User login credential warning system

• US 10,536,449 B2
• Filed: 03/17/2017
• Issued: 01/14/2020
• Est. Priority Date: 09/15/2015
• Status: Active Grant

• Current Assignee: Mimecast Services Limited (Mimecast Limited)
• Original Assignee: Mimecast Services Limited (Mimecast Limited)
• Inventors: Maylor, Jackie Anne, Tyler, Simon Paul, Malone, Steven, Ry, Wayne Van, Ribeiro, Francisco
• Primary Examiner(s): Sholeman, Abu S
• Application Number:
  US15/461,857
• Publication Number:
  US 20170195310A1
• Time in Patent Office: 1,033 Days
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 51/046 Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Virtually every online account requires login credentials like username and password for access. Using different credentials for each account can reduce the likelihood of unauthorized access to these accounts. Remembering all the different credentials, however, can be a challenge and it is not uncommon for a user to mistakenly provide credentials to a site that are for another, sensitive site. Accordingly, a system for warning a user of such an error is provided. The system includes a browser plugin that responds to a user entering their credentials at a requesting site by looking up an identifier of a trusted site associated with the user'"'"'s credentials. The identifiers of the requesting and trusted sites are compared, and if they do not match, the browser plugin blocks the user from submitting their credentials to the requesting site. Advantageously, the system reduces the likelihood that credentials to sensitive accounts are provided by accident.

Claims

1. A method for warning a user that login credentials they entered for a site is restricted to another, sensitive site, the method comprising:

providing a system comprising a browser plugin and a processor coupled to a non-transitory memory containing instructions executable by the processor to cause the browser plugin to;

query, via the browser plugin, a data store with a user'"'"'s login credentials to obtain one or more trusted site identifiers of a trusted site associated with the login credentials, the querying being in response to the user entering the login credentials at a requesting site, which prompted the user for their login credentials;

compare, via the browser plugin, the trusted site identifiers with a corresponding number of identifiers of the requesting site to identify whether the requesting site is an unsafe site, wherein the comparing comprises determining a suspicion score and identifying whether the requesting site is an unsafe site and is not safe for the user'"'"'s login credentials based, at least in part, on a correlation of the suspicion score to a threshold;

block, via the browser plugin, the user from submitting the entered login credentials to the requesting site, identified as being unsafe, based on the comparison of the trusted site identifiers with the requesting site identifiers; and

warn, via the browser plugin, the user that the login credentials they entered are restricted to another, sensitive site based on the comparison of the requesting site identifiers and trusted site identifiers.

2. The method of claim 1, wherein the querying includes querying the data store as the user is entering in each character of their login credentials.

3. The method of claim 1, wherein the requesting site is identified as the unsafe site when the suspicion score is in a specified range of values.

4. The method of claim 1, wherein determining the suspicion score includes graphically comparing a screen image of the requesting site to a screen image of the trusted site, the suspicion score is determined, at least in part, based on the graphical comparison.

5. The method of claim 1, wherein the suspicion score is a similarity metric determined based on a degree of similarity between a display representation of the requesting site identifier and a display representation of the trusted site identifier.

6. The method of claim 1, wherein the blocking includes blocking the user from submitting the entered login credentials to the requesting site when the requesting site identifiers do not match the trusted site identifiers.

7. The method of claim 1, wherein the requesting site identifiers and trusted site identifiers are any one of Uniform Resource Locators, Uniform Resource Identifiers, Internet Protocol addresses, domain names, and a combination thereof.

8. A system for warning a user that login credentials they entered for a site is restricted to another, sensitive site, the system comprising:

a data store storing a user'"'"'s login credentials and trusted site identifiers of trusted sites associated with the login credentials;

a browser plugin communicatively coupled to the data store; and

a processor coupled to a non-transitory memory containing instructions executable by the processor to cause the browser plugin to;

in response to the user entering login credentials at a requesting site, which prompted the user for their login credentials, query the data store with the user'"'"'s login credentials to obtain one or more trusted site identifiers associated with the login credentials;

compare the trusted site identifiers with a corresponding number of identifiers of the requesting site to identify whether the requesting site is an unsafe site, wherein the comparing comprises determining a suspicion score and identifying the requesting site is an unsafe site that is not safe for the user'"'"'s login credentials based, at least in part, on a correlation of the suspicion score to a threshold;

block the user from submitting the entered login credentials to the requesting site, identified as being unsafe, based on the comparison of the trusted site identifiers with the requesting site identifiers; and

warn the user that the login credentials they entered are restricted to another, sensitive site based on the comparison of the requesting site identifiers and trusted site identifiers.

9. The system of claim 8, wherein the browser plugin queries the data store as the user is entering in each character of their login credentials.

10. The system of claim 8, wherein the browser plugin identifies the requesting site is the unsafe site when the suspicion score is in a specified range of values.

11. The system of claim 8, wherein the browser plugin determines the suspicion score by graphically comparing a screen image of the requesting site to a screen image of the trusted site, the suspicion score is determined, at least in part, based on the graphical comparison.

12. The system of claim 8, wherein the suspicion score is a similarity metric determined based a degree of similarity between a display representation of the requesting site identifier and a display representation of the trusted site identifier.

13. The system of claim 8, wherein the browser plugin blocks the user from submitting the entered login credentials to the requesting site when the requesting site identifiers do not match the trusted site identifiers.

14. The system of claim 8, wherein the requesting site identifiers and trusted site identifiers are any one of Uniform Resource Locators, Uniform Resource Identifiers, Internet Protocol addresses, domain names, and a combination thereof.

15. A non-transitory computer readable medium storing instructions executable by at least one processor to execute method for warning a user that login credentials they entered are for a site is restricted to another, sensitive site, the instructions being coded to instruct the at least one processor to:

query a data store with a user'"'"'s login credentials to obtain one or more trusted site identifiers of a trusted site associated with the login credentials, the querying being in response to the user entering the login credentials at a requesting site, which prompted the user for their login credentials;

compare the trusted site identifiers with a corresponding number of identifiers of the requesting site to identify whether the requesting site is an unsafe site, wherein the comparing comprises determining a suspicion score and identifying the requesting site is an unsafe site that is not safe for the user'"'"'s login credentials based, at least in part, on a correlation of the suspicion score to a threshold;

block the user from submitting the entered login credentials to the requesting site, identified as being unsafe, based on the comparison of the trusted site identifiers with the requesting site identifiers; and

warn the user that the login credentials they entered are restricted to another, sensitive site based on the comparison of the requesting site identifiers and trusted site identifiers.