Abstract: A system and method that evaluates privacy policies from web sites to determine whether each site is permitted to perform operations (e.g., store, retrieve or delete) directed to cookies on a user's computer. Various properties of each cookie and the context in which it is being used are evaluated against a user's privacy preference settings to make the determination. An evaluation engine accomplishes the evaluation and determination via a number of criteria and considerations, including the cookie properties, its current context, the site, the zone that contains the site, and any P3P data (compact policy) provided with the site's response. The user privacy preferences are evaluated against these criteria to determine whether a requested cookie operation is allowed, denied or modified. A formalized distinction between first-party cookies versus third-party cookies may be used in the determination, along with whether the cookie is a persistent cookie or a session cookie.

Abstract: Computer-readable media, systems, and methods for validating an authentication ticket to ensure authenticated communications between a client and an online service provider. In embodiments an authentication request is received from a user agent associated with the client and the authentication request includes a set of identification information and a set of authentication information. Additionally, it is determined that the set of identification information and the set of authentication information are associated with a user and an authentication ticket is created including a user identification and an authentication, indicating to the online service provider that the user is authenticated to access one or more online services. Further, a validation token is embedded into the authentication ticket that provides enhanced verification that the access provided by the online service provider is authenticated.

Abstract: Systems and methods for providing signatures are described. In an implementation, a system includes a backend configured to generate a plurality of incomplete signatures using an offline portion of an online/offline signature algorithm, storage configured to store the plurality of incomplete signatures and a front end configured to process a plurality of messages using the plurality of incomplete signatures to form a plurality of digital signatures such that each of the messages has a corresponding one of the digital signatures.

Abstract: Encrypted communications between peers are inspected by a proxy server, for bugs, viruses, malicious software and the like, while the proxy server is prevented from modifying the encrypted communications. A proxy server functioning as a gateway processor between the peers includes a security processor. The security processor is coupled to one of the peers via a channel that is separate from the channel carrying the encrypted communications between the peers. Cryptographic keys needed to decrypt the encrypted communications are provided via the separate channel to the security processor prior to commencement of encrypted communications. The security processor monitors the encrypted communications. The security processor decrypts the monitored encrypted communications without perturbing the encrypted communications. The security processor decrypts the encrypted communications utilizing the previously provided cryptographic keys. The security processor inspects the decrypted communications.

Abstract: A human interactive proof (HIP) service is described. In response to a request from a web server, the HIP service generates a HIP challenge and an associated attestation. The web server can then embed the generated HIP challenge in a requested web page. The attestation is used to determine whether or not a user response to the HIP challenge is correct.

Abstract: A method, system, and computer-readable medium are provided for managing consent between online entities to perform tasks. The consent mechanism uses an asynchronous protocol for submitting consent requests, managing consent requests, and resolving consent requests. An application that requires consent to perform a task submits a request for consent to the consent mechanism. The resolving authority obtains pending request information from the consent mechanism and sends the consent mechanism request resolution information. The application obtains resolved request information from the consent mechanism. If the resolved request is approved, the consent mechanism allows the application to perform the task. If the resolved request is denied, the consent mechanism does not allow the application to perform the task.

Abstract: A permission level associated with a child's access to a Web server is identified. A relationship ticket is obtained from an authentication server and a request is generated to set the identified permission level. The request and the relationship ticket are sent to the Web server and a success code is received from the Web server if the requested permission level is established.

Abstract: A forwarding signature comprises a modified digital signature, modified using a predetermined parameter between a sender and an intended recipient. An intended recipient of the forwarding signature can verify that the forwarding signature corresponds to the message, but, can neither derive the original digital signature nor generate a new forwarding signature for a different parameter. Generation and verification of the forwarding signature is accomplished with access to the public key of a public/private cryptographic key pair, the original signed message, and the predetermined parameter. Access to the private key is not needed.

Abstract: A system enabling an application desiring access to a resource addressable by a URI to produce a response to an authentication challenge to a request to access the URI without including code specific to an authentication system and/or method is provided. The system includes an authentication manager that can pass an authentication challenge to authentication modules and/or objects operable to produce a response to the authentication challenge. The system may also include a cache adapted to store one or more responses to the authentication challenge communicated from the authentication modules, with such cache also being employed to facilitate pre-authenticating test challenges and/or pseudo-challenges.

Abstract: A system and method that prevents certain cookies, as specified by an Internet server, from being accessed through client-side script, thereby mitigating the amount of damage that cross-site scripting attacks can accomplish. The server marks selected cookies with an attribute that flags such cookies as being protected, and a security mechanism in the client prevents protected cookies from being accessed via script. A protected (flagged) cookie can still be accessed by the server, (e.g., via HTTP), while non-flagged cookies can be accessed by the server or script. An API or similar layer implements the security mechanism that checks for the attribute, and fails requests for any cookies having that attribute set. The present invention can also be adapted to prevent a malicious script from overwriting existing HTTP-only cookies on a client machine.

Abstract: Distinctively marking authentication forms and preemptively searching for and detecting unauthorized authentication forms. The invention includes creating a sign-in module having an identifying characteristic and presenting the created sign-in module to the user via a user interface. The invention also includes searching a plurality of web pages for the identifying characteristic and determining whether each of the searched web pages is authorized to include the created sign-in module.

