METHOD FOR SECURING ACCESS TO A RESOURCE

Abstract

METHOD FOR SECURING ACCESS TO A RESOURCE One aspect of the invention relates to a computer-implemented method for securing access to a resource via a web page, said web page being identified by a web address, access to the resource requiring user authentication. Figure to be published with the abbreviation: Figure 2

Description

Title of the invention: METHOD FOR SECURING ACCESS TO A RESOURCE TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of computer security and data protection, in particular identification data. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0002] Today, a large majority of online services require user authentication, generally using a username and password. Users must therefore manage a large number of authentication credentials, which is not always practical or straightforward. For example, the more passwords there are to remember, the greater the risk of forgetting at least one of them. Also, users may be tempted to use the same authentication credentials for multiple online services.

[0003] In particular, IT system managers of organizational entities such as companies, universities, or any other type of structure, face the following problem: some users use their professional authentication data to access services not managed by the IT system, such as online shopping sites, social networks, or food delivery sites. "Professional authentication data" is understood to mean authentication data intended for use within the framework of services associated with the organizational entity, for example, an intranet or a professional email system. The term "professional" here extends to any link between a user and an organizational entity. For example, the email address provided by a university to a student, having the university's domain name as its domain name (for example, "firstname.lastname@university").fr"), is considered here as a professional address, and a {username, password] pair provided by the university to the student to access their email and / or the university's local network is considered as professional authentication data.

[0004] Using corporate credentials for sites not approved or managed by an organization's IT system raises significant IT security and data protection issues. For example, a malicious user could retrieve corporate credentials used to access a food delivery website and use them to access sensitive data belonging to the organization, or even to hack into the organization's IT system.

[0005] This risk is all the more significant as computer attacks are becoming increasingly difficult to detect or circumvent. For example, a relatively recent type of attack, called BitB (for "Browser in the Browser"), consists of retrieving a user's username and password by "mimicking" a login window. In its most sophisticated version, this fake login window can even reproduce the icon in the title bar and the URL of the original page (including when it includes "https," which the user generally considers a guarantee that the visited page is legitimate), making it very difficult to detect.

[0006] There is therefore a need to protect professional authentication data and prevent it from being retrieved by third parties. Summary of the invention

[0007] The invention offers a solution to the problems mentioned above, by making it possible to prevent the user from sending their professional authentication data to an external server not controlled or anticipated by the organizational entity's IT system manager (typically a server not managed by the organizational entity's IT system manager and to which the organizational entity's IT system manager does not want the professional authentication data to be sent).

[0008] One aspect of the invention thus relates to a method, implemented by computer, for securing access to a resource via a web page, said web page being identified by a web address, access to the resource requiring authentication or registration of a user, the method comprising: • receiving at least one domain name to be monitored; • detect an attempt to send at least two strings of characters respectively associated with at least two user fields of the web page; • determine if the web address identifying the web page corresponds to an authorized web address; • if the web address identifying the web page corresponds to an authorized web address, allow the sending of at least two strings of characters to the external server; • Otherwise, determine if one of the at least two strings corresponds to an email address associated with one of the at least one domain names to be monitored received: • if no string of characters matches an email address associated with a domain name among the at least one domain name to be monitored received, authorize the sending of at least two strings of characters to the external server; • if a string of characters, called the first string of characters, matches an email address associated with a domain name among the at least one domain name to be monitored received, pause the sending of the at least two strings of characters to the external server for a time interval and send a query associated with an identity provider to determine if a second string of characters among the at least two strings of characters matches authentication data associated with the first string of characters;

[0009] wherein if a response to the query is received during the time interval, the method further comprises: • if a second string of characters among the at least two strings of characters corresponds to an authentication data associated with the first string of characters, prevent the sending of the at least two strings of characters to the external server; • otherwise, allow the sending of at least two strings of characters to the external server.

[0010] The term “resource” means any data, digital content, or service accessible from a web page, for example, an electronic document, an image, a video, an online food delivery service, an e-commerce service, etc. To access the resource, the user consults a web page identified by a web address. The web address can typically be a URI (for “Uniform Resource Identifier”), for example, a URL (for “Uniform Resource Locator”) or a URN (for “Uniform Resource Name”).

[0011] “Authentication” means a process for verifying the identity of a user, typically by entering identification data called an identifier and authentication data, for example, a password or biometric data. “Registration” means a process for recording certain information relating to a user with an external server for the purpose of future authentication on a website. Registration typically requires the user to enter at least an identifier and authentication data.

[0012] The "at least one domain name to monitor" typically corresponds to one or more domain names associated with the organizational entity.

[0013] By "authorized web address" is meant a web address for which no further checks are required. Authorized web addresses typically correspond to web addresses that the organizational entity's IT system manager has recognized as "safe," "controlled," or "legitimate."

