System and method for managing e-mail message traffic

• US 7,346,700 B2
• Filed: 04/07/2003
• Issued: 03/18/2008
• Est. Priority Date: 04/07/2003
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Inc. (Charter Communications Incorporated)
• Inventors: Gould, Kenneth, Chen, John Anthony
• Primary Examiner(s): Kang; Paul H.
• Application Number:
  US10/408,273
• Publication Number:
  US 20040199592A1
• Time in Patent Office: 1,807 Days
• Field of Search: 709/225, 709/224, 709/232, 709/235, 726 22- 26
• US Class Current: 709/232
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method for managing e-mail traffic originating from a specific IP address. An outbound e-mail message is routed to an e-mail governor where the IP address of the computer from which outbound e-mail message originated is determined. A record associated with the originating IP address is created in a datatstore. Metrics useful to determine an e-mail message rate and an e-mail byte rate are stored in the e-mail record. An e-mail message rate is determined and compared with an e-mail message rate threshold. If the e-mail message rate threshold is exceeded, the originating IP address is sending spam e-mail (spam) and redial action is taken. An e-mail byte rate is also determined and compared with an e-mail byte rate threshold. If the e-mail byte rate threshold is exceeded, the originating IP address is using excess network resources to send e-mail and redial action is taken.

Claims

1. A method for blocking excess outbound e-mail traffic originating from an e-mail creation device connected to a shared access network comprising:

creating an outbound e-mail message using an e-mail client operated by the e-mail creation device, wherein the outbound e-mail message comprises packets;

proffering the outbound e-mail message from the e-mail creation device to an e-mail server via a shared access network;

intercepting the proffered outbound e-mail message at an e-mail governor prior to receipt of the proffered e-mail by the e-mail server;

obtaining at the e-mail governor the IP address of the e-mail creation device (the “

originating IP address”

)from a packet;

determining at the e-mail governor if the originating IP address matches a stored IP address stored in a stored IP address record;

if the originating IP address matches the stored IP address, calculating at the e-mail governor a message transmission rate for the originating IP address and comparing the message transmission rate to a threshold message transmission rate;

if the message transmission rate is less than or equal to the threshold message transmission rate, then sending the proffered outbound e-mail message to the e-mail server;

if the message transmission rate exceeds the threshold message transmission rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

2. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1, wherein the e-mail creation device is a computer.

3. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 2, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

4. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1, wherein the e-mail creation device is connected to the shared access network via a wired connection.

5. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1, wherein the e-mail creation device is connected to the shared access network via a wireless connection.

6. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1 further comprising:

if the originating IP address does not match the stored IP address, creating a new stored IP address record associated with the IP address of the e-mail creation device, wherein the new stored IP address record comprises the originating IP address of the e-mail creation device, a time when the new stored IP address record was created and a message count of 1.

7. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1, wherein the stored IP address record further comprises:

a message count; and

a time when the stored IP address record was created; and

wherein calculating a message transmission rate for the originating IP address of the proffered outbound e-mail comprises;

timestamping the proffered outbound e-mail message;

incrementing the message count by 1; and

calculating a message transmission rate by dividing the message count by the difference between the proffered outbound e-mail timestamp and the time the IP address record was created.

8. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 1, wherein the stored IP record further comprises a message count, wherein the method further comprises establishing a time interval;

and

wherein calculating a message transmission rate for the originating IP address of the proffered outbound e-mail comprises;

incrementing the message count by 1;

making a determination whether the time interval has been reached; and

if the time interval has been reached, setting the message transmission rate equal to the message count and setting the message count to zero.

9. The method for blocking excess outbound email traffic originating from an e-mail creation device connected to a shared access network as in claim 8 further comprising:

if the originating IP address does not match the stored IP address, creating a new stored IP address record associated with the IP address of the e-mail creation device, wherein the new stored IP address record comprises the originating IP address of the e-mail creation device and a message count of 1.

