System and method for website authentication using a shared secret

• US 8,615,809 B2
• Filed: 11/10/2011
• Issued: 12/24/2013
• Est. Priority Date: 11/06/2006
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bajaj, Siddharth, Bradescu, Roxana Alina, Burstein, Jeffrey, M'Raihi, David, Popp, Nicolas
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US13/293,414
• Publication Number:
  US 20120159177A1
• Time in Patent Office: 775 Days
• Field of Search: None
• US Class Current: 726/30
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A web site can be authenticated by a third party authentication service. A user designates an authentication device that is a shared secret between the user and the authentication service. A web site page includes a URL that points to the authentication service. The URL includes a digital signature by the web site. When the user receives the page, the user'"'"'s browser issues a request to the authentication service, which attempts to authenticate the digital signature. If the authentication is successful, it sends the authentication device to the user computer.

Claims

1. A method comprising:

receiving, at a third party authentication server processor via a network, registration data associated with a user, wherein the registration data comprises a distortion template;

receiving, at the third party authentication server processor, a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;

determining whether the web site is authentic using the information in the request; and

providing a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.

2. The method of claim 1, wherein the request is based on a URL in a page associated with the web site.

3. The method of claim 2, wherein the URL comprises a digital signature, the digital signature being based on at least one of a private cryptographic key at a web server or a symmetric cryptographic key that is a shared secret between the third party authentication server processor and the web server.

4. The method of claim 1, further comprising:

sending a request from the third party authentication server processor to the client computer for an artifact stored at the client computer; and

receiving the artifact from the client computer at the third party authentication server processor, wherein the artifact comprises a user identifier.

5. The method of claim 1, wherein registration data further comprises a media item, the media item comprising at least of an audio segment, a video segment, an animation segment, or a graphic segment.

6. A system comprising:

a processor;

a memory coupled to the processor, the memory storing instructions adapted to be executed by the processor to;

receive registration data associated with a user, wherein the registration data comprises a distortion template;

receive a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;

determining whether authenticate the web site is authentic using the information in the request; and

provide a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.

7. The system of claim 6, wherein the request is based on a URL in a page associated with the web site.

8. The system of claim 6, wherein the URL comprises a digital signature, the digital signature being based on at least one of a private cryptographic key at a web server or a symmetric cryptographic key that is a shared secret between the processor and the web server.

9. The system of claim 6, further comprising

a database storing a record that correlates a user identifier with the user-defined indicator.

10. The system of claim 9, wherein the registration data further comprises a media item, the media item comprising at least one of an audio segment, a video segment, an animation segment, or a graphic, segment.

11. The system of claim 10, wherein the user-defined indicator comprises a digital signature.

12. A non-transitory computer-readable medium storing instructions adapted to be executed by a processor to perform operations comprising:

receiving, at a third party authentication server, registration data associated with a user, wherein the registration data comprises a distortion template;

receiving at the third party authentication server a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;

determining whether the web site is authentic using the information in the request; and

providing a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.

13. The medium of claim 12, the operations further comprising:

sending a request from the authentication server to the client computer for an artifact stored at the client computer and

receiving the artifact from the client computer at the authentication server, where the artifact comprises a user identifier.

14. The medium of claim 12, wherein the registration data further comprises a media item, the media item comprising at least one of an audio segment, a video segment, an animation segment, or a graphic segment.