TWI852549B - System and method for rapid identification of website security - Google Patents

Abstract

A system for rapidly identifying website security includes a client device coupled to a bank server for downloading a website security identification application, wherein the website security identification application is configured to: retrieve a website URL and a relevant certificate of the website information; confirm whether the relevant certificate information includes a secure communication layer (SSL) certificate; and confirm whether the SSL certificate is valid.

Description

System and method for quickly identifying website security

The present invention relates to a system and method for quickly identifying website security.

Current online transaction security issues are not the same. Most online security incidents occur in electronic transaction disputes or account theft. The first is to induce customers to believe that there is a problem with their computer or account, or that they need to fill in information on a fake website to participate in a lottery or win a prize. However, it is difficult for customers to judge the authenticity, resulting in customers not trusting the real bank website or mistaking it for a fake website, which can easily cause the actual business to be unable to be promoted.

Therefore, developing a tool to identify secure websites is something that people in this field have been considering.

One implementation of the present invention provides a system for quickly identifying website security, which includes a client device coupled to a bank server for downloading a website security identification application, wherein the client device is used to execute the website security identification application to: capture the URL of a website and the website's related certificate information; confirm whether the related certificate information includes a secure communication terminal layer (SSL) certificate; and confirm whether the SSL certificate is within the validity period.

In some embodiments, the client device is also used to execute a website security identification application to confirm whether the SSL certificate is issued to the correct person.

In some embodiments, the client device is further used to execute a website security identification application to confirm whether the issuer of the SSL certificate is Taiwan Network Certification Corporation.

In some embodiments, the client device is further configured to execute a website security identification application to confirm whether the issuer of the SSL certificate is Chunghwa Telecom Corporation Limited.

In some embodiments, the client device is further configured to execute a website security identification application to confirm whether the website's URL is in a specific security list.

In some embodiments, the client device is further configured to execute a website security identification application to mark a website as a safe website when the website's URL is in a specific security list.

In some embodiments, the client device is further configured to execute a website security identification application to mark a website as an unsecure website when the website's related certificate information does not include an SSL certificate.

In some embodiments, the client device is further used to execute a website security identification application to mark a website as an unsafe website when the relevant certificate information of the website includes an SSL certificate but the SSL certificate is no longer valid.

In some embodiments, the client device is further used to execute a website security identification application to mark a website as a secure website when the relevant certificate information of the website includes an SSL certificate and the SSL certificate is within a validity period.

Another embodiment of the present invention provides a method for quickly identifying website security, which includes using a client device to couple to a bank server to download a website security identification application, wherein the client device is used to execute the website security identification application to: capture the URL of a website and the website's related certificate information; confirm whether the related certificate information includes a secure communication terminal layer (SSL) certificate; and confirm whether the SSL certificate is within the validity period.

Therefore, according to the technical content of this case, the website security system and method for rapid identification provide a website security identification application for downloading and running on its information device, and the financial industry chain provides Internet security guarantees for its own affiliated websites and important financial websites, so that customers can have more trust in the secure websites certified by the website security identification application.

The following will clearly illustrate the spirit of the present invention with diagrams and detailed descriptions. After understanding the embodiments of the present invention, any person with ordinary knowledge in the relevant technical field can make changes and modifications based on the techniques taught by the present invention without departing from the spirit and scope of the present invention.

The terms used herein are only for describing specific embodiments and are not intended to be limiting of the present invention. Singular forms such as "a", "this", "here", "this" and "the" as used herein also include plural forms.

As used herein, “coupled” or “connected” may refer to direct or indirect physical contact between two or more elements or devices, or mutual operation or action between two or more elements or devices.

The words "include", "including", "have", "contain", etc. used in this article are open terms, meaning including but not limited to.

As used herein, "and/or" includes any or all combinations of the items described.

The terms used in this document generally have the ordinary meanings of each term used in this field, in the context of this case and in the specific context, unless otherwise specified. Certain terms used to describe this case will be discussed below or elsewhere in this specification to provide additional guidance to those skilled in the art in describing this case.

Please refer to Figures 1 and 2 at the same time. Figure 1 shows a flow chart of a method for quickly identifying website security according to some embodiments of the present case, and Figure 2 shows a functional block diagram of a system for quickly identifying website security according to some embodiments of the present case. The method and system for quickly identifying website security in the present case are mainly applicable to the financial industry chain to ensure the security of customers performing transactions or inputting data on its affiliated websites when serving their customers. The financial industry chain here includes financial holding industry, banking industry, insurance industry, securities industry, futures industry or leasing industry, etc. Subsidiaries of the financial holding industry include banks, life insurance, securities, investment trusts, investment consulting and other businesses.

