# US 12,003,538 B2 · Methods and systems for browser spoofing mitigation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,538 B2
- Document ID: US12003538B2
- Status: Granted
- Kind: B2
- Application number: 18/067,182
- Filed: 2022-12-16
- Published: 2023-04-20
- Granted: 2024-06-04
- Earliest claimed: 2020-02-18
- Assignees: Charles Schwab & Co., Inc.
- Applicants: TD Ameritrade IP Company, Inc.
- Inventors: John Scott Kula
- Web page: https://patentgrep.com/patent/US12003538B2

## CPC

- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/54: Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An authentication system includes an authentication module and a user history database storing order information that includes, for each of multiple logins of the first user to a web property, at least one of: an indication of an order of hypertext transfer protocol (HTTP) headers that were previously received at the authentication module during the login, and an indication of an order of navigator object properties that were previously returned to the authentication module during the login. The authentication module is configured to: receive, from a web browser of a first entity attempting to log in to the web property, credentials of the first user; determine order information of the first entity's web browser; perform a comparison operation based on the order information of the first user and that of the first entity, and determine whether to allow the first entity to log in based on the comparison operation.

## Claims

### Claim 1

An authentication system comprising:
at least one memory, wherein the memory stores instructions and order information of a first user, the order information of the first user including, for each login, among a plurality of times the first user logged in to a web property associated with the authentication system, at least one of an indication of an order of hypertext transfer protocol (HTTP) headers that were previously received from a web browser of the first user during the login or an indication of an order of navigator object properties that were previously returned by a web browser of the first user during the login; and
at least one processor configured to execute the instructions and cause the authentication system to perform,
receiving, from a web browser of a first entity attempting to log in to a web property, credentials of the first user,
determining order information of the web browser of the first entity, the order information of the web browser of the first entity including at least one of an indication of an order of HTTP headers included in an HTTP request of the web browser of the first entity or an indication of an order of navigator object properties of the web browser of the first entity, and
determining whether to allow the first entity to log in to the web property based on a comparison of the order information of the first user and the order information of the first entity.

### Claim 2 (depends on 1)

The authentication system of claim 1, wherein the processor is further configured to execute instructions to cause the authentication system to perform:
receiving an HTTP request from the web browser of the first entity; and
responding to the HTTP request by sending to the web browser of the first entity a hypertext markup language (HTML) document defining a webpage,
wherein the HTML document includes code for causing the web browser of the first entity to
walk a navigator object of the web browser by reading each property of the navigator object,
store each read navigator object property in a data object in the same order in which the properties exist in the navigator object, and
send, to the at least one processor, navigator object property information indicating the order of the properties of the navigator object of the web browser of the first entity.

### Claim 3 (depends on 1)

The authentication system of claim 1, wherein the processor is further configured to execute instructions to cause the authentication system to perform requesting one or more authentication factors from the first entity, in addition to the credentials of the first user, based on the order information of the first user and the order information of the first entity.

### Claim 4 (depends on 1)

The authentication system of claim 1, wherein the processor is further configured to execute instructions to cause the authentication system to perform:
determining whether the order of HTTP headers included in an HTTP request of the web browser of the first entity matches at least one of the orders of HTTP headers indicated by the order information of the first user; and
determining whether the order of navigator object properties of the web browser of the first entity matches at least one of the orders of navigator object properties indicated by the order information of the first user.

### Claim 5 (depends on 1)

The authentication system of claim 1, wherein the order information of the first user includes order information corresponding to at least one of at least two different web browsers of two different versions of a web browser family, respectively, or at least two different web browsers of two different web browser families, respectively.

### Claim 6 (depends on 4)

The authentication system of claim 4, wherein the first entity is allowed to log in to the web property if the order of HTTP headers included in the HTTP request of the web browser of the first entity matches at least one of the orders of HTTP headers indicated by the order information of the first user or the order of the navigator object properties of the web browser of the first entity matches at least one of the orders of navigator object properties indicated by the order information of the first user.

### Claim 7 (depends on 1)

The authentication system of claim 1, wherein the indication of the order of HTTP headers that were previously received from a web browser of the first user during the login includes a hash of the order of the HTTP headers that were previously received from a web browser of the first user during the login.

### Claim 8 (depends on 1)

The authentication system of claim 1, wherein the indication of the order of navigator object properties that were previously returned by a web browser of the first user during the login includes a hash of the order of navigator object properties that were previously returned by a web browser of the first user during the login.

