Method and system to dynamically obfuscate a web services interface
AssigneeSears Brands, L.L.C.
InventorsPartha Ghosh, Vivek Bawge
Life of this patent
Estimating the term…
Abstract
The present application relates to the handling of what are generally referred to as denial of service (DoS) attacks. More specifically, the present application relates to a method and system for protecting one or more on-line Web service application servers from DoS and/or distributed DoS (DDoS) attacks.
Claims30
A method for operating a system that uses a dynamically generated web services interface to protect a processor of service requests from attacks received via a data communication network, the method comprising:
- receiving a first service request, by a first processor from a client system via the data communication network, the first service request comprising an identifier of the client system, a service identifier, and a service key;
- producing, by the first processor, a client date and time by deciphering a portion of the service identifier using the identifier of the client system;
- determining, by the first processor, whether the first service request is an initial service request received by the first processor from the client system;
- identifying, by the first processor, a first match of the client date and time with a default date and time, if it is determined that the first service request is the initial service request received from the client system;
- identifying, by the first processor, a second match of the client date and time with a date and time of receipt of a previous service request received from the client system, if it is determined that the first service request is not the initial service request received from the client system;
- sending a second service request, by the first processor to the second processor, if either the first match or the second match is identified, wherein the second service request comprises a service name portion and the service key;
- and
- forwarding, by the first processor to the client system, a response of the second server processor to the second service request.
A non-transitory computer readable medium having a plurality of code sections, each code section comprising a plurality of instructions executable by one or more processors to cause the one or more processors to perform steps of a first process that uses a dynamically generated web services interface to protect a second process from attacks received via a data communication network, the steps comprising:
- receiving a first service request, from a client system via the data communication network, the first service request comprising an identifier of the client system, a service identifier, and a service key;
- producing a client date and time by deciphering a portion of the service identifier using the identifier of the client system;
- determining whether the first service request is an initial service request received by the first processor from the client system;
- identifying a first match of the client date and time with a default date and time, if it is determined that the first service request is the initial service request received from the client system;
- identifying a second match of the client date and time with a date and time of receipt of a previous service request received from the client system, if it is determined that the first service request is not the initial service request received from the client system;
- sending a second service request to the second processor, if either the first match or the second match is identified, wherein the second service request comprises a service name portion and the service key;
- and
- forwarding the client system, a response of the second server processor to the second service request.
A system that uses a dynamically generated web services interface to protect a second system for processing service requests from attacks received via a data communication network, the system comprising:
- one or more processors communicatively coupled to the data communication network and to the second system, the one or more processors operable to, at least:
- receive a first service request from a client system via the data communication network, the first service request comprising an identifier of the client system, a service identifier, and a service key;
- produce a client date and time by deciphering a portion of the service identifier using the identifier of the client system;
- determine whether the first service request is an initial service request received by the first processor from the client system;
- identify a first match of the client date and time with a default date and time, if it is determined that the first service request is the initial service request received from the client system;
- identify a second match of the client date and time with a date and time of receipt of a previous service request received from the client system, if it is determined that the first service request is not the initial service request received from the client system;
- send a second service request to the second system, if either the first match or the second match is identified, wherein the second service request comprises a service name portion and the service key;
- and
- forward to the client system, a response of the second system to the second service request.
Dependencies are inferred from the claim text.