Patent Publication Number: US-7904517-B2

Title: Challenge response systems

Description:
TECHNICAL FIELD 
     This invention is related to systems and methods for spam prevention and more particularly to tracking and validating messages, their corresponding challenges, and challenge responses to facilitate maintaining secure communication channels between the sender, the recipient, and third party servers. 
     BACKGROUND OF THE INVENTION 
     The advent of global communications networks such as the Internet has presented commercial opportunities for reaching vast numbers of potential customers. Electronic messaging, and particularly electronic mail (“email”), is becoming increasingly pervasive as a means for disseminating unwanted advertisements and promotions (also denoted as “spam”) to network users. 
     The Radicati Group, Inc., a consulting and market research firm, estimates that as of August 2002, two billion junk e-mail messages are sent each day—this number is expected to triple every two years. Individuals and entities (e.g., businesses, government agencies) are becoming increasingly inconvenienced and oftentimes offended by junk messages. As such, spam is now or soon will become a major threat to trustworthy computing. 
     A key technique utilized to thwart spam involves the employment of filtering systems/methodologies. One proven filtering technique is based upon a machine learning approach—machine learning filters assign to an incoming message a probability that the message is spam. In this approach, features typically are extracted from two classes of example messages (e.g., spam and non-spam messages), and a learning filter is applied to discriminate probabilistically between the two classes. Since many message features are related to content (e.g., words and phrases in the subject and/or body of the message), such types of filters are commonly referred to as “content-based filters”. 
     Despite the onslaught of such spam filtering techniques, many spammers have thought of ways to disguise their identities to avoid and/or bypass spam filters. Thus, conventional content-based and adaptive filters may become ineffective in recognizing and blocking disguised spam messages. 
     Instead of focusing on the recipient-end of spam, recent developments in anti-spam technology have concentrated on minimizing spammers&#39; resources or their ability to send spam. For example, much of the current research involves inhibiting access to free email accounts from which massive amounts of spam can be sent. In particular, service providers have begun to require that potential account holders solve computational puzzles and/or human interactive proofs (HIPs) in order to obtain email accounts. Because computational puzzles and HIPs are designed to be too difficult for computers to solve but easy enough for humans, they tend to at least hinder new account sign-ups en mass which is typically performed by computers. 
     Computational puzzles have also been extended to individual senders. For example, recipients can require a sender to correctly solve a puzzle if they suspect the sender is a spammer. Theoretically, this practice is effective at catching disguised spammers; but unfortunately, it is not a foolproof tactic against their ever-adapting nature. 
     SUMMARY OF THE INVENTION 
     The following presents a simplified summary of the invention in order to provide a basic understanding of some aspects of the invention. This summary is not an extensive overview of the invention. It is not intended to identify key/critical elements of the invention or to delineate the scope of the invention. Its sole purpose is to present some concepts of the invention in a simplified form as a prelude to the more detailed description that is presented later. 
     The present invention provides for a system and method that facilitates securing a challenge-response round-trip between senders and recipients. More specifically, the invention provides for tracking messages and challenges according to the respective sender and/or recipient so as to protect either party from spammer interference. 
     Suspicious message senders can prove that they are not spammers by “paying” with CPU cycles, solving HIPs or other puzzles that are too difficult for computers to solve, or by paying an amount of money (or equivalent) that would be too expensive for a spammer to afford. One problem with this approach is that spammers may attempt to send mail apparently from a “victim” user. This victim user receives the challenge. If the challenge is a HIP, the user may be fooled into solving it. If the challenge is a computational puzzle (to be solved automatically by the victim&#39;s computer), the victim&#39;s computer may be fooled into solving it. Thus, according to one aspect of the present invention, message senders can protect against rogue entities attempting to hijack or waste their CPU cycles by “signing” or “coding” their messages with a unique identifier (ID). One approach makes use of private IDs which facilitate verifying that incoming requests for CPU cycles (e.g., solve a challenge) are legitimate requests based on their messages and not the messages of an unknown third party stealing the senders&#39; identities. 
