Identifying e-mail messages from allowed senders

• US 7,653,698 B2
• Filed: 10/29/2007
• Issued: 01/26/2010
• Est. Priority Date: 05/29/2003
• Status: Expired due to Term

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian K., Eikenberry, Scott D., Koblas, David A., Nufire, Tim, Wieneke, Paul R.
• Primary Examiner(s): Winder; Patrice
• Assistant Examiner(s): NGUYEN, MINH CHAU
• Application Number:
  US11/927,506
• Publication Number:
  US 20080104186A1
• Time in Patent Office: 820 Days
• Field of Search: 709/229
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases

Abstract

A system and method are disclosed for maintaining a whitelist, including: obtaining message data based on an email message sent by a user; extracting recipient information from message data; updating the whitelist using the recipient information.

Claims

1. A system for identifying e-mail messages from allowed senders, the system comprising:

a spam filter configured to process an e-mail message sent by a sender to a recipient in a network for spam content; and

a server configured to;

receive message data concerning the e-mail message,

extract sender information and recipient information from the message data,

deliver the e-mail message to either the recipient based on one or more matches between the sender information and a whitelist associated with the recipient, or back to the spam filter based on no matches between the sender information and the whitelist associated with the recipient, and

add the recipient information to a whitelist associated with;

the sender, wherein the recipient is identified as being allowed to send e-mail messages to the sender, and

other users of the network, wherein the recipient is identified as always being allowed to send e-mail messages to the other users of the network.

2. The system of claim 1, further comprising an agent configured to provide the message data to the server.

3. The system of claim 2, further comprising a firewall configured to log message data concerning a plurality of e-mail messages.

4. The system of claim 3, wherein the agent resides on the firewall and is further configured to provide the log to the server.

5. The method of claim 2, wherein the agent is further configured to intercept the e-mail message.

6. The system of claim 1, further comprising a memory configured to store the whitelist associated with the sender and the whitelist associated with the recipient.

7. The system of claim 6, wherein the memory is further configured to store a whitelist associated with a group of users in the network.

8. The system of claim 1, wherein the server is further configured to review stored e-mail messages for the message data.

9. A method for identifying e-mail messages from allowed senders, the method comprising:

receiving message data concerning an e-mail message sent by a sender to a recipient in a network, the e-mail message having been processed by a spam filter;

extracting sender information and recipient information from the message data;

delivering the e-mail message to either the recipient based on one or more matches between the sender information and a whitelist associated with the recipient, or back to the spam filter based on no matches between the sender information and the whitelist associated with the recipient; and

adding the recipient information to a whitelist associated with;

the sender, wherein the recipient is identified as being allowed to send e-mail messages to the sender, and

other users of the network, wherein the recipient is identified as always being allowed to send e-mail messages to the other users of the network.

10. The method of claim 9, wherein receiving the message data further comprises receiving a log of message data concerning a plurality of e-mail messages.

11. The method of claim 10, wherein the log is generated and maintained by a firewall associated with the network.

12. The method of claim 9, wherein adding the recipient information to the whitelist associated with the sender is in response to the recipient having trusted user status in the network.

13. The method of claim 9, wherein receiving the message data further comprises reviewing stored e-mail messages for the message data.

14. The method of claim 9, further comprising:

intercepting the e-mail message; and

providing the e-mail message to the spam filter, wherein the spam filter processes the e-mail message.

15. The method of claim 9, further comprising maintaining a log of information concerning e-mail messages sent to the recipient.

16. The method of claim 9, wherein the whitelist associated with the recipient is further associated with a group of users in the network.

17. A computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for identifying e-mail messages from allowed senders, the method comprising:

receiving message data concerning an e-mail message sent by a sender to a recipient in a network, the e-mail message having been filtered by a spam filter;

extracting sender information and recipient information from the message data;

delivering the e-mail message either to the recipient based on one or more matches between the sender information and a whitelist associated with the recipient, or back to the spam filter based on no matches between the sender information and the whitelist associated with the recipient; and

adding the recipient information to a whitelist associated with;

the sender, wherein the recipient is identified as being allowed to send e-mail messages to the sender, and

other users of the network, wherein the recipient is identified as always being allowed to send e-mail messages to the other users of the network.

18. The computer-readable storage medium of claim 17, wherein the program is further executable to add the recipient information to the whitelist associated with the sender based on the recipient having trusted user status in the network.