Method and apparatus for authentication of users and web sites
AssigneeRSA Security Inc.
InventorsLouis Gasparini, Charles E. Gotlieb
Life of this patent
Estimating the term…
Abstract
A system and method allows a user to authenticate a web site, a web site to authenticate a user, or both. When a user requests a web page from the web site, customization information that is recognizable to the user is provided to allow the user to authenticate the web site. A signed, encrypted cookie stored on the user's system allows the web site to authenticate the user.
Claims22
A method of providing a web page, comprising:
- associating customization information with a user identifier;
- providing the user identifier in a cookie;
- encrypting the cookie;
- storing the cookie on a computer system operated by the user;
- responsive to a request for the web page, reading the cookie stored;
- providing the web page requested;
- and
- responsive to the cookie read, providing the customization information via at least one selected from:
- a) a secure connection and;
- b) a communication channel different from that used to provide the web page.
A method of authenticating at least a portion of a web site, comprising:
- providing to the web site a request for at least one web page and an encrypted cookie;
- receiving a web page and customization information;
- and
- authenticating the at least the portion of the web site responsive to the customization information received.
A system for providing a web page, comprising:
- a registration manager for associating in a database coupled to a database output customization information with a user identifier and for providing the user identifier at an output;
- a cookie builder having an input coupled to the registration manager output, the cookie builder for providing the user identifier in a cookie at an output;
- a cookie encryptor having an input coupled to the cookie builder output, the cookie encryptor for encrypting the cookie and providing the encrypted cookie at an output;
- a cookie storage having an input/output coupled to the cookie encryptor output, the cookie storage for storing the cookie on a computer system operated by the user;
- a web application having an input coupled for receiving a request for a web page, the web application for, responsive to the request for the web page, for reading the cookie stored via the web application input, for providing at least a portion of the web page at a first output, and providing at a second output the user identifier from the cookie read;
- and
- a customization information provider having an input coupled to the web application second output for receiving the user identifier, the customization information provider for retrieving at least a portion of the customization information from the database via an input/output coupled thereto, the customization information provider for providing at an output the customization information via at least one selected from:
- a) a secure connection and;
- b) a communication channel different from that used to provide the web page.
A computer program product comprising a computer useable medium having computer readable program code embodied therein for providing a web page, the computer program product comprising computer readable program code devices configured to cause a computer to:
- associate customization information with a user identifier;
- provide the user identifier in a cookie;
- encrypt the cookie;
- store the cookie on a computer system operated by the user;
- responsive to a request for the web page, read the cookie stored;
- provide the web page requested;
- and
- responsive to the cookie read, provide the customization information via at least one selected from:
- a) a secure connection and;
- b) a communication channel different from that used to provide the web page.
Dependencies are inferred from the claim text.