E-mail message authentication extending standards complaint techniques

• US 10,277,397 B2
• Filed: 12/21/2015
• Issued: 04/30/2019
• Est. Priority Date: 05/09/2008
• Status: Active Grant

• Current Assignee: Iconix Incorporated (Matthews Group LLC)
• Original Assignee: Iconix Incorporated (Matthews Group LLC)
• Inventors: Sachtjen, Scott A., Hociota, Vlad Adrian, Lazar, Razvan Vlad, Tir, Serban Adrian
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Celani, Nicholas P
• Application Number:
  US14/977,505
• Publication Number:
  US 20180192288A1
• Time in Patent Office: 1,226 Days
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A system and method for e-mail authentication. The method includes aggregating a plurality of headers associated with an e-mail message and transmitting the aggregated plurality of headers to a validation service. A validation response is then received from the validation service. The e-mail is authenticated based on the validation response.

Claims

1. A computer-implemented method for processing an email message received from over a wide area network (“

WAN”

), the method comprising;

receiving header information for the email message and storing the header information in processor-accessible storage, wherein the stored header information includes plural headers comprising at least a “

FROM;

”

header;

using at least one processor to

extract one or more sending domains from the header information,

transmit a request via the WAN to identify whether at least one domain from the one or more sending domains corresponds to a predetermined domain,

dependent on a response received via the WAN which identifies at least one domain corresponding to the predetermined domain, access via the WAN at least one sender policy framework (SPF) record published in association with the at least one domain which corresponds to the predetermined domain,

authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the “

FROM;

”

header and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

FROM;

”

header, and

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a purported responsible address (PRA) identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA; and

causing a processor-based system to deliver the email message to an addressed recipient following authentication;

wherein

the response identifies a first domain which corresponds the predetermined domain, and

the computer-implemented method further comprises transmitting a result over the WAN to a third party destination address, the result identifying both of the first domain and each sending domain extracted from the header information.

2. The computer-implemented method of claim 1, wherein using the at least one processor further comprises:

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, and if there is no SPF record corresponding to the sending domain represented by the PRA, authenticating the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a “

MAIL-FROM”

header identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

MAIL-FROM”

header.

3. The computer-implemented method of claim 1, wherein:

delivering the email message to the addressed recipient following authentication further comprises causing a system of the addressed recipient to display a confidence mark in association with the email message.

4. The computer-implemented method of claim 3, wherein:

the confidence mark indicates that the email message has been successfully authenticated.

5. The computer-implemented method of claim 3, wherein:

the confidence mark is specific to a domain identified by the response.

6. The computer-implemented method of claim 1, wherein:

the method further comprises delivering the email message to the addressed recipient if authentication is unsuccessful, and causing a system of the addressed recipient to display a mark in association with the email message which indicates that the email message failed authentication.

7. The computer-implemented method of claim 1, wherein:

the method further comprises if there is an SPF record corresponding to the sending domain represented by the “

FROM;

”

header, but if the email message was not received from the address determined according to the SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticating the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the PRA identified by the email message and if the email message was received from the address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA.

8. An apparatus comprising instructions stored on non-transitory machine-readable media, the instructions when executed to cause at least one processor to:

receive header information for the email message and store the header information in processor-accessible storage, wherein the stored header information includes plural headers comprising at least a “

FROM;

”

header;

extract one or more sending domains from the header information;

transmit a request via the WAN to identify whether at least one domain from the one or more sending domains corresponds to a predetermined domain;

dependent on a response received via the WAN which identifies at least one domain corresponding to the predetermined domain, access via the WAN at least one sender policy framework (SPF) record published in association with the at least one domain which corresponds to the predetermined domain;

authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the “

FROM;

”

header and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

FROM;

”

header;

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a purported responsible address (PRA) identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA; and

cause delivery of the email message to an addressed recipient following authentication.

