US 10,313,136 B2Granted

Method and a system for verifying the authenticity of a certificate in a web browser using the SSL/TLS protocol in an encrypted internet connection to an HTTPS website

AssigneeOnline Solutions Oy

InventorJyrki Salmi

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method for verifying the authenticity of a certificate in a web browser using an SSL/TLS protocol in an encrypted Internet connection to an HTTPS website includes establishing an encrypted connection to the HTTPS website using the web browser on a user's terminal device. A certificate including a public key of the HTTPS website and signed by a trusted certificate authority is sent to the user's web browser from the web server using the Internet connection. The certificate authority that signed the certificate is compared against the list of trusted certificate authorities. The certificate authority is verified as being included in the list. The thumbprint of the certificate is sent as an additional security check key using a second messaging channel, external to the Internet connection between HTTPS website and web browser of the user's terminal device, and the contact data in the customer register. The additional security check key is compared with the thumbprint received by the web.

Claims12

Dependent claims

A method for verifying the authenticity of a certificate in a web browser using an SSL/TLS (Secure Socked Layer/Transport Layer Security) protocol in an encrypted internet connection to an HTTPS (Hypertext Transfer Protocol Secure) website, wherein a web server of the HTTPS website has an SSL certificate provided with a thumbprint issued by a certificate authority governed by a third party, the web server has registered contact data of a user in a customer register and the web browser has a list of trusted certificate authorities, the method comprising:

establishing an encrypted connection to the HTTPS website placed on the web server with the Internet connection as a first messaging channel using the web browser on the user's terminal device;
authenticating the user during a first step of a two phase login process to the HTTPS website with steps including:
sending a certificate including a public key of the HTTPS website and signed by a trusted certificate authority to the user's web browser from the web server using the Internet connection;
comparing the certificate authority that has signed the certificate against the list of trusted certificate authorities embedded in the web browser;
and verifying that the certificate authority is included in the list;
and authenticating the user during a second step of the two phase process to the HTTPS website after completing the verifying the certificate authority with steps including:
sending the thumbprint of the certificate as an additional security check key from the web server using a second messaging channel, external to the Internet connection between HTTPS website and web browser of the user's terminal device, and the contact data in the customer register based on the first step of the two phase login process;
comparing the additional security check key with the thumbprint received by the web browser from the web server via the Internet connection for verifying the authenticity of the certificate;
and
generating the certificate on a certificate server utilizing the private key of the certificate server and the public key of the HTTPS website.

7 more elements

A system for verifying the authenticity of a certificate in a web browser using the SSL/TLS (Secure Socked Layer/Transport Layer Security) protocol in an encrypted Internet connection with an HTTPS (Hypertext Transfer Protocol Secure) website, said system including:

a user's terminal device comprising a web browser for browsing HTTPS websites;
a web server for maintaining an HTTPS website, said web server having a public key of the HTTPS website and a private key of the HTTPS website for identifying the HTTPS website, a certificate with a unique thumbprint created by a trusted certificate authority governed by a third party, and a customer register for storing contact data of users independent of the Internet connection between the HTTPS website and web browser of the user's terminal device, said web server being arranged to send a certificate including a public key and signed by the certificate authority to the web browser on the user's terminal device, the HTTPS website having a two phase login process with a first phase for authenticating the user before an authenticity verification of the certificate and a second phase for authenticating the user after completing the verification of authenticity of the certificate;
an encrypted Internet connection for connecting the web server to the web browser on the user's terminal device and vice versa as a first messaging channel;
and
a second messaging channel external to the Internet connection for sending an additional security check key, said additional security check key comprising the thumbprint of the certificate for verifying the authenticity of the certificate;
a certificate server generating the certificate utilizing the private key of the certificate server and the public key of the HTTPS website;
wherein said web server is arranged to send the additional security check key on the second messaging channel to the user based on the user data in said customer register, and wherein the contact data of users is related to said second messaging channel.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/335,136Filed 26 Oct 2016
Priority: FI 2015576326 Oct 2015
Published: US 2017/0118029 A127 Apr 2017
Granted: 4 Jun 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 9/321
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 63/0823
For authentication of entities: using certificates
H04L 63/123
Applying verification of the received information: received data contents, e.g. message integrity

Family

US 2017/0118029 A1Pre-grant publication · published 27 Apr 2017
US 10,313,136 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key