With the rapid growth of the Internet, the use of electronic mail (email) has become a valuable and indispensable tool for digital communications, especially in business transactions and personal communications. It is inexpensive, quick, and easy to use. Unfortunately, a significantly large proportion of email accounts and system have been inundated with “spam” or “junk mail” (hereinafter “spam”). Spam has grown to such a degree that it is effectively devaluing the use of email. Spam generally refers to unsolicited electronic messages sent to an unacceptably large number of email addresses. A “spammer” is a person or organization that generates the spam.
While spam can be a commercial advertisement or non-commercial bulk email that advocates some political or social position, some spam harms or damages the user or his computer. For example, many spam emails are used to advertise objectionable, fraudulent, or dangerous content, such as pornography, illegal pyramid schemes or to propagate financial scams. Spam may also pose serious security problems to a user's computer since spam emails are frequently used to propagate worms, viruses, Trojan horses, phishing attacks, malware, spyware, adware, extortion-ware, time bombs, cancelbots and other malicious software. Spam emails may also be used to download or activate dangerous code, such as Java applets, Javascript, and ActiveX controls. Email programs that support Hypertext Markup Language (HTML) can download malicious Java applets or scripts that execute with the mail user's privileges and permissions. Email has also been used to activate certain powerful ActiveX controls that were distributed with certain operating systems and browsers. In this case, the code is already on the user's system, but is invoked in a way that is dangerous. For instance, this existing code can be invoked by an email message to install a computer virus, turn off security checking, or to read, modify, or delete information on the user's disk drive.
Spam also depletes and wastes an organization's time, resources, network bandwidth, disk space, and system memory. It also uses valuable time to organize, filter and delete the spam. Many valid non-spam email messages may also be lost in this process. Much spam also comes from illegitimate advertisers posing or advertising as well-known companies or products.
Although various solutions have been implemented to block spam, they do not block all spam or prevent the same spammer from sending additional spam. For example, centralized and localized blacklists are common ways of blocking known spammers, but they do not block all spammers because spammers frequently change or alter the name of the sender in the email header. Whitelists are also common, but are so restricted that they nearly always block valid, non-spam email messages. Spam can also be blocked by blocking email that comes from nonexistent domains that cannot be found in the Domain Name System (DNS). However, this also results in blocking some valid email messages while failing to block other spam email. Bcc filtering may be used to reject email from unknown hosts that do not list the recipient's email address in the header of the message, but this fails to block those emails that do list the recipient's email address in the header. Filtering of client protocols such as POP3 provides relief to individual users, but still allows junk mail to be stored on the SMTP server. Other methods also include greylisting and Bayesian filtering. Unfortunately, spammers adapt and adjust to each method of eliminating spam, and thus each of the above described methods are only useful in a multi-layered approach to spam filtering. Furthermore, each of these methods fails to distinguish between valid and legitimate advertisements from the true, original advertisers, particularly when a user has requested certain advertisements.
In one of many possible embodiments, the present systems and methods provide a system for managing email and eliminating spam wherein an email client is configured to receive digitally signed email, identify spam email, and allow a user to report digitally signed spam to a certificate authority issuing the attached digital certificate. An email client as used herein could be a plug-in for existing email systems, a network monitor, a mail box monitor stored on a server, a specially designed email program, or any other method of monitoring emails coming into a mail server.
Another embodiment provides a system for eliminating spam that includes a certificate authority, wherein the certificate authority is configured to receive spam reports from one or more email clients.
Another embodiment provides a method for eliminating spam by receiving email, determining if the email is spam, and processing any email determined to be spam. Email is determined to be spam by checking the email for an anti-spam digital certificate; if the email is found to have an anti-spam digital certificate, the certificate is checked to determine if the certificate is revoked, and if it is, or if the email has no anti-spam digital certificate, then the email is classified as spam and processed.
Another embodiment provides a method for eliminating spam, including the steps of issuing a digital certificate to an advertiser, establishing a certificate account for the advertiser, receiving a spam report from an email recipient, and deducting a value from the certificate account.
The current systems and methods also provide a system for sending email advertisements by obtaining an anti-spam digital certificate from a certificate authority, obtaining a certificate account with the certificate authority, digitally signing an email advertisement with the digital certificate, and sending the email advertisement to an end user email client.
Another method for sending email advertisements includes obtaining an anti-spam digital certificate from a certificate authority, obtaining a certificate account with the certificate authority, digitally signing an email advertisement with the digital certificate, and sending the email advertisement to an end user email client.
Also provided herein is a method for managing email advertisements by receiving an email advertisement, checking the email for an anti-spam digital certificate; if the email is found to have an anti-spam digital certificate, then it is determined if the certificate is revoked, and if it is, or if the email has no anti-spam digital certificate, the email is classified and processed as spam. If the certificate is not revoked, then the email is processed according to a products or services classification on the certificate.
