Method of validating requests for sender reputation information

• US 20070073660A1
• Filed: 05/05/2006
• Published: 03/29/2007
• Est. Priority Date: 05/05/2005
• Status: Active Grant

• Current Assignee: Ironport Systems (Cisco Systems, Inc.)
• Original Assignee: Ironport Systems (Cisco Systems, Inc.)
• Inventors: Quinlan, Daniel
• Granted Patent: US 7,877,493 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of validating queries for reputation scores of message senders comprises receiving, from a first host computer, a DNS format query to obtain a reputation score associated with a second host computer, wherein the query includes an authentication code; validating the authentication code; and only when validating the authentication code is successful, performing a DNS lookup in a reputation database and returning a DNS response that provides the reputation score associated with the second host computer.

Claims

1. An apparatus, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to perform;

receiving, from a first host computer, a DNS format query to obtain a reputation score associated with a second host computer, wherein the query includes an authentication code;

validating the authentication code;

only when validating the authentication code is successful, performing a DNS lookup in a reputation database and returning a DNS response that provides the reputation score associated with the second host computer.

2. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform sending an NXDOMAIN record to the first host computer when validating the authentication code is unsuccessful.

3. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform determining whether the first computer is listed in a blacklist, and sending an NXDOMAIN record to the first host computer without validating the authentication code when the first computer is listed in the blacklist.

4. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

establishing a master domain and a plurality of subdomains, wherein each of the subdomains is associated with a respective customer group;

receiving the DNS format query from the first computer at a particular subdomain that is associated with a particular customer group, wherein the first computer is associated with the particular customer group, wherein the DNS format query includes an identifier of the particular customer group.

5. The apparatus of claim 4, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

retrieving configuration information associated with the particular customer group, wherein the configuration information for the particular customer group maps one or more discrete sets of reputation values to respective responsive actions;

determining, by mapping the reputation score for the second host computer to one of the discrete sets in the configuration information, a particular responsive action; and

performing the particular responsive action.

6. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

creating and storing, in a log file, a log entry that identifies the first computer and whether validation of the DNS format query was successful;

periodically reading the log file, determining whether the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer, and adding the first computer to the blacklist when the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer.

7. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

retrieving configuration information associated with the first computer, wherein the configuration information identifies a time in which the first computer is allowed to send queries;

determining whether the time has expired;

adding the first computer to the blacklist when the time has expired.

8. An apparatus, comprising:

means for receiving, from a first host computer, a DNS format query to obtain a reputation score associated with a second host computer, wherein the query includes an authentication code;

means for validating the authentication code;

means for performing a DNS lookup in a reputation database and returning a DNS response that provides the reputation score associated with the second host computer only when validating the authentication code is successful.

9. The apparatus of claim 8, further comprising means for sending an NXDOMAIN record to the first host computer when validating the authentication code is unsuccessful.

10. The apparatus of claim 8, further comprising means for determining whether the first computer is listed in a blacklist, and sending an NXDOMAIN record to the first host computer without validating the authentication code when the first computer is listed in the blacklist.

11. The apparatus of claim 8, further comprising:

means for establishing a master domain and a plurality of subdomains, wherein each of the subdomains is associated with a respective customer group;

means for receiving the DNS format query from the first computer at a particular subdomain that is associated with a particular customer group, wherein the first computer is associated with the particular customer group, wherein the DNS format query includes an identifier of the particular customer group.

12. The apparatus of claim 11, further comprising:

means for retrieving configuration information associated with the particular customer group, wherein the configuration information for the particular customer group maps one or more discrete sets of reputation values to respective responsive actions;

means for determining, by mapping the reputation score for the second host computer to one of the discrete sets in the configuration information, a particular responsive action; and

means for performing the particular responsive action.

13. The apparatus of claim 8, further comprising:

means for creating and storing, in a log file, a log entry that identifies the first computer and whether validation of the DNS format query was successful;

means for periodically reading the log file, determining whether the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer, and for adding the first computer to the blacklist when the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer.

