Securely inspecting electronic messages

• US 20060048220A1
• Filed: 08/24/2004
• Published: 03/02/2006
• Est. Priority Date: 08/24/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mahajan, Dhananjay M., Noss, John F., Roth, Daniel W., Jahromi, Babak G., Muhlestein, Travis John, Seely, Scott Christopher
• Granted Patent: US 7,574,601 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/234 for tracking messages

Abstract

The present invention extends to methods, systems, and computer program products for securely inspecting electronic messages. A computer system receives a control message that is passed through one or more receiving path components, positioned in a message receiving path, to a security component. The security component authenticates the received control message and passes the received control message to an inspection control component. The inspection control component activates message inspection in accordance with instructions contained in the received control message. When message inspection is activated, the computer system passes accessed messages to corresponding inspection components positioned in message paths (either receiving or sending) of the accessed message. The inspection component generates an inspection report (e.g., including a portion of contents of the accessed message) in accordance with instructions contained in a previously authenticated control message.

Claims

1. In a network environment that includes a computer system capable of transferring messages between other computer systems in the network environment, a method for securely activating electronic message inspection, the method comprising the following:

an act of a receiving a control message;

an act of passing the received control message through one or more receiving path components that are positioned in the receiving path of the received control message;

an act of passing the received control message to a security component subsequent to the received control message being passed through the one or more receiving path components;

an act of the security component authenticating a sender and contents of the received control message;

an act of passing the received control message to an inspection control component in the receiving path subsequent to authenticating the received control message; and

an act of the inspection control component activating message inspection in accordance with instructions contained in the received control message;

2. The method as recited in claim 1, wherein the act of receiving a control message comprises an act receiving a Simple Object Access Protocol (SOAP) envelope.

3. The method as recited in claim 2, wherein the act of receiving a Simple Object Access Protocol (SOAP) envelope comprises an act of receiving a Simple Object Access Protocol (SOAP) envelope having a header that contains an inspection configuration.

4. The method as recited in claim 1, wherein the act of passing the received control message through one or more receiving path components comprises an act of passing the received control message through one or more of a performance counter component and a role set component.

5. The method as recited in claim 1, wherein the act of passing the received control message to a security component comprises an act of passing the received control message to a security component that is positioned before the inspection control component in the receiving path.

6. The method as recited in claim 1, wherein the act of the security component authenticating a sender and contents of the received control message comprises an act of validating a digital signature.

7. The method as recited in claim 6, further comprising:

an act of decrypting the control message.

8. The method as recited in claim 1, wherein the act of passing the received control message to an inspection control component comprises an act of passing the received control message to an inspection control component that is positioned after the security component in the receive path.

9. The method as recited in claim 1, wherein the act of the inspection control component activating message inspection in accordance with instructions contained in the received control message comprises an act of activating message inspection in accordance with instructions contained in a Simple Object Access Protocol (SOAP) header.

10. The method as recited in claim 1, wherein the act of the inspection control component activating message inspection in accordance with instructions contained in the received control message comprises an act of sending instructions to one on or more inspection components to load a message filter.

11. The method as recited in claim 10, wherein the message filter is loaded from a filter table.

12. The method as recited in claim 10, wherein the message filter includes XPath statements.

13. The method as recited in claim 1, wherein the act of the inspection control component activating message inspection in accordance with instructions contained in the received control message comprises an act of the inspection control component loading a message filter.

14. In a network environment that includes a computer system capable of transferring messages between other computer systems in the network environment, a method for securely inspecting an electronic message, the method comprising the following:

an act of accessing a message;

an act of passing the accessed message to an inspection component positioned in a message path of the accessed message;

an act of the inspection component generating an inspection report for the accessed message, the inspection report being generated in accordance with instructions contained in a previously authenticated control message; and

an act of passing the accessed message through one or more message path components that are positioned in the message path of the accessed message subsequent to generating the inspection report.

15. The method as recited in claim 14, wherein the act of accessing a message comprises an act of accessing a Simple Object Access Protocol (SOAP) envelope.

16. The method as recited in claim 14, wherein the act of passing the accessed message to an inspection component positioned in a message path of the accessed message comprises an act of passing the accessed message to an inspection component positioned in a receive path.

17. The method as recited in claim 14, wherein the act of passing the accessed message to an inspection component positioned in a message path of the accessed message comprises an act of passing the accessed message to an inspection component positioned in a send path.

