Viable Email Attacks and a Simple End-to-End Security Solution

Abstract

Many attacks, scams, and malware threats are based on or spread through emails nowadays. Although people have been fighting against them with technical and legal measures for many years, the situation has not improved. It seems to be getting worse and worse. We attribute this to lack of end-to-end security measures for emails in current internet infrastructure. Most past security solutions provide either in-domain authentication, or domain-to-domain authentication. Available end-to-end solutions are based on public key cryptography and have many limitations. In this paper, we propose a simple end-to-end solution for email security. It is based on the idea of trust chain from sender to receiver, which spans multiple domains and organizations without the requirement of a uniform platform. On the client-end, it is transparent to the user without requirement of any user operation. The solution provides end-to-end authentication and integrity for its users, which is hard to achieve or use in existing works.