Method and apparatus for authenticating electronic mail

• US 20040068542A1
• Filed: 10/07/2002
• Published: 04/08/2004
• Est. Priority Date: 10/07/2002
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Abbott, Marty, Sanford, Kirk, Lalonde, Chris, Isaacs, Greg
• Granted Patent: US 7,072,944 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/4555 Directories for electronic mail or instant messaging
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method and apparatus for authenticating an electronic message are provided. The method includes investigating data in a header of the electronic message, and generating an authenticity indicator in response to the investigation. The authenticity indicator may provide an indication of the likelihood that the electronic message was sent from a purported sender visible to a recipient of the electronic message. In certain embodiments, the method includes presenting the authenticity indicator to the recipient of the electronic message. Investigating data in the header may include parsing the header to obtain purported sender data in a from field populated at a mail client and to obtain actual originator data, comparing the purported sender data and actual originator data, and generating the authenticity indicator in response to the comparison. The from field may be the “FROM: . . . ” field of an email message provided to identify a sender of the email message.

Claims

1. A method of authenticating electronic mail, the method including:

investigating data in a header of the electronic mail; and

generating an authenticity indicator in response to the investigation.

2. The method of claim 1, wherein the authenticity indicator provides an indication of the likelihood that the electronic mail was sent from a purported sender shown in the electronic mail, the method including presenting the authenticity indicator to the recipient of the electronic mail.

3. The method of claim 1, in which investigating data in the header includes:

parsing the header to obtain purported sender data in a “

from”

field populated at a mail client and to obtain actual originator data;

comparing the purported sender data and actual originator data; and

generating the authenticity indicator in response to the comparison.

4. The method of claim 3, wherein the from field is the “

FROM;

. . . ”

field of an email provided to identify a sender of the email.

5. The method of claim 3, wherein the actual originator data is that data provided in a received field included at a server receiving the electronic mail from the mail client.

6. The method of claim 1, in which investigating data in the header includes:

parsing the header to obtain a purported IP Address of an originator of the electronic mail and to obtain an actual domain name of an actual sender of the electronic mail;

interrogating a Domain Name Server (DNS) with the actual domain name to obtain an associated IP address of the actual domain name;

comparing the associated IP address with the purported IP address; and

generating the authenticity indicator in response to the comparison.

7. The method of claim 1, in which investigating data in the header includes:

parsing the header to obtain a header IP Address of the originator of the electronic mail and to obtain a purported domain name of a purported sender of the electronic mail;

interrogating a business entity database with the purported domain name to obtain an associated IP address associated with the purported domain name;

comparing the header IP address and the associated IP address; and

generating the authenticity indicator in response to the comparison.

8. The method of claim 7, wherein the business entity database is a “

WHOIS”

database.

9. The method of claim 1, which is executed in conjunction with virus protection software.

10. The method of claim 1, wherein the header of the electronic mail includes a visible mail header which is visible to the recipient when opening the electronic mail, and a transmission data mail header including received data included by at least one server via which the electronic mail is communicated, the method including investigating data in both the visible and transmission data mail headers.

11. The method of claim 1, in which investigating data in the header includes:

parsing the header to obtain domain name data of each server via which the electronic mail has been communicated;

comparing the domain name data of each server with reference domain name data; and

generating the authenticity indicator in response to the comparison.

12. The method of claim 11, wherein the reference domain name data includes domain names associated with spoofed electronic mail, the method including updating the reference domain name data in an automated fashion.

13. The method of claim 12, wherein the reference domain name data is stored on a client machine, the method including:

connecting the client machine to a remote database of reference domain name data;

downloading updated reference domain name data; and

storing the reference domain name data on the client machine.

14. The method of claim 11, which includes downloading the reference domain name data via the Internet.

15. The method of claim 11, wherein the reference domain data is integrated in a mail client application.

16. The method of claim 11, which includes parsing a received field included in the header by each server via which the electronic mail has been communicated.

17. A machine-readable medium embodying a sequence of instructions that, when executed by a machine, cause the machine execute a method of authenticating electronic mail, the method including:

investigating data in a header of the electronic mail; and

generating an authenticity indicator in response to the investigation.

18. The machine-readable medium of claim 17, wherein the authenticity indicator provides an indication of the likelihood that the electronic mail was sent from a purported sender shown in the electronic mail, the method including presenting the authenticity indicator to the recipient of the electronic mail.

19. The machine-readable medium of claim 17, wherein investigating data in the header includes:

parsing the header to obtain purported sender data in a “

from”

field populated at a mail client and to obtain actual originator data;

comparing the purported sender data and actual originator data; and

generating the authenticity indicator in response to the comparison.

20. The machine-readable medium of claim 19, wherein the from field is the “

FROM;

. . . ”

field of an email provided to identify a sender of the email.

21. The machine-readable medium of claim 19, wherein the actual originator data is that data provided in a received field included at a server receiving the electronic mail from the mail client.

