Using individualized APIs to block automated attacks on native apps and/or purposely exposed APIs with forced user interaction

Patent metadata

Field	Value
Publication number	US-10050935-B2
Application number	US-201514691540-A
Country	US
Kind code	B2
Filing date	Apr 20, 2015
Priority date	Jul 9, 2014
Publication date	Aug 14, 2018
Grant date	Aug 14, 2018

Abstract

An API call filtering system filters responses to API call requests received, via a network, from UEs. The API call filtering system is configured to require personalized API call requests wherein each API call (except for some minor exceptions) includes a unique UE identifier (“UEIN”) of the UE making the request. Using the UEIN, the web service or other service protected by the API call filtering system can be secured against excessive request iterations from a set of rogue UEs while allowing for ordinary volumes of requests of requests the UEs, wherein one or more boundaries between what is deemed to be an ordinary volume of requests and what is deemed to be excessive request iterations are determined by predetermined criteria.

First claim

What is claimed is:

1. A method comprising:
storing data regarding a plurality of unique end-point identifiers (UEINs) associated with a plurality of computing devices, wherein the plurality of UEINs includes a UEIN associated with a particular computing device;
receiving, from a computing device, a request comprising the UEIN and a challenge response;
based on the challenge response and the UEIN, verifying that the computing device is the particular computing device associated with the UEIN;
determining whether the UEIN is associated with a high volume of requests;
based on determining that the UEIN is associated with a high volume of requests, determining that the request is from an unauthorized user;
in response to determining that the request is from an unauthorized user, adding the UEIN to a plurality of unauthorized UEINs and blocking the request;
wherein requests received with a UEIN in the plurality of unauthorized UEINs are blocked;
wherein the method is performed by one or more computing devices.

2. The method of claim 1 ,
wherein the request is an application programming interface (API) call corresponding to an API service;
wherein one or more requests that are not blocked are forwarded to the API service.

3. The method of claim 1 , further comprising:
prior to receiving the request, receiving a set of data from the particular computing device indicating successful performance of a non-automatable step;
in response to the set of data indicating the successful performance of the non-automatable step, associating the UEIN with the particular computing device.

4. The method of claim 1 , wherein the UEIN is generated by the particular computing device.

5. The method of claim 1 , wherein determining whether the UEIN is associated with a high volume of requests includes applying a rule for distinguishing excessive request volumes from ordinary request volumes.

6. The method of claim 1 , wherein determining whether the UEIN is associated with a high volume of requests includes determining whether requests associated with the UEIN exceed a threshold.

7. The method of claim 1 , wherein the UEIN uniquely identifies a particular instance of an application running on the particular computing device.

8. The method of claim 7 , wherein the request comprises a modified API call, generated by the particular instance of the application, that uniquely identifies the particular instance of the application running on the particular computing device.

9. The method of claim 1 , further comprising:
receiving, from a second computing device, a second request, a second UEIN, and a second challenge response, wherein the second UEIN is associated with a second specific computing device prior to receiving the second request;
based on second challenge response, verifying that the second computing device is not the second specific computing device associated with the second UEIN;
blocking the second API call associated with the second UEIN.

10. A system for identifying and blocking unauthorized requests based on request volume comprising:
one or more hardware processors;
memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
store data regarding a plurality of unique end-point identifiers (UEINs) associated with a plurality of computing devices, wherein the plurality of UEINs includes a UEIN associated with a particular computing device;
receive, from a computing device, a request comprising the UEIN and a challenge response;
based on the challenge response, verify that the computing device is the particular computing device associated with the UEIN;
determine whether the UEIN is associated with a high volume of requests;
based on determining that the UEIN is associated with a high volume of requests, determine that the request is from an unauthorized user;
in response to determining that the request is from an unauthorized user, add the UEIN to a plurality of unauthorized UEINs and block the request;
wherein requests received with a UEIN in the plurality of unauthorized UEINs are blocked.

11. The system of claim 10 ,
wherein the request is an application programming interface (API) call corresponding to an API service;
wherein one or more requests that are not blocked are forwarded to the API service.

12. The system of claim 10 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more processors to:
prior to receiving the request, receive a set of data from the particular computing device indicating successful performance of a non-automatable step;
in response to the set of data indicating the successful performance of the non-automatable step, associating the UEIN with the particular computing device.

13. The system of claim 10 , wherein the UEIN is generated by the particular computing device.

14. The system of claim 10 , wherein determining whether the UEIN is associated with a high volume of requests includes applying a rule for distinguishing excessive request volumes from ordinary request volumes.

15. The system of claim 10 , wherein determining whether the UEIN is associated with a high volume of requests includes determining whether requests associated with the UEIN exceed a threshold.

16. The system of claim 10 , wherein the UEIN uniquely identifies a particular instance of an application running on the particular computing device.

17. The system of claim 16 , wherein the request comprises a modified API call, generated by the particular instance of the application, that uniquely identifies the particular instance of the application running on the particular computing device.

Assignees

• Shape Security Inc

Inventors

• Hansen Marc

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title