Systems, methods and computer program products for ingress email security
An ingress server is operable to perform, through a multi-list evaluator, two different validations: one utilizes a sender network address of a sender's server to determine whether to trust, accept, or reject a connection and one utilizes a domain of a sender email address from an envelope to determine whether to accept or reject a message. The multi-list evaluator may perform the validations in two phases. If a connection can be trusted, the connection is accepted and any message over the connection (in a single session) is accepted and no further validation is necessary. Further, in both phases, the multi-list evaluator can utilize a whitelist maintained by the ingress server to override a blacklist provided by a blacklist supplier. This override can reduce false-positives and drastically reduce delays usually associated with correcting false-positives and improve system throughput.
1. A method, comprising:
receiving, by an ingress server computer of a computer network a request for connection from a sender system, the sender system having a sender network address;
comparing, by the ingress server computer, the sender network address with a plurality of lists of addresses without receiving an envelope and an associated message from the sender system;
determining, by the ingress server computer based on the comparing, whether to trust the sender system and accept the request for connection from the sender system, to accept the request for connection from the sender system but not trust the sender system, or to reject the request for connection from the sender system;
when it is determined to accept the request for connection from the sender system but not trust the sender system, accepting, by the ingress server, the request for connection and receiving the envelope from the sender system but not accepting the message associated with the envelope, the envelope from the sender system containing a sender email address, the sender email address containing a domain;
comparing, by the ingress sever, the domain of the sender email address from the envelope with a plurality of lists of domains, the plurality of lists of domains including a whitelist, without opening the message; and
responsive to a determination that the domain of the sender email address from the envelope is found on the whitelist of the plurality of lists of domains or a determination that the domain of the sender email address from the envelope is not found on any of the plurality of lists of domains, accepting, by the ingress server, the message from the sender system and routing the message to the end user's device.
2. The method according to claim 1 , further comprising:
logging, in a log maintained by the ingress server, a reason of rejection or acceptance of the request for connection from the sender system; and
logging, in the log maintained by the ingress server, a reason of rejection or acceptance of the message from the sender system.
3. The method according to claim 1 , wherein the plurality of lists of addresses includes a trusted list of addresses maintained by the ingress server, a whitelist of addresses maintained by the ingress server, a blacklist of addresses maintained by the ingress server, and a blacklist maintained by a blacklist service provider system operating outside of the computer network.
4. The method according to claim 1 , wherein the plurality of lists of domains includes the whitelist maintained by the ingress server, a domain blacklist maintained by the ingress server, and a domain blacklist maintained by a blacklist service provider system operating outside of the computer network.
5. The method according to claim 1 , further comprising:
tagging the message with a reason for accepting the request for connection from the sender system and a reason for accepting the message based on the domain of the sender email address from the envelope of the message.
6. The method according to claim 1 , further comprising:
responsive to a determination to trust the sender system and accept the request for connection from the sender system, receiving the message from the sender system and routing the message to a receiver system.
7. The method according to claim 1 , further comprising:
responsive to a determination to reject the request for connection from the sender system, denying the request for connection such that no envelope or message is received by the ingress server.
8. A system, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor to perform, at an ingress server computer of a computer network:
receiving a request for connection from a sender system, the sender system having a sender network address;
comparing the sender network address with a plurality of lists of addresses without receiving an envelope and an associated message from the sender system;
determining, based on the comparing, whether to trust the sender system and accept the request for connection from the sender system, to accept the request for connection from the sender system but not trust the sender system, or to reject the request for connection from the sender system;
when it is determined to accept the request for connection from the sender system but not trust the sender system, accepting the request for connection and receiving the envelope from the sender system but not accepting the message associated with the envelope, the envelope from the sender system containing a sender email address, the sender email address containing a domain;
comparing the domain of the sender email address from the envelope with a plurality of lists of domains, the plurality of lists of domains including a whitelist, without opening the message; and
responsive to a determination that the domain of the sender email address from the envelope is found on the whitelist of the plurality of lists of domains or a determination that the domain of the sender email address from the envelope is not found on any of the plurality of lists of domains, accepting, by the ingress server, the message from the sender system and routing the message to the end user's device.
9. The system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
logging, in a log maintained by the ingress server, a reason of rejection or acceptance of the request for connection from the sender system; and
logging, in the log maintained by the ingress server, a reason of rejection or acceptance of the message from the sender system.
10. The system of claim 8 , wherein the plurality of lists of addresses includes a trusted list of addresses maintained by the ingress server, a whitelist of addresses maintained by the ingress server, a blacklist of addresses maintained by the ingress server, and a blacklist maintained by a blacklist service provider system operating outside of the computer network.
11. The system of claim 8 , wherein the plurality of lists of domains includes the whitelist maintained by the ingress server, a domain blacklist maintained by the ingress server, and a domain blacklist maintained by a blacklist service provider system operating outside of the computer network.
12. The system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
tagging the message with a reason for accepting the request for connection from the sender system and a reason for accepting the message based on the domain of the sender email address from the envelope of the message.
13. The system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
responsive to a determination to trust the sender system and accept the request for connection from the sender system, receiving the message from the sender system and routing the message to a receiver system.
14. The system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
responsive to a determination to reject the request for connection from the sender system, denying the request for connection such that no envelope or message is received by the ingress server.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to perform, at an ingress server of a computer network:
receiving a request for connection from a sender system, the sender system having a sender network address;
comparing the sender network address with a plurality of lists of addresses without receiving an envelope and an associated message from the sender system;
determining, based on the comparing, whether to trust the sender system and accept the request for connection from the sender system, to accept the request for connection from the sender system but not trust the sender system, or to reject the request for connection from the sender system;
when it is determined to accept the request for connection from the sender system but not trust the sender system, accepting the request for connection and receiving the envelope from the sender system but not accepting the message associated with the envelope, the envelope from the sender system containing a sender email address, the sender email address containing a domain;
comparing the domain of the sender email address from the envelope with a plurality of lists of domains, the plurality of lists of domains including a whitelist, without opening the message; and
responsive to a determination that the domain of the sender email address from the envelope is found on the whitelist of the plurality of lists of domains or a determination that the domain of the sender email address from the envelope is not found on any of the plurality of lists of domains, accepting, by the ingress server, the message from the sender system and routing the message to the end user's device.
16. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
logging, in a log maintained by the ingress server, a reason of rejection or acceptance of the request for connection from the sender system; and
logging, in the log maintained by the ingress server, a reason of rejection or acceptance of the message from the sender system.
17. The computer program product of claim 15 , wherein the plurality of lists of addresses includes a trusted list of addresses maintained by the ingress server, a whitelist of addresses maintained by the ingress server, a blacklist of addresses maintained by the ingress server, and a blacklist maintained by a blacklist service provider system operating outside of the computer network.
18. The computer program product of claim 15 , wherein the plurality of lists of domains includes the whitelist maintained by the ingress server, a domain blacklist maintained by the ingress server, and a domain blacklist maintained by a blacklist service provider system operating outside of the computer network.
19. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
tagging the message with a reason for accepting the request for connection from the sender system and a reason for accepting the message based on the domain of the sender email address from the envelope of the message.
20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
responsive to a determination to trust the sender system and accept the request for connection from the sender system, receiving the message from the sender system and routing the message to a receiver system.