[0014] By "attempt to send," it is understood that the user validates the data input to send it to an external server, for example, an authentication server or a registration server. The word "attempt" indicates that, according to the method of the invention, this sending can be paused to perform checks. Following these checks, the sending can be authorized or blocked. By "paused," it is understood that the sending is temporarily suspended, for example, by forcing the execution of a script before the actual sending of the data to the external server, in order to perform the necessary checks. The pause can advantageously be implemented for a predetermined AT duration, for example, between 200 ms and 500 ms.The time interval can therefore, in these embodiments, correspond to an interval extending between T and T+AT, where T designates the start of the pause (or, equivalently or almost equivalently) the moment when the user attempts to send the data to the external server.

[0015] By "authentication data associated with the first string of characters," the first string of characters corresponding to an email address, it is understood that the pair {email address, authentication data] is registered with an identity provider as a data pair enabling the authentication of a user. For example, the first string of characters may be a work email address and the second string of characters may be a work password, the work email address and work password being managed by the identity provider.

[0016] Thus, according to the invention, it is possible to verify that no {work email address, work password} pair is used to authenticate or register with a website to access a service that is not certified as reliable by the IT system administrator. If a user attempts to use their work data (i.e., the {work email address, work password} pair) to access such a service, the transmission of the work data is advantageously blocked, thereby preventing the work data from being retrieved by a third party who could then use it to access sensitive data of the organizational entity.

[0017] This verification is advantageously performed by querying the identity provider that an organizational entity has chosen to manage its users' credentials, thus avoiding the need to store user authentication data locally, and strengthens the overall security of the organizational entity's IT system.

[0018] In one or more embodiments, the method may further include: receiving a list of authorized web addresses. Determining whether the web address identifying the web page corresponds to an authorized web address can then be based on a check whether the web address identifying the web page belongs to the list of authorized web addresses or not.

[0019] The list of web addresses referred to herein as the "list of authorized web addresses" designates a set of web addresses for which no special checks are required. These authorized web addresses are typically web addresses that have been deemed "trusted," for example, by the IT system administrator of the organizational entity. When the web address of the website a user attempts to authenticate or register with is not on the list of authorized web addresses, checks are performed. It is understood that, equivalently, a set of web addresses can be designated as "to be monitored," and that checks are performed when a user attempts to authenticate or register with a website whose web address is on the list of to be monitored.

[0020] Alternatively or in addition, determining whether the web address identifying the web page corresponds to an authorized web address can be based on an Artificial Intelligence algorithm, for example, a machine learning algorithm. For example, it is possible to train a machine learning model to determine, using the trained model, whether a web address corresponds to an authorized web address or not—in particular, whether it corresponds to a web address that presents a danger to the user and the computer system. This determination may include calculating a probability that the web address is an authorized address and comparing the calculated probability to a predefined threshold (for example, 0.9).

[0021] In one or more embodiments, if no response to the query is received during the time interval, the method may further include: • prevent the sending of at least two strings of characters to the external server.

[0022] According to these embodiments, if no response to the query request is received from the identity provider during the time interval (which may happen, for example, because the query request was unsuccessful, or because the identity provider is unable to respond, for example due to maintenance), the sending of the data is blocked, thus preventing any risk of the user sending their professional data to an external server.

[0023] In one or more embodiments, the authentication data may be a password.

[0024] Of course, other authentication data can be used, for example biometric data, such as a fingerprint.

[0025] In one or more embodiments, if sending the at least two strings of characters to the external server is prevented, the method may further include: redirecting the user to a new web page.

[0026] For example, the user can thus be warned that he cannot access the requested page with the data he entered in the user fields of the web page he was viewing.

[0027] In one or more embodiments, the query request is sent to a server associated with the identity provider and the response to the query request is received from the server associated with the identity provider.

[0028] In these embodiments, no authentication data needs to be stored, and the verification of the pair {email address, authentication data] is carried out by querying a server associated with the identity provider.

[0029] Alternatively, the query is a query of a database comprising entries, each entry comprising an email address, information relating to an authentication data associated with the email address, and information relating to an identity provider to which the email address is linked.

[0030] In these embodiments, the verification of the {email address, authentication data] pair is performed by querying a database in which {email address, authentication data] pairs associated with an identity provider are stored. These embodiments are particularly advantageous when the user uses a password manager, and one or more of the user's email addresses are stored in a database in association with an identity provider to which they are linked (i.e., the identity provider that manages the professional email address) and with information relating to the passwords associated with these email addresses (for example, encrypted versions of the passwords).

[0031] In one or more embodiments, upon detection of an attempt to send at least two strings, said at least two strings may be stored in memory, and after querying the identity provider, each string other than the first string may be erased from said memory. For example, the strings may be temporarily stored in a memory space that the browser dedicates to the web page being viewed, and as soon as the page is closed, this data is automatically erased.

[0032] Typically, character strings other than the professional email address will be tested with the identity provider as passwords associated with said professional email address. For this purpose, all these character strings may be temporarily stored and deleted at the end of the verification with the identity provider. This ensures that no potential passwords are stored locally.

