Active e-mail filter with challenge-response

• US 8,990,312 B2
• Filed: 10/29/2007
• Issued: 03/24/2015
• Est. Priority Date: 07/16/2002
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Wilson, Brian
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US11/927,414
• Publication Number:
  US 20080168145A1
• Time in Patent Office: 2,703 Days
• Field of Search: 709/206, 709/207, 709/204
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

When a user receives potential junk e-mail from an unknown sender address, an active filter installed in or cooperating with the user'"'"'s e-mail system sends a challenge e-mail back to the sender address. Unless the user receives a correct response e-mail from the sender address and/or a response that meets formal criteria, the active filter rejects the original e-mail and blocks future e-mail from that sender address. The challenge preferably includes a question that the sender must correctly answer in his response. The question is such that only humans can interpret and respond to it correctly. For example, the question may relate to and/or be incorporated in an image in the challenge. Lists of approved and blocked sender addresses are compiled. The user may directly enter addresses in the address lists. Addresses to which the user has sent e-mail may also be included directly in the approved list.

Claims

1. A method for filtering electronic mail (e-mail) sent to a user, the method comprising:

receiving a current e-mail message from a sender address, the current e-mail message received from a computing device associated with the sender address, and received at a user system configured to manage received e-mail;

determining that a current level of security has been selected by the user, wherein the e-mail system has a plurality of different levels of security ranging from high to low, each level associated with the different set of one or more e-mail filters;

sending an active image-based challenge associated with the current level of security, in which a challenge question is part of a moving or changing image, wherein the challenge question is presented as scrolling text that is part of the moving or changing image and requires a correct e-mail response to be selected from a provided set comprising a plurality of possible e-mail responses, the active image-based challenge sent from the user system to the computing device associated with the sender address, the active image-based challenge sent via e-mail over a communications network; and

executing a software application stored in memory at the user system, wherein execution of the software application by a processor blocks the current e-mail message from the sender address from being displayed to the user unless the correct e-mail response is received by the user system from the sender address, the correct e-mail response further indicating that the computing device associated with the sender address is configured to accept e-mail and does not include an open relay.

2. The method of claim 1, wherein the active image-based challenge is created by the user to whom the current e-mail message is sent, and further comprising initially receiving the active image-based challenge from the user.

3. A system for filtering electronic mail, the system comprising:

an e-mail application stored in memory and associated with a recipient e-mail address;

a filter application stored in memory and executable by a processor to intercept electronic mail sent from a sender address to the recipient e-mail address prior to delivery of the electronic mail to the e-mail application, the filter communicatively coupled to an intermediate storage buffer;

an address analysis module stored in memory and executable by a processor to determine whether the sender address of the intercepted electronic mail is an approved sender, wherein the intercepted electronic mail is delivered to the e-mail application for execution thereby allowing user access only if the sender address is an approved sender, and wherein the intercepted electronic mail is transferred to the intermediate storage buffer by the filter application when execution of the address analysis module determines that the sender address is not an approved sender, the intermediate storage buffer configured for temporary storage of the intercepted electronic mail until a subsequent determination is made to deliver the electronic mail to the e-mail application or to delete the intercepted electronic mail from the buffer;

a challenge generation module stored in memory and executable by a processor to;

determine that a current level of security has been selected by the user, wherein the e-mail system has a plurality of different levels of security ranging from high to low, each level associated with the different set of one or more e-mail filters;

issue an active image-based challenge message associated with the current level of security, in which a challenge question is presented as scrolling text that is part of a moving or changing image to the sender address, the challenge question requiring a correct e-mail response to be selected from a provided set comprising a plurality of possible e-mail responses; and

a response analysis module stored in memory and executable to;

receive a challenge response message from the sender address, and

determine whether the challenge response message includes both an indication that the sender address is configured to accept e-mail and is not associated with an open relay and the correct e-mail response to the active image-based challenge, wherein execution of the address analysis module will identify the sender address as an approved sender when the challenge response message includes both the indication and correct answer to the challenge question and allow for delivery of the intercepted electronic mail in the intermediate storage buffer to the e-mail application, and the execution of the response analysis module will provide for deletion of the intercepted electronic mail when the indication is absent, the challenge response message includes an incorrect answer to the challenge question, or a challenge response message with the correct indication and correct answer are not received by the response analysis module within a predetermined period of time.

4. The system of claim 3, wherein the challenge generation module is further executable by the processor to access an external provider of challenge questions and download a challenge question to be issued to the sender address as a part of the active image-based challenge.

5. The system of claim 3, wherein the challenge generation module is further executable by the processor to generate the active image-based challenge in response to user input received via a graphical user interface.

6. The system of claim 5, wherein the user input received via the graphical user interface includes a user selection of a specific challenge question to be posited to the sender address.

7. The system of claim 5, wherein the user input received via the graphical user interface includes an indication for all future active image-based challenges to be generated automatically.

8. The system of claim 5, wherein the user input received via the graphical user interface includes an indication for all future active image-based challenges to be generated individually.

