# US 2018/0322134 A1 · Web service request verification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0322134 A1
- Document ID: US20180322134A1
- Status: Published application
- Kind: A1
- Application number: 16/021,256
- Filed: 2018-06-28
- Published: 2018-11-08
- Earliest claimed: 2013-10-10
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Philippe Kaplan; Georges-Henri Moll; Xavier Nodet; Olivier Oudot
- Web page: https://patentgrep.com/patent/US20180322134A1

## CPC

- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and Web server for verifying a Web service request originating from a Web page is provided. The method includes matching the Web service request with a Web service. A sequence ID contained in the request is identified. The Web service request is verified if the identified sequence ID does not correspond with a previous sequence ID for the matched Web service. Additionally, the Web service does not verify a same Web service request twice.

## Claims

### Claim 1

A Web server comprising a computer processor coupled to a computer-readable memory unit comprising a sequence ID software engine, a matcher component, an identifier component, and a verifier component, said memory unit comprising instructions that when executed by the computer processor implements a method for verifying a Web service request originating from a Web form, said method comprising:
storing, by said processor, a sequence ID as session data in a sequence ID register internal to said sequence ID software engine;
building, by said processor, Webpage content comprising said sequence ID added to a URL and associated with said Web form;
identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;
loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;
verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for Web service matched the Web service request, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises:
performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;
comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;
removing parameters from a SUBMIT command;
transmitting a confirmation page comprising a success code;
refreshing an original Web page displaying an order form; and
displaying a new order form;
removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;
generating, by said processor, in response to results of said removing, a new sequence ID;
generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;
reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;
forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and
embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.

### Claim 2 (depends on 1)

The Web server of claim 1, further comprising a suppressor component, and wherein said method further comprises:
suppressing, by said computer processor executing said suppressor component, the Web service request, if the Web service request is not verified, by removing critical parameters from the Web service request before the request is passed on to Web service.

### Claim 3 (depends on 1)

The Web server of claim 1, wherein the Web service ignores extra parameters in the Web service request if the Web service request has not been verified.

### Claim 4 (depends on 1)

The Web server of claim 1, wherein said sequence ID is determined by a sequence ID generator.

### Claim 5 (depends on 1)

The Web server of claim 1, wherein the sequence of sequence IDs comprises a simple arithmetical progression.

### Claim 6 (depends on 1)

The Web server of claim 1, wherein the sequence ID comprises a generated token.

### Claim 7 (depends on 1)

The Web server of claim 1, wherein the sequence ID is associated with a particular user session.

### Claim 8

A method for verifying a Web service request originating from a Web page, the method comprising:
storing, by a computer processor of a Web server executing a matcher component of the Web server, a sequence ID as session data in a sequence ID register internal to a sequence ID software engine, wherein said Web server comprises said sequence ID software engine, a matcher component, an identifier component, and a verifier component;
building, by said processor, Webpage content comprising said sequence ID added to a URL and associated with said Web form;
identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;
loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;
verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for Web service matched the Web service request, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises:
performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;
comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;
removing parameters from a SUBMIT command;
transmitting a confirmation page comprising a success code;
refreshing an original Web page displaying an order form; and
displaying a new order form;
removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;
generating, by said processor, in response to results of said removing, a new sequence ID;
generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;
reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;
forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and
embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
suppressing, by said computer processor executing a suppressor component of the Web server, the Web service request, if the Web service request is not verified, by removing critical parameters from the Web service request before the request is passed on to Web service.

### Claim 10 (depends on 8)

The method of claim 8, wherein the Web service ignores extra parameters in the Web service request if the Web service request has not been verified.

### Claim 11 (depends on 8)

The method of claim 8, wherein said sequence ID is determined by a sequence ID generator.

### Claim 12 (depends on 8)

The method of claim 8, wherein the sequence of sequence IDs comprises a simple arithmetical progression.

### Claim 13 (depends on 8)

The method of claim 8, wherein the sequence ID comprises a generated token.

### Claim 14 (depends on 8)

The method of claim 8, wherein the sequence ID is associated with a particular user session.

### Claim 15 (depends on 10)

The method of claim 10, further comprising:
providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in the computing system, said code being executed by the computer processor to implement said identifying and said verifying.

### Claim 16

A computer program product, comprising a non-transitory computer readable hardware storage device storing a computer readable program code, said computer readable program code comprising an algorithm that when executed by a computer processor of a Web server system implements a method, said method comprising:
storing, by a computer processor of a Web server executing a matcher component of the Web server, a sequence ID as session data in a sequence ID register internal to a sequence ID software engine, wherein said Web server comprises said sequence ID software engine, a matcher component, an identifier component, and a verifier component;
building, by said processor, Webpage content comprising said sequence ID added to a URL and associated with said Web form;
identifying, by said computer processor executing said identifier component, said sequence ID contained in the request;
loading, by said computer processor, said identified sequence ID into a sequence ID test register within said sequence ID software engine;
verifying, by said computer processor executing said verifier component, the Web service request if the identified sequence ID does not correspond with an already received sequence ID for Web service matched the Web service request, wherein the Web service does not verify a same Web service request twice, and wherein said verifying comprises:
performing a look up process via usage of a plurality of session registers, internal to said sequence ID software engine, for locating associated sequence registers associated with said identified sequence ID;
comparing, by a comparator internal to said sequence ID software engine, the already received sequence ID within an associated sequence register of said associated sequence registers with the identified sequence ID within the sequence ID test register;
removing parameters from a SUBMIT command;
transmitting a confirmation page comprising a success code;
refreshing an original Web page displaying an order form; and
displaying a new order form;
removing, by said processor based on results of said verifying, elements of said sequence ID from said URL;
generating, by said processor, in response to results of said removing, a new sequence ID;
generating, by said processor, a response Web page associated with said URL with said elements removed during said removing, wherein said response Web page differs from an original Web page associated with said sequence ID;
reloading, by said processor, said response Webpage via transmission of an HTTP signal to a server;
forwarding, by said processor to a client server, an HTTP message associated with said response Web page; and
embedding, by said computer processor executing a code generator, one or more restricted user controls in a Web page associated with a sequence ID generator internal to said sequence ID software engine, wherein any Web request received from a restricted user control includes said sequence ID generated by the sequence ID generator, and wherein each sequential request for the Web service is associated with a next sequential ID in a sequence of sequence IDs as embedded respectively in the Web page and the Web service.