Browser plug-in for secure credential submission

• US 9,124,566 B2
• Filed: 06/23/2009
• Issued: 09/01/2015
• Est. Priority Date: 06/23/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Deurbrouck, John, Baker, Caleb G., Zhu, Danhua, Dellow, Colin Leslie, Franco, Roberto A.
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US12/489,435
• Publication Number:
  US 20100325715A1
• Time in Patent Office: 2,261 Days
• Field of Search: 726/5, 726/9, 726/19, 726/20, 715/781, 715/835, 707/759, 707/769
• US Class Current: 1/1
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Described is a technology by which a plug-in (e.g., an ActiveX® control) instantiated by a web browser calls functions of a credential service to use a set of credential data (e.g., a card file) for logging into a website. If the credential service determines that a previously used card file for the website exists, a representation of that card file is displayed in the browser, and the data of that card file is used to obtain a token for logging in the user. If not found, an icon is presented instead, by which the user can select a user interface that allows selection of another card file that meets that meet the website'"'"'s requirements.

Claims

1. In a computing environment, a system comprising:

at least one processor;

a memory communicatively coupled to the at least one processor and including one or more components comprising;

a browser component configured to initiate a plug-in identified by content corresponding to a website, the plug-in configured to call functions of a credential service, including to determine whether a set of credential data that matches the website'"'"'s requirements is available and stored at a client device operating the browsing component, and if so, to obtain a token corresponding to the set of credential data for providing to the web site, the plug-in further configured to present a credential user interface when the credential service determines that no previously used set of credential data matches the website'"'"'s requirements, the credential user interface configured to display a visible representation of one or more other sets of credential data that match the website'"'"'s requirements, to process user selection of another set of credential data and to obtain a token corresponding to the other set of credential data.

2. The system of claim 1 wherein the plug-in comprises an ActiveX®

control or NPAPI component.

3. The system of claim 1 wherein the plug-in is identified in HTML content, and is associated with parameters including information that corresponds to the website'"'"'s requirements.

4. The system of claim 1 wherein the set of credential data comprises a card file maintained in a card store.

5. The system of claim 4 wherein the plug-in is further configured to display a visible representation of the card file.

6. The system of claim 1 wherein the credential service is further configured to determine whether a set of credential data that matches the website'"'"'s requirements is available by accessing a ledger associated with a card store.

7. The system of claim 1 wherein the plug-in is further configured to provide a select icon when no previously used credential data matches the website'"'"'s requirements credential user interface, and wherein the credential user interface is presented when the select icon is clicked.

8. The system of claim 1 wherein the credential service is further configured to obtain the token from an issuer service.

9. The system of claim 1 wherein the credential service includes functions called by the plug-in, including a function that when invoked instructs the credential service to obtain the token.

10. In a computing environment, a method comprising:

calling a credential service from a browser plug-in to determine whether a stored set of credential data previously associated with a website matches requirements set forth in parameters associated with the plug-in;

responsive to a determination that the set of credential data matches the requirements set forth in the parameters, calling the credential service to obtain a token corresponding to the credential data for providing to the website; and

responsive to a determination that the set of credential data does not match the requirements set forth in the parameters, displaying a credential user interface to select or create a set of credential data matching the requirements and calling the credential service to obtain a token corresponding to the set of credential data matching the requirements, the credential user interface configured to display a visible representation comprising claims corresponding to the other set of credential data.

11. The method of claim 10 further comprising, instantiating the plug-in by processing HTML that corresponds to a page of the website.

12. The method of claim 10 wherein a set of credential data previously associated with a website matches the requirements, and further comprising, displaying a representation of that set of credential data in association with the plug-in.

13. The method of claim 10 wherein the credential data does not match the requirements, and further comprising, calling the credential service to find at least one other set of credential data that meets the requirements, and presenting a representation of each other set of credential data that meets the requirements for user selection of another set.

14. The method of claim 13 further comprising, providing an icon that indicates that a set of credential data that meets the requirements is needed, and wherein presenting the representation of each other set of credential data occurs in response to user interaction with the icon.

15. The method of claim 10 further comprising, obtaining the token and submitting the token to the website.

16. The method of claim 15 wherein obtaining the token comprises providing a notification to the website, and in response to the notification, receiving a function call to get the token.

17. One or more computer-readable storage devices having computer-executable instructions, which in response to execution by a computer, cause the computer to perform steps comprising:

accessing information associated with a data store that maintains sets of credential data to determine whether a stored set of credential data previously associated with a website matches requirements set forth in parameters associated a the plug-in, and if so,

a) displaying a representation of that set of credential data that comprises a tile having a graphic and claims, obtaining a token corresponding to that set of credential data, and providing the token to a website, and if not,

b) searching for other sets of credential data that match the requirements, displaying a representation for each set of credential data that matches the requirements, receiving interaction with a displayed representation of another set of credential data, obtaining a token corresponding to the other set of credential data, and providing the token to a website.

18. The one or more computer-readable storage devices of claim 17 having further computer-executable instructions, which in response to execution by the computer, cause the computer to perform further steps, comprising:

providing a credential user interface.

19. The one or more computer-readable storage devices of claim 17 wherein accessing the information associated with a data store comprises reading a ledger associated with a card file data store.