Abstract: A system and method for automatically determining if a computer user is a human or an automated script. Human interactive proofs (HIPs) are currently used to deter automated registration for web services by automated computer scripts. Unfortunately, HIPs entail multiple steps (request service, receive challenge, respond to challenge) that can be burdensome. The system and method of the invention in one embodiment provides a “black-box” to potential users consisting of a challenge generator and a secret key. The challenge is generated for the user and the response can be provided as part of the service request, eliminating the need for a separate challenge from a service provider and response to the challenge.

Abstract: A system enabling an application desiring access to a resource addressable by a URI to produce a response to an authentication challenge to a request to access the URI without including code specific to an authentication system and/or method is provided. The system includes an authentication manager that can pass an authentication challenge to authentication modules and/or objects operable to produce a response to the authentication challenge. The system may also include a cache adapted to store one or more responses to the authentication challenge communicated from the authentication modules, with such cache also being employed to facilitate pre-authenticating test challenges and/or pseudo-challenges.

Abstract: Encrypted communications between peers are inspected by a proxy server, for bugs, viruses, malicious software and the like, while the proxy server is prevented from modifying the encrypted communications. A proxy server functioning as a gateway processor between the peers includes a security processor. The security processor is coupled to one of the peers via a channel that is separate from the channel carrying the encrypted communications between the peers. Cryptographic keys needed to decrypt the encrypted communications are provided via the separate channel to the security processor prior to commencement of encrypted communications. The security processor monitors the encrypted communications. The security processor decrypts the monitored encrypted communications without perturbing the encrypted communications. The security processor decrypts the encrypted communications utilizing the previously provided cryptographic keys. The security processor inspects the decrypted communications.

Abstract: Enabling dynamic aggregation of content from a plurality of content providers. The invention stores references associated with specific display areas in a document for a particular data source. Responsive to a request for the document, the invention retrieves the references associated with the data source and dynamically inserts the references into the appropriate display area of the document. A client renders the document by obtaining the content associated with the references. In an embodiment, the invention includes a web service for cobranding a login user interface for a user authentication system. The web service places cobranding content provided by an affiliate content provider and sign-in user interface content provided by a user authentication service into different frames of a single web page.

Abstract: Combining a browser cache and cookies to improve the security of token-based authentication protocols. A client stores a first portion of an authentication token as information (e.g., a cookie) in a first memory area. The client stores a second portion of the authentication token as server-inaccessible information (e.g., cached web content) in a second memory area. A server obtains the first and second portions from the client to recreate the authentication token to authenticate the client.

Abstract: A hierarchical identity based cryptographic system (“HIBC”) is integrated with the domain name system (“DNS”). A private key is assigned to each of the top level domain name authorities responsible for assigning the top level domain names (e.g., net, .com, etc.). The private key is generated according to an HIBC system, wherein the corresponding public key is based on the identity of the particular domain authority. When user requests a domain name from one of the top level domain name authorities, the user is issued a private key that is generated by the top level domain authority using its private key and the identity of the user according to the particular HIBC system implemented. The user's corresponding public key can be derived from the identity of the user and the public key of the top level domain name authority.

Abstract: A method, apparatus, and article of manufacture for detecting and preventing input data buffer overrun storing a security token containing a randomly generated data pattern in memory between an input data buffer and memory locations containing instruction address pointers. First one pushes all arguments to a function onto the stack data structure and pushes a return address onto the stack data structure for use in obtaining the memory address for the instruction to be executed upon completion of the function before it pushes onto the stack data structure a security token. This security token comprises a randomly generated data value.

Abstract: A system and method that evaluates privacy policies from web sites to determine whether each site is permitted to perform operations (e.g., store, retrieve or delete) directed to cookies on a user's computer. Various properties of each cookie and the context in which it is being used are evaluated against a user's privacy preference settings to make the determination. An evaluation engine accomplishes the evaluation and determination via a number of criteria and considerations, including the cookie properties, its current context, the site, the zone that contains the site, and any P3P data (compact policy) provided with the site's response. The user privacy preferences are evaluated against these criteria to determine whether a requested cookie operation is allowed, denied or modified. A formalized distinction between first-party cookies versus third-party cookies may be used in the determination, along with whether the cookie is a persistent cookie or a session cookie.

Abstract: A system and method that evaluates privacy policies from web sites to determine whether each site is permitted to perform operations (e.g., store, retrieve or delete) directed to cookies on a user's computer. Various properties of each cookie and the context in which it is being used are evaluated against a user's privacy preference settings to make the determination. An evaluation engine accomplishes the evaluation and determination via a number of criteria and considerations, including the cookie properties, its current context, the site, the zone that contains the site, and any P3P data (compact policy) provided with the site's response. The user privacy preferences are evaluated against these criteria to determine whether a requested cookie operation is allowed, denied or modified. A formalized distinction between first-party cookies versus third-party cookies may be used in the determination, along with whether the cookie is a persistent cookie or a session cookie.