DE112006001552T5 - Method and server for authenticating the sender of e-mails and communication of exchange information - Google Patents

Abstract

A method for authenticating a sender of an e-mail, the method being characterized in that in a server that has received the e-mail,
a list of elements of delivery information is generated which has been inserted in the e-mail by at least one server involved in the transmission of the e-mail,
the list is checked, starting with an item of the delivery information that has been inserted into the e-mail by the server preceding the server that received the e-mail, the check comprising the steps
Fetch, in a first domain name request, a fully qualified domain name corresponding to an IP address inserted in the element of the delivery information,
Get, in a second domain name request, an IP address that corresponds to the fully qualified domain name,
Comparing the IP address used in the first domain name request with the IP address obtained from the second domain name request, and if the compared IP addresses are the same
Checking the next element of the ...

Description

Field of the invention

The This invention relates generally to the safety of electronic Post (e-mail) and especially on the ways in which the receiver an e-mail can ensure that the entered in the e-mail Sender information reliable or trustworthy is.

Background of the invention

The Internet consists of a large number of servers, routers and others so-called nodes and communication links between the nodes. Typically, e-mails from one sender to a recipient over several Internet node sent. In general, the sender does not know about which Node sends the e-mail becomes. Every node, over the e-mail is sent, you can make a copy for yourself or send the message or a copy of it to another node. For this reason, unencrypted e-mails make comparatively unsafe communication method.

One receiver a conventional one E-mail can not know for sure if the one specified in an e-mail Sender is really the sender or if this is someone else.

E-mails are usually over transmits the Internet using a protocol called SMTP (Simple Mail Transfer Protocol) and in the IETF (Internet Engineering Task Force) specification RFC822 is specified. Furthermore the SMTP protocol was provided with an extension (RFC3207), the so-called SSMTP (Secure SMTP), through which a sending server and a receiving server can communicate securely with each other.

• 1) B> 220 ESMTP ready
• 2) A> helo smtp.domain.tld
• 3) B> 220 Hello.
• 4) A> MAIL From: <sender@domain.tld>
• 5) B> 220 ABsender ok
• 6) A> RCPT TO: <recipient@domain.tld>
• 7) B> 220 Empfänger ok
• 8) A> DATA
• 9) B> 220 Dateneingabe gefolgt von <CR><LF>.<CR><LF>
• 10) A> Von: sender@domain.tld
• 11) A> An: recipient@domain.tld
• 12) A> Betreff: Message Subject
• 13) A>
• 14) A> Die eigentliche Nachricht
• 15) A>.
• 16) B> 250 Ok
• 17) A> QUIT
• 18) B> 220 Bye.

The following describes the traditional handling of an SMTP protocol email when the email is sent from server A to server B:
A = sending server, B = receiving server)

• 1) B> 220 ESMTP ready
• 2) A> helo smtp.domain.tld
• 3) B> 220 Hello.
• 4) A> MAIL From: <sender@domain.tld>
• 5) B> 220 ABsender ok
• 6) A> RCPT TO: <recipient@domain.tld>
• 7) B> 220 receiver ok
• 8) A> DATA
• 9) B> 220 data entry followed by <CR><LF>.<CR><LF>
• 10) A> From: sender@domain.tld
• 11) A> To: recipient@domain.tld
• 12) A> Subject: Message Subject
• 13) A>
• 14) A> The actual message
• 15) A>.
• 16) B> 250 Ok
• 17) A> QUIT
• 18) B> 220 Bye.

In the aforementioned phases 1-3 perform the Server A and B an acknowledgment.

In Phases 4-7 Routing information of the e-mail is transmitted. The routing information determine a recipient the e-mail. A so-called return address is specified in the routing information for a situation in which the e-mail can not be delivered.

In the phases 8-16 the e-mail is transferred from one server to another. Phases 8 and 9 are preparing the transfer in front.

In the phases 10-12 the header information is separated from the actual message transfer a blank line (phase 13).

In Phase 14 will be the actual message, so the text and possible Transfer attachment files. Server A sends a line with a dot (.) And a line feed (Phase 15). After phase 15, the receiving server B stores the message usually on his hard drive.

In At phase 16, the server B sends an acknowledgment that the message was received. Servers A and B terminate the connection (phases 17 and 18). Subsequently clears the sending server A usually receives the e-mail from its hard disk.

The previous example describes the operation of two servers (A and B). The ones transmitting the e-mail Servers can Be part of a long chain. Therefore, the transfer includes the e-mail about this chain has a variety of phases 1-18. The following is a Server also called "one Router ".

The "concatenation" of the router / server for transmission emails cause a transmission delay, because a following router in the chain can not transmit before one E-mail from the previous router has been completely transferred. Furthermore the e-mail becomes frequent stored in each router on the hard drive of the router, something the transfer delayed.

It is possible, to submit the e-mail leaving a server of the chain a following server of the chain immediately contacted when he over sufficient information for the e-mail transmission features.

in the In the above example, the server B has the sufficient information after phase 8, so that it can contact the following server (server C). This will cause the transfer accelerates the message through the chain of routers (A, B, C), because the following router (router C) is capable of receiving the message transferred to, while the previous router (server B) the end portion of the message from the first router in the chain (server A). This type of transfer Emails are considered "transparent message transmission "(transparent messaging) designated. The transparent transmission has the advantage that the first router (server A) is an information element from the last router (server C) receives as soon as the message the recipient is sent. About that In addition, transparent messaging lowers the risk of loss a message when a server in the middle of the chain (server B) during the transmission the message a fault having.

Generally can speak the routers will be physical routers or virtual routers. A row of virtual routers can be within a physical router be installed.

1 shows a server with virtual routers. A server 101 receives a message 102 in accordance with a protocol (SMTP) and sends the message 102 after.

