Systems and methods for authorizing delivery of incoming messages

• US 20050125667A1
• Filed: 12/29/2003
• Published: 06/09/2005
• Est. Priority Date: 12/09/2003
• Status: Abandoned Application

• Current Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Original Assignee: America Online Inc. (Warner Bros. Discovery, Inc.)
• Inventors: Sullivan, Tim, Logue, Jay
• Application Number:
  US10/747,557
• Publication Number:
  US 20050125667A1
• Time in Patent Office: Days
• US Class Current: 713/170
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Delivery tickets that include data and a checksum are used to authenticate incoming electronic messages on behalf of a user. The delivery ticket is located in a field in the envelope portion or in a header in the content portion of outgoing electronic messages. A bounce message or a reply message generated by a remote computer in response to the outgoing electronic message includes the delivery ticket. When the bounce message or the reply message is received by an authentication server associated with the user, the delivery ticket is authenticated to determine whether to deliver the incoming message to the user. The delivery ticket is initially validated if a checksum regenerated by applying a private key to the data of the delivery ticket is the same as the checksum included in the delivery ticket. The validation process also includes determining whether the delivery ticket complies with rules that specify the duration of time of the validity or the number of times that the delivery ticket can be used.

Claims

1. In an authentication server included in an electronic messaging system, wherein a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming message comprising:

receiving an incoming message;

analyzing the incoming message to identify whether the incoming message contains a delivery ticket that includes data and a checksum; and

if the incoming message includes a delivery ticket, determining whether the delivery ticket is valid to authenticate the incoming message.

2. The method as recited in claim 1, further comprising delivering the incoming message to the user'"'"'s inbox if it is determined that the delivery ticket is valid.

3. The method as recited in claim 1, further comprising referencing a database to determine the use of the delivery ticket.

4. The method as recited in claim 3, wherein the use of the delivery ticket is defined as at least one of single-based, multiple-based, and time-based usage.

5. The method as recited in claim 4, further comprising delivering the incoming message to the user'"'"'s inbox if the delivery ticket complies with the defined use.

6. The method as recited in claim 1, further comprising sending the incoming message to a pending file if it is determined that the delivery ticket is not valid.

7. The method as recited in claim 1, wherein determining whether the delivery ticket is valid comprises regenerating the checksum to determine whether the regenerated checksum is the same as the checksum included in the delivery ticket.

8. In an authentication server in an electronic messaging system, wherein a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming message comprising:

inserting a first delivery ticket into an outgoing message;

receiving an incoming message;

analyzing the incoming message to identify whether the incoming message contains a second delivery ticket;

if the incoming message includes a second delivery ticket, determining whether the second delivery ticket is valid to authenticate the incoming message; and

if the second delivery ticket is valid, delivering the incoming message to the user'"'"'s inbox.

9. The method as recited in claim 8, wherein the delivery ticket comprises a checksum.

10. The method as recited in claim 8, wherein inserting the delivery ticket into the outgoing message comprises inserting the delivery ticket into the envelope portion of the outgoing message.

11. The method as recited in claim 8, wherein inserting the delivery ticket into the outgoing message comprises inserting the delivery ticket into the content portion of the outgoing message.

12. The method as recited in claim 8, further comprising referencing a database to determine the use of the delivery ticket.

13. The method as recited in claim 12, wherein the use of the delivery ticket is defined as at least one of single-based, multiple-based, and time-based usage.

14. The method as recited in claim 13, further comprising delivering the incoming message to the user'"'"'s inbox if the delivery ticket complies with the defined use.

15. The method as recited in claim 8, wherein:

the outgoing message is intended for a particular recipient account;

the incoming message is generated from an account that is different from the recipient account; and

the first delivery ticket is the same as the second delivery ticket.

16. The method as recited in claim 15, wherein the account that is different from the recipient account is located on a server that is in communication with the recipient account.

17. The method as recited in claim 15, wherein account that is different from the recipient account is a server to which the outgoing message was forwarded.

18. The method as recited in claim 8, wherein the outgoing message is intended for a particular recipient account and the incoming message is a challenge message generated by a challenge/response system associated with the recipient account.