[0033] In these embodiments, upon detection of the attempt to send at least two strings of characters, a string of characters other than the first string of characters is stored in memory in association with a respective informational data; wherein, if said string of characters other than the first string of characters corresponds to an authentication data associated with said first string of characters, the informational data relating to the second string of characters is kept in memory in association with the first string of characters.

[0034] According to these embodiments, when it is determined that one of the character strings is a password (or another type of authentication data) associated with the email address, informational data relating to the password is stored in memory, in association with the email address.

[0035] This allows, during a subsequent attempt to send data to an external server, for faster identification of user fields that may correspond to authentication data associated with the email address, without storing it as such (if the informative data is retrieved by a malicious third party, it cannot be used to access data of the organizational entity).

[0036] This informative data can be any data derived from the string of characters corresponding to the password.

[0037] For example, the informational data may be the result of a function applied to the string to which it is associated. For example, the informational data may be the result of an encryption or hashing function applied to the string, or to a portion of the string (for example, the first or last x characters, x being a predefined number), or to data associated with the string, for example, its number of characters. In a particular embodiment, the informational data may thus correspond to the result of applying a hashing function to the number of characters in the string.

[0038] Other embodiments are possible, for example the informative data can be a truncated result of an encryption algorithm applied to the string of characters.

[0039] In some embodiments, the information data is different from the character string.

[0040] In one or more embodiments, the method may further comprise: • detect an attempt to send, to a second external server, at least two sequences of characters respectively associated with at least two user fields of a second web page whose web address does not correspond to an authorized web address, in which one sequence of characters among the at least two sequences of characters corresponds to the first string of characters; • upon detection of said sending attempt, determine, for at least one character sequence other than the character sequence corresponding to the first character string, whether said at least one character sequence is compatible with the information stored in association with the first character string, and select said at least one character sequence only if said at least one character sequence is compatible with said information: • if no character sequence other than the character sequence corresponding to the first string of characters is selected, allow the sending of at least two character sequences to the second external server; • otherwise, pause the sending of at least two character sequences to the second external server for a second time interval and send a second query request associated with the identity provider to determine if a selected character sequence corresponds to authentication data associated with the first string of characters;

[0041] wherein if a response to the second query is received during the second time interval, the method may further comprise: • if a selected character sequence matches an authentication data associated with the first string of characters, prevent the sending of at least two character sequences to the second external server; • otherwise, allow the sending of at least two character sequences to the second external server.

[0042] In other words, during a subsequent attempt by the user to send data to another external server, a preliminary step ensures that only the user fields that could contain the work password are considered. This preliminary step relies on the use of the previously stored informational data associated with the email address. This embodiment is particularly advantageous when the web page contains many user fields, and that Sending a query to the identity provider for each of these fields would therefore be quite time-consuming. For example, if the work email address is stored in association with the number of characters in the work password, only fields whose character sequences have a number of characters equal to the number of characters stored in association with the work email address are tested.

[0043] It is noted that the formulation "sequence of characters" is used solely for the sake of simplification and clarity compared to the formulation "string of characters" above, but that both formulations refer to the same types of elements.

[0044] It is also noted that the informational data relating to authentication data can be used from the very first implementation of the method. For example, it is possible to store, in locally accessible memory, all professional email addresses in association with their respective informational data, for example, the number of characters in the professional passwords associated with the professional email addresses. From the very first implementation of the security method according to the invention, when it has been detected that one of the fields corresponds to a professional email address, it is possible to select only character strings compatible with the informational data associated with said professional email address and to send queries to the identity provider only for the selected character strings.This saves considerable time when there are more than two user fields on a web page, while avoiding storing authentication data as such (a third party retrieving this informational data in association with professional email addresses could not use it to access sensitive data of the organizational entity).

[0045] Another aspect of the invention relates to a device for securing access to a resource via a web page, said web page being identified by a web address, access to the resource requiring authentication or registration of a user, the device being configured to: • receive at least one domain name to monitor; • detect an attempt to send at least two strings of characters respectively associated with at least two user fields of the web page; • upon detection of the sending attempt, determine if the web address identifying the web page corresponds to an authorized web address; • if the web address identifying the web page corresponds to an authorized web address, allow the sending of at least two strings of characters to the external server; • Otherwise, determine if one of the at least two strings corresponds to an email address associated with one of the at least one domain names to be monitored received: • if no string of characters matches an email address associated with a domain name among the at least one domain name to be monitored received, allow the sending of at least two strings of characters to the external server; • if a string of characters, called the first string of characters, matches an email address associated with a domain name among the at least one domain name to be monitored received, pause the sending of the at least two strings of characters to the external server for a time interval and send a query associated with an identity provider to determine if a second string of characters among the at least two strings of characters matches authentication data associated with the first string of characters;

[0046] in which the device can further be configured, if a response to the query is received during the time interval, to: • if a second string of characters among the at least two strings of characters corresponds to an authentication data associated with the first string of characters, prevent the sending of the at least two strings of characters to the external server; • otherwise, allow the sending of at least two strings of characters to the external server.

