|
One of the key components missing in the current email system is message integrity
and non-repudiation. It may be surprising to learn, but message integrity is
not a guaranteed property of email. There are no checksums in the delivery
system to see if a message has be altered. The sender of a message is not verified.
As a message is in transit from one mailhost to another it is openly exposed
as it hops from one host to another through the Internet. Overall, there is
little confidence that the average email message will not be changed in transit
or comes from the source it claims to come from.
Go ahead, try it out yourself--change your "From" Address in your mail client
to be "bad@hacker.org" then send an email to yourself. Amazingly, it gets through.
It is not a stretch to imagine that someday someone with ill intent will use
this open "feature" for harm.
The Internet Engineering Task Force has a plethora of security-related standards
devoted to email. Implementations, however, are slow to catch up with the standards,
and it is not yet clear that a usable solution exists. Users have yet to be
presented with a comprehensive, unobtrusive security mechanism. Studies have
shown that in order for a security solution to be embraced and used by the
email community, it will need to be easy to implement for both administrators
and end-users alike.
What is EMUMAIL's Digital Postmark Service?
EMUMAIL invented its Digital Postmark Service to provide an incremental, backwards
compatible addition to email that:
EMUMAIL's Digital Postmarking Service (DPS) is an architectural extension to
email infrastructure that unobtrusively provides a layer of digital notarization
and postmarking, should message authentication and timestamping be questioned.
The Digital Postmark Service is NOT a complete end to end security product,
nor does it pretend to be! Electronic security is usually a complicated process
that , in its current implementations at least, takes the usefulness out of
email by requiring users to "relearn" behavior. EMUMAIL's Digital Postmark
Service lets users immediate enjoy in the benefits of message postmarking while
using email as they always have with no change in their behavior.
How does the Digital Postmark Service Work?
The DPS should be thought of as a mechanism that "reads" an email
message, remembers the exact contents of the message and then adds a time stamp
and digital postmark or notarization symbol to the message. The DPS is an entirely
server-side software product, with no client-side interaction required unless
the message is questioned. Digital Postmarks are stored on an EMUMAIL database
in case the messages' authenticity is questioned.
The Digital Postmark Service, like other security extensions (for example,
PGP and PEM), uses crytographically-sound algorithms to provide the force behind
its digital security. However, it is not a mathematical but a mechanical difference
in the way the DPS functions that is its largest advantage to alternative systems.
The DPS is actually a plug-in to the existing SMTP mail service, which provides
the postmarking to each message that gets passed through it. By tightly integrating
with a data store, postmarks are stored for later verification.
By mandating security at the server level, a layer of authenticity is created
entirely without the interaction of the end-user sending the message. This
translucent layer directly solves the useability problems of other systems.
Who uses the Digital Postmark Service?
While anyone concerned about email authenticity can use the Digital Postmark
Service, EMUMAIL has found that law firms, online billing agents, businesses
sending online receipts, and individuals that deal in sensitive information
that cannot be altered are early adopters of this technology.
How do I use the Digital Postmark Service? Using EMUMAIL's Digital Postmark
Service is easy. Once signed up, simply point your mail client to SMTP.com
for outbound email delivery, and send messages as you normally would. Both
domain wide and individual user accounts are available. Accounts consist of
a pre-paid volume of digitally signed mail that will be relayed through EMUMAIL
servers.
|
