Facilitating secure online transactions
View Patent ↗A method and system for mutually authenticating an identity and a server is provided in accordance with an aspect of the present invention. The method commences with transmitting a token from the server. Thereafter, the method continues with establishing a secure data transfer link. A server certificate is transmitted during the establishment of the secure data transfer link. The method continues with transmitting a response packet to the server, which is validated thereby upon receipt. The system includes an authentication module that initiates the secure data transfer link and transmits the response packet, and a server authentication module that transmits the token and validates the response packet.
1. A method comprising:
receiving a request for a Uniform Resource Locator (URL) identifier;
generating a unique session identifier;
transmitting over a first TCP connection, a token including the unique session identifier, said token signed with a private key associated with a server certificate;
receiving a first response to transmitting the token comprising a request to initiate a secure data transfer link over a second TCP connection, the second TCP connection being distinct from the first TCP connection;
completing the secure data transfer link in response to the request to initiate the secure data transfer link, wherein completing the secure data transfer link comprises transmitting the server certificate and the Uniform Resource Locator (URL) identifier over the second TCP connection;
receiving a second response including (1) the URL identifier transmitted during the completing of the secure data transfer link, (2) a second certificate distinct from the server certificate, (3) the server certificate as transmitted during the completion of the secure data transfer link, (4) the token, and (5) an authenticity identifier corresponding to a second private key associated with the second certificate; and
validating the second response,
said method performed by a computing system that comprises one or more computing devices.
2. The method of claim 1 , wherein the authenticity identifier comprises a cryptographic hash of the second response, the authenticity identifier being signed with the second private key.
3. The method of claim 1 , wherein validating the second response further includes validating the requested URL identifier in the second response against a URL associated with an authentication process.
4. The method of claim 1 , wherein validating the second response further includes validating the token in the second response against a stored token.
5. The method of claim 1 , wherein validating the second response further includes validating a first copy of the server certificate stored in the server against the server certificate in the second response.
6. The method of claim 1 , wherein validating the second response further includes validating the second certificate against the authenticity identifier comprising a signature on the second response, the signature on the second response being associated with the second private key.
7. The method of claim 1 , wherein the second response comprises a response packet.
8. A method for authenticating an identity to a server comprising one or more computing devices, the method comprising:
transmitting a request for a Uniform Resource Locator (URL) identifier;
receiving a token from the server over a first data link, the token including a unique session identifier generated by the server, said token signed with a private server key associated with a server certificate;
initiating a secure data transfer link to the server in response to receiving the token;
receiving, from the server, the server certificate and the requested Uniform Resource Locator (URL) identifier as initially transmitted during completion of the secure data transfer link; and
transmitting to the server a response including (1) the requested URL identifier, (2) a second certificate, (3) the server certificate as received from the server during completion of the secure data transfer link, (4) the token, and (5) an authenticity identifier corresponding to a second private key, the second private key being associated with the second certificate.
9. The method of claim 8 , wherein the authenticity identifier comprises a cryptographic hash of the response, the authenticity identifier being signed with the second private key.
10. The method of claim 8 , wherein:
the second certificate is issued from a certificate server associated with an authorized certification authority; and
the second certificate is linked to an organization associated with the server.
11. The method of claim 10 , wherein prior to issuing the second certificate, the method further comprises validating the identity with a challenge-response sequence.
12. The method of claim 11 , wherein the challenge-response sequence comprises a response that is transmitted to a predetermined telephone device associated with the identity.
13. The method of claim 11 , wherein the challenge-response sequence comprises a response that is transmitted to a predetermined e-mail address associated with the identity.
14. A system for authenticating an identity, the system comprising:
a computing system comprising one or more computing devices, said computing system programmed via executable instruction to at least:
generate a unique session identifier;
transmit a token to a second computer over a first data link, the token including the unique session identifier, said token signed with a private server key associated with a server certificate;
establish a secure data transfer link upon a request from the second computer, wherein establishing the secure data transfer link comprises transmitting to the second computer the server certificate and a Uniform Resource Locator (URL) identifier as specified by the second computer;
receive from the second computer a response including (1) the URL identifier, (2) a second certificate, (3) the server certificate as transmitted to the second computer during establishment of the secure data transfer link, (4) the token, and (5) an authenticity identifier corresponding to a second private key, the second private key being associated with the second certificate; and
validate the response.
15. The system of claim 14 , wherein the authenticity identifier comprises a cryptographic hash of the response, the authenticity identifier being signed with the second private key.
16. The system of claim 14 , wherein validating the response further includes validating the URL identifier in the response against a URL associated with the one or more computing devices.
17. The system of claim 14 , wherein validating the response further includes validating the token in the response against a token stored by the one or more computing devices.
18. The system of claim 14 , wherein validating the response further includes validating a first copy of the server certificate stored in the one or more computing devices against a second copy of the server certificate in the response.
19. The system of claim 14 , wherein validating the response further comprises validating the second certificate against the authenticity identifier comprising a signature on the response, the signature being associated with the second private key.
20. Non-transitory computer storage that comprises executable instructions that direct a computing system to at least:
receive a request for a Uniform Resource Locator (URL) identifier at a server;
transmit over a first data link a token including a unique session identifier generated by a server and signed with a private server key associated with a server certificate;
receive a first response to transmitting the token comprising a request for a secure data transfer link;
initiate a secure data transfer link in response to the request for a secure data transfer link, the secure data transfer link being independent of the first data link;
complete the secure data transfer link, the server certificate and the requested Uniform Resource Locator (URL) identifier of the server being transmitted during completion of the secure data transfer link;
receive a second response including (1) the requested URL identifier of the server transmitted during the completion of the secure data transfer link, (2) a second certificate, (3) the server certificate as received from the server during the completion of the secure data transfer link, (4) the token, and (5) an authenticity identifier corresponding to a second private key, the second private key being associated with the second certificate; and
validate the second response.
21. The non-transitory computer storage of claim 20 , wherein the authenticity identifier includes a cryptographic hash of the second response, the authenticity identifier being signed with the second private key.
22. The non-transitory computer storage of claim 20 , wherein validating the second response further includes validating the token in the second response against a token stored by the server.
23. The non-transitory computer storage of claim 20 , wherein validating the second response further includes validating a first copy of the server certificate stored at the server against a second copy of the server certificate in the second response.
24. The non-transitory computer storage of claim 20 , wherein validating the second response further includes validating the second certificate against a signature on the second response, the signature being associated with the second private key.