[0047] A computer program, implementing all or part of the process described above, installed on pre-existing equipment, is in itself advantageous.

[0048] Thus, the present invention also relates to a computer program comprising instructions for the implementation of certain steps of the process described above, when this program is executed by a processor.

[0049] This program may use any programming language (for example, an object-oriented language or other), and may be in the form of interpretable source code, partially compiled code or fully compiled code.

[0050] The [Fig.2] described in detail below can form the flowchart of the algorithm general of such a computer program.

[0051] The invention and its various applications will be better understood by reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0052] Other features and advantages of the invention will become apparent from the description, which can be read in conjunction with the figures. These figures are provided for illustrative purposes only and are not intended to limit the scope of the invention.

[0053] [Fig. la] Fig. la] represents a first example of a web page in a browser.

[0054] [Fig. 1b] Fig. 1b represents a second example of a web page in a na vigilance.

[0055] [Fig.2] Fig.2 represents a flowchart of a method for securing access to content via a web page, according to an embodiment of the invention.

[0056] [Fig. 3] [Fig. 3] represents an example of a device for securing access to content via a web page, according to an embodiment of the invention. DETAILED DESCRIPTION

[0057] [Fig. la] Fig. la] represents a first example of a web page in a browser.

[0058] Following the example in [Fig. 1a], a user attempts to access a delivery service online restoration via a web page (or "browser window") identified by a web address 110. This web address 110 can typically be a URL of the web page.

[0059] The web page shown in [Fig. 1a] includes two user fields for entering a username (user field 120) and a password (user field 130) to authenticate and access the online food delivery service. The user is prompted to enter two strings of characters corresponding to their username and password in the dedicated user fields 120 and 130, and to validate the entry using a validation button 140.

[0060] In this example, the authentication data includes a username and password, but the invention is not limited to this example and other embodiments are possible. In particular, the password can be replaced by other authentication data, for example biometric data, such as a fingerprint, which the user can enter using a fingerprint reader connected to their computer.

[0061] It is noted that the term "authenticate" here refers to the joint actions of identification (i.e., identifying a user by means of an identifier) ​​and authentication (i.e., verifying the identity of the user, by means of a usage data such as a password).

[0062] Conventionally, in the absence of a security method such as that proposed by the invention, upon validation of the entry of the username 120 and password 130, an HTTP request is sent to an external server, which then checks if the pair {username, password] corresponds to a record in a database data, for example via an SQL SELECT query. If the pair matches a record in the database, the external server can send an HTTP response to indicate that authentication was successful.

[0063] The invention proposes to secure a user's professional authentication data by preventing the user from using their professional authentication data to authenticate with certain services, particularly services that are not controlled by the professional organization to which the user belongs. For example, a list of "authorized" web addresses (e.g., URLs) can be defined, and as soon as the user attempts to authenticate on a web page whose address is not on the list of authorized web addresses, a security procedure is implemented.

[0064] Of course, as an alternative to a list of authorized web addresses, a list of "unauthorized" or "monitored" web addresses can be defined, and the security procedure is implemented when the user attempts to authenticate on a web page whose address belongs to the list of unauthorized web addresses.

[0065] As an alternative or in addition, whether a web address is authorized or not can be determined by means of a machine learning algorithm, trained in a supervised or unsupervised manner.

[0066] The security procedure can be implemented as follows: when the user validates the entry of their authentication data in fields 120 and 130, for example by clicking on a validation button 140, this data is retrieved for analysis. First, it can be checked whether a string of characters corresponding to one of the fields 120 or 130 corresponds to a "sensitive" identifier (i.e., one to be protected), for example, a professional email address. This check can be done, for example, by determining whether one of the strings of characters entered in one of the fields 120 or 130 includes or ends with a particular domain name, possibly preceded by the separator character @. For example, this domain name could correspond to an organizational entity (such as "organization.com"). It should be noted that the check can be performed for several domain names, for example, "organization.com", ...net” and “organization-france.fr”. .

[0067] In certain embodiments, at least some fields 120 and 130 are associated with respective types, which allow determining which field 120 or 130 corresponds to an identifier or an email address. For example, in HTML, the "type" attribute of field 120 can take the value "email," which allows determining that field 120 corresponds to an email address. It is thus possible to test only the string entered in field 120 to determine if it corresponds to a professional email address.

[0068] In other embodiments, fields 120, 130 are not associated with respective types, and it is possible to successively test the character strings corresponding to fields 120, 130 to determine if one of them corresponds to a professional email address.

[0069] It is noted that the form may include more than two fields, as shown in the example in [Fig.lb].

