Preventing execution of programs that are embedded in email messages

• US 20040068695A1
• Filed: 04/07/2003
• Published: 04/08/2004
• Est. Priority Date: 10/08/2002
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Malik, Dale W., Daniell, W. Todd
• Granted Patent: US 7,657,838 B2
• Time in Patent Office: Days
• US Class Current: 715/513
• CPC Class Codes: G06F 3/04812 Interaction techniques based on cursor appearance or behaviour, e.g. being affected by the presence of displayed objects
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Systems and methods are presented which generate modified email messages, which are largely devoid of embedded functions, from original email messages, which have embedded functions. The embedded functions are amenable to self-executing codes such as viruses, worms, and Trojan programs. Thus, the modified email message without these embedded functions, and any argument associated with these functions, provides a more secure email environment.

Claims

1. A method for preventing execution of executable programs that are embedded in HTML-formatted email messages, the method comprising the steps of:

(A) receiving a hypertext markup language (HTML) formatted email message, the HTML-formatted email message having HTML tags;

(B) receiving an indication to display the received HTML-formatted email message;

(C) generating a modified email message by;

(C1) searching the HTML-formatted email message to find a predetermined HTML tag, the predetermined HTML tag being selected from the group consisting of;

(C1a) input;

(C1b) VBScript;

(C1c) JScript;

(C1d) applet; and

(C1e) object; and

(C2) responsive to finding the predetermined HTML tag, effectively removing the predetermined HTML tag and any argument associated with the predetermined HTML tag; and

(D) displaying the modified email message.

2. A method for preventing execution of functions that are embedded in email messages, the method comprising the steps of:

searching an original email message to find an embedded function, the original email message being stored in non-volatile memory; and

generating a modified email message without the embedded function, the modified email message being generated from the original email message.

3. The method of claim 2, further comprising the step of:

providing an option to remove the embedded function;

receiving an indication to remove the embedded function; and

wherein the step of removing the embedded function is responsive to the step of receiving the indication to remove the embedded function.

4. The method of claim 2, wherein the step of searching the original email message comprises the step of:

filtering the original email message for a tag, the tag being indicative of the embedded function.

5. The method of claim 4, wherein the step of filtering the original email message comprises the step of:

comparing tags in the original email message to a predefined list of tags, the predefined list of tags comprising HTML elements, the HTML elements comprising;

input;

VBScript;

Jscript;

applet; and

object.

6. The method of claim 2, further comprising the step of:

receiving an indication to display the original email message, the received indication being adapted to initiate the searching of the original email message.

7. The method of claim 6, further comprising the step of:

displaying the modified email message in response to receiving the indication to display the original email message.

8. The method of claim 7, wherein the step of displaying the modified email message comprises the steps of:

opening an email read window; and

displaying the modified email message in the email read window.

9. The method of claim 7, wherein the step of displaying the modified email message comprises the steps of:

providing an email preview pane in an email client; and

displaying the modified email message in the email preview pane.

10. The method of claim 7, further comprising the steps of:

receiving an indication to forward the displayed email message; and

forwarding the original email message in response to receiving the indication to forward the displayed email message.

11. A computer-readable medium having computer-readable code for preventing execution of functions embedded in email messages, the computer-readable medium comprising:

computer-readable code adapted to instruct a programmable device to search an original email message to find an embedded function, the original email message being stored in non-volatile memory; and

computer-readable code adapted to instruct a programmable device to generate a modified email message without the embedded function, the modified email message being generated from the original email message.

12. The computer-readable medium of claim 11, further comprising:

computer-readable code adapted to instruct a programmable device to provide an option to remove the embedded function; and

computer-readable code adapted to instruct a programmable device to receive an indication to remove the embedded function.

13. The computer-readable medium of claim 11, further comprising:

computer-readable code adapted to instruct a programmable device to filter the original email message for a tag, the tag being indicative of the embedded function.

14. The computer-readable medium of claim 13, further comprising:

computer-readable code adapted to instruct a programmable device to compare tags in the original email message to a predefined list of tags.

15. The computer-readable medium of claim 14, wherein the predefined list of tags comprises:

a hypertext markup language (HTML) input element;

an HTML VBScript element;

an HTML JScript element;

an HTML applet element; and

an HTML object element.

16. The computer-readable medium of claim 11, further comprising:

computer-readable code adapted to instruct a programmable device to display the modified email message in response to receiving an indication to display the original email message.

17. The computer-readable medium of claim 16, further comprising:

computer-readable code adapted to instruct a programmable device to open an email read window; and

computer-readable code adapted to instruct a programmable device to display the modified email message in the email read window.

18. The computer-readable medium of claim 16, wherein the displaying of the modified email message comprises:

computer-readable code adapted to instruct a programmable device to provide an email preview pane in an email client; and

computer-readable code adapted to instruct a programmable device to display the modified email message in the email preview pane.

19. The computer-readable medium of claim 16, further comprising:

computer-readable code adapted to instruct a programmable device to forward the original email message in response to receiving an indication to forward the displayed email message.

20. A system for preventing execution of executable functions that are embedded in email messages, the system comprising:

logic adapted to search an original email message to find an embedded function, the original email message being stored in non-volatile memory; and

logic adapted to generate a modified email message without the embedded function, the modified email message being generated from the original email message.

21. The system of claim 20, further comprising:

logic adapted to provide an option to remove the embedded function; and

logic adapted to receive an indication to remove the embedded function.

22. The system of claim 20, further comprising:

logic adapted to filter the original email message for a tag, the tag being indicative of the embedded function.

23. The system of claim 22, further comprising:

logic adapted to compare tags in the original email message to a predefined list of tags.

24. The system of claim 22, further comprising:

means for comparing tags in the original email message to a predefined list of tags.

25. The system of claim 20, further comprising:

logic adapted to display the modified email message in response to receiving an indication to display the original email message.