ELECTRONIC MAIL PROCESSING UNIT INCLUDING SILVERLIST FILTERING

• US 20090307320A1
• Filed: 06/10/2008
• Published: 12/10/2009
• Est. Priority Date: 06/10/2008
• Status: Abandoned Application

• Current Assignee: Sendio Incorporated
• Original Assignee: Sendio Incorporated
• Inventors: Brown, Cameron, Golan, Tal
• Application Number:
  US12/136,697
• Publication Number:
  US 20090307320A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

Systems and methods of filtering received messages to discard unsolicited messages using silverlist filters and combinations of silverlist filters and other types of filters are disclosed. In many embodiments, an appliance remote from a mail server is used to filter messages using at least a silverlist filter prior to forwarding messages to the mail server. In a number of embodiments, a mail server applies a filtering process that includes a silverlist filter and a challenge response filter. One embodiment of the method of the invention includes receiving a message envelope sent from a sender IP address, where the message envelope includes a sender address and at least one recipient address, determining the reputation of the sender IP address, allowing the message when the sender has a reputable sender IP address, irrespective of the sender and recipient addresses, and performing a test when the sender IP address has unknown reputation. In addition, the test includes issuing a temporary failure to the sender, detecting as a retry a message envelope received within a predetermined time period, where the sender and recipient addresses of the original message envelope and the received message envelope correspond, and allowing the retry message.

Claims

1. A process for filtering messages, comprising:

receiving a message envelope sent from a sender IP address, where the message envelope includes a sender address and at least one recipient address;

determining the reputation of the sender IP address;

allowing the message when the sender has a reputable sender IP address, irrespective of the sender and recipient addresses; and

performing a test when the sender IP address has unknown reputation, the test comprising;

issuing a temporary failure to the sender; and

detecting as a retry a message envelope received within a predetermined time period, where the sender and recipient addresses of the original message envelope and the received message envelope correspond; and

allowing the retry message.

2. The process of claim 1, wherein determining the reputation of the sender IP address of each message comprises determining whether the sender IP address has passed said test within a predetermined time period.

3. The process of claim 2, wherein determining whether the sender IP address has passed said test within a predetermined time period comprises consulting a reputation database containing a listing of sender IP addresses that have passed said test within a predetermined time period.

4. The process of claim 3, wherein consulting said reputation database comprises querying a local reputation database.

5. The process of claim 3, wherein consulting said reputation database comprises sending a query to a remote reputation server.

6. The process of claim 3, further comprising storing reputation information concerning a sender IP address in said reputation database in response to the outcome of said test.

7. The process of claim 2, wherein the message has a plurality of recipient addresses and further comprising performing said test with at least two of the recipient addresses.

8. The process of claim 7, further comprising determining whether a recipient has authorized performance of said test.

9. The process of claim 2, further comprising determining whether the sender and recipient addresses of the original message envelope and the retried message envelope correspond using hash values of the addresses.

10. The process of claim 1, wherein detecting a received message as a retry further comprises:

determining that the sender and recipient addresses of the original message envelope and the received message envelope correspond; and

determining that the sender IP addresses of the original message envelope and the received message envelope correspond.

11. The process of claim 1, further comprising:

comparing the sender address of the message envelope to a whitelist of sender addresses; and

allowing messages where the sender address of the message envelope appears on the whitelist.

12. The process of claim 1, further comprising:

comparing the sender address of the message envelope to a blacklist of sender addresses; and

refusing to allow messages where the sender address of the message envelope appears on the blacklist.

13. The process of claim 1, further comprising applying a challenge response filtering process to messages that are allowed.

14. The process of claim 13, wherein the challenge response filter process comprises:

sending a challenge message to the sender of the allowed message; and

providing the allowed message to the recipient when an appropriate response to the challenge message is received from the sender of the allowed message.

15. The process of claim 14, wherein the challenge response filtering process comprises:

comparing the sender address of the allowed message to a whitelist of sender addresses;

providing the allowed message to the recipient when the sender address of the allowed message is on the whitelist;

comparing the sender address of the allowed message to a blacklist of sender addresses;

rejecting the allowed message when the sender address of the allowed message is on a blacklist;

sending a challenge message to the sender address of the allowed message when the sender of the allowed message is neither on the whitelist or the blacklist; and

providing the allowed message to the recipient when an appropriate response to the challenge message is received from the sender of the allowed message.

