JP5510103B2 - Information processing system, information processing apparatus, information processing method, and computer program - Google Patents

Description

  The present invention relates to license management of software installed in each of a plurality of computers, and more particularly, to a technique for identifying a computer that is likely to violate a license by using a data file attached to data transmitted from the computer. .

  In general, companies, etc., manage software installed on each computer used for business by IT departments, etc. in order to comply with the license of computer software such as application programs (hereinafter simply referred to as “software”). .

  For this type of management, install a system for managing inventory information about the software installed on the computer, and install the software actually installed on computers connected to the corporate network. Inventory information is collected via the network, and centralized management is performed by server devices. A technique for collecting software inventory information and managing software licenses using the collected inventory information is disclosed in Patent Document 1, for example.

  However, in such a system, software inventory information is always collected from computers connected to the network, and the inventory information managed by the server is always consistent with the status of the software installed on each computer. I don't mean. For example, inventory may be collected several times a month on a predetermined day. When such operation is performed, it is malicious to install software that does not have a valid license to be installed on a computer, uninstall that software a predetermined day before inventory collection, and reinstall it. If it was introduced to a computer in a distorted form, there was a problem that the fraud could not be detected.

  In addition, companies have introduced a system that controls the relay of data sent to the outside in accordance with predetermined rules so that confidential information, personal information, etc. are not leaked from e-mail data sent from the inside to the outside. Sometimes.

  At this time, the destination of e-mail data acquired by the gateway device or proxy server for connecting the corporate network and the Internet, keywords included in the subject and body, presence / absence of attached file, size, data type, attached file Control rules are created using the included keywords as conditions, and processing such as prohibiting sending of e-mail data matching the rules to the outside is performed. A technique related to such e-mail data transmission control is disclosed in Patent Document 2, for example.

JP 2001-222424 A JP 2008-109381 A

  In general, a certain software and a file created by the software and editable by the software are managed in association with the extension of the file. Software installed in the computer can be specified to some extent from the extension of a file attached to an e-mail or the like sent from the computer. In other words, it can be estimated that there is a high possibility that the software associated with the extension of the file attached to the e-mail is installed in the computer.

  However, conventionally, a software asset management system and a communication control system such as e-mail data are not linked to each other, but operate as independent systems. Therefore, a computer that has sent an e-mail subject to communication control by the communication control system grasps whether the software associated with the file attached to the e-mail is a computer installed with a valid license. Until now there was no way of thinking.

  Recently, it is common to exchange data necessary for business by e-mail, and by linking these systems together, it is possible to delete illegally installed software immediately before collecting inventory information. It can be expected that the above problem for preventing the detection of the problem will be dealt with suitably and the possibility of finding illegally installed software will be increased.

  Therefore, in view of the above, the present invention links a system (apparatus) for managing software assets with a system (apparatus) for controlling communication of data such as e-mail sent to the outside, and illegally An object of the present invention is to provide an information processing system, an information processing apparatus, an information processing method, and a computer program for early discovery of a computer on which software is installed.

  In order to achieve the above object, an information processing system of the present invention comprises the following arrangement. That is, an information processing system including a client device, a first server device that manages software installed in the client device, and a second server device that performs relay control of communication data transmitted from the client device. The first server device is installed in the client device in response to a request from the first storage means for storing software installed in the client device and the second server device. Transmission means for transmitting the software information to the second server, wherein the second server apparatus obtains the communication data transmitted from the client apparatus, and the first server apparatus, Software installed on the client device that transmitted the communication data Request means for requesting information from the first server device, first determination means for determining whether the communication data acquired by the acquisition means includes an attached file, and the communication data by the first determination means When it is determined that the file contains an attached file, it is determined whether the software information transmitted from the first server device according to the request means includes software corresponding to the file format of the attached file. And a relay control unit that prohibits relaying of the communication data when it is determined by the second determination unit and the second determination unit that software corresponding to the file format of the attached file is not included. A featured information processing system.

  In order to achieve the above object, an information processing apparatus of the present invention has the following configuration. That is, an information processing device that performs communication control of communication data transmitted from a client device, an acquisition unit that acquires communication data transmitted from the client device, and an attachment file that is attached to the communication data acquired by the acquisition unit A first determination unit that determines whether or not the file is included; and when the first determination unit determines that the communication data includes an attachment file, the attachment file is transmitted to the client device that has transmitted the communication data. A second determination unit that determines whether software corresponding to the file format is installed and the second determination unit determines that the software corresponding to the file format of the attached file is not installed; An information processing apparatus comprising: a relay control unit that prohibits relaying of the communication data.

  In order to achieve the above object, an information processing method of the present invention comprises the following arrangement. That is, an information processing method performed by an information processing apparatus that performs communication control of communication data transmitted from a client apparatus, the acquisition process acquiring the communication data transmitted from the client apparatus, and the acquisition process A first determination step of determining whether or not an attachment file is included in the communication data; and a client that has transmitted the communication data when it is determined in the first determination step that the communication data includes an attachment file In the second determination step for determining whether software corresponding to the file format of the attached file is installed in the apparatus, and in the second determination step, software corresponding to the file format of the attached file is not installed. A relay control step for prohibiting relaying of the communication data when it is determined that Information processing method for the butterflies.

  In order to achieve the above object, the computer program of the present invention comprises the following arrangement. That is, a computer program for causing a computer to function as an information processing device that performs communication control of communication data transmitted from a client device, wherein the computer acquires the communication data transmitted from the client device And a first determination unit that determines whether an attachment file is included in the communication data acquired by the acquisition unit, and a case where it is determined by the first determination unit that the communication data includes an attachment file. The second determination means for determining whether software corresponding to the file format of the attached file is installed in the client device that has transmitted the communication data, and the second determination means converts the file format of the attached file to If it is determined that the corresponding software is not installed, A computer program for causing to function as a relay control means for inhibiting relaying of data.

  According to the present invention, when an attached file is attached to an e-mail or the like subject to communication control, the computer that sent the e-mail or the like has the software corresponding to the type of the attached file properly installed. Determine if it is a computer. As a result, it can be expected that a computer in which software is illegally installed will be discovered at an early stage.

It is a figure which shows an example of the system configuration | structure of the information processing system in this invention. It is a figure which shows an example of the hardware constitutions of the computer applicable as an information processing apparatus of this invention. It is a figure which shows an example of a function structure of the information processing apparatus of this invention It is a flowchart which shows the outline | summary of the process performed by the information processing apparatus of this invention. 5 is a flowchart showing details of “relay control rule setting processing” in step S402 of FIG. 4. 5 is a flowchart showing details of “relay control processing” in step S404 of FIG. 4. It is a flowchart which shows the detail of the "webmail communication determination process" of step S603 of FIG. It is a flowchart which shows the detail of the "web data relay control process" of step S605 of FIG. 7 is a flowchart showing details of “mail data acquisition processing” in step S606 of FIG. 6. 7 is a flowchart showing details of “mail data relay control processing” in step S607 of FIG. 6. 11 is a flowchart showing details of “user use SW (software) correspondence determination processing” in steps S810 and 816 in FIG. 8 and steps S1010 and 1016 in FIG. It is a figure which shows an example of a structure of a relay control rule setting screen. It is a figure which shows an example of a structure of a relay control rule (web) setting screen. It is a figure which shows an example of a structure of a relay control rule (mail) setting screen. An example of the configuration of the webmail service information setting screen It is a figure which shows an example of a data structure of the relay control rule (web) data table registered into relay control rule DB. It is a figure which shows an example of a data structure of the relay control rule (mail) data table registered into relay control rule DB. It is a figure which shows an example of a data structure of the web mail service information data table registered into relay control rule DB. It is a figure which shows an example of a data structure of the category data table registered into relay control rule DB. It is a figure which shows an example of a data structure of the installation software data table registered into asset management DB. It is a figure which shows an example of a data structure of a file format data table.

  Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing an example of the configuration of an information processing system according to the present invention. In the figure, 101 is a relay server, and HTTP data and mail transmitted from the client PCs 105-1 to 105-4 (hereinafter collectively referred to as client PC 105) to the external web server 107 and web mail server 108. A device that performs relay control using various data registered in the relay control rule DB (database) 102 for e-mail data transmitted to the server 109, and functions as the information processing device of the present invention. It is a device to do.

  A relay control rule DB (database) 102 is used when the relay server 101 performs relay control processing on data transmitted from the client PC 105 to the external web server 107, web mail server 108, and mail server 109. It is a database for registering various data.

  Reference numeral 103 denotes an asset management server that periodically collects information about software installed in the client PC 105 and registers it in the asset management DB 104. Also, in response to a request from the relay server 101, information on software that is properly installed in the designated client PC 105 is transmitted to the relay server 101.

