WO2009035451A1 - Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé - Google Patents

Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé Download PDF

Info

Publication number
WO2009035451A1
WO2009035451A1 PCT/US2007/078215 US2007078215W WO2009035451A1 WO 2009035451 A1 WO2009035451 A1 WO 2009035451A1 US 2007078215 W US2007078215 W US 2007078215W WO 2009035451 A1 WO2009035451 A1 WO 2009035451A1
Authority
WO
WIPO (PCT)
Prior art keywords
information indicator
digital certificate
information
browser
downloaded
Prior art date
Application number
PCT/US2007/078215
Other languages
English (en)
Inventor
Melih Abdulhayoglu
Original Assignee
Melih Abdulhayoglu
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Melih Abdulhayoglu filed Critical Melih Abdulhayoglu
Priority to PCT/US2007/078215 priority Critical patent/WO2009035451A1/fr
Publication of WO2009035451A1 publication Critical patent/WO2009035451A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G06F21/445—Program or device authentication by mutual authentication, e.g. between devices or programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing

Definitions

  • the present invention relates to providing website information indicators to users browsing non-secure websites.
  • the site is accessed via a SSL/TLS connection.
  • the site being connected to has a digital certificate that provides the data necessary to make secure connection along with important verification information.
  • the information provided and the security assurance given depends on the quality of the digital certificate used.
  • a browser visiting a site that can be verified or authenticated by a digital certificate will often indicate the presence of the digital certificate to the user by revealing some form of visual or audio security indicator.
  • the presence of the security indicator lets the consumer know that the transaction being conducted is secure.
  • users, when accessing the site will see a pictorial representation of verification or have the border of the browser change colors.
  • EV SSL certificates are the next generation in Internet security as they require rigorous authentication of a business 's identity.
  • Merchants using EV SSL certificates must undergo a vetting process that requires the issuing certificate authority to validate company details, such as the legal status, registration number, and address and phone number of the company, prior to issuance.
  • merchants using EV Certificate are even more adversely affected than merchants with standard SSL certificates as consumers don't have any indication that an EV Certificate exists until the secured connection is initiated. This means that site owners who have met the rigors of EV validation and have purchased the enhanced security have no way of indicating to users browsing their site that they include the added assurance that an EV Certificate provides prior to the commencement of the secure connection.
  • site owners who have met the rigors of EV validation and have purchased the enhanced security have no way of indicating to users browsing their site that they include the added assurance that an EV Certificate provides prior to the commencement of the secure connection.
  • a method is needed to indicate to browsing consumers that a website can be trusted prior to their initiation of a secured transaction.
  • the level of security offered by a website is information that needs to be provided to consumers early on during their browsing experience. Waiting until they enter the secure portion of a site is too late.
  • digital certificate information should be available as the first time a user navigates to the site.
  • the invention disclosed teaches that information indicators regarding a site's digital certificate may be used on a non-secure or http site to inform consumers that a corresponding secure site exists.
  • the method works by retrieving the URL of a visited web site. Once the URL is known, a secure connection can be established using SSL/TLS to the secured version of the domain name. If a secure connection cannot be established (such as the https port being closed or when a secure version of the domain doesn't exist), the browser can be modified to display security indicators that alert the user that their shopping experience may not be safe.
  • a plug-in can be used to display an information indicator relating security assurances on a browser navigating to a non-secure site without a corresponding secured site to alert the user that a secure version of the site does not exist.
  • a plug-in can be instructed to download the digital certificate associated with the site.
  • the certificate can then be examined by the plug-in.
  • the examination can consist of comparing the thumbprint of the certificate to a thumbprint stored in a secured database on a trusted third-party site, certificate chaining, and time validation. If the thumbprint matches what is stored in the database and the other validation procedures pass, then the site is considered secure and appropriate information indicators are provided. Further comparisons (such as comparing various certificate fields or other certificate information stored in both the certificate and the database) can be used to ensure that the certificate is both authentic and associated with the correct site. Any certificate checks or assurances described herein can be used in tandem with each other to achieve a high level of authentication assurance.
  • a plug-in can check a database to see if the visited site has a corresponding site that is secured by a digital certificate. If so (or if not), the visual indicators are displayed. More advanced embodiments (such as the thumbprint check described previously) are preferred to provide greater security to the consumer. Further, the method is especially useful with EV Certificates as these certificates have undergone rigorous validation procedures. With EV Certificates, the method can be used to let users know that the site being visited has been verified as a valid Internet presence that may be transacted with safely.
