WO2020227801A1 - Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique - Google Patents

Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique Download PDF

Info

Publication number
WO2020227801A1
WO2020227801A1 PCT/CA2019/050639 CA2019050639W WO2020227801A1 WO 2020227801 A1 WO2020227801 A1 WO 2020227801A1 CA 2019050639 W CA2019050639 W CA 2019050639W WO 2020227801 A1 WO2020227801 A1 WO 2020227801A1
Authority
WO
WIPO (PCT)
Prior art keywords
email
sender
receiver
sequence
sequence identifier
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CA2019/050639
Other languages
English (en)
Inventor
William Pearce
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to PCT/CA2019/050639 priority Critical patent/WO2020227801A1/fr
Publication of WO2020227801A1 publication Critical patent/WO2020227801A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • TITLE Method of Detecting an Email Phishing Attempt or Fraudulent Email using
  • Email Bulk electronic mail
  • email domains email service providers
  • the present invention overcomes the disadvantages of the prior art by providing a method of verifying the authenticity of emails sent from a sender to a receiver by verifying the sequential history of the email correspondence between the parties.
  • the emails each have a sender’s email address, a receiver’s email address, and a user- accessible field such as the subject field.
  • the method of the present invention includes the steps of Identifying the receiver for an email to be sent by the sender and then generating a current sequence marker for the receiver.
  • the current sequence marker represents a next predicted sequence identifier in a sequence of emails between the sender and receiver.
  • sequence of emails between the sender and receiver includes 76 messages and the sequence marker is configured to be a numeric integer
  • the last sequence identifier used would be 76 and the next sequence identifier (76 +1 or 77) would result in the current sequence marker being 77.
  • the sequence identifiers comprise alphabetical characters (AA, AB, AC, etc.) and the last sequence identifier used was AG
  • the next predicted sequence identifier would be AH
  • the current sequence marker would be AH.
  • the next step in the method is to insert the current sequence marker into the user-accessible field of the email and then sending the email to the recipient.
  • the sequence marker is formed from a sequence of alphanumeric characters which are human readable.
  • sequence marker is inserted into the subject line of the email allowing the receiver to verify the presence and veracity of the sequence identifier without having to open the email.
  • Figure 1 is a schematic view of the system of the present invention showing the system of the present invention being used to send an email from a Sender A to a
  • the system of the present invention shown generally as item 10, consists of two email-capable computing devices 12 and 14 in communication with each other via a network 16.
  • Network 16 could be a telecom network or cellular data network or a local area network, but for most practical applications, network 16 is the internet.
  • Network 16 is capable of facilitating Simple Mail Transfer Protocol (RFC-5321) for email using Transmission Control Protocol (“TCP”), or other standards or proprietary methods of transporting email, that can send Sender A’s email 22 to Sender A’s email domain 37.
  • Sender A’s email domain 37 then forwards Sender A’s email 22 via Network
  • POP3 Office Protocol RFC-1939
  • IMAP Internet Message Access Protocol RFC- 3501
  • Email addresses such samplename@exampledornain.com include a component on the right side of the @ symbol that signifies an internet email domain address that has servers and related applications or services configured for email hosting, forwarding, and exchange.
  • Examples of Sender A’s email domain 37 and Recipient B’s email domain 38 include “.com” email domains such as Google’s Gmail (e.g., sender@gmail.com),
  • Hotmail e.g., sender@hotmail.com
  • Zoho Mail e.g., sender@zoho.com
  • Yahoo! Mail e.g., sender@yahoo.com
  • country-specific email domains such as Sympatico.ca, Hotmail.fr, and Yahoo.co.uk, and others
  • other email domain servers and processes compliant with the respective RFC protocols and standards for email messaging e.g., sender@yahoo.com
  • Data source 20 contains data about email contacts, e.g., a bulk email sender’s client base, and also contains data about the history of previously sent email messages. It is essential that data source 20 contains the contact information of recipients and be operative for the storage and retrieval of sequence identifier 26 for each recipient.
  • data source 20 could be operative in several forms, including (i) a traditional relational database such as Microsoft SQL Server; or (ii) a delimited text file database containing the contact information of recipients and sequence identifier 26 for each recipient; or (iii) a data file containing the contact information of recipients and sequence identifier 26 for each recipient; or (iv) a record of previously sent emails (hereinafter referred to as the“email history”) stored in their native format within, or otherwise accessible by Sender A, Sender A’s email application 18, and process 2; or (v) some other record of, or copy of, the email history that contains the contact information of recipients and sequence identifier 26 for each recipient.
  • a traditional relational database such as Microsoft SQL Server
  • a delimited text file database containing the contact information of recipients and sequence identifier 26 for each recipient
  • a data file containing the contact information of recipients and sequence identifier 26 for each recipient or
  • a record of previously sent emails hereinafter referred to as the“email history”
  • data source 20 is a traditional database, a data file, or an email history, it is accessible by and interoperable with the other components of the present invention, as described herein.
  • Data source 20 includes data about the components of previously sent emails from
  • Sender A to email recipients may also include the full or partial text and other data
  • MIME types that comprise previously sent emails, including (i) email header fields such as subject line 36 and recipient email address 24, and (ii) the message body of previously sent email messages.
  • data source 20 Regardless of where data source 20 resides, or whether data source 20 is a traditional database or another form of accessible email history, its purpose is to contain information about previously sent emails, including the email addresses 26 of email recipients and sequence identifier 26 for each recipient, or next sequence marker 30 for each recipient, or both sequence identifier 26 and next sequence marker 30 for each recipient.
  • data source 20 is an accessible email history of previously sent emails
  • the contact information of recipients and also sequence identifier 26 is retrievable or discernible. For example, by reading the email history, such as those found in a data folder of previously sent emails within email application 18 or located somewhere else on computing device 12, Sender A (manually) or process 2
  • Sender A’s computing device 12 is a network- 16-enabled device such as a desktop or laptop computer, a smartphone, tablet, smart TV, or another type of device.
