Trusted Communication Network

• US 20070107059A1
• Filed: 08/17/2006
• Published: 05/10/2007
• Est. Priority Date: 12/21/2004
• Status: Active Grant

• Current Assignee: MXTN Incorporated
• Original Assignee: MXTN Incorporated
• Inventors: Lin, Wei, Chasin, C.
• Granted Patent: US 9,160,755 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system includes a processing node configured to send authorized inbound messages to registered enterprise networks. An authorized message is a message that includes trusted source indicia. Trusted source indicia indicates that the message was sent by one or more of the processing node or an authenticated message transfer node associated with one of the registered enterprise networks. The system may further include an administration node configured to maintain registration of a plurality of message transfer nodes associated with the enterprise networks. A method includes receiving outbound messages from an authenticated message transfer node of an enterprise network, screening the messages for threats to determine whether to send the messages to associated recipients, applying a first message identifier to each message, wherein the first message identifier can be used to track the message and, for each message, sending the message to the associated recipient if no threats are detected in the message.

Claims

1. A system within a private network including a plurality of registered enterprise networks, the system comprising:

a processing node configured to send only authorized inbound messages to the registered enterprise networks, wherein an authorized message is a message that includes trusted source indicia, and wherein trusted source indicia indicates that the message was sent by one or more of the processing node or an authenticated message transfer node associated with one of the registered enterprise networks; and

an administration node configured to maintain registration of a plurality of message transfer nodes associated with the enterprise networks.

2. The system as recited in claim 1 wherein the processing node is further configured to detect threats in outbound messages sent from the message transfer nodes.

3. The system as recited in claim 2, wherein the threats comprise one or more of threats indicated by behavior-based anomalies and content-related threats.

4. The system as recited in claim 2 wherein the processing node is further configured to insert a message identifier into each outbound message, wherein the message identifier comprises a hash of one or more attributes of the outbound message.

5. The system as recited in claim 2 further comprising a hosted domain name system (DNS) server configured to provide authentication data when queried by recipients of the outbound messages.

6. The system as recited in claim 5 wherein the authentication data provided by the hosted DNS server comprises an Internet protocol (IP) address associated with the processing node.

7. The system as recited in claim 2, wherein the system further comprises a DNS server that is referenced by an enterprise network DNS server, whereby recipient authentication inquiries to the enterprise network DNS server are directed to include the hosted DNS server.

8. The system as recited in claim 2, wherein the processing node is further configured to generate a reputation metric associated with each of the plurality of registered enterprises, wherein the reputation metric is based at least in part on the threats detected in messages sent from the enterprise networks.

9. The system as recited in claim 1, wherein all outbound messages from the enterprise networks are submitted to the processing node.

10. The system as recited in claim 1, wherein the processing node is further configured to detect bounced messages that are bounced back to the processing node.

11. The system as recited in claim 10, wherein the processing node is configured to distinguish authorized bounced messages from unauthorized bounced messages.

12. The system as recited in claim 10, wherein the processing node is configured to use a bounce tracking identifier that is applied to each outbound message to determine if a received bounced message was transmitted by the processing node.

13. The system as recited in claim 1, wherein each of the message transfer nodes receives messages within the associated enterprise network in a first protocol and submits the messages to the processing node in a second protocol.

14. The system as recited in claim 1 wherein the administration node maintains registration of the plurality of message transfer nodes by performing one or more of the following:

authenticating the message transfers nodes;

sending software updates to the message transfer nodes;

monitoring availability of the message transfer nodes;

issuing arbitrary commands to the message transfer nodes;

registering the message transfer nodes;

or

configuring the message transfer nodes.

15. The system as recited in claim 14 wherein the administration module authenticates the message transfer node using an authentication certificate.

16. The system as recited in claim 1, wherein the processing node is further configured to quarantine outbound messages that have associated threats.

17. The system as recited in claim 16 wherein processing node disposes of each message based on an enterprise disposition policy, wherein the disposition policy is selected from a group consisting of:

quarantine until release,

bounce back to specified enterprise network user,

delete without sending,

deliver after a specified time,

deliver only after approval.

18. The system as recited in claim 1 further comprising one or more policies policy associated with an enterprise, wherein one of the one or more policies policy specifies filtering attributes upon which outbound messages are to be filtered, and wherein the processing node is further configured to filter outbound messages according to the policy.

19. The system as recited in claim 18, wherein the one or more policies comprise one or more of an enterprise-level policy, a group-level policy, a department-level policy, or a user-level policy.

