E-mail management services

• US 20030158905A1
• Filed: 02/19/2003
• Published: 08/21/2003
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Postini Corporation
• Inventors: Cox, Fred, Akamine, Shinya, Petry, Scott M., Lund, Peter Kevin, Oswall, Michael John
• Granted Patent: US 6,941,348 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention provides an electronic message management system (EMS) that includes a real-time feedback loop where data is collected from the electronic messages on incoming connection attempts, outgoing delivery attempts, and message content analysis, and written to a centralized data matrix. A separate process accesses the data matrix and analyzes trends in that data. The detected data patterns, trends or behavior is based on configuration parameters for the recipient. Based on these determinations, the process is able to instruct components in the EMS to accept, redirect, refuse, modify, defer, or otherwise dispose of the connection request, the delivery attempt, or the message. Associated methods for managing the transmission of electronic messages are also disclosed.

Claims

1. A traffic monitor for use with a computer process in managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

a data matrix for storing the source and destination data for a plurality of incoming electronic messages; and

an interface coupled to the matrix and configured to facilitate supplementing of the source and destination data with metadata provided by the computer process and based on the plurality of electronic messages, and to facilitate access to the source and destination data and the metadata for use in processing the plurality of electronic messages.

2. The traffic monitor as recited in claim 1, wherein the interface is configured to facilitate access to the source and destination data and metadata for use in generating processing instructions for processing the plurality of electronic messages.

3. The traffic monitor as recited in claim 2, wherein the processing instructions are disposition instructions for the plurality of incoming electronic messages.

4. The traffic monitor as recited in claim 3, wherein the disposition instructions are selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

5. The traffic monitor as recited in claim 1, wherein the interface is configured to facilitate supplementing of the source and destination data with metadata extrapolated from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

6. The traffic monitor as recited in claim 1, wherein the metadata extrapolated from the plurality of electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

7. A method for use with a computer process in managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

storing the source and destination data for a plurality of incoming electronic messages;

supplementing the source and destination data with metadata provided by the computer process and based on the plurality of electronic messages; and

processing in the computer process the plurality of electronic messages based on the source and destination data and the metadata.

8. The method as recited in claim 7, wherein processing includes generating processing instructions based on the source and destination data and the metadata for use in processing the plurality of electronic messages.

9. The method as recited in claim 8, wherein generating processing instructions includes generating disposition instructions for the plurality of electronic messages.

10. The method as recited in claim 9, wherein generating disposition instructions includes generating disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

11. The method as recited in claim 7, wherein supplementing includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

12. The method as recited in claim 7, wherein supplementing further includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

13. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

a traffic monitor having a data matrix for storing the source and destination data for a plurality of incoming electronic messages, and an interface for facilitating access to the data matrix;

a message handling process coupled to the interface and configured to supplement the source and destination data with metadata extrapolated from the plurality of electronic messages; and

an interpreter process coupled to the interface and configured to access the source and destination data and the metadata to generate processing instructions based thereon, the message handling process further configured to process the plurality of electronic messages based on the processing instructions.

14. The electronic message management system as recited in claim 13, wherein the processing instructions are disposition instructions for the plurality of electronic messages.

15. The electronic message management system as recited in claim 14, wherein the interpreter process is configured to generate disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

16. The electronic message management system as recited in claim 13, wherein the message handling process includes a connection management module configured to extract the source and destination data, and to accept the plurality of electronic messages from the sending mail servers based on the processing instructions.

17. The electronic message management system as recited in claim 16, further including a connection management table coupled between the interpreter process and the connection management module, and configured to hold the processing instructions.

18. The electronic message management system as recited in claim 13, wherein the message handling process includes a delivery module configured to deliver the plurality of electronic messages to the receiving mail servers based on the processing instructions.

19. The electronic message management system as recited in claim 18, wherein the interpreter process is configured to generate processing instructions based on the source and destination data and the metadata in accordance with rules stored in a database.

20. The electronic message management system as recited in claim 19, further including an administrative access console coupled to the database and configured to establish the rules.