9. The apparatus of claim 8, wherein:

the response identifies a first domain which corresponds the predetermined domain; and

the instructions when executed are further to cause the at least one processor to transmit a result over the WAN to a third party destination address, wherein the result identifies the identified sending domain and at least one sender address identified by the header information.

10. The apparatus of claim 8, wherein the instructions when executed are further to cause the at least one processor to:

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, and if there is no SPF record corresponding to the sending domain represented by the PRA, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a “

MAIL-FROM”

header identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

MAIL-FROM”

header.

11. The apparatus of claim 8, wherein the instructions when executed are further to cause the at least one processor to:

transmit instructions to a system of the addressed recipient to display a confidence mark in association with the email message, wherein further the confidence mark indicates that the email message has been successfully authenticated.

12. The apparatus of claim 8, wherein the instructions when executed are further to cause the at least one processor to:

transmit instructions to a system of the addressed recipient to display a confidence mark in association with the email message, wherein further the confidence mark is specific to a domain identified by the response.

13. The apparatus of claim 8, wherein the instructions when executed are further to cause the at least one processor to:

deliver the email message to the addressed recipient if authentication is unsuccessful; and

transmit instructions to a system of the addressed recipient to display a confidence mark in association with the email message which indicates that the email message failed authentication.

14. The apparatus of claim 8, wherein the instructions when executed are further to cause the at least one processor to:

if there is an SPF record corresponding to the sending domain represented by the “

FROM;

”

header, but if the email message was not received from the address determined according to the SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the PRA identified by the email message and if the email message was received from the address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA.

15. A network device, comprising processor-accessible storage, instructions stored on non-transitory machine-readable media, at least one processor, and circuitry to establish a wide area network (“

WAN”

) connection, wherein;

the instructions when executed are to cause the at least one processor to

receive header information for the email message and store the header information in the processor-accessible storage, wherein the stored header information includes plural headers comprising at least a “

FROM;

”

header,

extract one or more sending domains from the header information,

transmit a request via the WAN connection to identify whether at least one domain from the one or more sending domains corresponds to a predetermined domain,

dependent on a response received via the WAN connection which identifies at least one domain corresponding to the predetermined domain, access via the WAN connection at least one sender policy framework (SPF) record published in association with the at least one domain which corresponds to the predetermined domain,

authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the “

FROM;

”

header and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

FROM;

”

header, and

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a purported responsible address (PRA) identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA; and

the network device is to cause delivery of the email message to an addressed recipient following authentication.

16. The network device of claim 15, wherein:

the response identifies a first domain which corresponds the predetermined domain; and

the instructions when executed are further to cause the at least one processor to transmit a result over the WAN connection to a third party destination address, the result identifying the both of the first domain and each sending domain extracted from the header information.

17. The network device of claim 15, wherein the instructions when executed are further to cause the at least one processor to:

if there is no SPF record corresponding to the sending domain represented by the “

FROM;

”

header, and if there is no SPF record corresponding to the sending domain represented by the PRA, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by a “

MAIL-FROM”

header identified by the email message and if the email message was received from an address determined according to the SPF record for email purporting to be from the sending domain represented by the “

MAIL-FROM”

header.

18. The network device of claim 15, wherein:

the instructions when executed are further to cause the at least one processor to transmit to a system of the addressed recipient instructions to display a confidence mark in association with the email message; and

the confidence mark indicates that the email message has been successfully authenticated.

19. The network device of claim 15, wherein the instructions when executed are further to cause the at least one processor to:

if there is an SPF record corresponding to the sending domain represented by the “

FROM;

”

header, but if the email message was not received from the address determined according to the SPF record corresponding to the sending domain represented by the “

FROM;

”

header, authenticate the email message if the accessed at least one SPF record includes an SPF record corresponding to a sending domain represented by the PRA identified by the email message and if the email message was received from the address determined according to the SPF record for email purporting to be from the sending domain represented by the PRA.