SYSTEM AND METHOD OF EFFICIENT E-MAIL LINK EXPIRATION

• US 20080028446A1
• Filed: 07/25/2006
• Published: 01/31/2008
• Est. Priority Date: 07/25/2006
• Status: Abandoned Application

• Current Assignee: MyPoints.com, Inc. (Prodege)
• Original Assignee: MyPoints.com, Inc. (Prodege)
• Inventors: Burgoyne, Andre
• Application Number:
  US11/459,900
• Publication Number:
  US 20080028446A1
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 51/56 Unified messaging, e.g. interactions between e-mail, instant messaging or converged IP messaging [CPM]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method for providing secure and efficient link expiration that includes determining an email address for a member that a link is to be sent; generating a link by encrypting the member'"'"'s email address; determining an expiration date for the link; and applying a scaling factor to the expiration date. The method also includes combining the expiration date with the link; sending an email message to the member'"'"'s email address, with the email message including the link embedded therein; taking the member to a web site after receiving data corresponding to selection of the embedded link by the member; determining if the link has expired based on the expiration date with the reduced memory requirement; decrypting the link if it is determined that the link has not expired; and determining if the link is valid.

Claims

1. A method for providing secure and efficient link expiration, comprising:

determining an email address for a member that a link is to be sent;

generating a link by combining an encryption of the member'"'"'s email address and a unique member ID corresponding to the member;

determining an expiration date for the link;

applying a scaling factor to the expiration date to reduce the memory requirement for the expiration date;

including one of the expiration date with the reduced memory requirement or a key identifier corresponding to either the expiration date or the expiration date with the reduced memory requirement with the link;

sending an email message to the member'"'"'s email address, with the email message including the link embedded therein;

taking the member to a web site after receiving data corresponding to selection of the embedded link by the member;

decrypting the link;

determining if the link has expired based on the expiration date with the reduced memory requirement; and

determining if the link is valid if the link has not expired.

2. The method of claim 1, further comprising determining if the key identifier has expired before decrypting the link and only decrypting the link if the key identifier has not expired.

3. The method of claim 1, wherein determining if the link is valid comprises determining if data in the email link corresponding to the member'"'"'s email address is the same as data stored in the member'"'"'s account corresponding to the member'"'"'s email address.

4. The method of claim 1, wherein sending the email message with the embedded link comprises sending an account verification email to a new member, and further comprising setting the new member'"'"'s account status to “

verified”

if the link is determined to be valid and not expired.

5. The method of claim 1, further comprising generating a web page form to obtain the member'"'"'s email address and a zip code for the member after receiving data corresponding to selection of a “

forgot password”

link.

6. The method of claim 5, further comprising determining if is the zip code from the web page form matches the zip code stored in the member'"'"'s account.

7. The method of claim 6, wherein generating the link comprises combining a hash of the member'"'"'s email address, a hash of the member'"'"'s password, the unique member ID corresponding to the member, and one of the key identifier or the expiration date with the reduced memory requirement.

8. The method of claim 7, wherein determining if the link is valid comprises determining if the hash values of the member'"'"'s e-mail address and the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the member'"'"'s password stored in the member'"'"'s account.

9. The method of claim 8, further comprising allowing the member to update the password if it is determined that the link is valid and not expired.

10. The method of claim 1, wherein generating the link comprises combining a hash of the member'"'"'s email address and a hash of the last update date of the member'"'"'s password, and the unique member ID corresponding to the member, and determining if the link is valid by determining if the hash values of the member'"'"'s e-mail address and the last update date of the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the last update date of the member'"'"'s password stored in the member'"'"'s account.

11. The method of claim 1, further comprising automatically changing the member'"'"'s password after receiving data corresponding to selection of a “

forgot password”

link.

12. The method of claim 1, further comprising generating a web page form to obtain the member'"'"'s email address and a zip code for the member after receiving data corresponding to selection of a “

forgot password”

link.

13. A method for providing secure and efficient link expiration, comprising:

generating a web page form to obtain a member'"'"'s email address for the member after receiving data corresponding to a selection of a “

forgot password”

link;

displaying a message indicating that an e-mail has been sent to the member'"'"'s e-mail address to allow the member to change the member'"'"'s password;

determining an expiration date for the link;

applying a scaling factor to the expiration date to reduce the memory requirement for the expiration date;

generating the link by combining a hash of the member'"'"'s email address, a hash of the member'"'"'s password, a unique member ID corresponding to the member, and one of a key identifier corresponding to either the expiration date or the expiration date without reduced memory requirement, or the expiration date with the reduced memory requirement;

sending a reset password email message to the member'"'"'s email address, with the reset password email message including the link embedded therein;

taking member to an encrypted web site after receiving data corresponding to selection of the embedded link by the member;

decrypting the link;

determining if the link has expired;

determining if the link is valid if it is determined that the link has not expired;

allowing the member to update the member'"'"'s password if the link is determined to be valid and not expired; and

recording the transaction in the member'"'"'s account.

14. The method of claim 13, wherein generating the web page form further comprises obtaining a set of personal data for the member after receiving data corresponding to selection of a “

forgot password”

link.

