Method For Blocking Unwanted E-Mail Based On Proximity Detection

• US 20070204026A1
• Filed: 07/27/2005
• Published: 08/30/2007
• Est. Priority Date: 07/27/2004
• Status: Abandoned Application

• Current Assignee: US Telecom, Inc. (Kansas) (Deutsche Telekom AG)
• Original Assignee: US Telecom, Inc. (Kansas) (Deutsche Telekom AG)
• Inventors: Berger, Robert
• Application Number:
  US11/632,258
• Publication Number:
  US 20070204026A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]

Abstract

The abstract must be less than 150 words, or 200 words when no figure is to be published. Proximity detection algorithms are used to determine whether or not the render of the message is authentic, by verifying if the sending host (242) is within proximity of registered MX Hosts 182, WWW Hosts, and/or DNS servers forth alleged sending domain. Proximity detection, combined with Select Reverse DNS lookups (153), provides extremely effective and accurate e-mail source verification system (110,107). As this combination relies solely on the existing Internet Domain Name System for its identifying matrix, an affective anti-SPAM system/method is realized without making any changes to any installed e-mail systems. In addition to proximit detection, Automatic Open Relay Test Administration (AORTA) (124,132) is used to perform Open Relay (118) testing on all servers attempting to send a message.

Claims

1. A method to block unwanted electronic communication based on proximity detection, said method comprising the steps of:

a. receiving an initial dialogue regarding an incoming electronic communication from a sending host to a recipient over a network;

b. verifying if said sending host'"'"'s IP address is within at least one predefined proximity value of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a VWW host, or a DNS server; and

c. blocking said incoming electronic communication if said verification is unsuccessful, else, receiving said incoming e-mail and forwarding said received e-mail to said recipient.

2. A method to block unwanted electronic communication based on proximity detection, as, per claim 1, wherein said electronic communication is an e-mail.

3. A method to block unwanted electronic communication based on proximity detection, as per claim 1, wherein said electronic communication is SPAM.

4. A method to block unwanted electronic communication based on proximity detection, as per claim 1, wherein said at least one proximity value is 10,752 and said verification step is successful if said sending host'"'"'s IP address is within 10,752 IP addresses of any one of, or a combination of, said MX host, said WWW host, or said DNS server.

5. A method to block unwanted electronic communication based on proximity detection, as per claim 1, wherein proximity value is individually set for individual domains providing tighter and/or looser tolerances.

6. A method to block unwanted electronic communication based on proximity detection, as per claim 1, wherein said network is any of the following:

local area network, wide are network, or the Internet.

7. A method to block unwanted e-mail based on proximity detection, said method comprising the steps of:

a. receiving an initial dialogue regarding an incoming e-mail from a mail server over a network, said incoming e-mail sent by a sending host intended for a recipient;

b. performing an open relay test on said mail server to identify if said mail server is an open relay server;

c. verifying if said sending host'"'"'s IP address is within at least one predefined proximity value of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a WWW host, or a DNS server; and

d. blocking said incoming e-mail if said verification in (c) is unsuccessful and/or said mail server is an open relay server, else, receiving said incoming e-mail and forwarding said received e-mail to said recipient.

8. A method to block unwanted e-mail based on proximity detection, as per claim 7, wherein said method further comprises the step of maintaining a blacklist of servers, each entry in said blacklist having previously failed said open relay test and having an associated time-to-live (TTL) value defining a time period after which said open relay test is to be repeated.

9. A method to block unwanted e-mail based on proximity detection, as per claim 7, wherein said unwanted e-mail is SPAM.

10. A method to block unwanted e-mail based on proximity detection, as per claim 7, wherein said at least one proximity value is 10,752 and said verification step is successful if said sending host'"'"'s IP address is within 10,752 IP addresses of any one of, or a combination of, said MX host, said WWW host, or said DNS server.

11. A method to block unwanted e-mail based on proximity detection, as per claim 7, wherein said network is any of the following:

local area network, wide are network, or the Internet.

12. A method to block unwanted e-mail based on proximity detection, said method comprising the steps of:

a. receiving an initial dialogue regarding an incoming e-mail from a sender intended for a recipient;

b. identifying a domain association with said sender'"'"'s IP address by performing a selective reverse DNS (SRD) lookup on said sender'"'"'s IP address, said SRD performed exclusively on domains that are predetermined to have proper PTR records;

c. verifying if said sending host'"'"'s IP address is within at least one predefined proximity value of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a WWW host, or a DNS server; and

d. blocking said incoming e-mail if said verification in (c) is unsuccessful and/or said identified domain in (b) fails to match domain associated with said sender'"'"'s e-mail address, else, receiving said incoming e-mail and forwarding said received e-mail to said recipient.

