Visualization of trust in an address bar

• US 20060218403A1
• Filed: 03/23/2005
• Published: 09/28/2006
• Est. Priority Date: 03/23/2005
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Sauve, Aaron J., Silbey, Marc A., Van Dok, Cornelis K.
• Granted Patent: US 7,743,254 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Described are a system and method for presenting security information about a current site or communications session. Briefly stated, a browsing software is configured to receive a certificate during a negotiation of a secure session between a local device and a remote device. The certificate includes security information about a site maintained at the remote device. The security information is displayed to a user of the browsing software in a meaningful fashion to allow the user to make a trust determination about the site. Displaying the security information may include presenting a certificate summary that includes the most relevant information about the certificate, such as the name of the owner of the site and the name of the certificating authority of the certificate.

Claims

1. A computer-implemented method for displaying security information in browsing software, comprising:

negotiating a secure session between a local device and a site maintained by a remote device, the negotiating including transfer of a certificate from the remote device to the local device;

evaluating the certificate to determine the certificate'"'"'s validity;

extracting information from the certificate about the site and about a certificating authority for the certificate; and

displaying information about the validity of the certificate in a browser display, the information including at least a name associated with the ownership of the site.

2. The computer-implemented method recited in claim 1, wherein the secure session comprises a secure sockets layer protocol session.

3. The computer-implemented method recited in claim 1, wherein the local device and the remote device are coupled using a wide area network

4. The computer-implemented method recited in claim 3, wherein the wide area network comprises an Internet.

5. The computer-implemented method recited in claim 1, wherein the certificate comprises an SSL certificate.

6. The computer-implemented method recited in claim 1, wherein evaluating the certificate to determine the certificate'"'"'s validity comprises verifying a digital signature associated with the certificate.

7. The computer-implemented method recited in claim 1, wherein the information extracted from the certificate comprises a name of an owner of the site.

8. The computer-implemented method recited in claim 7, wherein the information further comprises a name of a certificating authority that signed the certificate.

9. The computer-implemented method recited in claim 8, wherein the information extracted from the certificate comprises the name of the owner and the name of the certificating authority.

10. The computer-implemented method recited in claim 9, wherein the information displayed comprises the name of the owner and the name of the certificating authority.

11. The computer-implemented method recited in claim 1, wherein displaying the information about the validity of the certificate comprises presenting a certificate summary that includes a name of an owner of the site.

12. The computer-implemented method recited in claim 11, wherein the information further comprises a name of a certificating authority responsible for signing the certificate.

13. The computer-implemented method recited in claim 1, wherein the information about the validity comprises an indication that the certificate is not valid.

14. The computer-implemented method recited in claim 13, wherein the certificate is not valid for one or more of at least the following reasons:

the certificate has expired, the certificating authority is not trusted on the local device, and the certificate does not match the site.

15. A computer-readable medium encoded with computer-executable instructions for displaying security information in a browsing software, the instructions comprising:

determining security information about a certificate received during a negotiation of a secure session between a local device and a remote device at a site; and

displaying a certificate summary in a drop-down visual element that includes the security information about the certificate, the visual element being displayed in an area on a graphical interface of the browsing software proximate to an address bar that identifies an address of the site.

16. The computer-readable medium recited in claim 15, wherein the secure session comprises an SSL secure session, and wherein the certificate comprises an SSL certificate.

17. The computer-readable medium recited in claim 15, wherein the security information comprises an indication that the certificate is valid.

18. The computer-readable medium recited in claim 17, wherein the security information further comprises a name of an owner of the site and a name of a certificating authority of the certificate.

19. The computer-readable medium recited in claim 15, wherein the security information comprises an indication that the certificate is not valid.

20. A computer-readable medium encoded with computer-executable components for displaying security information in browsing software, comprising:

means for negotiating a secure session between a local device and a site maintained by a remote device, the negotiating including transfer of a certificate from the remote device to the local device;

means for evaluating the certificate to determine the certificate'"'"'s validity;

means for extracting information from the certificate about the site and about a certificating authority for the certificate; and

means for displaying information about the validity of the certificate in a browser display, the information including at least a name associated with the ownership of the site.