Distributed defense architecture (DDA) for distributed denial of service (DDOS) attacks

Abstract

The present disclosure provides various systems, methods, and devices that can be used to defend against distributed denial of service (DDoS) attacks. In one aspect, the present disclosure provides a method for defending against DDoS attacks that can be implemented by a web server. The web server can generate indirect authentication credentials (IACs) based on authentication credentials associated with a user account and share the IACs with an intermediary server. The intermediary server can be, for example, an Internet server provider server or a proxy server. The web server can further detect anomalies based on web traffic directed to the web server and instruct the intermediary server to verify subsequent web traffic directed to the web server based on the IACs. Thereafter, the web server can receive, via the intermediary server, the verified web traffic directed to the web server.

Description

Technical Field

[0001] At least some aspects of this disclosure relate to cybersecurity, such as protecting web servers from denial-of-service and distributed denial-of-service attacks. Background Technology

[0002] Malicious actors may attempt to disrupt services provided by a web server using a denial-of-service (DoS) attack. To carry out a DoS attack, malicious actors typically overwhelm the web server with requests. This request overwhelm can prevent the web server from handling legitimate requests from client devices.

[0003] Distributed Denial-of-Service (DDoS) attacks are a type of DoS attack in which requests overwhelming a web server originate from multiple different sources. For example, a malicious actor might use devices with separate internet connections to send requests to the web server. For example Networks of devices (such as personal computers, smartphones, and IoT devices) are used to carry out DDoS attacks. In some cases, the network of internet-connected devices is a "botnet" of devices infected with malware programmed to make the devices act as "zombies" for malicious actors and send requests to web servers.

[0004] DDoS attacks can be particularly difficult to defend against due to the distributed nature of incoming requests. For example, because a web server is receiving both malicious and legitimate requests originating from multiple different devices, it can be difficult to identify which devices are sending malicious requests and block incoming traffic from those devices.

[0005] Therefore, there is a need for systems, methods, and devices for defending against DoS and DDoS attacks. This disclosure provides various solutions employing a distributed defense architecture (DDA). Summary of the Invention

[0006] In one aspect, this disclosure provides a computer-implemented method. This computer-implemented method may include receiving a client request by a web server via an intermediary server, and detecting anomalies related to the client request by the web server. The computer-implemented method may also include instructing an intermediary server to verify subsequent client requests by the web server, and receiving the verified subsequent client requests from the intermediary server by the web server.

[0007] In another aspect, the present disclosure provides a computer-implemented method. The computer-implemented method can include receiving, by an intermediary server, a client request directed to a web server, and forwarding, by the intermediary server, the client request to the web server. The computer-implemented method can also include receiving, by the intermediary server, an instruction from the web server to validate a subsequent client request. The instruction can be based on a detected anomaly related to the client request. The computer-implemented method can also include receiving, by the intermediary server, the subsequent client request, validating, by the intermediary server, the subsequent client request, and forwarding, by the intermediary server, the validated subsequent client request to the web server.

[0008] In yet another aspect, the present disclosure provides a web server. The web server can include a processor and a memory including instructions executable by the processor. The instructions can cause the processor to generate an indirect authentication credential (IAC) based on an authentication credential associated with a user account and share the IAC with an intermediary server. The intermediary server can be, for example, an Internet server provider server or a proxy server. The instructions can further cause the processor to detect an anomaly based on web traffic directed to the web server, instruct the intermediary server to validate subsequent web traffic directed to the web server based on the IAC, and receive, via the intermediary server, the validated web traffic directed to the web server. BRIEF DESCRIPTION OF DRAWINGS

[0009] In the description, for purposes of explanation and not limitation, specific details are set forth, such as particular aspects, procedures, techniques, etc. in order to provide a thorough understanding of the present technology. However, it will be apparent to one skilled in the art that the present technology can be practiced in other aspects that depart from these specific details.

[0010] The accompanying drawings are incorporated in and constitute a part of this specification and, together with the detailed description, serve to explain the various aspects of the concepts included in the claimed disclosure and, to explain the principles and advantages of the aspects.

[0011] The apparatus and methods disclosed herein have been represented, where appropriate, by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the various aspects of the present disclosure, in order not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

[0012] Figure 1 A diagram of a web traffic system is shown in accordance with at least one aspect of the present disclosure.

[0013] Figure 2A A diagram of a web traffic system during a distributed denial of service (DDoS) attack is shown in accordance with at least one aspect of the present disclosure.

[0014] Figure 2B A diagram of a web traffic system employing a distributed defense architecture (DDA) to mitigate DDoS attacks is shown in accordance with at least one aspect of the present disclosure. Figure 2A

[0015] Figure 3 A flow diagram of a method for initializing a DDA based on detecting a potential DDoS attack is shown in accordance with at least one aspect of the present disclosure.

[0016] Figure 4 A flow diagram of a method for performing a DDA to mitigate a potential DDoS attack is shown in accordance with at least one aspect of the present disclosure.