  • the plug-in software can perform a typical certificate validation procedure on the downloaded certificate to determine whether the site is secure. This can be done by tracing the path of a certificate downloaded from the secure site to a root certificate stored in any typical certificate storage location (such as the browser, the operating system, or in the plug-in software itself). If the path exists, the plug-in can alert that the secure portion of the site has a digital certificate. The plug-in or the browser itself will then display the appropriate security indicators. These security indicators can be enhanced by the plug-in to provide different levels of assurance on the non-secure (http) site. Different information indicators can be displayed depending on the type of certificate found on the secured site and the certificate's life-cycle status (i.e., whether the certificate is revoked or expired).
  • Information indicators can be anything that provides assurance to the consumer that the secured version of the site is a safe place to conduct transactions. Common information indicators include a visual modification of the web browser, an audio alert, or a new pop-up window displaying the security message. For example, when a secured site has an EV Certificate, the border of the screen can be turned green to reflect the added level of security available.
  • the information indicators used by the plugin can either be set by the browser or selected by the user. Allowing the user to select the information indicators greatly enhances the security of the method because it further prevents fraudsters from fraudulently displaying information indicators to the user. Examples include allowing the user to select which color to display or what audio sound should be used to alert the consumer that a non-secure http site has a secure counterpart.
  • FIG. Ia depicts a diagram of one embodiment of the present invention.
  • FIG. Ib shows a flowchart of an embodiment of a method of showing information indicators on a non-secure site.
  • FIG 2 shows a flowchart of an alternate embodiment of a method of showing information indicators on a non-secure site.
  • FIG 3 shows a flowchart of an alternate embodiment of a method of showing information indicators on a non-secure site.
  • FIG 4 shows a flowchart of an alternate embodiment of a method of showing information indicators on a non-secure site.
  • FIG 5 shows a flowchart of how a method of showing information indicators on a non-secure site can be used with registry entries to track multiple browser windows or tabs.
  • Figure Ia and Ib depict one embodiment of the structure of the invention.
  • Figure Ib is a flowchart of the embodiment of the invention.
  • the user 2 uses a browser 4 to navigate over the internet or network 10 to a non-secure website 12.
  • This can be an internet store site, a government site, or any other site that user might visit.
  • the user is a consumer that will be visiting the website via the Internet (over http) and is looking to complete a commercial transaction.
  • the user 2 could also be simply browsing the internet or window shopping.
  • the site 12 does not necessarily have to be located on the internet, and the user could be browsing an intranet or simply examining potential sites on their own network.
  • Step 204 the URL of the website 12 being visited is retrieved using any conventional method.
  • Such methods include, but are not limited to, retrieving the URL directly through the browser, by using web-based scripting, or by utilizing a software plug-in.
  • a browser extension or plug-in that performs the URL retrieval is useful as it can be used to perform all of the other steps in the method and can simplify the implementation of the invention.
  • plug-in and browser extension are used interchangeably for the purposes of this patent as either may be used in all cases.
  • An independent browser can also be created that incorporates the method, and it should be recognized that such an independent browser is the same as having a plug-in or browser extension included in an existing browser.
  • a plug-in 6 attempts to connect to the domain using HTTPS (SSL/TLS on port 443).
  • HTTPS SSL/TLS on port 443
  • the plug-in' s 6 attempt to connect over HTTPS initiates a secured connection with the secured version of the site 14 being visited.
  • the request to connect securely to the HTTPS site can be initiated automatically by the plug-in 6 or a separate set of code or may be initiated manually by the user 2 by clicking a button or some similar activity. Automatic initiation by the plug- in 6 is advantageous as it requires less input from the user 2.
  • the plug-in's 6 attempt to initiate a secured connection with the secure site 14 prompts the download of the digital certificate 16 associated with the secure site 14, if the secure site 14 exists (Step 208).
  • the data in the digital certificate is used to encrypt the data for the public key certificate and negotiate the key to be used in the session encryption.
  • the secure session must be established by completing a successful TLS/SSL handshake for the establishment of the session key. Establishing the secure connection proves the ownership of the provate key and, thus, authenticates the server as the owner of the digital certificate.
  • the digital certificate 16 may be downloaded through the browser 4, the plug-in 6 initiating the secure server request, a separate third- party application, a download request from the user 2, or any other standard method of downloading certificates over the internet.
  • the session may be closed immediately after the handshake is complete if desired.