  • Computing device 12 could be a single device, a server, or a plurality of servers and devices, and is configured as a bulk email sender and uses email application(s) 18, and possibly also process 2, to send emails to clients Such as Recipient B.
  • Email application 18 may reside on the local computing device 12 or a local server, or be accessible via the network 16 (the“internet” or“cloud”).
  • Computing device 12 and email application 18 also have access to a data source 20 (as a database or an accessible email history) that may reside on the local device 12, or a local server, or a local network, or somewhere within the cloud, or on the email sender’s email domain 37.
  • a data source 20 (as a database or an accessible email history) that may reside on the local device 12, or a local server, or a local network, or somewhere within the cloud, or on the email sender’s email domain 37.
  • data source 20 is operatively coupled to email application 18.
  • computing device 12 is configured to send email message(s) 22 from Sender A to Recipient B, and more particularly between computing devices 12 and 14 which are operated or otherwise controlled by Sender A and Recipient
  • Receiver B’s computing device 14 is a network- 16-enabled device such as desktop or laptop computer, a smartphone, tablet, smart TV, or another type of device.
  • Receiver B’s computing device 14 has access to email application 18 which is (i) an email application such as Microsoft Outlook, or other application, that resides on computing device 14; or (ii) an internet-based or cloud-based email service such as Google’s Gmail or Microsoft’s Hotmail which is accessible by a web browser such as
  • Names of email message recipients, email address(es) 24 and other relevant information about a plurality of contacts are stored in data source 20 (as a database or an accessible email history).
  • Data source 20 is operatively coupled to sequence identifier 26.
  • sequence identifier 26 is to enumerate each email communication from Sender A to each of Sender A’s individual recipient contacts and to maintain a component of data source 20 (as a database or an accessible email history) for each contact, such that every successive email from Sender A to each of its contacts is identified by the next value in a predictable sequence that is intuitively known and understood in the recipients’ language and/or culture.
  • this predictable sequence consists of the standard Arabic whole numbers, and the number 76 represents the most recent sequence marker from the emails that have previously been sent from Sender A to Recipient B, and in this example the number 77 represents the next sequence marker 30 that would be used in a future email being sent from Sender A to Recipient B.
  • Sender A's sequence identifier 26 for its email correspondence with Recipient B consists of a simple incrementing Arabic numerical sequence. (In the first email communication from Sender A to Recipient B, a starting email sequence number would have to be used. This starting sequence number could be the Arabic numeral 1 or could be another number used to start a sequence.)
  • Recipient B may notice that the sequence marker for the most recent email correspondence was 76, and that, therefore, the sequence marker for the next legitimate and expected email from Sender A should be 77.
  • MIME types to support multimedia messages, and therefore would be able to expand the range of potential sequence markers significantly: for example, pictures or icons could be used to display a recognizable sequence.
  • IMF Internet Message Format
  • IETF Internet Engineering Tash Force
  • IETF Internet Engineering Tash Force
  • the email application 18 that creates the single line of characters for the header field defined as “subject:” 36
  • next sequence marker 30 (commonly referred to as the“subject line” of the email) would execute an alternative process 2 that programmatically inserts an appropriate next sequence marker 30 after the subject field name and colon that defines the header of subject line 36 and anywhere within the subject line 36.
  • the next sequence marker 30 becomes embedded within and is part of email subject line 36.
  • next sequence marker 30 In addition to placing the next sequence marker 30 within the subject line 36 of the email message, the next sequence marker 30 could be inserted anywhere within the portion of the email that is visible to the recipient upon opening the email inbox in application 18; that is, in the areas reserved, pursuant to the specifications in RFC-5322 (and other RFC specifications for transporting email), for the name of the sender (known as“name:”) or near the beginning of the first text line of the body of the email.
  • subject line 36 Since in many email applications 18 the subject line 36 is immediately visible without the body of the email message being visible until the email message is actually opened, it is the best use of the present invention to have subject line 36 of the email be the location where the next sequence marker 30 would be inserted manually by Sender A using email application 18, or programmatically using process 2 and email application 18. Using the next sequential marker 30 in subject line 36 means it is easier for Recipient B to quickly and more easily identify a potential phishing attempt because Recipient B likely does not need to fully open email message 22 to see the next sequential marker 30.
  • Application 18 and process 2 are configured to send email messages from computing device 12 to computing device 14 by extracting information from data source
  • the email address is a field in email 22 before sending the email.
  • the email address is a field in email 22 before sending the email.
  • Recipient B is extracted from data source 20 and inserted into the destination email address field 32 in email 22.
  • Sender A manually reads information from data source 20 (as a database or an accessible email history) and manually fills in various fields in email 22, including using the next sequence marker 30 in the subject line 36 or in another part of the email, before sending the email using email application 18.
  • Sender A could read the components of data source 20 (as a database or an accessible email history) to determine next sequence marker 30.
  • Sender A could rely on other methods to track sequence identifier 26 and next sequence marker 30 for Recipient B and other contacts, such as (i) simply using human memory to track these; or (ii) tracking these using a written paper record; or (iii) tracking these using another database, computer application, or computer file stored on computing device 12 or another device or system accessible by Sender A; or (iv) tracking these using another method.
  • Sender A instead of relying on process 2 to programmatically insert next sequence marker 30, Sender A could manually insert the next sequence marker 30 into the subject line 36, or into another part of the email, to help detect and prevent email phishing attempts using sequential email numbering.
  • Email application 18, using process 2 also automatically inserts Sender A’s name
  • Sender (“sender's name:” as defined in RFC-5322 and other protocols for transporting email) and email address 34 into the sender’s email address field (“Sender:” as defined in RFC-5322 and other protocols for transporting email) 34 and the original subject text of the email into the“subject:” 36 field.