The financial industry chain can promote its service of quickly identifying website security on its bank-side server 200 or other servers serving customers, and provide website security identification applications for download. Customers of the financial industry chain can establish a connection with the bank-side server 200 through the Internet 300 through their client devices 150. Therefore, any client device 150 can log in to the website interface platform of the bank-side server 200 through the Internet 300 to execute various services of the website interface platform, including downloading website security identification applications. In some embodiments of the present case, these client devices 150 represent network-connected devices distributed in different locations. The client device 150 that can connect to the Internet is, for example, a mobile phone, a laptop, a tablet computer, a desktop computer, a smart phone, a tablet phone, or a smart watch, etc. The client device 150 may also be referred to as an information appliance (IA).

The website security identification application is used to execute the method 100 for quickly identifying the website security. In step 102 of the method 100, the website security identification application is started to connect to the website to be visited. If the client device 150 with a camera is used, after starting the website security identification application, the camera can be used to scan the two-dimensional barcode to connect to the website server 250 of the website to be visited.

In step 104 of method 100, the website's URL and related certificate information are then obtained. The "URL" here refers to the "real URL", not the "reduced URL" after the URL is shortened. Therefore, this step also includes restoring the real URL of the shortened URL before executing the subsequent verification step. The related certificate information here refers to certificates related to information security, such as SSL certificates and TSL certificates. The full name of SSL is Secure Sockets Layer. In short, it is a standard technology used to keep Internet connections secure and prevent all sensitive data sent between two systems from being read by criminals and modifying any transmitted information, including potential personal details. The two systems can be a server and a client (such as a shopping site and a browser), or server to server (for example, an application containing personally identifiable information or containing payroll information). This is done to ensure that any data transmitted between the user and the website, or between the two systems, remains unreadable. This technology uses encryption algorithms to obfuscate the data in transit, preventing hackers from reading the data as it is sent over the connection. This information could be any sensitive or personal information, including credit card numbers and other financial information, names and addresses. TSL (Transport Layer Security) is a newer and more secure version of SSL, and the security certificate is still generally referred to as SSL because this is the more common term. HTTPS (Hyper Text Transfer Protocol Secure) appears in the URL when a website is protected by an SSL certificate. The certificate details, including the issuing organization and the website owner's business name, can be viewed by clicking the lock icon on the browser bar.

In step 106 of method 100, it is first confirmed whether the website's relevant certificate information includes a secure communication terminal layer (SSL) certificate. Because financial websites are required by law to have this certificate to confirm their source identification. If the website's relevant certificate information does not include a secure communication terminal layer (SSL) certificate, the website is marked as an unsafe website in step 120 of method 100, and then step 122 of method 100 is performed. In some embodiments of the present case, when the website's relevant certificate information includes a secure communication terminal layer (SSL) certificate, it is still necessary to check whether the object of the issuance of the secure communication terminal layer (SSL) certificate is correct. If it is a related website of a financial industry chain, the object of the certificate issuance is the name of the company in the financial holding industry, banking industry, insurance industry, securities industry, futures industry or leasing industry. If the object of issuance does not match, it may be a counterfeit website, and it may be necessary to mark the website as an unsafe website in step 120 of method 100, and then proceed to step 122 of method 100. In some embodiments of the present case, when the relevant certificate information of the website includes a secure communication terminal layer (SSL) certificate, it is still necessary to check the issuer of the secure communication terminal layer (SSL) certificate. Since there are many issuers of SSL certificates in various countries, the credible issuers of SSL certificates for local enterprises in Taiwan include Taiwan Network Security Corporation and Chunghwa Telecom Corporation. In some embodiments of the present case, for affiliated websites of the local financial industry chain in Taiwan, when the relevant certificate information of the website includes a SSL certificate, but the credible issuer of the SSL certificate is not Taiwan Network Security Corporation or Chunghwa Telecom Corporation, it may still be necessary to mark the website as an unsafe website in step 120 of method 100, and then proceed to step 122 of method 100.

In step 108 of method 100, when the website's related certificate information includes a secure communication terminal layer (SSL) certificate, it is still necessary to check whether the secure communication terminal layer (SSL) certificate is within the validity period. In some embodiments of the present case, if the website's related certificate information includes a secure communication terminal layer (SSL) certificate, but the secure communication terminal layer (SSL) certificate is no longer within the validity period, the website needs to be marked as an unsafe website in step 120 of method 100, and then step 122 of method 100 is performed. In some embodiments of the present case (for example, for affiliated websites of the financial industry chain), if the relevant certificate information of the website includes a secure communication terminal layer (SSL) certificate, and the secure communication terminal layer (SSL) certificate is within the validity period, step 110 of method 100 can be directly executed to mark the website as a secure website.

