Method And Apparatus For Controlling Unsolicited Messages In A Messaging Network Using An Authoritative Domain Name Server

• US 20100100957A1
• Filed: 10/17/2008
• Published: 04/22/2010
• Est. Priority Date: 10/17/2008
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Alan Graham, Christine Graham
• Inventors: Graham, Alan, Graham, Christine
• Granted Patent: US 8,874,662 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods for controlling unsolicited messages in a messaging network using an authoritative domain name (DNS) server, in which a requester intending to send an e-mail message to a recipient queries the DNS server associated with the recipient'"'"'s domain. The response sent from the DNS server is dependent upon a security policy associated with the requester, which results from interrogations to determine the probability that the requester is sending unsolicited messages or spam. A validity factor is set to a first indicator if the request passes or to a second indicator if the request fails. The response from the DNS server provides the network address if the validity factor is set to the first indicator. A suitable not-the-network-address response is sent if the validity factor is set to the second indicator. The authoritative DNS server thereby controls, blocks, or reroutes the message and lightens the load on the recipient'"'"'s mail server and ISP(s).

Claims

1. A domain name server configured for reducing unsolicited messages communicated in a messaging network configured for sending messages from senders to recipients, comprising:

a domain name server configured for receiving a domain name request from a requester associated with a sender of a message to a recipient for the purpose of obtaining a network address associated with a domain name of the recipient and for communicating a response to the requester;

an analyzer that interrogates the domain name request and in response to the interrogation sets a validity factor to a first indicator if the request passes the interrogation and to a second indicator if the request fails the interrogation; and

a response generator that determines a response to the domain name request based on the validity factor, whereby the response provides the network address associated with the domain name subject of the request if the request passes the interrogation.

2. The domain name server as recited in claim 1, wherein the response generator is configured to provide a response that is not the network address associated with the domain name subject of the request if the validity factor is set to the second indicator.

3. The domain name server as recited in claim 2, wherein the response comprises a value indicating a server error, a non-existent domain was the subject of the request, or a refused request response by the domain name server.

4. The domain name server as recited in claim 1, wherein the response generator is configured to not send a response if the validity factor is set to the second indicator.

5. The domain name server as recited in claim 1, wherein the response generator is configured to provide a network address associated with an enforcement host name for receiving unsolicited messages from the sender if the validity factor is set to the second indicator, whereby the message is transmitted to the enforcement host name.

6. The domain name server as recited in claim 1, wherein the interrogation of the domain name request compares an identification of the source of the domain name request with a list of identified senders of unsolicited messages and if a match is determined, the validity factor is set to the second indicator.

7. The domain name server as recited in claim 1, wherein the interrogation of the domain name request compares the time interval between the current domain name request and the prior domain name request and if the time interval is less than a predetermined value, the validity factor is set to the second indicator.

8. The domain name server as recited in claim 1, wherein the interrogation of the domain name request compares each of a plurality of data fields in the domain name request to a predetermined criteria, and if any data field fails to satisfy the respective criteria, the validity factor is set to the second indicator.

9. The domain name server as recited in claim 1, wherein the interrogation of the domain name request evaluates the length of the request to a predetermined maximum packet length and if substantially equal, the validity factor is set to the second indicator.

10. The domain name server as recited in claim 1, further comprising a table of domain name requesters requesting a domain name and a requester factor that indicates the frequency of the requester making a request to the domain name server, the analyzer updating the table upon each request made by the requester, and if the requester factor exceeds a predetermined value, the validity factor is set to the second indicator.

11. The domain name server in recited in claim 7, wherein the frequency represents a determined ratio of the number of requests made to the DNS server within a predetermined period.

12. The domain name server as recited in claim 1, wherein the analyzer interrogates the domain name request according to an enforcement policy associated with the requester and if the domain name request fails to satisfy the enforcement policy, the validity factor is set to the second indicator.

13. The domain name server as recited in claim 1, wherein the interrogation compares the requester to a database of authorized requesters and if listed, the validity factor is set to the first indicator.

