Method and system for authentication of electronic communications

• US 20070208941A1
• Filed: 02/09/2007
• Published: 09/06/2007
• Est. Priority Date: 02/09/2006
• Status: Active Grant

• Current Assignee: California Institute of Technology, National Technology & Engineering Solutions Of Sandia LLC (Honeywell International Inc.)
• Original Assignee: California Institute of Technology, Sandia Corporation (Martin Marietta Corporation)
• Inventors: Backer, Alejandro
• Granted Patent: US 7,917,757 B2
• Time in Patent Office: Days
• US Class Current: 713/170
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and system to authenticate electronic communications, such as email. A trusted third party records information of each of sender'"'"'s communications, such as date, time and recipients. Recipients are allowed to verify if their incoming messages match the data of their senders'"'"' outgoing communications. Mismatches can be used to filter out fake messages assuming stolen identities.

Claims

1. An authentication method for electronic mail, comprising:

providing a sender of electronic mail with an authenticating code;

when the sender sends an electronic mail communication to a recipient, sending a message from the sender to a third party authentication entity;

sending information about the electronic mail communication from the recipient to the third party authentication entity;

comparing the message sent from the sender to the third party authentication entity with the information about the electronic mail communication from the recipient to the third party authentication entity; and

in case result of the comparison authenticates the sender, delivering the electronic mail communication to the recipient.

2. The method of claim 1, wherein the authenticating code is provided to the sender by the third party authentication entity.

3. The method of claim 1, wherein the authenticating code is provided to the sender by being sent to the electronic mail address of the sender.

4. The method of claim 1, wherein the message sent from the sender to the third party authentication entity is an electronic mail message.

5. The method of claim 1, wherein the message sent from the sender to the third party authentication entity is an encrypted message.

6. The method of claim 1, wherein the message sent from the sender to the third party authentication entity contains a code indentifying the sender together with information identifying the electronic mail communication.

7. The method of claim 6, wherein the information identifying the electronic mail communication comprises:

number of bytes, subject, the recipient, date and time of the electronic mail communication.

8. The method of claim 6, wherein the code identifying the sender is a password stored in a sender'"'"'s computer or account.

9. The method of claim 1 wherein, in case the result of the comparison does not authenticate the sender, the recipient has an option of discarding the electronic mail communication or putting the electronic mail communication in a spam folder.

10. The method of claim 1, wherein electronic mail communication from an unauthenticated sender is evidenced by an unauthentication tag to allow removal of the communication by way of recipient'"'"'s filtering software.

11. The method of claim 10, wherein the unauthentication tag is added to a header line, subject line, or body of the electronic mail communication.

12. The method of claim 1, wherein the providing the sender of electronic mail with the authenticating code comprises:

the authentication entity sending an electronic message to the sender to allow the sender to manually confirm authenticity of the electronic mail communication to the authentication entity.

13. The method of claim 12, wherein the providing the sender of electronic mail with the authenticating code further comprises:

inviting the sender to download certification software to avoid further manual confirmations.

14. The method of claim 1, wherein delivering the electronic mail communication to the recipient is subject to an additional condition of authentication of the sender arriving to the recipient within a preset period of time from the original mailing time.

15. The method of claim 1, wherein records of the third party authenticating entity or third party electronic mail communications sent by the third party authenticating entity are verifiable to verify whether bounced electronic mail communications were indeed sent by a legitimate owner of an electronic mail address.

16. A method for authenticating electronic mail, comprising:

upon sending an electronic mail communication from a sender to a recipient and before delivering the electronic mail communication to the recipient, sending a challenge from the recipient to the sender, requesting the sender to authenticate the electronic mail communication; and

upon authentication by the sender of the electronic mail communication, delivering the electronic mail communication to the recipient.

17. The method of claim 16, wherein the electronic mail message request the sender to authenticate the electronic mail communication by providing the sender with information on length, sender, recipient, date and time of the electronic mail communication and requesting the sender to confirm such information.

18. The method of claim 16, wherein the authentication is performed by software without manual intervention.

19. The method of claim 16, wherein the authentication is manually performed by the sender.

20. The method of claim 16, wherein the authentication is accompanied by information identifying the sender.

21. The method of claim 16, wherein the challenge is an electronic communication.

22. The method of claim 16, wherein the challenge is an electronic mail communication.

23. The method of claim 16, wherein a recipient'"'"'s email client or server is provided with a plug-in, wherein the challenge from recipient to sender comprises pinging a sender'"'"'s server with a code identifying the electronic mail communication and wherein the authentication by the sender comprises comparing the code with emails sent by the sender'"'"'s server and returning an answer.

24. A method for authenticating electronic mail, comprising:

sending an electronic mail communication from a sender to a recipient, the electronic mail communication being encrypted with a private key;

posting a public key in a publicly accessible server, the public key including code signifying authenticity of the sender;

comparing the private key with the public key; and

delivering the electronic mail communication to the recipient if there is a match between the private key and the public key.