10. A method for blocking e-mails from a consumer of excess network resources comprising:

creating an outbound e-mail message using an e-mail client operated by the e-mail creation device, wherein the outbound e-mail message comprises packets;

proffering the outbound e-mail message from the e-mail creation device to an e-mail server via a shared access network;

intercepting the proffered outbound e-mail message at an e-mail governor prior to receipt of the proffered e-mail by the e-mail server;

obtaining at the e-mail governor the IP address of the e-mail creation device (the “

originating IP address”

) from a packet;

determining at the e-mail governor if the originating IP address matches a stored IP address in a stored IP address record;

if the originating IP address matches the stored IP address, calculating at the e-mail governor a message byte rate for the originating IP address and comparing the message byte rate to a threshold message byte rate;

if the message byte rate is less than or equal to the threshold message byte rate, then sending the proffered outbound e-mail message to the e-mail server; and

if the message byte rate exceeds the threshold message byte rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

11. The method for blocking e-mails from a consumer of excess network resources as in claim 10, wherein the e-mail creation device is a computer.

12. The method for blocking e-mails from a consumer of excess network resources as in claim 11, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

13. The method for blocking e-mails from a consumer of excess network resources as in claim 10, wherein the e-mail creation device is connected to the shared access network via a wired connection.

14. The method for blocking e-mails from a consumer of excess network resources as in claim 10, wherein the e-mail creation device is connected to the shared access network via a wireless connection.

15. The method for blocking e-mails from a consumer of excess network resources as in claim 10 further comprising:

if the originating IP address does not match the stored IP address, creating a new stored IP address record associated with the IP address of the e-mail creation device, wherein the new stored IP address record of the e-mail creation device comprises the originating IP address of the e-mail creation device, a time when the new stored IP address record was created and a cumulative e-mail message byte total equal to the size in bytes of the proffered outbound e-mail message.

16. The method for blocking e-mails from a consumer of excess network resources as in claim 10, wherein the stored IP address record further comprises:

a cumulative e-mail message byte total; and

a time when the stored IP address record was created; and

wherein calculating a message byte rate for the originating IP address comprises;

timestamping the proffered outbound e-mail message;

adding the proffered outbound e-mail message size in bytes to the cumulative e-mail message byte total; and

calculating the message byte rate by dividing the cumulative e-mail message byte total by the difference between the proffered outbound e-mail timestamp and the time the stored IP address record was created.

17. The method for blocking e-mails from a consumer of excess network resources as in claim 10, wherein the stored IP address record further comprises a cumulative message byte total, wherein the method further comprises establishing a time interval;

and

wherein calculating a message byte rate for the originating IP address of the proffered outbound e-mail comprises;

adding the proffered outbound e-mail message size in bytes to the cumulative message byte total;

making a determination whether the time interval has been reached; and

if the time interval has been reached, setting the message byte rate equal to the cumulative message byte total and setting the cumulative message byte total to zero.

18. The method for blocking e-mails from a consumer of excess network resources as in claim 17 further comprising:

if the originating IP address does not match the stored IP address, creating a new stored IP record associated with the IP address of the e-mail creation device, wherein the new stored IP address record comprises a cumulative e-mail message byte total equal to the size of the proffered outbound e-mail message in bytes.

19. A system for blocking origination of excess outbound e-mail traffic from an e-mail creation device comprising:

a shared access network;

an e-mail server connected to the shared access network;

an e-mail governor;

an e-mail creation device connected to a shared access network;

an e-mail client operated by the e-mail creation device,

wherein the e-mail client comprises instructions for;

creating an outbound e-mail message, wherein the outbound e-mail message comprises packets; and

proffering the outbound e-mail message to the e-mail server via the shared access network;

a router connected to the shared access network, wherein the router comprises instructions for;

receiving the proffered outbound e-mail message from the e-mail creation device; and

routing the proffered outbound e-mail message to the e-mail governor, wherein the e-mail governor comprises;

an IP address record, wherein the IP address record comprises;

a time when the IP address record was created;

a stored IP address; and

a message count; and

instructions for;

receiving the proffered outbound e-mail message;

obtaining the IP address of the e-mail creation device from which the proffered outbound e-mail message originated (the “

originating IP address”