[0070] In the example shown in [Fig. 1b], the user is prompted to enter a set of data into a form to register on an online food delivery service platform. In this example, the form includes, in addition to the username field 120 and the password field 130, several other fields 150a, 150b, 150c. As in the example shown in [Fig. 1a], the user is prompted to validate this data and send it to an external server by clicking a validation button 140.

[0071] As mentioned previously, if a field 120 of the form is associated with a type indicating that this field 120 corresponds to an email address, it is possible to test only the string of characters entered in this field 120 and determine if it corresponds to a professional email address.

[0072] If no field 120, 130, 150a, 150b, or 150c is associated with a field type, it is possible to successively test the character strings corresponding to the different fields 120, 130, 150a, 150b, and 150c to determine if one of them corresponds to a professional email address. The test can stop when one of the fields 120, 130, 150a, 150b, or 150c is determined to correspond to a professional email address. Alternatively, the test can stop when one of the fields 120, 130, 150a, 150b, or 150c is determined to correspond to an email address (professional or otherwise).

[0073] It may happen that none of the fields are associated with a type indicating that they are email addresses, but that some fields 120, 130, 150a, 150b, 150c are associated with types other than an "email address" type, while other fields are not associated with any type. In some embodiments, it is possible, to reduce the number of character strings to be tested, to test only the fields that are not associated with any type.

[0074] If, after this first check, none of the fields 120, 130, 150a, 150b, 150c is determined to correspond to a professional email address, the security procedure is stopped, and the authentication procedure (in the case of [Fig.la]) or registration procedure (in the case of [Fig.lb]) resumes in the classic way: the data is sent, for example via HTTP requests, to an external server for verification or registration.

[0075] If, after this first check, a field 120 is determined to be cor Responding to a professional email address, the security procedure continues: it is then checked whether one of the other fields 130, 150a, 150b, 150c corresponds to authentication data (for example, a password) associated with the professional email address, such as the password associated with the professional email address and allowing access to, for example, services of the organizational entity (for example, an email system or an internal server). It is assumed that the {professional email address, authentication data} pair is known to an identity provider selected by the organizational entity, for example, an identity provider (or "identity manager," or "identity and access manager") with whom the organizational entity has a subscription.The identity provider can be, for example, Active Directory, Azure Active Directory (or Azure AD), JumpCloud, Okta, OneLogin, AuthO, Oracle Identity Management, etc.

[0076] Similar to what was described for the identifier, if one of the fields is associated with a type indicating that it is a password (for example, the "password" type in HTML), it is possible to test only the string corresponding to that field. Alternatively, it is possible to test several fields, for example, to successively test all user fields 130, 150a, 150b, 150c other than field 120 corresponding to the professional email address. Of course, this verification can be stopped as soon as a string associated with a user field 130, 150a, 150b, or 150c corresponds to the password associated with the professional email address.

[0077] To determine whether a string of characters associated with a user field 130, 150a, 150b, 150c corresponds to the password associated with the professional email address, it is possible to query the identity provider selected by the organizational entity.

[0078] If it is determined that a string of characters associated with a remaining user field 130, 150a, 150b, 150c corresponds to the password associated with the professional email address (entered in field 120), the sending of the data entered in the form is blocked, and the user may be redirected to a new web page, for example to a 404 error page.

[0079] In one or more embodiments, the data entered in user fields 120, 130, 150a, 150b, 150c can be temporarily stored in memory and deleted (in whole or in part) from memory at the end of the security procedure. Advantageously, this ensures that no professional password remains stored anywhere other than with the identity provider.

[0080] It is noted that, in the case where the form includes a large number of fields 120, 130, 150a, 150b, 150c and that these fields must all be tested to determine if two of them correspond to a pair {professional email address, professional password}, ​​the verification procedure may require a considerable amount of time.

[0081] Also, according to one or more embodiments, at the end of the first implementation of a security procedure for a given user during which it has been determined that a string of characters corresponds to a password associated with the professional email address, this password can be erased from memory, but an informational data relating to this password can be kept in memory, in association with the user's professional email address.

[0082] In other words, during the implementation of the security procedure, the work email address and a string of characters corresponding to another user field (130, 150a, 150b, 150c) are temporarily stored in memory. Upon verification with the identity provider, it is determined that this string of characters corresponds to the password associated with the work email address. At the end of the procedure, the password is deleted to maintain a high level of security, but informational data relating to this password is stored in memory, in association with the user's work email address. This informational data is intended to be used, during a subsequent implementation of the security procedure for this user, to reduce the number of strings of characters to be tested.

[0083] For example, the informational data may be a function of the number of characters in the password, for example, the result of a hash function applied to the number of characters in the password. During a subsequent implementation of the security procedure for this user (for example, if the user wishes to access the same or another service), once it is determined that one of the fields 120 corresponds to the user's work email address, memory is queried to determine the number of characters in the password associated with this work email address, and only the strings of characters (associated with the other user fields 130, 150a, 150b, 150c) for which the application of the hash function to the number of characters provides the expected result are tested. If no string of characters is suitable, the security procedure stops and the user can access the requested service.Other embodiments are possible; for example, the informational data may correspond to the result of an encryption or hashing function applied to the professional password, or any other data determined from the professional password.

