System and method for website authentication using a shared secret
View Patent ↗A web site can be authenticated by a third party authentication service. A user designates an authentication device that is a shared secret between the user and the authentication service. A web site page includes a URL that points to the authentication service. The URL includes a digital signature by the web site. When the user receives the page, the user's browser issues a request to the authentication service, which attempts to authenticate the digital signature. If the authentication is successful, it sends the authentication device to the user computer.
1. A method comprising:
receiving, at a third party authentication server processor via a network, registration data associated with a user, wherein the registration data comprises a distortion template;
receiving, at the third party authentication server processor, a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;
determining whether the web site is authentic using the information in the request; and
providing a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.
2. The method of claim 1 , wherein the request is based on a URL in a page associated with the web site.
3. The method of claim 2 , wherein the URL comprises a digital signature, the digital signature being based on at least one of a private cryptographic key at a web server or a symmetric cryptographic key that is a shared secret between the third party authentication server processor and the web server.
4. The method of claim 1 , further comprising:
sending a request from the third party authentication server processor to the client computer for an artifact stored at the client computer; and
receiving the artifact from the client computer at the third party authentication server processor, wherein the artifact comprises a user identifier.
5. The method of claim 1 , wherein registration data further comprises a media item, the media item comprising at least of an audio segment, a video segment, an animation segment, or a graphic segment.
6. A system comprising:
a processor;
a memory coupled to the processor, the memory storing instructions adapted to be executed by the processor to:
receive registration data associated with a user, wherein the registration data comprises a distortion template;
receive a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;
determining whether authenticate the web site is authentic using the information in the request; and
provide a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.
7. The system of claim 6 , wherein the request is based on a URL in a page associated with the web site.
8. The system of claim 6 , wherein the URL comprises a digital signature, the digital signature being based on at least one of a private cryptographic key at a web server or a symmetric cryptographic key that is a shared secret between the processor and the web server.
9. The system of claim 6 , further comprising
a database storing a record that correlates a user identifier with the user-defined indicator.
10. The system of claim 9 , wherein the registration data further comprises a media item, the media item comprising at least one of an audio segment, a video segment, an animation segment, or a graphic, segment.
11. The system of claim 10 , wherein the user-defined indicator comprises a digital signature.
12. A non-transitory computer-readable medium storing instructions adapted to be executed by a processor to perform operations comprising:
receiving, at a third party authentication server, registration data associated with a user, wherein the registration data comprises a distortion template;
receiving at the third party authentication server a request from a client computer to authenticate a web site, the request comprising information associated with authenticating the web site;
determining whether the web site is authentic using the information in the request; and
providing a user-defined indicator describing whether the web site is authentic to the client computer, the user-defined indicator being based on the registration data that is associated with the user, wherein the user-defined indicator comprises the distortion template applied to a text string that is associated with the user.
13. The medium of claim 12 , the operations further comprising:
sending a request from the authentication server to the client computer for an artifact stored at the client computer and
receiving the artifact from the client computer at the authentication server, where the artifact comprises a user identifier.
14. The medium of claim 12 , wherein the registration data further comprises a media item, the media item comprising at least one of an audio segment, a video segment, an animation segment, or a graphic segment.