RU2602789C2 - System and method for automatic filling of electronic forms - Google Patents

Abstract

FIELD: data processing.

SUBSTANCE: present invention relates to autocomplete of electronic forms, in particular, to a method and a system for automatic filling of web forms with personal user data. Method comprises steps of: generating and sending by a client a request for automatic filling of fields of electronic forms to an external application; processing said request on external application and sending processed request to an autocomplete system; performing user authentication and external application in autocomplete system, returning to user from autocomplete system data for filling only specific fields of electronic forms in accordance with said identifiers; wherein autocomplete system is part of independent external system, to which previously provided personal data.

EFFECT: technical result is providing safe automatic filling of forms using information previously stored by user on any of available independent external systems, and is achieved by using method and system for automatic filling of electronic forms with personal user data.

12 cl, 2 dwg

Description

FIELD OF THE INVENTION

The present invention relates to the field of auto-completion of electronic forms, in particular to a method and system for automatically filling out web forms with personal user data.

State of the art

Issues related to the automatic completion of electronic forms are relevant today. Currently, the user repeatedly enters the same data into the same type of electronic form on various sites. This procedure ensures that the user receives current information at the time of entry, but it is not very convenient for the user, because often the user enters the same data for different sites (as a rule, this is the name, surname, date of birth and the like).

US Pat. No. 7,146,560 (published December 5, 2006, “Systems and methods for managing identify information”) discloses a method and system for managing identity information through an identity management manager that stores user identity. Information is provided only if the user makes a request for content. Since the storage elements are also templates and styles for providing identification information, filling in the identification information of the requested resources (Internet) forms occurs automatically from the storage of the identity management manager, which saves the user from remembering the specified parameters related to specific information resources of the network. Refers to online-technology access to a variety of web resources on the Internet.

Publication US 2014/0258828 A1 discloses a web browser extension for auto-filling or a smartphone application for auto-filling, which provides secure storage of user data and automatic filling of web forms with personal user data. A pop-up menu with saved answers appears in front of or on the side of the form into which the user needs to enter the required information. The user simply selects the desired answer from the list of saved answers and places it in the appropriate electronic form. If the saved answers do not have the desired value, then the user simply clicks on the form and enters it himself. This answer can be automatically saved to the list of saved answers.

As an analogue closest to the present invention, the RoboForm program is considered (see http://www.roboform.com/ru). RoboForm is a program for automatically filling out forms on websites and storing passwords for the Windows operating system. This program provides the following functions: saving and automatically filling out form data on websites, creating several “persons” - data sets for filling out complex web forms, filling out http authentication form data, encrypting stored form data and passwords using AES algorithms, Blowfish, RC6, 3-DES, DES, support for multiple user profiles, backup and restore of saved information, the ability to store data in RoboForm Online storage. Moreover, the functionality of RoboForm Online was built into a new service: RoboForm Everywhere. The new RoboForm Everywhere service stores all data in a synchronized form on the server, monitors the availability of a backup copy of the data on the server and allows you to access data from anywhere (Everywhere) via the Internet.

However, when automatically filling out electronic forms with user data, it is necessary to provide not only high security, but also the convenience of using these tools.

The approach to solving this problem is to provide the user with the opportunity to automatically fill out electronic forms from a single source, and data automatically filled in can be adjusted by the user before sending to the site. User-corrected data can also be stored in a single source and offered to the user when filling in later. Moreover, unlike analogs, this single data source will be a non-specially created file that is stored directly on the user's computer and which cannot be used when using another computer (either laptop, tablet, smartphone, etc.). As well as not specially created online service, which will store the user's personal data for input into electronic forms. In the present invention, data for filling out a form is provided by an autofill system that is part of an external system storing requested data. Moreover, the mentioned external system is a social network, a platform of a telecom operator, a banking system, etc. That is, any system to which the user has previously transferred his personal data.

Known methods of registration on sites or authorization using external systems (usually social networks) reveal the user's authorization in the selected external system, after which the selected external system requests the user's consent to provide his personal data to a third-party site (for example, the OAuth protocol). OAuth is a protocol for authorized access to a third-party API, i.e. a protocol that allows social services to integrate with each other and provides a way to exchange personal information. Without each of the following steps (OAuth 2.0. Includes three main steps), the interaction cannot be considered consistent with OAuth 2.0 recommendations:

- authentication of the user redirected by the external application, and the issuance on behalf of the user of the rights to the external application (“authorization code” (Auth code));

- authentication of the external application and the issuance of a "token" (token) to perform permitted operations;

- execution of the operation by the application upon presentation of the "token".

