Email message hygiene stamp

• US 7,774,413 B2
• Filed: 08/30/2005
• Issued: 08/10/2010
• Est. Priority Date: 08/30/2005
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Costea, Mihai, Pearson, Malcolm E., Longley, Daniel D.
• Primary Examiner(s): DOAN, DUYEN MY
• Application Number:
  US11/215,823
• Publication Number:
  US 20070050444A1
• Time in Patent Office: 1,806 Days
• Field of Search: 709204-206, 726 22- 24
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Techniques for eliminating duplicate/redundant scanning of email messages while the email message traverses the various servers within an email infrastructure are provided. Some techniques utilize a message hygiene stamp that is transported with the email message as the email message enters an enterprise and is routed within the enterprise until the email message reaches the end user inbox. The filters comprise logic that enables the filters to annotate the result of their filtering or other processing in corresponding message hygiene stamps. The message hygiene stamps allow the filters to determine whether the email message has already been processed by the filter within the email infrastructure.

Claims

1. A method in an email system for filtering an email message, wherein the email system comprises a computer and a plurality of installed filtering agents, each filtering agent having an identifier that identifies a type of the filtering agent and a version of the filtering agent, the method comprising:

receiving by the computer the email message, the email message having a plurality of message hygiene stamps, each of the plurality of message hygiene stamps having an identifier identifying a type of a previous filtering agent that previously filtered the email message, a version of the previous filtering agent, virus signatures scanned by the previous filtering agent, and a result of filtering by the previous filtering agent;

determining by the computer whether the email message is received from a trusted source or received from an un-trusted source;

responsive to determining that the email message is received from the trusted source,

for each of the plurality of install filtering agents,

determining among the plurality of message hygiene stamps in the received email message if an appropriate message hygiene stamp is present, wherein the appropriate message hygiene stamp is the message hygiene stamp has the same identifier as the installed filtering agent;

in response to determining the appropriate message hygiene stamp is present in the received email message,

checking the appropriate message hygiene stamp to determine if the appropriate message hygiene stamp indicates an equal version or a newer version than the installed filtering agent;

when the appropriate message hygiene stamp indicates an equal version or a newer version than the installed filtering agent, not filtering the email message;

when the appropriate message hygiene stamp indicates an older version than the installed filtering agent, filtering the email message by the installed filtering agent;

modify the appropriate hygiene stamp to indicate a result of filtering, the version of the installed filtering agent, and result of the filtering;

in response to determining the appropriate message hygiene stamp is not present,

filtering the email message; and

placing a new message hygiene stamp on the email message indicating that the email message was filtered with the identifier of the installed filter agent, the version of the installed filtering agent, type of scanning and result of the filtering,

responsive to determining that the email message is received from the un-trusted source,

removing from the email message all message hygiene stamps; and

for each of the plurality of installed filtering agents,

filtering the email message with the installed filtering agent; and

placing a new message hygiene stamp on the email message, the new message hygiene having the identifier of the installed filtering agent, the version of the installed filtering agent, a type of scanning and a result of the filtering; and

wherein the message hygiene stamps placed on the email message are transported with the email message to an email client and wherein the email client determines the filtering that has been applied to the email message by analyzing the message hygiene stamps.

2. The method of claim 1, wherein placing the new message hygiene stamp on the email message comprises replacing the message hygiene stamp present with the received email message.

3. The method of claim 1, wherein one of the plurality of the installed filtering agent is an anti-virus filter.

4. The method of claim 1, wherein one of the plurality of the installed filtering agent is a anti-spam filter.

5. The method of claim 1, wherein one of the plurality of the installed filtering agent is a compliance agent.

6. The method of claim 1, wherein one of the plurality of the installed filtering agent is a journaling agent.

7. The method of claim 1, wherein the plurality of message hygiene stamps are placed in an attachment to the email message.

8. The method of claim 1, wherein the plurality of message hygiene stamps are placed in a header of the email message.

9. The method of claim 1 further comprising:

determining whether the email message is to be sent to an un-trusted destination; and

subsequent to determining that the email message is to be sent to the un-trusted destination, cleaning the email message of all message hygiene stamps present with the email message.