  • Step 208 if a digital certificate 16 is not available, the plug-in 6 or download instruction will fail and no certificate will be retrieved. Likewise, if the secure port is not open on the browsing computer and the plug-in or code instruction is unable to connect to the secure site 14, then no certificate will be returned or downloaded. In Step 210, if a digital certificate 16 is not returned then no further actions are taken. In the alternative, an information (or security) indicator 8 is displayed by the plugin 6 or browser 4 to alert the user 2 that the site 12 may not be secured or that the site 12 may be risky to conduct business with. Such security indicators 8 can be anything that lets the user known that a secure version of the site is not available, and might include a red border around the browser or computer screen, an audio warning, or a pop-up message displaying the details of the attempted certificate retrieval routine.
  • step 212 if a digital certificate 16 is available, the plug-in 6 retrieves the certificate's information.
  • the downloaded certificate 16 can be examined by the user 2, browser application 4, or plug-in 6 is ensured authentic and valid by completing the typical private key secure connection during the download.
  • a plug-in 6 (preferably the same plug-in that requested the secure connection) checks the certificate's validity 26. As shown in Figure 2, this can be done by checking the certificate's thumbprint against a list of valid certificates to determine whether the certificate qualifies to display information indicators on the non-secure site.
  • the certificate list should be maintained on a separate secured site to ensure its integrity. In a preferred embodiment, the list is signed and contained within a PKCS#7 Cryptographic Message format.
  • the certificate can also be validated using certificate chaining, time validation, checking certificate numbers, etc. All of the typical validation checks can be used in tandem to create an even higher level of security assurance for the user.
  • step 214 additional checks of the certificate information can be used to ensure the site's identity and prevent fraudsters from returning false data to the program.
  • Checks can include checking certificate names, file size, and other validated information found in the certificate against entries in a trusted database.
  • the plug-in 6 can then confirm that information in the downloaded certificate is the same as the information in the originally validated certificate. This can also be used to limit information indicators to specific Certification Authority brand certificates or to certificates that meet certain special requirements such as EV vetting.
  • step 216 if the certificate 16 passes the desired checks, then the plug-in 6 can display information indicators 8 on the client's web browser 4 while the browser remains navigated to the non-secured site 12. Alternatively, the plug-in 6 can instruct the browser 4 to display the information indicators 8. Different sets of information indicators can be displayed or used to indicate different certificate types. Different certificate indicators can be displayed depending on any of the information retrieved from the certificate, such as certificate issuer, certificate type, and lifecycle status, or the number of verification checks performed on and passed by the certificate during the plug-ins verification process.
  • Step 214 the revocation and expiration dates of the downloaded certificate can be checked to ensure that the certificate is still valid.
  • Different information indicators 8 can be used to show that the secured site 14 has a revoked or expired certificate 16 and should not be trusted despite the existence of a digital certificate.
  • a plug- in 6 or scripting language can be used to retrieve the website's domain name or address from a database maintained by a trusted source.
  • Step 404 if the domain name or address of the secure site 14 is found in the database, then the plug-in 6 can be instructed to display the appropriate information indicators 8.
  • different security indicators can be displayed based on the results of the database query. For example, if the database query results show the site as having an EV certificate, enhanced security indicators can be presented to the user to reflect this fact.
  • the plug-in 6 can maintain a (preferably encrypted) list of root certificates and then use standard certificate validation procedures to trace a path from the downloaded certificate up to the root certificate instead of (or in addition to) checking a trusted third-party database for the certificate. If a path can be successfully traced from the downloaded certificate to the root certificate (or vice versa), then the downloaded certificate is considered valid and the information indicators 8 will be displayed for the non-secure site 12 .
  • the plug-in 6 can also check the browser's list of stored root certificates or a local or remote cache of certificates to see if a valid path can be traced from the downloaded certificate to a valid root certificate.
  • the described method is advantageous to users as the entire method can occur automatically when visiting a web site.
  • the browser or plug-in can be configured to automatically retrieve the certificate for each site visited without further input by the user. This can be done by having the plug-in execute on startup of either the operating system or the browser. Once the plug-in is active, the plug-in can examine each page navigated to by the user. The plug automatically reads the URL of each site visited or of the site that is last in focus, retrieves the certificate by establishing an SSL connection, and then automatically determines the validity and authenticity of the certificate retrieved, displaying the security indicators as appropriate. Nothing is required from the user.
