E-mail firewall with stored key encryption/decryption

• US 20070245416A1
• Filed: 12/20/2006
• Published: 10/18/2007
• Est. Priority Date: 07/24/1997
• Status: Active Grant

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Axway Incorporated (Axway Software SA)
• Inventors: Dickinson, Robert, Krishnamurthy, Sathvik
• Granted Patent: US 8,607,042 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/224 providing notification on incoming messages, e.g. pushed notifications of received messages
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it

Abstract

An e-mail firewall (105) applies policies to e-mail messages (204) between a first 5 site and a plurality of second sites in accordance with a plurality of administrator selectable policies (216). The firewall comprises a simple mail transfer protocol (SMTP) relay (202) for causing the e-mail messages (204) to be transmitted between the first site and selected ones of the second sites. A plurality of policy managers (216) enforce—administrator selectable policies. The policies, such as encryption and decryption policies, comprise at least a first source/destination policy (218), at least a first content policy (202) and at least a first virus policy (224). The policies are characterized by a plurality of administrator selectable criteria (310), a plurality of administrator selectable exceptions (312) to the criteria and a plurality of administrator selectable actions (314, 316, 322) associated with the criteria and exceptions. The policy managers comprise an access manager (218) for restricting transmission of e-mail messages (204) between the first site and the second sites in accordance with the source/destination policy (218). The policy managers (216) further comprise a content manager (220) for restricting transmission of e-mail messages (204) between the first site and the second sites in accordance with the content policy (220), and a virus manager (224) for restriction transmission of e-mail messages (204) between the first site and the second sites in accordance with the virus policy (224).

Claims

1. A method for controlling e-mail messages transmitted from and received by a computing site, comprising:

a encrypting a first designated type of message transmitted from a user associated with said computing site in accordance with at least a first stored encryption key;

decrypting a second designated type of message sent to a user associated with said computing site in accordance with at least a second stored encryption key;

filtering for monitoring said messages, after said decryption and before said encryption, filtering comprising at least a content filtering to enforce content control policies by reference to specific words in the message body, each of said messages including at least one recipient address; and

transmitting a message to said at least one recipient address in response to a predetermined policy result of said filter.

2. The e-mail control method as set forth in claim 1 wherein each of said messages comprise destination information, identifying at least a first destination for said message, and wherein said filtering further comprises a destination filtering for restricting transit of said messages which contain information corresponding to changeable destination filter information.

3. The e-mail control method as set forth in claim 2 wherein each of said messages comprise source information identifying at least a first source for said message, and wherein said filtering further comprises source filtering for restricting transit of said messages which contain information corresponding to changeable source filter information.

4. The e-mail control method as set forth in claim 3 further comprising, in response to said filtering, redirecting messages which contain information corresponding to said changeable filter information to a destination which differs from at least said first destination of said message.

5. The e-mail control method as set forth in claim 4 further comprising, for in response to said filtering, causing redirection of messages which contain information corresponding to said changeable filter information to a destination which corresponds to at least said first destination of said message.

6. The e-mail control method as set forth in claim 5 further comprising:

in response to said redirection of messages, generating a notification e-mail message; and

transmitting said notification e-mail message to a destination corresponding to changeable notification message destination information.

7. The e-mail control method as set forth in claim 6 wherein said notification message comprises a body portion and wherein said generation notification message further causing generation of a message contained in said body portion.

8. Computer media storing instructions or statements for use in execution in a computer of a method for restricting receipt of e-mail messages, in accordance with a plurality of changeable policies, to a first site from a plurality of second sites, the method comprising the steps of:

intercepting a first e-mail message transmitted to a user associated with said first site from at least one user associated with one of said second sites;

determining if said message is encrypted and decrypting said message in accordance with a stored key, if said message is encrypted; and

filtering said message in accordance with at least one stored content policy, said messages including at least one internal site recipient address, the e-mail control system transmitting the message to said at least one internal site recipient address in response to a predetermined policy result of said filtering.

10. The computer media storing instructions or statements for use in execution in a computer as set forth in claim 8, wherein said filtering of said message comprises ensuring that an executable attachment is digitally signed.

11. The computer media storing instructions or statements for use in execution in a computer as set forth in claim 10, wherein said digital signature certificate is an X.509 certificate.

9. Computer media storing instructions or statements for use in execution in a computer of a method for restricting transmission of e-mail messages, in accordance with a plurality of changeable policies, from a first site to a plurality of second sites, the method comprising the steps of:

intercepting an e-mail message transmitted to at least one user associated with one of said second sites from a user associated with said first site;

filtering said e-mail message in accordance with a plurality of stored policies, including at least one content policy to enforce content control policies by reference to specific words in the message body;

responding to a first of said stored policies by encrypting said e-mail message in accordance with a stored key; and

transmitting said e-mail message to at least one user associated with one of said second sites.

12. An e-mail control system for restricting receipt of e-mail messages, in accordance with a plurality of changeable policies, to a first site from a plurality of second sites, comprising:

a means for intercepting a first e-mail message transmitted to a user associated with said first site from at least one user associated with one of said second sites;

a means for determining if said message is encrypted and decrypting said message in accordance with a stored key, if said message is encrypted; and

means for filtering said message in accordance with at least one stored content policy, said messages including at least one internal site recipient address, the e-mail control system transmitting the message to said at least one internal site recipient address in response to a predetermined policy result of said filtering.

14. The e-mail control system-as set forth in claim 12, wherein said means for filtering of said message comprises means for ensuring that an executable attachment is digitally signed.

15. The e-mail control system as set forth in claim 14, wherein said digital signature certificate is an X.509 certificate.

13. An e-mail control system for restricting transmission of e-mail messages, in accordance with a plurality of changeable policies, from a first site to a plurality of second sites, comprising:

means for intercepting an e-mail message transmitted to at least one user associated with one of said second sites from a user associated with said first site;

means for filtering said e-mail message in accordance with a plurality of stored policies, including at least one content policy to enforce content control policies by reference to specific words in the message body;

means for responding to a first of said stored policies by encrypting said e-mail message in accordance with a stored key; and

means for transmitting said e-mail message to at least one user associated with one of said second sites.