Method and apparatus for improving security during web-browsing

• US 20080016552A1
• Filed: 07/12/2006
• Published: 01/17/2008
• Est. Priority Date: 07/12/2006
• Status: Active Grant

• Current Assignee: Intuit, Inc.
• Original Assignee: Intuit, Inc.
• Inventors: Hart, Matt E.
• Granted Patent: US 9,154,472 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

One embodiment of the present invention provides a system that improves security during web-browsing. During operation, the system can receive a URL from a user. Next, the system can determine an IP address for the URL by querying a DNS server. The system can then determine a public-key associated with the URL. Next, the system can encrypt a string using the public-key to obtain an encrypted-string. The system can then send the encrypted-string to a remote-system which is associated with the IP address. Next, the system can receive a response from the remote-system. The system can then determine whether the DNS server has been compromised using the string and the response. If the system determines that the DNS server has been compromised, the system can alert the user, and in doing so, improve security during web-browsing.

Claims

1. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for improving security during web-browsing, the method comprising:

receiving a URL (Universal Resource Locator) from a user;

determining an IP (Internet Protocol) address for the URL by querying a DNS (Domain Name System) server;

determining a public-key associated with the URL;

encrypting a string using the public-key to obtain an encrypted-string;

sending the encrypted-string to a remote-system which is associated with the IP address;

receiving a response from the remote-system;

determining whether the DNS server has been compromised using the string and the response; and

if the DNS server has been compromised, alerting the user, thereby improving security during web-browsing.

2. The computer-readable storage medium of claim 1, wherein the string can contain:

the IP address for the URL;

a second IP address which is associated with the user'"'"'s computer;

a timestamp which can specify the date and time when the string was encrypted;

or

a random string.

3. The computer-readable storage medium of claim 1, wherein alerting the user involves displaying a watermark to the user using a web-browser.

4. The computer-readable storage medium of claim 1, wherein the method is performed by a web-browser toolbar.

5. The computer-readable storage medium of claim 1, wherein determining the IP address involves:

sending a query-message with the URL'"'"'s domain name to the DNS server; and

receiving a response-message from the DNS server which contains the IP address.

6. The computer-readable storage medium of claim 1, wherein determining the public-key involves:

sending a query-message with the URL to a trusted system which stores public-keys; and

receiving a response-message from the trusted system which contains the public-key associated with the URL.

7. The computer-readable storage medium of claim 1, wherein determining whether the DNS server has been compromised involves comparing the string with the response.

8. An apparatus for improving security during web-browsing, the apparatus comprising:

a first receiving mechanism configured to receive a URL (Universal Resource Locator) from a user;

a first determining mechanism configured to determine an IP (Internet Protocol) address for the URL by querying a DNS (Domain Name System) server;

a second determining mechanism configured to determine a public-key associated with the URL;

an encrypting mechanism configured to encrypt a string using the public-key to obtain an encrypted-string;

a sending mechanism configured to send the encrypted-string to a remote-system which is associated with the IP address;

a second receiving mechanism configured to receive a response from the remote-system;

a third determining mechanism configured to determine whether the DNS server has been compromised using the string and the response; and

an alerting mechanism, wherein if the DNS server has been compromised, the alerting mechanism is configured to alert the user, thereby improving security during web-browsing.

9. The apparatus of claim 8, wherein the string can contain:

the IP address for the URL;

a second IP address which is associated with the user'"'"'s computer;

a timestamp which can specify the date and time when the string was encrypted;

or

a random string.

10. The apparatus of claim 8, wherein the alerting mechanism is configured to display a watermark to the user using a web-browser.

11. The apparatus of claim 8, wherein the first determining mechanism is configured to:

send a query-message with the URL'"'"'s domain name to the DNS server; and

to

receive a response-message from the DNS server which contains the IP address.

