SECURING EMAIL CONVERSATIONS

• US 20130080775A1
• Filed: 09/28/2011
• Published: 03/28/2013
• Est. Priority Date: 09/28/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: McKerrell, Graeme, Neal, Peter, Liebmann, Nicholas
• Granted Patent: US 8,930,689 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding

Abstract

At least a portion of a transmission of an outgoing first email from a first email account to at least a second email account is encrypted. Second email address data is changed corresponding to the second email account to cause replies to the first email intended for the second email account to be sent to an intermediate device prior to being routed to the second email account. Replies to the first email are then sent to the intermediate device and sent over one or more encrypted channels. Replies to the first email including the changed email address data are decoded to identify the second email address data associated with the second email account. A reply to the first email is then sent to the second email account based on the identified second email address data.

Claims

1. A method comprising:

determining that at least a portion of a transmission of an outgoing first email from a first email account to at least a second email account is to be encrypted;

changing second email address data corresponding to the second email account to cause replies to the first email intended for the second email account to be sent to an intermediate device prior to being routed to the second email account, wherein replies to the first email sent to the intermediate device are sent over encrypted channels; and

causing at least a portion of a transmission of the first email to be encrypted and sent to the second email account.

2. The method of claim 1, wherein the first email is to be sent to both the second email account and at least a third email account, the method further comprising:

changing third email address data corresponding to the third email account to cause replies to the first email intended for the third email account to be sent to the intermediate device prior to being routed to the third email account; and

causing the encrypted portion of the transmission of the first email to be sent to the third email account.

3. The method of claim 2, wherein email transmissions are capable of being secured between a first server associated with the first email account and each of a second server associated with the second email account and a third server associated with the third email account, and at least some email transmissions are not secured between the second server and the third server.

4. The method of claim 2, further comprising:

receiving at least one copy of a reply to the previously-sent first email from the second email account, the at least one copy including the changed third email address data;

decoding at least a portion of the changed third email address data to identify an email address associated with the third email account; and

causing the at least one copy to be forwarded to the third email client over a secured communication channel.

5. The method of claim 1, further comprising changing email address data corresponding to the first email account to cause replies to the first email intended for the first email account to be sent to the intermediate device prior to being routed to the first email account.

6. The method of claim 1, wherein the intermediate device is used to serve email associated with first email account.

7. The method of claim 1, wherein the intermediate device is at least partially independent from an email server of the first email account.

8. The method of claim 1, wherein changing second email address data includes encoding a local portion of an email address of the second email account.

9. The method of claim 8, wherein encoding the local portion of the email address of the second email account includes hashing the email address.

10. The method of claim 8, wherein encoding the local portion of the email address of the second email account includes encrypting the email address.

11. The method of claim 8, wherein encoding the local portion of the email address of the second email account includes converting the email address into a text string.

12. The method of claim 1, wherein changing second email address data includes changing a domain portion of an email address of the second email account to a particular domain associated with the intermediate device.

13. The method of claim 1, wherein the transmission of the first email includes transmission of the changed second email address data.

14. The method of claim 13, wherein changing second email address data includes setting a reply-to email address data field to address data corresponding to the intermediate device.

15. The method of claim 1, wherein the second email address data is changed in response to determining that at least a portion of a transmission of an outgoing first email from a first email account to at least a second email account is to be encrypted.

16. A method comprising:

receiving at least one copy of a reply to a previously-sent first email intended for a first email client, the at least one copy including encoded email address data associated with the first email client and adapted to route the at least one copy to an intermediate device over a first secured communication channel based on the encoding;

decoding at least a portion of the encoded email address data to identify an email address associated with the first email client; and

causing the at least one copy to be forwarded to the first email client over a second secured communication channel.

17. The method of claim 16, wherein at least a portion of the encoded email address data is encrypted and decoding the portion of the encoded email address data includes decrypting the encrypted portion of the encoded email address data.

18. The method of claim 16, wherein at least a portion of the encoded email address data is a hash of the email address associated with the first email client.

19. The method of claim 16, wherein the encoded email address data was generated in response to a determination that the first email was to be transmitted at least partially over a secured communication channel.

20. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

determining that at least a portion of a transmission of an outgoing first email from a first email account to at least a second email account is to be encrypted;

changing second email address data corresponding to the second email account to cause replies to the first email intended for the second email account to be sent to an intermediate device prior to being routed to the second email account, wherein replies to the first email sent to the intermediate device are sent over encrypted channels;

causing at least a portion of a transmission of the first email to be encrypted and sent to the second email account.

21. A system comprising:

at least one processor device;

at least one memory element; and

an email security engine, adapted when executed by the at least one processor device to;

determine that at least a portion of a transmission of an outgoing first email from a first email account to at least a second email account is to be encrypted;

change second email address data corresponding to the second email account to cause replies to the first email intended for the second email account to be sent to an intermediate device prior to being routed to the second email account, wherein replies to the first email sent to the intermediate device are sent over encrypted channels;

cause at least a portion of a transmission of the first email to be encrypted and sent to the second email account.

22. The system of claim 21, further comprising an email server, the email server comprising the email security engine.