)from a packet;

determining if the originating IP address matches the stored IP address in the IP address record;

if the originating IP address does not match the stored IP address then;

creating an IP record associated with the IP address of the e-mail creation device;

storing the time the IP address record was created in the IP address record; and

setting the message count in the IP address record to 1;

if the originating IP address matches the stored IP address then;

timestamping the proffered outbound e-mail message;

incrementing the message count by one;

calculating a message transmission rate by dividing the message count by the difference between the proffered outbound e-mail timestamp and the time the IP record was created;

comparing the message transmission rate to a threshold message transmission rate;

if the message transmission rate is less than or equal to the threshold message transmission rate, then sending the proffered outbound e-mail message to the e-mail server; and

if the message transmission rate exceeds a threshold message transmission rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

20. The system of claim 19, wherein the e-mail creation device is a computer.

21. The system of claim 20, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

22. The system of claim 19, wherein the e-mail creation device is connected to the shared access network via a wired connection.

23. The system of claim 19, wherein the e-mail creation device is connected to the shared access network via a wireless connection.

24. A system for blocking origination of excess outbound e-mail traffic from an e-mail creation device comprising:

a shared access network;

an e-mail server connected to the shared access network;

an e-mail governor;

an e-mail creation device connected to a shared access network;

an e-mail client operated by the e-mail creation device,

wherein the e-mail client comprises instructions for;

creating an outbound e-mail message, wherein the outbound e-mail message comprises packets; and

proffering the outbound e-mail message to the e-mail server via the shared access network;

a router connected to the shared access network, wherein the router comprises instructions for;

receiving the proffered outbound e-mail message from the e-mail creation device; and

routing the proffered outbound e-mail message to the e-mail governor,

wherein the e-mail governor comprises;

an IP address record, wherein the IP address record comprises;

a stored IP address;

a time interval; and

a message count; and

instructions for;

measuring a time interval;

receiving the proffered outbound e-mail message;

obtaining the IP address of the e-mail creation device from which the proffered outbound e-mail message originated (the “

originating IP address”

) from a packet;

determining if the originating IP address matches the stored IP address in the IP address record;

if the originating IP address does not match the stored IP address then;

creating an IP record associated with the IP address of the e-mail creation device;

setting the message count in the IP address record to 1;

if the originating IP address matches the stored IP address then;

incrementing the message count by one,

determining if the lapsed time equals or exceeds the time interval;

if the elapsed time is equal to or greater than the time interval, then setting the message transmission rate equal to the message count and setting the elapsed time and the message count to zero;

comparing the message transmission rate to a threshold message transmission rate;

if the message transmission rate is less than or equal to the threshold message transmission rate, then sending the proffered outbound e-mail message to the e-mail server; and

if the message transmission rate exceeds a threshold message transmission rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

25. The system of claim 24, wherein the e-mail creation device is a computer.

26. The system of claim 25, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

27. The system of claim 24, wherein the e-mail creation device is connected to the shared access network via a wired connection.

28. The system of claim 24, wherein the e-mail creation device is connected to the shared access network via a wireless connection.

