and stores the attachment in the storage unit 30, thereby preventing information leakage in the attachment in the event of erroneous transmission.

[0096] For example, as shown in FIG. 1, the server 10 inserts the inquiry information into the body of the email M. The server 10 may insert the inquiry information into the header of the email M or as a new attached file of the email M. The server 10 may also insert not only the inquiry information but also the following information into the email M: You may also include instructions (e.g., click this URL to download the attachment).

[0097] It should be noted that the server 10 performs a process of sending an email without an attached file as is.

[0098] [6] Method for generating query information The server 10 generates reference information (for example, a URL) that serves as a reference destination for downloading the attached file. The reference information is a password that is required to download the attached file.

[0099] The query information is a character string that can identify at least the destination and the attachment file name (for example, the storage location in the storage unit 30) according to a predetermined format (URL format). For example, the destination and the attachment file name are encoded and written in the parameter portion according to the URL format.

[0100] If one e-mail has multiple attachments, the server 10 generates one piece of query information that associates the destination with the encrypted multiple attachments.

[0101] [7] Password Generation The server 10 generates a password based on a given encryption algorithm when it receives an instruction to generate a password. The generated password is stored in the management data storage unit 173 in association with the query information. Even when a single email contains multiple attachments, the server 10 generates a single password associated with the query information. The server 10 may also generate a password when it receives the query information, rather than when it receives an instruction to generate a password.

[0102] In addition, to prevent the password character string from being easily analyzed, the password may be a character string of 20 or more characters including symbols, numbers, uppercase letters, and lowercase letters.

[0103] The password may also be a one-time password that is valid only once. For example, a one-time password generation program that generates one-time passwords using the same algorithm as that of the server 10 is installed in advance on the terminal 20, and authentication is performed using the one-time password. For example, the algorithm and seed number of the one-time password generation program installed on the terminal 20 and the one-time password generation program installed on the server 10 match, and as a result, the one-time password generated on the terminal side and the password generated on the server 10 match. For example, the one-time password generation program performs a process of generating a one-time password based on the time and seed number at a predetermined interval (for example, every 30 seconds).

[0104] [8] Password notification When the server 10 receives inquiry information from a given user, it notifies the destination associated with the inquiry information of the password. The notification to the destination associated with the inquiry information means that the destination associated with the inquiry information is designated as the destination of an email for notifying the password, and an email containing the password is sent. The notification to the destination associated with the inquiry information may also be controlled so that the user of the destination associated with the inquiry information can log in and view the password on a screen dedicated to that user.

[0105] That is, the server 10 receives an email M (electronic mail) from user B at the destination (B@yyy.com). When inquiry information regarding email M (email ID=001) is received, the destination (B@yyy.com) associated with the inquiry information is notified of the password required to download the file attached to email M (email ID=001).

[0106] 5, the server 10 may notify the terminal 20 of user B of a password issuance screen Sc1. For example, when the server 10 receives inquiry information from user B of destination (B@yyy.com), the server 10 displays the password issuance screen Sc1. Then, when the server 10 receives an instruction to issue (generate) a password from user B (for example, an instruction by user B clicking on link L52), the server 10 may notify the destination (B@yyy.com) associated with the inquiry information of the password.

[0107] 5, the server 10 may display the destination and attachment file name of the email M (email ID=001) on the password issuance screen Sc1. Although not shown, the header and body of the email M may also be displayed.

[0108] Furthermore, even if inquiry information is received from user X who is not related to the destination user B, the password will be notified to the destination (B@yyy.com) associated with the inquiry information, thereby preventing the password from being leaked to anyone other than the destination user B.

[0109] In addition, when the server 10 receives inquiry information from a user in a case where one email contains multiple attachments, the server 10 notifies the address associated with the inquiry information of one password associated with the inquiry information.

[0110] [9] Attachment Control When the server 10 receives the inquiry information from the user B, the server 10 controls the attachment file (encrypted attachment file) associated with the inquiry information so that it can be downloaded or viewed.

[0111] 6 shows a password entry screen Sc2 displayed on the terminal 20 of user B. For example, when the server 10 receives inquiry information from user B as shown in FIG. 6, the server 10 notifies the user B of the password and then displays the password entry screen Sc2 to user B.