[0017] Figure 5 A flow diagram of a method for protecting a web server from abnormal web traffic that can be implemented by a web server is shown in accordance with at least one aspect of the present disclosure.

[0018] Figure 6 A flow diagram of a method for protecting a web server from abnormal web traffic that can be implemented by an intermediary server is shown in accordance with at least one aspect of the present disclosure.

[0019] Figure 7 A block diagram of a computer device having a data processing subsystem or component is shown in accordance with at least one aspect of the present disclosure.

[0020] Figure 8 A diagram of an example system including a host is shown in accordance with at least one aspect of the present disclosure.

[0021] Corresponding reference numerals indicate corresponding parts throughout the several views. The examples outlined herein are shown by way of example and such examples should not be construed as limiting the scope of the present disclosure in any manner. DETAILED DESCRIPTION

[0022] Before the various forms of the devices, systems and methods disclosed herein are explained in detail, it is to be understood that the forms are illustrative and that the concepts can be implemented in other forms, modifications and variations without departing from the spirit and scope of the disclosure. The illustrative forms can be implemented or incorporated in other forms, variations and modifications, and can be practiced or carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting in any way. As such, like reference numerals and characters are used to denote like elements throughout the following description.

[0023] ​As explained above, a malicious actor can attempt to disrupt the service provided by a web server by performing a denial of service (DoS) attack that overwhelms the web server with extraneous requests, rendering the web server unable to process legitimate requests from client devices. In some cases, the DoS attack can be a distributed denial of service (DDoS) attack. A DDoS attack can employ one or more botnets to send extraneous requests to the web server from multiple different sources. As a result, DDoS attacks can be particularly difficult to defend against.

[0024] DoS attacks and DDoS attacks can be harmful to a company associated with a web server by rendering the web server unable to process legitimate requests from client devices. For example, companies such as social media companies, streaming services, and online commerce companies typically rely on web servers to deliver products to consumers. DoS attacks and DDoS attacks can significantly slow down or bring down a company’s web server, which can not only prevent the company from delivering products to consumers, but also negatively impact the company’s reputation and consumers’ willingness to do business with the company in the future. Accordingly, there is a need for systems, methods, and devices for defending against DoS attacks and DDoS attacks.

[0025] The present disclosure provides various systems, methods, and devices for defending against DoS attacks and DDoS attacks and / or other abnormal web traffic that can negatively impact a web server. For example, in various aspects, the present disclosure provides a method for protecting a web server from abnormal web traffic. According to the method, the web server receives client requests via an intermediary server and detects an anomaly related to the client requests. In one aspect, the detected anomaly is an increase in the amount of client requests, which can indicate a potential DDoS attack. Based on detecting the anomaly, the web server instructs the intermediary server to enter a defense mode, which causes the intermediary server to validate subsequent client requests. Thereafter, the web server receives validated subsequent client requests from the intermediary server. Subsequent client requests that the intermediary server is unable to validate (e.g., malicious client requests sent as part of a DDoS attack) are not forwarded to the web server. Accordingly, the various systems, methods, and devices methods can provide the technical benefit of preventing a web server from being continuously exposed to abnormal web traffic (e.g., from a DDoS attack) that can overwhelm or otherwise negatively impact the web server. For example As a DDoS attack part of the sent malicious client requests) will not be forwarded to the web server. Accordingly, the various systems, methods, and devices methods can provide the technical benefit of preventing a web server from being continuously exposed to abnormal web traffic (e.g., from a DDoS attack) that can overwhelm or otherwise negatively impact the web server.

[0026] In some aspects of the example method cited above, the intermediary server verifies subsequent client requests based on indirect authentication credentials (IACs) generated by the web server. For example, the web server could use authentication credentials typically used to authenticate users requesting access to resources on the web server. For example An IAC is generated using authentication credentials such as username, password, and / or tokens stored in an authentication credential database. In one aspect, the IAC is generated by salting and hashing the authentication credentials. The web server shares the IAC with the intermediary server. Furthermore, subsequent client requests sent from the client device to the web server via the intermediary server may include additional headers containing the corresponding IAC. The intermediary server can verify the subsequent client request by comparing the IAC included in the subsequent client request with the IAC shared by the web server. Therefore, by using the IAC, the intermediary server can verify subsequent client requests without having access to the user's actual authentication credentials. Moreover, the intermediary server may not have access to the salt used to generate the IAC and therefore cannot derive the user's actual authentication credentials from the IAC. Thus, the above method can be implemented without sharing or otherwise providing access to the user's actual authentication credentials, thereby reducing the risk of leaking the user's authentication credentials. Furthermore, IAC generation is integrated into practical applications because the intermediary server can use the IAC to verify client requests directed to the web server and prevent potential DDoS attacks.

[0027] The devices, systems, and methods disclosed herein offer numerous technical advantages. For example, by instructing an intermediary server to verify subsequent client requests based on detected anomalies in web traffic, and by receiving these verified subsequent client requests, redundant requests associated with DoS and DDoS attacks can be prevented from reaching the web server. Therefore, the web server can avoid consuming excessive computational resources that would otherwise become unusable if redundant requests continued to arrive. Consequently, the devices, systems, and methods disclosed herein can be used to prevent potential DoS and DDoS attacks, thereby helping to ensure the web server remains operational and capable of handling legitimate client requests, and improving the functionality of the web server.