Also provided herein is a system for receiving email advertisements, the system including a digitally signed request to receive email advertisements and an email client configured to communicate with one or more certificate authorities.
Also described is a method for receiving email advertisements by sending to an advertiser a digitally signed request to receive email advertisements, receiving from the advertiser a digitally signed email advertisement having a digital certificate, determining whether the digital certificate has been revoked, and if said digital certificate has been revoked, classifying and processing the email as spam.
Finally, a method for verifying the authority to sell an email address is provided herein by receiving from an end user a digitally signed request to sell an email address, digitally signing the request, selling the email address to a third party, and obtaining the third party's digital signature on the request.
The accompanying drawings illustrate various embodiments of the present system and method and are a part of the specification. The illustrated embodiments are merely examples of the present system and method and do not limit the scope thereof.
b shows a flowchart of another embodiment of a method for eliminating spam.
b shows a flowchart of another embodiment of a method for identifying and blocking spam.
c shows a flowchart of another embodiment of a method for identifying and blocking spam.
b shows a flowchart of another embodiment of a method for reporting spam.
Throughout the drawings, identical reference numbers designate similar, but not necessarily identical, elements.
The following description includes specific details in order to provide a thorough understanding of the present anti-spam system and methods of making and using it. The skilled artisan will understand, however, that the system and methods described below can be practiced without employing these specific details. Indeed, they can be modified and can be used in conjunction with products and techniques known to those of skill in the art in light of the present disclosure.
Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. The appearance of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment
Referring now to the Figures,
Referring now to
The ASC generally includes information regarding the advertiser and the ASC, such as the advertiser's name, the certificate serial number, expiration date of the certificate, the advertiser's public key associated with that certificate, and the digital signature of the certificate authority signing the ASC. The ASC may also include additional information regarding the good(s) and/or service(s) being offered in the message to which the ASC is attached.
In one embodiment, the ASC contains classification information to classify the ASC for a particular product and/or service, or class or category of products and/or services, or any other designation with which the advertiser wishes to classify the ASC. According to this method, an advertiser may obtain an ASC for each different product/service, or class of products/services it wishes to advertise. In this method, the ASC not only correlates the digital signature on the message with the advertiser, but it also correlates the digital signature with the specified product/service or class of products/services. Thus, an advertiser may have a number of different ASCs for varying products/services or classes of products/services. When used in conjunction with the present anti-spam systems and methods, this allows a single advertiser to continue to send email advertisements for successful products when other email advertisements for less-successful products are not well-received by users or recipients or are considered to be spam. It also allows the advertiser to track the success its advertisements have with end users for various products/services or classes of products/services, and to gauge users' acceptance of email message advertisements for various products/services or classes of products/services. In another embodiment, the ASC may contain information regarding the price of products/services. Indeed, the ASC may contain any classification information the advertiser wishes to use.
When the advertiser obtains an ASC, the certificate authority also establishes an associated certificate account, which includes a specified value of money or points, as chosen by the certificate authority. The certificate account may be associated with the specific certificate only, or it may apply to all certificates owned by one advertiser. Typically, the amount of money or points in the certificate account depends on the cost of the certificate or how many points the advertiser is willing to purchase. The certificate authority typically maintains records and data concerning the balance of the certificate account. The certificate account is used by the certificate authority to manage the status of the advertiser's ASC, as described in more detail below.
The advertiser then composes an email message (step 312). The message is usually an advertisement, but may be any email message from an advertiser or other individual or organization to a customer, potential customer, organization member, or other individual (“end user”). After composing the email message, the advertiser then signs the message with a digital signature (step 314). The message can be signed with a digital signature by any method known to those of skill in the art, such as creating a hash of the message and then encrypting the hash with the advertiser's private key. The advertiser's ASC is also attached to the digitally signed message before the message is sent (step 316). After the message is digitally signed and the ASC attached, the advertiser sends the digitally signed message to an end user or group of end users (step 318). The email client then receives the digitally signed email (step 320). In one embodiment, all incoming email messages received by the email client are placed into a certificate check queue before being sent to the end user's email client inbox.
Referring now to
In one embodiment, the email client may be configured to respond to an unsigned email message by automatically sending a response email message to the sender of the unsigned email message. The response email message may explain that the user only accepts advertisements, unsolicited, or unwanted email, and/or any other email messages, if they are digitally signed with an ASC. In another embodiment the response email message may also describe the products/services, or classes of products/services for which the user accepts digitally signed advertisements.