  Reference numeral 104 denotes an asset management DB (database), which is a database that stores and manages information on software installed on each client PC 105 under a valid license. If software that is not registered in the asset management DB 104 is installed in the client PC 105, it means that the software is illegally installed.

  A client PC 105 is a computer used by a user who uses various web services provided by the web server 108, a web mail service provided by the web mail server 109, a mail transmission / reception service provided by the mail server 110, and the like. .

  Reference numeral 106 denotes an LDAP (Lightweight Directory Access Protocol) server that provides a directory service for managing corporate directory information, that is, information on users and organizations using the network. The directory service applicable to the present invention is not limited to LDAP, and may be Active Directory or the like.

  Reference numeral 107 denotes a network such as a LAN (local area network) for connecting the various devices described above so that they can communicate with each other. The connection form may be wired / wireless.

  108 is a web server, 109 is a web mail server, and 110 is a mail server, which is a server device that provides various services to devices connected via the wide area network 111. The wide area network 111 is a network for connecting the various devices described above so that they can communicate with each other. This completes the description of the system configuration of the information processing system of the present invention.

  Next, the hardware configuration of the information processing apparatus applicable to the relay server 101 will be described with reference to FIG. FIG. 2 is a block diagram illustrating an example of a hardware configuration of an information processing apparatus applicable to the relay server 101.

  In the figure, a CPU 201 comprehensively controls each device and controller described later connected to a system bus 204. In addition, the ROM 203 or the external memory 211 is necessary for the BIOS (Basic Input / Output System) or the operating system program (hereinafter referred to as OS) that is a control program of the CPU 201 and the relay server 101 to execute various processes described later. Various programs and data are stored. The RAM 202 functions as a main memory, work area, and the like for the CPU 201.

  The CPU 201 implements various processes to be described later by loading a program or the like necessary for executing the process into the RAM 202 and executing the program. An input controller (input C) 205 controls input from an input device 209 configured with a keyboard, a pointing device, and the like. A video controller (VC) 206 controls display on a display device such as the display device 210. The display device 210 is composed of, for example, a CRT display or a liquid crystal display.

  A memory controller (MC) 207 is a hard disk (HD), floppy disk (registered trademark FD) or PCMCIA card slot for storing boot programs, browser software, various applications, font data, user files, editing files, various data, and the like. Controls access to an external memory 211 such as a compact flash memory connected via an adapter.

  A communication I / F controller (communication I / FC) 208 is connected to and communicates with an external device via a network, and executes communication control processing in the network. For example, Internet communication using TCP / IP is possible.

  Note that the CPU 201 enables display on the display device 210 by executing outline font rasterization processing on a display information area in the RAM 202, for example. Further, the CPU 201 enables a user instruction with a mouse cursor (not shown) on the display device 210. The above is the description of the hardware configuration of the information processing apparatus applicable to the relay server 101.

  The hardware configuration of the relay server 101 is described as having the configuration illustrated in FIG. 2, but is not necessarily limited to the configuration illustrated in FIG. 2, and various processes described below performed by the relay server 101 are executed. Needless to say, the hardware configuration of the relay server 101 can be appropriately changed if possible. The hardware configuration of the information processing apparatus applied to the asset management server 103, the client PC 105, the LDAP server 106, the web server 108, the web mail server 109, and the mail server 110 shown in FIG.

  Next, an example of a functional configuration of the relay server 101 will be described with reference to FIG. As illustrated in FIG. 3, the relay server 101 includes a relay control rule reception unit 301, a relay control rule recording unit 302, an external transmission data acquisition unit 303, a mail information acquisition unit 304-1, an attached file information acquisition unit 304-2, and a relay. A relay control unit 304 including a control rule application unit 304-3, a software confirmation unit 304-4, a communication permission / denial response transmission unit 305, and a software warning notification unit 306 are provided.

  The relay control rule receiving unit 301 is a functional unit that performs a relay control rule setting process (details are shown in FIG. 5) described later. The relay control rule recording unit 302 is a functional unit that records the relay control rule set in the relay control rule setting process in the relay control rule DB 102.

  The external transmission data acquisition unit 303 acquires communication data instructed to be transmitted to an external network to be subjected to relay control processing by a relay control unit 304 described later. The relay control unit 304 relays the communication data acquired by the external transmission data acquisition unit 303 using various data registered in the relay control rule DB 102 and software asset management information managed by the asset management DB 104. It is a functional unit that performs processing (details are shown in FIG. 6).

  When the communication data acquired by the external transmission data acquisition unit 303 is web mail data transmitted to the web mail server 109, the mail information acquisition unit 304-1 includes mail information (addressee) included in the webmail data. Information, text information, subject information, mail text information, etc.).

  The attached file information extracting unit 304-2 is a functional unit that acquires an attached file included in the communication data acquired by the external transmission data acquiring unit. The relay control rule application unit 304-3 is a functional unit that determines whether or not the communication data satisfies the relay control rule by applying the relay control rule registered in the relay control rule DB 102 to the communication data.

  The software confirmation unit 304-4 determines whether software capable of editing the attached file extracted by the attached file information extracting unit 304-4 is properly installed in the client PC 105 that has transmitted the communication data, by using the extension of the attached file. This is the functional unit to be confirmed originally. The relay control unit 304 performs relay control of communication data acquired by the external transmission data acquisition unit 303 according to the processing results of the relay control rule application unit 304-3 and the software confirmation unit 304-4.

  The communication permission / denial response transmission unit 305 is a functional unit that notifies the result of the relay control processing of communication data by the relay control unit 304 to the client PC 105 that has transmitted the communication data. Based on the processing of the software confirmation unit 304-4, the software warning notification unit 306 may not properly install software for editing the attached file included in the communication data on the client PC 105 that has transmitted the communication data. This is a functional unit for notifying the software asset manager when it is determined that there is a problem.

  The above is the description of the functional configuration of the relay server 101. Note that a program for causing the relay server 101 to function as each of the functional units described above is stored in the external memory 211, and the CPU 201 loads the program into the RAM 202 as necessary, and performs processing according to control of the loaded program. By executing the above, the above functional units are realized.

  Hereinafter, an outline of processing performed by the relay server 101 will be described with reference to FIG. 4. FIG. 4 is a flowchart showing an outline of processing performed by the relay server 101. When executing this processing, the CPU 201 of the relay server 101 loads a program for causing the CPU 201 to execute this processing from the external memory 211 to the RAM 202, and executes processing according to the program loaded in the RAM 202. Perform the process shown.

  If the CPU 201 determines that a relay control rule setting change request from the client PC 105 has been received (YES in step S401), the process proceeds to step S402 to perform a relay control rule setting process. The details of this relay control rule setting process will be described later with reference to FIG. Note that the CPU 201 of the relay server 101 accepts a relay control rule setting change request by accepting a connection from the client PC 105 to a specific web page provided by the relay server 101.

  In addition, when the CPU 201 determines that the communication data transmitted from the client PC 105 to the external web server 108, the web mail server 109, the mail server 110, and the like has been acquired (function of the external transmission data acquisition unit 303). (YES in step S403), relay control processing is performed on the communication data (step S404). Details of this relay control processing will be described later with reference to FIG.

  Then, the CPU 201 repeats the process shown in this figure until it is determined that an instruction to end the relay control process has been received (YES in step S405). The above is an outline of the processing performed by the relay server 101.

  Next, details of the relay control rule setting process in step S402 of FIG. 4 will be described with reference to FIG. This process is a process performed by the relay control rule receiving unit 301 and the relay control rule recording unit 302 of the relay server 101. When executing this process, the CPU 201 uses the CPU 201 stored in the external memory 211 as a relay control rule. A program for functioning as the accepting unit 301 and the relay control rule recording unit 302 is loaded into the RAM 202, and this processing is performed according to the control of the program loaded into the RAM 202.

  First, the CPU 201 transmits screen information for displaying a relay control rule setting screen to the client PC 105 that has made a relay control rule setting change request to the relay server 101 (step S501). The relay control rule setting screen 1200 shown in FIG. 12 is displayed on the display device of the client PC 105 that has received the screen information.

  Here, the configuration of the relay control rule setting screen will be described with reference to FIG. FIG. 12 is a diagram illustrating an example of a configuration of a relay control rule setting screen displayed on the display device of the client PC 105.

  Here, an example of the configuration of the relay control rule setting screen will be described with reference to FIG. FIG. 12 is a diagram illustrating an example of a configuration of a relay control rule setting screen displayed on the display device of the client PC 105.