19. In an electronic messaging system, in which a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming bounce message comprising:

receiving an incoming bounce message that has been generated by a remote server in response to the remote server receiving an electronic message that has been sent by a user and is addressed to a recipient account that is unavailable;

determining whether the incoming bounce message contains a delivery ticket, wherein, if the incoming bounce message contains the delivery ticket, the delivery ticket includes data and a checksum;

if the incoming bounce message includes the delivery ticket, determining whether the delivery ticket is valid by regenerating the checksum, including;

applying a private key value to data; and

determining whether the regenerated checksum is the same as the checksum included in the delivery ticket; and

if it is determined that the delivery ticket is valid, delivering the incoming bounce message to the user'"'"'s inbox.

20. The method as recited in claim 19, wherein the delivery ticket is contained by the incoming bounce message and has been placed in the incoming bounce message by the remote server when the remote server generated the incoming bounce message.

21. The method as recited in claim 20, further comprising, prior to receiving the incoming bounce message, sending the electronic message that is addressed to the recipient account, the electronic message containing the delivery ticket.

22. The method as recited in claim 21, wherein the delivery ticket is included in a field in an envelope of the electronic message.

23. The method as recited in claim 19, further comprising, if it is determined that the incoming bounce message does not include the delivery ticket, not delivering the incoming bounce message to the user'"'"'s inbox.

24. The method as recited in claim 19, further comprising, if it is determined that the delivery ticket is not valid, not delivering the incoming message to the user'"'"'s inbox.

25. The method as recited in claim 19, wherein determining if the delivery ticket is valid comprises:

identifying a usage rule associated with the delivery ticket; and

determining whether the delivery ticket complies with the usage rule.

26. The method as recited in claim 25, wherein the usage rule associated with the delivery ticket is at least one of a single-use rule, a multiple-use rule, and a time-based rule.

27. In an electronic messaging system, in which a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming message comprising:

receiving an incoming reply message that has been generated by a remote computer in response to an electronic message that has been sent by a user;

determining whether the incoming reply message contains a delivery ticket, wherein, if the incoming reply message contains the delivery ticket, the delivery ticket includes data and a checksum;

if the incoming reply message includes the delivery ticket, determining whether the delivery ticket is valid by regenerating the checksum, including;

applying a private key value to data; and

determining whether the regenerated checksum is the same as the checksum included in the delivery ticket; and

if it is determined that the delivery ticket is valid, delivering the incoming reply message to the user'"'"'s inbox.

28. The method as recited in claim 27, wherein the delivery ticket is contained by the incoming reply message and has been placed in the incoming reply message by the remote computer when the remote computer generated the incoming bounce message.

29. The method as recited in claim 28, further comprising, prior to receiving the incoming reply message, sending the electronic message from a computer associated with the user, the electronic message containing the delivery ticket.

30. The method as recited in claim 29, wherein the delivery ticket is included in a header of the message portion of the electronic message.

31. The method as recited in claim 29, wherein the electronic message, when sent by the computer associated with the user, is addressed to a recipient account that is different from an account that was used to generate the incoming reply message.

32. The method as recited in claim 27, further comprising, if it is determined that the incoming reply message does not include the delivery ticket, not delivering the incoming reply message to the user'"'"'s inbox.

33. The method as recited in claim 27, further comprising, if it is determined that the delivery ticket is not valid, not delivering the incoming message to the user'"'"'s inbox.

34. The method as recited in claim 27, wherein determining if the delivery ticket is valid comprises:

identifying a usage rule associated with the delivery ticket; and

determining whether the delivery ticket complies with the usage rule.

35. The method as recited in claim 34, wherein the usage rule associated with the delivery ticket is at least one of a single-use rule, a multiple-use rule, and a time-based rule.

36. In an authentication server included in an electronic messaging system, wherein a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming message comprising:

generating an outgoing message containing a first delivery ticket, the first delivery ticket being valid for a specified period of time;

receiving an incoming message that purports to be a reply message based on the outgoing message;

determining whether the incoming message contains a second delivery ticket; and

determining whether receipt of the second delivery ticket was within the specified period of time.

37. The method as recited in claim 36, further comprising, after determining that receipt of the second delivery ticket is within the specified period of time, authenticating the second delivery ticket to determine whether the second delivery ticket is the same as the first delivery ticket and that the intended recipient of the incoming message was the sender of the outgoing message containing the first delivery ticket.

