Using individualized APIs to block automated attacks on native apps and/or purposely exposed APIs with forced user interaction

Patent metadata

Field	Value
Publication number	US-11032243-B2
Application number	US-201916553085-A
Country	US
Kind code	B2
Filing date	Aug 27, 2019
Priority date	Jul 9, 2014
Publication date	Jun 8, 2021
Grant date	Jun 8, 2021

Abstract

An API call filtering system filters responses to API call requests received, via a network, from UEs. The API call filtering system is configured to require personalized API call requests wherein each API call (except for some minor exceptions) includes a unique UE identifier (“UEIN”) of the UE making the request. Using the UEIN, the web service or other service protected by the API call filtering system can be secured against excessive request iterations from a set of rogue UEs while allowing for ordinary volumes of requests of requests the UEs, wherein one or more boundaries between what is deemed to be an ordinary volume of requests and what is deemed to be excessive request iterations are determined by predetermined criteria.

First claim

What is claimed is:

1. A network security method implemented by a network security system comprising one or more application programming interface (API) call filtering devices, application server devices, or user equipment (UE) devices, the method comprising:
receiving an API call from a client, wherein the API call is to an API function of an API associated with a service provided by a server and comprises a UE identifier (UEIN);
comparing the UEIN against a stored plurality of UEINs issued to authorized clients to verify that the requesting client is authorized to access the service;
sending to the client a challenge in response to the API call after verifying that the client is authorized to access the service, wherein the challenge is an encryption challenge that requires the client to perform an encryption operation based on the UEIN;
determining when a response message received from the client in response to the challenge is valid;
modifying the API call to conform to an expected format of the API function at least by omitting the UEIN, and issuing the modified API call to the API function, in response to validating the response message;
determining when a number of API calls comprising the UEIN exceed a threshold request volume; and
initiating a security mitigation action, when the determination indicates the number of API calls exceeds the threshold request volume.

2. The network security method of claim 1 , further comprising generating the stored UEINs in response to requests received from applications installed locally at the authorized clients.

3. The network security method of claim 1 , further comprising blocking or dropping the API call, when the comparison indicates the client is unauthorized.

4. An application programming interface (API) call filtering device, comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
receive an API call from a client, wherein the API call is to an API function of an API associated with a service provided by a server and comprises a UE identifier (UEIN);
compare the UEIN against a stored plurality of UEINs issued to authorized clients to verify that the requesting client is authorized to access the service; and
send to the client a challenge in response to the API call after verifying that the client is authorized to access the service, wherein the challenge is an encryption challenge that requires the client to perform an encryption operation based on the UEIN;
determine when a response message received from the client in response to the challenge is valid;
modify the API call to conform to an expected format of the API function at least by omitting the UEIN, and issue the modified API call to the API function, in response to validating the response message;
determine when a number of API calls comprising the UEIN exceed a threshold request volume; and
initiate a security mitigation action, when the determination indicates the number of API calls exceeds the threshold request volume.

5. The API call filtering device of claim 4 , wherein the processors are further configured to be capable of executing the stored programmed instructions to generate the stored UEINs in response to requests received from applications installed locally at the authorized clients.

6. The API call filtering device of claim 4 , wherein the processors are further configured to be capable of executing the stored programmed instructions to block or drop the API call, when the comparison indicates the client is unauthorized.

7. A non-transitory storage media comprising programmed instructions comprising executable code that, when executed by one or more processors, cause the processors to:
receive an API call from a client, wherein the API call is to an API function of an API associated with a service provided by a server and comprises a UE identifier (UEIN);
compare the UEIN against a stored plurality of UEINs issued to authorized clients to verify that the requesting client is authorized to access the service; and
send to the client a challenge in response to the API call after verifying that the client is authorized to access the service, wherein the challenge is an encryption challenge that requires the client to perform an encryption operation based on the UEIN;
determine when a response message received from the client in response to the challenge is valid;
modify the API call to conform to an expected format of the API function at least by omitting the UEIN, and issue the modified API call to the API function, in response to validating the response message;
determine when a number of API calls comprising the UEIN exceed a threshold request volume; and
initiate a security mitigation action, when the determination indicates the number of API calls exceeds the threshold request volume.

8. The non-transitory storage media of claim 7 , wherein the executable code, when executed by the processors, further causes the processors to generate the stored UEINs in response to requests received from applications installed locally at the authorized clients.

9. The non-transitory storage media of claim 7 , wherein the executable code, when executed by the processors, further causes the processors to block or drop the API call, when the comparison indicates the client is unauthorized.

10. A network security system, comprising one or more application programming interface (API) call filtering devices, application server devices, or user equipment devices with memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
receive an API call from a client, wherein the API call is to an API function of an API associated with a service provided by a server and comprises a UE identifier (UEIN);
compare the UEIN against a stored plurality of UEINs issued to authorized clients to verify that the requesting client is authorized to access the service; and
send to the client a challenge in response to the API call after verifying that the client is authorized to access the service, wherein the challenge is an encryption challenge that requires the client to perform an encryption operation based on the UEIN;
determine when a response message received from the client in response to the challenge is valid;
modify the API call to conform to an expected format of the API function at least by omitting the UEIN, and issue the modified API call to the API function, in response to validating the response message;
determine when a number of API calls comprising the UEIN exceed a threshold request volume; and
initiate a security mitigation action, when the determination indicates the number of API calls exceeds the threshold request volume.

11. The network security system of claim 10 , wherein the processors are further configured to be capable of executing the stored programmed instructions to generate the stored UEINs in response to requests received from applications installed locally at the authorized clients.

12. The network security system of claim 10 , wherein the processors are further configured to be capable of executing the stored programmed instructions to block or drop the API call, when the comparison indicates the client is unauthorized.

Assignees

• Shape Security Inc

Inventors

• Hansen Marc

Classifications

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04L63/0227 Primary

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04W12/126

  Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning · CPC title

• H04W12/122

  Counter-measures against attacks; Protection against rogue devices · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title