Automatic spoofed digital certificate detection

Abstract

Computing devices analyze digital certificates received from various locations (eg, accessed via the Internet or other networks) to automatically detect fraudulent digital certificates. A computing device maintains a record of the digital certificates it receives from these various locations. A certificate screening service operating remotely from the computing device also visits these various locations and maintains a record of the digital certificates that the service receives from those locations. In response to the request to access the target location, the computing device receives the current digital certificate from the target location. The computing device determines whether the current digital certificate is authentic or fraudulent based on one or more previously received digital certificates for the target site, validation certificates received from the credential screening service, and additional characteristics of the digital certificate and / or the target site of.

Description

Background technique [0001] With the development of computing technology, computers have become more and more common in people's lives. While using their computers, people sometimes desire to communicate information that is confidential or otherwise private in nature to one or more other devices. However, when performing such communications, users typically desire to verify that the one or more other devices with which they are communicating are in fact operated by an entity that the user trusts. For example, if a user is communicating his or her credit card number to another device in order to purchase a product, the user typically desires to verify that the other device is in fact an entity he or she trusts (e.g., the company from which the product was purchased, credit card processing companies, etc.). [0002] One way in which such verification can be performed is through the use of digital certificates that can associate an encryption key with a particular entity. Howe...

AI Technical Summary

Problems solved by technology

However, a malicious user can perform a variety of attacks in an attempt to get the user to accept a fraudulent credential, thereby causing the user to communicate with a device operated by the malicious user and provide confidential or otherwise private information to the malicious user

The problem with current computers is that it is difficult for users to distinguish between a spoofed certificate from a malicious user and a legitimate certificate from a trusted entity

Images