Classifying e-mail connections for policy enforcement

• US 10,257,164 B2
• Filed: 02/27/2004
• Issued: 04/09/2019
• Est. Priority Date: 02/27/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chant, Matthew P., Lyons, Peter K.
• Primary Examiner(s): Chang, Jungwon
• Application Number:
  US10/789,574
• Publication Number:
  US 20050193072A1
• Time in Patent Office: 5,520 Days
• Field of Search: 709206, 709224, 709225, 709207, 379 8823, 715500, 726 23, 726 14
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method and system for the policy-based restriction of electronic mail transmissions. A method for classifying electronic mail message transfer requests for policy enforcement can include identifying a source of an incoming electronic message, classifying the source, and applying a message transfer policy associated with the classification for the source. In particular, the identifying step can include identifying a network address for the source. The classifying step by comparison, can include classifying the source as one of a trusted source, a blocked source, and a suspect source. The classifying step also can include classifying the source as one of an authenticated source and an anonymous source. Finally, the classifying step further can include classifying the source as a blocked source where the source appears in a realtime black hole list.

Claims

1. A method for classifying electronic mail message transfer requests for policy enforcement comprising the steps of:

establishing a set of different message transfer policies, each policy having an association with a different classification of a source of an incoming electronic message;

identifying a source of an incoming electronic message included as part of a message transfer request;

classifying said source as one of a trusted source on condition that the source is located in a table of trusted sources, a suspect source where the source has an IP address that appears in a realtime black hole list on condition that the source is located in a table of suspect sources, a blocked source on condition that the source is present in a table of blocked sources, or an anonymous source on condition that the source is not present in any of the tables;

subsequently selecting a message transfer policy from amongst the set based upon the classification, the policy permitting full satisfaction of the request for a source classified as a trusted source, the policy prohibiting satisfaction of the request for a source classified as blocked and the policy permitting only limited satisfaction of the request for a source classified either as a suspect source or an anonymous source; and

,

applying the selected message transfer policy to said incoming electronic message so as to curb transmission of spam without undermining an effectiveness of electronic mail communications.

2. The method of claim 1, wherein said identifying step comprises the step of identifying a network address for said source.

3. The method of claim 1, wherein said classifying step further comprises the step of classifying said source as an authenticated source only where an authenticated connection has been established with said source.

4. The method of claim 1, wherein said applying step comprises the step of limiting transfer of messages from a source classified as suspect.

5. The method of claim 1, wherein said applying step comprises the step of limiting transfer of messages from a source classified as anonymous.

9. The machine readable storage of claim 2, wherein said classifying step further comprises the step of classifying said source as an authenticated source only where an authenticated connection has been established with said source.

10. The machine readable storage of claim 2, wherein said applying step comprises the step of limiting transfer of messages from a source classified as suspect.

11. The machine readable storage of claim 2, wherein said applying step comprises the step of limiting transfer of messages from a source classified as anonymous.

6. A system for classifying electronic mail message transfer requests for policy enforcement comprising:

a mail server;

a memory comprising a set of mail transfer policies, each policy having an association with a corresponding source classification;

at least one table of source identities having a particular classification; and

,

a classifier coupled to said mail server, said memory and said at least one table, the classifier identifying a source of an incoming electronic message included as part of a message transfer request in the mail server, classifying said source as one of a trusted source on condition that the source is located in a table of trusted sources, a suspect source where the source has an IP address that appears in a realtime black hole list on condition that the source is located in a table of suspect sources, a blocked source on condition that the source is present in a table of blocked sources, or an anonymous source on condition that the source is not present in any of the tables, subsequently selecting in the memory one of the mail transfer policies based upon the classification, the policies permitting full satisfaction of the request for a source classified as a trusted source, the policy prohibiting satisfaction of the request for a source classified as blocked and the policy permitting only limited satisfaction of the request for a source classified either as a suspect source or an anonymous source, and applying the selected one of the mail transfer policies to said incoming electronic message so as to curb transmission of spam without undermining an effectiveness of electronic mail communications.

7. A machine readable storage comprising a memory device having stored thereon a computer program for classifying electronic mail message transfer requests for policy enforcement, the computer program comprising a routine set of instructions which when executed by a machine cause the machine to perform the steps of:

establishing a set of different message transfer policies, each policy having an association with a different classification of a source of an incoming electronic message;

identifying a source of an incoming electronic message included as part of a message transfer request;

classifying said source as one of a trusted source on condition that the source is located in a table of trusted sources, a suspect source where the source has an IP address that appears in a realtime black hole list on condition that the source is located in a table of suspect sources, a blocked source on condition that the source is present in a table of blocked sources, or an anonymous source on condition that the source is not present in any of the tables;

subsequently selecting a message transfer policy from amongst the set based upon the classification, the policy permitting full satisfaction of the request for a source classified as a trusted source, the policy prohibiting satisfaction of the request for a source classified as blocked and the policy permitting only limited satisfaction of the request for a source classified either as a suspect source or an anonymous source; and

,

applying the selected message transfer policy to said incoming electronic message so as to curb transmission of spam without undermining an effectiveness of electronic mail communications.

8. The machine readable storage of claim 7, wherein said identifying step comprises the step of identifying a network address for said source.