Systems and methods for internet-wide monitoring and protection of user credentials

A method performed by a content delivery network (CDN) service provider that serves web application content on behalf of a plurality of web application providers who are customer of the CDN service provider, the method comprising:

• A. with a reverse proxy server:
• executing a TLS handshake with a user's client device, said execution of the TLS handshake comprising sending the client device a TLS certificate for a domain name of a web application provider customer of a CDN service provider, the CDN service provider operating the reverse proxy server;
• receiving, from a user's client device and over a publicly-accessible network, an application layer message directed to the domain name of the web application provider customer;
• examining the content of the application layer message to find a user credential;
• associating the user credential with a credential policy defined by a credential owner, the credential owner having issued the user credential to the user of the client device, and the credential owner being distinct from the web application provider;
• applying the credential policy, comprising:
• generating a verification message to verify whether the use of the user credential is permitted by the credential owner;
• sending the verification message to a remote computer that was designated by the credential owner;
• receiving a response to the verification message;
• sending a record of the user credential activity, the record including any of:
• the source IP address of the user's client device, date and time of receipt of the user credential, geography information, credential owner information;
• B. with one or more computers distinct from the reverse proxy server:
• collecting from the reverse proxy server a plurality of record of user credential activity, said plurality including the record of the user credential activity;
• collecting from a plurality of other reverse proxy servers a plurality of record of user credential activity;
• generating a visualization for one or more user credentials, the visualization comprising any of:
• (i) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which activity of the one or more user credentials was observed, wherein the portions are sorted based on any of:
• the location and angle of a given portion relative to the center of the pie indicating any of:
• the relative position and approximate bearing of the geography relative to the credential owner;
• (ii) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which the one or more user credentials had observed user credential activity, the perimeter length of a given portion indicating cardinality of sources within the geography of observed user credential activity across a first data category, and the height of the given portion indicating volume of observed activity across a second data category;
• (iii) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which the one or more user credentials had observed user credential activity, the enhanced pie chart further having a central region with one or more circles, each of which corresponds to a particular user credential with observed activity, wherein any of:
• the volume of a given circle relates to the a volume of observed activity for that particular user credential, and the position of a given circle relates to the slice where use of the particular user credential was observed.
• (iv) an enhanced pie chart having multiple portions, each portion corresponding to an autonomous system (AS) in which activity of the one or more user credentials was observed, where portions are grouped on a geography by geography basis around the perimeter of the enhanced pie chart.

An apparatus for monitoring usage of a user credential on the Internet, comprising:

• A. a reverse proxy server operated by a content delivery network (CDN) service provider, the reverse proxy server having circuitry forming at least one processor and at least one memory device storing computer program instructions for execution on the at least one processor, the computer program instructions including instructions that, when executed, cause the reverse proxy server to:
• a. execute a TLS handshake with a user's client device, said execution of the TLS handshake comprising sending the client device a TLS certificate for a domain name of a web application provider customer of a CDN service provider, the CDN service provider operating the reverse proxy server;
• b. receive, from a user's client device and over a publicly-accessible network, an application layer message directed to the domain name of the web application provider customer;
• c. examine the content of the application layer message to find a user credential;
• d. associate the user credential with a credential policy defined by a credential owner, the credential owner having issued the user credential to the user of the client device, and the credential owner being distinct from the web application provider;
• e. apply the credential policy, comprising:
• generating a verification message to verify whether the use of the user credential is permitted by the credential owner;
• f. send the verification message to a remote computer that was designated by the credential owner;
• g. receive a response to the verification message, the verification message comprising one of the following directives:
• i. a directive to allow the application layer message;
• ii. a directive to block the application layer message;
• iii. a directive to generate an alert;
• iv. a directive to initiate a two factor authentication process with the user associated with the user credential;
• h. apply the received directive to the application layer message, said application comprising:
• i. for a directive to allow the application layer message, process the application layer message in accord with a configuration associated with the web application provider;
• ii. for a directive to block the application layer message, block the application layer message;
• iii. for a directive to generate an alert about the application layer message, generate and send an alert in accord with any of:
• the directive and the credential policy;
• iv. for a directive to initiate a two factor authentication process with the user associated with the user credential, send a two factor authentication request to the user.

A system for monitoring usage of a user credential on the Internet, comprising:

• a plurality of reverse proxy servers operated by a content delivery network (CDN) service provider, a given reverse proxy server in the plurality having circuitry forming at least one processor and at least one memory device storing computer program instructions for execution on the at least one processor, the computer program instructions including instructions that, when executed, cause the given reverse proxy server to:
• execute a TLS handshake with a user's client device, said execution of the TLS handshake comprising sending the client device a TLS certificate for a domain name of a web application provider customer of a CDN service provider, the CDN service provider operating the reverse proxy server;
• receive, from a user's client device and over a publicly-accessible network, an application layer message directed to the domain name of the web application provider customer;
• examine the content of the application layer message to find a user credential;
• associate the user credential with a credential policy defined by a credential owner, the credential owner having issued the user credential to the user of the client device, and the credential owner being distinct from the web application provider;
• apply the credential policy, comprising:
• generating a verification message to verify whether the use of the user credential is permitted by the credential owner;
• send the verification message to a remote computer that was designated by the credential owner;
• receive a response to the verification message;
• sending a record of the user credential activity, the record including any of:
• the source 11? address of the user's client device, date and time of receipt of the user credential, geography information, credential owner information;
• one or more computers distinct from the plurality of reverse proxy servers, each of the one or more computers having circuitry forming at least one processor and at least one memory device storing computer program instructions for execution on the at least one processor, the computer program instructions including instructions that, when executed, cause the one or more computers to:
• collect from the plurality of reverse proxy servers a plurality of record of user credential activity;
• generate a visualization for one or more user credentials, the visualization comprising any of:
• (i) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which activity of the one or more user credentials was observed, wherein the portions are sorted based on any of:
• the location and angle of a given portion relative to the center of the pie indicating any of:
• the relative position and approximate bearing of the geography relative to the credential owner;
• (ii) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which the one or more user credentials had observed user credential activity, the perimeter length of a given portion indicating cardinality of sources within the geography of observed user credential activity across a first data category, and the height of the given portion indicating volume of observed activity across a second data category;
• (iii) an enhanced pie chart having multiple portions, each portion corresponding to a geography in which the one or more user credentials had observed user credential activity, the enhanced pie chart further having a central region with one or more circles, each of which corresponds to a particular user credential with observed activity, wherein any of:
• the volume of a given circle relates to the a volume of observed activity for that particular user credential, and the position of a given circle relates to the slice where use of the particular user credential was observed.
• (iv) an enhanced pie chart having multiple portions, each portion corresponding to an autonomous system (AS) in which activity of the one or more user credentials was observed, where portions are grouped on a geography by geography basis around the perimeter of the enhanced pie chart.