# US 10,122,830 B2 · Validation associated with a form

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,830 B2
- Document ID: US10122830B2
- Status: Granted
- Kind: B2
- Application number: 15/233,672
- Filed: 2016-08-10
- Published: 2017-02-02
- Granted: 2018-11-06
- Earliest claimed: 2012-03-08
- Assignees: Alibaba Group Holding Limited
- Applicants: Alibaba Group Holding Limited
- Inventors: Jincheng Lin; Hexiang Yang
- Web page: https://patentgrep.com/patent/US10122830B2

## CPC

- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 40/174: Form filling; Merging
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Form validation is disclosed, including: generating a first parameter and a second parameter in response to a request for a form from a client device; sending a first triggering message including the first parameter and the second parameter to the client device; receiving data associated with submission of the form; and determining whether the data associated with the submission of the form includes the hidden form field that matches the first parameter and a submitted value corresponding to the hidden form field that corresponds to the second parameter, in the event that the hidden form field matches the first parameter and the submitted value corresponding to the hidden form field corresponds to the second parameter, determine that the data associated with the submission of the form is successfully validated.

## Claims

### Claim 1

A system for form validation, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
generate a first parameter and a second parameter in response to a request for a form from a client device, wherein at least one of the first parameter and the second parameter is randomly generated;
generate a defined variable, wherein the defined variable is configured to be assigned as a temporary value corresponding to a hidden form field to be generated at the client device;
send a first triggering message including the defined variable, the first parameter, and the second parameter to the client device, wherein the first triggering message is configured to:
cause the hidden form field to be generated at the client device based at least in part on the first parameter and to be added to the form;
cause the defined variable to be assigned as a temporary value corresponding to the generated hidden form field on the client device; and
cause replacement of the temporary value corresponding to the hidden form field with a validation string in response to detection by the client device of a value assignment event related to a human interaction with the client device, wherein the validation string is determined based on the second parameter;
send an additional hidden field triggering message to the client device, wherein the additional hidden field triggering message is configured to cause an additional hidden form field to be generated and added to the form, wherein the additional hidden form field is not used for validation of the form;
receive data associated with submission of the form, the form including the additional hidden form field and a randomly generated value assigned to the additional hidden form field to enhance security;
determine whether the data associated with the submission of the form includes the hidden form field that matches the first parameter and a submitted value corresponding to the hidden form field that corresponds to the second parameter; and
in response to a determination that the hidden form field matches the first parameter and the submitted value corresponding to the hidden form field corresponds to the second parameter, determine that the data associated with the submission of the form is successfully validated.

### Claim 2 (depends on 1)

The system of claim 1, wherein the processor is further configured to:
generate a third parameter; and
send a second triggering message including the third parameter to the client device, wherein the second triggering message is configured to cause the third parameter to be used as a function name associated with a hidden form field generation function at the client device.

### Claim 3 (depends on 1)

The system of claim 1, wherein the value assignment event comprises one or more of the following: a mouse movement, a keyboard operation, and a touch screen operation.

### Claim 4 (depends on 1)

The system of claim 1, wherein determining whether the data associated with the submission of the form includes the hidden form field that matches the first parameter comprises determining whether a name of the hidden form field matches the first parameter.

### Claim 5 (depends on 1)

The system of claim 1, wherein the processor is further configured to:
store the validation string with a session;
store the validation string with an expiration period; and
in response to a determination that the form to which the hidden form field is added is submitted after the expiration period, determine that the data associated with the submission of the form is not successfully validated.

