Message distribution control

• US 8,886,727 B1
• Filed: 01/14/2005
• Issued: 11/11/2014
• Est. Priority Date: 01/27/2004
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Oliver, Jonathan J., Budman, Gleb, Koontz, Eugene, Drake, Christine, Oliver, Andrew F.
• Primary Examiner(s): GREENE, JOSEPH L
• Application Number:
  US11/036,603
• Time in Patent Office: 3,588 Days
• US Class Current: 709/206
• CPC Class Codes: G06F 16/3331 Query processing
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method of controlling distribution of content in a message sent by a message sender comprises receiving an indication from the message sender that the message is to be protected, identifying content in the message to be protected, adding the identified content to a database of protected content, and determining whether subsequently received content in a subsequently received message is associated with the identified content. A system for controlling distribution of content in a message sent by a message sender comprises a processor configured to receive an indication from the message sender that the message is to be protected, identify content in the message to be protected, add the identified content to a database of protected content, and determine whether subsequently received content in a subsequently received message is associated with the identified content.

Claims

1. A method of controlling distribution of content in a message sent by a message sender, comprising:

receiving over a network from a mail client a first message created by a first message sender, the first message including;

a text string manually marked by the first message sender as confidential content, upon which a distribution limit should be placed, and

a distribution limit manually set by the first message sender identifying one or more authorized recipients;

receiving over the network from a mail client a second message subsequent to the first message, wherein the second message is distinct from the first message and created by a second message sender who is distinct from the first message sender, and the second message includes a recipient identified by the second message sender; and

executing instructions stored in memory, wherein execution of the instructions by a processor;

adds the text string manually marked by the first message sender and the distribution limit manually set by the first message sender to a database stored in memory,

examines the second message for the stored text string manually marked by the first message sender, wherein examining the second message includes extracting a suspicious text string from the second message and comparing the suspicious text string to the stored text string manually marked by the first message sender,

examines the second message for the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender when the suspicious text string matches the stored text string manually marked by the first message sender, wherein examining the second message includes extracting the recipient identified by the second message sender and comparing the recipient to the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender, and

transmits the second message over the network to the recipient identified by the second message sender when the recipient identified by the second message sender matches the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

2. The method of claim 1, wherein the suspicious text string is a mutate form of the stored text string manually marked by the first message sender.

3. The method of claim 1, wherein the first and second messages are email messages.

4. The method of claim 1, wherein the first message further includes an indication manually set by the first message sender marking the entire first message as confidential content upon which the distribution limit should be placed.

5. The method of claim 1, wherein execution of the instructions by the processor further quarantines the second message when the recipient identified by the second message sender does not match the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

6. The method of claim 1, wherein execution of the instructions by the processor further transmits a portion of the second message that does not include the suspicious text string when the recipient identified by the second message sender does not match the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

7. The method of claim 1, wherein execution of the instructions by the processor further sends a notification to the second message sender when the suspicious text string matches the stored text string manually marked by the first message sender.

8. The method of claim 1, wherein execution of the instructions by the processor further permits the second message to be transmitted to both authorized and unauthorized recipients when the suspicious text string does not match the stored text string manually marked by the first message sender.

9. The method of claim 1, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes determining an edit distance between a substring of the suspicious text string and the stored text string manually marked by the first message sender.

10. The method of claim 1, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes comparing the suspicious text string to a substring that is semantically similar to the stored text string manually marked by the first message sender.

11. The method of claim 1, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes comparing a signature of the suspicious text string with the stored text string manually marked by the first message sender.

12. The method of claim 1, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes identifying a distinguishing property in the suspicious text string.

13. A system that controls distribution of content in a message sent by a message sender, the system comprising:

a processor;

a network interface communicatively coupled to a communications network; and

memory storing a database and executable instructions, whereby execution of the instructions by the processor;

receives at the network interface from a mail client a first message created by a first message sender, the first message including;

a text string manually marked by the first message sender as confidential content upon which a distribution limit should be placed, and

a distribution limit manually set by the first message sender identifying one or more authorized recipients;

receives at the network interface from a mail client a second message subsequent to the first message, wherein the second message is distinct from the first message and created by a second message sender who is distinct from the first message sender, and the second message includes a recipient identified by the second message sender;

adds the text string manually marked by the first message sender and the distribution limit manually set by the first message sender to the database;

examines the second message for the stored text string manually marked by the first message sender, wherein examining the second message includes extracting a suspicious text string from the second message and comparing the suspicious text string to the stored text string manually marked by the first message sender;

examines the second message for the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender when the suspicious text string matches the stored text string manually marked by the first message sender, wherein examining the second message includes extracting the recipient identified by the second message sender and comparing the recipient to the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender; and

transmits the second message over the network to the recipient identified by the second message sender when the recipient identified by the second message sender matches the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

14. The system of claim 13, wherein the suspicious text string is a mutated form of the stored text string manually marked by the first message sender.

15. The system of claim 13, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes determining an edit distance between a substring of the suspicious text string and the stored text string manually marked by the first message sender.

16. The system of claim 13, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes comparing the suspicious text string to a substring that is semantically similar to the stored text string manually marked by the first message sender.

17. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a computer processor to perform a method for controlling distribution of content in a message sent by a message sender, the method comprising:

receiving over a network from a mail client a first message created by a first message sender, the first message including;

a text string manually marked by the first message sender as confidential content upon which a distribution limit should be placed, and

a distribution limit manually set by the first message sender identifying one or more authorized recipients;

receiving over the network from a mail client a second message subsequent to the first message, wherein the second message is distinct from the first message and created by a second message sender who is distinct than the first message sender, and the second message includes a recipient identified by the second message sender;

adding the text string manually marked by the first message sender and the distribution limit manually set by the first message sender to a database stored in memory;

examining the second message for the stored text string manually marked by the first message sender, wherein examining the second message includes extracting a suspicious text string from the second message and comparing the suspicious text string to the stored text string manually marked by the first message sender;

examining the second message for the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender when the suspicious text string matches the stored text string manually marked by the first message sender, wherein examining the second message includes extracting the recipient identified by the second message sender and comparing the recipient to the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender; and

transmitting the second message over the network to the recipient identified by the second message sender when the recipient identified by the second message sender matches the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

18. The non-transitory computer-readable storage medium of claim 17, wherein the suspicious text string is a mutate form of the stored text string manually marked by the first message sender.

19. The non-transitory computer-readable storage medium of claim 17, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes determining an edit distance between a substring of the suspicious text string and the stored text string manually marked by the first message sender.

20. The non-transitory computer-readable storage medium of claim 17, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes comparing the suspicious text string to a substring that is semantically similar to the stored text string manually marked by the first message sender.

21. The non-transitory computer-readable storage medium of claim 17, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes comparing a signature of the suspicious text string with the stored text string manually marked by the first message sender.

22. The non-transitory computer-readable storage medium of claim 17, wherein comparing the suspicious text string to the stored text string manually marked by the first message sender includes identifying a distinguishing property in the suspicious text string.

23. The non-transitory computer-readable storage medium of claim 17, wherein the method further includes quarantining the second message when the recipient identified by the second message sender does not match the one or more authorized recipients identified in the stored distribution limit manually set by the first message sender.

24. The non-transitory computer-readable storage medium of claim 17, wherein the method further includes sending a notification to the second message sender when the suspicious text string matches the stored text string manually marked by the first message sender.