Secure web container for a secure online user environment

• US 8,881,227 B2
• Filed: 03/15/2013
• Issued: 11/04/2014
• Est. Priority Date: 03/30/2010
• Status: Active Grant

• Current Assignee: Authentic8, Inc.
• Original Assignee: Authentic8, Inc.
• Inventors: Rajagopal, Ramesh, Petry, Scott M., Tosh, James K. Jr., Lund, Peter K., Cox, Fredric L., Moore, Adam P.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): MEJIA, FELICIANO S
• Application Number:
  US13/844,026
• Publication Number:
  US 20130340028A1
• Time in Patent Office: 599 Days
• Field of Search: 705/37, 705/26.1, 705/26.61, 726/11, 726 22- 26
• US Class Current: 726/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Disclosed herein are systems and methods that allow for secure access to websites and web-based applications and other resources available through the browser. Also described are systems and methods for invocation of a secure web container which may display data representative of a requesting party'"'"'s application at a user'"'"'s machine. The secure web container is invoked upon receipt of an API call from the requesting party. Thus, described in the present specification are systems and methods for constructing and destroying private, secure, browsing environments (a secure disposable web container), insulating the user and requesting parties from the threats associated with being online for the purposes of providing secure, policy-based interaction with a requesting party'"'"'s online services.

Claims

1. A secure system for providing, responsive to a requesting party API call, images representative of requesting party application web content to a user of the requesting party application, the user accessing the system through a local client machine, the system comprising:

an application programming interface operable to validate an API call received from a requesting party application of a requesting party application provider, and to invoke a secure web container in a private user area external to the local machine such that the local client machine receives the images representative of the requesting party application web content without receiving web code commands from a third-party online service provider'"'"'s site,

wherein the private user area can be established and disposed of, thereby protecting user data from unauthorized access.

2. The secure system according to claim 1, wherein the application programming interface is operable to determine a policy record associated with the requesting party application.

3. The secure system according to claim 2, wherein the application programming interface is operable to invoke the secure web container for displaying images representative of requesting party application web content at the local client machine based on the policy record.

4. The secure system according to claim 2, wherein the policy record is received from the requesting party application substantially simultaneously with the API call.

5. The secure system according to claim 2, further comprising a policy database memory comprising a plurality of policy records for a plurality of requesting party application providers, wherein the policy record associated with the requesting party application is retrieved from the policy database memory.

6. The secure system according to claim 5, further comprising a policy portal server connected to the policy database memory and accessible by administrators to set policy records for the plurality of requesting party application providers.

7. The secure system according to claim 6, wherein the administrator is one of the plurality of requesting party application providers, whereby the administrator is enabled to provide its own policy record.

8. The secure system according to claim 6, wherein the administrator can set policy records on behalf of the plurality of requesting party application providers.

9. The secure system according to claim 1, wherein the secure web container is invoked based on the triggering of one or more triggers defined within the requesting party application.

10. The secure system according to claim 5, further comprising a requesting party application provider data store comprising policy attributes governing aspects of user-interaction with the web content, wherein one or more of the policy attributes are associated with one or more of the plurality of policy records.

11. The secure system according to claim 5, wherein policy attributes governing aspects of user-interaction with the web content are received from the requesting party application substantially simultaneously with the API call, wherein one or more of the policy attributes are associated with one or more of the plurality of policy records.

12. The secure system according to claim 1, wherein the secure web container for displaying web content is a disposable web browser.

13. The secure system according to claim 12, wherein the disposable web browser is provided to display within an existing browser window at the local client machine as an additional tab of the existing browser window at the local client machine.

14. The secure system according to claim 12, wherein the disposable web browser is provided to display within an existing browser window at the local client machine as a sub-window associated with the existing browser window at the local client machine.

15. The secure system according to claim 12, wherein the disposable web browser is provided to display within an existing browser window at the local client machine as a separate system window at the local client machine.

16. The secure system according to claim 1, wherein the secure web container for displaying web content is disposed of at an end of a user session to further protect user data from unauthorized access.

17. The secure system according to claim 1, wherein the application programming interface is further operable to authenticate that the user on the local client machine is who the user purports to be.

18. The secure system according to claim 1, wherein the API call defines a policy.

19. The secure system according to claim 1, wherein the API call defines a policy record.

20. The secure system according to claim 1, wherein the requesting party applications comprise online services.

21. A method for providing images, responsive to a requesting party API call, representative of requesting party application web content to a user of the requesting party application, the user accessing a secure web container through a local client machine, the method comprising:

receiving an API call from a requesting party application of a requesting party application provider; and

invoking the secure web container in a private user area external to the local machine such that the local client machine receives the images representative of the requesting party application web content without receiving web code commands from a third-party online service provider'"'"'s site,

wherein the private user area can be established and disposed of, thereby protecting user data from unauthorized access.

22. The method according to claim 21, further comprising determining a policy record associated with the requesting party application.

23. The method according to claim 22, further comprising displaying web content at the local client machine based on the policy record.

24. The method according to claim 22, further comprising receiving the policy record from the requesting party application substantially simultaneously with the API call.

25. The method according to claim 22, further comprising retrieving the policy record associated with the requesting party application from a policy database memory comprising a plurality of policy records for a plurality of requesting party application providers.

26. The method according to claim 22, further comprising retrieving policy attributes from a requesting party application provider data store, wherein the policy attributes govern aspects of user-interaction with the web content, and wherein the policy attributes are associated with the policy record.

27. The method according to claim 21, further comprising instructing the local client machine to delete the secure web container and all associated content.

28. The method according to claim 21, further comprising displaying the secure web container within an existing browser window at the local client machine as an additional tab of the existing browser window at the local client machine.

29. The method according to claim 21, further comprising displaying the secure web container within an existing browser window at the local client machine as a sub-window associated with the existing browser window at the local client machine.

30. The method according to claim 21, further comprising displaying the secure web container within an existing browser window at the local client machine as a separate system window at the local client machine.