10. A computer readable medium storing computer-executable instructions for controlling a computing device to perform a method of filtering an email message, wherein the computing device comprises a plurality of installed filtering agents, each filtering agent having an identifier that identifies a type of the filtering agent and a version of the filtering agent, the method comprising:

receiving the email message, the email message having a plurality of message hygiene stamps, each of the plurality of message hygiene stamps having an identifier identifying a type of a previous filtering agent that previously filtered the email message, a version of the previous filtering agent, virus signatures scanned by the previous filtering agent, and a result of filtering by the previous filtering agent;

determining whether the email message is received from a trusted source or received from an un-trusted source;

responsive to determining that the email message is received from the trusted source,

for each of the plurality of install filtering agents,

determining among the plurality of message hygiene stamps in the received email message if an appropriate message hygiene stamp is present, wherein the appropriate message hygiene stamp is the message hygiene stamp has the same identifier as the installed filtering agent;

in response to determining the appropriate message hygiene stamp is present in the received email message,

checking the appropriate message hygiene stamp to determine if the appropriate message hygiene stamp indicates an equal version or a newer version than the installed filtering agent;

when the appropriate message hygiene stamp indicates an equal version or a newer version than the installed filtering agent, not filtering the email message;

when the appropriate message hygiene stamp indicates an older version than the installed filtering agent, filtering the email message by the installed filtering agent;

modify the appropriate hygiene stamp to indicate a result of filtering, the version of the installed filtering agent, and result of the filtering;

in response to determining the appropriate message hygiene stamp is not present,

filtering the email message by the installed filtering agent; and

placing a new message hygiene stamp on the email message indicating that the email message was filtered with the identifier of the installed filtering agent, the version of the installed filtering agent, type of scanning and a result of the filtering,

responsive to determining that the email message is received from the un-trusted source,

removing from the email message of all message hygiene stamps; and

for each of the plurality of installed filtering agents,

filtering the email message with the installed filtering agent; and

placing a new message hygiene stamp on the email message, the new message hygiene having the identifier of the installed filtering agent, the version of the installed filtering agent, a type of scanning and result of the filtering;

wherein message hygiene stamps placed on the email message are transported with the email message to an email client and wherein the email client determines the filtering that has been applied to the email message by analyzing the message hygiene stamps.

11. The computer-readable medium of claim 10, wherein placing the new message hygiene stamp on the email message comprises replacing the message hygiene stamp present with the received email message.

12. The computer-readable medium of claim 10, wherein the plurality of message hygiene stamps are placed in an attachment to the email message.

13. The computer-readable medium of claim 10, wherein the plurality of message hygiene stamps are placed in a header of the email message.

14. The computer-readable medium of claim 10 further comprising:

determining whether the email message is to be sent to an un-trusted destination; and

subsequent to determining that the email message is to be sent to the un-trusted destination, cleaning the email message of all message hygiene stamps present with the email message.

16. The method of claim 10, wherein placing the new message hygiene stamp on the email message comprises replacing the message hygiene stamp present with the received email message.

15. A computing device programmed to filter an email message, the computing device comprises:

a memory;

a processor;

a plurality of installed filtering agents, each filtering agent having an identifier that identifies a type of the filtering agent and a version of the filtering agent;

a component for receiving the email message, the email message having a plurality of message hygiene stamps, each of the plurality of message hygiene stamps having an identifier identifying a type of a previous filtering agent that previously filtered the email message, a version of the previous filtering agent, virus signatures scanned by the previous filtering agent, and a result of filtering by the previous filtering agent;

a component for determining whether the email message is received from a trusted source or received from an un-trusted source;

a component for responsive to determining that the email message is received from the trusted source,

for each of the plurality of install filtering agents,

determining among the plurality of message hygiene stamps in the received email message if an appropriate message hygiene stamp is present, wherein the appropriate message hygiene stamp is the message hygiene stamp has the same identifier as the installed filtering agent;

in response to determining the appropriate message hygiene stamp is present in the received email message,

checking the appropriate message hygiene stamp to determine if the appropriate message hygiene stamp indicates an equal version or a newer version than the installed filtering agent;

when the appropriate message hygiene stamp indicates an equal version or a newer version than the filtering agent, not filtering the email message;

when the appropriate message hygiene stamp indicates an older version than the installed filtering agent, filtering the email message by the installed filtering agent;

modify the appropriate hygiene stamp to indicate a result of filtering, the version of the installed filtering agent, and result of the filtering;

in response to determining the appropriate message hygiene stamp is not present,

filtering the email message by the installed filtering agent and;

placing a new message hygiene stamp on the email message indicating that the email message was filtered with the identifier of the installed filtering agent, the version of the installed filtering agent, type of scanning and result of the filtering,

a component for, responsive to determining that the email message is received from the un-trusted source, removing from the email message all message hygiene stamps; and

for each of the plurality of installed filtering agents,

filtering the email message with the installed filtering agent; and

placing a new message hygiene stamp on the email message, the new message hygiene having the identifier of the installed filtering agent, the version of the installed filtering agent, a type of scanning and a result of the filtering;

wherein message hygiene stamps placed on the email message are transported with the email message to an email client and wherein the email client determines the filtering that has been applied to the email message by analyzing the message hygiene stamps.