The server 101 contains four routers acting as an e-mail firewall 103 , a security proxy 104 , a content filter 105 and an SMTP back-end 106 be designated. Arrows between the routers 103 - 106 describe how the message 102 yourself inside the server 101 moved from one router to another. If the transfer is done in the traditional way, the routers store 103 - 106 each message 102 on the hard disk of the server 101 , If the transparent message transmission is used instead of the conventional method, the message becomes 102 not stored on the disk, but the router 103 - 105 conduct the message 102 immediately continue and do not send any confirmation of message reception before the following routers 104 - 106 confirm receipt of the message.

A Open-source software Amavisd, which is downloadable on the internet, implements transparent routing within a server.

The transparent routing between servers is fraught with difficulties because an SMTP e-mail (message) has a number of recipients may and may have different e-mails Server is routed. Then a router, the transparent transmission obeys the transmission divide the email on a number of servers, causing the administration the transmission complicated. The transparent transmission thus works best when receiving the e-mail, ie in the last server of the "chain" or in the virtual Servers within a server.

The The following authentication problem exists in the prior art: Anyone can send emails about that with any sender address Send Internet. Complicated transmission chains make it difficult the real source of the email find out because every physical server, and often virtual Servers that are in the servers have their own notations in the header of emails. An unreliable server may also have notations make in the header and try that way the actual Obscure the origin of the email.

A solution for the Authentication problem is digital signatures in To use emails. But only a few senders and recipients of Emails use such. Digital signatures require software installations at the terminals the sender and recipient. A sender signs his / her message using the software and the receiver verifies whether the signature of the message is unique or not.

A another solution, which is more advanced than the previous one, is the use a particular server for the creation of digital signatures and for the verification of them. Then the Origin of emails, for example, to be checked at organizational level.

Some Procedures have been developed to transmit an e-mail Server to authenticate.

"Reverse IP Verification" is a well-known process for the Authentication of the server sending / delivering the e-mail Has. The following describes the functions of the "Reverse IP Verification".

It is assumed that the name of a receiving server is "domain-b 'and the IP address of the sending server is 123.45.67.89, then the receiving server makes'domain-b', the following notation in the transmission information:
Received: from smtp.domain.tld (smtp.domain.tld [123.45.67.89])
by smtp.domain-b.tld with ESMTP

In the first phase of the "Reverse IP Verification" the receiving server executes a DNS query, in which the server, ie 'Domain b', receives the domain name of the Domain Name Server (DNS) queries above IP address:
dig @ DNS-server1-PTR 89.67.45.123. in-addr.arpa

For example, in response to the DNS queries, the DNS (DNS Server1) returns the following answer:
89.67.45.123. Addr.arpa in PTR smtp.domain.tld

The DNS response revealed that the IP address 123.45.67.89 one complete Domain name "domain" matches.

In the second phase of the "Reverse IP Verification", the entire domain name of the IP address 123.45.67.89 is determined. Then the 'Domain-b' server uses a different DNS server (DNS-server2), as shown in the following DNS query:
dig @ DNS-server2 A smtp.domain.tld.

For example, in response to the DNS queries, the DNS (DNS-server2) returns the following answer:
Smtp.domain.tld. A 123.45.67.89

Finally, compare the 'Domain b' server in the recipient field entered IP address 123.45.67.89 with the IP address 123.45.67.89, in the second phase of the "Reverse IP Verification " has been. In this example, the IP addresses are the same, i. The message was sent by the server, its domain name is 'Domain' and its IP address 123.45.67.89 is.

Reverse IP Verification is common in many router applications commonly known and used for example in "Postfix" (www.postfix.org).

It It is assumed, as in the above example, that the domain name is 'Domain' and the IP address 123.45.67.89 correspond to each other. Then the 'domain b' server adds in the header of the message to the domain name 'Domain' in parentheses and the IP address 123.45.67.89 in square brackets.

Suppose, for example, that the domain b server routes the received message to the domain c, and we assume that the full domain name of the domain b server smtp.domain-b. tld "and the IP address of the 'Domain-b' server is 234.56.78.90. Then the 'Domain-c' server in the message header makes the following entries:
Received: from smtp.domain-b.tld (smtp.domain-b.tld [234.56.78.90])
by smtp.domain-c.tld with ESMTP
where ESMTP is an acronym from the words "Enhanced Simple Mail Transport Protocol". After this, the message contains the following transmission information:
Received: from smtp.domain-b.tld (smtp.domain-b.tld [234.56.78.90])
by smtp.domain-c.tld with ESMTP
Received: from smtp.domain.tld (smtp.domain.tld [123.45.67.89])
by smtp.domain-b.tld with ESMTP

To the Example Postfix router applications work with transmission information, such as described above.

In addition to the Reverse IP Verification, there are others well-known procedures with which the trustworthiness of the servers, which in sending or submitting from messages are detectable. One of these Messages uses a list that lists the IP addresses of trusted servers having. If the IP address of a server used for delivery listed in the list is, the server is considered reliable (sufficient) estimated. If the delivery server not found in the list of trusted servers, the server is considered untrustworthy.

The other known methods for authenticating a sending server are SPF (Sender Policy Framework) and Microsoft Sender ID. In these Published procedure Any organization that sends emails in a domain name service Information that reveals from which email server the emails be sent under the domain name. With the help of the SPF or Microsoft Sender ID procedure, for example, can have the following goals as certified e-mail servers are defined: a) a single IP address, b) all IP addresses, which are related to a domain name, and / or c) the so-called "MX server" in context with the domain name. The so-called "best guess" procedure is an extension of the SPF procedure. In the "best guess" method it is possible of it assume that all IP addresses and / or all MX servers of the domain name reliable although the organization sending the e-mail is not DNS information published after the procedure.

It It is also known that the server has an identifier in the header E-mail inserts, so that the sender of the e-mail is identified by means of the identifier can be.