  • the method may also be semi-automatic by making any of the steps require manual approval or activation by the user.
  • the address bar background color is changed to green if a site has a secure version that contains an EV Certificate. If an EV Certificate does not exist, then information indicators are not displayed by either the plug-in or the browser. Even if a digital certificate is found, a secure connection indicator is not shown on the http site or browser (such as the padlock symbol) to help avoid consumer confusion between secure sites and non-secured sites. It should be noted that information indicators other than colors may be used to show the presence of a digital certificate. Other possibilities include, but are not limited to, other visual displays such as pictures, graphics, or text, or audio warnings. Any information indicator can be used that can be displayed by the browser, scripting code, or plug-in.
  • Different security indicators can be used to display different levels of trust. For example, a red indicator can be used to indicate that a digital certificate could not be retrieved or that the validation of the certificate failed, a yellow indicator can be used to indicate that a standard SSL certificate is present, and a green indicator can be used to show that an EV certificate was found.
  • Different security indicators help relate to the user the risk of conducting a secured transaction with the particular site. Because the indicators are being displayed on the non-secured site, the user knows that a site can or can't be trusted prior to entering any secured areas and prior to providing any secured information.
  • connection with the secure site is initiated independent of the browser's connection to the site being viewed.
  • Validation of the secured site can be performed independently of the website in focus. This allows users to turn off the method if desired and helps increase the security of the described method by making the code less accessible to potential fraudsters.
  • the plug -in 6 can retrieve the certificate from the secured site (Step 602) and then automatically place the certificate and window handle (identity of the window to which the certificate belongs) in the Registry (Step 604).
  • a registry entry does not verify the validity of the certificate because it could have been created and displayed independently by a fraudulent web site operator.
  • the plug-in, external software, or html code within the web site itself can direct the plug-in application to verify the digital signature of the secure website as disclosed above.
  • the registry is then updated with certificate and window handle data.
  • a reverification request is made. This can be made by the user, the plug-in application, or by the browser application itself.
  • the plug-in application can also be on a timer to automatically activate once the timer expires.
  • the browser application can also contain an instruction to verify the certificate once certain parameters are met (such as a certain amount of time has passed, certain actions have been taken by the user, or any other method of automatically activating code).
  • the plug-in application checks the registry for all certificate and window handle data.
  • the plug-in application then verifies the digital signature of all certificates identified and verifies that the web-page is indeed associated with a corresponding legitimate secure site. After identifying which certificate belongs to which window, from the window handle data, the plug-in application displays the appropriate authentication indicators (Step 216). Doing this allows the user to have multiple browser windows or tabs open, each displaying its own information indicators. This embodiment also allows the system to continuously check the certificate's validity and presence to prevent hijacked browser sessions.
  • the plug-in software can then select which information indicators should be displayed depending on the digital certificate information associated with the secure site.
  • the user can configure the plug- in to show only indicators if certain security parameters are met (i.e. the certificate has not been revoked, the certificate is an EV certificate, etc).
  • a user might want to configure the plug-in to display no indicator if a site is lacking a certificate, a certain picture for sites that use a standard SSL certificate, and a flashing border for sites using an EV Certificate.
  • the ability of the user to select these features themselves helps ensure that a fraudster cannot simply paint the security indicators on every site developed in an attempt to deceive the user.
  • the plug-in software itself can decide which indicators should be presented to the user. This can be done by having the plug-in software retrieve a trigger from a secure database (either located in the plug-in itself or on a trusted secured site) that instructs the plug-in about which indicators should be displayed for each site visited. In this manner each non-secured site could potentially have its own different method of indicating that a secured version of the non-secure site exists. This helps show sites even more securely as it helps prevent phishing sites from replicating the security indicators.
  • This embodiment can also be used to incorporate company logos or themes into the security indicators. All that needs to be done is store the logo or theme to be displayed in the secure database.
  • Connections referred to as being via the Internet can be by other communication methods eg buy a local area network ("LAN”) or wide area network ("WAN").
  • LAN local area network
  • WAN wide area network
  • the database of certificates can also be a database and/or application on a user's machine.
  • the plug-in may reside on the user's machine, on a third-party machine, or on a server machine, and may be accessed remotely.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