15. The method of claim 14, further comprising determining if is the set of personal data obtained from the web page form matches the set of personal data stored in the member'"'"'s account.

16. The method of claim 13, wherein determining if the link is valid comprises determining if the hash values of the member'"'"'s e-mail address and the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the member'"'"'s password stored in the member'"'"'s account.

17. The method of claim 16, further comprising automatically changing the member'"'"'s password after receiving data corresponding to selection of the “

forgot password”

link.

18. A system for providing secure and efficient link expiration, comprising:

means for determining an email address for a member that a link is to be sent;

means for determining an expiration date for the link;

means for representing the expiration date in a low resolution format;

means for including with the link one of the expiration date in the low resolution format or a key identifier corresponding to either the expiration date or the expiration date in the low resolution format;

means for generating the link by combining;

a hash of the member'"'"'s email address, a unique member ID corresponding to the member, and one of the expiration date in the low resolution format or the key identifier corresponding to either the expiration date or the expiration date in the low resolution format;

means for sending an email message to the member'"'"'s email address, with the email message including the link embedded therein;

means for taking the member to a web site after receiving data corresponding to selection of the embedded link by the member;

means for decrypting the link;

means for determining if the link has expired; and

determining if the link is valid if the link has not expired.

19. The system of claim 18, wherein the means for determining if the link is valid comprises a means for determining if data in the email link corresponding to the member'"'"'s email address is the same as data stored in the member'"'"'s account corresponding to the member'"'"'s email address.

20. The system of claim 18, wherein the means for sending the email message with the embedded link comprises a means for sending an account verification email to a new member, and further comprising a means for setting the new member'"'"'s account status to “

verified”

if the link is determined to be valid and not expired.

21. The system of claim 18, wherein the means for determining if the link has expired comprises a means for determining if the link has expired based on the expiration date in the low resolution format.

22. The system of claim 18, further comprising:

a means for generating a web page form to obtain the member'"'"'s email address and personal information for the member after receiving data corresponding to selection of a “

forgot password”

link, and

a means for determining if is the personal information from the web page form matches the personal information stored in the member'"'"'s account.

23. The system of claim 22, wherein the means for generating the link comprises a means for combining a hash of the member'"'"'s email address, a hash of the member'"'"'s password, and a unique member ID corresponding to the member.

24. The system of claim 23, wherein the means for determining if the link is valid comprises a means for determining if the hash values of the member'"'"'s e-mail address and the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the member'"'"'s password stored in the member'"'"'s account.

25. The system of claim 23, further comprising a means for allowing the member to update the password if it is determined that the link is valid and not expired.

26. The system of claim 22, wherein the means for generating the link comprises a means for combining a hash of the member'"'"'s email address, a hash of the last update date of the member'"'"'s password, and the unique member ID corresponding to the member, and a means for determining if the hash values of the member'"'"'s e-mail address and the last update date of the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the last update date of the member'"'"'s password stored in the member'"'"'s account.

27. The system of claim 22, further comprising a means for automatically changing the member'"'"'s password after receiving data corresponding to selection of the “

forgot password”

link.

28. A system for providing secure and efficient link expiration, comprising:

a plurality of member server groups operatively coupled to a network, each of the plurality of member server groups comprising a first plurality of operatively coupled servers including an application server, a master data server and a plurality of replication data servers;

each of the plurality of member server groups including an e-mail engine, at least one of the e-mail engines configured to;

determine an email address for a member that a link is to be sent;

determine an expiration date for the link;

generate and encrypt a link that combines;

a hash of the member'"'"'s email address, a unique member ID corresponding to the member, and data associated with the expiration date;

send an email message to the member'"'"'s email address, with the email message having the link embedded therein;

decrypt the link;

determine if the link has expired based on the data associated with the expiration date;

determine if the link is valid if it is determined that the link has not expired; and

an administrative server group operatively coupled to the network and to the plurality of member server groups, the administrative server group comprising a second plurality of operatively coupled servers including an application server, a master data server and a plurality of replication data servers.

29. The system of claim 28, wherein the at least one e-mail engine is further configured to determine if data in the email link corresponding to the member'"'"'s email address is the same as data stored in the member'"'"'s account corresponding to the member'"'"'s email address.

30. The system of claim 28, wherein the at least one e-mail engine is further configured to send an account verification email to a new member and set the new member'"'"'s account status to “

verified”

if the link is determined to be valid and not expired.

31. The system of claim 28, wherein the at least one e-mail engine is further configured to generate a web page form to obtain the member'"'"'s email address and a zip code for the member after receiving data corresponding to selection of a “

forgot password”

link.

32. The system of claim 31, wherein the at least one e-mail engine is further configured to determine if is the zip code from the web page form matches the zip code stored in the member'"'"'s account.

33. The system of claim 28, wherein the at least one e-mail engine is further configured to:

combine a hash of the member'"'"'s email address, a hash of the member'"'"'s password, and the unique member ID corresponding to the member;

determine if the hash values of the member'"'"'s e-mail address and the member'"'"'s password are the same as the hash values for the member'"'"'s e-mail address and the member'"'"'s password stored in the member'"'"'s account; and

allow the member to update the password if it is determined that the link is valid and not expired.