     Another approach involves tracking outbound messages from any particular sender to make certain that the sender only responds to challenges or any other requests arising from the messages the sender actually sent. In particular, various individual or combinations of aspects of a message can be recorded and then tracked such as, for example, the subject, recipient, date, and the like. 
     Yet another aspect of the invention regards communication between users and third-party servers. HIP challenges in particular are typically solved using a web page, and since many users do not control their own web servers, the web page is typically hosted by a trusted third party. Unfortunately, this can provide some spammers with an opportunity to forge a response apparently from the trusted third party to the message recipient. Therefore, a secure communication channel is desired to transmit communications from the server to the recipient. 
     In practice, for example, when a third-party server is employed to validate puzzle results, as in the case of HIPs, a secure channel can be established through which the validation information can be sent. One approach involves having the third-party server sign a message cryptographically via a public key cryptographic signature system or a symmetric key cryptographic system. When using symmetric keys, for example, different recipients can employ different symmetric keys. The third-party server can then track the symmetric keys for the respective recipients to ensure that one recipient cannot forge a signature that would be trusted by another. 
     In other aspects of the invention, a recipient can send a challenge response in a message to the third-party server and include a random number in the message. If the server returns the random number along with validation information, then the recipient can verify that the validation information is in fact from the trusted server, assuming that eavesdropping on such communications is difficult. Furthermore, HTTP channels as well as the server&#39;s IP address can be utilized to keep communications secure between the third-party server and the recipient. 
     After a sender&#39;s response or solution to a challenge has been validated, the recipient may need assistance in retrieving the sender&#39;s original message. By embedding a cookie or some other type of ID in the challenge, which the recipient can extract from the solution, the recipient can store any data it expects to need during the message retrieval stage. 
     To the accomplishment of the foregoing and related ends, certain illustrative aspects of the invention are described herein in connection with the following description and the annexed drawings. These aspects are indicative, however, of but a few of the various ways in which the principles of the invention may be employed and the present invention is intended to include all such aspects and their equivalents. Other advantages and novel features of the invention may become apparent from the following detailed description of the invention when considered in conjunction with the drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a schematic block diagram of a challenge-response system that facilitates verifying a sender&#39;s message as being from the sender in accordance with an aspect of the present invention. 
         FIG. 2  is a schematic diagram demonstrating a challenge-response round trip integrated with employment of private IDs in accordance with an aspect of the present invention. 
         FIG. 3  is a schematic diagram demonstrating possible consequences of not using private IDs in accordance with an aspect of the present invention. 
         FIG. 4  is a schematic block diagram of a challenge-response system that facilitates securing communication between a trusted third party server or validation component and a recipient in accordance with an aspect of the present invention. 
         FIG. 5  is a schematic diagram demonstrating an exemplary pathway between a trusted challenge server and a recipient in accordance with an aspect of the present invention. 
         FIG. 6  is a schematic block diagram of a challenge-response system that facilitates secure retrieval of messages from senders who have successfully answered challenges in accordance with an aspect of the present invention. 
         FIG. 7  is a schematic diagram demonstrating a recipient&#39;s retrieval of a sender&#39;s message in accordance with an aspect of the present invention. 
         FIG. 8  is a flow diagram of an exemplary method that facilitates utilizing private IDs to determine that a sender actually sent a message for which the challenge has been issued in accordance with an aspect of the present invention. 
         FIG. 9  is a flow diagram of an exemplary method that facilitates secure communication between a challenge server and a recipient in accordance with an aspect of the present invention. 
         FIG. 10  is a flow diagram of an exemplary method that facilitates retrieving sender messages once they have correctly solved the respective challenges in accordance with an aspect of the present invention. 
         FIG. 11  is a schematic block diagram of an exemplary communication environment in accordance with the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     The present invention is now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It may be evident, however, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the present invention. 
