Detection method for fraudulent mail, detection program therefor, and detection device therefor

A computer-readable recording medium having stored therein a program for causing a computer in an electronic mail terminal device to execute fraudulent mail detection processing, the fraudulent mail detection processing comprising:

• a preparation process configured to preliminarily share internal transmission secret key information used in an electronic mail addressed to an internal network, between a transmitting terminal and a receiving terminal, and preliminarily generate external transmission secret key information used in an electronic mail addressed to an external network and external transmission public key information corresponding to the external transmission secret key information;
• at a time of transmitting a mail,
• a verification information generation process configured to generate verification information by encrypting, using the internal transmission secret key information, first characteristic amount target information including a characteristic amount target item from among a header item, a body text, and attached information, included in an outgoing mail, or first characteristic amount information generated from the first characteristic amount target information on a basis of a predetermined function when a transmission destination of the outgoing mail is the internal network, and generate the verification information by encrypting, using the external transmission secret key information, the first characteristic amount target information or the first characteristic amount information when the transmission destination of the outgoing mail is the external network;
• and
• an addition process configured to add, to a header of the outgoing mail, the verification information and characteristic amount target item information corresponding to the characteristic amount target item;
• and
• at a time of receiving a mail,
• a characteristic amount generation process configured to generate second characteristic amount target information including a characteristic amount target item indicated by the characteristic amount target item information added to the incoming mail, from among a header item, a body text, and attached information, included in the incoming mail, or generate second characteristic amount information from the second characteristic amount target information on the basis of the predetermined function;
• a decryption process configured to decrypt, using the internal transmission secret key information, the verification information added to the incoming mail when a transmission source of the incoming mail is the internal network, decrypt, using the external transmission public key information, the verification information added to the incoming mail when the transmission source of the incoming mail is the external network, and generate third characteristic amount target information or third characteristic amount information;
• and
• a verification process configured to compare the second characteristic amount target information or the second characteristic amount information with the third characteristic amount target information or the third characteristic amount information, and verify whether or not the second characteristic amount target information or the second characteristic amount information and the third characteristic amount target information or the third characteristic amount information coincide with each other.

A fraudulent mail detection device comprising:

• a preparation mechanism configured to preliminarily share internal transmission secret key information used in an electronic mail addressed to an internal network, between a transmitting terminal and a receiving terminal, and preliminarily generate external transmission secret key information used in an electronic mail addressed to an external network and external transmission public key information corresponding to the external transmission secret key information;
• at a time of transmitting a mail,
• a verification information generation mechanism configured to generate verification information by encrypting, using the internal transmission secret key information, first characteristic amount target information including a characteristic amount target item from among a header item, a body text, and attached information, included in an outgoing mail, or first characteristic amount information generated from the first characteristic amount target information on a basis of a predetermined function when a transmission destination of the outgoing mail is the internal network, and generate the verification information by encrypting, using the external transmission secret key information, the first characteristic amount target information or the first characteristic amount information when the transmission destination of the outgoing mail is the external network;
• and
• an addition mechanism configured to add, to a header of the outgoing mail, the verification information and characteristic amount target item information corresponding to the characteristic amount target item;
• and
• at a time of receiving a mail,
• a characteristic amount generation mechanism configured to generate second characteristic amount target information including a characteristic amount target item indicated by the characteristic amount target item information added to the incoming mail, from among a header item, a body text, and attached information, included in the incoming mail, or generate second characteristic amount information from the second characteristic amount target information on the basis of the predetermined function;
• a decryption mechanism configured to decrypt, using the internal transmission secret key information, the verification information added to the incoming mail when a transmission source of the incoming mail is the internal network, decrypt, using the external transmission public key information, the verification information added to the incoming mail when the transmission source of the incoming mail is the external network, and generate third characteristic amount target information or third characteristic amount information;
• and
• a verification mechanism configured to compare the second characteristic amount target information or the second characteristic amount information with the third characteristic amount target information or the third characteristic amount information, and verify whether or not the second characteristic amount target information or the second characteristic amount information and the third characteristic amount target information or the third characteristic amount information coincide with each other.