Email Sender and Reply-To Authentication to Prevent Interception of Email Replies

Abstract

An electronic messaging system that reviews content of inbound messages, verifies elements of header fields, and initiates an action if Name (N) and Address (A) of From (F) and Reply-To (R) elements of header fields match or do not match, those elements being N F =N R and A F ≠A R , to protect recipients against inadvertent routing of their reply email to an imposter of the named From sender, thereby mitigating risk of recipients falling prey to what is referred to herein as “Reply-To Whaling” attacks, within the email security category of anti-phishing.

We claim: 
     
         1 . An emailing system comprising:
 a processor programmed using programming commands to review content of inbound messages, verify elements of the email header fields of the inbound message, and to initiate an action if the elements of the header fields match or do not match;   wherein the elements being analyzed are N F =N R  and A F ≠A R .   
     
     
         2 . The system as described in  claim 1 , wherein the initiated action is an alert message. 
     
     
         3 . The system as described in  claim 1 , wherein the initiated action is moving the message to a different folder resident in a memory associated with processor. 
     
     
         4 . The system as described in  claim 1 , wherein the initiated action is sending an alert to both an email address in a TO and a FROM email header field of the inbound message. 
     
     
         5 . An emailing system, comprising:
 a server separate from a sender email client, the server programmed using programming commands to review content of inbound messages to the server, the programming commands of the server configured to execute the following commands:
 if A R ≠Null (empty field) and If N F =N R  and A F ≠A R , perform a special action on the message, and 
 otherwise process the inbound message in a normal manner. 
   
     
     
         6 . The system as described in  claim 5 , wherein the special action is an alert message. 
     
     
         7 . The system as described in  claim 5 , wherein the special action is moving the message to a different folder. 
     
     
         8 . The system as described in  claim 5  where the special action is sending an alert to both the email address in the TO and FROM email header fields of the inbound message. 
     
     
         9 . The system as described in  claim 5 , wherein the special actions may be marking the message with an alert or other marking and then processing the inbound message by sending it to the recipient of the inbound message, quarantining the message, putting the inbound message into a special folder, adding a header to the inbound message, deleting the inbound message, sending a separate message to the From header email address of and the To message header email address of the inbound message, or other actions other than or in addition to normal message sending. 
     
     
         10 . A system including an email client comprising:
 a processor disposed in the email client, the processor programmed with programming commands to review content of inbound messages after an end user of the email client initiates an action to a received inbound message, and to verify elements of the received inbound message header fields, and to initiate an action if the elements of the header fields match or do not match;   wherein the elements verified are N F =N R  and A F ≠A R .   
     
     
         11 . A system as described in  claim 10 , wherein the initiated action is one or more actions are selected from the group of actions consisting of opening the message, replying to the message, replying-all to the message, forwarding the message, and viewing the message. 
     
     
         12 . An emailing system having a server separate from a sender, comprising:
 a processor programmed using programming commands to review content of an inbound message received by the server, the processor programmed to determine if A R ≠Null (empty field) and if N F =N R  and if A F ≠A R , the processor being further programmed using programming commands to perform a special action on the message, otherwise the processor is programmed to process the inbound message in normal manner.   
     
     
         13 . The emailing system as described in  claim 12 , wherein the special action is an alert message. 
     
     
         14 . The emailing system as described in  claim 12 , wherein the special action is moving the message to a different folder. 
     
     
         15 . The emailing system as described in  claim 12 , wherein the special action is sending an alert to both the email address in the TO and FROM email header fields of the inbound message. 
     
     
         16 . The emailing system as described in  claim 12 , wherein the special action is one or more of actions selected from the group of actions consisting of marking the inbound message with an alert or other marking and then processing the inbound message by sending it to the recipient, quarantining the inbound message, putting the inbound message into a special folder, adding a header to the inbound message, deleting the inbound message, sending a separate message to the From message header email address and the To message header email address of the inbound message, or any other actions other than or in addition to normal message sending. 
     
     
         17 . An email system, comprising:
 a processor programmed using programming commands to review content of headers of inbound messages, and if the processor determines that A R ≠Null (empty field) and if N F =N R  and if A F ≠A R , the processor is programmed to perform a special action on the inbound message, otherwise the processor is programmed to process the inbound message in a normal manner.   
     