     As used in this application, the terms “component” and “system” are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers. 
     The subject invention can incorporate various inference schemes and/or techniques in connection with generating IDs and/or challenges for message recipients as well as challenge auto-responders (e.g., senders who program their account to auto-respond to challenges), for example. As used herein, the term “inference” refers generally to the process of reasoning about or inferring states of the system, environment, and/or user from a set of observations as captured via events and/or data. Inference can be employed to identify a specific context or action, or can generate a probability distribution over states, for example. 
     The inference can be probabilistic—that is, the computation of a probability distribution over states of interest based on a consideration of data and events. Inference can also refer to techniques employed for composing higher-level events from a set of events and/or data. Such inference results in the construction of new events or actions from a set of observed events and/or stored event data, whether or not the events are correlated in close temporal proximity, and whether the events and data come from one or several event and data sources. 
     It is to be appreciated that although the term message is employed extensively throughout the specification, such term is not limited to electronic mail per se, but can be suitably adapted to include electronic messaging of any form that can be distributed over any suitable communication architecture. For example, conferencing applications that facilitate a conference or conversation between two or more people (e.g., interactive chat programs and instant messaging programs) can also utilize the security features disclosed herein, since unwanted text can be electronically interspersed into normal chat messages as users exchange messages and/or inserted as a lead-off message, a closing message, or all of the above. 
     The present invention, as described in greater detail below, provides for securing and/or protecting challenge-response round trip technology. In general, challenge-response systems can be employed by message recipients to verify that a sender is not a spammer. If a sender is a suspected spammer, the recipient of the message can send a challenge to the apparent sender. The challenge can be included in a message sent via email that includes a request that the sender solve a computational challenge such as a computational puzzle or HIP before the sender&#39;s message is opened and read. Alternatively, the recipient&#39;s challenge can point the sender to a URL, for example, that is directed to a HIP and then require the sender to solve the HIP; or the message can offer the recipient a choice. In either scenario, spammers can intervene to spoof solutions or otherwise interfere with communications between the sender, recipient, and/or challenge system. 
     For example, a spammer or other malicious party can attempt to send a forged message apparently from a victim to a recipient. The recipient then sends a challenge to the victim to solve. If the victim solves it, then the spammer&#39;s message can be marked for the recipient to open and read. Thus, spammers can waste victims&#39; (e.g., legitimate senders) CPU cycles by getting them to solve challenges unknowingly on their behalf or tricking them into solving HIPs or paying money. Furthermore, many senders desire to automate their responses to challenges to make the challenge-response round trip transparent to them as well as to the recipient. However, this could make the senders more vulnerable to denial-of-service (DoS) attacks which would also allow spammers to use CPU cycles on the sender&#39;s machine to pay for their spam. 
     Referring now to  FIG. 1 , there is illustrated a challenge-response system  100  that protects senders from solving challenges for messages they did not send for the benefit of spammers. The system  100  comprises a sending component  110  that can send messages (e.g., at least one message) to a recipient  120  from a sender. The sender&#39;s message can include information such as a private ID inserted thereto for each outgoing message to verify that the message sent purportedly from the sender is actually from the sender. 
     Private IDs can assist in authenticating the legitimacy of incoming challenges—particularly for senders who want to track and readily identify their own messages. Moreover, they can be particularly valuable for senders who automatically respond to challenges. 
     Cryptography can be employed to facilitate the generation of private IDs to maximize their security. They can comprise at least one type of tracking data to keep track of which challenges have been answered as well as their age to determine expiration. Various components including one or more of the following can be used to generate private IDs:
         Date and/or time;   Number of recipients in message;   Counter;   Blank portion.       