  In the relay control rule setting screen 1200, a relay control rule (web) list display unit 1201 and a relay control rule (mail) list display unit 1211 are set. In the relay control rule (web) list display unit 1201, an ID display unit 1202, an explanation display unit 1203, an operation unit 1204, and an add button 1205 are set. In addition, an edit button 1204-1 and a delete button 1204-2 are set in the operation unit 1204.

  In ID 1202, ID information for uniquely identifying the relay control rule (web) is displayed. The explanation display unit 1203 displays a description of the relay control rule (web). The edit button 1204-1 is a control used to transmit a relay control rule setting change request to the relay server 101. The CPU of the client PC 105 allows the CPU of the client PC 105 to accept a click instruction for the edit button 1204-1. Then, a setting change request for the relay control rule (web) displayed in the row in which the edit button 1204-1 that has received the click instruction is set is issued to the relay server 101.

  The delete button 1204-2 is a control used to make a relay control rule deletion request to the relay server 101. By accepting a click instruction to the delete button 1204-2, the CPU of the client PC 105 relays the relay button. A request to delete the relay control rule (web) displayed in the row in which the delete button 1204-2 that has received a click instruction from the server 101 is set is issued to the relay server 101. The add button 1205 is a control used to make a relay control rule addition request to the relay server 101.

  Similarly, an ID display unit 1212, an explanation display unit 1213, an operation unit 1214, and an add button 1215 are set in the relay control rule (mail) list display unit 1211. In addition, an edit button 1214-1 and a delete button 1214-2 are set in the operation unit 1214. Since these functions are substantially the same as those set in the relay control rule (web) list display unit 1201, detailed description thereof will be omitted.

  The relay control rule setting screen 1201 includes a check box 1221 for specifying whether or not to perform relay control using a relay control rule (mail) for web mail data, a web mail service edit button 1222, a default. A relay rule designation unit 1223 and an OK button 1224 are set.

  The check box 1223 uses the relay control rule (mail) used for relay control of SMTP communication, instead of the relay control rule (web) used for relay control of HTTP communication, for the web mail data communicated by HTTP. This control is used to specify whether relay control is to be performed (checked) or not (not checked). Webmail is a technology that communicates email using HTTP, so it doesn't just include a specific keyword, but also whether the keyword is in the subject or in the body, and email is sent In some cases, relay control using a relay control rule similar to an e-mail on the condition of the destination and the number of destinations is desired, and the present invention employs such a configuration.

  The web mail service edit button 1222 is a control used to transmit a setting change request for web mail service information to the relay server 101. When a click instruction for the web mail service edit button 1222 is received, The CPU issues a web mail service information setting change request to the relay server 101.

  The default relay rule designating unit 1223 is a designating unit for designating a relay control method for communication not corresponding to all registered relay control rules, and relay, prohibition, and hold can be selected. When relay is selected, the relay server 101 is caused to perform relay control for relaying communication that does not correspond to all relay control rules. When prohibition is selected, the relay server 101 performs relay control for prohibiting relaying. When the hold is selected, the communication of the data is temporarily suspended, and the relay permission / rejection designation is accepted from the user who uses the client PC 105 that has transmitted the data or the superior of the user, Relay control will be performed according to the specification.

  An OK button 1224 is a control used to end the display of the relay control rule setting screen 1200. The above is the description of the configuration of the relay control rule setting screen in FIG.

  Returning to the description of FIG. The CPU 201 transmits screen information for displaying the relay control rule setting screen 1200 to the client PC 105, and then transmits the edit button 1204-1 or the add button 1205 in the relay control rule setting screen 1200 displayed on the client PC 105. When the CPU of the client PC 105 receives a pressing instruction from a pointing device or the like and receives a relay control rule (web) setting change request issued to the relay server 101 (YES in step S502), the relay control rule (web) Screen information for displaying the relay control rule (web) setting screen 1300 is transmitted to the client PC 105 that has made the setting change request to the relay server (step S503). The relay control rule (web) setting screen 1300 shown in FIG. 13 is displayed on the display device of the client PC 105 that has received the screen information.

  Here, an example of the configuration of the relay control rule (web) setting screen will be described with reference to FIG. FIG. 13 is a diagram illustrating an example of the configuration of a relay control rule (web) setting screen displayed on the display device of the client PC 105.

  As illustrated in FIG. 13, the relay control rule (web) setting screen 1300 includes an ID display unit 1301, a priority designation unit 1302, a rule name input unit 1303, an explanation input unit 1304, a URL condition setting unit 1305, and a keyword condition setting unit 1306. , An attached file condition setting unit 1307, an operation specifying unit 1308, an OK button 1309, and a cancel button 1310 are set.

  The ID display unit 1301 is a display unit that displays ID information for uniquely identifying the relay control rule (web). The priority designation unit 1302 is a designation unit that designates the priority of application of the relay control rule (web). The CPU 201 of the relay control server 101 performs this priority designation unit 1302 for the relay control target communication. By applying the relay control rules (web) in the order of priority specified in (1), communication relay control is performed.

  The rule name input unit 1303 is an input unit for inputting a rule name. The description input unit 1304 is an input unit for inputting a description of the rule, and information input here is displayed on the description display unit 1203 in FIG.

  The URL condition setting unit 1305 is a setting unit for setting a communication destination to be subjected to relay control. The URL / category specifying unit 1305-1, the URL input unit 1305-2, and the category specifying unit 1305-3 include Is set.

  The URL / category designation unit 1305-1 is a designation unit that designates whether the destination designation is performed by URL designation or category designation. When a URL is selected, the URL input unit 1305-2 selects the category. When is selected, the category designation section 1305-3 is enabled, and the URL can be input and the category can be designated. The URL input unit 1305-2 is an input field for inputting URL conditions. The CPU 201 of the relay server 101 determines that the URL input to the URL input unit 1305-2 matches, for example, HTTP communication set in the request URL.

  The category designation unit 1305-3 is a designation unit for designating a category. The CPU 201 of the relay server 101 determines that the HTTP communication in which the URL belonging to the category designated by the category designation unit is set as the request URL matches this condition. This determination is made according to the category data table 1900 registered in the relay control rule DB 102.

  Here, the configuration of the category data table registered in the relay control rule DB 102 will be described with reference to FIG. As shown in FIG. 19, the category data table 1900 includes a URL 1901 and a category 1902.

  In the URL 1901, a URL for which a category is set is registered. In the category 1902, the category to which the web page indicated by the URL registered in the URL 1901 belongs is registered. In the category 1902, for example, a plurality of categories can be registered using “,” or the like as a delimiter. The above is the description of the category data table in FIG.

  Returning to the description of FIG. The keyword condition setting unit 1306 is used to set keyword conditions. A keyword condition input field 1306-1 is set in the keyword condition setting unit 1306, and a keyword condition can be input. In this input field, it is possible to input a plurality of keywords. By using “|” indicating logical sum, “*” indicating logical product, etc. as keyword separators, keywords input in the keyword input field It is possible to input conditions such as when any of the above is included or when all are included.

  The attached file condition setting unit 1307 is a setting unit that sets conditions for an attached file attached to communication. In the attached file condition setting unit 1307, a MIME type input field 1307-1, a size input field 1307-2, and a size condition specifying unit 1307-3 are set. The MIME type input field 1307-1 is an input field for inputting a MIME type, and it is possible to input a plurality of conditions using “,” or the like as a delimiter. The size input field 1307-2 is an input field for inputting a file size. The size condition designation unit 1307-3 is a designation unit that designates a file size condition, and sets any of the following.

  The operation designation unit 1308 is a designation unit for designating an operation for communication that matches various conditions set by the URL condition setting unit 1305, the keyword condition setting unit 1306, and the attached file condition setting unit 1307. An operation designation field is set in the operation designation unit 1308, and relay or prohibition can be selected as the operation. Of course, it is possible to add another hold as in the default rule and to select another operation.

  An OK button 1309 is a control used for confirming various conditions and operations input via this screen. When the instruction to press the OK button 1309 is received, the CPU of the client PC 105 transmits various data input via the screen as input information to the relay server 101. A cancel button 1310 is a control used to end the process via this screen. The above is the description of the configuration of the relay control rule (web) setting screen of FIG.

  Next, the data structure of the relay control rule (web) data table registered in the relay control rule DB 102 will be described with reference to FIG. FIG. 16 is a diagram illustrating an example of a data configuration of the relay control rule (web). In this data table, the relay control rule data input via the relay control rule (web) setting screen 1300 in FIG. 13 is registered.

  As shown in FIG. 16, the relay control rule (web) data table includes, as data items, ID 1601, priority 1602, rule name 1603, description 1604, URL condition 1605, keyword condition 1606, attached file condition 1607, and operation 1608. I have.