However, there is a need for a method in which the user authentication step would end not by issuing some “authorization code” to receive the “token”, but by transmitting encrypted values to the user for the requested fields.

Also, considering well-known authorization methods using external systems, it should be noted that after receiving consent from the user to provide his personal data to a third-party site, the site receives (not clearly) all the necessary data. Thus, the user sees only that the necessary forms for filling were automatically filled with the help of information received from an external system. However, the site received "at the disposal" not only data for the mentioned forms, but all data provided by the user to the mentioned external system. And the user does not have the opportunity to find out whether this data will be used by the site and if so, for what purposes it will be used (for example, receiving email, phone, etc. for distributing spam mailings and more).

Disclosure of invention

The objective of the present invention is to eliminate the above-mentioned drawbacks inherent in solutions known from the prior art, in particular in providing the ability to automatically fill out electronic forms using data provided by an existing external system, and the external system does not provide access to the entire profile, but only to the data which the user has given permission to provide.

This problem is solved by the method and system, which are described in the independent claims. Additional embodiments of the present invention are presented in the dependent claims.

The technical result achieved by using the present invention is to enable the safe automatic filling of forms using information previously stored by the user on any of the available independent external systems.

According to a first aspect of the present invention, there is provided a method for automatically filling out electronic forms with personal user data, comprising the steps of:

form and send a request for automatic completion of electronic forms to an external application;

process the request and send the processed request to the autocomplete system;

Authenticate the user and the external application in the autocomplete system;

in case of successful authentication, data is returned to the user from the autocomplete system to fill out only the requested electronic forms in order to enable the user to transfer the said data to the external application to fill only the requested electronic forms;

moreover, the autofill system is part of an external system to which the user has previously provided personal data.

According to one embodiment, the user is given the opportunity to adjust the populated data.

In another embodiment, the autofill system stores the corrected data.

In yet another embodiment, the autocomplete system encrypts data for an external application.

In another embodiment, the external application includes an interaction module, the interaction module decrypting the encrypted populated data and transmitting it to the external application.

In one embodiment, in case of successful authentication, the requested electronic forms are returned to the user with a choice of data to fill out from the list of data stored in the autofill system.

According to another embodiment, if the user is a subscriber using the operator’s network for access, authentication is performed through the operator’s routing node using the subscriber’s network identifier.

According to a second aspect of the present invention, there is provided a system for automatically filling out electronic forms with user personal data, comprising:

a client configured to form and send a request to automatically fill out electronic forms to an external application;

an external application configured to process said request and send the processed request to the autofill system; and

an autocomplete system configured to authenticate a user and an external application,

moreover, in case of successful authentication, the autocomplete system returns to the user data for filling in only the requested electronic forms in order to enable the user to transfer the said data to the external application for filling in only the requested electronic forms;

at the same time, the client interacts with the external application and the autocomplete system using the HTTP / HTTPs protocol; and

moreover, the autofill system is part of an external system to which the user has previously provided personal data.

In one embodiment, the client is further configured to allow the user to adjust the data to be filled out in said electronic forms with the data filled in and to send the corrected data to the autofill system.

In another embodiment, said autofill system is further configured to save adjusted data.

In yet another embodiment, said autocomplete system is further configured to encrypt data for an external application.

In another embodiment, said external application further includes an interaction module, the interaction module being configured to decrypt the encrypted data for filling.

Brief Description of the Drawings

These and other features and advantages of the present invention will become apparent after reading the following description and viewing the accompanying drawings, in which:

FIG. 1 is a component diagram of a system in accordance with an exemplary embodiment of the present invention;

FIG. 2 is a flowchart of a method in accordance with an exemplary embodiment of the present invention.

The presented figures serve only to illustrate embodiments of the present invention and do not limit it in any way.

The implementation of the invention

Various embodiments of the present invention are described in further detail below with reference to the drawings. However, the present invention can be embodied in many other forms and should not be construed as being limited by any particular structure or function described in the following description. Based on the present description, a person skilled in the art will understand that the scope of legal protection of the present invention covers any embodiment of the present invention disclosed herein, regardless of whether it is implemented independently or in combination with any other embodiment of the present invention. For example, a system may be implemented or the method may be practiced using any number of embodiments set forth herein.