16. The process of claim 1, further comprising applying a content filtering process to messages that are allowed by the silverlist filter.

17. The process of claim 1, wherein the message is destined for a remote mail server and the filtering process includes forwarding messages that pass the filtering process to the remote mail server.

18. A mail processing unit, comprising:

a network connection configured to receive connection information, message envelopes, and message data, where the connection information includes a sender IP address, and message envelopes include a sender address and a recipient address; and

a processor configured to determine the reputation of the sender IP address of each message;

wherein the processor is further configured to allow messages from senders having reputable sender IP addresses; and

wherein the processor is further configured to perform a test on messages from senders of messages having an IP address of unknown reputation, comprising;

transmitting a temporary failure message via the network connection to the sender of the a message having an IP addresses of unknown reputation;

detecting as a retry a message envelope received via the network connection within a predetermined time period, where the sender and recipient addresses of the original message envelope and the received message envelope correspond; and

allowing the retry message.

19. The mail processing unit of claim 18, wherein the processor is configured to determine the reputation of a sender IP address by determining whether the sender IP address has passed said test within a predetermined time period.

20. The mail processing unit of claim 19, wherein the processor is configured to determine whether the sender IP address has passed said test within a predetermined time period by consulting a reputation database containing a listing of sender IP addresses that have passed said test within a predetermined time period.

21. The mail processing unit of claim 20, wherein the processor is configured to query a local reputation database.

22. The mail processing unit of claim 20, wherein the processor is configured to transmit a query to a remote reputation server via the network connection.

23. The mail processing unit of claim 20, wherein the processor is further configured to store reputation information in the reputation database concerning a sender IP address in response to the outcome of said test.

24. The mail processing unit of claim 19, wherein the processor is configured to perform said test with respect to multiple recipient addresses, when a message includes a plurality of recipient addresses.

25. The mail processing unit of claim 24, wherein the processor is configured to determine whether a recipient has authorized performance of said test prior to performing said test.

26. The mail processing unit of claim 19, wherein the processor is configured to determine whether the sender and recipient addresses of the original message envelope and the retried message envelope correspond using hash values of the addresses.

27. The mail processing unit of claim 18, wherein the processor is configured to detect a received message as a retry by:

determining that the sender and recipient addresses of the original message envelope and the received message envelope correspond; and

determining that the sender IP addresses of the original message envelope and the received message envelope correspond.

28. The mail processing unit of claim 18, wherein the processor is configured to apply a whitelist filter to received message envelopes comprising:

comparing the sender address of the message envelope to a whitelist of sender addresses; and

allowing messages where the sender address of the message envelope appears on the whitelist.

29. The mail processing unit of claim 18, wherein the processor is configured to apply a blacklist filter to received message envelopes comprising:

comparing the sender address of the message envelope to a blacklist of sender addresses; and

refusing to allow messages where the sender address of the message envelope appears on the blacklist.

30. The mail processing unit of claim 18, wherein the processor is further configured to apply a challenge response filter to allowed messages.

31. The mail processing unit of claim 30, wherein the processor is further configured to:

send a challenge message to the sender of the allowed message; and

provide the allowed message to the recipient when an appropriate response to the challenge message is received from the sender of the allowed message.

32. The mail processing unit of claim 30, wherein the processor is further configured to:

provide the allowed message to the recipient when the sender address of the allowed message is on a whitelist;

reject the allowed message when the sender address of the allowed message is on a blacklist;

send a challenge message to the sender address of the allowed message when the sender address of the allowed message is neither on the whitelist or the blacklist; and

provide the allowed message to the recipient when an appropriate response to the challenge message is received from the sender of the allowed message.

33. The mail processing unit of claim 18, wherein the processor is further configured to apply a content filter to allowed messages.

34. The mail processing unit of claim 18, wherein the message is destined for a remote mail server and the processor is configured to forward allowed messages to the remote mail server.