  In ID 1601, the ID information displayed on the ID display unit 1301 in FIG. 13 is registered. In the priority 1602, the priority designated by the priority designation unit 1302 is registered. In the rule name 1603, the rule name input to the rule name input unit 1303 is registered. In the description 1604, the description information input to the description input unit 1304 is registered.

  In the URL condition 1605, various information set by the URL condition setting unit 1305 in FIG. 13 is registered. As the URL condition data, category 1605-1 and condition 1605-2 are set in the relay control rule (web) data table, and the category 1605-1 is designated by the URL / category designation unit 1305-1 in FIG. If the URL or category classification information is a URL, or the category 1605-1 is a URL as a condition, the URL information input to the URL input section 1305-2 of FIG. The category specified in 3 is registered.

  In the keyword condition 1606, the keyword condition input in the keyword condition input field 1306-1 in FIG. 13 is registered. In the attached file condition 1607, the attached file condition set in the attached file condition setting unit in FIG. 13 is registered. As attachment file condition data, a MIME type 1607-1 and a size 1607-2 are set in the relay control rule (web) data table, and the MIME type 1607-1 is a MIME type input field 1307-1 in FIG. In the size input 1607-2, the size input condition 1307-2 is registered with a size matching condition consisting of the size conditions specified in the size input field 1307-2 and the size condition specifying unit 1307-3 in FIG.

  In the operation 1608, the operation specified by the operation specifying unit 1308 in FIG. 13 is registered. The above is the description of the data configuration of the relay control rule (web) data table of FIG.

  Returning to the description of FIG. In addition, the CPU 201 accepts an instruction to press the edit button 1214-1 or the add button 1215 on the relay control rule setting screen 1200 displayed on the client PC 105 by a pointing device, etc., so that the CPU of the client PC 105 accepts the relay server 101. When the issued relay control rule (mail) setting change request is received (YES in step S504), the relay control rule (mail) setting change request (relay control rule (mail) setting change request) is sent to the client PC 105 that made the relay server. Mail) Screen information for displaying the setting screen 1400 is transmitted (step S505). The relay control rule (mail) setting screen 1400 shown in FIG. 14 is displayed on the display device of the client PC 105 that has received the screen information.

  Here, an example of the configuration of the relay control rule (mail) setting screen will be described with reference to FIG. FIG. 14 is a diagram illustrating an example of a configuration of a relay control rule (mail) setting screen displayed on the display device of the client PC 105.

  As shown in FIG. 14, the relay control rule (mail) setting screen 1400 includes an ID display unit 1401, a priority designation unit 1402, a rule name input unit 1403, a description input unit 1404, a transmission user condition setting unit 1405, and a destination condition setting. A section 1406, a keyword condition setting section 1407, an attached file condition setting section 1408, an operation specifying section 1409, an OK button 1410, and a cancel button 1411 are set.

  The ID display unit 1401 is a display unit that displays ID information for uniquely identifying a relay control rule (mail). The priority designation unit 1402 is a designation unit that designates the priority of application of the relay control rule (mail). The CPU 201 of the relay control server 101 performs this priority designation unit 1302 for the relay control target communication. By applying the relay control rules (mails) in the order of priority specified in the above, communication relay control is performed.

  The rule name input unit 1403 is an input unit for inputting a rule name. The description input unit 1404 is an input unit for inputting a description of the rule, and information input here is displayed on the description display unit 1213 of FIG.

  A transmission user condition setting unit 1405 is a designation unit for designating a sender condition of an electronic mail (or web mail), and includes a user / group designation unit 1405-1, a user input field 1405-2, a user information reference button. 1405-3, a group input field 1405-4, and a group information reference button 1405-5 are set.

  A user / group designation unit 1405-1 is a designation unit that designates whether the transmission user condition is specified by user designation or group designation. When a user is selected, a user input field 1405-2 and a user information reference button 1405-3 are enabled. When a group is selected, a group input field 1405-4 and a group reference button 1405-5 are enabled. Users and groups can be specified.

  The user input field 1405-2 is an input field for inputting the user condition of the transmission user. Here, as the user condition, a method of inputting user information managed by the LDAP server 106, a method of inputting a sender's mail address, or the like can be adopted. The user reference button 1405-3 is a control used for acquiring user information managed by the LDAP server 106 and displaying a screen (not shown) for receiving user selection input. Information on the user selected via the screen (not shown) is displayed in the user input field 1405-2.

  A group input field 1405-4 is an input field for inputting a user group to which the relay control rule being created is applied. For example, a group managed by the LDAP server 106 is input here. The group information reference button 1405-5 is a control used for acquiring group information managed by the LDAP server 106 and displaying a screen (not shown) for accepting an input of group selection. Information on the group selected via the screen (not shown) is displayed in the group input field 1405-4.

  The destination condition setting unit 1406 is a setting unit that sets e-mail (or web mail) destination conditions. The destination condition specifying unit 1406-1, the address / group specifying unit 1406-2, the address input unit 1406-3, A group input unit 1406-4, a matching condition setting unit 1406-5, and a simultaneous transmission upper limit number input field 1406-6 are set.

  The destination condition designating unit 1406-1 displays the e-mail address input in the user input field 1406-3 or the e-mail address corresponding to the user included in the group input in the group input field 1406-4, where ( TO, CC, BCC), and a designation unit for designating a condition that the condition is met, and options include TO, CC, BCC, and combinations thereof.

  The address / group designation unit 1406-2 is a designation unit for designating whether the destination condition is designated by an e-mail address or by a group. When the address is selected, the address input unit 1406-3 becomes valid, and when the group is selected, the group input field 1406-4 becomes valid, and the condition can be entered.

  An address input unit 1406-3 is an input field for inputting an address condition set as an e-mail destination to which this rule is applied. The group input unit 1406-4 is an input field for setting a group condition including a user set as an e-mail destination to which this rule is applied. In the address input field 1406-3, it is not necessary to input all the e-mail addresses, and only the domain may be input. In the case of the input of only the domain, when the mail address having the domain is set in the location (TO, CC, BCC) set in the destination condition specifying unit 1406-1, the relay control is performed if this condition is met. The CPU 201 of the server 101 makes a determination. In the group input field, not only the group managed by the LDAP server 106 but also a group registered in a group management data table (not shown) can be selected. The group management data table manages group names and e-mail address specifying information included in the groups. For example, in the case of a group outside the company, it is registered such as an e-mail address not including a domain used in the company.

  The matching condition setting unit 1406-5 is a selection unit for selecting a matching condition for an e-mail address or a group. Options include “matches with”, “does not match”, “includes”, and “does not include”. , Etc. are set.

  The simultaneous transmission upper limit number input column 1406-6 is an input column for inputting the upper limit of the number of destinations that can be simultaneously set for one electronic mail destination (TO and CC). If a large number of e-mail addresses are set and transmitted for one e-mail, there is a risk that the e-mail address may leak from the e-mail address. Therefore, it is possible to set such an upper limit.

The keyword condition setting unit 1407 is used for setting keyword conditions. In the keyword condition setting unit 1407, a keyword setting location condition specifying unit 1407-1 and a keyword condition input field 1407-2 are set, and a keyword condition can be input. The keyword setting location condition specifying unit 1407-1 is a setting unit for setting in which part of the e-mail the keyword input in the keyword condition input field 1407-2 matches the condition. “Subject”, “Body”, “Subject + Body” and the like are options. The keyword condition input field 1407-2 is an input field for inputting a keyword condition. A plurality of keywords can be input in this input field, and keywords entered in the keyword input field by using “|” indicating logical sum, “*” indicating logical product, etc. as separators of the keywords. It is possible to input conditions such as when any of the above is included or when all are included.

  The attached file condition setting unit 1408 is a setting unit that sets conditions for an attached file attached to communication. In the attached file condition setting unit 1408, a MIME type input field 1408-1, a size input field 1408-2, and a size condition specifying unit 1408-3 are set. The MIME type input field 1408-1 is an input field for inputting a MIME type, and it is possible to input a plurality of conditions using “,” or the like as a delimiter. The size input field 1408-2 is an input field for inputting a file size. The size condition designation unit 1408-3 is a designation unit that designates a file size condition, and sets any of the following.

  The operation specifying unit 1409 specifies an operation for communication that matches various conditions set by the transmission user condition setting unit 1405, the destination condition setting unit 1406, the keyword condition setting unit 1407, and the attached file condition setting unit 1408. This is the designation part. An operation designation field is set in the operation designation unit 1409, and relay or prohibition can be selected as the operation. Of course, it is possible to add another hold as in the default rule and to select another operation.

