Method and apparatus for reducing e-mail spam and virus distribution in a communications network by authenticating the origin of e-mail messages
View Patent ↗The proposed invention solves the problem of spoofing the origin to create e-mail spam, virus distribution, and other abuse of the electronic mail. In particular, it solves a notoriously dangerous problem of distributing computer viruses via e-mail allegedly sent from friends, colleagues, and well-respected organizations. The proposed invention defines a comprehensive set of mechanisms and apparatus to reasonably ensure that an e-mail message—when received by an e-mail gateway, e-mail relay server, or the destination e-mail server—has originated at the location and sent by a person (or a program) specified in its “From:” field.
1. A method of authenticating an email message origin in a communications network, said method comprising the steps of:
receiving at an originating server of said e-mail message ( 14 ) a query from a downstream server ( 16 , 18 , 20 , 24 ) to determine whether said email message was sent by an indicated user, wherein said originating server is arranged to check an identification field of an incoming email message to determine if it corresponds to a mailbox serviced by the originating server and to create a log entry for received e-mail messages satisfying that criteria;
checking logged data at said originating server to determine whether said email message corresponds to a message sent from said originating server in response to said query; and
responding to said query to authenticate said email message origin.
2. The method of claim 1 , further including the steps of
checking if a “From” field in a message header of said e-mail message corresponds to a mailbox serviced by an originating server when said originating server receives a request for forwarding an email; and
logging data identifying said email message, if said “From” field successfully corresponds to a mailbox serviced by said originating server.
3. The method of claim 1 , wherein said query is received from a destination server.
4. The method of claim 1 , wherein said query is received from an authentication server.
5. The method of claim 4 , wherein said authentication server receives a request to authenticate from a destination server.
6. The method of claim 1 , wherein said query is initiated using a TCP session.
7. The method of claim 1 , wherein an originating message is identified by one or more of a set of parameters selected from the group consisting of: From: field, time of day, length, subject line, selected contents, and other message-specific parameters.
8. A method of authenticating an email message origin at a destination server ( 20 ) in a communications network, wherein an originating server ( 14 ) checks if a “From” field in an email message header corresponds to a mailbox serviced by the originating server when said originating server receives a request for forwarding an email and logs data identifying said email message, if said email message successfully corresponds to said originating server, said method comprising the steps of:
sending a query to said originating server from said destination server to determine whether said email message was sent by an indicated user;
receiving a response to said query to determine whether said message was authenticated, said response including information as to whether said email message corresponds to said logged data and to said originating server.
9. The method of claim 8 , wherein said query is sent to said originating server.
10. The method of claim 8 , wherein said query is sent to an authentication server.
11. The method of claim 8 , wherein said query is initiated using a TCP session.
12. The method of claim 8 , wherein an originating message is identified by one or more of a set of parameters selected from the group consisting of: From: field, time of day, length, subject line, selected contents, and other message-specific parameters.
13. A method of authenticating an email message origin in a communications network, said method comprising the steps of:
checking at an originating server ( 14 ) if a “From” field in a message header of said email message corresponds to a mailbox serviced by the originating server when said originating server receives a request for forwarding an email;
logging data identifying said email message, if said “From” field successfully corresponds to a mailbox serviced by said originating server;
sending a query from a destination server ( 20 ) to said originating server to determine whether said email message was sent by an indicated user;
checking said logged data at said originating server to determine whether said email message corresponds to said originating server;
responding to said query to authenticate said email message; and
receiving said response at said destination server.