[0112] Then, user B enters the notified password into text box field T61. That is, when the server 10 receives a password input instruction from user B (for example, an instruction by user B clicking link L62), the server 10 performs password authentication processing.

[0113] For example, the server 10 authenticates the user based on the password received from the user and the password associated with the query information registered in the server 10 (the password corresponding to the query information stored in the management data storage unit 173). For example, if the password received from the user matches the password registered in the server 10, the authentication is permitted.

[0114] If the server 10 permits the authentication, it displays a download screen Sc3 on the terminal 20 of the user B, as shown in FIG.

[0115] Then, as shown in FIG. 7, when the server 10 receives an instruction to download the attached file from the authenticated user B (for example, an instruction by the user B clicking on the link L72), the server 10 transmits the decrypted attached file associated with the reference information to the terminal 20 of the user B. In other words, the user B clicks on the link L72. The attached file can then be downloaded to user B's terminal 20.

[0116] Although not shown, when the server 10 receives an instruction to view the attached file from authenticated user B (for example, an instruction by user B clicking on a link), the server 10 may control user B's terminal 20 to view the decrypted attached file associated with the query information. In other words, user B clicks on a link for viewing, causing the contents of the attached file to be displayed on user B's terminal 20. In this way, user B can check the contents of the attached file even if he or she uses a browser that prohibits downloading (saving to the terminal).

[0117] Furthermore, even if there are multiple attachments, the server 10 performs authentication processing using a single password received from user B who has been authenticated, and if authentication is permitted, controls the multiple attachments corresponding to the inquiry information so that they can be downloaded to user B's terminal or viewed.

[0118]

[10] Effectiveness Control To improve information security regarding attachments, the server 10 sets validity (for example, the value of flag F) for identifying whether a process for generating a password for an attachment, a process for transmitting the password, and control for enabling downloading are valid or invalid. In other words, the server 10 performs a process for determining the validity of an attachment, and if it is determined to be valid (for example, if flag F=1), it performs a process for generating a password, a process for transmitting the password, and control for enabling downloading.

[0119] For example, the server 10 sets a flag indicating validity for each attached file (or for each piece of query information, or for each email). For example, flag F=1 means valid, and flag F=0 means invalid.

[0120] If the flag F=1, the server 10 performs a process of generating a password, a process of transmitting the password, and a control to enable downloading of the attached file.

[0121] On the other hand, when the flag F=0, the server 10 performs a process not to generate a password, a process not to transmit the password, and a control to prohibit downloading of the attached file.

[0122] In this embodiment, the server 10 receives a valid or invalid instruction from a predetermined user for each attached file (or each piece of inquiry information, or each email).

[0123] For example, when the server 10 receives a valid instruction from a specified user for an attached file of an email M (mail ID=001), the server 10 sets the flag F corresponding to the attached file to 1, and when the server 10 receives an invalid instruction from the specified user, the server 10 sets the flag F corresponding to the attached file to 0.

[0124] Here, the "predetermined user" refers to the user who sent the email containing the attached file (RCPT FROM, envelope FROM).

[0125] The "predetermined user" may be a user other than the sender. For example, when a group consisting of multiple users is set up in advance, a user other than the sender who belongs to the same group as the sender may be set as the predetermined user. Also, for example, a user who is the sender's superior may be set as the predetermined user. Furthermore, when multiple destinations are specified in an email, a user other than the sender who is a destination of the multiple destinations with the same domain as the sender may be set as the predetermined user. The user may be a predetermined user.

[0126]

[11] Download and viewing restrictions Furthermore, the server 10 may count the number K of times that query information has been received, and when the number K reaches a predetermined number or more (for example, three or more), it may control at least one of prohibiting downloading and prohibiting viewing. For example, regardless of the information of flag F, when the number K reaches a predetermined number or more (for example, three or more), it may control at least one of prohibiting downloading and prohibiting viewing.

[0127] Furthermore, the server 10 may set an expiration date corresponding to the inquiry information, and when the expiration date has passed, regardless of the information of the flag F, may control at least one of prohibiting downloading and prohibiting viewing.

[0128]

[12] Management Data 8 is an example of information stored in management data storage unit 173 of server 10. For example, management data storage unit 173 stores a URL (query information), a file name of an attached file, a destination, a generated password, a flag F indicating validity, an expiration date, and a count K indicating the number of times the URL can be accessed.