It is also known that the accuracy of the e-mail's sender details can be guaranteed by sending a so-called review message to the sender of the e-mail. These types of methods based on the use of a verification message are described, for example, in US Pat U.S. Patents 6,393,465 and 6,868,498 described. A weakness of these methods is extra care on the part of the sender because the sender is obliged to check the verification message / verification messages for his / her emails.

One another problem associated with the prior art is like the transmission method expressed by emails becomes.

One way to express the method of transmitting emails is to use UNIX mail servers. In this expression mode, the sender information of a message is changed when the message reaches an organization from the Internet, so that the recipient (end user) of the message is able to receive messages that come internally from the organization from messages originating from the message Internet come to part. The sender is changed, so that at the beginning, for example, a notation 'EXT' is. Then, for example, the sender information of the message looks like this:
EXT Matti Virtanen matti.virtanen@konserni.tld

A appropriate notation can also be in the subject line of the message be made.

One third problem in the context of the prior art is that the technique extra Actions for a sending organization requires. If the sending organization does not use authentication methods, the sending server can not be authenticated, unless the use of "best guess" procedure within the SPF process is used. However, "best guess" is a pretty unreliable way to authenticate a sender of an e-mail because the e-mail is sent via a very complicated transmission chain can be received.

One third problem related to the prior art the above SPF method. The problem occurs in a situation in which the message is sent out of an organization and a server used by the organization is used to send the message to a recipient outside the organization send. If the receiver using the SPF method, does that SPF procedure that the origin in the message is wrong, because based on the "envelope from "address the Message from another server comes as the server outside the organization, about send the message to the recipient arrives.

Summary of the invention

The The main object of the invention is to solve the above problems in the context of the prior art.

A E-mail that over the internet is being transmitted, happens a number of servers / routers on the way to a receiver, taking the e-mail usually the transmission information from every server involved in the transfer the e-mail includes.

The The invention comprises a method for authenticating a sender an e-mail, the e-mail being transmitted by at least one server (router) having. The method according to the invention uses the "reverse IP verification" described above. More specifically, the delivery information by means of "reverse IP Verification ", i. the information of the recipient field are based on the transmission information checked, the one server in front of the server that received the e-mail in the E-mail inserted Has. The transmission information ("Recipient fields") are allowed through until an unreliable one Element of transmission information is found or all elements of the transmission information of the "Reverse IP Verification" subjected. In the latter Case becomes an exam addressed to an element entered in the e-mail first. In this exam becomes the by "reverse IP Verification "received full domain name with the domain name in the sender information compared to the email. If the domain names match each other, the sender of the e-mail is authenticated. If necessary, the exam be extended by the procedure with 1 to 4 additional tests.

In addition to According to the method, the invention comprises a server equipped with the checking means is and sends and / or receives emails.

Brief description of the drawings

The The invention will be explained in more detail with reference to the accompanying drawings.

1 shows a server with virtual routers,

2A shows an operational principle of the method,

2 B shows the test steps of the procedure,

3 shows the editing of a list used in the exam

4A shows a further checking step, in which the beginning of a domain name is determined by a heuristic method,

4B shows another additional checking step, in which the domain name is searched for in the list of stored servers,

4C shows another additional testing step in which MX information is used

4D shows a further additional testing step in which a RIPE database is used,

5 shows a server in accordance with the invention.

Detailed description the invention

The Procedure is related to the authentication of the sender an e-mail. Authentication of the sender generally means that the sender named in the e-mail is the actual The sender of the e-mail is. In other words, it can be done with sufficient Security said that the email is from the one specified in the "From" field Sender originates.

The Authentication of the server also includes the verification of Correctness of the transmission information. The elements of the transmission information give the servers, over the the email from the original one Send the sender to the recipient has been.

The Procedure also refers to how the way of transmission the e-mail in the header of the e-mail can be specified better than today. The procedure replaces the elements in the header of the e-mail with verified information entries on which Basis it possible is, the trustworthiness estimate the origin of the e-mail. Accurate makes the e-mail application or another application a notation in the address field of the original Sender, on the basis of which the end user knows that the origin of the email has not been successfully verified. The Notation in the address field can for example, three question marks [???] in parentheses.

Furthermore can the possible encoding the end user with a particular notation in the address field of the Sender.

To the For example, the use of encryption with the notation "S" can be displayed.

Around Time to save the end user, the application can after the procedure be implemented so that the emails received in two different Folders based on the trustworthiness of the origin of the E-mails are received.

It It is known from the prior art that a mail server the Text "unknown" in the head of a E-mail writes and the IP address of the e-mail in square brackets sets when the "Reverse IP Verification "revealed that the full Domain name and the IP address of the email do not match each other.

It is important from the perspective of the invention, which tests a E-mailed and when it is determined that the email is correct.

It is assumed that the transmission information in the e-mail is as follows:
Received: from smtp.domain-b.tld (smtp.domain-b.tld [234.56.78.90])
by smtp.domain-c.tld with ESMTP
Received: from smtp.domain.tld (smtp.domain.tld [123.45.67.89])
by smtp.domain-b.tld with ESMTP

It is further assumed that the sender information of the e-mail is:
From: matti.meikalainen@domain.com

