Back to results
US 11,310,217 B2Granted
Using ephemeral URL passwords to deter high-volume attacks
AssigneePaypal, Inc.
InventorJohn Franco
Life of this patent
Estimating the term…
Abstract
Methods and systems for using ephemeral URL passwords to deter high volume attacks is described. A request to access one of several protected URLs is detected from a client computing device. A URL password is received from the client computing device. The request is redirected to the protected URL upon determining that the received URL password is valid for the one of the several of protected URLs.
Claims20
A system for protecting uniform resource locators (URLs) comprising:
- a non-transitory memory storing instructions;
- and
- one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
- detecting a first request to access a protected URL from a client computing device;
- providing, to the client computing device, a second request for a URL password, wherein the second request includes a nonce comprising a server-generated string;
- receiving, from the client computing device and in response to the second request, the URL password including a parameter computable by the client computing device using a hash-based computation, wherein the parameter, when used as a key in the hash-based computation on the nonce provided to the client computing device, enables a signature having a prefix associated with the protected URL to be produced by the client computing device;
- and
- redirecting the first request to the protected URL upon determining that the received URL password is valid for the protected URL by confirming the parameter used in the hash-based computation on the nonce results in the signature having the prefix.
5 more elements
A method for protecting URLs, the method comprising:
- detecting a request to access a protected URL from a client computing device;
- providing, to the client computing device, a nonce comprising a server-generated string;
- receiving, from the client computing device, a URL password based on a codebook downloaded by the client computing device, the URL password including a parameter computable by the client computing device using a hash-based computation, wherein the parameter, when used as a key in the hash-based computation on the nonce provided to the client computing device, enables a signature having a prefix associated with the protected URL to be produced by the client computing device;
- determining that the codebook on which the received URL password is based is not expired;
- determining that the received URL password is not found in a cache of previously used URL passwords;
- determining that the received URL password is valid for the protected URL by confirming the parameter used in the hash-based computation on the nonce results in the signature having the prefix;
- and
- redirecting the request to the protected URL.
5 more elements
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause performance of operations comprising:
- detecting a first request to access a protected URL from a client computing device;
- providing, to the client computing device, a second request for a URL password, wherein the second request includes a nonce comprising a server-generated string;
- receiving, from the client computing device and in response to the second request, the URL password including a parameter computable by the client computing device using a hash-based computation, wherein the parameter, when used as a key in the hash-based computation on the nonce provided to the client computing device, enables a signature having a prefix associated with the protected URL to be produced by the client computing device;
- and
- redirecting the first request to access to the protected URL upon determining that the received URL password is valid for the protected URL by confirming the parameter used in the hash-based computation on the nonce results in the signature having the prefix.
2 more elements
Dependencies are inferred from the claim text.