20. The system as recited in claim 18, wherein the one or more policies specifies a standard stationary to be applied to every outbound message sent from the enterprise network.

21. The system as recited in claim 1 wherein the processing node is further configured to insert one or more identifiers into each outbound message sent from the message transfer nodes, wherein the identifiers are selected from a group consisting of:

an integrity checksum signature;

a message identifier configured to be used to track the status of the associated message;

a bounce tracking identifier;

a domain name authentication identifier.

22. A method for use in a private network, wherein the private network includes a plurality of registered member enterprise networks, the method comprising:

receiving outbound messages from an authenticated message transfer node of an enterprise network;

screening the messages for threats to determine whether to send the messages to associated recipients;

applying a first message identifier to each message, wherein the first message identifier can be used to track the message;

for each message, sending the message to the associated recipient if no threats are detected in the message.

23. The method as recited in claim 22 further comprising:

filtering the outbound messages according to filter criteria;

for each message, storing the associated message identifier;

storing attributes and content filtered from each message such that the attributes and content can be retrieved using the associated message identifier.

24. The method as recited in claim 22 further comprising providing sender authentication information in response to an authentication query that uses the message identifier rather than an original sender identifier.

25. The method as recited in claim 22 further comprising computing a reputation metric based on threats detected in the outbound messages.

26. The method as recited in claim 23 wherein computing a reputation metric comprises computing one or more of an enterprise-wide reputation metric, a group-wide reputation metric, a user-level reputation metric, a department-level reputation metric, or an office site reputation metric.

27. The method as recited in claim 22 further comprising quarantining messages that include detected threats.

28. The method as recited in claim 27 further comprising disposing of each quarantined message according to a quarantine disposition policy, wherein the quarantine disposition policy is selected from a group consisting of:

deleting the quarantined message without delivery after a specified amount of time;

delivering the quarantined message after a specified amount of time;

delivering the quarantined message only after approval is received from an enterprise network administrator;

sending the quarantined message to an identified user within the enterprise network;

sending the quarantined message to the sender of the quarantined message.

29. The method as recited in claim 23 further comprising:

identifying an attachment in a selected outbound message;

extracting the attachment from the selected message;

storing the attachment; and

inserting a link into the selected outbound message, whereby the message recipient can access the attachment via the link.

30. The method as recited in claim 22 further comprising generating the message identifier, wherein generating the message identifier comprises computing a hash of one or more attributes of the message.

31. The method as recited in claim 23 wherein filtering the messages comprises filtering the messages based on one or more filtering criteria, wherein the one or more filtering criteria are selected from a group consisting of:

MAIL FROM parameter,

message checksum,

HELO Strings,

headers,

total size,

number of attachments,

total size of attachments,

messages with Hypertext Markup Language (HTML),

messages with text,

message with multiple parts,

messages with self-contained images,

spam score,

source IP address,

IP address of client sender,

IP address of member message transfer node, and

IP address of enterprise server.

32. The method as recited in claim 22, wherein one or more additional identifiers are inserted into each message, wherein the one or more additional identifiers are selected from a group consisting of:

an integrity checksum signature;

a bounce tracking identifier;

a domain name authentication identifier.

33. The method as recited in claim 32 further comprising detecting a message that is bounced without reaching the associated recipient by determining that the message contains a bounce tracking identifier.

34. The method as recited in claim 32 further comprising verifying whether a received message is an authorized message or an unauthorized message by determining whether a bounce tracking identifier is present in the received message.

35. The method as recited in claim 22 wherein screening the messages comprises determining whether the messages include one or more content-related threats or whether the messages are indicative of a behavior-based anomaly.

36. The method as recited in claim 35 wherein content-related threats are selected from a group consisting of:

spam;

viruses;

spyware;

worms.

37. The method as recited in claim 35 wherein the behavior-based anomaly indicates that a bot is resident on an identified node in the enterprise network.

38. The method as recited in claim 37 further comprising quarantining all messages sent from the identified node within the enterprise network, while allowing outbound messages from other nodes within the enterprise to be sent to the message recipients.

39. A system for facilitating trust among entities communicating over a network, the system comprising:

means for registering a plurality of message transfer nodes with a private network, wherein the message transfer nodes reside in associated enterprise networks that are members of the private network;

means for determining whether inbound messages sent to the enterprise networks have associated trusted source indicia; and

means for transmitting only inbound messages that have associated trusted source indicia to the enterprise networks.