The word “exemplary” is used herein to mean “serving as an example or illustration”. Any embodiment described herein as “exemplary” need not be construed as being preferred or taking precedence over other embodiments.

The term “authentication” is used herein to mean “authentication procedure”, for example, user authentication.

The invention presented herein consists of three main elements, which are depicted in FIG. one:

1) Client 1;

2) System 2 autofill;

3) External application 3.

1. Customer 1

Client 1 (user 4 of external application 3) is a device that implements a web client - a set of means by which user 4 interacts with external application 3 and autofill system 2 through the user's web browser. User 4 of external application 3 should be understood as a subscriber of a mobile operator, a bank client, a user of a social network, and the like, of consumers of systems equipped with an autofill system. Client 1 can be implemented as a personal, tablet or industrial computer, smartphone, as well as another device that implements a web client. Client 1 interacts with external application 3 and autocomplete system 2 through a web browser using HTTP / HTTPs protocols.

2. AutoFill System 2

This system is an information system that includes the following possible functional components:

- subsystem 6 user authentication;

- subsystem 7 authentication of external applications;

- subsystem of 8 autofill scenarios;

- subsystem 9 data storage.

Subsystems 6, 7, 8, 9 carry out internal interaction according to a predetermined protocol (for example, SOAP, REST, etc.). Subsystems 6, 7, 8, 9 can be implemented as a single unit based on an industrial computer or distributed.

Autocomplete system 2 interacts with client 1 via HTTP / HTTPs protocols. Interaction with external application 3 is carried out by receiving and sending requests redirected through the subscriber’s web browser.

3. External application 3

External application 3 is an independent information system that includes an integrated interaction module 10. The only execution requirement is the ability to integrate the interaction module 10 with the autofill system 2. The interaction module 10 is embedded in the user interface.

Interaction module 10 implements the following functions:

- the formation and redirection of requests to the system 2 autofill through client 1;

- receiving requests from system 2 auto-complete redirected through client 1;

- decryption of data received from system 2 autofill.

FIG. 2 is a flowchart of a method for automatically filling in electronic forms with personal data of user 4. When user 4 wants to use the proposed automatic filling system, he, for example, clicks on the “auto-complete help” button presented in client 1 (in particular, in a web browser) - step S001. In the next step S002, client 1 generates a request for automatic completion and sends it to external application 3. External application 3 receives the request, for example, in the form: “You must use the autofill system” (HTTP POST method).

It should be noted that when generating a request for autofill, fixed identifiers of fields requiring filling are transmitted. For example, if you need to fill in the field “Buyer surname”, then not the field name is transferred to the external application, but the predefined identifier of this field.

At step S003, the request is processed, the response is formed with a redirect to the address of the autofill system 2. The answer may include: the address of the autocomplete system 2, the identifier of the external application 3, the form identifier or the identifiers of the fields requiring filling, and other parameters. Next, redirect the response to the address of the system 2 autocomplete (HTTP 302) through client 1.

In some embodiments, the user session 1 identifier issued to client 1 is added to the specified response as it passes through the client, when it first accessed the autocomplete system 2 to simplify the authentication procedure.

If user 4 is a subscriber of the operator and access to the external application 3 is through the cellular network of the operator, the specified response passes through the module 5 of the operator (see Fig. 1), while the specified module 5 of the operator adds the subscriber ID. Thus, the operator module 5 is optional and it allows you to authorize the user without additional interaction of the autofill system with the user.

In some embodiments, the implementation may include MSISDN as the subscriber identifier — the number of the mobile subscriber of the digital network with the integration of services for communication in GSM, UMTS, etc.

In some embodiments, the IMSI, the international identifier of the mobile subscriber (individual subscriber number) associated with each GSM, UMTS, or CDMA mobile user, may be the subscriber identifier.

In some embodiments, a GGSN / SGSN is used as an operator module.

In some embodiments, PGW is used as the operator module.

The next step is step S004, where the use of the autofill system 2 (HTTPs GET) begins. The autofill system 2 receives a redirected response and passes its parameters to the user authentication subsystem 6 and the external application authentication subsystem 7.