• 1) Der letzte Eintrag der Übertragungsinformationen wird gelesen, d.h. eine Notation des "Empfängerfelds" wird von einem Server gelesen, der sich vor dem Server befindet, welcher die E-Mail empfangen hat und die Notation gemacht hat.
• 2) Extrahieren der IP-Adresse aus dem Element der Übertragungsinformationen, zum Beispiel, die IP-Adresse 34.56.78.90.
• 3) Überprüfen, ob die IP-Adresse, die in Schritt 2 erhalten wurde, sich auf der Liste der verlässlichen Server befindet.
• 4) Wenn diese nicht gefunden wird, wird die IP-Adresse in die Liste geschrieben.
• 5) Wenn diese gefunden wird, werden Schritte 2–4 für das nächste Element der Übertragungsinformationen durchgeführt. Wenn das gelesene Element der Übertragungsinformationen das erste in die E-Mail geschriebene Element ist, ist der nächste Schritt der Schritt 6.
• 6) Lesen der IP-Adresse aus der Liste.
• 7) Herausfinden des vollständigen Domainnamens mit Hilfe einer DNS-Suche ("smtp.domain.tld" in diesem Beispiel).
• 8) Herauszufinden der IP-Adresse, die mit dem vollständigen Domain-Namen korrespondiert, mit Hilfe einer DNS-Suche (34.56.78.90 in diesem Beispiel).
• 9) Wenn die IP-Adresse aus der Liste und die IP-Adresse aus der DNS-Suche übereinstimmen, werden die Schritte 6–8 für das nächste Element in der Liste durchgeführt. Wenn die IP-Adresse die letzte in der Liste ist, ist der nächste Schritt der Schritt 10.
• 10) Abtrennen von den voll qualifizierten Domainnamen der IP-Adresse den Endabschnitt des Domainnamens ("Domain" in diesem Beispiel).
• 11) Prüfen, ob der Endabschnitt des vollständigen Domainnamens den Absenderinformationen der E-Mail entspricht, d.h. dem Endabschnitt des vollständigen Domainnamens im "Von"-Feld.
• 12) Wenn diese einander entsprechen, ist der Absender authentifiziert.

The operation of the method is described by the following example. The transmission information and the sender information are checked as follows.

• 1) The last entry of the transmission information is read, ie a notation of the "recipient field" is read by a server located in front of the server that received the e-mail and made the notation.
• 2) Extract the IP address from the element of the transmission information, for example, the IP address 34.56.78.90.
• 3) Verify that the IP address obtained in step 2 is on the list of trusted servers.
• 4) If not found, the IP address will be written to the list.
• 5) If found, steps 2-4 are performed for the next item of transmission information. If the read element of the transmission information is the first element written in the e-mail, the next step is step 6.
• 6) Read the IP address from the list.
• 7) Find the full domain name using a DNS lookup ("smtp.domain.tld" in this example).
• 8) Find the IP address that corresponds to the full domain name using a DNS lookup (34.56.78.90 in this example).
• 9) If the IP address is from the list and the IP address from DNS lookup, steps 6-8 are performed for the next item in the list. If the IP address is the last in the list, the next step is step 10.
• 10) Detaching the fully qualified domain name of the IP address the end portion of the domain name ("domain" in this example).
• 11) Check that the end portion of the full domain name matches the sender information of the e-mail, that is, the end portion of the full domain name in the "From" field.
• 12) If these correspond to each other, the sender is authenticated.

The the following remark applies to step 4: the IP address of the delivery information, which is first inserted in the e-mail is always listed in the list.

The Procedure reveals the organization from which the e-mail originated. The procedure works even if it is in the middle of a public Server, for example, a server of an operator on the Internet, if this "medium Server "its own" Received "line in the e-mail writes.

2A shows an operation principle of the method. The procedure is used to authenticate the sender of an e-mail on the server receiving the e-mail. It will 201 in the server generates a list of the elements of the transmission information that at least one server participating in the transmission of the e-mail has inserted in the e-mail. Then the list is checked 202 starting with an element of the transmission information that was inserted into the e-mail from a server that is upstream of the receiving server. The exam includes at least the steps in 2 B , The investigation indicates whether 203 the studied elements of the information are reliable. If they are, it will be sent to the server that received the e-mail 204 that the sender information in the e-mail is correct.

2 B shows the testing steps of the method, which occur in all embodiments of the method. This check is performed by a server that processes the e-mail based on a list of elements of the e-mail delivery information ("Received" field) and e-mail sender information ("From" or "From"). ) checks. The check begins with the delivery information element that was inserted in the e-mail from a server in front of the server that received the e-mail. The exam includes the following steps. In the first DNS request 206 the full domain name of the IP address found in the element of the delivery information is determined. In the second DNS request 207 the IP address corresponding to the determined fully-qualified domain name is determined. Then, the IP address of the first DNS request is compared with the IP address found in the second DNS request 208 , If the comparison shows that the IP addresses are the same, and the element of the delivery information is the last one in the list 210 is, the domain name found in the first DNS request is compared 211 with the sender information of the e-mail. The e-mail contains the domain name associated with the sender of the e-mail. If the domain names match each other 212 , the sender information of the e-mail 204 considered correct. Thus, the sender information can be interpreted as correct when the list is checked out of the elements of the delivery information 209 and the items are verified as reliable, and in testing 212 the sender information is verified as reliable / correct. If the list contains non-validated elements 210 , the subsequent element of the list will be read and the steps 206 to 208 carried out. If the comparison 209 reveals that the IP addresses are not the same, the sender information becomes 205 interpreted as wrong or incorrect.

3 shows the processing of the list during the check. Editing the list means that the following step between steps 201 and 202 in 2A is carried out. Each item of delivery information that a server found in the list of trusted IP addresses has inserted into the e-mail is removed from the list by the server that received the e-mail. A notation that has been added by a trusted server trusts to the extent that the element of the delivery information is not checked. As the list of elements of the delivery information becomes shorter, the time required for execution of the procedure also becomes shorter. For example, the list of trusted IP addresses may consist of the company's or community's own servers. Then all other servers are interpreted as "unreliable", ie the elements of the delivery information from these remain in the list and the items become 2A checked.

If necessary, the accuracy of the test can be increased by taking the additional steps in 4A - 4D be performed. The further steps relate to the above-mentioned list which contains the elements of the transmission information ("Received" fields).

