E-mail anti-phishing system and method

1. An anti-phishing email method using an anti-phishing email system, the anti-phishing email system comprises an email address registration and authentication subsystem, an email signature registration subsystem and an email signature query subsystem, wherein the anti-phishing email method the method comprises:

(1) registering, by an email sending user, an email address used by the email sending user in the email address registration and authentication subsystem;

(2) generating, by the email sending user, a signature for information on a to-be-sent email using an email signature generator; registering the generated signature in the email signature registration subsystem in a secure way; and after the email signature is registered successfully, sending the email to an email receiving user, wherein a field indicating whether the email signature is registered is added in an email header of the email; and

(3) generating, after the email receiving user receives the email, a signature using a signature generator; querying the email signature query subsystem whether the email is registered; and determining whether the email is an illegal phishing email by comparing a query result with the information indicating whether the email signature is registered in the email header of the email,

wherein

an input to the signature generator comprises:

an email sender which is an email address represented by no more than 256 UNICODE characters;

an email receiver which is an email address represented by no more than 256 UNICODE characters;

an email sending date comprising a year, a mouth and a day represented by 8 digital characters; and

email content represented by UNICODE characters with an indefinite length; and

an output of the signature generator is an email signature represented by 128 ASCII characters.

2. The method according to claim 1 , wherein the step (1) comprises:

(1-1) registering, by the email sending user, in the anti-phishing email system to be a user and submitting an email address to the email address registration and authentication subsystem;

(1-2) sending, by the email address registration and authentication subsystem, a registration confirmation code and a link to the email address;

(1-3) recording, by the email sending user, information on the email address using the registration confirmation code and the link received by the email address;

(1-4) confirming, by the email address registration and authentication subsystem, registration information on the email address and sending information indicating that the email address is registered successfully to the email sending user; and

(1-5) periodically sending, by the email address registration and authentication subsystem, user information registered with the email address to the registered email address, to prompt the user to modify the user information or unbind the user if the information is incorrect.

3. The method according to claim 1 , wherein the registering the generated signature in the email signature registration subsystem in a secure way in step (2) comprises:

(2-1) encrypting, by the email sending user, the signature using a private key in key pair information registered in the anti-phishing email system;

(2-2) decrypting, by the email signature registration subsystem after receiving the encrypted signature, the encrypted signature using a public key stored in the anti-phishing email system by the email sending user and storing the signature information; and

(2-3) confirming, to the user by the anti-phishing email system, that the email signature is registered successfully and sending a confirmation code to the email sending user.

4. The method according to claim 3 , wherein the email header in the step (2) comprises information of the following fields:

X-registered, which is a newly added field having a default value of “No” indicating that the information is not registered, and a value of “Yes” indicating that the information is registered successfully; and

X-confirmation-No, which is a confirmation code assigned after the information on the email is registered successfully, comprising a field indicating a year, a field indicating a month and a day, a field indicating a time, a field indicating an email address, and a field indicating a random number.

5. The method according to claim 1 , wherein the step (3) comprises:

presenting, by the email signature query subsystem, to the email receiving user whether the email is registered, after the email receiving user submits the information on the sender, the receiver, the sending date, the confirmation code and the signature information to the email signature query subsystem; and

prompting the email receiving user that the email is an illegal phishing email in a case where it is confirmed that the email is registered while the registration information is incorrect.

6. The method according to claim 1 , comprising:

determining the received email is an illegal phishing email in a case where the email sending user notifies the email receiving user, by a short message or by telephone, that an email is a registered email, while the email receiving user finds an error after querying the anti-phishing email system.

7. The method according to claim 2 , wherein the registering the generated signature in the email signature registration subsystem in a secure way in step (2) comprises:

(2-1) encrypting, by the email sending user, the signature using a private key in key pair information registered in the anti-phishing email system;

(2-2) decrypting, by the email signature registration subsystem after receiving the encrypted signature, the encrypted signature using a public key stored in the anti-phishing email system by the email sending user and storing the signature information; and

(2-3) confirming, to the user by the anti-phishing email system, that the email signature is registered successfully and sending a confirmation code to the email sending user.

8. The method according to claim 7 , wherein the email header in the step (2) comprises information of the following fields:

X-registered, which is a newly added field having a default value of “No” indicating that the information is not registered, and a value of “Yes” indicating that the information is registered successfully; and

X-confirmation-No, which is a confirmation code assigned after the information on the email is registered successfully, comprising a field indicating a year, a field indicating a month and a day, a field indicating a time, a field indicating an email address, and a field indicating a random number.

9. An anti-phishing email system for implementing an anti-phishing email method, the anti-phishing email method comprises (1) registering, by a user terminal used by an email sending user, an email address used by the email sending user in an email address registration and authentication subsystem; (2) generating, by a sending terminal used by the email sending user, a signature for information on a to-be-sent email using an email signature generator; registering the generated signature in an email signature registration subsystem in a secure way; and after the email signature is registered successfully, sending the email to an email receiving user, wherein a field indicating whether the email signature is registered is added in an email header of the email; and (3) generating, by a receiving terminal after the email receiving user receives the email, a signature using a signature generator; querying an email signature query subsystem whether the email is registered; and determining whether the email is an illegal phishing email by comparing a query result with the information indicating whether the email signature is registered in the email header of the email, wherein an input to the signature generator comprises: an email sender which is an email address represented by no more than 256 UNICODE characters; an email sending date comprising a year, a mouth and a day represented by 8 digital characters; and email content represented by UNICODE characters with an indefinite length; and an output of the signature generator is an email signature represented by 128 ASCII characters,

wherein the anti-phishing email system comprises: a memory, and a processor, wherein the processor comprises an email address registration and authentication subsystem, an email signature registration subsystem, and an email signature query subsystem, wherein,

the memory is configured to store a program;

the processor is configured to execute the program, and when the program is being executed, the email address registration and authentication subsystem is configured to receive the email address used by the email sending user and register the email address;

the email signature registration subsystem is configured to register the signature generated by the email sending user using the email signature generator for the information on the to-be-sent email; and

the email signature query subsystem is configured for the email receiving user to query whether the email is registered after the email receiving user receives the email, to determine whether the email is an illegal phishing email.

10. The system according to claim 9 , wherein the email address registration and authentication subsystem is configured to, after the user submits the email address to the email address registration and authentication subsystem,

send a registration confirmation code and a link to the email address for the user to record information on the email address using the registration confirmation code and the link; and

confirm registration information on the email address and send information that the email address is registered successfully to the user.

11. The system according to claim 9 , further comprising a storage module configured to store key pair information, wherein

a private key in the key pair information is used by the user to encrypt the signature, and

a public key of the key pair is used by the email signature registration subsystem to decrypts the encrypted signature after the email signature registration subsystem receives the encrypted signature.