AUTHENTICATING ELECTRONIC COMMUNICATIONS

• US 20060206572A1
• Filed: 05/31/2006
• Published: 09/14/2006
• Est. Priority Date: 10/07/2002
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Abbott, Marty, Sanford, Kirk, Lalonde, Chris, Isaacs, Greg
• Granted Patent: US 7,320,021 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 61/4555 Directories for electronic mail or instant messaging
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method includes generating an authenticity indicator for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the authenticity indicator indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication. The authenticity indicator is presented to the recipient of the electronic communication.

Claims

1. A method including:

generating an authenticity indicator for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the authenticity indicator indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication; and

presenting the authenticity indicator to the recipient of the electronic communication.

2. The method of claim 1, including parsing a header of the electronic communication to identify the domain name data as included in the header by a server that received the electronic communication from a communication client.

3. The method of claim 1, including parsing a header of the electronic communication to identify the purported sender data included in the header of the electronic communication.

4. The method of claim 1, wherein the parsing of the header to obtain the purported sender data includes:

parsing the header to obtain purported sender domain name data in a “

FROM;

..”

field populated at a communication client, the purported sender domain name data being visible to a recipient of the electronic communication.

5. The method of claim 1, wherein the parsing of the header to obtain purported sender data includes:

parsing the header to obtain a purported IP address of an originator of the electronic communication;

interrogating a Domain Name Server (DNS) with the domain name data to obtain an associated IP address of a domain name;

comparing the associated IP address with the purported IP address; and

generating the authenticity indicator in response to the comparison.

6. The method of claim 1, wherein the header of the electronic communication includes a visible mail header which is visible to the recipient when opening the electronic communication, and a transmission data mail header including received data included by at least one server via which the electronic communication is communicated, the method including investigating data in both the visible and transmission data mail headers.

7. The method of claim 4, wherein the parsing of the header to obtain purported domain name data includes:

parsing the header to obtain domain name data of each server via which the electronic communication has been communicated;

comparing the domain name data of each server with reference domain name data; and

generating the authenticity indicator in response to the comparison.

8. The method of claim 7, wherein the reference domain name data includes domain names associated with spoofed electronic communications, the method including updating the reference domain name data in an automated fashion.

9. The method of claim 7, wherein the reference domain name data is stored on a client machine, the method including:

connecting the client machine to a remote database of reference domain name data;

downloading updated reference domain name data; and

storing the reference domain name data on the client machine.

10. A machine-readable medium embodying instructions that, when executed by a machine, cause the machine perform a method including:

generating an authenticity indicator for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the authenticity indicator indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication; and

presenting the authenticity indicator to the recipient of the electronic communication.

11. The machine-readable medium of claim 10, wherein the method includes parsing a header of the electronic communication to identify the domain name data as included in the header by a server that received the electronic communication from a communication client.

12. The machine-readable medium of claim 10, wherein the method includes parsing a header of the electronic communication to identify the purported sender data included in the header of the electronic communication.

13. A server for authenticating electronic communications communicated between the server and at least one client device, the server including:

a communication interface to communicate with the at least one client device;

a processor; and

memory including instructions that, when executed by the processor, cause the processor to;

generate a confidence factor for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the confidence factor indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication; and

present the confidence factor to the recipient of the electronic communication.

14. The server of claim 13, wherein the instructions cause the processor to parse a header of the electronic communication to identify the domain name data as included in the header by a server that received the electronic communication from a communication client.

15. The server of claim 13, wherein the instructions cause the processor to parse a header of the electronic communication to identify the purported sender data included in the header of the electronic communication.

16. The server of claim 15, wherein the instructions cause the processor to:

parse the header to obtain purported sender domain name data in a “

FROM;

”

field populated at a communication client, the purported sender domain name data being visible to a recipient of the electronic communication.

17. The server of claim 15, wherein the instructions cause the processor to:

parse the header to obtain a purported IP Address of an originator of the electronic communication;

interrogate a Domain Name Server (DNS) with the domain name data to obtain an associated IP address of the domain name;

compare the associated IP address with the purported IP address; and

generate the confidence factor in response to the comparison.

18. The server of claim 13, wherein instructions cause the processor to:

parse a header of the electronic communication to obtain domain name data of each server via which the electronic communication has been communicated;

compare the domain name data of each server with reference domain name data; and

generate the confidence factor in response to the comparison.

19. The server of claim 18, wherein the reference domain name data includes domain names associated with spoofed electronic communications and the reference domain name data is updated in an automated fashion.

20. The server of claim 13, wherein the confidence factor is a warning regarding an origin of the electronic communication.

21. The server of claim 20, wherein the warning advises that the purported sender data does not match the domain name data.

22. The server of claim 20, wherein the warning cautions a user of a possibility of the electronic communication being spoofed.

23. The server of claim 13, wherein the confidence factor is a number within a confidence range.

24. A server for authenticating electronic communication communicated between the server and at least one client device, the server including:

communication means for communicating with the at least one client device;

processing means; and

memory means for storing instructions which, when executed by the processing means, cause the processing means to;

generate an authenticity indicator for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the authenticity indicator indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication; and

present the authenticity indicator to the recipient of the electronic communication.

25. The server of claim 24, wherein the authenticity indicator is a warning regarding an origin of the electronic communication.

26. The server of claim 25, wherein the warning advises that the purported sender data does not match the domain name data.

27. The server of claim 25, wherein the warning cautions a user of a possibility of the electronic communication being spoofed.

28. The server of claim 24, wherein the authenticity indicator is a number within a confidence range.