TRUSTED COMMUNICATION NETWORK

• US 20150358352A1
• Filed: 08/19/2015
• Published: 12/10/2015
• Est. Priority Date: 12/21/2004
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Chasin, C. Scott, Lin, Wei
• Granted Patent: US 10,212,188 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system includes a processing node configured to send authorized inbound messages to registered enterprise networks. An authorized message is a message that includes trusted source indicia. Trusted source indicia indicates that the message was sent by one or more of the processing node or an authenticated message transfer node associated with one of the registered enterprise networks. The system may further include an administration node configured to maintain registration of a plurality of message transfer nodes associated with the enterprise networks. A method includes receiving outbound messages from an authenticated message transfer node of an enterprise network, screening the messages for threats to determine whether to send the messages to associated recipients, applying a first message identifier to each message, wherein the first message identifier can be used to track the message and, for each message, sending the message to the associated recipient if no threats are detected in the message.

Claims

1-39. -39. (canceled)

40. An apparatus for reputation management by reducing threats emanating from a member network, comprising:

a memory element operable to store electronic code; and

a processor operable to execute instructions associated with the electronic code, such that the apparatus is configured to;

detect, by a threat detection module, a threat in an outbound message originating from a member of a member network;

in response to detecting the threat, quarantine the outbound message in an outbound quarantine;

dispose the quarantined message based on a disposition policy; and

adjust, by a reputation module, a reputation score of the member based on the detected threat.

41. The apparatus of claim 40, wherein the apparatus is further configured to:

receive the outbound message from an end user node on the member network;

identify the member and the member'"'"'s policy; and

filter the outbound message according to the member'"'"'s policy.

42. The apparatus of claim 40, wherein the apparatus is further configured to:

track, by a quarantine pool, when messages enter the outbound quarantine.

43. The apparatus of claim 40, wherein the apparatus is further configured to:

track, by a quarantine pool, the order in which messages are disposed.

44. The apparatus of claim 40, wherein the apparatus is further configured to:

determining, by a billing services module, billing amount to the member based on duration of retention period for quarantined messages in the outbound quarantine.

45. The apparatus of claim 40, wherein:

the threat is a behavior-based anomaly indicating that a bot is resident on an identified node in the member network; and

the apparatus is further configured to quarantine all messages sent from the identified node within the enterprise network, while allow outbound messages from one or more other nodes within the member network to be sent to message recipients.

46. The apparatus of claim 40, wherein the apparatus is further configured to:

receive the outbound message from an end user node on the member network; and

filter the outbound message based on the member'"'"'s reputation score.

47. The apparatus of claim 40, the apparatus is further configured to:

receive the outbound message from an end user node on the member network;

filter the outbound message based on one or more Simple Mail Transport Protocol attributes.

48. The apparatus of claim 40, the apparatus is further configured to:

receive the outbound message from an end user node on the member network;

filter the outbound message based on content filtering, wherein the content filtering specifies message profanity, pornography, undesirable content, or questionable content be filtered for quarantining.

49. The apparatus of claim 40, wherein the disposition policy is selected from a group consisting of:

quarantine until release,

bounce back to specified enterprise network user,

delete without sending,

deliver after a specified time, and

deliver only after approval.

50. One or more non-transitory computer-readable storage media having machine-executable instructions for reputation management by reducing threats emanating from a member network, said instructions when executed on a processor configure the processor to:

detect, by a threat detection module, a threat in an outbound message originating from a member of a member network;

in response to detecting the threat, quarantine the outbound message in an outbound quarantine;

dispose the quarantined message based on a disposition policy; and

adjust, by a reputation module, a reputation score of the member based on the detected threat.

51. The one or more non-transitory computer-readable storage media of claim 50, wherein the processor is further configured to:

receive the outbound message from an end user node on the member network;

identify the member and the member'"'"'s policy; and

filter the outbound message according to the member'"'"'s policy.

52. The one or more non-transitory computer-readable storage media of claim 50, wherein the processor is further configured to:

track, by a quarantine pool, when messages enter the outbound quarantine.

53. The one or more non-transitory computer-readable storage media of claim 50, wherein the processor is further configured to:

track, by a quarantine pool, the order in which messages are disposed.

54. The one or more non-transitory computer-readable storage media of claim 50, wherein the processor is further configured to:

determine, by a billing services module, billing amount to the member based on duration of retention period for quarantined messages in the outbound quarantine.

55. A method for reputation management by reducing threats emanating from a member network, the method comprising:

detecting, by a threat detection module, a threat in an outbound message originating from a member of a member network;

in response to detecting the threat, quarantining the outbound message in an outbound quarantine;

disposing the quarantined message based on a disposition policy; and

adjusting, by a reputation module, a reputation score of the member based on the detected threat.

56. The method of claim 55, wherein:

the threat is a behavior-based anomaly indicating that a bot is resident on an identified node in the member network; and

the method further comprises quarantining all messages sent from the identified node within the enterprise network, while allowing outbound messages from one or more other nodes within the member network to be sent to message recipients.

57. The method of claim 55, further comprising:

receiving the outbound message from an end user node on the member network; and

filtering the outbound message based on the member'"'"'s reputation score.

58. The method of claim 55, the apparatus is further configured to:

receiving the outbound message from an end user node on the member network;

filtering the outbound message based on one or more Simple Mail Transport Protocol attributes and content filtering, wherein the content filtering specifies message profanity, pornography, undesirable content, or questionable content be filtered for quarantining.

59. The method of claim 55, wherein disposing the quarantined message comprises one of the following:

deleting the quarantined message without delivery after a specified amount of time;

delivering the quarantined message after a specified amount of time;

delivering the quarantined message only after approval is received from an enterprise network administrator;

sending the quarantined message to an identified user within the enterprise network; and

sending the quarantined message to the sender of the quarantined message.