12. The apparatus of claim 8, wherein the second determining mechanism is configured to:

send a query-message with the URL to a trusted system which stores public-keys; and

to

receive a response-message from the trusted system which contains the public-key associated with the URL.

13. The apparatus of claim 8, wherein the third determining mechanism is configured to compare the string with the response.

14. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method to determine whether a network has been compromised, the method comprising:

determining a public-key which is associated with a URL (Universal Resource Locator) which contains a domain name;

querying a DNS (Domain Name System) server to determine an IP (Internet Protocol) address for the domain name;

sending an encrypted-string to the IP address using a network, wherein the encrypted-string is determined using a string and the public-key;

receiving a response from a remote-system which is associated with the IP address; and

determining whether the network has been compromised using the string and the response.

15. The computer-readable storage medium of claim 14, wherein the string can contain:

the IP address for the domain name;

a second IP address which is associated with the user'"'"'s computer;

a timestamp which can specify the date and time when the string was encrypted;

or

a random string.

16. The computer-readable storage medium of claim 14,

wherein the method is performed by a web-browser toolbar;

wherein the DNS server is located within the network;

wherein determining whether the network has been compromised involves determining whether the DNS server has been compromised.

17. The computer-readable storage medium of claim 14, wherein determining the public-key involves:

sending a query-message with the URL to a trusted system which stores public-keys; and

receiving a response-message from the trusted system which contains the public-key associated with the URL.

18. The computer-readable storage medium of claim 14, wherein querying the DNS server involves:

sending a query-message with the domain name to the DNS server; and

receiving a response-message from the DNS server which contains the IP address.

19. The computer-readable storage medium of claim 14, wherein determining whether the network has been compromised involves comparing the string with the response.

20. An apparatus to determine whether a network has been compromised, the apparatus comprising:

a first determining mechanism configured to determine a public-key which is associated with a URL (Universal Resource Locator) which contains a domain name;

a querying mechanism configured to query a DNS (Domain Name System) server to determine an IP (Internet Protocol) address which is associated with the domain name;

a sending mechanism configured to send an encrypted-string to the IP address using a network, wherein the encrypted-string is determined using a string and the public-key;

a receiving mechanism configured to receive a response from a remote-system which is associated with the IP address; and

a second determining mechanism configured to determine whether the network has been compromised using the string and the response.

21. The apparatus of claim 20, wherein the string can contain:

the IP address for the URL;

a second IP address which is associated with the user'"'"'s computer;

a timestamp which can specify the date and time when the string was encrypted;

or

a random string.

22. The apparatus of claim 20, wherein the first determining mechanism is configured to:

send a query-message with the URL to a trusted system which stores public-keys; and

to

receive a response-message from the trusted system which contains the public-key associated with the URL.

23. The apparatus of claim 20, wherein the querying mechanism is configured to:

send a query-message with the domain name to the DNS server; and

to

receive a response-message from the DNS server which contains the IP address.

24. The apparatus of claim 20, wherein the second determining mechanism is configured to compare the string with the response.

25. A method for improving security during web-browsing, the method comprising:

receiving a URL (Universal Resource Locator) from a user;

determining an IP (Internet Protocol) address for the URL by querying a DNS (Domain Name System) server;

determining a public-key associated with the URL;

encrypting a string using the public-key to obtain an encrypted-string;

sending the encrypted-string to a remote-system which is associated with the IP address;

receiving a response from the remote-system;

determining whether the DNS server has been compromised using the string and the response; and

if the DNS server has been compromised, alerting the user, thereby improving security during web-browsing.

26. A method to determine whether a network has been compromised, the method comprising:

determining a public-key which is associated with a URL (Universal Resource Locator) which contains a domain name;

querying a DNS (Domain Name System) server to determine an IP (Internet Protocol) address for the domain name;

sending an encrypted-string to the IP address using a network, wherein the encrypted-string is determined using a string and the public-key;

receiving a response from a remote-system which is associated with the IP address; and

determining whether the network has been compromised using the string and the response.