  An OK button 1410 is a control used to confirm various conditions and operations input via this screen. When receiving an instruction to press the OK button 1410, the CPU of the client PC 105 transmits various data input via this screen as input information to the relay server 101. A cancel button 1411 is a control used to end the processing via this screen. The above is the description of the configuration of the relay control rule (mail) setting screen of FIG.

  Next, the configuration of the relay control rule (mail) data table registered in the relay control rule DB 102 will be described with reference to FIG. FIG. 17 is a diagram showing an example of the data configuration of the relay control rule (mail) data table.

  As shown in FIG. 17, the relay control rule (mail) data table includes data items such as ID 1701, priority 1702, rule name 1703, description 1704, transmission user condition 1705, destination condition 1706, keyword condition 1707, and attached file condition. 1708 and operation 1709.

  In the ID 1701, ID information displayed on the ID display unit 1401 in FIG. 14 is registered. Similarly, the priority level designated by the priority level designation unit 1402 is registered in the priority level 1702. Similarly, the rule name input to the rule name input unit 1403 is registered in the rule name 1703. In the description 1704, the description information input to the description input unit 1404 is registered.

  In the transmission user condition 1705, various types of information set by the transmission user condition setting unit 1405 in FIG. 14 are registered. As the transmission user condition data, a division 1705-1 and a condition 1705-2 are set in the relay control rule (mail) data table, and the user / group designation unit 1405-1 shown in FIG. In the condition 1705-2, the user condition input in the user input field 1405-2 or the group condition input in the group input field 1405-4 is registered.

  In the destination condition 1706, various types of information set by the destination condition setting unit 1406 in FIG. 14 are registered. As the destination condition data, the relay control rule (mail) data table 1700 is set with a target address 1706-1 and an upper limit number 1706-2. For example, the target address 1706-1 includes “abc” in “abc”. information created from information set in the destination condition specifying unit 1406-1, the address input unit 1406-3 or the group input unit 1406-4, and the matching condition setting unit 1406-5, such as “.com” and “included”. be registered. In the upper limit number 1706-2, the numerical value input in the simultaneous transmission upper limit number input field 1406-6 is registered.

  In the keyword condition 1707, various types of information set by the keyword condition setting unit 1407 in FIG. 14 are registered. As keyword condition data, a position 1707-1 and a keyword 1707-2 are set in the relay control rule (mail) data table 1700. The selection information in the keyword setting location condition specifying unit 1407-1 is registered in the position 1707, and the keyword information input in the keyword condition input field 1407-2 is registered in the keyword 1707-2.

In the attached file condition 1708, the attached file condition set by the attached file condition setting unit 1408 in FIG. 14 is registered. As attachment condition data, a MIME type 1708-1 and a size 1708-2 are set in the relay control rule (mail) data table 1700. The MIME type 1708-1 includes a MIME type input field 1408- in FIG. In the information input in 1, a size matching condition including the size conditions specified in the size input field 1408-2 and the size condition specifying unit 1408-3 in FIG. 14 is registered in the size 1708-2. .

  In the operation 1709, the operation specified by the operation specifying unit 1409 in FIG. 14 is registered. The above is the description of the data configuration of the relay control rule (mail) data table 1700 of FIG.

  Returning to the description of FIG. Further, the CPU 201 is issued to the relay server 101 when the CPU of the client PC 105 accepts a pressing instruction by a pointing device or the like to the web mail service edit button 1222 of the relay control rule setting screen 1200 displayed on the client PC 105. When the web mail service information setting change request is accepted (YES in step S506), the web mail service setting screen 1500 is displayed on the client PC 105 that has sent the web mail service information setting change request to the relay server. Screen information is transmitted (step S507). The web mail service setting screen 1500 shown in FIG. 15 is displayed on the display device of the client PC 105 that has received the screen information.

  Here, the configuration of the webmail service setting screen will be described with reference to FIG. FIG. 15 is a diagram showing an example of the configuration of a web mail service setting screen displayed on the display device of the client PC 105. Via this screen, web mail service information used for acquiring various information (FROM, TO, CC, BCC, subject, text, attachment) from web mail communication is specified via this screen. .

  As shown in FIG. 15, the web mail service setting screen 1500 includes an ID display field 1501, a web mail service name input field 1502, a type setting unit 1503, a URL input field 1504, a caller input field 1505, a destination input field 1506, A CC input field 1507, a BCC input field 1508, a subject name input field 1509, a body text input field 1510, an attached input field 1511, an OK button 1512, and a cancel button 1513 are set.

  The web mail service name input field 1502 is an input field for inputting the name of the web mail service. An ID display field 1501 is a display field in which an ID for uniquely identifying the web mail service information is displayed. The type setting unit 1503 is a setting unit that sets the type of data to be transmitted by web mail communication specified by the web mail service information, and text, attachment, and text + attachment are set as options. Web mail communication methods differ depending on the web mail service, and there are those that send the text and attached file simultaneously in one communication, and those that send the text and attached file in different communications, so this condition setting is necessary .

  The URL input field 1504 is an input field for inputting URL information for specifying a web mail service site provided by the web mail server. A caller input field 1505 is an input field for inputting parameter variable information in which caller information is set when web mail is transmitted. A destination input field 1506 is an input field for inputting parameter variable information in which destination (TO) information is set when web mail is transmitted. A CC input field 1507 is an input field for inputting parameter variable information in which CC information is set when web mail is transmitted. A BCC input field 1508 is an input field for inputting parameter variable information in which BCC information is set when web mail is transmitted.

  The subject input field 1509 is an input field for inputting parameter variable information in which subject information is set when web mail is transmitted. A text input field 1510 is an input field for inputting parameter variable information in which text information is set when web mail is transmitted. The attachment input field 1511 is an input field for inputting parameter variable information in which information of an attached file is set at the time of web mail transmission. When the text is selected by the type setting unit 1503, the information input in the attachment input field 1511 is treated as invalid information, and when the attachment is selected, the information input in the text input field 1510 is treated as invalid information. It will be.

  The OK button 1512 is a control used for confirming various conditions and operations input via this screen. When receiving an instruction to press the OK button 1512, the CPU of the client PC 105 transmits various data input via this screen as input information to the relay server 101. A cancel button 1513 is a control used to end the processing via this screen. The above is the description of the configuration of the web mail service setting screen 1500 in FIG.

  Next, the data structure of the web mail service information data table will be described with reference to FIG. FIG. 18 is a diagram showing an example of the data structure of the web mail service information data table.

  As shown in FIG. 18, the web mail service information data table 1800 includes FROM 1805-1, TO 1805-2, CC 1805-3, BCC 1805-4 as ID 1801, web mail service name 1802, type 1803, URL 1804, and transmission data information 1805. Data items such as a subject 1805-5, a text 1805-6, and an attached 1805-7 are provided.

  ID 1801 is a data item for registering ID information for uniquely identifying web mail service information, and the ID information displayed in the ID display field 1501 in FIG. 15 is displayed. The web mail service name 1802 is a data item for registering the name of the web mail service, and the information input in the web mail service name input field 1502 of FIG. 15 is registered. A type 1803 is a data item for registering the type (text, attached) of data transmitted by communication specified by the web mail service information, and the information set by the type setting unit in FIG. 15 is registered. .

  The URL 1804 is a data item for registering a URL for specifying the web mail service, and information input in the URL input field 1504 in FIG. 15 is registered. The transmission data information 1805 is used to acquire web mail communication information, for example, a destination (TO, CC, BCC), a subject, a text, and an attached file from HTTP data transmitted to the URL registered in the URL 1804. Is registered.

  More specifically, FROM1805-1 is a data item for registering the variable name of the parameter variable in which FROM information is set in the HTTP data, and the information input in the sender input field 1505 in FIG. be registered. TO1805-2 is a data item for registering the variable name of the parameter variable in which the TO information is set in the HTTP data, and the information input in the destination input field 1506 in FIG. 15 is registered. CC 1805-3 is a data item for registering the variable name of the parameter variable in which the CC information is set in the HTTP data, and the information input in the CC input field 1507 in FIG. 15 is registered. The BCC 1805-4 is a data item for registering the variable name of the parameter variable in which the BCC information is set in the HTTP data, and the information input in the BCC input field 1508 in FIG. 15 is registered.

  A subject 1805-5 is a data item for registering a variable name of a parameter variable in which subject information is set in HTTP data, and information input in the subject input field 1509 in FIG. 15 is registered. A text 1805-6 is a data item for registering a variable name of a parameter variable in which text information is set in HTTP data, and information input in the text input field 1510 in FIG. 15 is registered. An attachment 1805-7 is a data item for registering a variable name of a parameter variable in which attachment file information is set in HTTP data, and information input in the attachment input field 1511 in FIG. 15 is registered. Using this data, the CPU 201 of the relay control server 101 specifies web mail transmission data in the HTTP data, or obtains mail information such as TO, CC, and text from HTTP data that performs web mail transmission. . The above is the description of the data structure of the web mail service information data table managed by the relay control rule DB 102.

