Validating E-mails using message posting services

• US 9,882,858 B2
• Filed: 06/02/2015
• Issued: 01/30/2018
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sasatani, Yohkichi, Shibutani, Katsuya, Takiguchi, Ichiro, Yatsu, Yoshiki
• Primary Examiner(s): Nguyen, Tu
• Application Number:
  US14/728,186
• Publication Number:
  US 20160359789A1
• Time in Patent Office: 973 Days
• Field of Search: 709206
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Validation of e-mails is provided. An e-mail is received. A sender of the e-mail is determined. A message posting service account that is associated with the sender is identified. The message posting service is queried for a first hash value that corresponds to the e-mail based, at least in part, on the account. A response is received from the message posting service. Whether the account includes the first hash value is determined based, at least in part, on the response. The e-mail is or is not validated based, at least in part, on the response from the message posting service.

Claims

1. A computer program product for validating e-mails, the computer program product comprising:

a computer readable storage device and program instructions stored on the computer readable storage device, the program instructions comprising;

program instructions to receive an e-mail;

program instructions to determine a sender of the e-mail;

program instructions to identify an account of a message posting service, wherein the account is associated with the sender;

program instructions to query a message posting service for a first hash value corresponding to the e-mail based, at least in part, on the account;

program instructions to, responsive to determining that the first hash value is posted to the account, calculate a second hash value based, at least in part, on one or more predetermined portions of the e-mail and to compare the first hash value and the second hash value;

program instructions to, responsive to determining that the first hash value is equal to the second hash value, determine that the e-mail is authentic based, at least in part, on the comparison of the first and second hash values;

program instructions to, responsive to determining that the first hash value is not equal to the second hash value, determine that the e-mail has been tampered with;

program instructions to determine a time of receipt of the e-mail;

program instructions to determine a time of posting of the first hash value;

program instructions to determine a duration of time between the time of receipt and the time of posting;

program instructions to, responsive to determining that the first hash value is equal to the second hash value and that the duration of time between the time of receipt and the time of posting is less than a threshold duration of time, determine that the e-mail is authentic; and

program instructions to, responsive to determining the that the duration of time between the time of receipt and the time of posting is equal to or greater than the threshold duration of time, determine that the e-mail has been tampered with.

2. The computer program product of claim 1, wherein the first hash value is posted to the message posting service via the account associated with the sender, and wherein the first hash value is based, at least in part, on the one or more predetermined portions of the e-mail.

3. The computer program product of claim 1, wherein determining that the first hash value is posted to the account is based, at least in part, on at least one of verification data contained in the e-mail and a time of receipt of the e-mail.

4. The computer program product of claim 3, the program instructions further comprising:

program instructions to determine that the first hash value is not posted to the account based on a response to querying the message posting service and, in response, determining, by one or more computer processors, that the e-mail is spoofed.

5. A computer system for validating e-mails, the computer system comprising:

one or more computer processors;

one or more computer readable storage devices;

program instructions stored on the one or more computer readable storage devices for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to receive an e-mail;

program instructions to determine a sender of the e-mail;

program instructions to identify an account of a message posting service, wherein the account is associated with the sender;

program instructions to query a message posting service for a first hash value corresponding to the e-mail based, at least in part, on the account;

program instructions to, responsive to determining that the first hash value is posted to the account, calculate a second hash value based, at least in part, on one or more predetermined portions of the e-mail and to compare the first hash value and the second hash value;

program instructions to, responsive to determining that the first hash value is equal to the second hash value, determine that the e-mail is authentic based, at least in part, on the comparison of the first and second hash values;

program instructions to, responsive to determining that the first hash value is not equal to the second hash value, determine that the e-mail has been tampered with;

program instructions to determine a time of receipt of the e-mail;

program instructions to determine a time of posting of the first hash value;

program instructions to determine a duration of time between the time of receipt and the time of posting;

program instructions to, responsive to determining that the first hash value is equal to the second hash value and that the duration of time between the time of receipt and the time of posting is less than a threshold duration of time, determine that the e-mail is authentic; and

program instructions to, responsive to determining the that the duration of time between the time of receipt and the time of posting is equal to or greater than the duration of time, determine that the e-mail has been tampered with.

6. The computer system of claim 5, wherein the first hash value is posted to the message posting service via the account associated with the sender, and wherein the first hash value is based, at least in part, on the one or more predetermined portions of the e-mail.

7. The computer system of claim 5, wherein determining that the first hash value is posted to the account is based, at least in part, on at least one of verification data contained in the e-mail and a time of receipt of the e-mail.

8. The computer system of claim 7, the program instructions further comprising:

program instructions to determine that the first hash value is not posted to the account based on a response to querying the message posting service and, in response, determining, by one or more computer processors, that the e-mail is spoofed.