Trusted communication network

• US 9,160,755 B2
• Filed: 08/17/2006
• Issued: 10/13/2015
• Est. Priority Date: 12/21/2004
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Chasin, C. Scott, Lin, Wei
• Primary Examiner(s): Nawaz, Asad
• Assistant Examiner(s): Ansari, Najeebuddin
• Application Number:
  US11/465,433
• Publication Number:
  US 20070107059A1
• Time in Patent Office: 3,344 Days
• Field of Search: 726/23, 726/1, 726/2, 726/3, 726/4, 726/5, 726/11, 726/12, 726/13, 726/14, 726/19, 709/206
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system includes a processing node configured to send authorized inbound messages to registered enterprise networks. An authorized message is a message that includes trusted source indicia. Trusted source indicia indicates that the message was sent by one or more of the processing node or an authenticated message transfer node associated with one of the registered enterprise networks. The system may further include an administration node configured to maintain registration of a plurality of message transfer nodes associated with the enterprise networks. A method includes receiving outbound messages from an authenticated message transfer node of an enterprise network, screening the messages for threats to determine whether to send the messages to associated recipients, applying a first message identifier to each message, wherein the first message identifier can be used to track the message and, for each message, sending the message to the associated recipient if no threats are detected in the message.

Claims

1. An apparatus for limiting bounce attacks, comprising:

a processing node provided on a computer system having a processor and a computer-readable memory that;

receives an outbound message;

filters said outbound message for threats to determine whether to send said outbound message to at least one message recipient of said outbound message;

in response to determining said outbound message is trusted;

applies a trusted message identifier to said outbound message that identifies said outbound message as a trusted message prescreened for a security threat and having been originated from an authenticated private network member;

inserts a message tracking identifier (ID), a bounce tracking message ID, and a sender authentication tracking message ID into the outbound message, wherein the message tracking ID is generated using a hash of portions of the outbound message;

stores at least the bounce tracking message ID among one or more bounce tracking message IDs at the processing node; and

sends the outbound message to the at least one message recipient of said outbound message;

distinguishes whether a bounce back message is authorized and corresponds to one of the outbound messages sent by the processing node by determining whether bounce tracking message ID in the bounce back message corresponds to one of the bounce tracking message IDs stored at the processing node, wherein the bounce back message is a non-delivery report; and

generates a reputation metric associated with each member network of a plurality of registered member networks, wherein said reputation metric is based at least in part on threats detected in messages sent from said plurality of member networks.

2. The apparatus of claim 1, wherein said processing node further sends said outbound message to said at least one recipient on other member networks of the plurality of member networks and on non-member networks available on a public network system.

3. The apparatus of claim 1, further comprising a hosted domain name system (DNS) server configured to provide authentication data when queried by said at least one recipient of said outbound message.

4. The apparatus of claim 3, wherein said authentication data provided by said hosted DNS server comprises an Internet Protocol (IP) address associated with said processing node.

5. The apparatus of claim 1, wherein the bounce tracking message ID comprises a hash of one or more parts of the message and replaces a sender envelope ID of the outbound message.

6. The apparatus of claim 1, wherein said processing node further quarantines outbound messages that have associated threats.

7. The apparatus of claim 6, wherein said processing node disposes of said outbound messages based on an enterprise disposition policy, wherein said disposition policy is selected from a group consisting of:

quarantine until release,

bounce back to specified enterprise network user,

delete without sending,

deliver after a specified time, and

deliver only after approval.

8. The apparatus of claim 1, further comprising one or more policies associated with a first member network of the plurality of member networks, wherein one of said one or more policies specifies filtering attributes upon which outbound messages are to be filtered, and wherein said processing node further filters outbound messages according to said one or more policies.

9. The apparatus of claim 8, wherein said one or more policies comprise one or more of an enterprise-level policy, a group-level policy, a department-level policy, or a user-level policy.

10. The apparatus of claim 8, wherein said one or more policies specifies a standard stationary to be applied to every outbound message sent from each member network of said plurality of member networks.

