Email Link Rewriting with Destination Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are ineffective in preventing phishing attacks, as they fail to reliably verify the safety of link destinations in emails and web pages, leading to potential malicious site navigation and data theft.
Innovation Solution
A system and method for verifying navigation by detecting suspicious links, presenting alternative destinations, and interfering with or allowing navigation based on verification, using a whitelist and blacklist, and rewriting links to redirect to a trusted site for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current phishing prevention technologies are used, then some phishing attempts can be blocked, but they fail to reliably verify link destinations and remain ineffective against all phishing messages
Solution Approach 1:
The patent introduces an intermediary verification system that sits between the user and link destinations. When a user encounters a link, the system intercepts it, verifies the destination through multiple checks (whitelist/blacklist, DNS verification, content scanning), and only then allows navigation. This intermediary layer resolves the contradiction by providing reliable verification without limiting coverage to specific known phishing patterns.
Solution Approach 2:
The system performs preliminary verification actions before allowing user navigation. Links are pre-checked against whitelist and blacklist databases, DNS records are verified in advance, and destination content is scanned for malicious elements before the user clicks. This preliminary action ensures reliability by catching phishing attempts early while maintaining versatility across different types of phishing messages.
2Reliability
If real-time security checks and firewalls are implemented, then navigation to malicious sites can be detected, but users on exempt devices or networks cannot benefit from these protections
Solution Approach 1:
The patent creates a universal verification system that operates independently of device type or network location. The link verification functionality is embedded in a way that can be accessed by any user on any device through any network connection. The system performs DNS verification, whitelist/blacklist checking, and content scanning in a manner that is agnostic to the user's specific device or network environment, making the protection universally applicable.
3Object-affected harmful factors
If security filters are applied to all links, then malicious sites can be blocked, but legitimate links may also be interfered with causing false negatives
Solution Approach 1:
The system applies different verification strategies to different links based on their characteristics. Whitelist entries receive trusted status without additional verification, blacklist entries are blocked immediately, and links in between undergo full verification including DNS checking and content scanning. This localized quality approach ensures that legitimate links in the whitelist are not falsely blocked while suspicious links receive thorough inspection.
Solution Approach 2:
The verification system incorporates feedback mechanisms where verification results from one link can influence the handling of subsequent links. DNS verification results, content scan outcomes, and user interaction patterns are fed back into the system to refine future verification decisions. This feedback loop reduces false negatives by learning from past verification outcomes and adjusting verification intensity accordingly.
Data Source
AI summary
In some embodiments, techniques for computer security comprise receiving a first email, detecting a first link in the email, wherein the first link is associated with a first link destination, determining a second link associated with a second link destination, wherein the second link destination is associated with a predetermined address and with the first link destination, providing a second email, where the second email differs from the first email at least by having the first link rewritten with the second link, receiving an HTTP request for the second link destination, determining the first link destination from the second link destination, verifying that the first link destination is not suspicious, and enabling navigation to the first link destination.