     The date and/or time component included in the private ID can represent when the private ID or message was generated or when the message was sent by the sender. In addition, inclusion of the date and/or time can facilitate allowing the private ID to expire at some time in the future (e.g., 2 days, 1 week, etc.). The number of recipients can be used to determine the number of challenges that are needed for a particular message. For example, when a sender sends a message with 4 recipients, each of the 4 recipients should receive the message with a different private IP inserted thereto. Thus, the counter feature can make the private ID unique to ensure that a sender is not responding more than once to the same challenge. Finally, the blank portion of the private ID is included to increase the difficulty of guessing a valid private ID. 
     Private IDs can also comprise public or symmetric keys. The use of one over the other can depend on user or message system preferences. Because there are multiple ways to send messages from the same user account, the system  100  or a component thereof can confirm that each of these access points have access to the same key or to the same list of keys. For example, to make certain that the same key is used, the system or component thereof can ask the user to manually enter a password or pass phrase on each machine that appends private IDs or some other type of signature. The password, for example, can be used indirectly or directly to generate the key. Alternatively or in addition, the key can be stored in a secure folder on a server or in a message, both of which can be hidden. When communicating between two clients at different locations, a special message can be generated having a unique format to hide the key. The key can also be passed using a secure pathway and/or be encrypted with another key or password. Finally, one key (e.g., an infocard) can be used to generate another key. 
     Referring again to the system  100 , the recipient  120  can request the sender to solve a challenge by way of a challenge receiving component  130  when the recipient  120  receives the message. Essentially, the challenge receiving component  130  can send a challenge with the message&#39;s private ID included in the challenge to the sender ( 110 ) via a verification component  140 . The verification component  140  can verify that the sender sent the message by examining the private ID included in the challenge. If the private ID is determined to be valid, then the sender can respond to the challenge (automatically or manually) with a somewhat stronger guarantee that the challenge is legitimate. 
     Otherwise, if the private ID is deemed invalid or is missing, the challenge can be sent to a spam filter (not shown). If the verdict is good, then the challenge can be displayed in the sender&#39;s inbox, depending on whether the recipient still requires the challenge to be solved. Optionally, the recipient and/or the sender can be notified of the invalid or missing verification information (e.g., private ID). 
     In some cases, senders may receive messages purportedly from them but which are actually not from them. As can be imagined, the verification information may not match since such messages are typically from spammers who have spoofed the From: header of a sender&#39;s message. Such messages can be given differential treatment apart from other messages received by the sender. For example, a filter can be trained to move such messages to a special folder for later investigation. If the sender also makes use of a challenge-response system for incoming messages, the challenge-response system can flag these messages and request user action before initiating a challenge. In addition, the challenge-response can be programmed to not accept or block responses from auto-responders for this type of message. 
     As an alternative to the system  100 , a tracking system can be employed by the sender to track every or nearly every outbound message that is sent and make sure that the sender only responds to challenges for messages that were actually sent. This can be accomplished in part by tracking one or more different types of information about the message. Exemplary types of information include but are not limited to the subject, number and/or name of recipients, date of message, size of message, etc. At least a portion of this information can then be included in the challenge message to verify that the challenge has been properly sent to the actual sender. 
     Some of the effects of employing system  100  are pictorially demonstrated in schematic diagrams  200  and  300  in  FIGS. 2 and 3 , respectively. In  FIG. 2 , Alice sends Bob a message with a private ID affixed to the message. In fact, every message sent by Alice includes a different private ID. Bob must then echo or repeat the private ID in a challenge sent to Alice. Alice can validate that the private ID belongs to her and then sends Bob a solution to the challenge. Alternatively, Bob (or Bob&#39;s server) could simply add the value one to the random number it receives, and then Alice (the sender) could check to determine if the received number is exactly one greater than the sent number. 
       FIG. 3  demonstrates how a sender&#39;s machine can be easily hijacked by a malicious party (Hacker) or spammer when not using private IDs or some other type of verification information and building challenge limits into them. As shown, Alice sends an innocuous message to Hacker. In the case of a spammer, the message could be “please remove me from your list”. Hacker then sends many recipient victims spam with forged From: header using Alice&#39;s email address. The recipient victims then send challenges to Alice. Unaware that these are not for her own messages, she sends solutions for them back to the recipient victims. Hence, Hacker can send spam to a nearly unlimited number of victims for “free”. Thus, by using private IDs, Alice can limit the number of victims who will be sent spam paid for by Alice&#39;s CPU cycles. 
