Identity-based messaging security
A system comprising email processing circuitry, web server circuitry, third-party interface circuitry, and a database, wherein the database stores information about a plurality of users. The system receives, via a network, a first email message and generates a modified first email message by insertion of a link to remotely-hosted content in the received email message. The system transmits, via a network interface, the modified first email message. The system receives, via a network, a request for the remotely-hosted content, and updates the database based on information contained in the request for the remotely-hosted content. The system receives, via a network, information about activity on a third-party system, and updates the database based on the information about activity on the third-party system. The system receives a second email message, determines an action to take on the second email message based on information in the database, and takes the action.
1. A system comprising:
email processing circuitry, web server circuitry, third-party interface circuitry, and a database, wherein:
the database stores information about a plurality of users;
the email processing circuitry is operable to:
receive, via a network, a first email message;
generate a modified first email message by insertion of a link to remotely-hosted content in the received email message; and
transmit, via a network interface, the modified first email message;
the web server circuitry is operable to:
receive, via a network, a request for the remotely-hosted content; and
update the database based on information contained in the request for the remotely-hosted content;
the third-party interface circuitry is operable to:
receive, via a network, information about activity on a third-party system; and
update the database based on the information about activity on the third-party system; and
the email processing circuitry is operable to:
receive a second email message;
determine an action to take on the second email message based on information stored in the database; and
perform the determined action on the second email message.
2. The system of claim 1 , wherein the determined action comprises one or more of:
insertion of text into the body of the second email message;
deletion of the second email message;
delaying delivery of the second email message;
redirection of the second email message;
delivery of the second email message to a quarantine;
delivery of the second email message to a spam folder; and
delivery of the second email message to an inbox.
3. The system of claim 1 , wherein:
the update of the database based on information contained in the request for the remotely-hosted content comprises an update of one or more access locations associated with one or more of the plurality of users; and
the update of the database based on the information about activity on a third-party system comprises an update of one or more access locations associated with one or more of the plurality of users.
4. The system of claim 3 , wherein the determined action is based on one or more access locations associated in the database with a sender and/or recipient of the second email message.
5. The system of claim 4 , comprising notification circuitry operable to:
detect that a third-party system account associated with a sender or recipient of the second email message was accessed from a suspicious location; and
take the determined action on the second email address based on the detection that the third-party system account was accessed from a suspicious location.
6. The system of claim 3 , comprising notification generation circuitry operable to generate an alert email message based on one or more access locations associated in the database with a sender and/or recipient of the first email message.
7. The system of claim 6 , wherein the notification circuitry is operable to detect that the first email message was accessed from a suspicious location and generate the alert based on the detection.
8. The system of claim 1 , wherein:
the update of the database based on information contained in the request for the remotely-hosted content comprises an update of one or more relationships associated with one or more of the plurality of users; and
the update of the database based the information about activity on the third-party system comprises an update of one or more relationships associated with one or more of the plurality of users.
9. The system of claim 8 , wherein the determined action is based on one or more relationships associated in the database with a sender of the second email message and/or a recipient of the second email message.
10. The system of claim 9 , wherein the one or more relationships identify one or both of:
people or domains to which the sender and/or recipient of the second email message previously sent an email message; and
people or domains from which the sender and/or recipient of the second email message previously received an email message.
11. The system of claim 9 , wherein the one or more relationships identify one or both of:
people or domains to which the sender and/or recipient of the second email message previously sent a message on the third-party system; and
people or domains from which the sender and/or recipient of the second email message previously received a message on the third-party system.
12. The system of claim 8 , comprising notification generation circuitry operable to generate an alert email message based on one or more relationships associated in the database with a sender and/or a recipient of the second email message.
13. The system of claim 12 , wherein the one or more relationships identify one or both of:
people or domains to which the sender and/or recipient of the second email message previously sent an email message; and
people or domains from which the sender and/or recipient of the second email message previously received an email message.
14. The system of claim 12 , wherein the one or more relationships identify one or both of:
people or domains to which the sender and/or recipient of the second email message previously sent a message on the third-party system; and
people or domains from which the sender and/or recipient of the second email message previously received a message on the third-party system.
15. The system of claim 1 , comprising notification generation circuitry operable to:
detect, based on the information contained in the request for the remotely-hosted content and the information about activity on the third-party system, that an email account associated with one of the plurality of users and a messaging system account associated with the one of the plurality of users are or were accessed from different locations within a determined time period; and
generate an alert message in response to the detection.
16. The system of claim 1 , wherein the third-party system interface circuitry is operable to send a command to the third-party system to restrict access of one of the plurality of users on the third-party system in response to detection of suspicious activity on an email account associated with the one of the plurality of users.
17. The system of claim 1 , wherein the email processing circuitry is operable to restrict access to an email account associated with one of the plurality of users in response to receiving, via the third-party system interface, a notice of suspicious activity on a third-party system account associated with the one of the plurality of users.
18. The system of claim 1 , wherein the third-party system is a non-email messaging system.