Electronic mail system with authentication methodology for supporting relaying in a message transfer agent
View Patent ↗An electronic mail (“e-mail”) system is described that provides a methodology that allows the system to determine when it is appropriate to relay e-mail messages, particularly from “roaming” users. In basic operation, the methodology of the present invention first checks whether the client has been authenticated. If not, the decision of whether relaying is allowed may be subject to other rules in the system, such as whether the user currently resides behind the company's firewall. Of interest herein is a case where the client has been authenticated. In that case, the system can allow relaying for everyone who has a certificate (“cert”) signed by certain certificate authorities (“CAs”). Additionally, the system can require specific cert subjects.
1. In an electronic mail (e-mail) system, a method for determining whether to approve relaying of e-mail received from a roaming user, the method comprising:
attempting to authenticate the user for purposes of relaying an e-mail, through use of a certificate;
if the user cannot be authenticated, immediately terminating the method without approval of relaying;
determining a certificate issuer for the now-authenticated user;
if the certificate issuer is unknown to the system, immediately terminating the method without approval of relaying;
determining whether relaying is allowed based on identity of the certificate issuer;
if relaying is allowed based on identity of the certificate issuer, immediately terminating the method with approval of relaying;
determining whether relaying is allowed based on identity of the user as a certificate subject; and
if relaying is allowed based on identity of the certificate subject, terminating the method with approval of relaying, otherwise terminating the method without approval of relaying.
2. The method of claim 1 , wherein said certificate comprises a signed public key.
3. The method of claim 1 , wherein said certificate comprises an X.509 certificate.
4. The method of claim 1 , wherein said certificate issuer is associated with a Distinguished Name and wherein said step of determining a certificate issuer includes:
optionally rewriting information from the certificate using a regular expression to extract only a portion of the Distinguished Name associated with the certificate issuer.
5. The method of claim 1 , wherein approval of relaying by the system may occur as a result of another method that also operates within the system.
6. The method of claim 1 , wherein said certificate subject is associated with a Distinguished Name and wherein said step of determining whether relaying is allowed based on identity of the user as a certificate subject includes:
optionally rewriting information from the certificate using a regular expression to extract only a portion of the Distinguished Name associated with the certificate subject.
7. The method of claim 1 , wherein said e-mail is received from said user while the user is currently logged onto a system that is remote from said e-mail system.
8. The method claim 1 , wherein said e-mail system is protected by a firewall, and wherein said system that is remote resides outside said firewall.
9. The method of claim 1 , wherein said step of determining whether relaying is allowed based on identity of the certificate issuer includes:
looking up the certificate issuer in a database, for determining whether relaying is allowed based on identity of that particular certificate issuer.
10. The method of claim 1 , wherein said user connects to the e-mail system using a Mail User Agent.
11. The method of claim 10 , wherein the Mail User Agent communicates with the e-mail system via SMTP.
12. The method of claim 1 , wherein said step of attempting to authenticate the user is based, at least in part, on Transport Layer Security (TLS) protocol.
13. The method of claim 1 , wherein said step of determining whether relaying is allowed based on identity of the certificate issuer includes:
looking up the certificate issuer in a database; and
if a lookup value of RELAY is returned for the certificate issuer, specifying that relaying is allowed based on identity of this particular certificate issuer.
14. The method of claim 1 , wherein said step of determining whether relaying is allowed based on identity of the certificate issuer includes:
looking up the certificate issuer in a database; and
if a lookup value of SUBJECT is returned for the certificate issuer, specifying that determination of whether relaying is allowed will have to be determined based on identity of the user as a certificate subject.
15. The method of claim 1 , wherein said system includes a Sendmail-compatible Message Transfer Agent (MTA) and wherein said method is controlled, at least in part, by a configuration file for the MTA.