# US 10,771,392 B1 · Increasing efficiency to rate limiting

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,392 B1
- Document ID: US10771392B1
- Status: Granted
- Kind: B1
- Application number: 16/439,013
- Filed: 2019-06-12
- Granted: 2020-09-08
- Earliest claimed: 2019-06-12
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Leo Michael Farrell; Scott Matthew Andrews; Philip Alan John Nye
- Web page: https://patentgrep.com/patent/US10771392B1

## CPC

- H04L 41/5003: Managing SLA; Interaction between SLA and QoS
- H04L 47/215: using token-bucket
- H04L 41/0266: using meta-data, objects or commands for formatting management information, e.g. using eXtensible markup language [XML]
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066)
- H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented system and method include a rate-limiting server. The server receives a request from a client and uses an early stage process to search for a rate-limiting token bucket (TB) using metadata associated with the request. Responsive to finding the TB using the first metadata, a response operation is performed. Responsive to not finding the TB using the first metadata, a late stage process is used to search for the rate-limiting TB using server-side session data associated with the request. Responsive to not finding the TB using the session data, the TB is created and associated with at least two search indexes comprising the first metadata associated with the request and the session data. Finally, the response operation is performed that comprises transmitting a determined response to the client.

## Claims

### Claim 1

A computer-implemented method, comprising, using a processor of a server:
receiving a request from a client via a network interface of the server;
utilizing an early stage process to search for a rate-limiting token bucket (TB) using first metadata associated with the request;
responsive to finding the TB using the first metadata, performing a response operation;
responsive to not finding the TB using the first metadata, utilizing a late stage process to search for the rate-limiting TB using server-side session data associated with the request;
responsive to not finding the TB using the session data:
creating the TB and associating with it at least two search indexes comprising the first metadata associated with the request and the session data; and
performing the response operation;
wherein the response operation comprises transmitting, via the network interface, a determined response to the client.

### Claim 2 (depends on 1)

The method of claim 1, wherein the response operation further comprises:
modifying a count of the TB;
determining whether a token count criteria has been met;
responsive to the token count criteria being met, setting the determined response to be a rate-limiting response; and
responsive to the token count criteria not being met, setting the determined response to be a normal response.

### Claim 3 (depends on 2)

The method of claim 2, wherein the client is a web client, the server is a web server, the request is a hypertext transfer protocol (HTTP) request, and the response is an HTTP response; the method further comprising:
receiving a second request from the web client via the network interface;
utilizing the early stage process to search for the TB using second metadata associated with the request that differs from the first metadata;
responsive to finding the TB using the second metadata, performing the response operation;
responsive to not finding the TB using the second metadata, utilizing the late stage process to search for the rate-limiting TB using the web server-side session data associated with the second request;
responsive to finding the TB using the session data:
updating a search index of the TB to include the second metadata associated with the second request; and
performing the response operation.

### Claim 4 (depends on 3)

The method of claim 3, wherein the first metadata and the second metadata are selected from the group consisting of a URL of the request, an HTTP method of the request, a header value of the request, a cookie, and over a wire information selected from the group consisting of an IP address and a MAC address.

### Claim 5 (depends on 3)

The method of claim 3, wherein at least one of the first metadata and the second metadata is a cookie.

### Claim 6 (depends on 3)

The method of claim 3, wherein the session data is selected from the group consisting of a username and contact information.

### Claim 7 (depends on 6)

The method of claim 6, wherein the session data is a username.

### Claim 8 (depends on 3)

The method of claim 3, wherein the second metadata replaces the first metadata in the TB.

### Claim 9 (depends on 2)

The method of claim 2, wherein:
the modifying of the count is incrementing the count; and
the token count criteria is that the TB is full.

### Claim 10 (depends on 2)

The method of claim 2, wherein:
the modifying of the count is decrementing the count; and
the token count criteria is that the TB is empty.

### Claim 11 (depends on 1)

The method of claim 1, wherein the session data is available only to the server.

### Claim 12 (depends on 1)

The method of claim 1, wherein the first metadata is obtainable solely from the contents of the request or a communication channel associated with the request.

### Claim 13

A server computer system providing rate limiting, the system comprising:
a processor configured to:
receive a request from a client via a network interface of the server;
utilize an early stage process to search for a rate-limiting token bucket (TB) using first metadata associated with the request;
responsive to finding the TB using the first metadata, perform a response operation;
responsive to not finding the TB using the first metadata, utilize a late stage process to search for the rate-limiting TB using server-side session data associated with the request;
responsive to not finding the TB using the session data:
create the TB and associate with it at least two search indexes comprising the first metadata associated with the request and the session data; and
perform the response operation;
wherein the response operation comprises the processor being configured to transmit, via the network interface, a determined response to the client.

### Claim 14 (depends on 13)

The system of claim 13, wherein the processor is further configured to:
modify a count of the TB;
determine whether a token count criteria has been met;
responsive to the token count criteria being met, set the determined response to be a rate-limiting response; and
responsive to the token count criteria not being met, set the determined response to be a normal response.

### Claim 15 (depends on 14)

The system of claim 14, wherein the client is a web client, the server is a web server, the request is a hypertext transfer protocol (HTTP) request, and the response is an HTTP response, and the processor is further configured to:
receive a second request from the web client via the network interface;
utilize the early stage process to search for the TB using second metadata associated with the request that differs from the first metadata;
responsive to finding the TB using the second metadata, perform the response operation;
responsive to not finding the TB using the second metadata, utilize the late stage process to search for the rate-limiting TB using the web server-side session data associated with the second request;
responsive to finding the TB using the session data:
update a search index of the TB to include the second metadata associated with the second request; and
perform the response operation.

### Claim 16 (depends on 15)

The system of claim 15, wherein the first metadata and the second metadata are cookies and the session data is a username.

### Claim 17 (depends on 13)

The system of claim 13, wherein the second metadata replaces the first metadata in the TB.

### Claim 18 (depends on 13)

The system of claim 13, wherein the session data is available only to the server.

### Claim 19 (depends on 13)

The system of claim 13, wherein the metadata is obtainable solely from the contents of the request or a communication channel associated with the request.

### Claim 20

A computer program product comprising a computer readable storage medium having computer-readable program code embodied therewith to, when executed on a processor:
receive a request from a client via a network interface of the server;
utilize an early stage process to search for a rate-limiting token bucket (TB) using first metadata associated with the request;
responsive to finding the TB using the first metadata, perform a response operation;
responsive to not finding the TB using the first metadata, utilize a late stage process to search for the rate-limiting TB using server-side session data associated with the request;
responsive to not finding the TB using the session data:
create the TB and associating with it at least two search indexes comprising the first metadata associated with the request and the session data; and
perform the response operation;
wherein the response operation comprises the processor being configured to transmit, via the network interface, a determined response to the client.