Trusted communication network

• US 10,212,188 B2
• Filed: 08/19/2015
• Issued: 02/19/2019
• Est. Priority Date: 12/21/2004
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, LLC
• Inventors: Chasin, C. Scott, Lin, Wei
• Primary Examiner(s): Nawaz, Asad M
• Assistant Examiner(s): Ansari, Najeeb
• Application Number:
  US14/830,545
• Publication Number:
  US 20150358352A1
• Time in Patent Office: 1,280 Days
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system includes a processing node configured to send authorized inbound messages to registered enterprise networks. An authorized message is a message that includes trusted source indicia. Trusted source indicia indicates that the message was sent by one or more of the processing node or an authenticated message transfer node associated with one of the registered enterprise networks. The system may further include an administration node configured to maintain registration of a plurality of message transfer nodes associated with the enterprise networks. A method includes receiving outbound messages from an authenticated message transfer node of an enterprise network, screening the messages for threats to determine whether to send the messages to associated recipients, applying a first message identifier to each message, wherein the first message identifier can be used to track the message and, for each message, sending the message to the associated recipient if no threats are detected in the message.

Claims

1. A gateway, comprising:

a processor; and

one or more non-transitory, machine-readable media coupled to the processor;

wherein the one or more non-transitory machine-readable media have stored instructions thereon, which, if executed by the gateway, cause the gateway to determine whether to send an outbound message from a member to at least one message recipient of the outbound message, said determination further comprising

applying one or more filters to the outbound message, wherein the one or more filters include a spam filter;

modifying the outbound message to prevent a bounce attack;

extracting an attachment from the outbound message, when the attachment is filtered;

in response to detecting spam, quarantining the outbound message in an outbound quarantine without sending the outbound message to the at least one message recipient;

applying a disposition policy to the quarantined message; and

managing reputation feedback of the member based on the detected spam, wherein the member is penalized with a loss of access to a service, if the reputation feedback falls below a minimum value.

2. The gateway of claim 1, wherein the outbound message originates from an end user node on a member network;

and

the determination further comprises;

identifying the member corresponding to the end user node, and a policy of the member; and

applying the one or more filters to the outbound message according to the policy of the member.

3. The gateway of claim 1, wherein:

the one or more filters include a filter that determines whether the outbound message is indicative of a behavior-based anomaly;

the behavior-based anomaly indicates that a bot is resident on a node in an enterprise network; and

the determination further comprises, in response to detecting the behavior-based anomaly, quarantining all messages sent from the node within the enterprise network.

4. The gateway of claim 1, wherein the outbound message originates from an end user node corresponding to the member on a member network;

and

the one or more filters comprise a filter which filters the outbound message based on a reputation score of the member.

5. The gateway of claim 1, wherein the applying the one or more filters comprises filtering the outbound message based on one or more Simple Mail Transport Protocol attributes.

6. The gateway of claim 1, wherein:

the one or more filters include a content filter for detecting content-related threats, the content filter specifies message profanity, pornography, undesirable content, or questionable content be filtered for quarantining; and

the determination further comprises, in response to detecting a content-related threat, quarantining the outbound message without sending the outbound message to the at least one message recipient.

7. The gateway of claim 1, wherein the disposition policy is selected from the following:

quarantine until release,

bounce back to specified enterprise network user,

delete without sending,

deliver after a specified time, and

deliver only after approval.

8. The gateway of claim 1, wherein the one or more non-transitory, machine-readable media includes RAID storage.

9. The gateway of claim 1, wherein the spam filter determines whether the outbound message includes a content-related threat.

10. The gateway of claim 1, wherein the outbound message is an instant message.

11. The gateway of claim 1, wherein the outbound message is an email message.

12. The gateway of claim 1, wherein the disposition policy is a deliver only after approval policy.

13. The gateway of claim 1, wherein the outbound message is modified by replacing an original envelope sender address based on a hash of one or more parts of the outbound message.

14. The gateway of claim 1, wherein the member is an enterprise.

15. The gateway of claim 1, wherein the gateway receives the outbound message from a sender and filters out a single message based on a reputation score of the sender.

16. The gateway of claim 1, wherein the member is penalized with a higher service fee or a member guarantee to address an in-network source of pollution, if the reputation feedback falls below a minimum value.

17. One or more non-transitory, computer-readable storage media having machine-executable instructions for determining whether to send an outbound message from a member to at least one message recipient of the outbound message, said instructions, when executed on a processor, configure the processor at least to:

apply one or more filters to the outbound message, wherein the one or more filters include a spam filter;

modify the outbound message to prevent a bounce attack;

extract an attachment from the outbound message, when the attachment is filtered;

in response to detecting spam, quarantine the outbound message in an outbound quarantine without sending the outbound message to the at least one message recipient;

apply a disposition policy to the quarantined message, wherein the disposition policy is a deliver only after approval policy; and

manage reputation feedback of the member based on the detected spam, wherein the member is penalized with a loss of access to a service, if the reputation feedback falls below a minimum value.

18. The one or more non-transitory, computer-readable storage media of claim 17, wherein the processor is further configured by said instructions to:

receive the outbound message from an end user node on a member network;

identify a policy of the member; and

apply the one or more filters to the outbound message according to the policy of the member.

19. The one or more non-transitory, computer-readable storage media of claim 17, wherein the processor is further configured by said instructions to:

track when messages enter the outbound quarantine.

20. The one or more non-transitory, computer-readable storage media of claim 17, wherein the processor is further configured by said instructions to:

track the order in which messages are disposed from the outbound quarantine.

21. The one or more non-transitory, computer-readable storage media of claim 17, wherein the processor is further configured by said instructions to:

determine, by a billing services module, a billing amount to the member based on a duration of a retention period for quarantined messages in the outbound quarantine.

22. A method for determining whether to send an outbound message from a member to at least one message recipient of the outbound message, the method comprising:

applying one or more filters to the outbound message, wherein the one or more filters include a spam filter;

modifying the outbound message to prevent a bounce attack;

extracting an attachment from the outbound message, when the attachment is filtered;

in response to detecting spam, quarantining the outbound message without sending the outbound message to the at least one message recipient;

applying a disposition policy to the quarantined message; and

managing reputation feedback of the member based on the detected spam, wherein the member is penalized with a loss of access to a service, if the reputation feedback falls below a minimum value.

23. The method of claim 22, wherein:

the one or more filters include a filter that determines whether the outbound message is indicative of a behavior-based anomaly;

the behavior-based anomaly indicates that a bot is resident on a node in an enterprise network; and

the method further comprises, in response to detecting the behavior-based anomaly, quarantining all messages sent from the node within the enterprise network.

24. The method of claim 22, wherein:

the outbound message originates from an end user node corresponding to the member on a member network; and

the one or more filters include a filter that filters the outbound message based on a reputation score of the member.

25. The method of claim 22, wherein the applying the one or more filters comprises filtering based on one or more Simple Mail Transport Protocol attributes and content filtering, and the content filtering specifies message profanity, pornography, undesirable content, or questionable content be filtered for quarantining.

26. The method of claim 22, wherein the applying the disposition policy comprises one of the following:

deleting the outbound message without delivery after a specified amount of time;

delivering the outbound message after a specified amount of time;

delivering the outbound message only after approval;

sending the outbound message to an identified user within an enterprise network; and

sending the outbound message to a sender of the outbound message.