4A shows the further test step, in which the beginning of a domain name is determined by a heuristic method. Becoming more precise On the server that received the email, an element of the fully-qualified domain name was checked using a special heuristic procedure 401 , This part is left over if two strings separated by a dot are removed from the end of the domain name fetched in the first DNS request 206 , The heuristic method indicates whether the part is a dynamic network address or a non-dynamic network address. Suppose that after the exam 401 the part that remains when two separated-by-point character strings at the end of the domain name is a non-dynamic network address. If the item is the last one in the list 210 and in step 212 If the domain names match each other, the sender information ("from" field) is considered correct. Faking or intercepting a non-dynamic network address is much more difficult than faking or intercepting a dynamic network address. If the item is based on the exam 401 is a dynamic network address, the element of the delivery information is considered false / unreliable and therefore the sender information ("From" field) is considered false / unreliable 205 ,

Additionally or alternatively, the exam may be in 2 B be improved with the following additional step.

4B shows the further test step, in which the domain name is searched in the list of the conquered server. This step is preferably performed when the "Reverse IP Verification" is completed ( 2 , Step 209 ). Some Internet servers for the transmission of e-mails are conquered by unwanted parties, such as hackers. The conquered servers, or more precisely, their domain names, are included in the lists that are commonly available. These lists can be interpreted as a logical list. In 4B becomes the domain name on a server that received the e-mail 403 searched in the (logical) list of conquered servers. After this, the sender information 404 interpreted as correct if the searched domain name is missing in the list of conquered servers and if the domain name is the last element of the delivery information (in the list including the "Received" field) 210 and the compared domain names match each other 212 ,

Additionally or alternatively, the exam may be in 2 B be improved by the following additional step.

4C shows the further testing step in which MX (Mail Exchange) information is used. The MX information is stored in a Domain Name Server (DNS). An element of the MX information reveals to which server e-mails addressed to a particular domain name should be delivered. In step 405 the following substeps are performed: 1) using the full domain name of the first domain name request as a search key to obtain MX (Mail Exchange) information, 2) using at least one fully qualified domain name in the MX information in a domain name request wherein for some of the fully qualified domain names of the MX information of the domain name request, an IP address corresponding to the IP address in the element of the delivery information is retrieved 406 3) If the item of delivery information that was determined to be correct is the last one in the list 210 is and based on the comparison 211 the domain names match each other 212 , the sender information ("from" field) is considered correct.

Alternatively, after the step 204 an additional check using the MX information targeted to the sender information.

In this additional review will be the following sub-steps: 1) Using the domain name in connection with the sender as a search term in a search, where the search results in MX information, 2) comparing the fully qualified domain name that matches the IP address, which is an element of the delivery information is, with at least one fully qualified domain name of the MX information, and if the compared fully-qualified Domain name a fully-qualified domain name MX information matches, determining the sender information as correct.

Additionally or alternatively, the exam may be in 2 B be improved with the following additional step.

4C shows the further testing step in which MX (Mail Exchange) information is used. The MX information is stored in a Domain Name Server (DNS). An element of the MX information reveals to which server e-mails addressed to a particular domain name should be delivered. In step 405 will be the one in step 206 The domain name retrieved is compared to the MX information available through the domain name service of the Internet. Does their domain name correspond to an item of MX information? 406 , the element of the delivery information is interpreted as correct. Is the element of the delivery information the last one in the list 210 and match the domain names each other 212 , the sender information ("from" field) is considered correct.

Additionally or alternatively, the test according to 2 B be improved by the following additional step.

4D shows the further test step, in which a RIPE (Röseaux IP Europaens) database is used. As described above, the IP address corresponding to the fetched domain name is in the second DNS request 207 determined. In the next step 407 This IP address is used as search term in the search in the RIPE (WHOIS) database after the owner organization of the IP address. In the next step 408 The owner organization information is compared to the domain name obtained in the first domain name request 206 , If the information about the owner organization matches the domain name 409 , the item of delivery information is considered reliable. Otherwise, the element of the delivery information is considered unreliable and the sender information is estimated to be false or unreliable.

The method according to the invention relates to a number of embodiments. In one embodiment, the sender information of an e-mail is considered correct only if the additional steps, 401 . 403 . 405 . 407 and 408 in 4A - 4D Show that all elements of the delivery information are correct and in step 212 the domain names match each other. In all other cases, the sender information of the e-mail is interpreted as incorrect.

In other embodiments of the method, the determination of the accuracy of the email is done in a different manner. First of all, the number of additional steps to be performed may vary, for example, only the additional step 401 in 4A be performed. Further, the sender information may be interpreted as correct, although some additional steps may indicate that an item of the delivery information is incorrect.

It is possible to specify a security level for sender information. The degree of security is, for example, an integer between 0 and 100, where 0 means that the sender information is definitely wrong and 100 means that the sender information is definitely correct. The degree of security can be implemented, for example, by giving points, allowing each of the extra steps 401 . 403 and 405 resulting in 0 to 20 points, the extra steps 407 and 408 together yield 0 to 20 points, and the step 212 results in 0 to 20 points. Then the degree of security is determined as the sum of the points to calculate an integer between 0 and 100. It is possible to specify a threshold, for example 80, that must be reached in order for the sender information to be considered correct.

In a particular embodiment of the Invention is the degree of security related information about the Sender of an e-mail stored by the domain name server of the Internet in a security degree database. The security level will be along with the domain and IP address stored in the security level database. Then is it possible to have one Search the database to make new emails from the IP address of the sender. If the security level in the database is assigned to the domain name and the IP address is low, It makes sense to consider such received emails as suspicious consider.

It is possible, too, one transmitting the e-mail Assign a server security level. The degree of security describes the trustworthiness of the server instead of the sender's trustworthiness (the IP address of the sender). The security level is increased if an e-mail that is considered correct by the method according to the invention will, over the server was received. Accordingly, the degree of security diminished if the sender information of the e-mail is incorrect is interpreted.

