Patent ID: 8429734

Claim:
A computer-implemented method comprising: executing on a host computer system a credential manager application, wherein the executing includes: intercepting, by the executing credential manager application on the host computer system, an SSL certificate received on the host computer system, wherein the SSL certificate is intercepted prior to receipt by a web browser on the host computer system, and wherein the SSL certificate is returned from a web site in response to communication from the host computer system; obtaining, on the host computer system by the executing credential manager application, certificate information associated with said SSL certificate, wherein said certificate information comprises: a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate; at least one user credential of a user, wherein the user is a user of the host computer system; and at least one certificate attribute of the SSL certificate; querying a trusted local cache, on the host computer system by the executing credential manager application, for locally stored certificate information corresponding to said SSL certificate, wherein said locally stored certificate information comprises: a Uniform Resource Locator (URL) associated with a web site providing the SSL certificate; at least one user credential of a user, wherein the user is a user of the host computer system; and at least one certificate attribute of the SSL certificate; determining, on the host computer system by the executing credential manager application, whether said locally stored certificate information is present in said trusted local cache; wherein upon a determination that said locally stored certificate information is present in said trusted local cache, obtaining, on the host computer system by the executing credential manager application, said locally stored certificate information; performing a first comparison, on the host computer system by the executing credential manager application, said first comparison comparing at least said at least one user credential and said at least one certificate attribute with corresponding information in said locally stored certificate information; determining, on the host computer system by the executing credential manager application, whether said SSL certificate is verified based upon said first comparison; wherein upon a determination that said SSL certificate is verified, releasing said SSL certificate; and wherein upon a determination that said SSL certificate is not verified, taking protective action on the host computer system as the SSL certificate is indicative of malicious activity and so is indicative of a malicious attack; and wherein the protective action includes sending an alert of the malicious activity by the executing credential manager application.