Method and apparatus for electronic mail filtering

• US 8,244,817 B2
• Filed: 05/13/2008
• Issued: 08/14/2012
• Est. Priority Date: 05/18/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Websense UK Ltd. (Forcepoint LLC)
• Inventors: Kay, James
• Primary Examiner(s): BOUTAH, ALINA A
• Application Number:
  US12/600,631
• Publication Number:
  US 20100217811A1
• Time in Patent Office: 1,554 Days
• Field of Search: 709/206, 709/207, 709/224, 726/22, 707/999.009
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/226 Delivery according to priorities
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

A message processing apparatus (200) is provided in an electronic messaging system. The message processing apparatus (200) holds an ordered queue (232) of the electronic messages (101) and adds a new incoming message (101) to the queue (232) according to a reputation score (201) allocated to each incoming message. Messages having a highest reputation score (201) are extracted from a top of the queue (232) for detailed analysis according to one or more filtering mechanisms. A message forwarding unit (250) forwards wanted messages to a server unit (300) for onward transmission to a recipient terminal (20). Messages from a trusted client identity (105) who is most likely to send wanted messages are allocated a high reputation score (201) and take priority through the queue (232). Messages from a non-trusted client identity (105) are allocated a lower reputation score (201) and remain in the queue (232) until all messages with a higher reputation score (201) have been extracted.

Claims

1. A message processing apparatus for processing messages on a communication path between a client unit and a server unit, the message processing apparatus comprising:

a processor; and

a non-transitory computer readable medium, operatively coupled to the processor, and configured to store;

a message receiving unit arranged to receive an incoming message from a client unit and to determine a client identity with respect to the client unit,

a reputation score allocation unit arranged to allocate a reputation score to the incoming message with respect to the determined client identity,

a message queuing unit arranged to store the incoming message with a plurality of messages in a message queue ordered according to the reputation score allocated to the incoming message,

a message analysis unit arranged to extract a message with the highest reputation score in the message queue from the message queue, and to analyze the extracted message, and

a message forwarding unit arranged to forward the extracted message along the communication path to a server unit,

wherein messages from a trusted client unit are allocated a high reputation score and take priority for analysis through the message queue, and messages from a non-trusted client unit are allocated a lower reputation score and remain in the message queue until all messages with a higher reputation score have been extracted.

2. The message processing apparatus of claim 1, further comprising a reputation score database arranged to store a plurality of reputation scores each associated one of a plurality of client identities;

and

wherein the reputation score allocation unit is arranged to allocate the reputation score to the incoming message according to the reputation score stored in the reputation score database with respect to the determined client identity.

3. The message processing apparatus of claim 2, further comprising a reputation score updating unit arranged to update one or more of the plurality of reputation scores stored in the reputation score database.

4. The message processing apparatus of claim 3, wherein the reputation score updating unit is arranged to communicate with the message analysis unit to update the reputation score associated with a particular client identity.

5. The message processing apparatus of claim 4, wherein the reputation score updating unit is arranged to determine an updated reputation score associated with a particular client identity according to statistics derived from a history of previous messages from the particular client identity.

6. The message processing apparatus of claim 5, wherein the reputation score updating unit is arranged to determine the updated reputation score for a particular client identity according to a proportion of wanted messages as determined by one or more filtering functions performed by the message analysis unit with respect to a total number of messages from the particular client identity.

7. The message processing apparatus of claim 5, wherein the reputation score updating unit is arranged to determine the updated reputation score according to a volume of traffic received from a particular client identity a rate at which the traffic is received and a percentage of the traffic which is determined to be unwanted messages.

8. The message processing apparatus of claim 3, further comprising a communication line coupled to the reputation score database to update the stored reputation scores with reference to an external source.

9. The message processing apparatus of claim 8, wherein the external source is a reputation score updating unit in another of the message processing apparatuses.

10. The message processing apparatus of claim 1, wherein the reputation score is a numerical value on a predetermined numerical scale.

11. The message processing apparatus of claim 1, wherein the message receiving unit is arranged to hold open each of the plurality of incoming connections while the reputation score allocation unit allocates the reputation score to each of the incoming messages and the message queuing unit holds the incoming messages on the message queue.

