NEW METHOD FOR SECURE SITE AND USER AUTHENTICATION

• US 20110107407A1
• Filed: 11/02/2010
• Published: 05/05/2011
• Est. Priority Date: 11/02/2009
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: GANESAN, RAVI
• Granted Patent: US 8,458,774 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The present invention provides a new method of site and user authentication. This is achieved by creating a pop-up window on the user'"'"'s PC that is in communication with a security server, and where this communication channel is separate from the communication between the user'"'"'s browser and whichever web site they are at. A legitimate web site embeds code in the web page which communicates to the security server from the user'"'"'s desktop. The security server checks the legitimacy of the'"'"'web site and then signals both the web page on the user'"'"'s browser, as well as the pop-up window to which it has a separate channel. The security server also sends a random image to both the pop-up window and the browser. If user authentication is requested by the web site the user is first authenticated by the security server for instance by out of band authentication. Then the security server computes a one time password based on a secret it shares with the web site and sends it to the pop up window. The user copies this one time password into their browser which sends it to the web site, which can re-compute the one time password to authenticate the user.

Claims

1-7. -7. (canceled)

8. A method of authenticating a site on a network, comprising:

receiving, by a security server from a web page that is (i) associated with a network site and (ii) displayed by a user'"'"'s network device, an identifier of the user'"'"'s network device and an identifier of the network site; and

transmitting, by the security server in response to the receipt of the identifiers, an indication of legitimacy of the network site that will cause display of a corresponding legitimacy indicator on both the web page and a pop-up window displayed by the user'"'"'s network device.

9. The method of claim 8, further comprising:

determining, by the security server, the legitimacy of the network site based on the received network site identifier.

10. The method of claim 8, further comprising:

storing, by the security server on the user'"'"'s network device, a local session object;

wherein the received user'"'"'s network device identifier includes the stored local session object.

11. The method of claim 8, wherein the received network site identifier includes a network address of the network site included in the displayed web page.

12. The method of claim 8, wherein:

if the transmitted indication indicates that the network site is legitimate, the corresponding legitimacy indicator includes a first type visual cue in a first state; and

if the transmitted indication indicates that the network site is illegitimate, the corresponding legitimacy indicator includes the first type visual cue in a second state.

13. The method of claim 12, wherein:

the first type visual cue is a light;

the first state is green; and

the second state is red.

14. The method of claim 12, further comprising:

if the transmitted indication indicates that the network site is legitimate, the corresponding legitimacy indicator also includes a second type visual cue for display on both the web page and the pop-up window.

15. The method of claim 14, wherein the second type visual cue is a random image.

16. An article of manufacture for authenticating a site on a network, comprising:

storage medium; and

logic stored on the storage medium, wherein the stored logic is configured to be readable by a processor and thereby cause the processor to operate so as to;

receive, from a web page that is (i) associated with a network site and (ii) displayed by a user'"'"'s network device, an identifier of the user'"'"'s network device and an identifier of the network site; and

transmit, in response to the receipt of the identifiers, an indication of legitimacy of the network site that will cause display of a corresponding legitimacy indicator on both the web page and a pop-up window displayed by the user'"'"'s network device.

17. The article of manufacture of claim 16, wherein the stored logic is further configured to cause the processor to operate so as to:

determine the legitimacy of the network site based on the received network site identifier.

18. The article of manufacture of claim 16, wherein:

the stored logic is further configured to cause the processor to operate so as to store a local session object on the user'"'"'s network device; and

the received user'"'"'s network device identifier includes the stored local session object.

19. The article of manufacture of claim 16, wherein the received network site identifier includes a network address of the network site included in the displayed web page.

20. The article of manufacture of claim 16, wherein:

if the transmitted indication indicates that the network site is legitimate, the corresponding legitimacy indicator includes a first type visual cue in a first state; and

if the transmitted indication indicates that the network site is illegitimate, the corresponding legitimacy indicator includes the first type visual cue in a second state.

21. The article of manufacture of claim 20, wherein, if the transmitted indication indicates that the network site is legitimate, the corresponding legitimacy indicator also includes a second type visual cue for display on both the web page and the pop-up window.

22. A system for authenticating a site on a network, comprising:

a communications port configured to receive, from a web page that is (i) associated with a network site and (ii) displayed by a user'"'"'s network device, an identifier of the user'"'"'s network device and an identifier of the network site; and

a processor configured with logic to determine the legitimacy of the network site based on the received network site identifier and to direct transmission of an indication of legitimacy of the network site that will cause display of a corresponding legitimacy indicator on both the web page and a pop-up window displayed by the user'"'"'s network device.

23. The system of claim 22, wherein:

the processor is further configured to direct the storage of a local session object on the user'"'"'s network device; and

the received user'"'"'s network device identifier includes the stored local session object.

24. The system of claim 22, wherein the received network site identifier includes a network address of the network site included in the displayed web page.

25. The system of claim 22, wherein:

if the network site is determined to be legitimate, the corresponding legitimacy indicator includes a first type visual cue in a first state; and

if the network site is determined to be illegitimate, the corresponding legitimacy indicator includes the first type visual cue in a second state.

26. The system of claim 25, wherein, if the network site is determined to be legitimate, the corresponding legitimacy indicator also includes a second type visual cue for display on both the web page and the pop-up window.

27. A method of authenticating a site on a network, comprising:

displaying, at a user'"'"'s network device, a web page associated with a network site and a pop up window associated with a security server;

transmitting, from the web page to the security server, an identifier of the user'"'"'s network device and an identifier of the network site;

receiving, by the user'"'"'s network device from the security server in response to the transmission of the identifiers, an indication of legitimacy of the network site; and

displaying, at a user'"'"'s network device, a legitimacy indicator corresponding to the received indication of legitimacy on both the web page and the pop-up.

28. The method of claim 27, further comprising:

executing code embedded in the web page;

wherein the user'"'"'s network device identifier and the network site identifier are transmitted based on the execution of the embedded web page code.

29. The method of claim 27, further comprising:

if the received indication of legitimacy indicates that the network site is legitimate, the corresponding legitimacy indicator includes a first type visual cue in a first state and a second type visual cue; and

if the received indication of legitimacy indicates that the network site is illegitimate, the corresponding legitimacy indicator includes the first type visual cue in a second state.

30. The method of claim 27, further comprising:

receiving, at the user'"'"'s network device, a user selection of a personalized image;

storing the selected personalized image at the user'"'"'s network device; and

displaying the stored personalized image on the pop-up window.