### Claim 6

A method for form validation, comprising:
generating, using one or more processors, a first parameter and a second parameter in response to a request for a form from a client device, wherein at least one of the first parameter and the second parameter is randomly generated;
generating a defined variable, wherein the defined variable is configured to be assigned as a temporary value corresponding to a hidden form field to be generated at the client device;
sending a first triggering message including the defined variable, the first parameter, and the second parameter to the client device, wherein the first triggering message is configured to:
cause the hidden form field to be generated at the client device based at least in part on the first parameter and to be added to the form;
cause the defined variable to be assigned as a temporary value corresponding to the generated hidden form field on the client device; and
cause replacement of the temporary value corresponding to the hidden form field with a validation string in response to detection by the client device of a value assignment event related to a human interaction with the client device, wherein the validation string is determined based on the second parameter;
sending an additional hidden field triggering message to the client device, wherein the additional hidden field triggering message is configured to cause an additional hidden form field to be generated and added to the form, wherein the additional hidden form field is not used for validation of the form;
receiving data associated with submission of the form, the form including the additional hidden form field and a randomly generated value assigned to the additional hidden form field to enhance security;
determining whether the data associated with the submission of the form includes the hidden form field that matches the first parameter and a submitted value corresponding to the hidden form field that corresponds to the second parameter; and
in response to a determination that the hidden form field matches the first parameter and the submitted value corresponding to the hidden form field corresponds to the second parameter, determine that the data associated with the submission of the form is successfully validated.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
generating a third parameter; and
sending a second triggering message including the third parameter to the client device, wherein the second triggering message is configured to cause the third parameter to be used as a function name associated with a hidden form field generation function at the client device.

### Claim 8 (depends on 6)

The method of claim 6, wherein the value assignment event comprises one or more of the following: a mouse movement, a keyboard operation, and a touch screen operation.

### Claim 9 (depends on 6)

The method of claim 6, further comprising:
storing the validation string with a session;
storing the validation string with an expiration period; and
in response to a determination that the form to which the hidden form field is added is submitted after the expiration period, determining that the data associated with the submission of the form is not successfully validated.

### Claim 10

A computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
generating a first parameter and a second parameter in response to a request for a form from a client device, wherein at least one of the first parameter and the second parameter is randomly generated;
generating a defined variable, wherein the defined variable is configured to be assigned as a temporary value corresponding to a hidden form field to be generated at the client device;
sending a first triggering message including the defined variable, the first parameter, and the second parameter to the client device, wherein the first triggering message is configured to:
cause the hidden form field to be generated at the client device based at least in part on the first parameter and to be added to the form;
cause the defined variable to be assigned as a temporary value corresponding to the generated hidden form field on the client device; and
cause replacement of the temporary value corresponding to the hidden form field with a validation string in response to detection by the client device of a value assignment event related to a human interaction with the client device, wherein the validation string is determined based on the second parameter;
sending an additional hidden field triggering message to the client device, wherein the additional hidden field triggering message is configured to cause an additional hidden form field to be generated and added to the form, wherein the additional hidden form field is not used for validation of the form;
receiving data associated with submission of the form, the form including the additional hidden form field and a randomly generated value assigned to the additional hidden form field to enhance security;
determining whether the data associated with the submission of the form includes the hidden form field that matches the first parameter and a submitted value corresponding to the hidden form field that corresponds to the second parameter; and
in response to a determination that the hidden form field matches the first parameter and the submitted value corresponding to the hidden form field corresponds to the second parameter, determining that the data associated with the submission of the form is successfully validated.

### Claim 11 (depends on 10)

The computer program product of claim 10, further comprising computer instructions for:
generating a third parameter; and
sending a second triggering message including the third parameter to the client device, wherein the second triggering message is configured to cause the third parameter to be used as a function name associated with a hidden form field generation function at the client device.

### Claim 12 (depends on 10)

The computer program product of claim 10, wherein the value assignment event comprises one or more of the following: a mouse movement, a keyboard operation, and a touch screen operation.

### Claim 13 (depends on 10)

The computer program product of claim 10, further comprising computer instructions for:
storing the validation string with a session;
storing the validation string with an expiration period; and
in response to a determination that the form to which the hidden form field is added is submitted after the expiration period, determining that the data associated with the submission of the form is not successfully validated.