11. The apparatus of claim 1, wherein said processing node further inserts one or more identifiers into each outbound message sent wherein said identifiers are selected from a group consisting of:

an integrity checksum signature; and

a domain name authentication identifier.

12. A non-transitory computer-readable storage medium having machine-executable instructions that when executed on a processor configure the processor to:

receive an outbound message;

filter said outbound message for threats to determine whether to send said outbound message to at least one message recipient of said outbound message;

in response to determining said outbound message is trusted;

apply a trusted message identifier to said outbound message that identifies said outbound message as a trusted message prescreened for a security threat and having been originated from an authenticated private network member;

inserts a message tracking ID, a bounce tracking message ID, and a sender authentication tracking message ID into the outbound message, wherein the message tracking ID is generated using a hash of portions of the outbound message;

store at least the bounce tracking message ID among one or more bounce tracking message IDs at the processing node; and

send the outbound message to the at least one message recipient of said outbound message;

distinguish whether a bounce back message is authorized and corresponds to one of the outbound messages sent by the processing node by determining whether bounce tracking message ID in the bounce back message corresponds to one of the bounce tracking message IDs stored at the processing node, wherein the bounce back message is a non-delivery report; and

generate a reputation metric associated with each member network of a plurality of registered member networks, wherein said reputation metric is based at least in part on threats detected in messages sent from said plurality of member networks.

13. The medium of claim 12, wherein the machine executable instructions that when executed on the processor configure the processor further to:

send said outbound message to said at least one recipient on other member networks of the plurality of member networks and on non-member networks available on a public network system.

14. The medium of claim 12, wherein the machine executable instructions that when executed on the processor configure the processor to filter the outbound message according to one or more policies associated with a first member network of the plurality of member networks, wherein one of said one or more policies specifies filtering attributes upon which outbound messages are to be filtered.

15. The medium of claim 14, wherein said one or more policies comprise one or more of an enterprise-level policy, a group-level policy, a department-level policy, or a user-level policy.

16. The medium of claim 14, wherein said one or more policies specifies a standard stationary to be applied to every outbound message sent from each member network of said plurality of member networks.

17. The medium of claim 12, wherein the machine-executable instructions that when executed on the processor configure the processor to further insert one or more identifiers into each outbound message sent wherein said identifiers are selected from a group consisting of:

an integrity checksum signature; and

a domain name authentication identifier.

18. A method for limiting bounce attacks, comprising:

receiving, by a processing node executing on a processor, of a an outbound message;

filtering, by the processing node, said outbound message for threats to determine whether to send said outbound message to at least one message recipient of said outbound message;

in response to determining said outbound message is trusted;

applying, by the processing node, a trusted message identifier to said outbound message that identifies said outbound message as a trusted message prescreened for a security threat and having been originated from an authenticated private network member;

inserting, by the processing node, a message tracking ID, a bounce tracking message ID, and a sender authentication tracking message ID into the outbound message, wherein the message tracking ID is generated using a hash of portions of the outbound message;

storing, by the processing node, at least the bounce tracking message ID among one or more bounce tracking message IDs at the processing node;

sending, by the processing node, the outbound message to the at least one message recipient of said outbound message;

distinguishing, by the processing node, whether a bounce back message is authorized and corresponds to one of the outbound messages sent by the processing node by determining whether bounce tracking message ID in the bounce back message corresponds to one of the bounce tracking message IDs stored at the processing node, wherein the bounce back message is a non-delivery report; and

generating a reputation metric associated with each member network of a plurality of registered member networks, wherein said reputation metric is based at least in part on threats detected in messages sent from said plurality of member networks.

19. The method of claim 18, further comprising filtering the outbound message according to one or more policies associated with a first member network of the plurality of member networks, wherein one of said one or more policies specifies filtering attributes upon which outbound messages are to be filtered.

20. The method of claim 18, further comprising inserting one or more identifiers into each outbound message sent wherein said identifiers are selected from a group consisting of:

an integrity checksum signature; and

a domain name authentication identifier.