One particular embodiment of the method includes a step of adding a server to the list of trusted IP addresses when, based on the level of security, the server is highly likely to send legitimate e-mails. More specifically, the IP address of the server is included in the list of trusted IP addresses associated with 3 was discussed. It also controls those situations where e-mail is received from outside an organization, but a server within the organization is used to forward the e-mail received to a recipient outside the organization.

In summary, the following aspects should be mentioned. If necessary, the procedure may be carried out without the additional tests 4A - 4D be used. However, if at least one of the four additional checks is used, the sender information of an e-mail is interpreted as correct if the following three conditions are met: an item of the delivery information is the last one in the list 210 . the domain name found in the first domain name query contains a domain name associated with the sender of the email 212 and at least one additional check indicates that the item of delivery information is correct. As described above, on the server which has received the e-mail, the sender information can be assigned a degree of security for the probability of the correctness of the information. The higher the number of additional checks, the higher the probability that one or more elements of the delivery information are correct. In addition, it is possible to store a security level together with the sender information in a database or memory to later use the security level. On the server that received the e-mail, the security level is preferably embedded in the header of the e-mail. The recipient of the e-mails can then decide for themselves whether he regards the sender information as correct or not.

Of the Security level is preferably in the "From" box displayed. A security level can also be displayed in the "Reply to" field of the e-mail become.

Furthermore Is it possible, In the field "From" and / or "Answer to" a degree of encryption display. The degree of encryption is a topic concerning a note about the use of encryption products (for example'). The degree of strength of encoding reveals how strong / reliable encryption technology or encryption techniques in the transmission an e-mail were used.

Around define a degree of encryption strength The method comprises the following steps, where "sender information" refers to the received one E-mail refers ("sender information" is not the sender information a reply e-mail). Usually everyone adds Server involved in the transfer an e-mail and conventional server software (e.g. Postfix) uses in the delivery information a note about the use of the transmission and the degree of strength of the encoding one. This part is usually not visible to the recipient of one E-mail and he does not say anything about it the actual Security level of the channel used for e-mail transmission. Vice versa, if the elements of the delivery information, those according to the inventive method as reliable it is possible to be viewed to consider, whether all reliable Elements of transmission information about encoding contain. It is possible, based on the records of the degree of strength of the encoding the strenght the incoming encryption find out, for example, by selecting those elements of the delivery information, the weakest Degree of encryption exhibit). In the next Step, the domain name in the sender information in one MX query used over a domain name service is performed. This MX query results in a number of MX servers. Subsequently, will to one of the MX servers (included in the series of MX servers) over one Simple Mail Transfer Protocol (SMTP) performed a connection test to to consider, whether the MX server uses the email encryption support and how high the degree of strength the encryption is. The degree of resulting encryption can be defined by the weakest Degree of degrees of encryption strength is selected the one related by the test connections to the MX servers is determined by the domain name. The level of incoming traffic encryption and the degree of encryption of the outgoing traffic are separated in the header or in the header inserted by emails or, if necessary, combined to a degree that the overall strength of the encryption represents.

In summary should mention the following aspects become. The method may be at least in the header of an e-mail (in the "From" field and / or in the "Reply to" field) insert one of the following: a) a forgery notice, indicating that the sender information is incorrect, b) an encryption indication, indicating that at least one encryption technique in the transmission has been used. additionally or alternatively, at least one of the following notations may be in the header be added to the e-mail: (c) a level of security that determines the likelihood of the accuracy of the Sender information indicates and d) the degree of strength of the Encryption.

Possible dissymmetry signs in connection with the transmission channel can displayed by the "From" field as well as the "Reply To" field for the message the above information a), b), c) and / or d) are used. For example, if an email in a secured transfer has arrived, but the answer e-mail will go off in an unsecured transmission would, becomes an encryption hint inserted in the "From" field and in the "reply to" field an indication that the encryption has been omitted.

An e-mail application must function in a standard manner to communicate the information a), b), c) and / or d) to the recipient of an e-mail. If the recipient of the e-mail (not the e-mail reply) receives the e-mail, the e-mail application displays in the "From" field the text indicating a), b), c) and / or d) contains. If the e-mail is answered, ie the answer e-mail ge is sent, the e-mail application that works in the regular way will extract a string from the "Reply to" field and use it as the reply address. If the end of the string contains the information a), b), c) and / or d), this information will be sent to the sender of the reply e-mail. Thus, the sender of the reply e-mail sees the information in the "To" field of the reply e-mail. Based on the information, the sender of the e-mail can determine the correctness of the recipient's address and the way in which the e-mail is transmitted. For example, if the e-mail has arrived secured, but the reply e-mail is sent unsecured, the sender of the reply e-mail will be notified before sending the reply e-mail. Then he / she can take this into account in the content of the reply e-mail. The mere encryption of an e-mail creates security, but security is closely related to the accuracy of the recipient's addresses (for example, security is not given when sending a well-encrypted e-mail to a completely wrong organization).

In addition to According to the method, the invention comprises a server for authentication the sender of an e-mail and the communication of the exchange information the e-mail. The server is configured to take the steps of explained above Perform procedure.

5 shows a server according to the invention. The server 501 is used to authenticate the sender of an e-mail 502 , The server 501 who sent the e-mail 502 receives, includes means 503 for generating a list of those elements of the delivery information inserted into the e-mail by at least one server involved in the transmission of the e-mail. In addition, the server includes 501 at least means for the exam 505 and means for an IP comparison 506 , The procedure processes the list 504 with the means for the exam 505 from an element of the delivery information inserted in the e-mail from a server located in front of the server receiving the e-mail. The means for the IP comparison 506 are used in the processing of the list. These means are designed to a) from the means for testing 505 to obtain an item of the delivery information, b) in a first domain name request, to request a fully qualified domain name corresponding to an IP address in the element of the delivery information, c) in a second domain name request to request an IP address which corresponding to the fully qualified domain name, d) comparing the IP address of the first domain name request with the IP address of the second domain name request, and if the IP addresses are the same, e) the domain name to the means for checking 505 to convey. The means for the exam 505 are configured to read f) a domain name associated with the sender of the e-mail, g) compare the read domain name with the domain name transmitted by the means for IP comparison, and h) the sender information as interpret correctly if the compared domain names match each other.