38. The method as recited in claim 37, further comprising, after determining that the second delivery ticket is the same as the first delivery ticket, delivering the incoming message to the user'"'"'s inbox.

39. The method as recited in claim 37, further comprising, after determining that the second delivery ticket is the same as the first delivery ticket, referencing a database to determine whether receipt of the second delivery ticket complies with the defined usage of the first delivery ticket.

40. The method as recited in claim 39, further comprising, after determining that the receipt of the second delivery ticket complies with the defined usage of the first delivery ticket, delivering the incoming message to the user'"'"'s inbox.

41. In an authentication server included in an electronic messaging system, wherein a user sends an outgoing message and receives incoming messages, a method of authenticating an incoming message comprising:

generating an outgoing message containing a first delivery ticket without storing the first delivery ticket;

receiving an incoming message that purports to be a reply message based on the outgoing message;

determining if the incoming message contains a second delivery ticket, the second delivery ticket including a usage indicator;

referencing a database to determine whether the second delivery ticket has been previously stored; and

upon determining that the second delivery ticket has not been previously stored, storing in the database the second delivery ticket along with the usage identified by the usage indicator.

42. The method as recited in claim 41, further comprising authenticating the second delivery ticket to determine whether the second delivery ticket is the same as the first delivery ticket.

43. The method as recited in claim 42, further comprising, after determining that the second delivery ticket is the same as the first delivery ticket, delivering the incoming message to the user'"'"'s inbox.

44. The method as recited in claim 41, further comprising

identifying a specified period of time where the second delivery ticket is valid based on the usage indicator;

and

deleting the second delivery ticket from the database when the specified period of time has expired.

45. An electronic message having a data structure generated by an authentication server, the electronic message comprising:

an envelope portion identifying the sender and the recipient, the envelope portion including a delivery ticket embedded in a field identifying the sender;

the delivery ticket configured to be passed on to a reply message purporting to be based from the electronic message and used to authenticate the reply message without requiring any other filtering mechanism; and

a content portion containing data to be delivered to the recipient.

46. The electronic message as recited in claim 45, wherein the delivery ticket comprises a checksum.

47. The electronic message as recited in claim 46, wherein the checksum is derived using a private salt.

48. The electronic message as recited in claim 45, wherein the delivery ticket comprises a cryptographic portion.

49. The electronic message as recited in claim 45, wherein the delivery ticket comprises a digital signal portion.

50. An electronic message having a data structure generated by an authentication server, the electronic message comprising:

an envelope portion identifying the sender and the recipient; and

a content portion containing data to be delivered to the recipient, content portion comprising a message header portion, the message header portion including a delivery ticket embedded in a field uniquely identifying the message;

the delivery ticket configured to be passed on to a reply message purporting to be based from the electronic message and used to authenticate the reply message without requiring any other filtering mechanism.

51. The electronic message as recited in claim 50, wherein the field uniquely identifying the message comprises a MESSAGE-ID field.

52. The electronic message as recited in claim 50, wherein the delivery ticket comprises a checksum.

53. The electronic message as recited in claim 52, wherein the checksum is derived using a private salt.

54. The electronic message as recited in claim 50, wherein the delivery ticket comprises a cryptographic portion.

55. The electronic message as recited in claim 50, wherein the delivery ticket comprises a digital signal portion.

56. In an authentication server in an electronic messaging system, a method of processing incoming messages directed to a user comprising:

receiving an incoming message purporting to be generated in response to an outgoing message sent by the user, the incoming message containing a delivery ticket;

using the delivery ticket to determine whether the incoming message is a response to an outgoing message sent by the user; and

based on the determination, delivering, or not delivering, the incoming message to the user'"'"'s inbox.

57. The method as recited in claim 56, wherein using the delivery ticket to determine whether the incoming message is a response to an outgoing message sent by the user further comprises determining whether the delivery ticket was originally inserted in an outgoing message sent by the user.

58. The method as recited in claim 56, wherein using the delivery ticket to determine whether the incoming message is a response to an outgoing message sent by the user further comprises cryptographically authenticating the delivery ticket.

59. The method as recited in claim 56, wherein using the delivery ticket to determine whether the incoming message is a response to an outgoing message sent by the user further comprises matching the delivery ticket against a log of previously received delivery tickets.