     Turning now to  FIG. 4 , there is illustrated a challenge response system  400  that facilitates secure communication between third-party challenge servers (e.g., a HIP or micropayment server) and recipients who require confirmation that the challenges are solved correctly by the sender. Such a system  400  can be particularly useful when utilizing HIP or micropayment challenges. For example, when sending a HIP challenge via email, the sender receives a message from (or on behalf of) the recipient that includes a link to a HIP webpage hosted on a third-party HIP server. The webpage can include an embedded image containing a word that the user (sender) needs to transcribe. The sender solves the HIP and the HIP server can record the solution. 
     One problem with hosting puzzles on third-party HIP servers is that it is possible for spammers to spoof communications from the third-party HIP server, making it seem like the HIP has been solved when in fact, it has not been solved. There is also some concern of how a HIP server is to contact an email client or email server to tell the client or server (on recipient&#39;s end) that the HIP has been solved. Many email clients sit behind firewalls and the only reliable way to contact them is via email. Unfortunately, email is typically insecure; and for at least this reason, secure channels via email are desirable. 
     As shown in the figure, a sender can initially send a message to a recipient. The recipient can respond to the sender with a message requesting the sender to solve a challenge such as a HIP or make a micropayment. Thus, the message can include a URL that directs the sender to a challenge website hosted by a challenge server  410 . Once the sender solves the challenge (or provides the necessary micropayment), the challenge server  410  can generate a “secure” server message. The server message can then be validated to ensure that the message came from a trusted server (and that its content can be trusted by the recipient). 
     In order to effectively validate the server&#39;s message, a validation component  420  can employ several different techniques. In one instance, the server  410  can sign its messages with a type of cryptographic ID attached to each outgoing message. The ID can change for each message it sends. The validation component  420  can then determine whether the ID appearing in the message matches that of the server  410 . The ID or digital signature of the message can be created by using either a public key or symmetric key cryptographic system. When using symmetric keys, different recipients should have different keys to mitigate or prevent one recipient from forging a signature that may be trusted by another. The server  410  can keep track of the pertinent symmetric keys for each recipient. Thus, the server  410  can return the correct ID or key of the message. 
     In another instance, the server can track nearly all if not all symmetric keys for all recipients in its database. The server can sign its messages with the recipient&#39;s symmetric key that is specific to this particular pairing (of recipient to server). In some cases, a secure email channel can be used such as S/MIME. 
     In yet another instance, the recipient can verify the source of a server message. For example, after receiving the message from the server  410 , the recipient can send the message with a random number back to the server  410 . The server  410  can then be asked to return the message. If the returned message has the correct number, then the server  410  can be identified as the trusted server and the server&#39;s message is essentially authenticated. Only the actual server  410  or someone who can eavesdrop on this conversation (not a typical spammer) can return the correct random number. 
     Upon receiving a response via email, the recipient can also open a channel over HTTP (which is usually not blocked by firewalls) and verify that the response was valid. It is much harder to fake an HTTP response than to fake email. Finally, in some cases, the recipient can determine the IP address that the HIP-response email used, and verify that this IP address corresponds to the HIP server. 
     Moreover, “signed” messages can verify the legitimacy of incoming notifications. For example, if the user&#39;s email client is an application on a PC, a HIP server might send a digitally signed message to the email client to confirm that the HIP was correctly solved. Or, if the user&#39;s email client is a web-based client, the HIP server might send a digitally signed message communicated via a secure private tunnel, communicated via a signed web service, or other similar secure means. 