[0129] For example, the destination indicates the envelope To, and the password is the password used to download or view the attached file.

[0130] In the example of Figure 8, the destination (B@yyy.com) has flag F = 1, so the password can be obtained and the attached file can be retrieved, but the destination (G@zzz.com) has flag F = 0, so the password cannot be obtained and the attached file cannot be retrieved or viewed.

[0131] The expiration date indicates the date and time until which the attached file can be acquired. The number of times K indicates the number of times the query information has been received. In other words, it indicates the number of times the query information has been accessed.

[0132] The password data stored in the management data storage unit 173 may not be the password itself, but may be a character string (such as a hash value) for determining the password.

[0133]

[13] Flowchart The processing flow of this embodiment will be described with reference to FIGS. 9A and 9B.

[0134] 9A, the terminal 20-A of the sending user A (A@xxx.com) sends an e-mail with an attachment (step S1). The destination of this e-mail is assumed to be user B (B@yyy.com).

[0135] When the server 10 receives an email with an attached file (step S11), it encrypts the attached file (step S12) and stores the encrypted attached file in the storage unit 30 (step S13).

[0136] Then, the query information (URL) is generated (step S14), and the attached file is deleted from the received email, and the query information is inserted (step S15), and the email is sent to the destination (step S16).

[0137] Then, the terminal 20-B of the destination user B receives the email (step S100 ).

[0138] Next, referring to FIG. 9B, the destination user B's terminal 20-B accesses the reference information (URL) (step S111). When the server 10 receives the inquiry information from the terminal 20-B (step S17), it notifies the terminal 20-B of a password (step S18). Note that when the server 10 receives a password generation instruction from the terminal 20-B, it may generate a password and notify the terminal 20-B of the password.

[0139] Then, the terminal 20-B receives the password (step S112) and inputs the password (step S113). For example, the password is input into a password input screen. The input password is transmitted to the server 10.

[0140] The server 10 performs authentication processing based on the password (step S19). For example, the server 10 receives the password and performs authentication processing to determine whether the password registered in the server 10 matches the received password.

[0141] If the authentication process determines that the file is permitted (Y in step S20), the server 10 controls the attachment so that it can be downloaded to or viewed on the terminal 20-B (step S21). Note that even if the authentication is permitted, the server 10 may prohibit the attachment from being downloaded to or viewed on the terminal 20-B if a given condition is not met (for example, if the flag F indicating validity is 0).

[0142] Then, the terminal 20-B downloads or browses and displays the attached file transmitted from the server 10 (step S114).

[0143] On the other hand, if the server 10 determines that the authentication process is not permitted (N in step S20), the process ends. This ends the process.

[0144]

[14] Application example [14.1] Notification of inquiry information If the server 10 determines that the email M has an attachment, it may send the email M without the attachment to the destination and notify the destination user of the inquiry information separately. For example, it may send an email including the inquiry information to the destination.

[0145] [14.2] Multiple attachments When one e-mail contains multiple attachments, the server 10 may generate a password for each attachment. Then, when authentication based on the password is permitted, the server 10 may control the attachments so that they can be downloaded or viewed.

[0146] Furthermore, the server 10 may generate query information corresponding to each of the multiple attached files, or may generate query information that collectively includes the multiple attached files.

[0147] [14.3] First and second reference information The server 10 of this embodiment may be configured to allow downloading of an attached file using reference information (URL) instead of a password.

[0148] For example, if an attachment exists in the email M (email ID=001) sent from the sender (A@xxx.com), the server 10 encrypts the attachment. The encrypted attachment is stored in the storage unit 30.

[0149] Then, the server 10 generates the first query information L1 (first URL) and the second query information L2 (second URL) based on the destination (B@yyy.com) and the identification information of the attached file.

[0150] The first query L1 is associated with a destination (B@yyy.com) and identification information of the attached file. The second query L2 is also associated with the destination (B@yyy.com) and identification information of the attached file.

[0151] That is, the first query L1 and the second query L2 are information that can identify the destination and the attached file. The attached file that can be identified by the first query L1 and the second query L2 is an encrypted attached file.

[0152] The second query information L2 is information (URL) different from that of the first query information L1. The server 10 stores the first query information L1 and the second query information L2 in association with each other.

[0153] Then, the server 10 deletes the data portion of the attached file of the email M, inserts the query information L1 instead, and sends the email M to the destination (B@yyy.com).