14. The apparatus of claim 8, further comprising:

means for retrieving configuration information associated with the first computer, wherein the configuration information identifies a time in which the first computer is allowed to send queries;

means for determining whether the time has expired;

means for adding the first computer to the blacklist when the time has expired.

15. A machine-implemented method comprising:

receiving, from a first host computer, a DNS format query to obtain a reputation score associated with a second host computer, wherein the query includes an authentication code;

validating the authentication code;

only when validating the authentication code is successful, performing a DNS lookup in a reputation database and returning a DNS response that provides the reputation score associated with the second host computer.

16. The method of claim 15, further comprising sending an NXDOMAIN record to the first host computer when validating the authentication code is unsuccessful.

17. The method of claim 15, further comprising determining whether the first computer is listed in a blacklist, and sending an NXDOMAIN record to the first host computer without validating the authentication code when the first computer is listed in the blacklist.

18. The method of claim 15, further comprising:

establishing a master domain and a plurality of subdomains, wherein each of the subdomains is associated with a respective customer group;

receiving the DNS format query from the first computer at a particular subdomain that is associated with a particular customer group, wherein the first computer is associated with the particular customer group, wherein the DNS format query includes an identifier of the particular customer group.

19. The method of claim 18, further comprising:

retrieving configuration information associated with the particular customer group, wherein the configuration information for the particular customer group maps one or more discrete sets of reputation values to respective responsive actions;

determining, by mapping the reputation score for the second host computer to one of the discrete sets in the configuration information, a particular responsive action; and

performing the particular responsive action.

20. The method of claim 15, further comprising:

creating and storing, in a log file, a log entry that identifies the first computer and whether validation of the DNS format query was successful;

periodically reading the log file, determining whether the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer, and adding the first computer to the blacklist when the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer.

21. The method of claim 15, further comprising:

retrieving configuration information associated with the first computer, wherein the configuration information identifies a time in which the first computer is allowed to send queries;

determining whether the time has expired;

adding the first computer to the blacklist when the time has expired.

22. A computer-readable medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving, from a first host computer, a DNS format query to obtain a reputation score associated with a second host computer, wherein the query includes an authentication code;

validating the authentication code;

only when validating the authentication code is successful, performing a DNS lookup in a reputation database and returning a DNS response that provides the reputation score associated with the second host computer.

23. The computer-readable medium of claim 22, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform sending an NXDOMAIN record to the first host computer when validating the authentication code is unsuccessful.

24. The computer-readable medium of claim 22, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform determining whether the first computer is listed in a blacklist, and sending an NXDOMAIN record to the first host computer without validating the authentication code when the first computer is listed in the blacklist.

25. The computer-readable medium of claim 22, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

establishing a master domain and a plurality of subdomains, wherein each of the subdomains is associated with a respective customer group;

receiving the DNS format query from the first computer at a particular subdomain that is associated with a particular customer group, wherein the first computer is associated with the particular customer group, wherein the DNS format query includes an identifier of the particular customer group.

26. The computer-readable medium of claim 25, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

retrieving configuration information associated with the particular customer group, wherein the configuration information for the particular customer group maps one or more discrete sets of reputation values to respective responsive actions;

determining, by mapping the reputation score for the second host computer to one of the discrete sets in the configuration information, a particular responsive action; and

performing the particular responsive action.

27. The computer-readable medium of claim 22, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

creating and storing, in a log file, a log entry that identifies the first computer and whether validation of the DNS format query was successful;

periodically reading the log file, determining whether the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer, and adding the first computer to the blacklist when the first computer has issued a number of queries that exceeds an invalidation threshold for the first computer.

28. The computer-readable medium of claim 22, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform:

retrieving configuration information associated with the first computer, wherein the configuration information identifies a time in which the first computer is allowed to send queries;

determining whether the time has expired;

adding the first computer to the blacklist when the time has expired.