21. The electronic message management system as recited in claim 13, wherein the message handling process is configured to supplement the source and destination data with metadata extrapolated using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

22. The electronic message management system as recited in claim 13, wherein the metadata extrapolated from the plurality of electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

23. The electronic message management system as recited in claim 13, wherein the destination data includes original delivery addresses of the receiving mail servers, the message handling process further configured to intercept the plurality of electronic messages by associating a delivery address of the electronic message management system with the original delivery addresses.

24. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, wherein messages sent from the sending mail servers comprise source data associated with the sending mail servers and destination data associated with the receiving mail servers, comprising:

storing the source and destination data for a plurality of incoming electronic messages in a data matrix;

extrapolating metadata from the plurality of electronic messages;

supplementing the source and destination data with the metadata;

accessing the source and destination data and the metadata via an interface;

generating processing instructions based on the source and destination data and the metadata; and

processing the plurality of electronic messages based on the processing instructions.

25. The method as recited in claim 24, wherein generating processing instructions includes generating disposition instructions for the plurality of electronic messages.

26. The method as recited in claim 25, wherein generating includes generating disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

27. The method as recited in claim 24, wherein the processing includes accepting the plurality of incoming electronic messages from the sending mail servers based on the source and destination data and the metadata.

28. The method as recited in claim 27, wherein generating processing instructions includes generating processing instructions in a connection management table, and the processing includes processing the plurality of electronic messages based on the message processing instruction in the connection management table.

29. The method as recited in claim 24, wherein the processing includes delivering the plurality of incoming electronic messages to the receiving mail servers based on the source and destination data and the metadata.

30. The method as recited in claim 24, wherein generating includes generating processing instructions based on the source and destination data and the metadata in accordance with rules stored in a database.

31. The method as recited in claim 30, wherein generating further includes generating processing instructions in accordance with rules established using an administrative access console coupled to the database.

32. The method as recited in claim 24, wherein extrapolating includes extrapolating the metadata from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

33. The method as recited in claim 24, wherein extrapolating includes extrapolating metadata selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

34. The method as recited in claim 24, wherein the destination data includes original delivery addresses of the receiving mail servers, the method further including intercepting the plurality of incoming electronic messages by associating a new delivery address with the original delivery addresses.

35. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

a connection management module configured to extract source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

a data matrix for storing the source and destination data; and

an interface coupled between the data matrix and the connection management module and configured to facilitate supplementing of the source and destination data with metadata extrapolated from the plurality of incoming electronic messages, and to facilitate access to the source and destination data and the metadata, the connection management module further configured to accept any of the plurality of incoming electronic messages from the sending mail servers based on the source and destination data and the metadata.

36. The electronic message management system as recited in claim 35, further including a connection management table having processing instructions based on the source and destination data and the metadata, the connection management module configured to accept any of the plurality of incoming electronic messages based on the processing instructions.

37. The electronic message management system as recited in claim 36, wherein the processing instructions are disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

38. The electronic message management system as recited in claim 36, wherein the processing instructions are generated in accordance with rules stored in a database.

39. The electronic message management system as recited in claim 38, further including an administrative access console coupled to the database and configured to establish the rules.

40. The electronic message management system as recited in claim 35, wherein the metadata is extrapolated from the plurality of incoming messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

41. The electronic message management system as recited in claim 35, wherein the metadata extrapolated from the plurality of incoming electronic messages is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

42. The electronic message management system as recited in claim 35, wherein the destination data includes original delivery addresses of the receiving mail servers, the connection management module further configured to intercept the plurality of incoming electronic messages by associating a delivery address of the electronic message management system with the original delivery addresses.

43. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

extracting source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages; and

accepting any of the plurality of electronic messages from the sending mail servers based on the source and destination data and the metadata.

44. The method as recited in claim 43, wherein accepting includes accepting any of the plurality of incoming electronic messages based on processing instructions based on the source and destination data and the metadata.

45. The method as recited in claim 44, wherein the processing instructions are disposition instructions selected from the group consisting of:

message accept;

message reject;

message quarantine;

message spool;

message defer;

message throttle;

message redirect;

connection rejection; and

black hole.

46. The method as recited in claim 44, wherein accepting further includes accepting any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database.