[0084] [Fig.2] Fig.2 represents a flowchart of a method for securing a access to content via a web page, according to one embodiment of the invention.

[0085] During an optional step 205, a list of "authorized" web addresses is received. This list of allowed web addresses typically includes addresses considered "trusted" by the organization's IT system administrator. For example, the list of allowed web addresses might include web addresses associated with the organization's website, web addresses associated with search engines, and so on. This list of allowed web addresses defines a set of web addresses for which the security procedure is not implemented. It should be noted that the items on this list can be "complete" web addresses, but also "partial" web addresses, such as a domain name (in which case it is checked whether the accessed web address includes the domain name), or a set of web addresses associated with the same domain name.In particular, pattern matching can be used to define such a set of web addresses, for example by using one or more regular expressions, or one or more metacharacters (also called "wildcards"), such as an asterisk "*" (to define, for example, the set of web addresses starting with www.exampledomain.fr), or a question mark "?".

[0086] As mentioned above, equivalently, in step 205, the list of web addresses received can be a list of "to be monitored" web addresses, defining, conversely, a set of web addresses for which the security procedure is necessarily implemented. For example, the list of web addresses to be monitored may include web addresses associated with social networks or online food delivery services.

[0087] Alternatively or in addition, it is possible to automatically determine whether a web address should be monitored or not. To do this, an artificial intelligence algorithm, for example a machine learning algorithm such as a neural network, can be trained to automatically determine, during step 225, whether a web address should be monitored or not. Such automatic detection can be implemented in addition to step 205, or replace step 205 (in which case step 205 is not implemented).

[0088] During a 210 step, at least one "to protect" or "to monitor" domain name is received. The domain name to protect identifies email addresses requiring a security procedure, including business email addresses. The domain name received in the 210 step may or may not have an extension (e.g., "organization.com"). As mentioned above, several domain names may be received during the 210 step.

[0089] It is noted that step 210 can be implemented before, after, or in parallel with step 205. Furthermore, steps 205 and 210 can only be implemented during a first implementation of the securing process according to the invention. Steps 205 and 210 can also be implemented later than the first implementation of the security process according to the invention, for example to update the list of authorized (or monitored) web addresses as well as the domain name(s) to be protected.

[0090] In step 215, a triggering event is received, which initiates the security procedure. This event typically corresponds to an attempt to send data to an external server. For example, the event may correspond to the user submitting a form using a validation button (element 140 in Figures 1a and 1b). Alternatively, the event may correspond to the entry (without necessarily validation) of character strings into at least two user fields on a web page.

[0091] Upon receiving the triggering element, a check is performed at step 220 to determine whether the web address of the web page through which the user attempts to send data corresponds to an authorized address (or, equivalently, to an address to be monitored). If the web address corresponds to an authorized web address (arrow "O" in step 220), no further checks are performed, the pause is terminated, and the entered data is sent to the external server (step 260) in the usual manner.

[0092] If the web address does not correspond to an authorized web address (arrow "N" in step 220), a step 225 is implemented in which it is checked whether a string of characters associated with one of the user fields corresponds to a professional email address. This check is performed, for example, by checking whether the string of characters includes a domain name to be protected, received in step 210.

[0093] If a string of characters associated with one of the user fields does not correspond to a professional email address (step 225, arrow "N"), no further check is carried out, the pause is terminated and the entered data is sent to the external server (step 260), in the usual way.

[0094] If a string associated with one of the user fields matches a work email address (step 225, arrow "O"), the sending of the strings associated with the user fields of the web page to an external server is paused at step 230. In one embodiment, the sending of the strings associated with the user fields of the web page to an external server is paused for a predefined duration, for example, between 200 and 500 ms. Alternatively, the sending of the strings associated with the user fields of the web page to an external server is paused indefinitely, and the pause ends when the procedure for verifying the strings associated with the user fields is completed.

[0095] In a particular implementation of the invention, event reception (step 215) is implemented by an event listener method called "addEventListener" to listen for one or more events, for example, a user clicking a button. When the user clicks a button, a function can then be called to pause the sending of data entered in the user fields of the web page to an external server and perform verification of this data. The pausing (step 230) can be implemented, for example, using a "while(true)" statement to generate a loop within the script and prevent the data from being sent directly to the external server.