29. A system for blocking e-mails from a consumer of excess network resources comprising:

a shared access network;

an e-mail server connected to the shared access network;

an e-mail governor;

an e-mail creation device connected to a shared access network;

an e-mail client operated by the e-mail creation device,

wherein the e-mail client comprises instructions for;

creating an outbound e-mail message, wherein the outbound e-mail message comprises packets; and

proffering the outbound e-mail message to the e-mail server via the shared access network;

a router connected to the shared access network, wherein the routed comprises instructions for;

receiving the proffered outbound e-mail message from the e-mail creation device; and

routing the proffered outbound e-mail message to the e-mail governor,

wherein the e-mail governor comprises;

an IP address record, wherein the IP address record comprises;

a time when the IP address record was created;

a stored IP address; and

a cumulative message byte total; and

instructions for;

receiving the proffered outbound e-mail message, wherein the e-mail message comprises packets;

obtaining the IP address of an e-mail creation device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

) from a packet;

determining if the originating IP address matches the stored IP address in the IP address record;

if the originating IP address does not match the stored IP address then;

creating an IP record associated with the IP address of the e-mail creation device;

storing the time the IP address record was created in the IP address record; and

setting the cumulative message byte total in the IP address record to the size of the proffered outbound e-mail message in bytes;

if the originating IP address matches the stored IP address then;

timestamping the proffered outbound e-mail message,

adding the size of the proffered outbound e-mail message in bytes to the cumulative message byte total;

calculating a message byte rate by dividing the cumulative message byte total by the difference between the proffered outbound e-mail timestamp and the time the IP address record was created;

comparing the message byte rate to a threshold message byte rate;

if the message byte rate is less than or equal to the threshold message byte rate, then sending the proffered outbound e-mail message to the e-mail server; and

if the message byte rate exceeds a threshold message byte rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

30. The system of claim 29, wherein the e-mail creation device is a computer.

31. The system of claim 30, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

32. The system of claim 29, wherein the e-mail creation device is connected to the shared access network via a wired connection.

33. The system of claim 29, wherein the e-mail creation device is connected to the shared access network via a wireless connection.

34. A system for blocking emails from a consumer of excess network resources comprising:

a shared access network;

an e-mail server connected to the shared access network;

an e-mail governor;

an e-mail creation device connected to a shared access network;

an e-mail client operated by the e-mail creation device,

wherein the e-mail client comprises instructions for;

creating an outbound e-mail message, wherein the outbound e-mail message comprises packets; and

proffering the outbound e-mail message to the e-mail server via the shared access network;

a router connected to the shared access network, wherein the router comprises instructions for;

receiving the proffered outbound e-mail message from the e-mail creation device; and

routing the proffered outbound e-mail message to the e-mail governor,

wherein the e-mail governor comprises;

an IP address record, wherein the IP address record comprises;

a time interval;

a stored IP address; and

a cumulative message byte total; and

instructions for;

measuring the time interval;

receiving the proffered outbound e-mail message, wherein the e-mail message comprises packets;

obtaining the IP address of an e-mail creation device connected to the shared access network from which the proffered outbound e-mail message originated (the “

originating IP address”

) from a packet;

determining if the originating IP address matches the stored IP address in the IP address record;

if the originating IP address does not match the stored IP address;

creating an IP record associated with the IP address of the e-mail creation device; and

setting the cumulative message byte total in the IP address record to the size of the proffered outbound e-mail message in bytes;

if the originating IP address matches the stored IP address then;

determining if the lapsed time equals or exceeds the time interval;

if the elapsed time is equal to or greater than the time interval, then setting the message byte rate equal to the cumulative message byte total and set the elapsed time and the cumulative message byte total to zero;

comparing the message byte rate to a threshold message byte rate;

if the message byte rate is less than or equal to the threshold message byte rate, then sending the proffered outbound e-mail message to the e-mail server; and

if the message byte rate exceeds a threshold message transmission rate, then discarding the outbound e-mail message and blocking subsequent e-mails from the originating IP address.

35. The system for detecting a consumer of excess network resources as in claim 34, wherein the e-mail creation device is a computer.

36. The system of claim 35, wherein the computer is selected from the group consisting of a personal computer, a laptop computer, and a personal digital assistant.

37. The system of claim 35, wherein the e-mail creation device is connected to the shared access network via a wired connection.

38. The system of claim 34, wherein the e-mail creation device is connected to the shared access network via a wireless connection.