47. The method as recited in claim 46, wherein accepting further includes accepting any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database established using an administrative access console coupled to the database.

48. The method as recited in claim 43, wherein the supplementing includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

49. The method as recited in claim 43, wherein the supplementing includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

50. The method as recited in claim 43, wherein the destination data includes original delivery addresses of the receiving mail servers, the method further including intercepting the plurality of incoming electronic messages by associating a new delivery address with the original delivery addresses.

51. An electronic message management system for use in managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

a data matrix for storing source data associated with the sending mail servers and destination data associated with the receiving mail servers for a plurality of incoming electronic messages;

an interface coupled to the data matrix and configured to facilitate supplementing of the source and destination data with metadata extrapolated from the plurality of electronic messages, and to facilitate access to the source and destination data and the metadata; and

a delivery management module coupled to the interface and configured to deliver any of the plurality of incoming electronic messages to the receiving mail servers based on the source and destination data and the metadata.

52. The electronic message management system as recited in claim 51, wherein the delivery management module is configured to deliver any of the plurality of incoming electronic messages to the receiving mail servers based on processing instruction based on the source and destination data and the metadata.

53. The electronic message management system as recited in claim 52, wherein the delivery management module is configured to deliver any of the plurality of incoming electronic messages to a plurality of receiving mail servers based on loading capabilities of the plurality of receiving mail servers.

54. The electronic message management system as recited in claim 52, wherein the processing instructions are disposition instructions for the plurality of electronic messages.

55. The electronic message management system as recited in claim 54, wherein the disposition instructions are selected from the group consisting of:

message deliver;

message defer;

message reject; and

message redirect.

56. The electronic message management system as recited in claim 51, wherein the processing instructions based on the source and destination data and the metadata are generated in accordance with rules stored in a database.

57. The electronic message management system as recited in claim 55, further including an administrative access console coupled to the database and configured to establish the rules.

58. The electronic message management system as recited in claim 51, wherein the metadata is extrapolated from the plurality of incoming electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

59. The electronic message management system as recited in claim 51, wherein the metadata extrapolated is selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.

60. A method for managing the transmission of electronic messages from sending mail servers to receiving mail servers, comprising:

storing source data associated with the sending mail servers and destination data associated with the receiving mail servers from a plurality of incoming electronic messages;

supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages; and

delivering any of the plurality of electronic messages to the receiving mail servers based on the source and destination data and the metadata.

61. The method as recited in claim 60, wherein delivering includes delivering any of the plurality of incoming electronic messages to the receiving mail servers based on processing instructions based on the source and destination data and the metadata.

62. The method as recited in claim 61, wherein delivering includes delivering any of the plurality of incoming electronic messages to a plurality of receiving mail servers based on loading capabilities of the plurality of receiving mail servers.

63. The method as recited in claim 61, wherein the processing instructions are disposition instructions selected from the group consisting of:

message deliver;

message defer;

message reject; and

message redirect.

64. The method as recited in claim 61, wherein delivering further includes delivering any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database.

65. The method as recited in claim 60, wherein delivering further includes delivering any of the plurality of incoming electronic messages based on processing instructions generated in accordance with rules stored in a database established using an administrative access console coupled to the database.

66. The method as recited in claim 60, wherein the supplementing includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages using program threads for detecting unwanted electronic messages and unwanted electronic message delivery attempts.

67. The method as recited in claim 60, wherein the supplementing includes supplementing the source and destination data with metadata extrapolated from the plurality of electronic messages selected from the group consisting of:

count of connection attempts from source IP address;

count of current open connections from source IP address;

duration of connections from source IP address;

count of messages from source IP address;

message size;

count of recipients on messages;

count of spam messages from source IP address;

count of virus infected messages from source IP address

count of messages from source IP address with unwanted binary attachment;

count of messages from source IP address with unwanted content;

count of messages from source IP address against which the disposition option was blocked, blackholed, spooled, or quarantined;

count of current open connections to destination IP address;

duration of connections to destination IP address;

count of failed connections to destination IP address;

count of temporary deferral errors from destination IP address; and

count of unknown user errors from destination IP address.