Just-in-time, email embedded URL reputation determination

• US 9,929,991 B2
• Filed: 09/16/2016
• Issued: 03/27/2018
• Est. Priority Date: 12/20/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Liebmann, Nicholas, Stecher, Martin, Gartside, Paul, Bishop, Michael G., Hunt, Simon
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US15/267,658
• Publication Number:
  US 20170005961A1
• Time in Patent Office: 557 Days
• Field of Search: 709206
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/18 Commands or executable codes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system allows just-in-time checking of information about an email in which a hyperlink is embedded. Upon receipt of the email containing the hyperlink, the resource locator of the hyperlink is modified to allow checking the reputation of the email upon traversal of the hyperlink. At traversal of the hyperlink, the current reputation of the resource locator and the current reputation of the email are both determined, and one or more actions are performed responsive to the determination.

Claims

1. A program storage device, on which is stored instructions for determining whether to allow traversal of a hyperlink embedded in an email, comprising instructions that when executed by one or more processors causes an email gateway to:

receive an email;

create a message identifier for the email;

generate meta-information corresponding to the email;

store the meta-information in a database, keyed by the message identifier;

encrypt the message identifier;

modify a resource locator of a hyperlink contained in the email to include the encrypted message identifier;

deliver the email to a recipient mailbox;

receive the message identifier from a web gateway;

determine a current reputation of the email from a reputation server; and

providing the current reputation of the email to the web gateway.

2. The program storage device of claim 1, wherein the meta-information comprises:

a data signature;

header data of the email; and

envelope data of the email.

3. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

encode the message identifier into the resource locator.

4. The program storage device of claim 3, wherein the instructions for causing one or more processors to encode the message identifier into the resource locator comprise instructions for causing one or more processors to:

encode additional information into the resource locator.

5. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

replace the resource locator with a different resource locator.

6. The program storage device of claim 1, wherein the instructions for causing one or more processors to modify the resource locator comprise instructions for causing one or more processors to:

encode information regarding a context of the email into the resource locator.

7. A system for determining whether to allow traversal of a hyperlink embedded in an email, comprising:

a web gateway; and

an email gateway,

wherein the web gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive a request to make a connection to a location specified by a resource locator of a hyperlink embedded in an email;

determine an identity of the email based on the resource locator;

determine a current reputation of the email; and

determine a current reputation of the resource locator; and

perform an action responsive to a reputation of the resource locator and the email,

wherein the email gateway comprises;

a processor;

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive the email; and

modify the resource locator in the email to identify the email.

8. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

cache information corresponding to the email;

receive the request from the web gateway;

extract information about the email from the cached information based on information in the request;

obtain reputation information for the email; and

send the reputation information to the web gateway.

9. The system of claim 7,

wherein the software of the web gateway further comprises instructions for causing the processor to:

determine that the resource locator comprises information associated with a context of the email,

wherein the instructions for causing the processor to request reputation information comprise instructions for causing the processor to;

include the information associated with the context of the email in the request.

10. The system of claim 7,

wherein the software of the email gateway further comprises instructions for causing the processor to:

deliver the email containing the modified resource locator.

11. The system of claim 7, wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to:

generate a message identifier for the email; and

modify the email by encoding the message identifier into the resource locator in the email.

12. The system of claim 7, wherein the software of the email gateway further comprises instructions for causing the processor to:

obtain an initial reputation of the email upon receipt of the email; and

perform an action responsive to the initial reputation.

13. The system of claim 7, further comprising:

a redirection server, comprising;

a processor; and

a storage device, coupled to the processor, on which is stored software comprising instructions for causing the processor to;

receive information associating the modified resource locator with the resource locator in the email;

receive a connection corresponding to the resource locator;

request a reputation of the email and the resource locator in the email; and

redirect the connection to a destination specified in the resource locator in the email,

wherein the instructions for causing the processor to modify the resource locator comprise instructions for causing the processor to;

replace the resource locator in the email with a resource locator pointing to the redirection server.

14. A method for determining whether to allow traversal of a hyperlink embedded in an email, comprising:

receiving an email by an email gateway computer, comprising;

determining an initial reputation of the email by requesting a reputation of the email from a reputation server;

modifying a first resource locator of a hyperlink embedded in the email to identify the email; and

deliver the email to a mailbox of a recipient; and

receiving by the email gateway from a web gateway a request to traverse the first resource locator, comprising;

determining a current reputation of the first resource locator by requesting a current reputation of the first resource locator from the reputation server;

analyzing the first resource locator to identify the email in which the hyperlink was embedded;

determining a current reputation of the email by requesting a current reputation of the email from the reputation server; and

providing the current reputation of the first resource locator and the current reputation of the email to a web gateway for determining whether to allow traversal of the first resource locator.

15. The method of claim 14, wherein modifying a first resource locator comprises:

replacing the resource locator with a second resource locator; and

associating the first resource locator with the second resource locator.

16. The method of claim 15, wherein receiving a request to traverse the first resource locator further comprises:

receiving a request by a redirection service to traverse the second resource locator; and

determine the first resource locator associated with the second resource locator.

17. The method of claim 14,

wherein receiving an email further comprises:

storing meta-information about the email; and

associating the meta-information with a message identification data, and

wherein modifying a first resource locator comprises;

encoding the message identification data into the first resource locator.

18. The method of claim 17, wherein the meta-information comprises:

a data signature;

header data of the email; and

envelope data of the email.

19. The method of claim 14, wherein modifying a first resource locator of a hyperlink embedded in the email to identify the email comprises:

encoding information regarding a context of the email into the resource locator.

20. The method of claim 14, wherein modifying a first resource locator of a hyperlink embedded in the email to identify the email comprises:

replacing the resource locator with a difference resource locator.