SECURE BROWSER

• US 20090138804A1
• Filed: 02/04/2009
• Published: 05/28/2009
• Est. Priority Date: 05/16/2003
• Status: Active Grant

• Current Assignee: Questionmark Computing Limited (Learnosity Ltd.)
• Original Assignee: Questionmark Computing Limited (Learnosity Ltd.)
• Inventors: Roberts, Paul, Shepherd, Eric Robert, Kleeman, John
• Granted Patent: US 9,055,048 B2
• Time in Patent Office: Days
• US Class Current: 715/742
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method for interacting with a user, comprising communicating with at least one cooperative server through a normal browser; automatically receiving encrypted data having an associated received type code indicative of a requirement for a secure browser having restricted functionality with respect to a functionality of the normal browser; selectively and automatically invoking the secure browser for handling of the received encrypted data based on the received type code associated with the received encrypted data; receiving the encrypted data with the invoked secure browser for handling thereof, wherein the received encrypted data is not available for use by the user in the normal browser and the invoked secure browser imposes restrictions on availability outside of the secure browser of decrypted data derived from the encrypted data; and communicating an input from the user, through the secure browser, to the at least one cooperative server.

Claims

1. A method for interacting with a user, comprising:

communicating with at least one cooperative server through a normal browser;

automatically receiving encrypted data having an associated received type code indicative of a requirement for a secure browser having restricted functionality with respect to a functionality of the normal browser;

selectively and automatically invoking the secure browser for handling of the received encrypted data based on the received type code associated with the received encrypted data;

receiving the encrypted data with the invoked secure browser for handling thereof, wherein the received encrypted data is not available for use by the user in the normal browser and the invoked secure browser imposes restrictions on availability outside of the secure browser of decrypted data derived from the encrypted data; and

communicating an input from the user, through the secure browser, to the at least one cooperative server.

2. The method according to claim 1, further comprising the step of limiting access of a user, with the secure browser, to documents outside of a specified set.

3. The method according to claim 1, further comprising the step of authenticating the secure browser, to assure that the secure browser having the restricted functionality is authentic and available for handling of the received encrypted data.

4. The method according to claim 1, wherein the secure browser lacks one or more of the following functions:

print, save, cache, cut and copy, and the restrictions prevent applications other than the secure browser from implementing the one or more lacking functions.

5. The method according to claim 1, wherein the secure browser transforms text information into graphic objects for handling by a host computer operating system.

6. The method according to claim 1, wherein the secure browser restricts termination of its own execution.

7. The method according to claim 1, wherein the secure browser comprises an applet executing within an environment of the normal browser.

8. The method according to claim 1, wherein the normal browser provides data export support functionality and the secure browser has restricted data export functionality with respect to the data export functionality of the normal browser, and wherein the encrypted data is encrypted according to a public key-private key protocol.

9. A computer readable medium, having stored therein instructions for a programmable processor to perform the method according to claim 1.

10. A method for interacting with a user, comprising:

requesting an insecure document having an associated insecure document type code from a cooperative server through a normal browser in a computer;

receiving data in response to the request for the insecure document, comprising information representing the insecure document and the associated insecure document type code;

browsing the insecure document through the normal browser, permitting unrestricted access by the user to information in the insecure document and permitting interaction by the user with processes in the computer other than those permitted by the secure browser, the information in the insecure document being available for interaction by the user through the normal browser in the computer;

requesting a secure document having an associated secure document type code from a cooperative server through a normal browser in a computer;

receiving data in response to the request for the document, comprising encrypted information representing the document and the associated document type code;

automatically invoking a secure browser, based on at least the received associated document type code, when the associated document type code indicates a secure document type which has associated limitations on external availability of information in the document having the secure document type outside of the secure browser, the secure browser permitting access by the user to decrypted information corresponding to the encrypted information within the document having the secure document type, and restricting interaction by the user with processes in the computer other than those permitted by the secure browser, the restricted interaction processes being available for interaction of the user through the normal browser in the computer; and

automatically communicating an input from the user, through the secure browser, to a cooperative server.

11. The method according to claim 10, wherein the secure browser provides restricted navigational functionality with respect to the navigational functionality of the normal browser.

12. The method according to claim 10, further comprising, when the secure browser is invoked, limiting access of a user to a set of documents within a predetermined set.

13. The method according to claim 10, further comprising the step of authenticating the existence and authenticity of the secure browser with a remote server prior to presenting the decrypted content to the user.

14. The method according to claim 10, wherein the secure browser prevents use of the following functions:

save, copy, and navigate to unrestricted documents.

15. The method according to claim 10, wherein the secure browser restricts termination of its own execution.

16. The method according to claim 10, wherein the encrypted information is encrypted using a public key-private key protocol.

17. The method according to claim 10, wherein the encrypted information is encrypted using a shared secret protocol.

18. The method according to claim 10, wherein the secure browser is granted exclusive control over graphic user interface functionality of a host computer when invoked.

19. The method according to claim 10, further comprising authenticating the cooperative server by the secure browser prior to presenting the decrypted information.

20. A computer readable media storing a program for a controlling a processor to perform the method of claim 10.

21. An automated computer system for interacting with a user, comprising:

a normal browser executing on a computer, adapted to communicate with at least one cooperative server;

a communications interface of the computer adapted to receive encrypted data having an associated received type code indicative of a requirement for a secure browser having restricted functionality with respect to a functionality of the normal browser;

a secure browser executing on the computer, which is selectively and automatically invoked for handling of the received encrypted data based on the received type code associated with the received encrypted data;

the encrypted data being received through the communications interface with the invoked secure browser for handling thereof, wherein the received encrypted data is not available for use by the user in the normal browser and the invoked secure browser imposes restrictions on availability outside of the secure browser of decrypted data derived from the encrypted data; and

the computer communicating an input from the user, generated by the secure browser, through the communications interface, to the at least one cooperative server.