[0096] In addition, a query is sent (step 235) to determine if one of the remaining fields contains a string of characters corresponding to a password associated with the work email address, referred to herein as the "work password". This query can be a request sent to a server, for example, the server of an identity provider linked to the work email address, or a server (remote or "cloud" server) on which a database is stored comprising records [work email address, authentication data] associated with an identity provider to which the work email address is linked (for example, the database records can include three pieces of information: identity provider identifier, work email address, authentication data).Alternatively, or in addition, the query can be a query of a locally stored database, the database containing records as described above, for example [work email address, authentication data] in association with an identity provider to which the work email address is linked. Indeed, when the user uses a password manager, the credentials (which may include the work email address) and passwords (or data derived from passwords, for example the results of applying a password encryption function) are stored in such a database, and the verification can be performed by querying this database to check if any of the remaining fields match the authentication data associated with the work email address detected in step 225.

[0097] It is noted that steps 230 and 235 can be implemented in any order or in parallel after it has been detected that a string of characters associated with one of the user fields corresponds to a professional email address (step 225, arrow "O").

[0098] A test 240 is then implemented to verify one or more conditions. During Test 240 specifically verifies whether a response to the query is received from the identity provider. Alternatively, it can verify whether a response is received within a predetermined time, this predetermined time potentially corresponding to the predefined pause duration (step 220) of sending the strings associated with the web page's user fields to an external server. The advantage of these implementations is that, if the identity server query fails, an action is taken and the system does not remain in an "infinite" pause.

[0099] According to these embodiments, if a response to the query is received from the identity provider within the allotted time (for example, the pause time 220 of sending the strings associated with the user fields of the web page to an external server) and no string entered in one of the user fields corresponds to the professional password (step 245), i.e. the password associated, in the identity provider's database, with the professional email address, the pause is terminated and the entered data is sent to the external server (step 260).

[0100] If a response to the query is received from the identity provider within the allotted time (for example, the pause time 220 of sending the strings associated with the user fields of the web page to an external server) and a string entered in one of the user fields matches the work password (step 250), the sending of the entered data to the external server is blocked (step 265).

[0101] If no response to the query is received from the identity provider within the allotted time (step 255), the transmission of the entered data to the external server can advantageously be blocked (step 265) to ensure maximum security. Other embodiments are possible; for example, if no response to the query is received from the identity provider within the allotted time (step 255), the pause time in step 220 can be renewed, and a new query sent to the identity provider. Alternatively, to avoid unduly restricting user access to services, it may be decided in this case to allow the transmission of the data nonetheless (step 260).

[0102] According to one possible implementation, the method described above can be implemented as a web browser extension (or "plug-in"). This allows for data control even before a network packet is created to send data to the external server, thus ensuring more reliable and secure handling of data sent externally. The network packet is created only if, at the end of the process, it is authorized to send the data to the external server.

[0103] Alternatively, the above process can be implemented as an intermediate program of the "proxy" type. According to one possible implementation, the process can be an intermediate program at the user's workstation level, but this requires a more complex and user-intrusive architecture. In particular, this solution requires integration between the thin client and the thick client to be able to act on network requests at the operating system level. Using such a solution, the creation of the HTTP request to the external server is not blocked, but its transmission at the network level can be prevented. According to another possible implementation, the process can be an intermediate program at the network level. Such a solution requires decrypting and re-encrypting the HTTP stream, and may therefore be somewhat more computationally intensive.

[0104] [Fig.3] Fig.3 represents an example of a device for securing access to a content via a web page, according to one embodiment of the invention.

[0105] The device may include a computer 300, comprising a memory 301 for storing instructions enabling the implementation of the security process detailed above and temporary data for carrying out different steps of this process.

[0106] The computer 300 may further include a circuit 302. This circuit may be, for example, a processor capable of interpreting instructions in the form of a computer program, an electronic card whose steps of the process of the invention are described in silicon, or a programmable electronic chip such as an FPGA chip (for "Field-Programmable Gate Array" in English).

[0107] The computer 300 may include an input interface 303 for receiving data such as the list of allowed or monitored web addresses, the domain name(s) to be protected, and the character strings entered in the user fields of the web page, and an output interface 304 for providing commands, such as redirects to a new web page. Finally, the computer may include, to allow easy interaction with a user, a screen 305 and a keyboard 306. Of course, the keyboard is optional, particularly in the case of a computer in the form of a touchscreen tablet, for example.

[0108] Furthermore, the functional diagram shown in [Fig. 2] is a typical example of a program in which certain instructions can be executed using the described device. As such, [Fig. 2] can be considered the flowchart of the general algorithm of a computer program within the meaning of the invention.

[0109] Of course, the present invention is not limited to the embodiments described above by way of example. It extends to other variants.

