Request modification for web security challenge

Patent metadata

Field	Value
Publication number	US-11258820-B2
Application number	US-201916730725-A
Country	US
Kind code	B2
Filing date	Dec 30, 2019
Priority date	Jul 6, 2015
Publication date	Feb 22, 2022
Grant date	Feb 22, 2022

Abstract

Techniques are provided for request modification for web security challenge. Data corresponding to a web page request by a client computing device for a web page is received. The web page comprises web code that allows a user to submit a request to initiate a web transaction with a web server system. Challenge code is generated that determines one or more values that are a valid solution to a challenge. The challenge code is provided for integrated code to be served in response to the web page request. The integrated code comprises the challenge code and modified web code that adds one or more parameters for the valid solution to the request. A particular request is received to initiate the web transaction. It is determined that the one or more parameter values are not a valid solution. In response, the web server system is prevented from processing the particular request.

First claim

What is claimed is:

1. A computer system comprising:
a hardware processor;
a memory coupled to the hardware processor and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
process a web page request from a client for a web page comprising web code that, when executed, allows submission of a request to initiate a web transaction with a web server system;
generate challenge code that, when executed, determines one or more challenge values that are a valid solution to a challenge;
provide modified web code from a polymorphic recoding of a least one function name of the web code with the challenge code to be served in response to the web page request;
receive a particular request from the client to initiate the web transaction, the particular request including a submitted solution comprising one or more solution values;
determine when the one or more solution values are not the valid solution; and
in response to the determination that the one or more solution values are not the valid solution, prevent the web server system from processing the particular request.

2. The computer system of claim 1 , wherein the prevent the web server system from processing the particular request further comprises not forwarding the particular request to the web server system.

3. The computer system of claim 1 , wherein the challenge code comprises at least one script that is written in JavaScript that is configured to be interpreted and executed at the client.

4. The computer system of claim 1 , wherein, when the modified code executes at the client, the client determines the submitted solution to the challenge after the web page is loaded at the client.

5. The computer system of claim 1 , wherein the determine when the one or more solution values are not the valid solution to the challenge comprises verifying that the solution values were generated by the client within a particular period of time after the modified code was provided to the client.

6. The computer system of claim 1 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more hardware processors to:
receive a second web page request by a second client computing device for the web page;
generate second challenge code that, when executed, determines one or more second challenge values that are a valid solution to a second challenge;
provide second modified web code from another polymorphic recoding of the web code with the second challenge code to be served in response to the second web page request;
receive a second request from the client to initiate the web transaction, the second request including a second submitted solution comprising one or more second solution values;
determine when the one or more second solution values are the valid solution to the second challenge; and
in response to determining that the one or more solution values are the valid solution to the second challenge, cause the web server system to process the second request.

7. The computer system of claim 1 , wherein the polymorphic recoding is further of an attribute value of the web code.

8. A method implemented by a network security system comprising one or more content network delivery devices, security intermediary devices, origin web servers, or client devices, the method comprising:
processing a web page request from a client for a web page comprising web code that, when executed, allows submission of a request to initiate a web transaction with a web server system;
generating challenge code that, when executed, determines one or more challenge values that are a valid solution to a challenge;
providing modified web code from a polymorphic recoding of at least one function name of the web code with the challenge code to be served in response to the web page request;
receiving a particular request from the client to initiate the web transaction, the particular request including a submitted solution comprising one or more solution values;
determining when the one or more solution values are not the valid solution; and
in response to determining that the one or more solution values are not the valid solution, preventing the web server system from processing the particular request.

9. The method of claim 8 , wherein the preventing the web server system from processing the particular request further comprises not forwarding the particular request to the web server system.

10. The method of claim 8 , wherein the challenge code comprises at least one script that is written in JavaScript that is configured to be interpreted and executed at the client.

11. The method of claim 8 , wherein, when the modified code executes at the client, the client determines the submitted solution to the challenge after the web page is loaded at the client.

12. The method of claim 8 , wherein the determining when the one or more solution values are not the valid solution to the challenge comprises verifying that the solution values were generated by the client within a particular period of time after the modified web code was provided to the client.

13. The method of claim 8 , further comprising:
receiving a second web page request by a second client computing device for the web page;
generating second challenge code that, when executed, determines one or more second challenge values that are a valid solution to a second challenge;
providing second modified code from another polymorphic recoding of the web code with the second challenge code to be served in response to the second web page request;
receiving a second request from the client computing device to initiate the web transaction, the second request including a second submitted solution comprising one or more second solution values;
determining when the one or more second solution values are the valid solution to the second challenge; and
in response to determining that the one or more solution values are the valid solution to the second challenge, causing the web server system to process the second request.

14. The method of claim 8 , wherein the polymorphic recoding is further of an attribute value of the web code.

15. A non-transitory computer readable medium having stored thereon instructions comprising executable code that, when executed by a processor, causes the processor to:
process a web page request from a client for a web page comprising web code that, when executed, allows submission of a request to initiate a web transaction with a web server system;
generate challenge code that, when executed, determines one or more challenge values that are a valid solution to a challenge;
provide modified web code from a polymorphic recoding of at least one function name value of the web code with the challenge code to be served in response to the web page request;
receive a particular request from the client to initiate the web transaction, the particular request including a submitted solution comprising one or more solution values;
determine when the one or more solution values are not the valid solution;
and in response to the determination that the one or more solution values are not the valid solution, prevent the web server system from processing the particular request.

16. The non-transitory computer readable medium of claim 15 , wherein for the prevent the web server system from processing the particular request, the executable code, when executed by the processors further causes the processors to:
prevent forwarding of the particular request to the web server

Assignees

• Shape Security Inc

Inventors

• Hansen Marc R

Classifications

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F21/31

  User authentication · CPC title