The server according to the invention comprises at least the means 503 . 505 , and 506 , In addition to these, the server can 501 have additional funds and the funds for the audit 505 may be configured to perform actions other than the aforementioned actions f), g) and h).

To speed up the editing of the list 504 remove the funds for the exam 505 preferably from the list each item of the delivery information added by a server found in a list of trusted IP addresses. Then the list gets shorter and the funds for the IP comparison 506 need to be used less than before.

The server 501 can also provide funds for heuristics 507 exhibit. These remedies check, by a heuristic process, a portion of the domain names left over when the last two strings separated by a dot are removed at the end of the full domain name. The means for the IP comparison 506 get this fully-qualified domain name in the second domain name request.

If the server 501 the funds for heuristics 507 contains, will be the means for the exam 505 adjusted to the sender information of the e-mail 502 interpreted as correct if the means for the heuristic indicate that it is a non-dynamic network address.

If necessary, the test equipment 505 further adapted to that of the funds for the IP comparison 506 get searched domain names in a list of conquered servers. Normally, the sender information of an e-mail is considered correct only if each searched domain name does not appear in the list of the conquered servers.

The test equipment 505 are further adapted to perform the following actions: 1) using the full domain name of the first domain name query as the search term, resulting in MX information search, 2) using at least one fully qualified domain name from the MX information in a domain name request, and 3) interpretation of the Elements of delivery information considered correct when some fully-qualified domain names in the MX information in a domain name request generate an IP address that corresponds to the IP address inserted in the element of the delivery information.

If necessary, perform the test equipment 505 in connection with the further verification of the sender information, the following actions: 1) using the domain name associated with the sender information as a search term in a search for MX information, 2) comparing with at least the complete domain name corresponding to the IP address of the element of the transmission information a fully qualified domain name from the MX information; and 3) interpreting the sender information as correct if the compared fully qualified domain name corresponds to some domain name of the MX information.

With regard to the additional verification of sender information, the testing equipment 505 further adapted to use the IP address of the second domain name request as a search term to obtain information about an owner organization in a RIPE database and then to compare the owner organization information from the database request with the domain name from the first domain name request.

The server 501 preferably comprises notation means 508 that are capable of entering in the header or header information of the e-mail at least one of the following: a) an error indication indicating that the server judges the sender information as incorrect, b) an encryption indication indicating that at least one encryption technique c) a level of security indicating the likelihood that the sender information is correct, and d) an encryption strength indicating how strong the encryption method is when transmitting the e-mail were used. This information will be included in the e-mail sent by the server that has the same content (text and / or attachment files) as the e-mail 502 that this server has received.

In addition to In the above examples, there are other ways to implement the method and server according to the invention. These possibilities are obvious to the person skilled in the art on the basis of his / her professional abilities and the instructions obtained from this patent application.

The Invention is in the attached claims regarding the method and the server.

Summary

The The invention relates to a method for authenticating a Sender of an e-mail. The method examines elements of the delivery information the e-mail, i. the items in recipient fields are checked based on an element of the transmission information, the was inserted in the e-mail from a server which is the server, who received the e-mail is upstream. The transmission information (Receiver fields) are examined until either an unreliable element of the transmission information is found or there are all elements of the transmission information with processed a so-called reverse IP verification. If all Elements of the transmission information be processed, the element of the transmission information, which was first entered in the email, reviewed. In this exam will be a domain name obtained by reverse IP verification compared with a domain name contained in the sender information of the e-mail. If the domain names match each other, the sender is the email successfully authenticated. About that In addition, the invention comprises an e-mail server operating according to the method is working.

Claims (22)

