Validating inbound messages

• US 20060085505A1
• Filed: 10/14/2004
• Published: 04/20/2006
• Est. Priority Date: 10/14/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bansod, Aditya, Gillum, Eliot C., Wong, Chun Yu, Mironov, IIya
• Granted Patent: US 7,571,319 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for verifying messages. The method may include the steps of receiving an inbound message and characterizing the inbound message by analyzing a latent cryptographic identifier in the inbound message. The identifier is generated by a recognized message system, which may be the receiving system itself, for an outbound message. Characterizing may involve detecting if the latent cryptographic identifier is present and determining if the cryptographic identifier is valid. The step of determining can be performed using symmetric or asymmetric methods of verifying the authenticity of the message.

Claims

1. A method for interpreting messages, comprising:

receiving an inbound message; and

characterizing the inbound message by analyzing a latent cryptographic identifier in the inbound message, the identifier generated by a recognized message system for an outbound message.

2. The method of claim 1 wherein the step of characterizing comprises:

detecting if a latent cryptographic identifier generated by a recognized messaging system is present; and

determining if the cryptographic identifier is valid.

3. The method of claim 1 further including the step of generating an outbound message including said identifier.

4. The method of claim 3 wherein the step of generating comprises inserting said identifier in a Message-ID field of an email message.

5. The method of claim 3 wherein the step of generating includes encrypting message metadata.

6. The method of claim 5 wherein the message metadata is the account name originating the message.

7. The method of claim 5 wherein the message metadata is the domain of account originating the message.

8. The method of claim 5 wherein the message metadata is the time of message transmission.

9. The method of claim 5 wherein the message metadata is the subject field of the message.

10. The method of claim 5 wherein the message metadata is a portion of subject field metadata selected by skipping a number of characters at the beginning of the subject field.

11. The method of claim 5 wherein the message metadata includes the email address of the recipient of the original message

12. The method of claim 1 wherein each said step of characterizing comprises examining a Message-ID header field in an email message.

13. The method of claim 1 wherein said message is a failure report of original message delivery.

14. The method of claim 13 wherein the step of characterizing comprises examining a Message-ID in headers of the original message attached in the failure report.

15. The method of claim 1 wherein said inbound message is a reply to original message.

16. The method of claim 15 wherein the step of characterizing comprises examining a Message-ID found in an In-Reply-To header.

17. The method of claim 15 wherein the step of characterizing comprises examining a Message-ID found in an References header.

18. The method of claim 2 further including the step, prior to said step of determining, of checking at least one optimization component in the identifier to determine whether a more detailed determination of the identifier is required.

19. The method of claim 18 wherein the optimization component is a recipient hint.

20. The method of claim 18 wherein the optimization component is a time hint.

21. The method of claim 1 wherein the step of characterizing comprising comparing a keyed-hash of message metadata against test signatures.

22. The method of claim 1 wherein the step of characterizing comprising verifying a PKI encryption of message metadata.

23. A method for validating an inbound email in a messaging system, comprising:

extracting a cryptographic identifier generated from a known originating system from the inbound email; and

comparing the identifier against a number of known valid MAC values to determine whether the message originated with the known originating system.

24. The method of claim 23 wherein the known originating system is the messaging system.

25. The method of claim 23 wherein said step of comparing generates a positive comparison, and the method further includes the step of processing the message based on said positive comparison.

26. The method of claim 25 wherein said processing comprises bypassing at least a portion of a spam filter.

27. The method of claim 23 wherein said step of comparing generates a negative comparison, and the method further includes the step of processing the message based on said negative comparison.

28. The method of claim 27 wherein the processing comprises displaying a different icon for the message.

29. The method of claim 27 wherein the processing comprises routing mail to a specific folder.

30. The method of claim 27 wherein the processing comprises forwarding mail for analysis by a spam filter.

31. The method of claim 27 wherein the processing comprises storing mail sent with negative comparisons for analysis.

32. The method of claim 27 combining key identification with virus scanning to provide an early warning system for viruses.

33. The method of claim 27 wherein said processing includes treating failure reports not passing the check pejoratively.

34. The method of claim 33 where pejorative treatment amount to hiding the message from the user.

35. A messaging system, including:

an identifier generator providing a cryptographic identifier for a standard field in each message handled by the message transfer agent; and

an identifier characterizer interpreting the content of the standard identification field in inbound messages to the messaging system.

36. The messaging system of claim 35 wherein the identifier generator is incorporated into a mail user agent.

37. The messaging system of claim 35 wherein the identifier generator is incorporated into a messaging transfer agent.

38. The messaging system of claim 35 wherein the identifier characterizer is incorporated into a messaging transfer agent.

39. The messaging system of claim 35 wherein the identifier characterizer is incorporated into a mail user agent.

40. The messaging system of claim 35 further including a spam filter.

41. The messaging system of claim 40 further including the step of comparing an output of the characterizer to message decisions by the spam filter.

42. The messaging system of claim 40 wherein spam filters are run only fraction of the time, and a false-positive rate is extrapolated.

43. The messaging system of claim 40 wherein the messaging system includes a transmission log, and the identification is used as optimization against transmission log check.

44. The messaging system of claim 40 wherein the spam filter is run less often as a result of identification is used an optimization to reduce the load on the system resulting from running the spam filters.

45. The messaging system of claim 35 wherein the system further includes at least a first server and a second server, and the generator and the characterizer are provided on each of said first and second server, and each first and second server includes a different encryption key.

46. The messaging system of claim 35 wherein the system further includes:

a plurality of inbound servers and a plurality of outbound servers, at least one said generator provided on each of said plurality of outbound servers,

at least one said characterizer provided on each of said plurality of inbound servers,

each said generator provides a signature using one of a plurality of unique private keys stored on said outbound server, and

each said verifier validates a signature using a public key stored on each said inbound server.

47. A method for validating email, comprising:

generating an latent cryptographic identifier in each outbound message output by a messaging system; and

upon receipt of any inbound message by the messaging system;

determining whether the latent cryptographic identifier in the inbound message is present;

extracting an encrypted identifier from the cryptographic identifier; and

comparing the encrypted identifier against a number of known valid encrypted identifier to determine whether the inbound message originated with the messaging system.

48. The method of claim 47 wherein the encrypted identifier is a message authentication code.

49. The method of claim 47 wherein the cryptographic identifier includes at least one optimizer component.

50. The method of claim 49 wherein the method further includes the step, prior to the step of extracting, of checking the optimizer component to determine whether to perform said extracting and comparing steps.