Secure e-mail attachment routing and delivery

• US 10,097,489 B2
• Filed: 01/29/2015
• Issued: 10/09/2018
• Est. Priority Date: 01/29/2015
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Lin, Wei
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): Chambers, Michael A
• Application Number:
  US14/608,701
• Publication Number:
  US 20160226808A1
• Time in Patent Office: 1,349 Days
• Field of Search: 709206
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding

Abstract

An e-mail message is received that specifies at least one recipient and which includes an attachment. The attachment is a file having a header specifying at least one e-mail address for a permitted recipient. The header is analyzed to determine whether the at least one recipient is specified as a permitted recipient. The e-mail message is relayed to the at least one recipient if is determined that the at least one recipient is a permitted recipient. In addition or in the alternative, delivery of the e-mail message to the at least one recipient is prevented if is determined that the at least one recipient is not a permitted recipient. Related apparatus, systems, techniques and articles are also described.

Claims

1. A method comprising

receiving, at a mail server, an e-mail message, the e-mail message being received from a first mail application associated with a sender of the e-mail message, the e-mail message specifying a recipient of the e-mail message, the e-mail message further comprising an attachment generated by a file creation and modification application, the generation of the attachment comprising generating a graphic user interface configured to receive a user-generated input specifying at least one of a plurality of permitted recipients for an attachment of an email message, and the generating of the attachment further comprising generating a header and a portion encapsulating content separate from the header, the header comprising the at least one of the plurality of permitted recipients for the attachment, the portion encapsulating the content of the attachment being encrypted, and the header being unencrypted to enable a parsing of the header;

parsing the attachment of the mail to determine whether the header of the attachment includes extensible markup language (XML) instructions for the mail server to verify the recipient of the e-mail message; and

in response to determining that the header of the attachment includes XML instructions for the mail server to verify the recipient of the e-mail message, verify the recipient of the e-mail message by at least;

determining whether the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment;

relaying the e-mail message to a second mail application associated with the recipient based at least on a determination that the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment; and

sending, to the first mail application associated with the sender of the e-mail message, an error message based at least on a determination that the recipient does not match at least one of the plurality of permitted recipients specified in the header of the attachment.

2. The method of claim 1, wherein the document creation and modification application is selected from a group consisting of:

word processing programs, presentation programs, and spreadsheet programs.

3. The method of claim 1, wherein the portion encapsulating the content of the attachment is further compressed.

4. The method of claim 1, wherein the parsing comprises decrypting or decompressing at least a portion of the e-mail message to enable an analysis of the header of the attachment.

5. The method of claim 1, wherein the e-mail message is prevented from being sent to the second mail application associated with the recipient based at least on the determination that the recipient does not match at least one of the plurality of plurality of permitted recipients specified in the header of the attachment.

6. The method of claim 1, wherein at least one of the receiving, the parsing, the determining, the relaying, and the sending is implemented by at least one hardware data processor forming part of at least one computing system.

7. A non-transitory computer program product storing instructions which, when executed by at least one hardware processor, result in operations comprising:

receiving, at a mail server, an e-mail message, the e-mail message being received from a first mail application associated with a sender of the e-mail message, the e-mail message specifying a recipient of the e-mail message, the e-mail message further comprising an attachment generated by a file creation and modification application, the generation of the attachment comprising generating a graphic user interface configured to receive a user-generated input specifying at least one of a plurality of permitted recipients for an attachment of an email message, and the generating of the attachment further comprising generating a header and a portion encapsulating content separate from the header, the header comprising the at least one of the plurality of permitted recipients for the attachment, the portion encapsulating the content of the attachment being encrypted, and the header being unencrypted to enable a parsing of the header;

parsing the attachment of the mail to determine whether the header of the attachment includes extensible markup language (XML) instructions for the mail server to verify the recipient of the e-mail message; and

in response to determining that the header of the attachment includes XML instructions for the mail server to verify the recipient of the e-mail message, verify the recipient of the e-mail message by at least;

determining whether the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment;

relaying the e-mail message to a second mail application associated with the recipient based at least on a determination that the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment; and

sending, to the first mail application associated with the sender of the e-mail message, an error message based at least on a determination that the recipient does not match at least one of the plurality of permitted recipients specified in the header of the attachment.

8. The computer program product of claim 7, wherein the document creation and modification application is selected from a group consisting of:

word processing programs, presentation programs, and spreadsheet programs.

9. The computer program product of claim 7, wherein the portion encapsulating the content of the attachment is further compressed.

10. The computer program product of claim 7, wherein the parsing comprises decrypting or decompressing at least a portion of the e-mail message to enable an analysis of the header of the attachment.

11. The computer program product of claim 7, wherein the e-mail message is prevented from being sent to the second mail application associated with the recipient based at least on the determination that the recipient does not match at least one of the plurality of plurality of permitted recipients specified in the header of the attachment.

12. A system comprising:

at least one hardware data processor; and

at least memory storing instructions which, when executed by the at least one hardware processor, result in operations comprising;

receiving, at a mail server, an e-mail message, the e-mail message being received from a first mail application associated with a sender of the e-mail message, the e-mail message specifying a recipient of the e-mail message, the e-mail message further comprising an attachment generated by a file creation and modification application, the generation of the attachment comprising generating a graphic user interface configured to receive a user-generated input specifying at least one of a plurality of permitted recipients for an attachment of an email message, and the generating of the attachment further comprising generating a header and a portion encapsulating content separate from the header, the header comprising the at least one of the plurality of permitted recipients for the attachment, the portion encapsulating the content of the attachment being encrypted, and the header being unencrypted to enable a parsing of the header;

parsing the attachment of the mail to determine whether the header of the attachment includes extensible markup language (XML) instructions for the mail server to verify the recipient of the e-mail message; and

in response to determining that the header of the attachment includes XML instructions for the mail server to verify the recipient of the e-mail message, verify the recipient of the e-mail message by at least;

determining whether the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment;

relaying the e-mail message to a second mail application associated with the recipient based at least on a determination that the recipient matches at least one of the plurality of permitted recipients specified in the header of the attachment; and

sending, to the first mail application associated with the sender of the e-mail message, an error message based at least on a determination that the recipient does not match at least one of the plurality of permitted recipients specified in the header of the attachment.