US 8,914,883 B2Granted

Securing email communications

AssigneeFortinet, Inc.

InventorsCarl M. Windsor, Jiandong Cheng

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and systems are provided for securing email communications. According to one embodiment, a network device evaluates whether a domain name of a target recipient of an outbound email is present in a local white list or a local black list. If it is found in the local white list, the email is transmitted to the target recipient. If it is found in the local black list, transmission of the email to the target recipient is prevented. When the domain name is not present in the local black list and the local whitelist, a global doppelganger database is checked. If it is found in the global doppelganger database, the email is handled according to a corresponding acceptability flag; otherwise, the validity of the domain name is dynamically verified and handled according to the verification result.

Claims18

Dependent claims

A method for securing electronic mail (email) communications comprising:

receiving, by a network device, an outbound email originated by a computing device of an internal network and directed to a target recipient;
evaluating, by the network device, whether a domain name of the target recipient is present in a local white list or a local black list;
when the domain name is determined to be present in the local white list, transmitting the email to the target recipient;
when the domain name is determined to be present in the local black list, preventing transmission of the email to the target recipient;
when the domain name is determined not to be present in one of the local black list and the local whitelist, determining, by the network device, whether the domain name is present in a global doppelganger database;
when the domain name is determined to be present in the global doppelganger database, preventing transmission of the outbound email to the target recipient if the domain name is an unacceptable domain name and transmitting the outbound email to the target recipient if the domain name is an acceptable domain name;
when the domain name is determined not to be present in one of the local black list and the local white list and the global doppelganger database, dynamically verifying, by the network device, validity of the domain name;
and
when the validity of the domain name is confirmed by said dynamically verifying, transmitting the outbound email to the target recipient and when the validity of the domain name is not confirmed by said dynamically verifying, preventing transmission of the outbound email to the target recipient.

6 more elements

A non-transitory computer-readable storage medium tangibly embodying a set of instructions, which when executed by one or more processors of a network device, cause the one or more processors to perform a method comprising:

receiving an outbound email originated by a computing device of an internal network and directed to a target recipient;
evaluating whether a domain name of the target recipient is present in a local white list or a local black list;
when the domain name is determined to be present in the local white list, transmitting the email to the target recipient;
when the domain name is determined to be present in the local black list, preventing transmission of the email to the target recipient;
when the domain name is determined not to be present in one of the local black list and the local whitelist, determining whether the domain name is present in a global doppelganger database;
when the domain name is determined to be present in the global doppelganger database, preventing transmission of the outbound email to the target recipient if the domain name is an unacceptable domain name and transmitting the outbound email to the target recipient if the domain name is an acceptable domain name;
when the domain name is determined not to be present in one of the local black list and the local white list and the global doppelganger database, dynamically verifying validity of the domain name;
and
when the validity of the domain name is confirmed by said dynamically verifying, transmitting the outbound email to the target recipient and when the validity of the domain name is not confirmed by said dynamically verifying, preventing transmission of the outbound email to the target recipient.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/886,841Filed 3 May 2013
Published: US 2014/0331318 A16 Nov 2014
Granted: 16 Dec 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
G06F 16/955
Retrieval from the web: using information identifiers, e.g. uniform resource locators [URL]
H04L 51/04
User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail: real-time or…
H04L 51/212
Monitoring or handling of messages: using filtering or selective blocking