# US 8,572,190 B2 · Method and system for recognizing desired email > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,190 B2 - Document ID: US8572190B2 - Status: Granted - Kind: B2 - Application number: 12/628,901 - Filed: 2009-12-01 - Published: 2010-03-25 - Granted: 2013-10-29 - Earliest claimed: 2006-03-09 - Assignees: WatchGuard Technologies, Inc. - Applicants: John Alsop; Christopher Gabe; Robert Osborne - Inventors: John Alsop; Christopher Gabe; Robert Osborne - Web page: https://patentgrep.com/patent/US8572190B2 ## CPC - H04L 51/212: using filtering or selective blocking - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for recognizing an incoming email as a desired email examines outgoing email messages to arrange the email into fragments for which representations are created and stored. When an incoming message is received, the message is arranged into fragments for which representations are created. The representations of the incoming message are compared to the stored representations and if the matches between stored representations and the representations of the incoming message meet a predefined threshold test, the incoming message is recognized as being desirable. An incoming email message which has been recognized as being desirable can be subjected to a lesser examination to recognize a SPAM message, or to no further examination to recognize a SPAM message. ## Claims ### Claim 1 A method of recognizing an incoming email message, received at an email firewall, as being non-SPAM, comprising the steps of: arranging contents of an outgoing email message, received at the email firewall from a private network, into outgoing message fragments, each outgoing message fragment corresponding to a portion of the contents of the outgoing email message; for each outgoing message fragment, creating a stored outgoing message fragment representation of at least a portion of the outgoing message fragment; designating the stored outgoing message fragment representation as corresponding to a non-SPAM message based on the outgoing message fragment originating in an outgoing email message; arranging contents of the incoming email message, received at the email firewall from a public network, into at least one incoming message fragment, each incoming message fragment corresponding to a portion of the contents of the incoming email message; for each incoming message fragment, creating an incoming message fragment representation of at least a portion of the incoming message fragment; comparing each incoming message fragment representation to the stored outgoing message fragment representations to identify matches therebetween, wherein matches indicate a portion of the contents of the outgoing email message in the contents of the incoming email message; and identifying the incoming email message as being non-SPAM in response to the contents of the incoming email message comprising a threshold amount of the contents of the outgoing email message based on the matches between the incoming message fragment representations and the stored outgoing message fragment representations exceeding a pre-defined threshold test. ### Claim 2 (depends on 1) The method of claim 1, wherein one of the outgoing message fragments is an address of an intended recipient of the outgoing email message. ### Claim 3 (depends on 1) The method of claim 1, wherein creating an outgoing message fragment representation comprises copying a portion of the outgoing message fragment. ### Claim 4 (depends on 1) The method of claim 1, wherein creating an outgoing message fragment representation comprises forming a hash of at least a portion of the outgoing message fragment. ### Claim 5 (depends on 1) The method of claim 1, wherein a respective time value is associated with each stored outgoing message fragment representation and each stored outgoing message fragment representation is removed from storage when the associated time value is exceeded. ### Claim 6 (depends on 1) The method of claim 1, wherein the pre-defined threshold test comprises comparing the number of identified matches to a threshold value. ### Claim 7 (depends on 1) The method of claim 1, wherein the pre-defined threshold test comprises a template defining one or more specific matches that must be found in a subject message. ### Claim 8 (depends on 6) The method of claim 6, wherein the number of identified matches is provided as a parameter to a subsequent process operating on the incoming email message. ### Claim 9 (depends on 1) The method of claim 1, wherein creating an incoming message fragment representation comprises ignoring a pre-defined set of characters in the incoming message fragment. ### Claim 10 (depends on 1) The method of claim 1, further comprising forwarding an incoming email message identified as being non-SPAM to an intended recipient without being processed by an anti-SPAM filter. ### Claim 11 (depends on 1) The method of claim 1, further comprising: identifying the incoming email message as being unrecognized if the matches identified between the incoming message fragment representations and the outgoing message fragment representations do not meet the pre-defined threshold test. ### Claim 12 An email system, comprising: at least one incoming email server, at least one outgoing email server, at least one email firewall device; and at least one fingerprinting device, which is operable to: receive an outgoing email from a private network; prior to delivering the outgoing email, arrange contents of the outgoing email into at least one outgoing message fragment and to create and store an outgoing message fragment representation of each outgoing message fragment of the outgoing email; designate the outgoing message fragment representations as corresponding to non-SPAM messages based on the outgoing message fragment originating in an outgoing email message; upon receipt of an incoming email from a public network, arrange contents of the incoming email into at least one incoming message fragment and to create an incoming message fragment representation of each incoming message fragment of the incoming email; identify matches between the at least one incoming message fragment representations to the stored outgoing message fragment representations, the matches indicating a portion of the contents of the outgoing email message in the contents of the incoming email message; and identify the incoming email as non-SPAM when the incoming email message comprises a threshold amount of the contents of the outgoing email message based on the identified matches exceeding a predefined threshold test. ### Claim 13 (depends on 12) The email system of claim 12, wherein the at least one fingerprinting device is the at least one email firewall device. ### Claim 14 (depends on 12) The email system of claim 12, wherein an outgoing message fragment representation comprises a copy of at least a portion of the outgoing message fragment. ### Claim 15 (depends on 12) The email system of claim 12, wherein an outgoing message fragment representation comprises a hash of at least a portion of the outgoing message fragment. ### Claim 16 An email server comprising an email fingerprinting device, configured to: arrange content of an outgoing email message received from a private network into a plurality of stored outgoing message fragments, each stored outgoing message fragment corresponding to a portion of the content of the outgoing email message; designate the outgoing message fragment representations as corresponding to non-SPAM messages based on the outgoing message fragment originating in an outgoing email message; arrange content of an incoming email message received from a public network into a plurality of incoming message fragments, each incoming message fragment corresponding to a portion of the content of the incoming email message; and identify the incoming email message as non-SPAM when the incoming email message comprises a threshold amount of the content of the outgoing email message as indicated by matching a predetermined threshold of the incoming message fragments to the stored outgoing message fragments.