[0154] If the server 10 determines that the email M has an attachment, it may send the email M without the attachment to the destination and notify the destination user of the query information L1 separately. For example, it may send an email including the query information L1 to the destination.

[0155] Thereafter, when the server 10 receives the access of the query L1, the server 10 identifies the destination (B@yyy.com) from the query L1 and notifies the identified destination (B@yyy.com) of the query L2. That is, the server 10 notifies the destination (B@yyy.com) of the query L2 corresponding to the query L1.

[0156] When the server 10 receives the access request based on the query L2, it identifies the attachment based on the query L2, decrypts the attachment, and controls the decrypted attachment so that it can be downloaded. In other words, the destination user B can display the download screen Sc3 shown in Fig. 7 on his / her terminal simply by clicking the query L2, thereby saving the user the trouble of entering a password.

[0157] According to this embodiment, the notification destination of the query information L2 is limited to the destination user B, so even if user B mistakenly sends (mistransfers) the email M to another user X by mistake, or if the query information L1 is fraudulently known to user X, it is possible to control so that the query information L2 is not notified to user X. In other words, it is possible to control so that user X cannot fraudulently download or view attached files.

[0158] When the server 10 receives the access request for the query L2, the server 10 may internally issue a password, perform authentication based on the issued password, and display a download screen to the destination user B.

[0159] Furthermore, when an email contains multiple attachments, the server 10 generates a first query and a second query that associate the destination with the encrypted attachments. When the server 10 receives the second query, the server 10 decrypts the attachments associated with the second query, and controls the decrypted attachments so that they can be downloaded or viewed by the user.

[0160] [14.4] Antivirus Processing The server 10 may perform anti-virus processing on the decrypted attachment before downloading it to the user's terminal or before viewing it. Anti-virus processing means performing processing to remove computer viruses from the attachment. For example, the server 10 records specific code patterns contained in predefined known viruses, checks the target attachment for a match, and if a match occurs, removes the code.

[0161] The server 10 may perform anti-virus processing on the attached file before storing the attached file in the storage unit 30 .

[0162] [14.5] Filtering The server 10 may determine whether a predetermined condition is met before downloading or viewing the decrypted attachment to the user's terminal, and if the predetermined condition is met, may control the decrypted attachment to be downloadable to the user or viewable. Alternatively, if the predetermined condition is met, the server 10 may control the decrypted attachment to be prohibited from being downloaded to the user's terminal or viewed.

[0163] The predetermined condition is a predetermined rule condition. The server 10 may define the predetermined condition in advance, or may set the predetermined condition based on input information from an administrator or a user. The server 10 may set a plurality of predetermined conditions.

[0164] For example, if the destination domain of the header information satisfies a predetermined condition A that a specific domain (for example, "yyy.com") is specified, the server 10 controls the decrypted attachment file so that it can be downloaded or viewed by the user.

[0165] Also, for example, if the server 10 satisfies a predetermined condition B that the subject of the header information contains the word "confidential," the server 10 controls the decrypted attachment file to be prohibited from being downloaded to the user's terminal or prohibited from being viewed.

[0166] Furthermore, the server 10 may determine whether or not a predetermined condition is satisfied before storing the attachment in the storage unit 30, and if the predetermined condition is satisfied, store the attachment in the storage unit 30. Alternatively, the server 10 may control the storage unit 30 to prohibit storage of the attachment if the predetermined condition is satisfied.

[0167] [14.6] Authentication Tokens The server 10 may notify an authentication token instead of a password. That is, when the server 10 accepts access based on the query L, the server 10 identifies the destination (B@yyy.com) from the query L and notifies the identified destination (B@yyy.com) of the authentication token.

[0168] The authentication token is a program or URL for generating a password (e.g., a one-time password) for accessing a file server, and may also be referred to as a security token. For example, when authentication is permitted based on a password generated using the authentication token in response to a user instruction, the server 10 decrypts an encrypted attachment and controls the decrypted attachment so that it can be downloaded or viewed. Furthermore, once authentication based on the authentication token from a user is permitted, the server 10 may maintain the authentication permission of the user for a predetermined period (e.g., 10 minutes after the authentication permission is granted).

