Secure injection of context information in browsers

Patent metadata

Field	Value
Publication number	US-9843576-B1
Application number	US-201514973635-A
Country	US
Kind code	B1
Filing date	Dec 17, 2015
Priority date	Dec 17, 2015
Publication date	Dec 12, 2017
Grant date	Dec 12, 2017

Abstract

Systems and methods are directed to enabling a client device to insert customized content from a first server into a webpage received from a second server without using an asynchronous data fetching protocol. The second server determines contextual information related to the client device and prepares a container webpage that includes an image link having one or more parameters based on the contextual information. The client device receives and uses the image link to send, to the first server, an image request with the one or more parameters and a cryptographically verifiable token generated by the second server. The first server uses the token to verify that the second server generated the one or more parameters and generates a customized image using the one or more parameters. The client device receives and renders the customized image within the container webpage without reloading the container webpage.

First claim

What is claimed is:

1. A system, comprising:
a first content server comprising one or more first processors and a second content server comprising one or more second processors, the first content server configured with processor-executable instructions to perform operations comprising:
receiving, from a client device associated with a user, a hypertext transfer protocol (HTTP) request for an image, wherein the HTTP request comprises a cryptographically verifiable token and one or more parameters, wherein:
the cryptographically verifiable token and the one or more parameters are generated by the second content server,
the cryptographically verifiable token is encrypted so as to be decryptable by the first content server, and
an ability of the first content server to decrypt the cryptographically verifiable token serves as cryptographic verification of the cryptographically verifiable token;

determining, based at least in part on the one or more parameters and the cryptographically verifiable token, contextual message information associated with at least the client device;
determining, based at least in part on the contextual message information, whether to generate an image with a customized message; and
performing one of:
generating, and sending to the client device, an image with no customized message in response to determining not to generate an image with a customized message; or
in response to determining to generate an image with a customized message:
generating, based at least in part on the contextual message information, a customized message related to the user of the client device, and
generating, and sending to the client device, an image that includes the customized message,

wherein:
the first content server operates in a first network domain, and the second content server operates in a second network domain distinct from the first network domain; and
the second content server is configured with processor-executable instructions to perform operations prior to reception of the request for the image at the first content server, the operations comprising:
receiving, from the client device, a webpage request;
determining contextual information based at least in part on the webpage request;
generating the one or more parameters based at least in part on the contextual information;
generating a container webpage comprising an image link,

wherein the image link comprises the one or more parameters; and
sending, to the client device, the container webpage.

2. The system of claim 1 , wherein:
the contextual message information is further associated with the user of the client device; and
the customized message includes a message that is personalized for the user of the client device.

3. The system of claim 2 , wherein:
the system further comprises the client device, wherein the client device comprises one or more third processors; and
the one or more third processors are configured with processor-executable instructions to perform operations comprising:
sending, to the second content server, the webpage request;
receiving, from the second content server, the container webpage comprising the image link;
initiating rendering of the container webpage; and
subsequent to initiating rendering of the webpage data:
using the image link, sending the request for the image to the first content server;
receiving, from the first content server, one of the image that includes the customized message or the image with no customized message; and
rendering, on a display of the client device, one of the image that includes the customized message or the image with no customized message.

4. The system of claim 3 , wherein the one or more third processors are configured with processor-executable instructions to perform operations such that rendering one of the image that includes the customized message or the image with no customized message further comprises rendering one of the image that includes the customized message or the image with no customized message without refreshing the container webpage.

5. The system of claim 3 , wherein the client device does not support or has disabled one or more asynchronous data fetching protocols, wherein the one or more asynchronous data fetching protocols enable the client device to obtain, from the first content server, content that is included in the container webpage independently of rendering the container webpage.

6. A system comprising:
a first server comprising one or more first processors and a second server comprising one or more second processors, the first server configured with processor-executable instructions to perform operations comprising:
receiving, from a client device, a request for an image, wherein the request comprises one or more parameters related to an image link and comprises a cryptographically verifiable token that is decryptable by the first server, wherein the one or more parameters and the cryptographically verifiable token are generated by the second server;
determining, based at least in part on the one or more parameters and the cryptographically verifiable token, contextual message information associated with at least a user of the client device;
generating an image based at least in part on the contextual message information; and
sending, to the client device, the image,

wherein:
the first server operates in a network domain,
the second server operates in another domain distinct from the network domain of the first server, and
the second server is configured with processor-executable instructions to perform operations prior to reception of the request for the image by the first server, the operations comprising:
receiving, from the client device, a page request;
determining contextual information based at least in part on the page request;
generating the one or more parameters based at least in part on the contextual information;
generating a container page comprising the image link,

wherein the image link comprises the one or more parameters; and
sending the container page to the client device.

7. The system of claim 6 , wherein the first server is configured with processor-executable instructions to perform operations such that generating the image based at least in part on the contextual message information comprises:
generating a personalized message addressed to the user of the client device based at least in part on the contextual message information; and
generating the image based at least in part on the personalized message.

8. The system of claim 6 , wherein the first server is configured with processor-executable instructions to perform operations such that the request for the image received from the client device is not received via an asynchronous data exchange protocol.

9. The system of claim 6 , wherein the one or more parameters comprises at least one of an identification of the user of the client device, an identification of the second server, information regarding a web session conducted between the client device and the second server, state information regarding the second server, state information regarding the client device, a browsing history of the client device, or the cryptographically verifiable token digitally signed by the second server.

10. The system of claim 6 , wherein the first server is configured with processor-executable instructions to perform operations such that generating the image based at least in part on the contextual message information comprises:
determining, based at least in part on the contextual message information, to send a customized message to the user of the client device; and
generating an image comprising the customized m

Assignees

• Amazon Tech Inc

Inventors

• Peng Jin

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L67/42

  Electricity · mapped topic

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title