Injecting credentials into web browser requests

• US 10,341,316 B2
• Filed: 06/17/2016
• Issued: 07/02/2019
• Est. Priority Date: 06/18/2015
• Status: Active Grant

• Current Assignee: Avast Software SRO (Gen Digital Inc.)
• Original Assignee: Avast Software SRO (Gen Digital Inc.)
• Inventors: Dvo{hacek over (r)}ak, Petr
• Primary Examiner(s): Song, Hee K
• Application Number:
  US15/186,177
• Publication Number:
  US 20160373420A1
• Time in Patent Office: 1,110 Days
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A password manager injects credentials into a web browser request. A user can browse to a form provided by a server that includes a password field. A plug-in requests a password for the field from a password manager. The actual password is not provided to the plug-in or the browser. The password manager provides a proxy password that is not the actual password for the field. A request interceptor in a separate process from the browser intercepts the completed request as it is sent to the server and replaces the proxy password with the actual password.

Claims

1. A method comprising:

determining that a form includes a password field for a server application, wherein the form is displayed within a tab or a window of a browser executing on a device;

requesting a password for the server application from a password manager, wherein the password manager is executed on the device and includes a request interceptor;

receiving data from the password manager responsive to the request, wherein the data is not the actual password for the server application, and wherein the password manager maintains an internal reference associating the data with the actual password for the server application;

creating a password proxy from the data;

filling in the password field with the password proxy;

issuing, by the browser, a login request containing the password proxy, wherein an intended address of the login request is a server hosting the server application;

intercepting, by the request interceptor on the device, the login request containing the password proxy that is intended for the server application;

determining, by the request interceptor on the device, the actual password for the server application by reversing the password proxy to obtain the data from which the password proxy was created and obtaining the actual password from the internal reference associating the data with the actual password;

replacing, by the request interceptor on the device, the password proxy with the actual password in the login request;

forwarding, by the request interceptor on the device, the login request including the actual password to the server application; and

deleting the data received from the password manager and the password proxy in response to determining that the tab or the window of the browser within which the form is displayed has closed.

2. The method of claim 1, wherein said maintaining a reference to the data comprises maintaining the reference to the data for a limited amount of time.

3. The method of claim 2, said method further comprising deleting the data after the data has been used once by the password manager to provide the password to the server application.

4. The method of claim 1, wherein said creating a password proxy from the data comprises creating a derivative of the data to create the password proxy.

5. The method of claim 1, wherein said creating a password proxy from the data comprises applying a transformation to the data to create the password proxy.

6. The method of claim 1, wherein said creating a password proxy from the data comprises creating a randomly generated string of text.

7. The method of claim 1, wherein said creating a password proxy from the data comprises creating an encrypted version of the actual password.

8. The method of claim 1, said method further comprising initializing the request interceptor.

9. A method comprising:

initializing a request interceptor on a device, wherein the request interceptor comprises a password manager;

intercepting, by the request interceptor on the device, a login request intended for a server application, the login request including a password proxy, and the login request issued by a browser executing on the device;

determining, by the request interceptor on the device, an actual password for the server application by reversing the password proxy to obtain data from which the password proxy was created and obtaining the actual password from an internal reference associating the obtained data with the actual password;

replacing, by the request interceptor on the device, the password proxy with the actual password in the login request;

forwarding, by the request interceptor on the device, the login request including the actual password to the server application; and

deleting, by the request interceptor, the data and the password proxy in response to determining that a tab or a window of the browser that uses the password proxy has closed.

10. The method of claim 9, wherein the password manager establishes itself as a root certificate authority.

11. A method comprising:

displaying a browser, wherein the browser is executing on a device;

determining that a form includes a password field for a server application, wherein the form is displayed within a tab or a window of the browser;

requesting a password for the server application from a password manager, wherein the password manager is executed on the device, and wherein the password manager is separate and independent from the browser;

receiving data from the password manager responsive to the request, wherein the data is not the actual password for the server application, wherein the password manager maintains an internal reference associating the data with the actual password for the server application;

creating a password proxy from the data;

filling in the password field with the password proxy;

issuing, with the browser, a login request containing the password proxy, wherein an intended address of the login request is a server hosing the server application;

initializing a request interceptor on the device, wherein the request interceptor comprises the password manager;

intercepting, by the request interceptor on the device, the login request containing the password proxy that is intended for the server application;

determining, by the request interceptor on the device, the actual password for the server application by reversing the password proxy to obtain the data from which the password proxy was created and obtaining the actual password from the internal reference associating the data with the actual password;

replacing, by the request interceptor on the device, the password proxy with the actual password in the login request;

forwarding, by the request interceptor on the device, the login request including the actual password to the server application; and

deleting the data received from the password manager and the password proxy responsive to determining that the tab or the window of the browser within which the form is displayed has closed.