[0169] [14.7] Controlling Receipt of Email The server 10 may also manage attachments in the above-described manner when functioning as a receiving server for importing received e-mails to the user side. Note that the server function for importing received e-mails to the user side includes, for example, POP (Post Office Protocol), IMAP (Internet Message Access Protocol), etc.

[0170] The following describes the case where the server 10 functions as a receiving server. First, the server 10 receives an email Mr (assuming the email ID is 002) sent from a sender (A@xxx.com) and addressed to a destination (B@yyy.com). The server 10 then determines whether or not an attachment exists for the received email Mr (hereinafter referred to as "received email"). If an attachment exists, the server 10 encrypts the attachment and stores the encrypted attachment in the attachment storage unit 40.

[0171] Then, the server 10 generates query information L (URL) that associates the destination (B@yyy.com) with the identification information of the attached file. The identification information of the attached file is information that can uniquely identify the attached file. For example, the server 10 generates query information L (URL) based on the destination (B@yyy.com) and the identification information of the attached file.

[0172] The server 10 then deletes the data portion of the attached file of the email Mr and stores the email Mr with the reference information L inserted in its place in the received email storage unit 50.

[0173] Then, for example, based on a reception instruction from user B of destination (B@yyy.com), the email Mr stored in the received email storage unit 50 is taken in as received email for user B.

[0174] When user B accesses the query information L included in the email Mr, the server 10 accepts the access of the query information L, identifies the destination (B@yyy.com) from the query information L, and notifies the identified destination (B@yyy.com) of the password.

[0175] When the server 10 receives access to the query information L, it performs password authentication, and if authentication is permitted, it decrypts the attachment stored in the attachment storage unit 40 and controls so that the decrypted attachment can be downloaded or viewed.

[0176] Note that the server 10 may also perform the processes listed in the above-mentioned application examples when functioning as a receiving server.

[0177] The received mail storage unit 50 and the attached file storage unit 40 may be a storage area of ​​the server 10, or may be a storage area on the cloud (for example, a storage area on the Internet that can be connected to the server 10 and the terminal 20 via the Internet).

[0178] [14.8] Download location In this embodiment, the download destination of the attached files etc. may be not only the user's terminal 20 but also a storage area on the cloud.

[0179] In other words, controlling the attachment so that it can be downloaded to the user side includes not only making the attachment downloadable to the terminal 20 of the user, but also making the attachment so that it can be stored in a storage area on the Internet that can be connected to the terminal 20 via the Internet in association with the user ID of the user (so that the user can access it). .

[0180]

[15] Other The email in this embodiment is not limited to SMTP, and may be sent and received using any given protocol.

[0181] Furthermore, the data of this embodiment, for example, email data, may be stored in the storage unit 30 or in a storage area on the Internet.

[0182] In addition, the server 10 of this embodiment may encrypt attachments to all received e-mails, or may control to encrypt attachments to e-mails that satisfy given rule conditions. For example, the server 10 may set rule conditions in advance based on input information from an administrator or a user.

[0183] In this embodiment, the concept of control to enable downloading may include control to enable printing, and the concept of control to prohibit downloading may include control to prohibit printing. [Explanation of symbols]

[0184] 10 servers, 20 terminals, 30 storage units, 100 Processing unit, 111 Receiving unit, 112 Analysis unit, 113 Encryption processing unit, 114 Transmission unit, 115 Notification unit, 116 Storage processing unit, 117 Query information generation unit, 118 Password generation unit, 119 File control unit, 120 Web processing unit, 170 Storage unit, 171 Main memory unit, 172 user information memory unit, 173 management data memory unit, 180 information storage medium

Claims

1. A file management system that manages attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that deletes the attachment of the email, inserts the first inquiry information into the email, and sends the email to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; a file control unit that, when receiving the second query information from a user, decrypts the attached file associated with the second query information; The file control unit A file management system that controls the decrypted attached file so that it can be stored in a storage area on the Internet in association with the user ID of the user.

2. A file management system that performs processing to manage attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that deletes the attachment of the email, inserts the first inquiry information into the email, and sends the email to the destination; When the first inquiry information is received, the address associated with the first inquiry information is a notification unit that first notifies the second query information; a file control unit that, when receiving the second query information from a user, decrypts the attached file associated with the second query information; The second inquiry information is It's a URL, not a password. The file control unit A file management system characterized in that, when an access to the URL is received from a user, the system decrypts the attached file associated with the URL.