In step S005, the user authentication subsystem 6 and the external application authentication subsystem 7 obtain the initial data in order to verify the user rights and the external application, respectively. The external application authentication subsystem 7 searches for the profile of the external application 3, checks for the availability of the necessary rights to perform the automatic filling operation. If this external application 3 does not have rights to perform the operation (or user 4 does not have rights, which is indicated below), then system 2 generates a response message about the impossibility of automatic completion.

In some embodiments, user authentication is performed by the identifier of client 1 issued to client 1 during a previous call to the autocomplete system.

In some embodiments, user authentication is performed by the subscriber identifier added when the response passes through the operator module 5.

In some embodiments, user authentication is performed when an authentication script is executed, during which the user authentication subsystem 6 requests, through client 1, the user to enter additional authentication data.

In some embodiments, user authentication is performed by the subscriber identifier obtained from the operator at the user's network address.

The user authentication subsystem 6 searches for the user profile, checks for the availability of the necessary rights to perform the automatic filling operation. If the user profile does not have rights to perform the operation, the service generates a response message about the impossibility of automatic filling.

In the next step, S006 receives user data and returns the completed form. In case of successful authorization, a request is made to the user profile to obtain data for filling. The screen with the filled fields is returned to the client (in particular, the web browser) of the user.

In some cases, returns multiple choices for one parameter. Subsystem 8 of autofill scripts is responsible for the execution of scripts for automatic completion (for example, the formation of a response with the requested electronic forms with filled data).

Next, user 4, if necessary, is given the opportunity to adjust the data added by the autofill system - step S007. In some embodiments, user 4 is able to select one of the suggested values.

Upon completion of the adjustment, the user confirms the correctness of the specified data and confirms their sending to the external application - step S008 (for example, the "send to external application" button). Client 1 makes a request to the autofill system 2 and transmits the specified data (HTTPs POST) - step S009. Thus, the user himself decides to transfer data to an external application.

The next step S010 is to save the adjusted data. In particular, upon receipt of a request containing user-confirmed data 4, system 2 stores the corrected data. In particular, the data storage subsystem 9 of the autofill system 2 is configured to save data provided by the user.

Autofill system 2 generates a response to client 1 with redirection to the address of external application 3 (HTTPs 302) - SOU stage. In some embodiments, the autofill system 2 encrypts the transmitted data. The response may include the address of the external application 3 for forwarding the response, encrypted data, and possibly other parameters.

Upon receipt of the response, client 1 redirects the response to the address of external application 3 (HTTP GET) - step S012. External application 3 receives a response containing the data of the autocomplete system 2 for the original form.

In some cases, the external application further includes an integrated interaction module 5 that decrypts the received data — step S013.

Thus, the user quickly and safely fills out all the necessary forms with data that was previously provided to the mentioned system 2 autofill, without providing all the data stored on the system 2 to external application 3.

Additional advantages of using this method are:

- improving the security of storage and transmission of user data due to user authorization on the side of the autofill system 2, as well as by encrypting the transmitted user data;

- reducing the likelihood of erroneous user input;

- increasing the reliability of the information provided by automating the process of updating data in case of correction by the user.

A method for automatically filling out web forms with user data is implemented on the basis of a computer system. Briefly, the steps of this method illustrated in FIG. 2 can be described as follows:

- receive (external application 3) a request (from client 1 (web browser)) for automatic completion;

- produce (external application 3) the redirection of the response (system 2 autofill);

- receive (autocomplete system 2) a redirected response and verify the rights of the external application 3 and user 4;

- receive (system 2 auto) data for user 4 and return (to client 1 (web browser)) the requested completed form;

- provide (client 1 (web browser)) user 4 the ability to perform data adjustments;

- produce (system 2 autofill) the preservation of the adjusted values and form a response message;

- produce (external application 3) receiving data (from system 2 autofill).

In the embodiment, when the user 4 is a subscriber, and on the side of the autofill system 2, the primary authentication of the subscriber using the operator’s network for access is performed through the operator’s routing node, then the user authentication data is not required.

In an embodiment, when user 4 has previously adjusted the data offered by the autofill system 2, then, upon a subsequent request for data, user 4 will be presented with a choice from user profile data and previously entered data.

According to a further embodiment, in which, to prevent unauthorized access to the data returned by the autofill system 2, the transmitted data is encrypted.