La présente invention concerne un procédé et un système pour afficher des indicateurs d'informations qui aident à fournir des assurances de sécurité aux consommateurs. Le procédé fonctionne grâce à un plug-in ou une extension de navigateur qui détermine l'URL d'un site parcouru. Le navigateur initie ensuite une connexion sécurisée avec le domaine associé à l'URL d'un site parcouru. Le plug-in peut ensuite afficher un indicateur selon s'il existe ou non un certificat numérique. Si on le souhaite, le plug-in peut effectuer d'autres vérifications pour s'assurer de la validité et de l'authenticité du certificat. Les indicateurs d'information peuvent être statiques, présélectionnés par le programme ou sélectionnés par l'utilisateur final.
PCT/US2007/078215 2007-09-12 2007-09-12 Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé WO2009035451A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/US2007/078215 WO2009035451A1 (fr) 2007-09-12 2007-09-12 Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/US2007/078215 WO2009035451A1 (fr) 2007-09-12 2007-09-12 Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé

Publications (1)

Publication Number Publication Date
WO2009035451A1 true WO2009035451A1 (fr) 2009-03-19

Family

ID=40452282

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2007/078215 WO2009035451A1 (fr) 2007-09-12 2007-09-12 Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé

Country Status (1)

Country Link
WO (1) WO2009035451A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114844857A (zh) * 2022-04-02 2022-08-02 南京邮电大学 基于域名的网站https部署测量自动化方法

