Fraud prevention

Patent metadata

Field	Value
Publication number	US-9781132-B2
Application number	US-201514881316-A
Country	US
Kind code	B2
Filing date	Oct 13, 2015
Priority date	Oct 13, 2015
Publication date	Oct 3, 2017
Grant date	Oct 3, 2017

Abstract

As provided herein, a user of a client device may navigate to a webpage using a browser. A browser window, populated with a verification image and/or details about the webpage, is generated and presented to the user. The verification image and/or details about the webpage differentiate a browser window generated by the browser, from the webpage, from a browser window generated by a malicious user. The browser window comprises a login box into which credentials for logging into the user account may be entered. Responsive to the user entering correct credentials into the login box and selecting a submit option based upon recognition of the verification image, the browser window may be submitted to a server and the user may be presented with a window comprising access to the user account.

First claim

What is claimed is:

1. A client device for accessing a user account provided by a server, the client device comprising:
a processor;
a display; and
a memory storing instructions that, when executed on the processor, provide a system comprising:
a communicator to:
provide a request associated with a webpage to the server; and
in response to the request, receive, from the server, a header embedded with a field for username information, a field for password information, a field for a formSubmit URL, caching information and content type information;

a webpage verifier to verify whether a certificate associated with the webpage is authentic;
a form window generator to:
identify a verification image stored by the client device having an association with the server providing the webpage;
generate, using the header, a form window populated with the verification image based upon the webpage being verified as authentic; and
present the form window and a login box, to log into the user account, to the user; and

responsive to correct credentials being entered into the login box and the user selecting a submit option based upon recognition of the verification image, the communicator to:
submit the form window to the server at a server location designated by the certificate; and
present the user with a window comprising access to the user account.

2. The client device of claim 1 , the system configured to:
responsive to the user of the client device navigating to the webpage for an initial visit, request the user select an image to comprise the verification image.

3. The client device of claim 1 , the system configured to:
responsive to the user of the client device navigating to the webpage, identify an image from the certificate to comprise a server verification image selected by the server.

4. The client device of claim 3 , the system configured to:
generate the form window populated with the verification image and the server verification image based upon the webpage being verified as authentic.

5. The client device of claim 1 , the certificate comprising at least one of:
a secure socket layer, a transport layer security, or an extended validation certificate.

6. The client device of claim 1 , the form window generator configured to:
generate the form window to comprise at least one of a name of an organization providing the webpage, a country in which the organization resides, a province in which the organization resides, an address at which the organization resides, or a domain name associated with the webpage.

7. The client device of claim 1 , the system comprising at least one of an operating system, a browser, or an application that communicates with one or more webpages.

8. The client device of claim 7 , the system configured to instruct a second client device comprising at least one of the operating system, a second operating system, the browser, a second browser, the application, or a second application that communicates with one or more webpages.

9. The client device of claim 8 , the system configured to:
responsive to the second client device, associated with the user, navigating to the webpage and verifying that the certificate associated with the webpage is authentic, instruct the second client device to generate a second form window comprising the verification image; and
instruct the second client device to present the second form window to the user through the second client device.

10. The client device of claim 1 , comprising:
the form window generator configured to:
hide a username field of the login box from the user; and
hide a password field of the login box from the user; and

a cache component configured to:
enter the username from a cache into the username field; and
enter the password from the cache into the password field.

11. A method for accessing a user account provided by a server, comprising:
responsive to a client device, associated with a user, navigating to a webpage:
receiving, from the server, a header embedded with a field for username information, a field for password information, a field for a formSubmit URL, caching information and content type information;
verifying whether a certificate associated with the webpage is authentic;

responsive to the client device verifying the certificate as authentic:
identifying a verification image stored by the client device having an association with the server providing the webpage; and
generating a login box, using the header, to log into the user account;

presenting a form window comprising the verification image, based upon the webpage being verified as authentic, and the login box to the user through the client device;
responsive to the user entering credentials into the login box and selecting a submit option based upon recognition of the verification image, submitting the form window to the server at a server location designated by the certificate; and
responsive to the server granting access based upon the credentials corresponding to the user account, presenting the user with a window comprising access to the user account.

12. The method of claim 11 , comprising:
responsive to the client device verifying the certificate as authentic and identifying an image comprised in the certificate, presenting the image from the certificate, to comprise a server verification image, to the user on the client device; and
responsive to the user selecting the submit option based upon recognition of the server verification image, submitting the form window to the server.

13. The method of claim 11 , comprising:
responsive to the user of the client device navigating to the webpage, identifying an image from the certificate to comprise a server verification image.

14. The method of claim 13 , comprising:
generating the form window populated with the verification image and the server verification image based upon the webpage being verified as authentic.

15. The method of claim 11 , comprising utilizing a mobile application on the client device to navigate to the webpage.

16. The method of claim 11 , comprising:
generating the form window to comprise at least one of a name of an organization providing the webpage, a country in which the organization resides, a province in which the organization resides, an address at which the organization resides, or a domain name associated with the webpage.

17. The method of claim 11 , comprising:
responsive to a second client device, associated with the user, navigating to the webpage and verifying the certificate associated with the webpage is authentic, providing the second client device with the verification image; and
instructing the second client device to generate a second form window comprising the verification image.

18. A client device for accessing a user account provided by a server, the client device comprising:
a processor;
a display; and
a memory storing instructions that, when executed on the processor, provide a system comprising:
a communicator to:
provide a request associated with a webpage to the server; and
in response to the request, receive, from the server, a header embedded with a field for username information, a field for password information, a field for a formSubmit URL, caching information and content type information;

a webpage verifier to verify whether a certificate associated with the webpage is authentic;
a form window generator to:
responsive to the webpage being verified as authentic:
identify a verification image stored by the client device

Assignees

• Yahoo Inc
• Yahoo Holdings Inc

Inventors

• Ramakrishnan Binu

Classifications

• H04L63/123 Primary

  received data contents, e.g. message integrity · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F40/174

  Form filling; Merging · CPC title