DETECTING METHOD AND DEVICE

• US 20130305360A1
• Filed: 03/11/2013
• Published: 11/14/2013
• Est. Priority Date: 05/10/2012
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: YOSHIOKA, Takashi, Tsuda, Hiroshi
• Application Number:
  US13/792,422
• Publication Number:
  US 20130305360A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A detecting method includes: receiving a text information mail including text information, first verification information on the text information, first verification information of attached information which is attached to the text information, and an attached information mail including the attached information, first verification information of the text information, and first verification information of the attached information from a transmission source; generating second verification information of the text information, and second verification information of the attached information, based on shared information which is shared with the transmission source, and an algorithm; and detecting a spoof, based on a comparison result of the first verification information of the text information and the second verification information of the text information, and a comparison result of the first verification information of the attached information and the second verification information of the attached information.

Claims

1. A detecting method which detects a spoofed email to be executed by a computer, the detecting method comprising:

dividing an email to be transmitted into text information and attached information;

generating first verification information using an algorithm in which shared information is used, with respect to each of the text information and the attached information;

generating a text information mail in which the first verification information is added to a header of an email including the text information;

generating an attached information mail in which the first verification information is added to a header of an email including the attached information;

transmitting the text information mail and the attached information mail;

when the text information mail and the attached information mail are received, generating second verification information using the algorithm with respect to each of the text information which is included in the text information mail and the attached information which is included in the attached information mail;

comparing the first verification information which is included in the received text information mail and the received attached information mail to the second verification information; and

combining the text information included in the text information mail and the attached information included in the attached information mail when the first verification information matches the second verification information.

2. The detecting method according to claim 1,

wherein the first verification information is first feature amount information which is generated based on the respective text information to which the shared information is added, and attached information to which the shared information is added, and the algorithm, and

wherein the second verification information is second feature amount information which is generated based on the respective text information to which the shared information is added, and attached information to which the shared information is added, and the algorithm.

3. The detecting method according to claim 2,

wherein the comparing compares the first feature amount information to the second feature amount information with respect to each of the text information and the attached information.

4. The detecting method according to claim 1,

wherein the first verification information is first encryption information which is generated based on first feature amount information which is generated using a first algorithm with respect to each of the text information and the attached information, and a second algorithm which is encrypted using the shared information, and

wherein the second verification information is second encryption information which is generated based on second feature amount information which is generated using the first algorithm with respect to each of the text information and the attached information, and the second algorithm.

5. The detecting method according to claim 1,

wherein the attached information is one of attached link information relating to link information which is attached to the email and attached file information relating to file data, or both the attached link information and the attached file information.

6. The detecting method according to claim 5,

wherein the combining, when the first verification information matches the second verification information, combines the text information and the attached information.

7. The detecting method according to claim 1,

wherein the generating of the text information mail adds the first verification information, with respect to each of the text information and the attached information, to the header of the email, and

wherein the generating of the attached information mail adds the first verification information, with respect to each of the text information and the attached information, to the header of the email.

8. The detecting method according to claim 1,

wherein the algorithm is a one-way hash function.

9. The detecting method according to claim 1,

wherein the comparing, when the first verification information matches the second verification information, adds the comparison result to the respective headers of the text information mail and the attached information mail.

10. The detecting method according to claim 1, further comprising:

comparing the first verification information included in the text information mail and the attached information mail to the first verification information in reception history information when the first verification information matches the second verification information.

11. A computer-readable recording medium storing a program for causing a computer to execute a procedure for detecting a spoofed email, the procedure comprising:

dividing an email to be transmitted into text information and attached information;

generating first verification information using an algorithm in which shared information is used with respect to each of the text information and the attached information;

generating a text information mail in which the first verification information is added to a header of an email including the text information;

generating an attached information mail in which the first verification information is added to a header of an email including the attached information;

transmitting the text information mail and the attached information mail;

when the text information mail and the attached information mail are received, generating second verification information using the algorithm with respect to each of the text information which is included in the text information mail and the attached information which is included in the attached information mail;

comparing the first verification information which is included in the received text information mail and the received attached information mail to the second verification information; and

combining the text information included in the text information mail and the attached information included in the attached information mail when the first verification information matches the second verification information.

12. A detecting device which detects a spoofed email, comprising:

a memory configured to store a program including a procedure; and

a processor configured to execute the program, the procedure including;

dividing an email to be transmitted into text information and attached information;

generating first verification information using an algorithm in which shared information is used with respect to each of the text information and the attached information;

generating a text information mail in which the first verification information is added to a header of an email including the text information;

generating an attached information mail in which the first verification information is added to a header of an email including the attached information;

transmitting the text information mail and the attached information mail;

when the text information mail and the attached information mail are received, generating second verification information using the algorithm with respect to each of the text information which is included in the text information mail and the attached information which is included in the attached information mail;

comparing the first verification information which is included in the received text information mail and the received attached information mail to the second verification information; and

combining the text information included in the text information mail and the attached information included in the attached information mail when the first verification information matches the second verification information.

13. A transmission terminal comprising:

a memory configured to store a program including a procedure; and

a processor configured to execute the program, the procedure including;

obtaining text information and attached information of a transmission target;

generating verification information of the text information and the verification information of the attached information based on shared information which is shared with a transmission destination and an algorithm;

generating a text information mail including the text information, verification information of the text information, and verification information of the attached information;

generating an attached information mail including the attached information, verification information of the text information, verification information of the attached information; and

transmitting the text information mail and the attached information mail to the transmission destination.

14. A reception terminal comprising:

a memory configured to store a program including a procedure; and

a processor configured to execute the program, the procedure including;

receiving a text information mail including text information, first verification information on the text information, first verification information of attached information which is attached to the text information, and an attached information mail including the attached information, first verification information of the text information, and first verification information of the attached information from a transmission source;

generating second verification information of the text information, and second verification information of the attached information, based on shared information which is shared with the transmission source, and an algorithm; and

detecting a possibility of a spoof, based on a comparison result of the first verification information of the text information and the second verification information of the text information, and a comparison result of the first verification information of the attached information and the second verification information of the attached information.