14. The domain name server as recited in claim 1, wherein the analyzer further comprises a list of interrogations to be applied against a request for a domain name, each interrogation having a predetermined first score if the request fails the interrogation and a predetermined second score if the request fails the interrogation, and a threshold value that if exceeded by the sum of the scores of the interrogations results in the validity factor set to the second indicator.

15. The domain name server as recited in claim 14, wherein the predetermined second score is weighted.

16. The domain name server as cited in claim 1, wherein the analyzer creates a score based on the weighted results of two or more interrogation tests, and sets a validity factor based on a pre-defined risk threshold associated with the domain name subject of the request compared with the score.

17. A messaging network configured for communicating electronic messages from a first user to a second user while reducing communication of unsolicited messages, each user nominally identified by a local-part name and a mail-domain domain name, the mail-domain domain name associated with a network service provider that provides electronic mail service to one or more users, comprising:

at least one root server that maintains an authorative index of valid mail-domain names and associated network addresses;

a plurality of network service providers, each providing electronic mail service through a electronic mail server to a plurality of users, each user having a unique local-part name and a mail-domain domain name associated with the mail server;

a domain name server configured for receiving a domain name request from a requester associated with a first user seeking to send a message to a second user as a recipient for the purpose of obtaining a network address associated with the mail-domain domain name of the second user and for communicating a response to the requester, comprising;

an analyzer that interrogates the domain name request and in response to the interrogation sets a validity factor to a first indicator if the request passes the interrogation and to a second indicator if the request fails the interrogation; and

a response generator that determines a response to the domain name request based on the validity factor, whereby the response provides the network address associated with the domain name subject of the request if the request passes the interrogation.

18. A method of blocking communication of unsolicited messages in a messaging network configured for sending messages from senders to recipients with an authoritative domain name server that restricts transmission of an unsolicited message from a sender of an unsolicited message to a recipient, comprising the steps of:

(a) providing in a messaging network a domain name server configured for receiving a domain name request from a requester associated with a sender of a message to a recipient for the purpose of obtaining a network address associated with the domain name of the recipient and for communicating a response to the requester;

(b) analyzing the domain name request based on an enforcement policy and in response setting a validity factor to a first indicator if the request passes the enforcement policy and to a second indicator if the request fails the enforcement policy; and

(c) returning a response to the domain name request based on the validity factor, the response comprising a network address associated with the domain name when the validity factor is set to the first indicator and the response comprising not the network address if the validity factor is set to the second indicator,

whereby the validity factor set as the first indicator permits the message to be sent to the recipient and when set as the second indicator prevents the message from being sent to the recipient.

19. The method as recited in claim 18, wherein the step (c) returning comprises returning a response indicating a server error, a non-existent domain was subject of the request, or a refused request, if the validity factor is set to the second indicator.

20. The method as recited in claim 18, wherein the step (c) returns a network address associated with an enforcement host name for receiving unsolicited messages from the sender if the validity factor is set to the second indicator, whereby the message is transmitted to the enforcement host name.

21. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing an identification of the source of the domain name request with a list of identified senders of unsolicited messages.

22. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing the time interval between the current domain name request and the prior domain name request, and if the time interval is less than a predetermined value, setting the validity factor to the second indicator.

23. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing each of a plurality of data fields in the domain name request to a predetermined criteria, and if any data field fails to satisfy the respective criteria, setting the validity factor to the second indicator.

24. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing the length of the request to a predetermined maximum packet length, and if the lengths are substantially equal, setting the validity factor to the second indicator.

25. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing a table of domain name requesters requesting a domain name and a requester factor that indicates the frequency of the requester making a request to the domain name server, the analyzer updating the table upon each request made by the requester, and if the requester factor exceeds a predetermined value, setting the validity factor to the second indicator.

26. The method as recited in claim 18, wherein the enforcement policy in step (b) comprises comparing the requester to a database of authorized requesters and if listed, the validity factor is set to the first indicator.

27. The method as cited in claim 18, wherein the analyzer in step (b) creates a score based on the weighted results of two or more interrogation tests conducted according to the enforcement policy, and sets the validity factor based on a pre-defined risk threshold associated with the domain name subject of the request compared with the score.