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030188194A1 (en) * 2002-03-29 2003-10-02 David Currie Method and apparatus for real-time security verification of on-line services
US20030191967A1 (en) * 2000-10-10 2003-10-09 David Naccache Method for protection against fraud in a network by icon selection
US20040068665A1 (en) * 1998-04-30 2004-04-08 Openwave Systems Inc. Method and apparatus for maintaining security in a push server
US6744452B1 (en) * 2000-05-04 2004-06-01 International Business Machines Corporation Indicator to show that a cached web page is being displayed
US6925595B1 (en) * 1998-08-05 2005-08-02 Spyglass, Inc. Method and system for content conversion of hypertext data using data mining
US20050289034A1 (en) * 2004-06-25 2005-12-29 Roth Jason T Website submission security monitor
US20070055867A1 (en) * 2003-03-14 2007-03-08 Rajesh Kanungo System and method for secure provisioning of encryption keys
US20070180225A1 (en) * 2005-02-24 2007-08-02 Schmidt Jeffrey A Method and system for performing authentication and traffic control in a certificate-capable session

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040068665A1 (en) * 1998-04-30 2004-04-08 Openwave Systems Inc. Method and apparatus for maintaining security in a push server
US6925595B1 (en) * 1998-08-05 2005-08-02 Spyglass, Inc. Method and system for content conversion of hypertext data using data mining
US6744452B1 (en) * 2000-05-04 2004-06-01 International Business Machines Corporation Indicator to show that a cached web page is being displayed
US20030191967A1 (en) * 2000-10-10 2003-10-09 David Naccache Method for protection against fraud in a network by icon selection
US20030188194A1 (en) * 2002-03-29 2003-10-02 David Currie Method and apparatus for real-time security verification of on-line services
US20070055867A1 (en) * 2003-03-14 2007-03-08 Rajesh Kanungo System and method for secure provisioning of encryption keys
US20050289034A1 (en) * 2004-06-25 2005-12-29 Roth Jason T Website submission security monitor
US20070180225A1 (en) * 2005-02-24 2007-08-02 Schmidt Jeffrey A Method and system for performing authentication and traffic control in a certificate-capable session

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114844857A (zh) * 2022-04-02 2022-08-02 南京邮电大学 基于域名的网站https部署测量自动化方法
CN114844857B (zh) * 2022-04-02 2023-08-25 南京邮电大学 基于域名的网站https部署测量自动化方法

Similar Documents

Publication Publication Date Title
EP2263348B1 (fr) Procédé et système pour afficher des indicateurs d'informations de vérification pour un site internet non sécurisé
US9838380B2 (en) Visualization of trust in an address bar
EP3432541B1 (fr) Procédé et appareil de connexion de site web
US8667573B2 (en) Validating the origin of web content
CN104580172B (zh) 一种基于https协议的数据通信方法及装置
EP1451660B1 (fr) Ameliorations relatives a des procedes d'acces et d'utilisation de pages web
US8707048B2 (en) Dynamic pattern insertion layer
US8689345B1 (en) Mitigating forgery of electronic submissions
JP2009527850A (ja) 評判情報を含む情報の識別
JP4818664B2 (ja) 機器情報送信方法、機器情報送信装置、機器情報送信プログラム
US20040243802A1 (en) System and method employed to enable a user to securely validate that an internet retail site satisfied pre-determined conditions
US10652244B2 (en) Cross-site request forgery (CSRF) prevention
US20080059380A1 (en) Method and apparatus for secure purchase and banking transactions
EP1965560A1 (fr) Procédé et système pour la gestion de l'accès sécurité au contenu de réseau
JP5278495B2 (ja) 機器情報送信方法、機器情報送信装置、機器情報送信プログラム
CN109960945B (zh) 浏览器主动安全保护方法及系统
WO2009035451A1 (fr) Procédé et système pour afficher des indicateurs d'information de vérification pour un site web non sécurisé
JP2006171892A (ja) ウェブサイト所有者情報伝達方法、ウェブサイト所有者情報送信装置及び方法並びにプログラム
US20240020376A1 (en) System and method for safely autofilling login fields in computing sources
CN118300864A (zh) 基于Web应用的免密登录方法、装置、设备和介质
Degenne Economic Incentives in the HTTPS Authentication Process

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07842295

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 07842295

Country of ref document: EP

Kind code of ref document: A1