Nok Nok Labs, Inc.

Matthew Lourie

Rolf Lindemann

Davit Baghdasaryan

Brendon Wilson

Marc Briceno

Naga Nagarajan

A system, apparatus, method, and machine-readable medium are described for defending against malicious code injection. For example, one embodiment of an apparatus comprises: a processor to execute an application to access a web page on the Internet in response to user input, the web page having one or more resource descriptors and/or code descriptors associated therewith; an authenticator engine to validate the web page based, at least in part, on the resource descriptors and/or code descriptors, by connecting to a trusted entity; and wherein the trusted entity is configured to generate a signature on a cryptographic assertion that includes one or more resource descriptor objects associated with the one or more resource descriptors and/or one or more code descriptor objects associated with the one or more code descriptors.

System and method for protection against malicious program code injection

A system, apparatus, method, and machine-readable medium are described for endorsing authenticators. For example, one embodiment of an apparatus comprises: a first instance of an authenticator associated with a first app to allow a user of the first app to authenticate with a first relying party; a secure key store accessible by the first instance of the authenticator to securely store authentication data related to the first app; and a synchronization processor to share at least a portion of the authentication data with a second instance of the authenticator associated with a second app to be executed on the apparatus.

System and method for endorsing a new authenticator

A system, apparatus, method, and machine-readable medium are described for determining the authentication capabilities. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.

Query system and method to determine authentication capabilities

A system, apparatus, method, and machine readable medium are described for determining the authentication capabilities. For example, one embodiment of a method comprises: receiving a policy identifying a set of acceptable authentication capabilities; determining a set of client authentication capabilities; and filtering the set of acceptable authentication capabilities based on the determined set of client authentication capabilities to arrive at a filtered set of one or more authentication capabilities for authenticating a user of the client.

A system, apparatus, method, and machine readable medium are described for performing transaction signing within an authentication framework. For example, one embodiment of a method comprises: executing an online transaction between a first server and a client; providing transaction details of the online transaction to a second server; generating a signature over the transaction details using a key at the second server; transmitting an authentication request to the client with the signature and the transaction details; authenticating a user on the client to generate authentication data, the authentication data specifying whether the user was successfully authenticated on the client; and transmitting the authentication data, the transaction details, and the signature to the second server; using the transaction details and the key to validate the signature and using the authentication details to authenticate the client at the second server, wherein upon validating the signature and authenticating the client, the second server transmits a confirmation for the transaction to the first server.

System and method for implementing transaction signing within an authentication framework

A system, apparatus, method, and machine readable medium are described for transparently requesting a new random challenge from a server within an authentication framework. For example, one embodiment of a method comprises: transmitting a random challenge and an indication of a timeout period associated with the random challenge from a server to a client within the context of a network registration or authentication process using authentication devices communicatively coupled to the client; automatically detecting that the random challenge is no longer valid based on the timeout period; and responsively transmitting a request for a new random challenge from the client to a server, wherein transmitting is performed transparently to a user of the client.

Growing community of inventors

San Jose, CA, United States of America

Matthew Lourie