By a News Reporter-Staff News Editor at Journal of Engineering — According to news reporting originating from Alexandria, Virginia, by VerticalNews journalists, a patent by the inventors Vaithilingam, Gandhi (Sunnyvale, CA); Ho, Cheng (Santa Clara, CA); Pitigoi-Aron, Gruia (San Jose, CA); Vincent, Ben (San Francisco, CA), filed on May 26, 2009, was published online on December 31, 2013.
The assignee for this patent, patent number 8621614, is Microsoft Corporation (Redmond, WA).
Reporters obtained the following quote from the background information supplied by the inventors: “Various techniques exist that enable service providers to receive and process messages (e.g., emails, short message service (SMS) messages, and the like) from various sources and allow users to view and take action on those messages. At times, the sources may be nefarious entities, such as criminals or illegal computer programs, that transmit messages to users that fraudulently induce disclosure of the user’s personal information. This process of inducing disclosure of information via fraudulent messages is commonly referred to as phishing. Often, ‘phishing’ is characterized as the criminally fraudulent process of attempting to acquire sensitive information (e.g., usernames, passwords, credit card details, etc.) by masquerading as a trustworthy entity in an electronic communication; thus, luring unsuspecting users to provide, what is otherwise, guarded information. In instances, phishing is carried out by sending an email or instant message, whose look and feel is similar to a legitimate email or instant message, to a user that directs the user to navigate to a fake website (i.e., spoofed website of a bank), and baiting the user into entering private information (e.g., bank account logon, user identification, social security number, and the like) at the fake website.
“Service providers have taken steps to identify these phishing messages. Further, if the service providers have identified a message as a phishing message, the service providers may attempt to mitigate the damage potentially caused by the phishing message. However, when a client-side application that is not associated with the service provider is being used to access messages in the user’s account, service providers fail to provide the user with adequate protection from the phishing message. That is, because most elements of the client-side application are not directly controlled by the service provider, the service provider is restrained from employing conventional techniques that inform the user of the phishing email.
“As such, these present techniques are not configured to offer users adequate protective measures against phishing messages. Accordingly, employing a procedure to limit potential damage that a phishing message can cause when viewed from a client-side application, or a non-web mail client, would enhance the user’s experience when viewing and taking action on messages in his/her account.”
In addition to obtaining background information on this patent, VerticalNews editors also obtained the inventors’ summary information for this patent: “This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.
“Embodiments of the present invention generally relate to computer-readable media and computerized methods for governing treatment of digital messages (e.g., email messages, instant messages, and the like) upon identifying them as potentially phishing emails. In an exemplary embodiment, a service provider is employed to control behavior of an account that is assigned to an intended recipient of the digital messages. Controlling the behavior of the account may encompass a variety of operations. However, each of these operations is implemented in the context of a non-web mail server. That is, the intended recipient accesses his/her account via a user interface (UI) display being rendered by the non-web mail server. Generally, the service provider is unable to exert control over, or tailor the configuration of, the UI display because the non-web mail client lacks extension protocol to allow the service provider to manipulate aspects of the UI display. Accordingly, conventional techniques for warning the intended recipient of digital messages identified as potentially phishing emails are ineffective.
“In one embodiment, an operation for controlling the behavior of the account includes appending a metadata tag to the digital messages identified as potentially phishing emails and aggregating them in a storage location that is dedicated to persist the tagged digital communications in isolation from digital messages identified as legitimate emails. This dedicated storage location maps to, and may be published as, a folder on the UI display. Upon selection of the folder, representations (e.g., metadata of content and digital communication properties) of the tagged digital communications allocated to the dedicated storage location are posted to the recipient. Accordingly, the recipient is alerted to an unsafe status of the tagged digital communications without directly manipulating the UI display.
“Further, user-initiated actions that are directed toward the representations of the tagged digital communications may be limited. For instance, a request by the recipient to invoke actions that are predetermined as restricted (e.g., command attempting to move a tagged digital communication, reply command, reply to all command, and forward command) are failed by the service provider in order to protect the security of recipient. By way of example, failing the action may include the steps of intercepting the request, ascertaining that the action is classified as a restricted action, ascertaining that the digital communication to which the action is directed is tagged as a potentially phishing email, and failing to implement the action. Upon failing the action, an operation-fail indication (i.e., known error code) is transmitted to the non-web mail client, which, in turn, notifies the recipient that the action was not carried out by the service provider. Accordingly, the recipient is reminded of the unsafe status of the tagged digital communication. Moreover, these security measures provide a layer of protection against distributing tagged digital communications that could harm other users, even though the non-web mail client does not support antiphishing features.
“In another embodiment, an operation for controlling the behavior of the account includes replacing the digital communications that are identified as potentially phishing emails with warning messages. In one instance, the warning message conveys a notification that the identified digital communication may be a potentially phishing email. In another instance, the warning message provides directions to access content of the identified digital communication via a web browser. In still another instance, the warning message includes a uniform-resource locator (URL) link to a web browser that, upon selection by the recipient, allows the recipient to access content of the identified digital communication at the service provider. Accordingly, by presenting the warning message to the recipient and abstaining from revealing the content of the identified digital communication, the recipient is informed of the unsafe status of the digital communication and blocked from inadvertently navigating to a compromised website.”
For more information, see this patent: Vaithilingam, Gandhi; Ho, Cheng; Pitigoi-Aron, Gruia; Vincent, Ben. Managing Potentially Phishing Messages in a Non-Web Mail Client Context. U.S. Patent Number 8621614, filed May 26, 2009, and published online on December 31, 2013. Patent URL: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2Sect2=HITOFFp=9u=%2Fnetahtml%2FPTO%2Fsearch-bool.htmlr=432f=Gl=50co1=ANDd=PTXTs1=20131231.PD.OS=ISD/20131231RS=ISD/20131231
Keywords for this news article include: Legal Issues, Microsoft Corporation.
Our reports deliver fact-based news of research and discoveries from around the world. Copyright 2014, NewsRx LLC