Ingress Email Security via Multi-List Evaluator Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing email security systems face disruptions and performance issues due to false-positive blacklisting, where non-malicious email servers are incorrectly flagged, leading to delayed corrections and service interruptions.
Innovation Solution
Implementing a specially programmed mail filter (milter) with a multi-list evaluator at the ingress server, which performs a two-phase processing to validate incoming messages. This includes checking the sender's network address against trust, whitelist, and blacklist lists, and further evaluating the sender's domain to determine message acceptance or rejection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklists are used to block malicious email traffic, then email security is improved, but false-positive rate increases causing non-malicious servers to be incorrectly blocked
Solution Approach 1:
The patent segments the blacklist checking process into two distinct phases: connection-phase checking against a smaller, more accurate internal blacklist, and envelope-phase checking against larger third-party blacklists. This segmentation allows the system to maintain security while reducing false positives by applying different blacklist sources at appropriate processing stages.
Solution Approach 2:
The patent performs preliminary blacklist checking during the connection phase before full email processing occurs. By evaluating sender IP addresses against blacklists early in the SMTP handshake process, the system can reject potentially malicious connections before they consume significant resources, while the two-phase approach ensures false positives are minimized through subsequent verification.
2Reliability
If third-party blacklists are used for email validation, then malware detection capability is improved, but service disruption time increases when false-positive blacklisting occurs
Solution Approach 1:
The patent divides blacklist validation into two phases: connection-phase validation using a curated internal blacklist, and envelope-phase validation using third-party blacklists. This segmentation enables the system to maintain malware detection capability while reducing service disruption by having a fallback mechanism through the internal blacklist that doesn't require external communication.
Solution Approach 2:
The internal blacklist acts as an intermediary between third-party blacklists and the email filtering decision. It provides a local, authoritative reference that can override or supplement third-party blacklist decisions, enabling the system to resolve false-positive blacklisting issues without requiring external intervention and thus minimizing service disruption time.
3Reliability
If multiple blacklists are checked for comprehensive security, then threat detection coverage is improved, but processing time increases
Solution Approach 1:
The patent segments threat detection into two phases: connection-phase detection using a smaller internal blacklist, and envelope-phase detection using multiple third-party blacklists. This segmentation improves threat detection coverage by combining multiple blacklist sources while managing processing time by applying checks at different stages of email processing rather than all at once.
Solution Approach 2:
The patent implements periodic blacklist checking at different processing stages: connection-phase checking against the internal blacklist, and envelope-phase checking against third-party blacklists. This periodic approach distributes the computational burden of multiple blacklist checks across different time points in the email processing workflow, maintaining comprehensive security while managing processing throughput.
Data Source
AI summary
An ingress server is operable to perform, through a multi-list evaluator, two different validations: one utilizes a sender network address of a sender's server to determine whether to trust, accept, or reject a connection and one utilizes a domain of a sender email address from an envelope to determine whether to accept or reject a message. The multi-list evaluator may perform the validations in two phases. If a connection can be trusted, the connection is accepted and any message over the connection (in a single session) is accepted and no further validation is necessary. Further, in both phases, the multi-list evaluator can utilize a whitelist maintained by the ingress server to override a blacklist provided by a blacklist supplier. This override can reduce false-positives and drastically reduce delays usually associated with correcting false-positives and improve system throughput.