Visualization of trust in an address bar

• US 8,843,749 B2
• Filed: 05/07/2010
• Issued: 09/23/2014
• Est. Priority Date: 03/23/2005
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Sauve, Aaron J., Van Dok, Cornelis K., Silbey, Marc A.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Tran, Tongoc
• Application Number:
  US12/776,260
• Publication Number:
  US 20100217989A1
• Time in Patent Office: 1,600 Days
• Field of Search: 713/176, 713/156, 713/170, 713/175, 713/168, 713/180, 726/2, 726/10, 726 17- 19, 705/44
• US Class Current: 713/175
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Described are a system and method for presenting security information about a current site or communications session. Briefly stated, a browsing software is configured to receive a certificate during a negotiation of a secure session between a local device and a remote device. The certificate includes security information about a site maintained at the remote device. The security information is displayed to a user of the browsing software in a meaningful fashion to allow the user to make a trust determination about the site. Displaying the security information may include presenting a certificate summary that includes the most relevant information about the certificate, such as the name of the owner of the site and the name of the certificating authority of the certificate.

Claims

1. A system comprising:

one or more processors;

one or more computer-readable storage media storing instructions that, when executed via the one or more processors, cause the one or more processors to implement a browser configured to;

output a webpage in a display portion of the browser responsive to navigation of the browser to the webpage;

display a visual representation of a level of trust established for the webpage via an address bar of the browser, the address bar incorporating a protocol portion to present a uniform resource locator (URL) corresponding to the webpage and a security bar portion to present the visual representation of the level of trust in conjunction with the URL.

2. The system recited in claim 1, wherein the browser is further configured to enable navigation to obtain the webpage from a website over a network.

3. The system recited in claim 2, wherein the browser is further configured to:

receive an assertion of trust corresponding to the webpage via the website responsive to navigation to obtain the webpage; and

establish the level of trust based on the assertion of trust that is received.

4. The system recited in claim 2, wherein the browser is further configured to establish the level of trust based upon a certificate that is presented by the website responsive to navigation of the browser to obtain the webpage.

5. The system recited in claim 1, wherein the visual representation comprises an icon indicative of the level of trust.

6. The system recited in claim 1, wherein the visual representation comprises a color indicative of the level of trust.

7. The system recited in claim 1, wherein the visual representation comprises a name of a trusted entity associated with the webpage.

8. The system recited in claim 1, wherein the visual representation comprises one or more of an icon, a color, or a name of an entity associated with the webpage.

9. The system recited in claim 1, wherein to display the visual representation of the level of trust comprises coloring at least the security bar portion of the address bar to indicate the level of trust.

10. The system recited in claim 1, wherein to display the visual representation of the level of trust comprises coloring both the protocol portion and the security bar portion to indicate the level of trust.

11. The system recited in claim 1, wherein the browser security bar portion incorporated with the address bar is further configured to respond to one or more user actions to cause an expanded summary of security information to appear proximate to the security bar portion.

16. The computer-implemented method recited in claim 10, wherein the visual representation of the level of trust comprises one or more of an icon, a color, or a name of an entity associated with the URL.

17. The computer-implemented method recited in claim 10, wherein displaying the visual representation of the level of trust comprises coloring at least the security bar portion of the address bar to indicate the level of trust.

12. A computer-implemented method comprising:

rendering content in a display portion of a browser responsive to navigation of the browser to a uniform resource locator (URL) to obtain the content; and

displaying a visual representation of a level of trust established for the content via an address bar of the browser based upon an assertion of trust corresponding to the URL, the address bar incorporating a protocol portion to present the URL corresponding to the content and a security bar portion to present the visual representation of the level of trust in conjunction with the URL.

13. The computer-implemented method recited in claim 12, further comprising:

detecting a user action to interact with the security bar portion; and

responsive to the user action, exposing a security summary portion of the address bar that is configured to include expanded security related information regarding the content.

14. The computer-implemented method recited in claim 12, further comprising:

receiving the assertion of trust as a certificate that corresponds to the content responsive to navigation to the URL; and

establishing the level of trust based on the certificate.

15. The computer-implemented method recited in claim 14, wherein the certificate comprises a secure socket layer (SSL) certificate.

18. One or more computer readable storage media storing instructions that, when executed by one or more devices of a computing system, cause the computing system to perform acts including:

outputting a webpage in a display portion of a browser responsive to navigation of the browser to the webpage;

receiving an assertion of trust corresponding to the webpage responsive to the navigation;

establishing a level of trust for the webpage based on the assertion of trust that is received; and

displaying a visual representation of the level of trust established for the webpage via an address bar of the browser, the address bar incorporating a protocol portion to present a uniform resource locator (URL) corresponding to the webpage and a security bar portion to present the visual representation of the level of trust in conjunction with the URL, the visual representation including at least coloring the security bar portion of the address bar to indicate the level of trust.

19. One or more computer-readable storage media as recited in claim 18, wherein coloring the security bar portion of the address bar to indicate the level of trust comprises:

coloring the security bar portion in a first color when the assertion of trust is determined to be valid; and

coloring the security bar portion in a second color when the assertion of trust is determined to be invalid.

20. One or more computer-readable storage media as recited in claim 18, wherein the instructions, when executed by the one or more devices of the computing system, further cause the computing system to perform acts including:

detecting a user action to interact with the security bar portion; and

responsive to the user action, exposing a security summary portion of the address bar that is configured to include expanded security related information regarding the webpage.