E-mail firewall with policy-based cryptosecurity

• US 8,255,683 B2
• Filed: 09/05/2006
• Issued: 08/28/2012
• Est. Priority Date: 07/23/1998
• Status: Expired due to Fees

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Axway Incorporated (Axway Software SA)
• Inventors: Krishnamurthy, Sathvik, Dickinson, III, Robert D.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US11/516,365
• Publication Number:
  US 20070005983A1
• Time in Patent Office: 2,184 Days
• Field of Search: 726/14, 726/24, 380/30, 380/232, 713/152, 713/153, 713/154, 713/170, 725/14, 725/24
• US Class Current: 713/153
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/224 providing notification on incoming messages, e.g. pushed notifications of received messages
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it

Abstract

An e-mail firewall applies policies to e-mail messages between a first site and second sites in accordance with administrator selectable policies. The firewall includes a simple mail transfer protocol relay for causing the e-mail messages to be transmitted between the first site and selected ones of the second sites. Policy managers enforce-administrator selectable policies relative to one or more of encryption and decryption, signature, source/destination, content and viruses.

Claims

1. A computer-implemented method for filtering e-mail messages transmitted from an external site to an internal site associated with a first policy, comprising:

i. intercepting using an SMTP relay implemented as programmed computer hardware an e-mail message having a sender address associated with an external site;

ii. detecting whether said e-mail message includes a digital signature;

iii. applying at least one policy condition to said e-mail message, said policy condition applied by reference to the digital signature, said applying providing a policy application result;

iv. applying at least a second policy condition to said e-mail message in response to a predetermined condition of the digital signature, the second policy condition selected by reference to an identity associated with the digital signature;

v. detecting that the digital signature is a valid digital signature; and

vi. processing said e-mail message in accordance with said applying of the second policy.

2. A computer-implemented method for filtering e-mail messages transmitted from an external site to an internal site associated with a first policy, comprising:

i. intercepting using an SMTP relay implemented as programmed computer hardware an e-mail message having a sender address associated with an external site;

ii. detecting whether said e-mail message includes a digital signature;

iii. applying at least one policy condition to said e-mail message, said policy condition applied by reference to the digital signature, said applying providing a policy application result;

iv. applying a second policy for detecting whether the digital signature is associated with a domain which is included in a stored list of trusted domains; and

v. processing said e-mail message in accordance with said applying of the second policy.

3. A method for restricting transmission of e-mail messages between a first site and a second site in accordance with administrator selectable policies, said method comprising:

utilizing a simple mail transfer protocol (SMTP) relay in a transmission path for the e-mail messages between said first site and second sites;

enforcing one or more administrator selectable policies, at least some of said policies establishing both criteria and exceptions relative to actions on e-mail messages received at the SMTP relay and thereby restricting transmission of at least some of the received mail messages based on access, content and virus control policy aspects of the administrator selectable policies,

wherein the administrator selectable policies further enforce security policy aspects that dictate, relative to a policy-defined subset of less than all e-mail messages received at the SMTP relay, encryption and signature requirements, and wherein the actions established by the administrator selectable policies restrict transit of at least some of the received e-mail messages based non-compliance with a requirement that the policy-defined subset of e-mail messages be encrypted or signed.

4. The method of claim 3, further comprising:

encrypting and thereby conforming with the security policy at least some of the received e-mail messages transiting the SMTP relay.

5. The method of claim 3,

wherein the policy-defined subset of e-mail messages is selected based at least in part on sender.

6. The method of claim 3,

wherein the policy-defined subset of e-mail messages is selected based at least in part on intended recipient.

7. The method of claim 3, further comprising:

extracting signatures from at least some of the e-mail messages received at the SMTP relay and, based on the administrator selectable policies, verifying the extracted signatures; and

restricting transmission of at least some of the received e-mail messages based on results of the signature verification.