       FIG. 5  pictorially demonstrates at least one aspect of the system  400 , supra. As shown in the diagram  500 , Alice sends Bob a message and then Bob challenges Alice. Alice can validate the challenge (as corresponding to a message she actually sent) and then contact the challenge server (e.g., HIP server) to get a HIP to solve. The solution can be returned to the HIP server—at which time, it can be authenticated to be sure that it came from the trusted HIP server. 
     Turning now to  FIG. 6 , there is illustrated a challenge-response system  600  that facilitates retrieving a sender&#39;s message once the sender has correctly solved or performed a challenge. The system  600  comprises a message receiving component  610  that can receive messages sent from a sender  620 . The recipient can decide to challenge the sender  620 . Thus, the recipient can optionally signal a challenge generation component  630  to provide a challenge to the sender  620  by way of a message having a unique ID appended thereto (ID generator  640 ). A challenge echoing the same ID of the message can be generated and affixed to the challenge as well (e.g., in the challenge message headers). 
     Otherwise, such as in the case of HIP challenges, the recipient can send a challenge message to the sender and include a unique ID and a link to a challenge website. The particular challenge can be accessed by clicking on the link and then submitting the solution via the webpage. The hosting server can record the solution and user (sender) as well as the unique ID that appeared in the challenge message. This unique ID can be subsequently employed to verify the identity of the hosting server (by a validation component  650  as well as to facilitate locating the sender&#39;s message (by a message retrieval component  660 ) stored in a message repository  670 —since the sender&#39;s original message does not accompany the challenge-related communications. 
     After the ID is generated for the sender&#39;s message and included in the challenge message, the sender&#39;s message can be sent to the message repository  670  at least until the recipient&#39;s message system (e.g., email program) has been notified that the corresponding challenge has been successfully solved. 
     Message retrieval can be initiated by recipient action or upon recipient request. Alternatively, the sender&#39;s correct and verified response can automatically trigger the retrieval component  660  to move the appropriate message to the recipient&#39;s inbox. 
       FIG. 7  provides further illustration of the system  600 . As shown in this model  700  of the challenge-response round trip, when the challenger or recipient (Bob) receives the sender&#39;s (Alice) solution to the puzzle and sees that it is valid, he then somehow has to find Alice&#39;s original message now that he knows that the message is legitimate. One approach is to have a “cookie” included in part of Bob&#39;s challenge which contains some data which will assist Bob in remembering where Alice&#39;s original message was stored. For example, it could contain the internal MAPI message-ID of the original message, for which Bob can subsequently search his message store. This data may or may not be encrypted or otherwise disguised. 
     Alternatively, Alice can re-attach her original message to the solution she sends to Bob. In this case, the encrypted cookie for correlation can be stored into the private ID that was described, supra, in  FIG. 1 , so that when Alice gets Bob&#39;s challenge, she knows what message was challenged. Thus, the cookie or ID used by the recipient to correlate messages to solved challenges can be a part of the sender&#39;s private ID used to identify the sender&#39;s messages to the sender. 
     Various methodologies in accordance with the subject invention will now be described via a series of acts as shown in  FIGS. 8-10 . It is to be understood and appreciated that the present invention is not limited by the order of acts, as some acts may, in accordance with the present invention, occur in different orders and/or concurrently with other acts from that shown and described herein. For example, those skilled in the art will understand and appreciate that a methodology could alternatively be represented as a series of interrelated states or events, such as in a state diagram. Moreover, not all illustrated acts may be required to implement a methodology in accordance with the present invention. 
     Referring now to  FIG. 8 , there is a flow diagram of an exemplary methodology  800  that facilitates a secure challenge-response round trip in part by allowing a sender to verify that challenges correlate to actual messages. The methodology  800  comprises sending at least one message to a recipient at  810 . The message can comprise information, at least a portion of which can be used for verification such as a private ID or other type of ID. The ID can be appended to at least one message header or to any other portion of the message so long as it can be tracked by the sender. The use of private IDs can be particularly useful with respect to autoresponders of challenges. By utilizing private IDs, senders can be more confident that their autoresponses will not have deleterious effects of mass spam dissemination even if they are fooled by a spammer into solving a challenge for the spammer. 
