Request modification for web security challenge

Patent metadata

Field	Value
Publication number	US-2020145451-A1
Application number	US-201916730725-A
Country	US
Kind code	A1
Filing date	Dec 30, 2019
Priority date	Jul 6, 2015
Publication date	May 7, 2020
Grant date	—

Abstract

Techniques are provided for request modification for web security challenge. Data corresponding to a web page request by a client computing device for a web page is received. The web page comprises web code that allows a user to submit a request to initiate a web transaction with a web server system. Challenge code is generated that determines one or more values that are a valid solution to a challenge. The challenge code is provided for integrated code to be served in response to the web page request. The integrated code comprises the challenge code and modified web code that adds one or more parameters for the valid solution to the request. A particular request is received to initiate the web transaction. It is determined that the one or more parameter values are not a valid solution. In response, the web server system is prevented from processing the particular request.

First claim

What is claimed is:

1 . A computer system comprising:
one or more hardware processors; a memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to: receive data corresponding to a web page request by a client computing device for a web page comprising web code that, when executed, allows a user to submit a request to initiate a web transaction with a web server system; generate challenge code that, when executed, determines one or more values that are a valid solution to a challenge; provide the challenge code for integrated code to be served in response to the web page request, the integrated code comprising the challenge code and modified web code that adds one or more parameters for the valid solution to the request; receive a particular request from the client computing device to initiate the web transaction, the particular request including a submitted solution comprising one or more parameter values; determine that the one or more parameter values are not a valid solution; and in response to determining that the one or more parameter values are not a valid solution, prevent the web server system from processing the particular request.

2 . The computer system of claim 1 , wherein preventing the web server system from processing the particular request comprises not forwarding the particular request to the web server system.

3 . The computer system of claim 1 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more hardware processors to:
receive second data corresponding to a second web page request by a second client computing device for the web page; generate second challenge code that, when executed, determines one or more values that are a valid solution to a second challenge that is different than the first challenge; provide the second challenge code for second integrated code to be served in response to the second web page request.

4 . The computer system of claim 1 , wherein the challenge code comprises at least one script that is written in JavaScript that is interpreted and executed at the client computing device.

5 . The computer system of claim 1 , wherein, when the integrated code executes at the client computing device, the client computing device determines a solution to the challenge in the background while the user interacts with the web page after the web page is loaded at the client computing device.

6 . The computer system of claim 1 , wherein determining whether the possible solution is a valid solution to the challenge comprises verifying that the submitted solution was generated by the client computing device within a particular period of time after the integrated code was provided to the client computing device.

7 . The computer system of claim 1 , wherein the computer system comprises a proxy computing system that is arranged as a proxy to the web server system.

8 . The computer system of claim 1 , wherein execution of the challenge code at the client computing device does not begin until the user selects a control in the web page that triggers the challenge code to be run.

9 . The computer system of claim 1 , wherein providing the challenge code for integrated code comprises hosting the challenge code and providing a reference to the challenge code for the integrated code.

10 . The computer system of claim 1 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more hardware processors to:
receive second data corresponding to a second web page request by a second client computing device for the web page; generate second challenge code that, when executed, determines one or more values that are a valid solution to a second challenge; provide the second challenge code for second integrated code to be served in response to the second web page request; receive a second request from the client computing device to initiate the web transaction, the second request including a second submitted solution comprising one or more second parameter values; determine that the one or more second parameter values are a valid solution to the challenge; and in response to determining that the one or more parameter values are a valid solution to the challenge, cause the web server system to process the particular request.

11 . A method comprising:
receiving data corresponding to a web page request by a client computing device for a web page comprising web code that, when executed, allows a user to submit a request to initiate a web transaction with a web server system; generating challenge code that, when executed, determines one or more values that are a valid solution to a challenge; providing the challenge code for integrated code to be served in response to the web page request, the integrated code comprising the challenge code and modified web code that adds one or more parameters for the valid solution to the request; receiving a particular request from the client computing device to initiate the web transaction, the particular request including a submitted solution comprising one or more parameter values; determining that the one or more parameter values are not a valid solution; and in response to determining that the one or more parameter values are not a valid solution, preventing the web server system from processing the particular request; wherein the method is performed by one or more computing devices.

12 . The method of claim 11 , wherein preventing the web server system from processing the particular request comprises not forwarding the particular request to the web server system.

13 . The method of claim 11 , further comprising:
receiving second data corresponding to a second web page request by a second client computing device for the web page; generating second challenge code that, when executed, determines one or more values that are a valid solution to a second challenge that is different than the first challenge; providing the second challenge code for second integrated code to be served in response to the second web page request.

14 . The method of claim 11 , wherein the challenge code comprises at least one script that is written in JavaScript that is interpreted and executed at the client computing device.

15 . The method of claim 11 , wherein, when the integrated code executes at the client computing device, the client computing device determines a solution to the challenge in the background while the user interacts with the web page after the web page is loaded at the client computing device.

16 . The method of claim 11 , wherein determining whether the possible solution is a valid solution to the challenge comprises verifying that the submitted solution was generated by the client computing device within a particular period of time after the integrated code was provided to the client computing device.

17 . The method of claim 11 , wherein receiving the particular request, determining that the one or more parameter values are not a valid solution to the challenge, and preventing the web server system from processing the particular request are performed by a proxy computing system that is arranged as a proxy to the web server system.

18 . The method of claim 11 , wherein execution of the challenge code at the client computing device does not begin until the user selects a control in the web page that triggers

Assignees

• Shape Security Inc

Inventors

• Hansen Marc R

Classifications

• G06F21/31

  User authentication · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06Q20/382 Primary

  insuring higher security of transaction · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title