12. The message processing apparatus of claim 1, wherein the message receiving unit is arranged to determine the client identity with respect to an IP address of the client unit.

13. The message processing apparatus of claim 1, further comprising a timing unit arranged to allocate and monitor a timing field associated with the incoming message with respect to a permitted total time to live wherein the timing unit is arranged to determine the incoming message as a timed-out message when the timing field indicates that the permitted total time to live has expired.

14. The message processing apparatus of claim 13, wherein the timing unit is arranged to remove the timed-out message from the message queue when the timing field indicates that the permitted total time to live has expired.

15. The message processing apparatus of claim 13, wherein the message receiving unit is arranged terminate a connection to the client unit for the incoming message so that a message transaction is not successfully completed, in response to a signal from the timing unit indicating that the incoming message is a timed-out message.

16. The message processing apparatus of claim 1, further comprising a queue size unit arranged to control a size of the message queue held by the message queuing unit wherein the queue size unit is arranged to selectively remove one or more incoming messages from the message queue having a low reputation score in favor of a new incoming message having a higher allocated reputation score, while maintaining a predetermined maximum size of the message queue.

17. The message processing apparatus of claim 16, wherein the message receiving unit is arranged terminate a connection to the client unit for the one or more incoming messages so that a message transaction is not successfully completed, in response to a signal from the queue size unit indicating that one or more incoming messages have been removed from the message queue.

18. The message processing apparatus of claim 1, wherein the message analysis unit is arranged to analyze the extracted message with respect to one or more message filtering functions wherein the message analysis unit is arranged to determine the extracted message as either a wanted message or an unwanted message according to the one or more message filtering functions.

19. The message processing apparatus of claim 18, wherein the message forwarding unit is arranged to selectively forward the wanted message according to the analysis of the message analysis unit.

20. The message processing apparatus of claim 18, further comprising a quarantine store arranged to selectively quarantine the unwanted message according to the analysis of the message analysis unit.

21. The message processing apparatus of claim 1, wherein the message processing apparatus is arranged to store and forward the messages between the client unit and the server unit.

22. The message processing apparatus of claim 1, wherein the message processing apparatus is arranged to be coupled in use as a message transfer agent between the client unit and the server unit.

23. The message processing apparatus of claim 1, wherein the message processing apparatus is a stand-alone appliance arranged to be coupled in use to a receiving server which stores the incoming message for retrieval by a receiving terminal.

24. The message processing apparatus of claim 1, wherein the message processing apparatus is a stand-alone appliance arranged to be coupled in use to a receiving terminal as an ultimate destination of the incoming message.

25. The message processing apparatus of claim 1, wherein the message processing apparatus is arranged to process the incoming message in the form of an Internet email sent over SMTP.

26. A message processing apparatus for processing messages from a plurality of client units, comprising:

a processor; and

a non transitory computer readable medium, operatively coupled to the processor, and configured to store;

a message receiving unit arranged to receive a plurality of incoming messages each from a respective client unit and to determine a client identity with respect to each of the client units,

a reputation score allocation unit arranged to allocate a reputation score to each of the plurality of incoming messages according to the respective client identity,

a message queuing unit arranged to store the plurality of incoming messages in an ordered message queue, wherein the messages in the message queue are ordered according to the reputation score allocated to each of the incoming messages, and

a message analysis unit arranged to extract a message from the ordered message queue with a higher reputation score before extracting a message with a lower reputation score, and to analyze each of the extracted messages,

wherein messages from a trusted client unit are allocated a high reputation score and take priority for analysis through the message queue, and messages from a non-trusted client unit are allocated a lower reputation score and remain in the message queue until all messages with a higher reputation score have been extracted.

27. The message processing apparatus of claim 26, further comprising:

a message forwarding unit arranged to selectively forward one or more of the extracted messages toward a respective receiving terminal, according to the analysis of the message analysis unit.

28. The message processing apparatus of claim 26, further comprising:

a quarantine unit arranged to selectively quarantine one or more of the extracted messages, according to the analysis of the message analysis unit.

