Systems and methods for distributed, stateless, and dynamic browser challenge generation and verification

Patent metadata

Field	Value
Publication number	US-11558206-B2
Application number	US-202117152496-A
Country	US
Kind code	B2
Filing date	Jan 19, 2021
Priority date	Jan 19, 2021
Publication date	Jan 17, 2023
Grant date	Jan 17, 2023

Abstract

Provided is an unobtrusive client verification system with one verification devices having processors that are configured to receive a first request from an unverified client device, generate a random number in response to receiving the first request from the unverified client device, define a set of expressions as a browser challenge problem that evaluates to an answer specified by the random number, encrypt the answer within an answer token, provide the browser challenge problem with the answer token to the unverified client device, receive a second request with a solution to the browser challenge problem and the answer token from the unverified client device, and verify the unverified client device in response to the solution matching the answer that is decrypted from the answer token provided with the second request.

First claim

What is claimed is:

1. A method for dynamic browser challenge generation and verification comprising:
receiving a first request from an unverified client device;
generating a random number in response to receiving the first request from the unverified client device;
defining a browser challenge problem with browser executable instructions comprising a set of expressions, wherein the set of expressions comprises two or more expressions, wherein each expression of the set of expressions evaluates to a value that is less than the random number, wherein a total value derived by combining the values evaluated by the set of expressions equals the random number, and wherein the random number is an answer to the browser challenge problem;
encrypting the answer within an answer token;
providing the browser challenge problem with the answer token to the unverified client device;
receiving a second request with a solution to the browser challenge problem and the answer token from the unverified client device; and
verifying the unverified client device in response to the solution matching the answer that is decrypted from the answer token provided with the second request.

2. The method of claim 1 further comprising:
identifying a unique identifier of the unverified client device from one or more header parameters of the first request;
encrypting the unique identifier of the unverified client device within the answer token; and
wherein providing the browser challenge problem with the answer token comprises sending the answer and the unique identifier to the unverified client device in an encrypted format.

3. The method of claim 2 further comprising:
invalidating the second request in response to a unique identifier identified from one or more header parameters of the second request differing from the unique identifier that is decrypted from the answer token provided with the second request.

4. The method of claim 2 further comprising: verifying that the second request originates from a same device that issued the first request based on the unique identifier within header parameters of the second request matching the unique identifier of the unverified client device that is decrypted from the answer token provided with the second request.

5. The method of claim 1 further comprising:
entering a timestamp in the answer token;
extracting the timestamp from the answer token provided with the second request; and
invalidating the second request in response to the timestamp extracted from the answer token provided with the second request having expired.

6. The method of claim 1 , wherein providing the browser challenge problem comprises:
embedding the set of expressions in HyperText Markup Language (“HTML”) code; and
transmitting a response with the HTML code to the unverified client device.

7. The method of claim 1 further comprising:
distributing content requested within the second request in response to verifying the unverified client device.

8. The method of claim 7 further comprising:
blocking the unverified client device from accessing content that is requested with the second request in response to the solution not matching the answer that is decrypted from the answer token provided with the second request.

9. The method of claim 1 ,
wherein providing the browser challenge problem comprises distributing the browser challenge problem with the answer token from a first verification device that receives the first request;
wherein receiving the second request comprises receiving the second request with the solution and the answer token at a second verification device that is different than the first verification device generating and providing the browser challenge problem to the unverified client device; and
wherein verifying the unverified client device comprises verifying the unverified client device at the second verification device based on the solution received with the second request matching the answer that the second verification device decrypts from the answer token.

10. The method of claim 1 further comprising:
providing a verified token to the unverified client device in response to said verifying, wherein the verified token comprises an indication that the unverified client device has been successfully verified by one node of a distributed platform and that the unverified client device may subsequently access data from other nodes of the distributed platform without additional verification.

11. The method of claim 10 further comprising:
receiving a third request with the verified token; and
distributing content that is requested in the third request without verification based on inclusion of the verified token with the third request.

12. The method of claim 1 , wherein providing the browser challenge problem comprises:
issuing a redirect message with the browser challenge problem and the answer token to the unverified client device, the redirect message causing the unverified client device to reissue the first request as the second request with the solution and the answer token.

13. The method of claim 1 , wherein a Uniform Resource Locator (“URL”) of the first request matches a URL of the second request.

14. The method of claim 1 further comprising:
determining that a rate of requests from the unverified client device exceeds a threshold after said verifying; and
performing a secondary verification of the unverified client device in response to determining that the rate of requests exceeds the threshold.

15. The method of claim 14 , wherein performing the secondary verification comprises performing an obtrusive verification of the unverified client device that requires human interaction.

16. The method of claim 1 , wherein the browser executable instructions further comprise one or more instructions that cause the unverified client device to set a first cookie based on encrypted contents of the answer token, and to set a second cookie with the solution.

17. The method of claim 16 , wherein verifying the unverified client device comprises:
determining that the second request is issued with the first cookie and the second cookie; and
invalidating the second request in response to the second request omitting one or more of the first cookie or the second cookie.

18. The method of claim 1 , wherein at least one expression of the set of expressions comprises browser executable code that evaluates to a value of zero.

19. A verification system for dynamic browser challenge generation and verification comprising:
a non-transitory computer-readable medium storing a set of processor-executable instructions; and
one or more hardware processors configured to execute the set of processor-executable instructions, wherein executing the set of processor-executable instructions causes the one or more processors to:
receive a first request from an unverified client device;
generate a random number in response to receiving the first request from the unverified client device;
define a browser challenge problem with browser executable instructions comprising a set of expressions, wherein the set of expressions comprises two or more expressions, wherein each expression of the set of expressions evaluates to a value that is less than the random number, wherein a total value derived by combining the values evaluated by the set of expressions equals the random number, and wherein the random number is an answer to the browser challenge problem;
encrypt the answer within an answer token;
provide the brows

Assignees

• Edgio Inc
• Verizon Digital Media Services Inc

Inventors

• Bedi Harkeerat Singh
• Sabanayagam Revathi
• Singh Devender
• Morrison Reed

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/3271 Primary

  using challenge-response · CPC title