  Returning to the description of FIG. In step S508, the CPU 201 inputs from the client PC 105 to each input unit of the relay control rule setting screen 1200, the relay control rule (web) setting screen 1300, the communication control rule (mail) setting screen 1400, and the web mail service setting screen 1500. When it is determined that the received input information has been acquired (YES), the data table in the relay control rule DB corresponding to the received input information is updated (step S509). That is, when the input information input via the relay control rule (web) setting screen 1300 is acquired, the relay control rule (web) data table 1600 is input via the relay control rule (mail) setting screen 1400. When the input information obtained is obtained, the relay control rule (mail) data table 1700 is obtained. When the input information entered via the web mail service setting screen 1500 is obtained, the web mail service information data table 1800 is obtained. Update. When the input data input via the relay control rule setting screen 1200 is acquired, a relay control rule data table (not shown) is updated.

  After the processing in step S509 is completed, screen information for displaying the relay control rule setting screen 1200 is created based on the updated relay control rule DB (step S510), and the screen information is transmitted to the client PC 105 (step S510). S501).

  On the other hand, if it is determined in step S508 that input information from the client PC 105 has not been received (NO), the process proceeds to step S511, and it is determined whether an end instruction for the relay control rule setting process has been received from the client PC 105. If it is determined that an end instruction has been received (YES in step S511), the process ends. The relay control unit 304 performs relay control processing to be described later using data in various data tables registered in the relay control rule DB in the relay control rule setting processing shown in FIG. The above is the description of the relay control rule setting process in step S402 of FIG.

  Next, details of the relay control process in step S404 of FIG. 4 will be described with reference to FIG. This process is mainly performed by the relay control unit 304 of the relay control server 101. When executing this process, the CPU 201 causes the CPU 201 stored in the external memory 211 to function as the relay control unit 304. The program is loaded into the RAM 202, and this processing is performed according to the control of the program loaded into the RAM 202. Here, a relay control process for data transmitted to the web server 108, the web mail server 109, and the mail server 110 will be described.

  First, the CPU 201 determines whether the communication data addressed to the outside acquired by the external transmission data acquisition unit 303 in step S403 of FIG. 4 is SMTP (Simple Mail Transfer Protocol) data (step S601). If the CPU 201 determines in step S601 that the data is SMTP data, that is, if it is determined that the data is electronic mail data (YES in step S601), the process proceeds to step S607 to perform mail data relay control processing. Details of this processing will be described later with reference to FIG.

  On the other hand, if it is determined in step S601 that the data is not SMTP data (NO), it is determined whether or not the externally transmitted communication data acquired by the external transmission data acquisition unit 303 in step S403 in FIG. 4 is HTTP data. Determination is made (step S602). If the CPU 201 determines in step S602 that the data is HTTP data, that is, the communication addressed to the outside is communication addressed to the web server or the web mail server (YES in step S602), the process proceeds to step S603, and the communication is the web data. Web mail communication determination processing is performed to determine whether the mail communication is performed (step S603). Details of this processing will be described later with reference to FIG. In the relay control rule setting screen 1200 shown in FIG. 12, when the web mail data is set not to perform relay control using the relay control rule (mail), that is, when the check box 1221 is not checked. This processing is not performed.

  If it is determined that the acquired HTTP data is web mail data after the process of step S603 is completed (YES in step S604), the process proceeds to step S606, and the web mail data acquisition process is performed (step S606). The mail data relay control process in step S607 is performed.

  On the other hand, if it is determined in step S604 that the acquired HTTP data is not web mail data (NO), the process proceeds to step S605, and a web data relay control process is performed. Details of the web data relay control process in step S605 will be described later with reference to FIG. In addition, in the relay control rule setting screen 1200 of FIG. 12, when it is set not to perform relay control using the relay control rule (mail) for the web mail data, the determination process of step S604 is not performed. The process proceeds to step S605.

  If NO in step S602, that is, if it is determined that the data acquired by the external transmission data acquisition unit 303 is not HTTP data, the process proceeds to step S608, and the relay control rule to be applied to other types of data is determined. If there is, the relay control rule to which the relay control rule is applied is performed. The relay control unit 304 of the relay server 101 performs this process every time the external transmission data acquisition unit 303 acquires data to be transmitted to an external network. The above is the detailed description of the relay control process in step S404 of FIG.

  Next, the details of the web mail communication determination process in step S603 of FIG. 6 will be described with reference to FIG. In this process, web mail data, which is electronic mail data using HTTP, is processed in accordance with a relay control rule on the condition of subject, destination, text, etc., as in the case of normal electronic mail data. This process is performed to identify mail data.

  First, the CPU 201 of the relay server 101 acquires a list of web mail service information from the web mail service information table 1800 from the relay control rule DB 102 (step S701). Then, by comparing the acquired web mail service information with the acquired HTTP data, it is specified whether the acquired HTTP data is web mail data.

  In step S702, the CPU 201 determines the web mail service information to be applied to the verification with the HTTP data acquired from the plurality of web mail service information acquired in step S701. Then, it is determined whether or not the HTTP data request URL matches the URL set in the URL condition 1804 (step S703). If it is determined in step S703 that they match (YES), the process advances to step S704 to determine whether the data structure matches the data structure registered in the transmission data information 1805 of the web mail service information. To do.

  If it is determined in the determination process in step S704 that the data configuration matches (YES), the process proceeds to step 705, and the acquired HTTP data is specified as web mail data.

  If the CPU determines NO in step S703 or S704, the process proceeds to step S706, where it is determined whether there is still unapplied webmail service information, and it is determined that there is unadapted webmail service information Advances the processing to step S702 and repeats the subsequent processing.

  The above process is performed until the process of step S705 is performed or NO is determined in the process of step S706. When this process is completed by performing the process of step S705, when this process is completed by determining YES in the determination process of step S604 in FIG. 6 and NO in the determination process of step S706. The CPU 201 determines NO in the determination process of step S604 in FIG. The above is the detailed description of the web mail communication determination process in step S603 of FIG.

  Next, details of the web data relay control process in step S605 of FIG. 6 will be described with reference to FIG. This process is performed by the attached file information extraction unit 304-2 and the relay control rule application unit 304-3 of the relay control unit 304.

  The CPU 201 acquires a relay control rule from the relay control rule (web) data table 1600 in the relay control rule DB 102, and selects a relay control rule to be applied to HTTP data to be subjected to relay control in order of application priority (step S801).

  Thereafter, it is determined whether the URL condition is set in the relay control rule selected in step S801 (step S802). If it is determined that the URL condition exists (YES), the request URL of the HTTP data is the URL It is determined whether the condition is met (step S803). If the URL condition is set by direct URL input, it matches the character string pattern of the URL, or if it is set as a category, the CPU 201 determines whether the request URL is included in the category. It will be judged whether the conditions are met. Note that not only the request URL but also the reference source information (Referrer) may be determined together with the URL condition. Of course, when either the request URL or the reference source information matches the information registered in the URL condition, it can be determined that the request condition matches the URL condition.

  If YES is determined in step S803, or if it is determined in step S802 that the URL condition is not set, the CPU 201 advances the process to step S804, and determines whether the keyword condition is set in the relay control rule. If it is determined that there is a keyword condition (YES), it is determined whether the HTTP data includes a character string, a character string pattern, or the like set in the keyword condition as transmission data (step S805). If it is determined in step S805 that the HTTP data that is the object of relay control includes a character string, a character string pattern, or the like set in the keyword condition of the relay control rule, the process proceeds to step S806.

  If YES is determined in step S805, or if it is determined in step S804 that no keyword condition is set, the CPU 201 advances the process to step S806 to check whether an attachment file condition is set in the relay control rule. judge. As a result of the determination, if it is determined that it is set, it is determined whether the attached file included in the HTTP data matches the attached file condition (step S807). As described above, as the attached file condition, a file type condition, a keyword condition in the file, a file size condition, and the like can be set.

  If NO is determined in the determination process of step S806 or YES is determined in the determination process of step S807, the CPU 201 determines that the HTTP data to be subjected to the relay control process matches the relay control rule selected in step S801. become. In that case, the process proceeds to step S808.