Claims

Claims

1. A computer-implemented method of securing access to a resource via a web page, said web page being identified by a web address (110), access to the resource requiring authentication or registration of a user, the method comprising: receive (210) at least one domain name to be monitored; detect (215) an attempt to send, to an external server, at least two character strings (120, 130, 150a, 150b, 150c) respectively associated with at least two user fields of the web page; upon detecting the sending attempt, determining (220) whether the web address identifying the web page corresponds to an authorized web address; • if the web address (110) identifying the web page corresponds to an authorized web address, authorize (260) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; • otherwise, determining (225) whether a character string (120) among the at least two character strings (120, 130, 150a, 150b, 150c) corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received : • if no character string (120) corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received, authorize (260) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; • if a character string (120), called the first character string, corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received, pause (230) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server for a time interval and send (235) an associated query request to an identity provider to determine (240) whether a second character string (130) among the at least two character strings matches authentication data associated with the first character string (120); wherein if a response to the query request is received during the time interval, the method further comprises: - if a second character string (130) among the at least two character strings (120, 130, 150a, 150b, 150c) corresponds to an authentication data item associated with the first character string (120), preventing (265) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; - otherwise, authorizing (260) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server.

2. The method of claim 1, wherein, if no response to the polling request is received within the time interval, the method further comprises: preventing (265) sending the at least two character strings (120, 130, 150a, 150b, 150c) to the external server.

3. Method according to one of the preceding claims, in which the authentication data is a password.

4. Method according to one of the preceding claims, wherein, if the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server is prevented (265), the method further comprises: redirecting the user to a new web page.

5. A method according to one of the preceding claims, wherein the query request is sent to a server associated with the identity provider and wherein the response to the query request is received from the server associated with the identity provider.

6. Method according to one of claims 1 to 4, in which the request query is a query to a database comprising entries, each entry comprising an email address, information relating to an authentication data associated with the email address, and information relating to an identity provider to which the email address is attached.

7. A method according to any preceding claim, wherein, upon detecting the attempt to send the at least two character strings (120, 130, 150a, 150b, 150c), said at least two character strings (120, 130, 150a, 150b, 150c) are stored in a memory; and wherein, after querying the identity provider, each character string (130, 150a, 150b, 150c) other than the first character string (120) is erased from said memory.

8. The method of claim 7, wherein, upon detecting the attempt to send the at least two character strings (120, 130, 150a, 150b, 150c), a character string (130) other than the first character string (120) is stored in the memory in association with a respective piece of information; wherein, if said character string (130) other than the first character string (120) matches an authentication piece of information associated with said first character string (120), the information piece of information relating to the second character string (130) is kept in the memory in association with the first character string (120).

9. Method according to claim 8, in which the informative data is a result of a function applied to the character string with which it is associated.

10. Method according to one of claims 8 and 9, further comprising: - detecting an attempt to send, to a second external server, at least two character sequences respectively associated with at least two user fields (120, 130, 150a, 150b, 150c) of a second web page whose web address does not correspond to an authorized web address, in which a character sequence among the at least two character sequences corresponds to the first character string (120); - upon detection of said sending attempt, determining, for at least one character sequence other than the character sequence corresponding to the first character string, whether said at least one character sequence is compatible with the information data stored in association with the first character string, and selecting said at least one character sequence only if said at least one character sequence is compatible with said information data; • if no character sequence other than the character sequence corresponding to the first character string is selected, allow sending of the at least two character sequences to the second external server; • otherwise, pause sending the at least two character sequences to the second external server for a second time interval and send a second associated query request to the identity provider to determine whether a selected character sequence matches an authentication data associated with the first character string; wherein if a response to the second polling request is received during the second time interval, the method further comprises: - if a selected character sequence corresponds to an authentication data item associated with the first character string (120), preventing the sending of the at least two character sequences to the second external server; - otherwise, allow sending at least two character sequences to the second external server.

11. Device for securing access to a resource via a web page, said web page being identified by a web address (110), access to the resource requiring authentication or registration of a user, the device being configured to: - receive (210) at least one domain name to monitor; - detect (215) an attempt to send to an external server, of at least two character strings (120, 130, 150a, 150b, 150c) respectively associated with at least two user fields of the web page; upon detecting the sending attempt, determining (220) whether the web address identifying the web page corresponds to an authorized web address; • if the web address (110) identifying the web page corresponds to an authorized web address, authorize (260) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; • otherwise, determining (225) whether a character string (120) among the at least two character strings (120, 130, 150a, 150b, 150c) corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received: • if no character string (120) corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received, authorize (260) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; and • if a character string (120), called the first character string, corresponds to an electronic address associated with a domain name among the at least one domain name to be monitored received, pause (230) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server for a time interval and send (235) an associated query request to an identity provider to determine (240) whether a second character string (130) among the at least two character strings corresponds to authentication data associated with the first character string (120); wherein the device is further configured, if a response to the polling request is received during the time interval, to: - if a second character string (130) among the at least two character strings (120, 130, 150a, 150b, 150c) corresponds to an authentication data item associated with the first character string (120), preventing (265) the sending of the at least two character strings (120, 130, 150a, 150b, 150c) to the external server; - otherwise, authorize (260) sending at least two character strings (120, 130, 150a, 150b, 150c) to the external server.

12. Computer program product comprising instructions for implementing the method according to one of claims 1 to 10 when this program is executed by a processor.

Images