In step 110 of method 100, a pre-set website whitelist (i.e., safe list) may be used to check whether the visited website is in the list. In some embodiments of the present case, when the URL of the website is in a specific safe list, step 110 of method 100 may be directly executed (i.e., step 106 and step 108 are skipped) to identify the website as a safe website. In some embodiments of the present case, the website whitelist may include Taiwan Pay (taiwanpay.com.tw), the National Banking Association's e-Bill National Payment Network (ba.org.tw), the National Federation of Banking and Commercial Banking Associations of the Republic of China (ba.org.tw), the Ministry of the Interior's Certificate Administration Center (nat.gov.tw), the Cooperative Bank Airport Transfer Reservation Platform (youfirst.com.tw), Visa Infinite Card/Visa Xi Card Exclusive Privileges (freeliving.com.tw), Longteng Travel Official Website - Global Quality Life Service Platform, VIP Travel Smart Service Platform (dragonpass.com.cn), mastercard (johoo777.com), Priceless Specials… etc. In some embodiments of the present case, the website whitelist is mostly affiliated websites of non-financial industry chains. In some embodiments of the present case, the website whitelist can also list all affiliated websites of the financial industry chain. When the relevant certificate information of the website includes a secure communication terminal layer (SSL) certificate and the secure communication terminal layer (SSL) certificate is within the validity period, the website's URL still needs to be in the specific security list, and then the step 110 of method 100 is directly executed to identify the website as a secure website. If the website's URL is not in the specific security list, it is still necessary to mark the website as an unsafe website in step 120 of method 100, and then proceed to step 122 of method 100.

In step 112 of method 100, if certain conditions of the above steps are met, the website security identification application will clearly mark the website that meets the viewing conditions as "safe" or "SAFE" on its user interface, so that users can easily perceive that the website is a safe website.

In step 120 of method 100, if certain conditions of the above steps are met, the website security identification application will clearly mark the website that meets the viewing conditions as "unsafe" or "WARNING" on its user interface, so that users can easily detect that the website is an unsafe website.

In step 122 of method 100, if a website has been marked as "unsafe" or "WARNING", information security personnel will then be asked to investigate the website or report the website for the purpose of removing it from the shelves.

In some embodiments of the present invention, the bank-side server 200 has a processor unit, a communication unit, and a storage unit, etc., to provide downloading of the website security identification application and to serve as background support when the application is running on the client device 150. In some embodiments of the present invention, the client device 150 has a processor unit, a communication unit, and a storage unit, etc., to execute each step of the above method 100. In some embodiments of the present invention, step 106, step 108, and step 110 of the method 100 can be run and checked on the client device 150 and the bank-side server 200 at the same time.

Accordingly, the rapid website security identification system and method of this case provides a website security identification application for downloading and running on its information device, and the financial industry chain provides Internet security guarantees for its own affiliated websites and important financial websites, so that customers can have more trust in the secure websites certified by the website security identification application.

Although the present invention is disclosed as above by way of embodiments, it is not intended to limit the present invention. Anyone skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of the patent application attached hereto.

100: Method

102: Step

104: Step

106: Step

108: Step

110: Steps

112: Step

120: Step

122: Step

150: Client device

200: Bank server

250:Web server

300:Internet

The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present invention and are used together with the specification to illustrate the technical solutions of the embodiments of the present invention. Figure 1 shows a flow chart of a method for quickly identifying website security according to some embodiments of the present invention. Figure 2 shows a functional block diagram of a system for quickly identifying website security according to some embodiments of the present invention.

100:Methods

102: Steps

104: Steps

106: Steps

108: Steps

110: Steps

112: Steps

120: Steps

122: Steps

Claims (8)

A system for quickly identifying website security includes: a client device coupled to a bank server for downloading a website security identification application, wherein the client device is used to execute the website security identification application to: capture a website URL and related certificate information of the website; confirm whether the related certificate information includes a secure communication terminal layer (SSL) certificate; confirm whether the SSL certificate is valid; confirm whether the object of the issuance of the SSL certificate is correct; and confirm whether the website URL is in a specific security list. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: confirm whether the issuer of the SSL certificate is Taiwan Network Certification Corporation. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: confirm whether the issuer of the SSL certificate is Chunghwa Telecom Corporation Limited. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: mark the website as a safe website when the website's URL is in a specific security list. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: mark the website as an unsafe website when the relevant certificate information of the website does not include the SSL certificate. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: when the relevant certificate information of the website includes the SSL certificate but the SSL certificate is no longer valid, mark the website as an unsafe website. A system for quickly identifying website security as described in claim 1, wherein the client device is also used to execute the website security identification application to: mark the website as a secure website when the relevant certificate information of the website includes the SSL certificate and the SSL certificate is within the validity period. A method for quickly identifying website security includes: coupling a client device to a bank server to download a website security identification application, wherein the client device is used to execute the website security identification application to capture a website URL and related certificate information of the website, confirm whether the related certificate information includes a secure communication terminal layer (SSL) certificate, confirm whether the SSL certificate is valid, confirm whether the object of the SSL certificate is correct, and confirm whether the website URL is in a specific security list.

Images