  In step S808, the CPU 201 determines whether attachment data is included in the HTTP data. If it is determined that the attached file data is not included, it is not necessary to perform relay control based on the asset management information, so the process proceeds to step S811, and the operation set in the rule is executed. . If the CPU 201 determines in step S808 that the attachment data is included in the HTTP data, the process proceeds to step S809 to perform relay control based on the asset management information, and the user use software (SW) correspondence determination process I do. Details of this processing will be described later with reference to FIG.

  If it is determined that the attached file is an attached file corresponding to the software installed on the client PC 105 used by the user after the process of step S809 is completed (YES in “corresponding to user use SW?” In step S810). Then, the process proceeds to step S811, and the operation set in the operation 1608 of the relay control rule selected in step S801 is executed.

  On the other hand, if NO is determined in step S810, the client PC 105 used by the user may have been illegally installed with software, and is created with the software that may have been illegally installed. Since it is going to be sent to the outside with the attached file, the relay of HTTP data is prohibited (step S816), and the software is illegally installed on the client PC 105 that sent the HTTP data to the IT department software administrator. Notification that there is a possibility of being performed is performed (step S817).

  If the CPU 201 determines NO in step S803, step S805, and step S808, the HTTP data does not match the various conditions set in the relay control rule selected in step S801, and thus the process is performed in step S812. The process is advanced to whether or not a relay control rule (web) not yet applied remains in the HTTP data. If it is determined in step S812 that there is an unapplied relay control rule, the process proceeds to step S801, another relay control rule is selected according to the priority order information, and the processes in and after step S802 are repeated.

  On the other hand, if NO and CPU 201 determine in step S812, the relay control rule (web) that matches the HTTP is not registered in the relay control rule (web) data table 1600, and is set as a default process. Will be applied. However, when an attachment file is included in the HTTP file, relay control processing according to asset management information is performed. Therefore, first, in step S813, the CPU 201 determines whether attached file data is included in the HTTP data. If it is determined that the attached file data is not included, the process proceeds to step S818, and the relay control process set as the default operation is performed.

  If it is determined in step S813 that the attachment data is included in the HTTP data, the process proceeds to step S814, and the user use software (SW) correspondence determination process is performed as in step S809. The result of the determination process If it is determined that the attached file is an attached file corresponding to the software installed on the client PC 105 used by the user (YES in “corresponding to user use SW?” In step S815), the process proceeds to step S818. Go ahead and execute the action set as the default action.

  On the other hand, if NO is determined in step S815, the client PC 105 used by the user may have been illegally installed with software, and is created with the software that may have been illegally installed. Since it is going to be sent to the outside with the attached file, the relay of HTTP data is prohibited (step S816), and the software is illegally installed on the client PC 105 that sent the HTTP data to the IT department software administrator. Notification that there is a possibility of being performed is performed (step S817).

  The above is the detailed description of the web data relay control process in step S605 of FIG. In the description of this process, the example in which the relay control process according to the information managed in the relay control rule DB is first performed and then the relay control process according to the asset management information is described. Of course, the communication control processing according to the above may be performed first.

  Next, details of the web mail data acquisition process in step S606 of FIG. 6 will be described with reference to FIG. This processing is mainly performed by the mail information acquisition unit 304-1 of the relay control unit 304.

  First, the CPU 201 acquires the web mail service information corresponding to the transmission destination URL of the target web mail data from the web mail service information data table 1800 (step S901). After that, in accordance with the various parameter data set in the web mail service information acquired in step S901, the sender (FROM) and destination (mail configuration information set in each parameter in the HTTP data) TO), broadcast address (CC), BCC, title, text, attached file, etc. are acquired (step S902), and the acquired data is stored in the RAM 202 (step S903). The above is the detailed description of the web mail data acquisition process in step S606 of FIG.

  Next, details of the mail data relay control process in step S607 of FIG. 6 will be described with reference to FIG. This process is substantially the same as the web data relay control rule already described with reference to FIG.

  First, the CPU 201 acquires a relay control rule from the relay control rule (mail) data table 1700 in the relay control rule DB 102, and selects a relay control rule to be applied to mail data to be subjected to relay control in the order of application priority (steps). S1001).

  Thereafter, it is determined whether the transmission user condition is set in the relay control rule selected in step S1001 (step S1002). If it is determined that there is a transmission user condition (YES), the transmission user information of the mail data is It is determined whether or not the transmission user condition is met (step S1003). If it is determined YES in step S1003, or if it is determined in step S1002 that the transmission user condition is not set in the relay control rule, the process proceeds to step S1004, and the relay control selected in step S1001. It is determined whether a destination condition is set for the rule.

  If it is determined in the determination process in step S1004 that there is a destination condition (YES), the process proceeds to step S1005, and it is determined whether the destination information of the mail data matches the destination condition.

  If it is determined in step S1004 that there is no destination condition (NO), or if it is determined in step S1005 that the destination information of the mail data matches the destination condition (YES), the process proceeds to step S1006. It is determined whether a keyword condition is set in the relay control rule. If it is determined in the determination process of step S1006 that the keyword condition is set (YES), the process proceeds to step S1007, and it is determined whether the mail data matches the keyword condition.

  If it is determined in the determination process in step S1006 that no keyword condition is set in the relay control rule (NO), or in the determination process in step S1007, the mail data does not match the keyword condition set in the relay control rule. If it is determined, the process advances to step S1008 to determine whether an attachment file condition is set in the relay control rule. If it is determined in step S1008 that the attached file condition is set, the process proceeds to step S1009 to determine whether the attached file in the mail data matches the attached file condition.

  If it is determined in step S1008 that the attached file condition is not set in the relay control rule, or if it is determined in step S1009 that the attached file in the mail data matches the attached file, the relay control rule It is determined that certain mail data matches the relay control rule selected in step S1001. On the other hand, if it is determined NO in any one of the determination processes of step S1003, step S1005, step S1007, and step S1009, the mail data subject to relay control does not match the relay control rule selected in step S1001. Judge. In that case, the process proceeds to step S1014, and it is determined whether or not there is an unapplied relay control rule (step S1014). If it is determined that there is still (YES), the process proceeds to step S1001, and another relay is determined. A control rule is selected, and the processes after step S1002 are performed.

  If it is determined that the mail data subject to relay control matches the relay control rule, the process proceeds to step S1010, and it is determined whether a file is attached to the mail data. If it is determined that an attached file is attached to the mail data, a step is performed to determine whether software corresponding to the file format of the attached file is properly installed in the client PC 105 that transmitted the mail data. In step S1011, a user software (SW) correspondence determination process is performed. Details of this processing will be described later with reference to FIG. If it is determined that no file is attached, the process advances to step S1013.

  The CPU 201 receives the correspondence determination process in step S1011 and determines whether the software corresponding to the attached file is properly installed in the client PC 105 (corresponding to user use SW?) (Step S1012). If it is determined YES in this determination process, the process proceeds to step S1013. In step S1013, the CPU 201 performs the relay control process set in the operation of the relay control rule selected in step S1001 on the mail data.

  On the other hand, if NO is determined in the determination process of step S1012, the process proceeds to step S1018, and the relay of received data (relay control target mail data) is prohibited. Then, the IT department software administrator is notified that there is a possibility that the software may be improperly installed in the client PC 105 that has transmitted the mail data (step S1019).

  If it is determined in step S1014 that there are no unapplied relay control rules, the processing from step S1015 to step S1019 is performed. Since this processing is the same as the processing from steps S1010 to S1013, S1018, and S1019 already described, detailed description thereof is omitted. The above is the detailed description of the mail data relay control process in step S610 of FIG.

  Next, with reference to FIG. 11, the details of the user use software (SW) correspondence determination process in steps S809 and S814 in FIG. 8 and steps S1011 and S1016 in FIG. 10 will be described. This process is mainly performed by the software confirmation unit 304-4 of the relay control unit 304.

  Before describing the processing of FIG. 11, asset management information managed by the asset management DB 104 of the asset management server 103 will be described first. The asset management DB 104 manages an installed software data table 2000 shown in FIG. 20 as asset management information.

  First, an example of the data configuration of the installed software data table managed by the asset management DB 104 will be described with reference to FIG. FIG. 20 is a diagram showing an example of the data configuration of the installed software data table managed by the asset management DB 104.

  As shown in FIG. 20, in the installed software data table 2000, a PC management ID 2001 and an installed software type 2002 are set as data items. The PC management ID 2001 is a data item in which ID information for uniquely identifying the client PC 105 is registered. The installed software type 2002 is a data item for registering software that is originally installed with a valid license in the client PC 105 specified by the PC management ID. The asset management server 103 creates this data table by collecting information on software installed regularly (for example, once a month) from the client PC 105. At that time, the IT administrator or the like confirms whether the software registered in the installed software type 2002 is installed under a valid license. The above is the description of the data configuration of the installed software data table 2000.

