Method and system for recognizing desired email

• US 20070214220A1
• Filed: 03/09/2006
• Published: 09/13/2007
• Est. Priority Date: 03/09/2006
• Status: Active Grant

• Current Assignee: WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: Borderware Technologies Incorporated (Gladiator Corporation)
• Inventors: Osborne, Robert, Alsop, John, Gabe, Christopher
• Granted Patent: US 7,627,641 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

A system and method for recognizing an incoming email as a desired email examines outgoing email messages to arrange the email into fragments for which representations are created and stored. When an incoming message is received, the message is arranged into fragments for which representations are created. The representations of the incoming message are compared to the stored representations and if the matches between stored representations and the representations of the incoming message meet a predefined threshold test, the incoming message is recognized as being desirable. An incoming email message which has been recognized as being desirable can be subjected to a lesser examination to recognize a SPAM message, or to no further examination to recognize a SPAM message.

Claims

1. A method of recognizing an incoming email message as being desired, comprising the steps of:

(i) arranging the contents of an outgoing email message into at least one message fragment;

(ii) for each message fragment creating a representation of at least a portion of the contents of the fragment;

(iii) storing each created representation;

(iv) arranging the contents of an incoming email message into at least one message fragment;

(v) for at least one message fragment of the incoming message creating a representation of at least a portion of the contents of the fragment;

(vi) comparing each representation of a fragment created in step (v) to the stored representations created in step (ii) to identify matches therebetween; and

(vii) identifying the incoming email message as being desired if the matches identified meet a pre-defined threshold test.

2. The method of claim 1 wherein the address of the intended recipient of the outgoing email is one of the fragments.

3. The method of claim 1 wherein the created representation of steps (ii) and (v) comprises copying a portion of the data of the fragment.

4. The method of claim 1 wherein the created representation of steps (ii) and (v) comprises forming a hash of at least a portion of the data of the fragment.

5. The method of claim 1 wherein a time value is stored with each created representation of step (ii) and each created representation is removed from the storage when the associated time value is exceeded.

6. The method of claim 1 wherein the pre-defined threshold test comprises comparing the number of identified matches to a threshold value.

7. The method of claim 1 wherein the pre-defined threshold test comprises a template defining one or more specific matches that must be found in a subject message.

8. The method of claim 6 wherein the number of identified matches is provided as a parameter to a subsequent process operating on the received message.

9. The method of claim 1 wherein, for each incoming message the creation of the representation of at least a portion of the contents of the fragment operates to ignore the presence of a pre-defined set of characters in the fragments.

10. The method of claim 1 wherein an incoming email message identified as being desired is forwarded to the intended recipient without being processed by an anti-SPAM filter.

11. An email system comprising:

at least one incoming email server;

at least one outgoing email server;

at least one email firewall device; and

at least one fingerprinting device which is operable to;

(a) prior to delivering an outgoing email, arrange the outgoing email into at least one message fragment and to create and store a representation of each of the at least one message fragments of the outgoing email;

(b) upon receipt of an incoming email, arrange the incoming email into at least one message fragment and to create a representation of each of the at least one message fragments of the incoming email;

(c) to compare each of representations created for each of the at least one message fragments of the incoming email to the stored representations; and

(d) if the matches between the stored representations and the at least one representations of the message fragments of the incoming email meet a predefined threshold test, then identifying the incoming email as desired.

12. The email system of claim 11 wherein the at least one fingerprinting device is the at least one email firewall device.

13. The email system of claim 11 wherein the representation comprises a copy of at least a portion of the fragment.

14. The email system of claim 11 wherein the representation comprises a hash of at least a portion of the fragment.