A method for authenticating a sender of an e-mail, the method being characterized in that in a server that has received the e-mail, a list of elements of delivery information generated by at least one server involved in the transmission of the E-mail is involved, in which e-mail has been inserted, the list is checked, starting with an element of the delivery information that has been inserted into the e-mail by the server, the server that has received the e-mail preceded, wherein the exam comprises the steps of, in a first domain name request, a fully qualified domain name corresponding to an IP address inserted in the element of the delivery information, fetching, in a second domain name request, an IP address corresponding to the fully qualified domain name, comparing the IP address used in the first domain name request with the one from the e.g. wide domain name request received IP address, and if the compared IP addresses are the same checking the next element of the delivery information, if the item of delivery information is the last item in the list, comparing the fully qualified domain name to the sender information of the e-mail containing a domain name associated with the sender of the e-mail and setting the sender information as correct if the compared domain names correspond to each other. Method according to claim 1, characterized in that that before the exam from the list every element of the delivery information which is a server that is in a list of trusted IP addresses is findable in which e-mail has been inserted. Method according to claim 1, characterized that the procedure comprises a first additional test in which by means of of a heuristic procedure, a part of the domain name used in the second domain name request was received and of which the last two Strings separated by a dot from the end of the Domain names have been removed, using the heuristic method It is to find out if the part is a dynamic network address or a non-dynamic network address, and if a non-dynamic network address Network address is detected, it is determined that Element of the delivery information correct is. Method according to claim 1, characterized in that that the procedure includes a second additional test, in which one Domain name is searched for in a list conquered server and in case that the domain name is missing from the list of conquered servers, certainly that will be the element of the delivery information correct is. Method according to claim 1, characterized in that that the procedure includes a third additional test, in which of the fully-qualified domain name obtained in the first domain name request was used as search term, whereby the search in MX information (Mail eXchange) results, at least a fully-qualified domain name MX information is used in a domain name request, and some of the fully-qualified MX information domain names generate an IP address in the domain name request, which with the IP address in the item of transmission information corresponds certainly that will be the element of the delivery information correct is. Method according to claim 1, characterized in that that the method comprises an additional check directed to the sender information of the a domain name assigned to the sender as search term is used in a search that results in MX information of the fully-qualified domain name that is in the element of delivery information inserted IP address corresponds to at least one fully qualified domain name compared in the MX information, and if the compared fully-qualified domain name with some of the fully-qualified Domain name in the MX information corresponds it is determined that the sender information is correct. Method according to claim 1, characterized in that that the procedure includes a fourth additional test, in which the in the second domain name query received IP address as a keyword used to provide owner organization information from a RIPE database (RIPE Whois database), the owner information obtained from the database request with the one from the first domain name request obtained domain names are compared and if the domain names each other correspond it is determined that the item of delivery information correct is. Method according to one of claims 1 to 7, characterized that it is determined that an element of the delivery information is correct, if the following conditions are true: a) the item of delivery information is the last element of the delivery information, b) the domain name obtained in the first domain name request the element of the delivery information contains a domain name associated with the sender of the e-mail, and c) at least one performed additional exam indicates that the item of delivery information is correct is. Method according to one of claims 1 to 7, characterized that a level of security, which is the probability of correctness the item of delivery information describes where server is added to sender information, the higher the probability, the higher the probability Number of performed additional exams indicates that the element (s) of the delivery information is correct is or is. Process according to claim 9, characterized records that the security level with the sender information is stored in a memory on the server that has received the e-mail. Method according to claim 9, characterized in that that at each server, which receives the E-Mail, the security degree the Header information is added to the e-mail. Method according to claim 1, characterized in that that at each server, which receives the E-Mail, to the header information at least one of the following is added to the email: one Error message indicating that the sender information is incorrect was determined, an encryption statement, which indicates that at least one encryption technique is used was when the email over transmit the internet has been. Method according to claim 1, characterized in that that the procedure the following steps at each server, which the Receive email, carries Use one of the sender information associated with the domain name in one MX request that is executed by a domain name service where the MX request results in a number of MX servers, Produce an SMTP connection with each MX server of the discovered MX server, where the SMTP connection indicates if the MX server is encrypting supported by emails and if at least one of the MX servers is encrypting Emails supported Insert a encryption strength in the header information of the e-mail, which indicates how strong encryption technology for one Reply message of the e-mail is usable. Server for authenticating a sender of a E-mail, characterized in that the server comprises medium for generating a list of those elements of delivery information, which by at least one server, the transfer the e-mail involved in the e-mail has been inserted, Means to Check the list, starting with an element of the delivery information, that has been inserted into the email by the server that is the server, which has received the e-mail, precedes, Means for one IP comparison, which are configured from the means for testing an element of the delivery information to obtain, in a first domain name request a fully qualified Domain name to pick, which with one in the element of the transmission information pasted IP address corresponds, in a second domain name request get an IP address that matches the fully-qualified domain name corresponds, by the one used in the first domain name request IP address with the one obtained from the second domain name request Compare IP address, and if the compared IP addresses are the same to transfer the domain name to the means for the exam, the means for the exam are configured to the sender in the e-mail to read assigned domain names, the next element of the delivery information to consider, and for the last item in the list consisting of the elements of the delivery information the domain name compared with the domain name used by the means for the IP comparison was obtained and to determine that Sender information is correct if the compared domain names correspond to each other. Server according to claim 14, characterized that means for the exam are further configured to remove from the list any item of delivery information to remove a server that is in a list of trusted IP addresses is findable in which e-mail has been inserted. Server according to claim 14, characterized that the server comprises means for heuristics configured in such a way are to use a heuristic method, a part of the domain name, the received in the second domain name request and of which the last two strings separated by a period have been removed from the end of the domain name to investigate where the heuristic procedure is to find out whether the part is a dynamic network address or a non-dynamic one Network address is. Server according to claim 16, characterized that means for the exam are further configured to provide the sender information as to interpret correctly when passing the exam with the heuristics indicates that the part refers to a non-dynamic network address. Server according to claim 14, characterized that the testing agent continue to carry a search of the domain name configured in a list of conquered servers are. A server according to claim 14, characterized in that the checking means are further configured to use the fully qualified domain name obtained in the first domain name request as a search word to obtain MX information (Mail eXchange), to use at least one fully-qualified domain name of the MX information in a domain name request and to determine that the element of the delivery information is correct when some of the fully-qualified domain name of the MX information in the domain name request has an IP address which corresponds to the IP address in the element of the delivery information. Server according to claim 14, characterized that the testing agent continue to be configured in this way at a sender assigned Use domain names as search words in a search to get MX information to obtain, around the fully-qualified domain name that with in the element of delivery information pasted IP address corresponds to at least one fully-qualified To compare domain names in the MX information, and the Determine sender information as correct if the compared fully-qualified domain name with some of the fully-qualified Domain name in the MX information corresponds. Server according to claim 14, characterized that the testing agent continue to be configured in this way in the second domain name query received IP address as keyword to use owner organization information from a RIPE database (RIPE WHOIS database), and around the obtained owner organization information from the database request with the one from the first domain name request to compare received domain names. Server according to claim 14, characterized that the server further comprises notation means configured such are to put in the header information of the email at least one of the insert the following information: a) an error indication indicating that the sender information was determined to be incorrect, b) an encryption indication indicating that at least one encryption technique was used when transferring the e-mail over the Internet c) a degree of security which indicates the probability describes the correctness of the element of the transmission information, or d) an encryption strength which the strenght during transmission encryption used in the email displays.