  Next, the data structure of the file format data table will be described with reference to FIG. FIG. 21 is a view showing an example of the data structure of the file format data table 2100. In the following description, the file format data table 2100 is described as being managed by the asset management DB 104, but the data table may be managed by the relay control rule DB 102.

  As shown in FIG. 21, the file format data table 2100 is configured to include a software type 2101, an extension 2102, and a file format 2103 as data items, and a determination unit size 2103-1 and a data feature 2103 as file format data items. -2.

  The software type 2101 is a data item for registering information for specifying the type of software, such as a software name. The extension 2102 is a data item for registering extension information attached to a file corresponding to software specified by information registered in the software type. When dealing with a plurality of types of extensions, a plurality of extensions are registered. A file format 2103 is a data item for registering data indicating the file format of a file supported by the software. Many softwares specify the corresponding file according to the information in the header of the file. Therefore, the specific information is registered in this file format 2103. The determination part size 2103-1 is a data item for registering the size of the file header part (data used for determining whether the file is the target file). The data feature 2103-2 is data indicating the configuration of the data of the part registered in the determination unit size 2103-1.

  The extension can be easily changed by the user's input unit operation. Therefore, such an information is provided because the file corresponding to the application cannot always be determined only by the extension. The extension is effective when simply determining the file corresponding to the application. The above is the description of the data configuration of the file format data table 2100 in FIG.

  The process of FIG. 11 will be described. The CPU 201 acquires file format data from the asset management DB 104 managed by the asset management server 103 (step S1101). Thereafter, the file format data in which the extension information of the attached file data is set to the extension 2102 is searched, and the software associated with the extension of the attached file is specified (step S1102).

  Further, the CPU 201 obtains the installed software data installed in the client PC 105 that has transmitted the data subject to relay control from the asset management DB 104 (step S1103), and the software identified in step S1102 is valid for the client PC 105. Is installed (step S1104).

  If the CPU 201 determines in the determination process in step S1104 that the software specified in step S1102 is properly installed in the client PC 105 (YES), the process proceeds to step S1105. On the other hand, if the CPU 201 determines NO, the process advances to step S1109, and the attached file is in a format that is not compatible with the software used by the user, that is, the software legally installed on the client PC 105 used by the user. Judged to be a file.

  In step S1105, by checking the file format of the attached data, it is determined whether to check the file format of the attached data in order to identify the corresponding software information. The extension information can be easily changed when the file name is changed by a file management function provided by the OS or the like. Therefore, it is difficult to accurately identify the software corresponding to the attached file unless the file format of the attached file is confirmed. However, the extension check does not need to check the contents of the file, so there are many mistakes, but it is an effective method for easily specifying the corresponding software.

  If it is determined in step S1105 that the file format check is not performed (NO), the process proceeds to step S1108, and it is determined that the attached file corresponds to the software used by the user.

  On the other hand, if it is determined in step S1105 that the file format check is to be performed, the process proceeds to step S1106, and the information set in the file format 2103 of the file format data table is compared with the attached file data to cope with the attached file. Software to be identified.

  Thereafter, it is determined whether the software identified in step S1106 is properly installed in the client PC 105 used by the user (step S1107).

  If it is determined in step S1107 that the software corresponding to the attached file has been properly installed (YES), the process proceeds to step S1108. On the other hand, there is a possibility that the software is illegally installed ( If NO is determined, the process proceeds to step S1109.

  The above is the detailed description of the user use software (SW) correspondence determination process. In the present invention, by performing such processing, it becomes possible to quickly identify a client PC on which software may be illegally installed.

  In addition, since data created by software that was not installed under a valid license cannot be attached to an e-mail or the like and sent to another PC or the like, the user must install the software illegally. The effect of deterring can also be produced.

  An object of the present invention is to supply a recording medium (or storage medium) that records software program codes for realizing the functions of the above-described embodiments to a system or apparatus, and the computer of the system or apparatus (or CPU or MPU). Needless to say, this can also be achieved by reading and executing the program code stored in the recording medium. In this case, the program code itself read from the recording medium realizes the functions of the above-described embodiment, and the recording medium on which the program code is recorded constitutes the present invention.

  Further, by executing the program code read by the computer, not only the above-described functions of the actual form are realized, but also an operating system (OS) operating on the computer based on the instruction of the program code. It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.

  Furthermore, after the program code read from the recording medium is written into a memory provided in a function expansion card inserted into the computer or a function expansion unit connected to the computer, the function is based on the instruction of the program code. It goes without saying that the CPU or the like provided in the expansion card or the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  When the present invention is applied to the recording medium, program code corresponding to the flowchart described above is stored in the recording medium.

101 relay server 102 relay control rule DB (database)
103 Asset management server 104 Asset management DB (database)
105-1 to 105-4 Client PC
106 LDAP server 107 LAN (local area network)
108 Web server 109 Web mail server 110 Mail server 111 Wide area network 201 CPU
202 RAM
203 ROM
204 System Bus 205 Input Controller 206 Video Controller 207 Memory Controller 208 Communication I / F (Interface) Controller 209 Input Device 210 Display Device 211 External Memory

Claims (8)

An information processing apparatus that stores file format information in which software is associated with a file format of a file created by the software, and software information in which a client device is associated with software installed in the client device. And
Communication data acquisition means for acquiring communication data transmitted from the client device;
Using the file format information, the software corresponding to the file format of the file included in the communication data acquired by the communication data acquisition unit is specified, and the specified software uses the software information to identify the communication data. Determining means for determining whether the client device is installed on the transmitted client device ;
When it is determined by the determination means that the software corresponding to the file format is not installed in the client device, a notification means for notifying that effect;
An information processing apparatus comprising: The information processing apparatus performs communication control of communication data acquired by the communication data acquisition unit,
The information processing according to claim 1, further comprising: a relay control unit that prohibits relaying of the communication data when the determination unit determines that software corresponding to the file format is not installed. apparatus. The file format information is information in which software and an extension of a file created by the software are associated with each other,
The determination unit specifies software corresponding to an extension of a file included in the communication data based on the file format information, and the specified software using the software information is installed in a client device that has transmitted the communication data The information processing apparatus according to claim 1, wherein the information processing apparatus determines whether it has been performed.   An attachment file determination means for determining whether the communication data acquired by the communication data acquisition means includes an attachment file;
  The determination unit determines whether software corresponding to a file format of the attached file is installed in the client device when the attachment file determination unit determines that the attached file is included. Item 4. The information processing apparatus according to any one of Items 1 to 3. An information processing system comprising: a client device; a first server device that manages software information in which the client device is associated with software installed in the client device; and a second server device,
The second server device is
Communication data acquisition means for acquiring communication data transmitted from the client device;
Software information acquisition means for acquiring the software information from the first server device;
Identifying the software corresponding to the file format of the file included in the communication data acquired by the communication data acquisition means based on the file format information in which the software and the file format of the file created by the software are associated , and the software information Determining means for determining whether the software specified by the software information acquired by the acquiring means is installed in the client device that has transmitted the communication data;
When it is determined by the determination means that the software corresponding to the file format is not installed in the client device, a notification means for notifying that effect;
An information processing system comprising: The second server device performs relay control of communication data transmitted from the client device,
The second server device prohibits relaying of communication data acquired by the communication data acquisition unit when the determination unit determines that software corresponding to the file format is not installed in the client device. 6. The information processing system according to claim 5, further comprising relay control means . Information in the information processing apparatus that stores file format information that associates software with the file format of a file created by the software, and software information that associates the client device with software installed in the client device A processing method,
A communication data acquisition step in which the communication data acquisition means of the information processing apparatus acquires the communication data transmitted from the client apparatus;
The determination unit of the information processing device uses the file format information to identify software corresponding to the file format of the file included in the communication data acquired in the communication data acquisition step, and uses the software information to A determination step of determining whether the identified software is installed in the client device that transmitted the communication data ;
If the notification unit of the information processing apparatus determines that the software corresponding to the file format is not installed in the client apparatus in the determination step, a notification step of notifying that effect;
An information processing method comprising: Executed in an information processing apparatus that stores file format information in which software is associated with a file format of a file created by the software, and software information in which a client device is associated with software installed in the client device A possible program,
The information processing apparatus;
Communication data acquisition means for acquiring communication data transmitted from the client device;
Using the file format information, the software corresponding to the file format of the file included in the communication data acquired by the communication data acquisition unit is specified, and the specified software uses the software information to identify the communication data. Determining means for determining whether the client device is installed on the transmitted client device ;
When it is determined by the determination means that the software corresponding to the file format is not installed in the client device, a notification means for notifying that effect;
A program characterized by making it function.

Images