     At  820 , at least one challenge can be received and prepared to be sent to the message sender to assist the recipient of the message in verifying that the sender is not a malicious party such as a spammer. In particular, the challenge can include at least a portion of the verification information. When the challenge is sent to the sender, the sender can verify that the challenge corresponds to one of the sender&#39;s messages by way of the verification information at  830 . If the verification information does not match or is missing, the challenge can be sent to a filter and a resulting verdict can dictate the appropriate action to take. For example, if the verdict is “good”, then the challenge can be moved to the sender&#39;s inbox to be solved. Other treatments of the challenge can be performed as well such as notifying the sender and/or the recipient of the deficient verification information. 
     Referring now to  FIG. 9 , there is illustrated a flow diagram of an exemplary methodology  900  that facilitates securing communication between a challenge (HIP) server and a recipient by way of an email communication channel. The methodology  900  comprises sending at least one HIP-based challenge to a sender at  910 . At  920 , notice is received such as by the recipient that the challenge has been solved and a secure message can be sent to the recipient with the related information. The secure message can include a digital signature and/or cookie which can be embedded in the HIP URL. The digital signature of the message should match the public key of the HIP server. The cookie can be returned here so that the recipient (challenger) can retrieve the original message. The secure message from the HIP server can be validated to be sure that it is coming from a valid and trusted server (e.g., HIP server). 
     Turning to  FIG. 10 , there is illustrated a flow diagram of an exemplary method  1000  that facilitates retrieving messages that correlate to senders who have responded correctly to the respective challenges. The method  1000  involves receiving a sender&#39;s solution to a challenge at  1010  and then validating at least one of the ID of the message to make certain that the ID is in the message, the challenge server, and/or that the ID of the message matches the challenge the sender solved. 
     Once the appropriate information has been validated, the recipient can be notified that the sender has answered the challenge correctly; and thus can retrieve the respective message from a message repository at  1020 . Alternatively, the recipient&#39;s message system can be set to automatically move the appropriate message into the inbox as soon as the relevant information has been validated. To facilitate the retrieval process, a cookie, for example, can be employed to make it easier for the message system to retrieve the original message. 
     In order to provide additional context for various aspects of the present invention,  FIG. 11  and the following discussion are intended to provide a brief, general description of a suitable operating environment  1110  in which various aspects of the present invention may be implemented. While the invention is described in the general context of computer-executable instructions, such as program modules, executed by one or more computers or other devices, those skilled in the art will recognize that the invention can also be implemented in combination with other program modules and/or as a combination of hardware and software. 
     Generally, however, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular data types. The operating environment  1110  is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Other well known computer systems, environments, and/or configurations that may be suitable for use with the invention include but are not limited to, personal computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include the above systems or devices, and the like. 
     With reference to  FIG. 11 , an exemplary environment  1110  for implementing various aspects of the invention includes a computer  1112 . The computer  1112  includes a processing unit  1114 , a system memory  1116 , and a system bus  1118 . The system bus  1118  couples the system components including, but not limited to, the system memory  1116  to the processing unit  1114 . The processing unit  1114  can be any of various available processors. Dual microprocessors and other multiprocessor architectures also can be employed as the processing unit  1114 . 
     The system bus  1118  can be any of several types of bus structure(s) including the memory bus or memory controller, a peripheral bus or external bus, and/or a local bus using any variety of available bus architectures including, but not limited to, 11-bit bus, Industrial Standard Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Universal Serial Bus (USB), Advanced Graphics Port (AGP), Personal Computer Memory Card International Association bus (PCMCIA), and Small Computer Systems Interface (SCSI). 
