Signed response to an abusive email account owner and provider systems and methods

Patent metadata

Field	Value
Publication number	US-9635038-B2
Application number	US-201514942851-A
Country	US
Kind code	B2
Filing date	Nov 16, 2015
Priority date	Jun 14, 2013
Publication date	Apr 25, 2017
Grant date	Apr 25, 2017

Abstract

Systems and methods for abusive email account detection and transmission of a signed response to an abusive email account owner and provider. The methods include receiving an email from a first email account on a second email account, wherein the email contains malicious content, determining if a trust relationship exists between a first email server corresponding to the first email account and a second email server corresponding to the second email account, and transmitting, using a hardware processor of the second email server, an alert email to the first email account corresponding to the trust relationship, wherein the alert email includes a digital signature and a secure field having an abusive category descriptor in an email header. The secure field may include an abusive category descriptor, for example transmitting spam, transmitting malware, transmitting phishing attempts, and committing fraud.

First claim

What is claimed is:

1. A computer system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to, in response to executing instructions stored on the non-transitory memory, cause the computer system to perform operations comprising:
analyzing an email from a first email account that is addressed to a second email account;
based on the analyzing, determining the email includes particular content having one or more characteristics that meet one or more criteria indicating the email may be abusive;
in response to determining the email includes the particular content, generating a reporting email that is separate from the email from the first email account, the reporting email comprising:
an email header;
a digital signature included in the email header that is usable by a recipient of the reporting email to verify a validity of a trust relationship between a first email server corresponding to the first email account and a second email server corresponding to the second email account; and
a secure field that includes encrypted information indicating the email may be abusive;

and
transmitting the reporting email.

2. The system of claim 1 , wherein transmitting the reporting email comprises sending the reporting email to a service provider corresponding to the first email server.

3. The system of claim 1 , wherein transmitting the reporting email comprises sending the reporting email to the first email account.

4. The system of claim 1 , wherein the operations further comprise forming the trust relationship subsequent to the email being sent, by acquiring an encryption key via the internet.

5. The system of claim 1 , wherein the secure field is produced using symmetric-key encryption.

6. The system of claim 1 , wherein the secure field is produced using a private key of an asymmetric key pair, and wherein the first email server possess a public key of the asymmetric key pair.

7. A method, comprising:
receiving an email, at a computer system, from a first email account that is addressed to a second email account;
in response to determining, by the computer system, that the email includes abusive content,
generating a reporting message that is separate from the email from the first email account, the reporting message comprising encrypted information digitally signed by a second party, the encrypted information indicating that the email includes abusive content; and
the computer system causing the reporting message to be transmitted.

8. The method of claim 7 , wherein the encrypted information is included in a secure field of the reporting message.

9. The method of claim 7 , wherein the reporting message is transmitted to at least one of a service provider corresponding to the second email account or the second email account.

10. The method of claim 7 , wherein the determining the email is abusive is based on receiving classification information about the email from a user associated with the second email account.

11. The method of claim 7 , wherein the determining the email is abusive comprises:
determining the email has content with one or more characteristics that correspond to at least one category in the following group of categories consisting of: unsolicited commercial emails, phishing emails, malware-containing emails, fraudulent emails.

12. The method of claim 7 , wherein the encrypted information is included in a header field of the message.

13. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving an email from a first email account that is addressed to second email account;
determining the email includes questionable content having one or more characteristics that correspond to one or more of spam emails, malware-related emails, phishing emails, or fraudulent emails;
in response to determining the email includes questionable content, generating a reporting message comprising a digital signature to verify a validity of a trust relationship between a first entity associated with a first email server for the first email account and a second entity associated with a second email server for the second email account, and a secure field including information that the email includes questionable content; and
transmitting the reporting message.

14. The non-transitory machine-readable medium of claim 13 , wherein an email header for the reporting email comprises the secure field.

15. The non-transitory machine-readable medium of claim 13 , wherein the secure field is encrypted, and wherein the reporting message is addressed to an email address corresponding to the first entity.

16. The non-transitory machine-readable medium of claim 14 , wherein the operations further comprise determining the email includes questionable content having one or more characteristics that correspond malware-related emails based on the email including an attachment containing a malicious executable.

17. The non-transitory machine-readable medium of claim 13 , wherein transmitting the reporting message comprises sending an email to an email address other than an email address for the first email account.

18. The method of claim 7 , wherein the computer system hosts the second email account.

Assignees

• Paypal Inc

Inventors

• Wardman Brad
• Pickett Jeremy D
• Weideman Michael

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L51/12

  Electricity · mapped topic

• H04L51/02

  using automatic reactions or user delegation, e.g. automatic replies or chatbot-generated messages · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title