SYSTEM FOR DETECTING AUTHENTIC E-MAIL MESSAGES

• US 20050076221A1
• Filed: 09/21/2004
• Published: 04/07/2005
• Est. Priority Date: 09/22/2003
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Secure Data In Motion, Inc. (Proofpoint Incorporated)
• Inventors: Olkin, Terry M., Moreh, Jahanshah, Olkin, Jeffrey C.
• Granted Patent: US 7,457,958 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

A system (50, 150) for assisting a user (14) to determine whether an email (18) comes from a purported originator (16). A computerized system having a display unit is provided. Logic (54) in the computerized system determines whether the email (18) includes an authenticity mark (52) including an originator identifier (102) and encrypted data (104). Logic (54) in the computerized system then decrypts the encrypted data (104) into decrypted data (108-14), based on the originator identifier (102). Logic (54) in the computerized system then presents to the user (14), on the display, whether the email (18) includes the authenticity mark (52), whether the encrypted data (104) decrypts successfully, and information based on the authenticity mark (52) and the decrypted data (108-14).

Claims

1. A computer program, embodied on a computer readable storage medium, for assisting a user to determine whether an email comes from a purported originator, the computer program comprising:

a code segment that determines with a computerized system whether the email includes an authenticity mark including an originator identifier and encrypted data;

a code segment that decrypts said encrypted data based on said originator identifier, into decrypted data;

a code segment that presents to the user on a display unit;

whether the email includes said authenticity mark;

whether said encrypted data decrypts successfully; and

information based on said authenticity mark and said decrypted data.

2. The computer program of claim 1, wherein the computer program is digitally signed.

3. The computer program of claim 1, wherein said code segment that determines runs as a service in said computerized system.

4. The computer program of claim 1, wherein said code segment that determines includes a hypertext transport protocol (HTTP) server.

5. The computer program of claim 1, wherein said code segment that determines listens at a port in said computerized system for a request for hypertext markup language (HTML) content and extracts said authenticity mark from a uniform resource locator (URL) link requesting said HTML content.

6. The computer program of claim 1, wherein said code segment that presents further presents information to the user based on said originator identifier.

7. The computer program of claim 6, further comprising a code segment that matches said originator identifier to one of a plurality of registered originators maintained in a storage unit, to retrieve a decryption key associated with said originator identifier for use by said code segment that decrypts.

8. The computer program of claim 1, wherein:

said code segment that determines compares a checksum from said authenticity mark against contents of the email; and

said code segment that presents further presents to the user information based on said checksum.

9. The computer program of claim 1, wherein said code segment that decrypts employs a public key of said purported originator.

10. The computer program of claim 1, wherein:

said code segment that decrypts extracts at least one of a timestamp, a topic, and a user identifier from said encrypted data; and

said code segment that presents further presents to the user information based on at least one of said timestamp, said topic, and said user identifier.

11. The computer program of claim 10, further comprising a code segment that compares said timestamp to preset timeliness criteria;

and wherein said code segment that presents emphasizes said information based on said timestamp when said timeliness criteria are deviated from.

12. The computer program of claim 1, wherein said code segment that presents employs a dialog box that only software running locally in said computerized system can provide, thereby avoiding confusion with a remotely generated browser window.

13. A system for assisting a user to determine whether an email comes from a purported originator, the system comprising:

a computerized system having a display unit;

a logic in said computerized system that determines whether the email includes an authenticity mark including an originator identifier and encrypted data;

a logic in said computerized system that decrypts said encrypted data based on said originator identifier, into decrypted data;

a logic in said computerized system that that presents to the user, on said display;

whether the email includes said authenticity mark;

whether said encrypted data decrypts successfully; and

information based on said authenticity mark and said decrypted data.

14. The system of claim 13, wherein said logic in said computerized system that determines runs as a service.

15. The system of claim 13, wherein logic in said computerized system that determines includes a hypertext transport protocol (HTTP) server.

16. The system of claim 13, wherein said logic in said computerized system that determines listens at a port for a request for hypertext markup language (HTML) content and extracts said authenticity mark from a uniform resource locator (URL) link requesting said HTML content.

17. The system of claim 13, wherein said logic in said computerized system that that presents to the user further presents information based on said originator identifier.

18. The system of claim 17, further comprising a logic in said computerized system that matches said originator identifier to one of a plurality of registered originators maintained in a storage unit, to retrieve a decryption key associated with said originator identifier for use by said logic in said computerized system that decrypts.

19. The system of claim 13, wherein:

said logic in said computerized system that determines compares a checksum from said authenticity mark against contents of the email; and

said logic in said computerized system that that presents to the user further presents information based on said checksum.

20. The system of claim 13, wherein said logic in said computerized system that decrypts employs a public key of said purported originator.

21. The system of claim 13, wherein:

said logic in said computerized system that decrypts extracts at least one of a timestamp, a topic, and a user identifier from said encrypted data; and

said logic in said computerized system that that presents to the user further presents information based on at least one of said timestamp, said topic, and said user identifier.

22. The system of claim 13, further comprising a logic in said computerized system that compares said timestamp to preset timeliness criteria;

and wherein said logic in said computerized system that that presents to the user emphasizes said information based on said timestamp when said timeliness criteria are deviated from.

23. The system of claim 13, wherein said logic in said computerized system that that presents to the user employs a dialog box that only software running locally in said computerized system can provide, thereby avoiding confusion with a remotely generated browser window.

24. A method for assisting a user to determine whether an email comes from a purported originator, the method comprising:

determining whether the email includes an authenticity mark including an originator identifier and encrypted data;

decrypting said encrypted data based on said originator identifier, into decrypted data;

presenting to the user;

whether the email includes said authenticity mark;

whether said encrypted data decrypts successfully; and

information based on said authenticity mark and said decrypted data.

25. The method of claim 24, wherein said determining includes running a service in a computerized system.

26. The method of claim 24, wherein said determining includes running a hypertext transport protocol (HTTP) server.

27. The method of claim 24, wherein said determining includes listening at a port in a computerized system for a request for hypertext markup language (HTML) content and extracting said authenticity mark from a uniform resource locator (URL) link requesting said HTML content.

28. The method of claim 24, wherein:

said determining further includes extracting an originator identifier from said authenticity mark; and

said presenting further includes presenting information to the user based on said originator identifier.

29. The method of claim 28, further comprising matching said originator identifier to one of a plurality of registered originators and retrieving a decryption key associated with said originator identifier for use in said decrypting.

30. The method of claim 24, wherein:

said determining includes comparing a checksum from said authenticity mark against contents of the email; and

said presenting includes presenting information based on said checksum.

31. The method of claim 24, wherein said decrypting employs a public key of said purported originator.

32. The method of claim 24, wherein:

said decrypting extracts at least one of a timestamp, a topic, and a user identifier from said encrypted data; and

said presenting includes presenting information based on at least one of said timestamp, said topic, and said user identifier.

33. The method of claim 32, further comprising comparing said timestamp to preset timeliness criteria;

and wherein said presenting emphasizes said information based on said timestamp when said timeliness criteria are deviated from.

34. The method of claim 24, wherein said presenting employs a dialog box that only software running locally in a computerized system can provide, thereby avoiding confusion with a remotely generated browser window.