Net-Based Email Filtering

• US 20110307950A1
• Filed: 06/08/2011
• Published: 12/15/2011
• Est. Priority Date: 06/09/2010
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Eikenberry, Scott, Gmuender, John, Yanovsky, Boris, Karlcut, Akbal Singh, Uy, Michael Carl Y.
• Granted Patent: US 8,671,447 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A local gateway device receives email across the internet from a sender of the email and forwards it across the internet to an email filtering system. The email filtering system analyzes the email to determine whether it is spam, phishing or contains a virus and sends it back to the local gateway device along with the filtered determination. The local gateway device forwards the received email and the filtered determination to a local junk store which handles the email appropriately. For example, if the email has been determined to be spam, phishing or containing a virus, the junk store can quarantine the email and if the email has been determined to be non-spun and/or not phishing and/or not containing a virus, the junk store can forward the email to a local mail server for delivery.

Claims

1. An email filtering process comprising the steps of:

a) receiving email at a UTM Gateway from an MTA across a first internet-based communication connection;

b) sending the received email from the UTM Gateway to an Email Security Appliance across a second internet-based communication connection;

c) receiving the email with a filtered status at the UTM Gateway from the Email Security Appliance across a third internet-based communication connection; and

d) sending the email with the filtered status from the UTM Gateway to a Junk Store across a first local communication connection.

2. The email filtering of claim 1 further comprising, before (a):

i) establishing the first internet-based communication connection between the UTM Gateway and the MTA;

ii) establishing the second internet-based communication connection between the UTM Gateway and the Email Security Appliance;

iii) establishing the third internet-based communication connection between the UTM Gateway and the Email Security Appliance; and

iv) establishing the first local communication connection between the UTM Gateway and a Junk Store.

3. The email filtering process of claim 1 further comprising sending email filter processing rules from the UTM Gateway to the Email Security Appliance.

4. The email filtering process of claim 1 further comprising, between (b) and (c):

processing the email at the Email Security Appliance to determine whether it is a spam email or a non-spam email and either;

(i) giving the email a filtered status indicating spam if the email is determined to be spam email;

or

(ii) giving the email a filtered status indicating non-spam if the email is determined to not be spam email.

5. The email filtering process of claim 1 further comprising:

quarantining the received email at the Junk Store if the email with the filtered status indicates that the email is spam;

or

sending the received email from the Junk Store to a local mail server if the email with the filtered status indicates that the email is non-spam.

6. The email filtering process of claim 1 further comprising, between (b) and (c):

processing the email at the Email Security Appliance to determine whether it is a phishing email or a non-phishing email and either;

(i) giving the email a filtered status indicating phishing if the email is determined to be phishing email;

or

(ii) giving the email a filtered status indicating non-phishing if the email is determined to not be phishing

7. The email filtering process of claim 1 further comprising:

quarantining the received email at the Junk Store if the email with the filtered status indicates that the email is phishing;

or

sending the received email from the Junk Store to a local mail server if the email with the filtered status indicates that the email is non-phishing.

8. The email filtering process of claim 1 further comprising, between (b) and (c):

processing the email at the Email Security Appliance to determine whether it is a virus-containing email or a non-virus containing email and either;

(i) giving the email a filtered status indicating a virus if the email is determined to be a virus containing email;

or

(ii) giving the email a filtered status indicating no virus if the email is determined to not be a virus containing email.

9. The email filtering process of claim 1 further comprising:

quarantining the received email at the Junk Store if the email with the filtered status indicates that the email contains a virus;

or

sending the received email from the Junk Store to a local mail server if the email with the filtered status indicates that the email does not contain a virus.

10. The email filtering process of claim 1 further comprising checking the reputation of the IP address of the MTA against an allow list and a block list on the UTM Gateway.

11. The email filtering process of claim 1 further comprising checking the reputation of the IP address of the MTA by the UTM Gateway checking with an IP Address Reputation Service,

12. The email filtering process of claim 1 wherein the first internet-based communication connection is an SMTP connection using port 25 of the UTM Gateway.

13. The email filtering process of claim 1 wherein the second internet-based communication connection is an SMTP connection using port 25 of the Email Security Appliance.

14. The email filtering process of claim 1 wherein the third internet-based communication connection is an SMTP connection using port 10025 on the UTM Gateway.

15. The email filtering process of claim 3 wherein the UTM Gateway sends email filter processing rules using a custom SMTP HELO command,

16. The email filtering process of claim 1 further comprising scanning the email received at the UTM Gateway from the MTA for viruses before sending the received email from the UTM Gateway to the Email Security Appliance.