  • Sender
  • A would manually insert the data for these email fields while constructing the email message using email application 18.
  • Applications 18, process 2 and data source 20 (as a database or an accessible email history) then operate together to retrieve the last sequence identifier 26 for that recipient from the components in data source 20 and generate a new next sequence marker 30 by, in this embodiment, arithmetically increasing it by one from 76 to 77.
  • Process 2 then updates the sequence identifier for Recipient B in data source 20, if appropriate, and stores or saves the sequence identifier 26, or next sequence marker 30; or both sequence identifier 26 and next sequence marker 30; or a marker, indicator or other data to represent or compute at a later time the value for either sequence identifier 26 or next sequence marker 30, or both; pending retrieval for the next email from Sender
  • data source 20 may also be stored in data source 20 (as a database or an accessible email history), along with the sequence identifiers and sequence markers; however, if data source 20 takes the form of an email history, then it might not be necessary to store or save information about sequence identifier 26 or next sequence marker 30 in the database components since the email history can simply be read when needed by Sender A or process 2 to determine what the sequence identifier 26 is and what the next sequence marker 30 will be.
  • Sender A’s email application 18 When Sender A’s email application 18 communicates to its host email domain 37, it may comply with IMF and SMTP, or it may use an alternate protocol, standard or proprietary method for transporting email. Alternatively, a web browser application may be used to communicate to an internet host that is coupled to an email domain 37. In either case, the precise communication method between application 18 and the sending host domain 37 and receiving host domain 38 is not material for the purposes of the present invention; however, when Sender A’s host email domain 37 communicates xvith other email host domains or transmission agents, it must comply with IMF and SMTP.
  • the present invention can utilize either US-ASCII characters, or the other data types or character sets in other standards that allow for values outside of the US-ASCII range of 1 through 127, to detect an email phishing attempt or fraudulent email using sequential email numbering
  • Sender sender A.address@sender Adomain. com
  • next sequence marker 30 in the present invention has been applied to the“subject:” line 36, but is not strictly at the beginning of the subject tine:
  • next sequential identifier 30 could be inserted within the subject line 36 immediately after the header (“Subject :”) or anywhere within the subject line 36, including in the middle or at the end of the subject line 36.
  • the next sequence marker 30 is thus added to the original text intended for the“subject:” line 36 and the combined text is inserted into the“subject:” line 36.
  • the next sequence marker 30 could be at the beginning of the text of the subject line, anywhere within the subject line text, or at the end of the subject line text, as demonstrated in the following three examples: (i) Subject: 77 - Another chance to save with this special offer; (ii) Subject: Another chance to save with this special offer - 77; and (iii) Subject: Another chance - 77 - to save with this special offer.
  • the present invention inserted next sequence marker 30 into the email subject line
  • Sender A could have determined the next sequence marker 30 by referencing the components in data source 20 and manually creating an email message using email application 18 (without using process 2) and manually inserting the next sequence marker 30 within the subject line 36.
  • other applications could have intercepted the «nail at a later stage and inserted the next sequence marker 30 programmatically, prior to the email leaving the host domain 37 for transmission to the recipient, if no sequence marker 30 was found in the subject line 36 or in another email message header field, message body, or any other part of the email message.
  • next sequence marker 30 is not limited to being in subject line 36 and so it could be placed: (i) anywhere within the sender’s name field (“Sender:”) which, as described in RFC-5322, Section 3.4, is an email header field for“an optional display name ...
  • next sequence marker 30 could be inserted anywhere within the email 22, as described above, if the next sequence marker 30 were located within subject line 36, this would be in keeping with the RFC protocols and related standards for email messaging: as set forth in RFC-5322, Section 3.6.5, the subject line 36 is“intended to have only human-readable content with information about the message” and so acts an appropriate container for next sequence marker 30 and allows the present invention to function properly without deviating from RFC-5322 and related standards for transporting email messages.
  • the present invention assists its human users in recognizing and understanding the significance of sequence identifier 26 and sequence marker 30 (which in this embodiment are similar to page numbers). Once the human user has recognized or learned of the significance of the sequence identifier(s), no further or prior specialized knowledge is required.
  • Recipient B may be assisted in understanding that an email purporting to be from
  • Sender A but that is lacking either the correct next sequence marker 30 or any sequence marker at all may be a phishing or fraud attempt and should be considered to be suspicious and worthy of further investigation.
  • This assistance could come if some combination of email application 18, data source 20 (as a database or an accessible email history) and process 2 alerted Recipient B if the next sequential marker 30 that was received as part of email message 22 does not match the expected sequential identifier; that is, if the sequence is out of order.
  • Email application 18, interoperating with other components, could, for example, change the email message to a different colour, alert
  • Recipient B using an on-screen message on computing device 14, or. otherwise provide a notification to Recipient B that an email may be a potential email phishing attempt and should be treated as a suspicious email message.
  • Recipient B could also instead manually compare the next sequence marker 30 to sequence identifier 26 to determine whether an email is a potential phishing or fraud attempt
  • the present invention thus allows Recipient B, a client of a bulk email sender, to detecting email phishing attempts, or other fraudulent emails, using sequential email numbering and the other components and processes of the present invention.
  • the email domain 37 may insert the next sequence marker
  • the process of the present invention could be applied to any email whatsoever, including any person, entity, or process(es) capable of sending email and embedding the next sequence marker 30 within the subject line 36 or any other part of the email message, include header fields and the body of the email message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