22. The machine-readable medium of claim 17, wherein investigating data in the header includes:

parsing the header to obtain a purported IP Address of an originator of the electronic mail and to obtain an actual domain name of an actual sender of the electronic mail;

interrogating a Domain Name Server (DNS) with the actual domain name to obtain an associated IP address of the actual domain name;

comparing the associated IP address with the purported IP address; and

generating the authenticity indicator in response to the comparison.

23. The machine-readable medium of claim 17, wherein investigating data in the header includes:

parsing the header to obtain a header IP Address of the originator of the electronic mail and to obtain a purported domain name of a purported sender of the electronic mail;

interrogating a business entity database with the purported domain name to obtain an associated IP address associated with the purported domain name;

comparing the header IP address and the associated IP address; and

generating the authenticity indicator in response to the comparison.

24. The machine-readable medium of claim 23, wherein the business entity database is a “

WHOIS”

database.

25. The machine-readable medium of claim 17, wherein the instructions are executed in conjunction with virus protection software.

26. The machine-readable medium of claim 17, wherein the header of the electronic mail includes a visible mail header which is visible to the recipient when opening the electronic mail, and a transmission data mail header including received data included by at least one server via which the electronic mail is communicated, the method including investigating data in both the visible and transmission data mail headers.

27. The machine-readable medium of claim 17, wherein investigating data in the header includes:

parsing the header to obtain domain name data of each server via which the electronic mail has been communicated;

comparing the domain name data of each server with reference domain name data; and

generating the authenticity indicator in response to the comparison.

28. The machine-readable medium of claim 27, wherein the reference domain name data includes domain names associated with spoofed electronic mail, the method including updating the reference domain name data in an automated fashion.

29. The machine-readable medium of claim 28, wherein the reference domain name data is stored on a client machine, the method including:

connecting the client machine to a remote database of reference domain name data;

downloading updated reference domain name data; and

storing the reference domain name data on the client machine.

30. The machine-readable medium of claim 27, in which the method includes downloading the reference domain name data via the Internet.

31. The machine-readable medium of claim 27, wherein the reference domain data is integrated in a mail client application.

32. The machine-readable medium of claim 27, in which the method includes parsing a received field included in the header by each server via which the electronic mail has been communicated.

33. A mail server for authenticating electronic mail communicated between the mail server and at least one client device, the mail server including:

a communication interface for communicating with the at least one client device;

a processor; and

memory which includes a set of instructions which, when executed by the processor, cause the processor to;

investigate data in a header of the electronic mail; and

generate an authenticity indicator in response to the investigation.

34. The mail server of claim 33, wherein the authenticity indicator is presented to a recipient of the email to provide an indication of the likelihood that the electronic mail was sent from a purported sender shown in the electronic mail.

35. The mail server of claim 33, in which the processor:

parses the header to obtain purported sender data in a “

from”

field populated at a mail client and to obtain actual originator data;

compares the purported sender data and actual originator data; and

generates the authenticity indicator in response to the comparison.

36. The mail server of claim 35, wherein the from field is the “

FROM;

. . . ”

field of an email provided to identify a sender of the email.

37. The mail server of claim 35, wherein the actual originator data is that data provided in a received field included at a server receiving the electronic mail from the mail client.

38. The mail server of claim 33, in which the processor:

parses the header to obtain a purported IP Address of an originator of the electronic mail and to obtain an actual domain name of an actual sender of the electronic mail;

interrogates a Domain Name Server (DNS) with the actual domain name to obtain an associated IP address of the actual domain name;

compares the associated IP address with the purported IP address; and

generates the authenticity indicator in response to the comparison.

39. The mail server of claim 33, in which the processor:

parses the header to obtain a header IP Address of the originator of the electronic mail and to obtain a purported domain name of a purported sender of the electronic mail;

interrogates a business entity database with the purported domain name to obtain an associated IP address associated with the purported domain name;

compares the header IP address and the associated IP address; and

generates the authenticity indicator in response to the comparison.

40. The mail server of claim 39, wherein the business entity database is a “

WHOIS”

database.

41. The mail server of claim 33, in which the processor:

parses the header to obtain domain name data of each server via which the electronic mail has been communicated;

compares the domain name data of each server with reference domain name data; and

generates the authenticity indicator in response to the comparison.

42. The mail server of claim 41, wherein the reference domain name data includes domain names associated with spoofed electronic mail and the reference domain name data is updated in an automated fashion.

43. The mail server of claim 42, wherein the reference domain name data is stored on a client machine and the processor:

connects the client machine to a remote database of reference domain name data;

downloads updated reference domain name data; and

stores the reference domain name data on the client machine.

44. A mail server for authenticating electronic mail communicated between the mail server and at least one client device, the mail server including:

means communication interface for communicating with the at least one client device;

processor means; and

means to store a set of instructions which, when executed by the processor, cause the processor means to;

investigate data in a header of the electronic mail; and

generate an authenticity indicator in response to the investigation.