     
         18 . An email system comprising:
 a processor programmed using programming commands to review content of headers of inbound messages, and if the processor determines that A F ≠A R , the processor is programmed to perform a special action on the inbound message, otherwise the processor is programmed to process the inbound message in a normal manner.   
     
     
         19 . The system as described in  claim 18 , wherein the special action is an alert message. 
     
     
         20 . The system as described in  claim 18 , wherein the special action is moving the message to a different folder. 
     
     
         21 . The system as described in  claim 18 , wherein the special action is sending an alert to both the email address in the TO and FROM email header fields. 
     
     
         22 . An emailing system with a server separate from a sender, comprising:
 a processor programmed by programming commands to review content of an inbound message on the server, and if the processor determines that A F ≠A R , the processor is programmed to perform a special action on the inbound message, otherwise the processor is programmed to process the inbound message in a normal manner.   
     
     
         23 . The system as described in  claim 22 , wherein the special action is an alert message. 
     
     
         24 . The system as described in  claim 22 , wherein the special action is moving the message to a different folder stored in a memory associated with the processor. 
     
     
         25 . The system as described in  claim 22 , wherein the initiated action is sending an alert to either the email address in the TO or FROM email header fields of the inbound message, or to send the alert to the email address of both the To and From email header fields of the inbound message. 
     
     
         26 . A system having an email client, comprising:
 a processor disposed in the email client, the processor programmed with programming commands to review content of inbound messages after an end user of the email client initiates an action to a received inbound message, and to verify elements of the received inbound message header fields, and to initiate an action if the elements of the header fields match or do not match;   wherein the elements verified are A F ≠A R .   
     
     
         27 . The system as described in  claim 26 , wherein the action is clicking a REPLY button, a REPLY-ALL button, or a FORWARD button in a user interface of the email client. 
     
     
         28 . The system as described in  claim 26 , wherein the action is displaying an alert message. 
     
     
         29 . The system as described in  claim 26 , wherein the action is moving the message to a different folder stored in a memory associated with the processor. 
     
     
         30 . The system as described in  claim 26 , wherein the action is sending an alert to both the email addresses in the TO and FROM email header fields of the inbound message. 
     
     
         31 . A system having an email client, comprising
 a processor disposed in the email client, the processor programmed using programming commands to review content of an inbound message after the user of the email client initiates an action to the inbound message, the programming commands of the processor configured to determine if A R ≠Null (empty field) and If N F =N R  and A F ≠A R , perform a special action on the message, otherwise process the inbound message in a normal manner.   
     
     
         32 . The system as described in  claim 31 , wherein the user initiated action is clicking a REPLY button in the email client user interface. 
     
     
         33 . The system as described in  claim 31 , wherein the special action is displaying an alert message. 
     
     
         34 . The system as described in  claim 31 , wherein the special action is moving the message to a different folder stored in a memory associated with the processor. 
     
     
         35 . The system as described in  claim 31 , wherein the special action is sending an alert to both the email address in the TO and FROM email header fields. 
     
     
         36 . The system as described in  claim 31  wherein, the special action is sending an alert to both the email address in the TO and FROM email header fields of the inbound message. 
     
     
         37 . An emailing system having a server disposed on an outbound message path toward an email address contained in an originally received reply-to message header address, the server being separate from a recipient having the reply-to email address, comprising:
 a processor associated with the server, the processor programmed using programming commands to review content of an inbound message received by the server, the processor programmed to determine if A R ≠Null (empty field) and if N F =N R  and if A F ≠A R , the processor being further programmed using programming commands to perform a special action on the message, otherwise the processor is programmed to process the inbound message in normal manner.   
     
     
         38 . An emailing system with a server disposed on an outbound message path, the server separate from a forward recipient, comprising:
 a processor associated with the server, the processor programmed using programming commands to review content of a message received on the server from an original recipient of the message, the message having been forwarded by the original recipient to a forward recipient, the processor also being programmed to analyze message headers of the received message, and if A R ≠Null (empty field) and if N F =N R  and A F ≠A R , the processor being further programmed using programming commands to perform a special action on the message, otherwise the processor is programmed to process the inbound message in normal manner.