La présente invention concerne un procédé de vérification de l'authenticité de courriers électroniques envoyés d'une première application de courrier électronique d'un expéditeur à une seconde application de courrier électronique d'un destinataire, les courriers électroniques ayant chacun une adresse de courrier électronique de l'expéditeur, une adresse de courrier électronique du destinataire et un champ accessible par l'utilisateur pour recevoir un contenu. Le contenu du champ accessible par l'utilisateur est visible par le destinataire lors de l'ouverture d'une boîte de réception de courrier électronique dans la seconde application de courrier électronique. Le procédé consiste d'abord à identifier le destinataire d'un courrier électronique devant être envoyé par l'expéditeur. Un marqueur de séquence actuelle pour le destinataire est ensuite généré. Le marqueur de séquence actuelle représente un identifiant de la séquence suivante dans une séquence de courriers électroniques entre l'expéditeur et le destinataire. Le marqueur de séquence actuelle est ensuite inséré dans le champ accessible par l'utilisateur du courrier électronique et le courrier électronique est ensuite envoyé.
PCT/CA2019/050639 2019-05-13 2019-05-13 Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique Ceased WO2020227801A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CA2019/050639 WO2020227801A1 (fr) 2019-05-13 2019-05-13 Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CA2019/050639 WO2020227801A1 (fr) 2019-05-13 2019-05-13 Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique

Publications (1)

Publication Number Publication Date
WO2020227801A1 true WO2020227801A1 (fr) 2020-11-19

Family

ID=73290109

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CA2019/050639 Ceased WO2020227801A1 (fr) 2019-05-13 2019-05-13 Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique

Country Status (1)

Country Link
WO (1) WO2020227801A1 (fr)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020144154A1 (en) * 2000-12-06 2002-10-03 Tomkow Terrence A. System and method for verifying delivery and integrity of electronic messages
US20050144451A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing electronic message authentication
US20070022469A1 (en) * 2005-07-20 2007-01-25 Cooper Robin R Network user authentication system and method

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020144154A1 (en) * 2000-12-06 2002-10-03 Tomkow Terrence A. System and method for verifying delivery and integrity of electronic messages
US20050144451A1 (en) * 2003-12-30 2005-06-30 Entrust Limited Method and apparatus for providing electronic message authentication
US20070022469A1 (en) * 2005-07-20 2007-01-25 Cooper Robin R Network user authentication system and method

Similar Documents

Publication Publication Date Title
US7835294B2 (en) Message filtering method
US7882189B2 (en) Using distinguishing properties to classify messages
US7058684B1 (en) Device, method, and storage medium to block junk email
US7664812B2 (en) Phonetic filtering of undesired email messages
US7930351B2 (en) Identifying undesired email messages having attachments
US7103599B2 (en) Parsing of nested internet electronic mail documents
US20030110227A1 (en) Real time streaming media communication system
US20210329007A1 (en) Method of Using Sequential Email Numbering to Detect an Email Phishing Attempt or Fraudulent Email Within an Email Domain
JP2008502998A (ja) サーバーへの電子メッセージのコンテンツについての通信情報
US11601440B2 (en) Method of detecting an email phishing attempt or fraudulent email using sequential email numbering
US20230291767A1 (en) Method of Detect an Email Phishing Attempt or Fraudulent Email Within an Email Domain
US8140628B2 (en) Enforcing conformance in email content
US7962557B2 (en) Automated translator for system-generated prefixes
JP3909162B2 (ja) メール装置および記録媒体
CA3064380A1 (fr) Methode d'utilisation de la numerotation du courriel sequentielle pour detecter une tentative d'hameconnage par courriel ou un courriel frauduleux a l'interieur d'un domaine de courriel
JP2005135024A (ja) 迷惑メール遮断方法及び迷惑メール遮断プログラム
WO2020227801A1 (fr) Procédé de détection d'une tentative d'hameçonnage par courrier électronique ou d'une utilisation frauduleuse de courrier électronique
US12238052B2 (en) Method of detecting incomplete instant messaging record sets using sequential numbering
US12238083B2 (en) Method of detecting incomplete electronic record sets using sequential numbering
JP5051664B2 (ja) メール誤送信防止装置およびメール誤送信防止方法
JP2003141033A (ja) 誤送防止電子メール・システム
WO2020227803A1 (fr) Procédé de détection d'ensembles d'enregistrements électroniques incomplets au moyen d'une numérotation séquentielle
US20250260720A1 (en) Method and system for usable phishing preventive information systems
JP3938577B2 (ja) 悪戯メール防止装置、その方法及び記録媒体
JP4334210B2 (ja) メッセージ提供システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19928566

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19928566

Country of ref document: EP

Kind code of ref document: A1

WWG Wipo information: grant in national office

Ref document number: 202147054808

Country of ref document: IN