Browser Plug-in Secure Credential Submission via Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face difficulties in associating credential submission tools with websites, especially when credentials are presented outside the browser, and feel insecure when presented within the browser, as it appears the website has access to all credentials.
Innovation Solution
A browser plug-in, such as an ActiveX control, communicates with a credential service to determine if stored credentials match the website's requirements, obtaining a token for submission while displaying the credential information within the web page context, allowing users to select the appropriate credentials without disclosing metadata to the web page.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are selected and presented entirely outside the browser, then user control over credential selection is improved, but user ability to associate the submission tool with the site deteriorates
Solution Approach 1:
A browser plug-in serves as an intermediary component that bridges the gap between external credential management and web site authentication. The plug-in allows credential selection to occur within the browser context (maintaining site association) while enabling users to manage credentials externally (preserving user control). The plug-in communicates with both the credential service and the web site, facilitating secure token submission without exposing credential metadata.
2Loss of information
If credentials are selected and presented within the browser, then association between submission tool and site is improved, but user security perception deteriorates due to fear of credential exposure
Solution Approach 1:
The patent extracts credential metadata from the browser environment and stores it externally in a credential service. When authentication is required, only a security token (not the actual credentials) is submitted to the web site through the browser plug-in. This extraction approach maintains the association between the submission tool and site while eliminating the security risk of credential exposure within the browser.
Solution Approach 2:
Instead of submitting actual credentials, the system creates and submits a copy in the form of a security token. This token contains the necessary authentication information but does not reveal the underlying credential metadata. The plug-in generates this token copy securely and submits it to the web site, preserving both site association and user security.
3Loss of information
If credential metadata is disclosed to the web page, then web page can display credential information, but user security deteriorates
Solution Approach 1:
The patent extracts credential metadata from the web page context and stores it securely in an external credential service. The web page can request authentication without receiving the actual credential metadata. Instead, the browser plug-in communicates with the credential service to obtain and submit appropriate security tokens, preventing credential exposure while maintaining functional capability.
Solution Approach 2:
The browser plug-in acts as an intermediary that blocks direct access to credential metadata by the web page. It receives authentication requests from the web page, securely communicates with the external credential service to retrieve appropriate tokens, and submits only these tokens to the web page. This intermediary approach prevents credential exposure while enabling necessary authentication functionality.
Data Source
AI summary
Described is a technology by which a plug-in (e.g., an ActiveX® control) instantiated by a web browser calls functions of a credential service to use a set of credential data (e.g., a card file) for logging into a website. If the credential service determines that a previously used card file for the website exists, a representation of that card file is displayed in the browser, and the data of that card file is used to obtain a token for logging in the user. If not found, an icon is presented instead, by which the user can select a user interface that allows selection of another card file that meets that meet the website's requirements.