Validating inbound messages

• US 7,571,319 B2
• Filed: 10/14/2004
• Issued: 08/04/2009
• Est. Priority Date: 10/14/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wong, Chun Yu, Bansod, Aditya, Gillum, Eliot C., Mironov, Ilya
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Tran; Tongoc
• Application Number:
  US10/965,058
• Publication Number:
  US 20060085505A1
• Time in Patent Office: 1,755 Days
• Field of Search: 713/155, 713/168, 713/170, 726/13, 726/23, 726/24, 380/229
• US Class Current: 713/168
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for verifying messages. The method may include the steps of receiving an inbound message and characterizing the inbound message by analyzing a latent cryptographic identifier in the inbound message. The identifier is generated by a recognized message system, which may be the receiving system itself, for an outbound message. Characterizing may involve detecting if the latent cryptographic identifier is present and determining if the cryptographic identifier is valid. The step of determining can be performed using symmetric or asymmetric methods of verifying the authenticity of the message.

Claims

1. A method for interpreting messages, comprising:

receiving an inbound message, wherein the inbound message includes a plurality of fields, a first of said fields including a unique message identifier, said message identifier further incorporating a latent cryptographic identifier as part of the message identifier, said latent cryptographic identifier being generated by a recognized message system for inclusion in outbound messages and including at least one optimization hint; and

characterizing the inbound message by analyzing the latent cryptographic identifier in the inbound message.

2. The method of claim 1 wherein the step of characterizing comprises:

detecting if a latent cryptographic identifier generated by a recognized messaging system is present; and

determining if the cryptographic identifier is valid.

3. The method of claim 2 further including the step, prior to said step of determining, of checking said at least one optimization hint in the identifier to determine whether a more detailed determination of the identifier is required.

4. The method of claim 3 wherein the optimization hint is a recipient hint.

5. The method of claim 3 wherein the optimization hint is a time hint.

6. The method of claim 1 further including the step of generating an outbound message including said identifier.

7. The method of claim 6 wherein the step of generating comprises inserting said identifier in a Message-ID field of an email message.

8. The method of claim 6 wherein the step of generating includes encrypting message metadata.

9. The method of claim 8 wherein the message metadata is the account name originating the message.

10. The method of claim 8 wherein the message metadata is the domain of account originating the message.

11. The method of claim 8 wherein the message metadata is the time of message transmission.

12. The method of claim 8 wherein the message metadata is the subject field of the message.

13. The method of claim 8 wherein the message metadata is a portion of subject field metadata selected by skipping a number of characters at the beginning of the subject field.

14. The method of claim 8 wherein the message metadata includes the email address of the recipient of the original message

15. The method of claim 1 wherein each said step of characterizing comprises examining a Message-ID header field in an email message.

16. The method of claim 1 wherein said message is a failure report of original message delivery.

17. The method of claim 16 wherein the step of characterizing comprises examining a Message-ID in headers of the original message attached in the failure report.

18. The method of claim 1 wherein said inbound message is a reply to original message.

19. The method of claim 18 wherein the step of characterizing comprises examining a Message-ID found in an In-Reply-To header.

20. The method of claim 18 wherein the step of characterizing comprises examining a Message-ID found in an References header.

21. The method of claim 1 wherein the step of characterizing comprising comparing a keyed-hash of message metadata against test signatures.

22. The method of claim 1 wherein the step of characterizing comprising verifying a PKI encryption of message metadata.

23. A computer-readable medium having computer-executable instructions for performing the steps recited in claim 1.

24. A method for validating an inbound email in a messaging system, comprising:

extracting a cryptographic identifier generated from a known originating system from the inbound email;

checking at least one optimization hint in the identifier to determine whether a more detailed determination of the cryptographic identifier is required; and

if a detailed determination is required,

comparing a portion of the cryptographic identifier against a number of known valid MAC values to determine whether the message originated with the known originating system, and if so, generating a positive comparison, and

processing the email based on the positive comparison including bypassing at least a portion of a spam filter.

25. The method of claim 24 wherein the known originating system is the messaging system.

26. The method of claim 24 wherein said step of comparing generates a negative comparison if the message did not originate with the known originating system, and If so, the method further includes the step of processing the message based on said negative comparison.

27. The method of claim 26 wherein the processing comprises displaying a different icon for the message.

28. The method of claim 26 wherein the processing comprises routing mail to a specific folder.

29. The method of claim 26 wherein the processing comprises forwarding mail for analysis by a spam filter.

30. The method of claim 26 wherein the processing comprises storing mail sent with negative comparisons for analysis.

31. The method of claim 26 combining key identification with virus scanning to provide an early warning system for viruses.

32. The method of claim 26 wherein said processing includes treating failure reports not passing the check pejoratively.

33. The method of claim 32 where pejorative treatment amount to hiding the message from the user.

34. A messaging system, including:

an identifier generator providing a cryptographic identifier for each message handled by the message transfer agent, wherein each message includes a plurality of fields, including a standard identification field encoded with a unique message identifier, said cryptographic identifier being incorporated as part of the message identifier, each cryptographic identifier generated including at least one optimization hint; and

an identifier characterizer interpreting the content of the standard identification field in inbound messages to the messaging system.

35. The messaging system of claim 34 wherein the identifier generator is incorporated into a mail user agent.

36. The messaging system of claim 34 wherein the identifier generator is incorporated into a messaging transfer agent.

37. The messaging system of claim 34 wherein the identifier characterizer is incorporated into a messaging transfer agent.

38. The messaging system of claim 34 wherein the identifier characterizer is incorporated into a mail user agent.

39. The messaging system of claim 34 further including a spam filter.

40. The messaging system of claim 39 further including the step of comparing an output of the characterizer to message decisions by the spam filter.

41. The messaging system of claim 39 wherein spam filters are run only fraction of the time, and a false-positive rate is extrapolated.

42. The messaging system of claim 39 wherein the messaging system includes a transmission log, and the identification is used as optimization against transmission log check.

43. The messaging system of claim 39 wherein the spam filter is run less often as a result of identification is used an optimization to reduce the load on the system resulting from running the spam filters.

44. The messaging system of claim 34 wherein the system further includes at least a first server and a second server, and the generator and the characterizer are provided on each of said first and second server, and each first and second server includes a different encryption key.

45. The messaging system of claim 34 wherein the system further includes:

a plurality of inbound servers and a plurality of outbound servers,

at least one said generator provided on each of said plurality of outbound servers,

at least one said characterizer provided on each of said plurality of inbound servers,

each said generator provides a signature using one of a plurality of unique private keys stored on said outbound server, and

each said verifier validates a signature using a public key stored on each said inbound server.

50. The messaging system of claim 34, wherein the standardized identification field of each message includes the unique message identifier, the cryptographic identifier, a local part, random data bytes, at least two optimization hints including a recipient hint and a time interval hint, and a version information.

46. A method for validating email, comprising:

generating an latent cryptographic identifier in each outbound message output by a messaging system , the identifier including at least one optimization hint and an encrypted unique identifier; and

upon receipt of any inbound message by the messaging system;

determining whether the latent cryptographic identifier in the inbound message is present;

examining the optimization hint and extracting the encrypted identifier from the cryptographic identifier; and

comparing the encrypted identifier against a number of known valid encrypted identifier to determine whether the inbound message originated with the messaging system.

47. The method of claim 46 wherein the encrypted identifier is a message authentication code.

48. The method of claim 46 wherein the cryptographic identifier includes at least one optimizer component.

49. The method of claim 48 wherein the method further includes the step, prior to the step of extracting, of checking the optimizer component to determine whether to perform said extracting and comparing steps.