Securing locally stored Web-based database data

• US 8,838,962 B2
• Filed: 09/24/2010
• Issued: 09/16/2014
• Est. Priority Date: 09/24/2010
• Status: Active Grant

• Current Assignee: Advanced Research LLC
• Original Assignee: Advanced Research LLC
• Inventors: Lee, Bryant Christopher
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/890,008
• Publication Number:
  US 20120079267A1
• Time in Patent Office: 1,453 Days
• Field of Search: 713/156
• US Class Current: 713/156
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The present invention extends to methods, systems, and computer program products for locally storing Web-based database data in a secure manner. Embodiments of the present invention permit Web-based database data to be locally stored at a computer system to increase the efficiency of rendering the Web-based database data within a Web browser at the computer system. Web-based database data can be sandboxed per domain to mitigate (and possibly eliminate) the exposure of the Web-based database data to malicious computer systems. A web server may be required to authenticate itself before it may present database data to be locally stored at a computer system. A web server may be required to authenticate itself before being allowed to access database data stored locally at a computer system.

Claims

1. At a computer server including a Web server, an application, content, and a database, the computer server connected over a network to a computer system including a Web browser, a browser cache, a local store access module, and a controlled access local store, the Web browser for browsing Web-based content, the contents of the browser cache fully accessible to any Web server in communication with the Web browser, the local store access module controlling access to contents of the controlled access local store based on domains associated with Web server requests to access the contents of the controlled access local store, the controlled access limiting further access to each portion of content in the local access store to requests from the domain that initially sent the portion of content for storage in the controlled access local store, a method for caching database data at the computer system for subsequent Web browser access in a secure manner, the method comprising:

a Web server in a specified domain verifying that it has access rights to store a database portion in the controlled access local store at the computer system, by a method of digital certification comprising;

receiving a request sent from the computer system to the Web server in the specified domain, the request requesting that the Web server verify its identify;

sending a digital certificate from the Web server to the computer system, the digital certificate containing a digital signature of a certificate authority, the digital certificate containing a public key for the specified domain;

wherein the computer system verifies the authenticity of the digital certificate by verifying the authenticity of the digital signature of the certificate authority;

receiving a request sent from the computer system to a Web server in the specified domain, the request requesting that the Web server send an acknowledgement with a digital signature of the specified domain;

sending an acknowledgement from the Web server to the computer system, the acknowledgement containing a digital signature of the specified domain;

wherein the computer system verifies the authenticity of the acknowledgement by verifying the authenticity of the digital signature of the specified domain by using the public key for the specified domain;

wherein the computer system stores an indication that the Web server has access rights to store the database portion in the controlled access local store;

receiving a Web based request sent from the computer system to the Web server in the specified domain, the Web based request requesting access to a Web page that includes the database portion and other content, the database portion stored in a database accessible to the Web server;

sending the requested Web page from the Web server to the computer system, the Web page including the database portion and the other content;

wherein a Web browser in the computer system caches the other content in the browser cache;

wherein the computer system stores the database portion in the controlled access local store such that data contained in the stored database portion can be locally provided to the Web browser without the data being included in network based communication;

wherein the computer system retains an indication that the database portion was received from the specified domain so that the local store access module can limit access to the database portion stored in the controlled access local store, the limited access including;

permitting requests from Web servers in the specified domain to access the database portion for use in Web pages presented at the Web browser, wherein the web servers in the specified domain have authenticated that they are in the specified domain by a method of digital certification comprising;

receiving a request sent from the computer system to a Web server in the specified domain, the request requesting that the Web server verify its identify;

sending a digital certificate from the Web server to the computer system, the digital certificate containing a digital signature of a certificate authority, the digital certificate containing a public key for the specified domain;

wherein the computer system verifies the authenticity of the digital certificate by verifying the authenticity of the digital signature of the certificate authority;

receiving a request sent from the computer system to the Web server in the specified domain, the request requesting that the Web server send an acknowledgement with a digital signature of the specified domain;

sending an acknowledgement from the Web server to the computer system, the acknowledgement containing a digital signature of the specified domain;

wherein the computer system verifies the authenticity of the acknowledgement by verifying the authenticity of the digital signature of the specified domain by using the public key for the specified domain;

and preventing requests from Web servers in other domains from accessing the database portion.

2. The method of claim 1, further comprising:

wherein the Web server may send a request to the computer system indicating the database portion be stored in a secure or non-secure manner;

wherein if the Web server sends a request indicating the database portion be stored in a secure manner, then the computer system retains an indication that the database portion was received from the specified domain so that the local store access module can limit access to the database portion stored in the controlled access local store, the limited access including;

permitting requests from Web servers in the specified domain to access the database portion for use in Web pages presented at the Web browser, wherein the web servers in the specified domain have authenticated that they are in the specified domain by a method of digital certification comprising;

receiving a request sent from the computer system to a Web server in the specified domain, the request requesting that the Web server verify its identify;

sending a digital certificate from the Web server to the computer system, the digital certificate containing a digital signature of a certificate authority, the digital certificate containing a public key for the specified domain;

wherein the computer system verifies the authenticity of the digital certificate by verifying the authenticity of the digital signature of the certificate authority;

receiving a request sent from the computer system to a Web server in the specified domain, the request requesting that the Web server send an acknowledgement with a digital signature of the specified domain;

sending an acknowledgement from the Web server to the computer system, the acknowledgement containing a digital signature of the specified domain;

wherein the computer system verifies the authenticity of the acknowledgement by verifying the authenticity of the digital signature of the specified domain by using the public key for the specified domain;

and preventing requests from Web servers in other domains from accessing the database portion;

wherein otherwise, then the computer system retains an indication that the database portion was received from the specified domain so that the local store access module can limit access to the database portion stored in the controlled access local store the limited access including;

permitting requests from Web servers in the specified domain to access the database portion for use in Web pages presented at the Web browser;

and preventing requests from Web servers in other domains from accessing the database portion.