METHOD AND SYSTEM FOR MESSAGING SECURITY

• US 20080270789A1
• Filed: 07/14/2008
• Published: 10/30/2008
• Est. Priority Date: 06/22/2001
• Status: Active Grant

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Tumbleweed Communications Corporation (Axway Software SA)
• Inventors: Smith, Jeffrey C., Bandini, Jean-Christophe Denis
• Granted Patent: US 8,407,780 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

An e-mail firewall applies policies to e-mail messages transmitted between a first site and a plurality of second sites. The e-mail firewall includes a plurality of mail transfer relay modules for transferring e-mail messages between the first site and one of the second sites. Policy managers are used to enforce and administer selectable policies. The policies are used to determine security procedures for the transmission and reception of e-mail messages. The e-mail firewall employs signature verification processes to verify signatures in received encrypted e-mail messages. The e-mail firewall is further adapted to employ external servers for verifying signatures. External servers are also used to retrieve data that is employed to encrypt and decrypt e-mail messages received and transmitted by the e-mail firewall, respectively.

Claims

1. A messaging firewall comprising:

a message relay introducible into a messaging pathway to receive a plurality of electronic messages including at least first and second messages from different users associated with different user systems;

a security manager that determines, for each of the first and second messages received by the message relay, a level of verification by applying a signature verification policy that references particular attributes of the respective messages as received, and that at least initiates verification of digital signatures for the respective messages, wherein the verification of respective signatures for the first and second messages is to a differing levels of confidence in accordance with the signature verification policy and at least one particular attribute of the respective message as received.

2. A messaging firewall system that cooperates with a remote publicly accessible security server to securely transmit e-mail messages, the system comprising:

a message encryptor that encrypts an e-mail message in accordance with at least one encryption key;

a lookup module that queries the remote security server for an encryption key including related encryption data which is associated with at least one target server for the e-mail message; and

a transmission module that transmits the e-mail message to at least one target server for which encryption data was retrieved by the lookup module,

wherein the system includes a certificate lookup module to retrieve certificates associated with the e-mail message source for application to the e-mail message to allow for the recipient to authenticate the message source.