3. In claim 1 or 2, The file control unit A file management system that controls the decrypted attached file so that it can be downloaded to the user's terminal or can be viewed.

4. In claim 3, The file control unit A file management system characterized in that anti-virus processing is performed on the decrypted attached file before it is downloaded to the user's terminal or before it is viewed.

5. In claim 3 or 4, The file control unit A file management system characterized by determining whether a specified condition is met before downloading or viewing the file to the user's terminal, and if the specified condition is met, controlling the decrypted attachment so that it can be downloaded to the user's terminal, or controlling it so that it is prohibited from being downloaded to the user's terminal.

6. In any one of claims 3 to 5, The file control unit A file management system characterized by determining whether or not a specified condition is met before downloading or viewing the file to the user's terminal, and if the specified condition is met, controlling the decrypted attachment so that it can be viewed on the user's terminal, or controlling it so that it is prohibited from being viewed on the user's terminal.

7. In any one of claims 1 to 6, The query information generation unit A file management system that generates a first query and a second query that associate the destination with the encrypted multiple attachments when a single email contains multiple attachments.

8. An information processing device that performs processing to manage attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that deletes the attachment of the email, inserts the first inquiry information into the email, and sends the email to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; a file control unit that, when receiving the second query information from a user, decrypts the attached file associated with the second query information; The file control unit An information processing device characterized by controlling the decrypted attached file so that it can be stored in a storage area on the Internet in association with the user ID of the user.

9. An information processing device that performs processing to manage attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that deletes the attachment of the email, inserts the first inquiry information into the email, and sends the email to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; a file control unit that, when receiving the second query information from a user, decrypts the attached file associated with the second query information; The second inquiry information is It's a URL, not a password. The file control unit When an access to the URL is received from a user, the information processing device decrypts the attached file associated with the URL.

10. A program that causes a computer to perform a process for managing attachments to emails with specified destinations, a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; a sending unit that deletes the attachment of the email, inserts the first inquiry information into the email, and sends the email to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; causing the computer to function as a file control unit that decrypts an attached file associated with the second query information when the second query information is received from a user; The file control unit A program that controls the decrypted attachment file so that it can be stored in a storage area on the Internet in association with the user ID of the user.

11. A program that causes a computer to perform a process for managing attachments to emails with specified destinations, comprising: a receiving unit for receiving an email sent from a sender; an encryption processing unit that encrypts the attached file of the email; a storage processing unit that stores the encrypted attachment in a storage unit; a query generating unit that generates first query information and second query information that associate the destination with the encrypted attachment; The attachment of the email is deleted, and the first inquiry information is inserted into the email. a sending unit that sends the email to the destination; a notification unit that, when receiving the first query, notifies the destination associated with the first query of the second query; causing the computer to function as a file control unit that decrypts an attached file associated with the second query information when the second query information is received from a user; The second inquiry information is It's a URL, not a password. The file control unit A program characterized by decrypting an attached file associated with the URL when access to the URL is accepted from a user.

12. An information processing method in which a computer manages attachments to emails with specified destinations, comprising: The computer receiving an email sent from a sender; a step of encrypting the attachment of the email; a step of storing the encrypted attachment in a storage unit; generating first and second queries that associate the destination with the encrypted attachment; removing the attachment from the email, inserting the first query information into the email, and sending the email to the destination; When the first inquiry information is received, notifying the destination associated with the first inquiry information of the second inquiry information; and when the second query information is received from a user, decoding the attached file associated with the second query information, The decoding step includes: An information processing method characterized by controlling the decrypted attached file so that it can be stored in a storage area on the Internet in association with the user ID of the user.

13. An information processing method in which a computer manages attachments to emails with specified destinations, comprising: The computer receiving an email sent from a sender; a step of encrypting the attachment of the email; a step of storing the encrypted attachment in a storage unit; generating first and second queries that associate the destination with the encrypted attachment; removing the attachment from the email, inserting the first query information into the email, and sending the email to the destination; When the first inquiry information is received, notifying the destination associated with the first inquiry information of the second inquiry information; and when the second query information is received from a user, decoding the attached file associated with the second query information, The second inquiry information is It's a URL, not a password. The decoding step includes: An information processing method, comprising the steps of: when receiving access to the URL from a user, decrypting an attached file associated with the URL.

Images