If the email client determines that the incoming email message was digitally signed with an ASC, it will then check if the ASC is still valid or if it has been revoked (step 414). Any method known to those of skill in the art may be used to check the status of the ASC. In one embodiment the email client determines if the ASC has been revoked by accessing the issuing certificate authority's online certificate revocation list (CRL). The email client will then retrieve the status information contained in the CRL for that ASC. The status information may show that the ASC is valid or revoked. If the email client finds that the ASC has been revoked, then the message may be forwarded or processed as defined by the user (step 418). The defined forwarding or processing of the message may be identical to that specified above for unsigned email messages, or it may be different. Generally, the forwarding or other disposition of the email message may include any of the processes or dispositions described above for unsigned email messages.
If the email client determines that the ASC has not been revoked, it then checks to determine if the sender of the email message has been blocked (step 416).
In one embodiment, the sender is blocked by a blacklist defined in the email client. Any known method for blacklisting may be used, including user-defined blacklists, imported blacklists, content-based blacklists, and others known to those of skill in the art. In another embodiment, the sender may be blocked by its absence in the email client's whitelist. The whitelist may be created and implemented according to any method known to those of skill in the art. If the email client determines that the sender has been blocked, or that email messages from the particular sender are not accepted, then the email message may be forwarded or processed as defined by the user (step 418). The defined forwarding or processing of the message may be identical to that specified above for unsigned email messages or signed messages with revoked ASCs, or it may be different. Generally, the forwarding or other disposition of the blocked or unaccepted email message may include any of the processes or dispositions described above.
In another embodiment of identifying and blocking spam, shown in
Referring to
Referring now to
As stated above, when the end-user presses the spam button displayed on their email software, the email client reports to the certificate authority that the user has identified the email message as spam (step 516). This may be done by any method known to those of skill in the art. For example, in one embodiment the email client may report the spam to the certificate authority via an email message from the end-user's email software. In another embodiment, the email client establishes a connection via a network with a database or other server operated by the certificate authority and directly adds the spam report to the database or other program operated by the certificate authority. After receiving the spam report, the certificate authority will then deduct a value from the advertiser's certificate account (step 518). The amount of the value depends on the practices of the certificate authority, any agreements made between the certificate authority and the advertiser, and may vary depending on the nature of the email message, its content, its classification, etc. Each time an email message is reported by a user as spam, the certificate authority deducts a value from the certificate account. Once the certificate account balance reaches zero (step 520), the certificate authority will revoke the ASC (step 522). Thus, an email signed with an ASC may be reported as spam by users who did not wish to receive that email message. If the certificate account has not reached zero, then the email may be opened and read by other end users (step 510) since it will not be blocked by the anti-spam system. However, once the ASC is revoked due to the certificate account reaching zero (step 520), every anti-spam email client may determine that the ASC has been revoked and will forward or process the email message as defined by the user (e.g. step 412,
In one embodiment, shown in
In another embodiment, the email client is configured to allow a user to report a particular email message as spam only once. This ensures that one user does not deplete an advertiser's ASC account when the advertiser is legitimately carrying on business as a non-spammer.
As shown in
By digitally signing a request to authorize an advertiser or other sender to send email messages to the recipient, the sender can prove that the receiver allowed the sender to send email messages to the receiver. Thus, if an email message recipient receives an email message from a sender, and reports the email message as spam, the sender can verify to the certificate authority that the message was authorized by the recipient, and the certificate authority will not deduct any value or points from the sender's certificate account.
The present system and methods also provide a method of verifying that the sender has the recipient's permission to sell the recipient's email address to third parties. In one embodiment, when an advertiser sells the email address of a user to a third party advertiser the third party advertiser can verify, using cryptographic algorithms, that the user has consented to selling his/her email. The user can also verify the classes of use for that resale. For example, a user might only want an advertiser to sell his/her certificate to third parties to only receive discount coupons from them, or new product announcements, etc.
In another embodiment, when the user receives an email from a third party who has purchased his/her email address, the end user can verify that the sender does have the consent to send the message. This verification can come through the user allowing the first advertisers to sell his/her email address to a second advertiser, and the second advertiser including cryptographic details to prove that the transaction was genuine. This way the end user has the ability to check that only the authorized advertisers can send him/her an email for the intended purposes set out by him/her in a way he/she can verify it.
According to one embodiment, shown in
The preceding description has been presented only to illustrate and describe embodiments of the anti-spam email client and system and methods. It is not intended to be exhaustive or to limit the anti-spam email client and system and methods to any precise form disclosed. It is to be understood that the above-described arrangements are only illustrative of the application of the principles described herein. Modifications and alterations of may be devised by those skilled in the art without departing from the spirit and scope of the products and methods described herein, and the appended claims are intended to cover such modifications and arrangements
Filing Document | Filing Date | Country | Kind | 371c Date |
---|---|---|---|---|
PCT/US2007/077649 | 9/5/2007 | WO | 00 | 2/11/2009 |