9. The system of claim 3, wherein the challenge generation module is further executable by the processor to cause the display of a notification of receipt of electronic mail that has not been approved for delivery to the e-mail application, the notification including an option to generate the active image-based challenge and transfer the electronic mail to the intermediate storage buffer.

10. The system of claim 3, wherein the challenge generation module is further executable by the processor to cause the display of a notification of receipt of electronic mail that has not been approved for delivery to the e-mail application, the notification including an option to not generate the active image-based challenge and to allow for delivery of the electronic mail to the e-mail application.

11. The system of claim 3, wherein the active image-based challenge is created by the user to whom the current e-mail message is sent, and wherein the challenge generation module receives the active image-based challenge from the user.

12. A method for electronic mail delivery, the method comprising:

intercepting an electronic mail message sent from a sender address and addressed to a recipient address, wherein interception of the electronic mail message occurs prior to delivery of the electronic mail message to the recipient address;

determining whether the sender address is that of an approved sender, wherein the electronic mail message is stored in an intermediate storage buffer until the determination is made that the electronic mail message is that of an approved sender;

delivering the intercepted electronic mail message from the intermediate storage buffer to the recipient address for access by a user associated with the recipient address when the determination indicates that the intercepted electronic mail message is from an approved sender;

determining that a current level of security has been selected by the user, wherein the e-mail system has a plurality of different levels of security ranging from high to low, each level associated with the different set of one or more e-mail filters;

issuing an active image-based challenge associated with the current level of security, in which a challenge question is part of a moving or changing image to the sender address when the determination indicates that the intercepted electronic mail message is not from an approved sender, wherein the challenge question is presented as scrolling text that is part of the moving or changing image and is to be responded to by a user associated with the sender address, and wherein the challenge question that is part of the moving or changing image requires a correct e-mail response to be selected from a provided set comprising a plurality of possible e-mail responses;

analyzing a message received in response to the active image-based challenge, wherein the intercepted electronic mail is deleted from the intermediate storage buffer when the message received in response to the active image-based challenge fails to include an indication that the sender address is configured to accept e-mail and is not associated with an open relay and the correct response to the challenge question, and delivering the intercepted electronic mail message from the intermediate storage buffer to the recipient address for access by the user associated with the recipient address when the message received in response to the active image-based challenge includes the indication and the correct response to the challenge question and is received within a predetermined period of time, and adding the sender address to a list of approved senders whereby the sender address is not subject to a future challenge upon receipt of subsequent electronic mail messages from the sender address.

13. The method of claim 12, further comprising:

accessing an external provider of challenge questions; and

downloading a challenge question to be issued to the sender address as a part of the active image-based challenge.

14. The method of claim 12, further comprising receiving user input concerning the generation of the active image-based challenge.

15. The method of claim 12, further comprising:

generating a notification to the user associated with the recipient address, the notification indicating interception of an electronic mail message from a non-approved sender; and

receiving input from the user associated with the recipient address in response to the notification, the input indicating the challenge question to be issued to the sender address as a part of the active image-based challenge.

16. The method of 12, wherein the active image-based challenge is created by the user to whom the current e-mail message is sent, and further comprising initially receiving the active image-based challenge from the user.

17. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for electronic mail delivery, the method comprising:

intercepting an electronic mail message sent from a sender address and addressed to a recipient address, wherein interception of the electronic mail message occurs prior to delivery of the electronic mail message to the recipient address;

determining whether the sender address is that of an approved sender, wherein the electronic mail message is stored in an intermediate storage buffer until the determination is made that the electronic mail message is that of an approved sender;

delivering the intercepted electronic mail message from the intermediate storage buffer to the recipient address for access by a user associated with the recipient address when the determination indicates that the intercepted electronic mail message is from an approved sender;

determining that a current level of security has been selected by the user, wherein the e-mail system has a plurality of different levels of security ranging from high to low, each level associated with the different set of one or more e-mail filters;

issuing an active image-based challenge associated with the current level of security, in which a challenge question is presented as scrolling text that is part of a moving or changing image to the sender address when the determination indicates that the intercepted electronic mail message is not from an approved sender, wherein the challenge question that is part of the moving or changing image is to be responded to by a user associated with the sender address, and wherein the challenge question that is part of the moving or changing image requires a correct e-mail response to be selected from a provided set comprising a plurality of possible e-mail responses;

analyzing a message received in response to the active image-based challenge, wherein the intercepted electronic mail is deleted from the intermediate storage buffer when the message received in response to the active image-based challenge fails to include an indication that the sender address is configured to accept e-mail and is not associated with an open relay and the correct response to the challenge question, and delivering the intercepted electronic mail message from the intermediate storage buffer to the recipient address for access by the user associated with the recipient address when the message received in response to the active image-based challenge includes the indication and the correct response to the challenge question and is received within a predetermined period of time, and adding the sender address to a list of approved senders whereby the sender address is not subject to a future challenge upon receipt of subsequent electronic mail messages from the sender address.

18. The non-transitory computer-readable storage medium of claim 17, wherein the active image-based challenge is created by the user to whom the current e-mail message is sent, and further comprising initially receiving the active image-based challenge from the user.