29. An electronic messaging system, comprising:

a processor; and

a non transitory computer readable medium, operatively coupled to the processor, and configured to store;

a plurality of client units arranged to send electronic messages wherein each of the client units is associated with a predetermined client identity in the system;

a plurality of server units arranged to receive the electronic messages sent by the plurality of client units;

at least one message processing apparatus arranged to intercept the electronic messages with store-and-forward type interception between the plurality of client units and at least one of the plurality of server units, wherein the message processing apparatus comprises;

a message receiving unit arranged to receive one of the electronic messages from a particular client unit amongst the plurality of client units and to determine the client identity with respect to the particular client unit;

a reputation score allocation unit arranged to allocate a reputation score to the electronic message with respect to the client identity;

a message queuing unit arranged to store the electronic message in a message queue containing a plurality of the electronic messages and ordered according to the reputation score allocated to each of the electronic messages;

a message analysis unit arranged to extract an electronic message with the highest reputation score in the message queue from the message queue and to analyze the extracted electronic message with respect to one or more message filtering functions; and

a message forwarding unit arranged to forward the extracted electronic message to the at least one of the plurality of server units,

wherein messages from a trusted client unit are allocated a high reputation score and take priority for analysis through the message queue, and messages from a non-trusted client unit are allocated a lower reputation score and remain in the message queue until all messages with a higher reputation score have been extracted.

30. The electronic messaging system of claim 29, wherein the plurality of client units include a plurality of sending terminals arranged to originate the electronic messages and a plurality of outgoing message servers arranged to send the electronic messages originating from the plurality of sending terminals.

31. The electronic messaging system of claim 29, wherein the plurality of server units include a plurality of receiving message servers arranged to receive one or more of the electronic messages according to a recipient identity provided for each electronic message, and a plurality of recipient terminals arranged to accept one or more of the electronic messages from one of the receiving message servers according to the recipient identity of each electronic message.

32. A method of processing electronic messages between a client unit and a server unit in an electronic messaging system, comprising:

receiving an electronic message from a client unit;

determining a client identity with respect to the client unit;

allocating a reputation score to the electronic message with respect to the determined client identity;

storing the electronic message in a message queue ordered according to the reputation score allocated to the electronic message;

extracting an electronic message with the highest reputation score in the message queue from the message queue;

analyzing the extracted electronic message with respect to one or more message filtering functions;

selectively forwarding the extracted electronic message to the server unit according to a result of the one or more filtering functions; and

allocating a high reputation score to a message from a trusted client unit, and allocating a lower reputation score to a message from a non-trusted client unit;

wherein all messages in the message queue with a higher reputation score are extracted from the message queue before messages with a lower reputation score are extracted from the message queue.

33. A non-transitory computer-readable storage medium having recorded thereon instructions executable by a computer to perform:

receiving an electronic message from a client unit;

determining a client identity with respect to the client unit;

allocating a reputation score to the electronic message with respect to the determined client identity;

storing the electronic message in a message queue ordered according to the reputation score allocated to the electronic message;

extracting an electronic message with the highest reputation score in the message queue from the message queue;

analyzing the extracted electronic message with respect to one or more message filtering functions;

selectively forwarding the extracted electronic message according to a result of the one or more filtering functions; and

allocate a high reputation score to a message from a trusted client unit, and allocate a lower reputation score to a message from a non-trusted client unit;

wherein all messages in the message queue with a higher reputation score are extracted from the message queue before messages with a lower reputation score are extracted from the message queue.

34. A system for processing electronic messages between a client unit and a server unit in an electronic messaging system, comprising:

a memory configured to store an ordered message queue;

at least one processor configured to;

receive an electronic message from a client unit;

determine a client identity with respect to the client unit;

allocate a reputation score to the electronic message with respect to the determined client identity;

store the electronic message in the ordered message queue with a plurality of electronic messages, the messages ordered according to the reputation score allocated to the electronic messages;

extract an electronic message with the highest reputation score in the message queue from the message queue;

analyze the extracted electronic message with respect to one or more message filtering functions; and

selectively forward the extracted electronic message to the server unit according to a result of the one or more filtering functions, wherein messages from a trusted client unit are allocated a high reputation score and take priority for analysis through the message queue, and messages from a non-trusted client unit are allocated a lower reputation score and remain in the message queue until all messages with a higher reputation score have been extracted.