Bank of America Corporation

Stuart David Ford

Sanjay Bhanu

Ricardo Varanda

Andrew Paul Montgomery

Martin Sunder Singh Devasirvatham Samuel

Michael James Sbandi

Anna Kristen Pingel Berry

Robert Cain Durbin, Jr

Adam Kristian King

Chiamaka Azih

A computing device comprising a secure browser extension for a web browser monitors for satisfaction of one or more operating conditions to identify whether one or more unauthorized applications are intercepting web browser communications. Based on satisfaction of at least one operating condition, the secure browser extension of the computing device sends an HTTPS request to a known service via the web browser. The secure browser extension receives an HTTPS response to the HTTPS request via the web browser. The secure browser extension determines whether the certificate included in the HTTPS response is trusted by the secure browser extension. Based on determining the certificate is not trusted, the secure browser extension terminates the web browser session and generates a notification for display at the computing device that indicates web browser communications are compromised.

Browser extension for validating communications

Systems for credential evaluation and control are provided. In some examples, a request to access data via a website may be received. The request may include a username. A browser extension embedded in the web browser used to request the data via the website may be triggered and one or more credential evaluation functions may be executed. An event record associated with the request to access data may be generated. The event record may be analyzed to determine a designation associated with the website and a designation associated with user credentials provided with the request to access the data. The designation of the website and the designation of the credentials may be compared to determine whether the designations match. If so, access to the requested data may be provided. If not, one or more mitigating actions may be identified and executed.

Multi-computer processing system for dynamically evaluating and controlling authenticated credentials

A system manages security policy data used to provide access by a user to third-party applications without revealing sign-on credentials to the user. The system includes an access management server that hosts an administration portal for configuring the security policy data. The security policy data includes, for each user, a list of applications to which the user may request access and the corresponding sign-on credentials for accessing each of the applications. In response to inputs provided at the administration portal, the system associates applications with credentials and subsequently associates the credentials with a user. Before these associations are used to update the security policy data. A request for confirmation of user permission is sent to a permission server, which stores current permission data for users. If permission for the user is confirmed, security policy data is updated according to the associations provided via the administration portal.

Administration portal for simulated single sign-on

A computing device comprising a secure browser extension for a web browser monitors for satisfaction of one or more operating conditions to identify whether one or more unauthorized applications are installed on the computing device. Based on satisfaction of at least one operating condition, the secure browser extension of the computing device sends an HTTP request to a known service via the web browser. The secure browser extension receives a response to the HTTP request via the web browser. The secure browser extension determines whether the received response is an HTTP response (e.g., from an unauthorized application) or a non-HTTP response (e.g., from the known service). Based on determining the received response is an HTTP response, the secure browser extension terminates the web browser session and generates a notification for display at the computing device that indicates web browser communications are compromised.

Web browser communication validation extension

A system provides for automatically populating a sign-on page with sign-on credentials and automatically submitting the sign-on credentials without revealing at least one of the sign-on credentials to a user. The system includes an access management server which stores sign-on credentials for accessing the application. An application access tool, which is associated with a browser extension of a web browser executed on the user's device, provides a network address for a sign-on page of the application, and the system automatically redirects the user to this sign-on page. The system uses a source code database to identify object identifiers in html source code of the sign-on page that corresponds to form fields or other objects in the sign-on page for appropriately entering and submitting sign-on credentials in the sign-on page. The credentials are entered in an anonymized format that is not readable to the user.

Automatic login tool for simulated single sign-on

A blind authenticator performs an authentication procedure with two devices that provides the convenience offered by password storage but avoids storing the passwords themselves. Generally, the blind authenticator stores on the two devices portions of different code generation algorithms. These algorithms on the devices are incomplete&#x2014;they may not execute properly on their own. During an authentication procedure, the blind authenticator communicates to the devices the remaining portions of these code generation algorithms so that the devices can execute their respective code generation algorithms. The devices then send the generated codes to the blind authenticator, which performs a code validation algorithm on the received codes to determine whether the codes are valid. The code validation algorithm is not sent to the devices, so the devices do not know what makes a code valid or invalid.

Blind authenticator

A system manages security policy data used to provide access by a user to third-party applications without revealing sign-on credentials to the user. The system includes an access management server that hosts an administration portal for configuring the security policy data. The security policy data includes, for each user, a list of applications to which the user may request access and the corresponding sign-on credentials for accessing each of the applications. In response to inputs provided at the administration portal, the system associates applications with credentials and subsequently associates the credentials with a user. Before these associations are used to update the security policy data, a request for confirmation of user permission is sent to a permission server, which stores current permission data for users. If permission for the user is confirmed, security policy data is updated according to the associations provided via the administration portal.

A system provides access to a third-party application by a user without revealing at least one sign-on credential used to access the application to the user. The system includes an access management server and a permission server. The access management server hosts a user portal. In response to a user input from the user portal requesting to access the application, the access management server requests, from the permission server, confirmation of user's permission to access the application. The permission server determines whether access is confirmed using stored permission data, which includes applications the user is currently permitted to access. If the permission server confirms the user's permission, the access management server redirects the user to a sign-on page of the application, automatically enter the sign-on credentials in an anonymized format that is not readable by the user, and automatically submits the sign-on credentials.

Growing community of inventors

Slapton, United Kingdom

Stuart David Ford