According to another additional embodiment, to prevent unauthorized access to the data returned by the autofill system 2, the data is returned to the address specified in the profile of the external application 3 during registration, and not to the address from which the request was received.

Specialists in the art should understand that the shown arrangement of the components of the automatic filling system is exemplary and, as necessary, can be changed to achieve greater efficiency in a particular application. The scope of protection of the present invention is intended to cover all possible different locations of the above system components.

In one or more exemplary embodiments, the functions described herein may be implemented in hardware, software, firmware, or any combination thereof. Being implemented in software, said functions may be stored on or transmitted in the form of one or more instructions or code on a computer-readable storage medium. The storage medium may be any available medium that is accessed by a computer. By way of example, but not limitation, such computer-readable media can be RAM, ROM, EEPROM, CD-ROM or other optical disk drive, magnetic disk drive or other magnetic storage devices, or any other storage medium that can be used for transferring or storing the required program code in the form of instructions or data structures and which can be accessed using a computer. The term disc used in this document includes compact disc (CD), laser discs, optical discs, universal digital discs (DVDs), floppy discs and blu-ray discs. Combinations of the aforementioned storage media should also fall within the protection scope of the present invention.

Although exemplary embodiments of the invention are shown in the present description, it should be understood that various changes and modifications can be made without departing from the scope of protection of the present invention defined by the attached claims. The functions, steps, and / or actions referred to in the claims characterizing the method in accordance with the embodiments of the present invention described herein need not be performed in any particular order unless otherwise noted or specified. Moreover, the mention of elements of the system in the singular does not exclude the set of such elements, unless explicitly stated otherwise.

Claims (12)

1. A method for automatically filling out electronic forms on an external application with user personal data, comprising the steps of:
form and send, with the help of the client, a request to automatically fill out the fields of electronic forms to an external application;
process said request on an external application and send the processed request to the autocomplete system, and the processing includes the addition of the request with identifiers of specific fields that need to be filled;
authenticate the user and the external application in the autocomplete system,
in case of successful authentication, both the user and the external application return data to the user from the autocomplete system to fill in only specific fields of electronic forms according to the identifiers mentioned, in order to enable the user to transfer the said data to the external application to fill in only the requested fields of electronic forms, while the returned data is displayed directly in specific fields of electronic forms in accordance with field identifiers;
moreover, the autofill system is part of an independent external system, different from an external application to which the user has previously provided personal data. 2. The method according to claim 1, further comprising allowing the user to adjust the completed data. 3. The method of claim 2, wherein the adjusted data is stored in the autofill system. 4. The method according to claim 1, wherein the data to fill is encrypted for an external application in the autofill system. 5. The method of claim 4, wherein the encrypted data is decrypted for completion and transmitted to an external application. 6. The method according to claim 3, in which the requested electronic forms are returned to the user with a choice of data to fill out from the list of data stored in the autofill system. 7. The method according to claim 1, in which, if the user is a subscriber using the operator’s network for access, authentication is performed through the operator’s routing node using the subscriber’s network identifier. 8. A system for automatically filling out electronic forms on an external application with user personal data, comprising:
a client configured to form and send a request to automatically fill in the fields of electronic forms to an external application;
an external application configured to process said request and send the processed request to the autocomplete system, the processing including the addition of the request with identifiers of specific fields that need to be filled;
an autofill system configured to authenticate a user and an external application,
at the same time, the client interacts with the external application and the autocomplete system using the HTTP / HTTPs protocol;
moreover, in the case of successful authentication of both the user and the external application, the autofill system returns data to the user to fill in only specific fields of electronic forms according to the identifiers mentioned, to enable the user to transfer the said data to the external application to fill only the requested fields of electronic forms, while the returned data is displayed on the client directly in specific fields of electronic forms in accordance with the field identifiers;
moreover, the autofill system is part of an independent external system, different from an external application to which the user has previously provided personal data. 9. The system of claim 8, wherein the client is further configured to provide the user with the ability to adjust data to fill out electronic forms with data filled in said fields and send the corrected data to the autofill system. 10. The system of claim 9, wherein the autofill system is further configured to save adjusted data. 11. The system of claim 8, wherein the autofill system is further configured to encrypt data for an external application. 12. The system of claim 11, wherein the external application further includes an interaction module, wherein the interaction module is configured to decrypt the encrypted filled data for filling and transmit it to the external application.

Images