13. A method to block unwanted e-mail based on proximity detection, as per claim 12, wherein said unwanted e-mail is SPAM.

14. A method to block unwanted e-mail based on proximity detection, as per claim 12, wherein said verification step is successful if said at least one proximity value is 10,752 and said sending host'"'"'s IP address is within 10,752 IP addresses of any one of, or a combination of, said MX host, said WWW host, or said DNS server.

15. A method to block unwanted e-mail based on proximity detection, as per claim 12, wherein said network is any of the following:

local area network, wide are network, or the Internet.

16. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, each device comprising:

a. a network interface to receive, over a network, an initial dialogue regarding an incoming e-mail from a sending host to a recipient;

b. a proximity detection module to extract sending host'"'"'s IP address and verify if said sending host'"'"'s IP address is within at least one predefined proximity value of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a WWW, host, or a DNS server; and

c. said network interface blocking said incoming e-mail if said verification is unsuccessful, else, said network interface receiving said incoming e-mail and forwarding said received e-mail to said recipient.

17. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 16, wherein each of said anti-sparn devices maintains, on a subscription basis, a plurality of the following lists:

open relay list, universal white list, universal black list, ISP list, e-mail service provider list, or selective reverse DNS list, said lists used in conjunction with said proximity detection module to block unwanted e-mail.

18. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 16, wherein said unwanted e-mail is SPAM.

19. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 16, wherein said proximity detection module successfully verifies if said at least one proximity value is within 10,752 IP addresses of any one of, or a combination of, said MX host, said WWW host, or said DNS server.

20. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 16, wherein said network is any of the following:

local area network, wide are network, or the Internet.

21. An article of manufacture comprising a computer user medium having computer readable program code embodied therein which implements a method to block unwanted electronic communication based on proximity detection, said medium comprising:

a. computer readable program code aiding in receiving an initial dialogue regarding an incoming electronic communication from a sending host to a recipient;

b. computer readable program code verifying if said sending host'"'"'s IP address is within proximity of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a WWW host, or a DNS server; and

c. computer readable program code blocking said incoming electronic communication if said verification is unsuccessful, else, receiving said incoming e-mail and forwarding said received e-mail to said recipient.

22. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, each device comprising:

a. a network interface aiding in receiving an initial dialogue regarding an incoming e-mail from a mail server over a network, said incoming e-mail sent by a sending host intended for a recipient;

b. an open relay tester performing an open relay test on said mail server to identify if said mail server is an open relay server;

c. a proximity detection module verifying if said sending host'"'"'s IP address is within 10,752 IP addresses of any one of, or a combination of, the following hosts associated with said sending host;

an MX host, a WWW host, or a DNS server; and

d. a blocking module blocking said incoming e-mail if said verification in said proximity detection module is unsuccessful and/or said open relay tester verifies that said mail server is an open relay server, else, said network interface receiving said incoming e-mail and forwarding said received e-mail to said recipient.

23. A plurality of anti-sparn devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 22, wherein said network is any of the following:

local area network, wide are network, or the Internet.

24. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, each device comprising:

a. a network interface aiding in receiving an initial dialogue regarding an incoming e-mail from a sender intended for a recipient;

b. an selective reverse DNS unit identifying a domain association with said sender'"'"'s IP address by performing a selective reverse DNS (SRD) lookup on said sender'"'"'s IP address, said SRD performed exclusively on domains that are predetermined to have proper PTR records;

c. a proximity detection module verifying if said sending host'"'"'s IP address is within 10,752 IP addresses of any one of, or a combination of, the following hosts associated with said sending host;

an Mx host, a WWW host, or a DNS server; and

d. a blocking module blocking said incoming e-mail if said proximity detection module unsuccessfully verifies and/or said domain identified by said SRD unit fails to match domain associated with said sender'"'"'s e-mail address, else, said network interface receiving said incoming e-mail and forwarding said received e-mail to said recipient.

25. A plurality of anti-spam devices geographically distributed over at least one network, each of said devices blocking unwanted e-mail based on proximity detection algorithms, as per claim 24, wherein said network is any of the following:

local area network, wide are network, or the Internet.