### Claim 9

An authentication system comprising:
at least one memory, wherein the memory stores instructions and a reference database storing reference order information, the reference order information including, for each web browser type among a plurality of web browser types, at least one of an indication of an order of hypertext transfer protocol (HTTP) headers included in an HTTP request of the web browser type or an indication of an order of navigator object properties of the web browser type; and
at least one processor configured to execute the instructions and cause the authentication system to perform,
receiving, from a web browser of a first entity attempting to log in to a web property, first credentials of a first user,
determining order information of the web browser of the first entity, the order information of the web browser including at least one of an indication of an order of HTTP headers included in an HTTP request of the web browser of the first entity or an indication of an order of navigator object properties of the web browser of the first entity,
requesting one or more authentication factors from the first entity, different from the first credentials of the first user, based on the reference order information, the order information of the web browser of the first entity, and the first credentials of the first user, and
determining whether to allow the first entity to log in to the web property based on the one or more authentication factors, the order information of the web browser of the first entity, and the reference order information.

### Claim 10 (depends on 9)

The authentication system of claim 9, wherein the processor is further configured to execute instructions to cause the authentication system to perform:
receiving an HTTP request from the web browser of the first entity; and
responding to the HTTP request by sending to the web browser of the first entity a hypertext markup language (HTML) document defining a webpage;
wherein the HTML document includes code for causing the web browser of the first entity to
walk a navigator object of the web browser by reading each property of the navigator object;
store each read navigator object property in a data object in the same order in which the properties exist in the navigator object; and
send, to the at least one processor, navigator object property information indicating the order of the properties of the navigator object of the web browser of the first entity.

### Claim 11 (depends on 9)

The authentication system of claim 9, wherein the requesting of one or more authentication factors includes requesting the one or more authentication factors in response to the reference order information and the order information of the first entity being different.

### Claim 12 (depends on 9)

The authentication system of claim 9, wherein the processor is further configured to execute instructions to cause the authentication system to perform:
determining whether a browser type, from among the plurality of web browser types, that corresponds to the order of HTTP headers included in an HTTP request of the web browser of the first entity matches a browser type identified by a user agent HTTP header of the web browser of the first entity or a user agent property of the navigator object properties of the web browser of the first entity; and
determining whether a browser type, from among the plurality of web browser types, that corresponds to the order of navigator object properties of the web browser of the first entity matches a browser type identified by the user agent HTTP header of the web browser of the first entity or the user agent property of the navigator object properties of the web browser of the first entity.

### Claim 13

A method of operating an authentication system, the authentication system including at least one memory configured to store order information of a first user, the order information of the first user including, for each login, among a plurality of times the first user logged in to a web property associated with the authentication system, at least one of an indication of an order of hypertext transfer protocol (HTTP) headers that were previously received from a web browser of the first user during the login or an indication of an order of navigator object properties that were previously returned by a web browser of the first user during the login, the method comprising:
receiving, from a web browser of a first entity attempting to log in to a web property, credentials of the first user;
determining order information of the web browser of the first entity, the order information of the web browser of the first entity including at least one of an indication of an order of HTTP headers included in an HTTP request of the web browser of the first entity or an indication of an order of navigator object properties of the web browser of the first entity; and
determining whether to allow the first entity to log in to the web property based on a comparison of the order information of the first user and the order information of the first entity.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
receiving an HTTP request from the web browser of the first entity; and
responding to the HTTP request by sending to the web browser of the first entity a hypertext markup language (HTML) document defining a webpage,
wherein the HTML document includes code for causing the web browser of the first entity to
walk a navigator object of the web browser by reading each property of the navigator object,
store each read navigator object property in a data object in the same order in which the properties exist in the navigator object, and
send, to a processor of the authentication system, navigator object property information indicating the order of the properties of the navigator object of the web browser of the first entity.

### Claim 15 (depends on 13)

The method of claim 13, further comprising:
requesting one or more authentication factors from the first entity, in addition to the credentials of the first user, based on the first user and the order information of the first entity.

### Claim 16 (depends on 13)

The method of claim 13, further comprising:
determining whether the order of HTTP headers included in an HTTP request of the web browser of the first entity matches at least one of the orders of HTTP headers indicated by the order information of the first user; and
determining whether the order of navigator object properties of the web browser of the first entity matches at least one of the orders of navigator object properties indicated by the order information of the first user.

### Claim 17

A method of operating an authentication system, the authentication system including at least one memory configured to store a reference database including reference order information, the reference order information including, for each web browser type among a plurality of web browser types, at least one of an indication of an order of hypertext transfer protocol (HTTP) headers included in an HTTP request of the web browser type or an indication of an order of navigator object properties of the web browser type, the method comprising:
receiving, from a web browser of a first entity attempting to log in to a web property, first credentials of a first user;
determining order information of the web browser of the first entity, the order information of the web browser including at least one of an indication of an order of HTTP headers included in an HTTP request of the web browser of the first entity or an indication of an order of navigator object properties of the web browser of the first entity;
requesting one or more authentication factors from the first entity, different from the first credentials of the first user, based on the reference order information, the order information of the web browser of the first entity, and the first credentials of the first user; and
determining whether to allow the first entity to log in to the web property based on the one or more authentication factors, the reference order information, and the order information of the web browser of the first entity.