Electronic mail system with authentication/encryption methodology for allowing connections to/from a message transfer agent

• US 6,986,037 B1
• Filed: 05/31/2000
• Issued: 01/10/2006
• Est. Priority Date: 04/07/2000
• Status: Expired due to Term

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Sendmail Incorporated (Proofpoint Incorporated)
• Inventors: Assmann, Claus
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Moorthy, Aravind K
• Application Number:
  US09/585,701
• Time in Patent Office: 2,050 Days
• Field of Search: 713/155, 713/200, 713/201, 713/151, 713/153, 713/160, 713/168
• US Class Current: 713/155
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

An electronic mail (“e-mail”) system is described that enforces authentication or encryption to/from Mail Transfer Agents and from Mail User Agents. In one embodiment, for example, an electronic mail (e-mail) system is described that comprises: a message transfer agent (MTA) available for a client to connect to; program logic for authenticating the client, through use of a certificate, in order to identify the client as approved for establishing a secured connection with the MTA; program logic for establishing a secured connection between the client and the MTA in instances where the client can be authenticated; program logic for testing encryption strength of the secured connection; and program logic for terminating the secured connection in instances where the secured connection has inadequate encryption strength.

Claims

1. In an electronic mail (e-mail) system, a method for sending an e-mail message using a secured connection that employs encryption, the method comprising:

receiving at a message transfer agent (MTA) a request from a client for establishing a secured connection with the MTA for sending an e-mail message;

attempting to authenticate the client, through use of a certificate, in order to identify the client as approved for establishing a secured connection with the MTA;

if the client cannot be authenticated, terminating the method without establishing the secured connection and without sending the e-mail message;

if the client can be authenticated, establishing the secured connection between the client and the MTA;

determining whether the encryption employed for the secured connection meets a predefined minimum encryption strength;

if the encryption employed does not meet the predefined minimum encryption strength, terminating the secured connection without sending the e-mail message, whereupon the method terminates; and

if the encryption employed does meet the predefined minimum encryption strength sending the e-mail message.

2. The method of claim 1, wherein said minimum encryption strength comprises a particular key length of a symmetric cipher used for encryption.

3. The method of claim 1, wherein said step of terminating the method without establishing the secured connection includes:

returning a temporary error reply code.

4. The method of claim 1, wherein said step of terminating the method without establishing the secured connection includes:

returning a permanent error reply code.

5. The method of claim 1, wherein the e-mail message is returned to an original sender for the message if the client cannot be authenticated.

6. The method of claim 1, wherein the e-mail message is queued for future sending if the client cannot be authenticated.

7. The method of claim 1, wherein said step of determining whether the encryption employed for the secured connection meets a predefined minimum encryption strength employs SASL (Simple Authentication and Security Layer) protocol.

8. The method of claim 1, wherein said client is remote from said e-mail system.

9. The method of claim 1, wherein said client includes a Mail User Agent.

10. The method of claim 9, wherein the Mail User Agent communicates with the e-mail system via SMTP (Simple Mail Transport Protocol).

11. The method of claim 1, wherein said MTA comprises a Sendmail-compatible Message Transfer Agent (MTA) and wherein said method is controlled, at least in part, by a configuration file for the Sendmail-compatible MTA.

12. The method of claim 1, wherein said certificate comprises a signed public key.

13. The method of claim 1, wherein said certificate comprises an X.509 certificate.

14. The method of claim 1, wherein said step of terminating the method without establishing the secured connection includes:

rejecting at least some subsequent SMTP commands received from the client.

15. The method of claim 14, wherein the rejected SMTP commands are rejected with an error.

16. In an electronic mail (e-mail) system, a method for sending an e-mail message using a secured connection that employs encryption, the method comprising:

attempting at a first message transfer agent (MTA) to establish a secured connection with a second MTA for sending an e-mail message;

attempting to authenticate the second MTA, through use of a certificate, in order to identify the second MTA as approved for establishing a secured connection with the first MTA;

if the second MTA cannot be authenticated, terminating the method without establishing the secured connection and without sending the e-mail message;

if the second MTA can be authenticated, establishing the secured connection between the first MTA and the second MTA;

determining whether the encryption employed for the secured connection meets a predefined minimum encryption strength;

if the encryption employed does not meet the predefined minimum encryption strength, terminating the secured connection without sending the e-mail message, whereupon the method terminates; and

if the encryption employed does meet the predefined minimum encryption strength, sending the e-mail message.

17. The method of claim 16, wherein said minimum encryption strength comprises a particular key length of a symmetric cipher used for encryption.

18. The method of claim 16, wherein said step of terminating the method without establishing the secured connection includes:

returning a temporary error reply code.

19. The method of claim 16, wherein said step of terminating the method without establishing the secured connection includes:

returning a permanent error reply code.

20. The method of claim 16, wherein the e-mail message is returned to an original sender for the message if the second MTA cannot be authenticated.

21. The method of claim 16, wherein the e-mail message is queued for future sending if the second MTA cannot be authenticated.

22. The method of claim 16, wherein said step of determining whether the encryption employed for the secured connection meets a predefined minimum encryption strength employs SASL (Simple Authentication and Security Layer) protocol.

23. The method of claim 16, wherein said second MTA is remote from said e-mail system.

24. The method of claim 16, wherein said first MTA originally received the e-mail message from a client that connects to the e-mail system using a Mail User Agent.

25. The method of claim 24, wherein the Mail User Agent communicates with the e-mail system via SMTP (Simple Mail Transport Protocol).

26. The method of claim 16, wherein said first MTA comprises a Sendmail-compatible Message Transfer Agent (MTA) and wherein said method is controlled, at least in part, by a configuration file for the Sendmail-compatible MTA.

27. The method of claim 16, wherein said certificate comprises a signed public key.

28. The method of claim 16, wherein said certificate comprises an X.509 certificate.

29. The method of claim 16, wherein the first MTA communicates with the second MTA using SMTP (Simple Mail Transport Protocol).

30. The method of claim 29, wherein said step of terminating the method without establishing the secured connection includes:

issuing an SMTP QUIT command.

31. An electronic mail (e-mail) system comprising:

a message transfer agent (MTA) available for a client to connect to;

program logic for authenticating the client, through use of a certificate, in order to identify the client as approved for establishing a secured connection with the MTA;

program logic for establishing a secured connection between the client and the MTA in instances where the client can be authenticated;

program logic for testing encryption strength of the secured connection; and

program logic for terminating the secured connection in instances where the secured connection has inadequate encryption strength.

32. The system of claim 31, wherein the client includes Mail User Agent (MUA) software.

33. The system of claim 31, wherein the e-mail message is communicated to the MTA via SMTP (Simple Mail Transport Protocol).

34. The system of claim 31, wherein said certificate comprises a signed public key.

35. The system of claim 31, wherein said certificate comprises an X.509 certificate.