Message authentication using signatures
View Patent ↗Systems and methods are provided for using digital signatures to help distinguish legitimate email from known or trusted organizations from unsolicited email or forged email. Digital signatures may be used in an email body, mail header, or embedded links. The signatures may be verified by a recipient or internet service provider and may be used in conjunction with spam filtering applications.
1. A method for using digital signatures to authenticate messages, the method comprising:
at a recipient, creating a list of domains, wherein the list of domains includes one or more domains from which all incoming messages from the one or more domains are to be checked for valid signatures;
at a sender at a given domain within the list of domains, digitally signing a message to create a digital signature and sending the message together with the digital signature to the recipient;
at the recipient, extracting from the message the given domain of the sender;
at the recipient, comparing the extracted given domain of the sender the list of domains; and
at the recipient and based on the given domain matching a domain in the list of domains, verifying the digital signature.
2. The method defined in claim 1 further comprising:
at the recipient, based on the given domain matching a domain in the list of domains, and based on the digital signature being verified to be authentic, accepting the message; and
at the recipient, based on the given domain matching a domain in the list of domains, and based on the digital signature not being verified to be authentic, blocking the message as spam.
3. The method defined in claim 1 further comprising:
at an additional sender at an additional given domain outside the list of domains, sending an additional message to the recipient;
at the recipient, comparing the additional given domain to the list of domains; and
at the recipient and based on the additional given domain not matching a domain in the list of domains, accepting the additional message.
4. A method for suppressing a fake email message that attempts to trick a recipient into believing that the fake email message was sent by an organization with which the recipient has a relationship, wherein the organization has an associated private key, the method comprising:
receiving an email message, the email message including information indicating that the message originated from the organization;
determining that an email message has attributes that match the search filter criteria, wherein the search filter criteria includes information to specifically identify the organization;
determining that the email message does not have a digital signature created using the private key associated with the organization; and
based on determining that the email message has attributes that match the search filter criteria and determining that the email message does not have a digital signature created using the private key associated with the organization, performing at least one action selected from the group consisting of: suppressing the email message, treating the email message as an illegitimate email, and displaying a warning message.
5. The method defined in claim 4 wherein determining that the email message does not have a digital signature created using the private key associated with the organization comprises:
determining that the email message has an invalid digital signature.
6. The method defined in claim 4 wherein determining that the email message does not have a digital signature created using the private key associated with the organization comprises:
determining that the email message has a digital signature created using an additional private key that is not associated with the organization.
7. The method defined in claim 4 wherein determining that the email message does not have a digital signature created using the private key associated with the organization comprises:
determining that the email message does not have any digital signatures.
8. The method defined in claim 4 wherein the action comprises suppressing the email message.
9. The method defined in claim 4 wherein the action comprises treating the email message as an illegitimate email.
10. The method defined in claim 4 wherein the action comprises displaying the warning message, wherein the warning message comprises a warning for the recipient that the message appears to be fake.
11. The method defined in claim 4 further comprising:
receiving an additional email message, the additional email message including information indicating that the message originated from the organization;
determining that the additional email message has attributes that match the search filter criteria;
determining that the additional email message has a digital signature created using the private key associated with the organization; and
based on determining that the additional email message has attributes that match the search filter criteria and determining that the additional email message has a digital signature created using the private key associated with the organization, displaying the additional email message for the recipient.
12. The method defined in claim 11 further comprising:
at the organization, digitally signing the additional email message using the private key associated with the organization.
13. The method defined in claim 12 wherein digitally signing the additional email message comprises using an email gateway associated with the organization to digitally sign the additional email message.
14. The method defined in claim 4 wherein the search filter criteria comprise a list of keywords that are associated with the organization.
15. The method defined in claim 4 wherein the search filter criteria comprise a list of keywords that are associated with the organization and wherein the keywords comprise at least one keyword selected from the group consisting of: a name of the organization, a web site address of the organization, and a domain name of the organization.
16. A method for using digital signatures to authenticate messages, the method comprising:
receiving a message from a given domain name,
extracting the given domain name from the incoming message;
determining that the extracted given domain name is contained within a list of domains from which all incoming messages are to be checked for valid signatures;
determining that the message does not have a digital signature associated with the given domain name; and
in response to determining that the given domain name is contained within the list of domains from which incoming message are to be checked for valid signatures and that the message does not have a digital signature associated with the given domain name, performing at least one action selected from the group consisting of: suppressing the message, treating the message as being illegitimate, and displaying a warning message.
17. The method defined in claim 16 further comprising:
receiving an additional message from an additional given domain name;
determining that the additional given domain name is contained within the list of domains from which incoming messages are to be checked for valid signatures;
determining that the additional message has a valid digital signature associated with the additional given domain name; and
in response to determining that the additional given domain name is contained within the list of domains from which incoming messages are to be checked for valid signatures and that the additional message has a valid digital signature associated with the additional given domain name, accepting the additional message.
18. The method defined in claim 16 further comprising:
receiving an additional message from an additional given domain name;
determining that the additional given domain name is not contained within the list of domains from which incoming messages are to be checked for valid signatures; and
in response to determining that the additional given domain name is not contained within the list of domains from which incoming messages are to be checked for valid signatures, accepting the additional message.
19. The method defined in claim 16 wherein determining that the message does not have a digital signature associated with the given domain name comprises:
determining that the message has a digital signature created using a private key that is not associated with the given domain name.
20. The method defined in claim 16 wherein determining that the message does not have a digital signature associated with the given domain name comprises:
determining that the message does not have a digital signature.