Asymmetrical Challenges for Web Security

A computer-implemented method, comprising:

• receiving, at a computing system and over a network from a client computing device, a request to initiate a web-based transaction, the request including values for one or more parameters that are presented as a solution to a challenge that was provided to the client computing device;
• determining whether the values in the request comprise a valid solution to the challenge that was provided to the client computing device;
• and
• in response to determining that the values in the request comprise a valid solution to the challenge, coordinating with a web server system to initiate the web-based transaction,
• wherein the computing system is configured, in response to determining that the values in the request comprise an invalid solution to the challenge, to block the request to initiate the web-based transaction from being communicated to the web server system so as to prevent initiation of the web-based transaction by the web server system.

A computer-implemented method, comprising:

• obtaining, at a computing system, web code for a web page that is to be served to a client computing device;
• modifying the web code for the web page by inserting into the web code additional, executable code that defines a challenge to be solved by the client computing device, the additional, executable code arranged to cause the client computing device to search for values for one or more parameters that comprise a solution to the challenge by iteratively testing different values of the one or more parameters as possible solutions until particular values are determined to satisfy one or more constraints associated with the challenge;
• transmitting the modified web code, including the additional, executable code, over a network and to the client computing device;
• identifying, at the computing system, that the client computing device has generated a valid solution to the challenge;
• and
• in response to identifying that the client computing device has generated a valid solution to the challenge, taking action to initiate a web-based transaction requested by the client computing device.

A system of one or more computers, comprising:

• a server subsystem that serves electronic content to client computing devices and that is configured to perform web transactions in response to requests from the client computing devices;
• a challenge generator that generates challenge code for execution by the client computing devices, the challenge code arranged to cause the client computing devices to determine values for one or more parameters that comprise solutions to challenges defined by the challenge code;
• a communications interface transmits the electronic content from the server subsystem and the challenge code from the challenge generator over a network and to the client computing devices, the communications interface further configured to receive requests to perform web transactions from the client computing devices;
• and
• a challenge validator that (i) identifies, in the requests from the client computing devices to perform the web transactions, values that are presented in the requests as solutions to the challenges, (ii) determines whether the identified values are valid solutions to the challenges, and (iii) communicates with the server subsystem to cause performance of the requested web transactions in response to a determination that the identified values are valid solutions to the challenges.

One or more non-transitory computer-readable media having instructions stored thereon that, when executed by one or more computers, cause performance of operations comprising:

• receiving, at a computing system, first code that defines at least a portion of an electronic resource that is to be served to a client computing device;
• generating second code that defines a challenge to be solved by the client computing device, the second code arranged to cause the client computing device to determine values for one or more parameters that comprise a solution to the challenge, wherein the values for the one or more parameters that comprise the solution to the challenge are required for the client computing device to make valid requests to initiate one or more web-based transactions;
• providing, to the client computing device, the first code that defines the at least the portion of the electronic resource and the second code that defines the challenge to be solved by the client computing device;
• receiving a request from the client computing device to initiate a particular web-based transaction, the request including particular values for the one or more parameters that comprise a possible solution to the challenge;
• determining whether the particular values for the one or more parameters comprise a valid solution to the challenge;
• and
• taking action to initiate the particular web-based transaction or to not initiate the particular web-based transaction based on whether the particular values for the one or more parameters are determined to comprise a valid solution to the challenge.

One or more non-transitory computer-readable media having instructions stored thereon that, when executed by one or more computers, cause performance of operations comprising:

• receiving, at a computing system and over a network from a client computing device, a request to initiate a web-based transaction, the request including values for one or more parameters that are presented as a solution to a challenge that was provided to the client computing device;
• determining whether the values in the request comprise a valid solution to the challenge that was provided to the client computing device;
• and
• in response to determining that the values in the request comprise a valid solution to the challenge, coordinating with a web server system to initiate the web-based transaction,
• wherein the computing system is configured, in response to determining that the values in the request comprise an invalid solution to the challenge, to block the request to initiate the web-based transaction from being communicated to the web server system so as to prevent initiation of the web-based transaction by the web server system.

One or more non-transitory computer-readable media having instructions stored thereon that, when executed by one or more computers, cause performance of operations comprising:

• obtaining, at a computing system, web code for a web page that is to be served to a client computing device;
• modifying the web code for the web page by inserting into the web code additional, executable code that defines a challenge to be solved by the client computing device, the additional, executable code arranged to cause the client computing device to search for values for one or more parameters that comprise a solution to the challenge by iteratively testing different values of the one or more parameters as possible solutions until particular values are determined to satisfy one or more constraints associated with the challenge;
• transmitting the modified web code, including the additional, executable code, over a network and to the client computing device;
• identifying, at the computing system, that the client computing device has generated a valid solution to the challenge;
• and
• in response to identifying that the client computing device has generated a valid solution to the challenge, taking action to initiate a web-based transaction requested by the client computing device.