     The system memory  1116  includes volatile memory  1120  and nonvolatile memory  1122 . The basic input/output system (BIOS), containing the basic routines to transfer information between elements within the computer  1112 , such as during start-up, is stored in nonvolatile memory  1122 . By way of illustration, and not limitation, nonvolatile memory  1122  can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), or flash memory. Volatile memory  1120  includes random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, RAM is available in many forms such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). 
     Computer  1112  also includes removable/nonremovable, volatile/nonvolatile computer storage media.  FIG. 11  illustrates, for example a disk storage  1124 . Disk storage  1124  includes, but is not limited to, devices like a magnetic disk drive, floppy disk drive, tape drive, Jaz drive, Zip drive, LS-100 drive, flash memory card, or memory stick. In addition, disk storage  1124  can include storage media separately or in combination with other storage media including, but not limited to, an optical disk drive such as a compact disk ROM device (CD-ROM), CD recordable drive (CD-R Drive), CD rewritable drive (CD-RW Drive) or a digital versatile disk ROM drive (DVD-ROM). To facilitate connection of the disk storage devices  1124  to the system bus  1118 , a removable or non-removable interface is typically used such as interface  1126 . 
     It is to be appreciated that  FIG. 11  describes software that acts as an intermediary between users and the basic computer resources described in suitable operating environment  1110 . Such software includes an operating system  1128 . Operating system  1128 , which can be stored on disk storage  1124 , acts to control and allocate resources of the computer system  1112 . System applications  1130  take advantage of the management of resources by operating system  1128  through program modules  1132  and program data  1134  stored either in system memory  1116  or on disk storage  1124 . It is to be appreciated that the present invention can be implemented with various operating systems or combinations of operating systems. 
     A user enters commands or information into the computer  1112  through input device(s)  1136 . Input devices  1136  include, but are not limited to, a pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, and the like. These and other input devices connect to the processing unit  1114  through the system bus  1118  via interface port(s)  1138 . Interface port(s)  1138  include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). Output device(s)  1140  use some of the same type of ports as input device(s)  1136 . Thus, for example, a USB port may be used to provide input to computer  1112  and to output information from computer  1112  to an output device  1140 . Output adapter  1142  is provided to illustrate that there are some output devices  1140  like monitors, speakers, and printers among other output devices  1140  that require special adapters. The output adapters  1142  include, by way of illustration and not limitation, video and sound cards that provide a means of connection between the output device  1140  and the system bus  1118 . It should be noted that other devices and/or systems of devices provide both input and output capabilities such as remote computer(s)  1144 . 
     Computer  1112  can operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s)  1144 . The remote computer(s)  1144  can be a personal computer, a server, a router, a network PC, a workstation, a microprocessor based appliance, a peer device or other common network node, and the like, and typically includes many or all of the elements described relative to computer  1112 . For purposes of brevity, only a memory storage device  1146  is illustrated with remote computer(s)  1144 . 
     Remote computer(s)  1144  is logically connected to computer  1112  through a network interface  1148  and then physically connected via communication connection  1150 . Network interface  1148  encompasses communication networks such as local-area networks (LAN) and wide-area networks (WAN). LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CDDI), Ethernet/IEEE 1102.3, Token Ring/IEEE 1102.5, and the like. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks like Integrated Services Digital Networks (ISDN) and variations thereon, packet switching networks, and Digital Subscriber Lines (DSL). 
     Communication connection(s)  1150  refers to the hardware/software employed to connect the network interface  1148  to the bus  1118 . While communication connection  1150  is shown for illustrative clarity inside computer  1112 , it can also be external to computer  1112 . The hardware/software necessary for connection to the network interface  1148  includes, for exemplary purposes only, internal and external technologies such as, modems including regular telephone grade modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards. 
     What has been described above includes examples of the present invention. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the present invention, but one of ordinary skill in the art may recognize that many further combinations and permutations of the present invention are possible. Accordingly, the present invention is intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims. Furthermore, to the extent that the term “includes” is used in either the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term “comprising” as “comprising” is interpreted when employed as a transitional word in a claim.