18. The method as recited in claim 14, wherein the act of passing the accessed message to an inspection component positioned in a message path of the accessed message comprises an act of passing the accessed message to an inspection control component.

19. The method as recited in claim 14, further comprising:

an act of matching the contents of the accessed message to filter criteria prior to generating the inspection report.

20. The method as recited in claim 19, wherein the act of matching the contents of the accessed message comprises an act of matching the contents of the accessed message to a portion of an XPath statement.

21. The method as recited in claim 14, wherein the act of the inspection component generating an inspection report for the accessed message comprises an act of including a portion of the contents of the accessed message in the inspection report.

22. The method as recited in claim 14, wherein the act of the inspection component generating an inspection report for the accessed message comprises an act of generating the inspection report in accordance with instructions contained in a header of a Simple Object Access Protocol (SOAP) envelope.

23. The method as recited in claim 14, wherein the act of the inspection component generating an inspection report for the accessed message comprises an act of an inspection control component generating an inspection report.

24. The method as recited in claim 14, further comprising:

an act of storing the generated inspection report.

25. The method as recited in claim 14, further comprising:

an act of sending the generated inspection report to an extensibility module.

26. The method as recited in claim 14, wherein the act of passing the accessed message through one or more message path components comprises an act of passing the accessed message through one or more receive path components.

27. The method as recited in claim 26, further comprising:

an act of delivering a modified message to a Web service.

28. The method as recited in claim 14, wherein the act of passing the accessed message through one or more message path components comprises an act of passing the accessed message through one or more send path components.

29. The method as recited in claim 28, further comprising:

an act of delivering a modified message to another computer system.

30. A computer program product for use in a network environment that includes a computer system capable of transferring messages between other computer systems in the network environment, the computer program product for implementing a method for securely activating electronic message inspection, the computer program product comprising one or more computer-readable media having stored thereon computer-executable instructions that, when executed by a processor, cause the computer system to perform the following:

receive a control message;

pass the received control message through one or more receiving path components that are positioned in the receiving path of the received control message;

pass the received control message to a security component subsequent to the received control message being passed through the one or more receiving path components;

authenticate a sender and contents of the received control message;

pass the received control message to an inspection control component in the receiving path subsequent to authenticating the received control message; and

activate message inspection in accordance with instructions contained in the received control message.

31. The method as recited in claim 30, wherein computer-executable instructions that when executed cause the computer system to receive a control message comprise computer-executable instructions that when executed cause the computer system to receive a Simple Object Access Protocol (SOAP) envelope.

32. The method as recited in claim 30, wherein computer-executable instructions that when executed cause the computer system to pass the received control message to a security component comprise computer-executable instructions that when executed cause the computer system to pass the received control message to a security component positioned before the inspection control component in the receive path.

33. The method as recited in claim 30, wherein computer-executable instructions that when executed cause the computer system to pass the received control message to an inspection control component comprise computer-executable instructions that when executed cause the computer system pass the received control message to an inspection control component positioned before the security component in the receive path.

34. The method as recited in claim 30, wherein computer-executable instructions that when executed cause the computer system to activate message inspection comprise computer computer-executable instructions that when executed cause the computer system to activate message inspection comprise computer in accordance instructions contained in a Simple Object Access Protocol (SOAP) envelope header.

35. A computer program product for use in a network environment that includes a computer system capable of transferring messages between other computer systems in the network environment, the computer program product for implementing a method for securely inspecting an electronic message, the computer program product comprising one or more computer-readable media having stored thereon computer-executable instructions that, when executed by a processor, cause the computer system to perform the following:

access a message;

pass the accessed message to an inspection component positioned in a message path of the accessed message;

generate an inspection report for the accessed message, the inspection report being generated in accordance with instructions contained in a previously authenticated control message; and

pass the accessed message through one or more message path components that are positioned in the message path of the accessed message subsequent to generating the inspection report.

36. The method as recited in claim 35, wherein computer-executable instructions that when executed cause the computer system to access a message comprise computer-executable instructions that when executed cause the computer system to access a Simple Object Access Protocol (SOAP) envelope.

37. The computer program product as recited in claim 35, further comprising:

computer-executable instructions that, when executed, cause the computer system to match the contents of the accessed message to filter criteria prior to generating the inspection report.

38. The method as recited in claim 35, wherein computer-executable instructions that when executed cause the computer system generate an inspection report for the accessed message comprise computer-executable instructions that when executed cause the computer system to generate an inspection report in accordance with instructions contained in a header of a Simple Object Access Protocol (SOAP) envelope.