[0028] Figure 1A diagram of a web traffic system 100 according to at least one aspect of this disclosure is shown. The web traffic system 100 includes a client device 102 communicating with a web server 104. The web server 104 can receive requests from the client device 102, such as requests for web pages or other resources provided by the web server 104. Based on the received request, the web server 104 can provide the content of the web page or the requested resource to the client device 102. In some aspects, communication between the client device 102 and the web server 104 utilizes the Hypertext Transfer Protocol (HTTP) or a variant thereof. For example Hypertext Transfer Security Protocol (HTTPS). Client device 102 can be any type of device capable of communicating via the Internet, such as, for example, a personal computing device, a mobile computing device, etc. For example Laptops, smartphones, and Internet of Things (IoT) devices. For example (Smart home hub), smart TV, or any other type of device that can be used to access the resources of web server 104.

[0029] The web traffic system 100 also includes a middleware server 106. Middleware server 106 may include one or more middleware servers of different types. For example, middleware server 106 may include a first Internet Service Provider (ISP) server 108, a second ISP server 110, and / or a proxy server 112. The first ISP server 108, the second ISP server 110, and / or the proxy server 112 facilitate client device 102's connection to the Internet. Therefore, the first ISP server 108, the second ISP server 110, and / or the proxy server 112 facilitate communication between client device 102 and web server 104. In some aspects, the first ISP server 108 may be connected to a lower-tier ISP (… For example Tier 3 and Tier 2 correspond to each other, and the second ISP can correspond to a higher tier ISP ( For example Level 2 corresponds to Level 1). Proxy server 112 can be a gateway or intermediary for communication between client device 102 and web server 104. Although Figure 1 The intermediary server 106 is described as including a first ISP server 108, a second ISP server 110, and a proxy server 112; however, in other respects, the intermediary server 106 may include fewer than two ISP servers. For example (Zero or one ISP server), more than two ISP servers, more than one proxy server, or no proxy server. Furthermore, in other respects, the order of connections between the servers included in the intermediary server 106 may differ from... Figure 1 The example shown is shown.

[0030] In some aspects, the client devices 102, the intermediary servers 106, and / or the web servers 104 can communicate via one or more wired and / or wireless networks. For example, the client devices 102, the intermediary servers 106, and / or the web servers 104 can communicate via a cellular network (e.g., a long-term evolution (LTE) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a For example public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber optic-based network, a cloud computing network, and / or the like, and / or a combination of these or other types of networks. For example

[0031] Figure 2A A diagram of a web traffic system 200a during a distributed denial of service (DDoS) attack is shown in accordance with at least one aspect of the disclosure. The web traffic system 200a can be similar in many respects to the web traffic system 100 Figure 1 ), where like or similar components are indicated by corresponding reference numbers. The web traffic system 200a includes multiple client devices 102 sending legitimate requests to the web servers 104 via different intermediary servers 106. For example, as shown in Figure 2A , the client device 102a sends requests to the web servers 104 via the intermediary server 106a, and the client device 102b sends requests to the web servers 104 via the intermediary server 106b. Each of the intermediary servers 106a, 106b, 106c can include one or more than one different type of intermediary server, such as different tiers of ISP servers and / or proxy servers, as described above with respect to the intermediary servers 106 of Figure 1 . Figure 2A The number of client devices 102 and intermediary servers 106 depicted in For example is for purposes of illustration. The web traffic system 200a can include any number (e.g., tens, thousands, millions) of client devices 102 sending requests to the web servers 104 via any number (e.g., tens, thousands) of intermediary servers 106. For example

[0032] Still referring to Figure 2A ​​web traffic system 200a also includes botnets 120a-120e (sometimes collectively referred to as botnets 120) that attempt to maliciously perform DDoS attacks on web server 104. For example, as shown in Figure 2A botnet 120a and botnet 120b send excess requests to web server 104 via intermediary server 106a, botnet 120c sends excess requests to web server 104 via intermediary server 106b, and botnet 120d and botnet 120e send excess requests to web server 104 via intermediary server 106c. Each of the botnets 120 can be composed of one or more internet-connected devices that have been compromised by malware that is programmed to cause the devices to send excess requests to web server 104. Figure 2A The number of botnets 120 depicted in FIG. 1 is for illustrative purposes. Web traffic system 200a can include any number For example of botnets 120 (in the thousands). In some aspects, botnets 120 are capable of sending more than one million requests per second to web server 104. The requests sent by botnets 120 to web server 104 can be sufficient to significantly slow down or disable web server 104, such that the web server is unable to handle legitimate requests sent by client devices 102.

[0033] Figure 2B A diagram of a web traffic system 200b employing a distributed defense architecture (DDA) to mitigate DDoS attacks as described above with respect to Figure 2A FIG. 1 is shown in accordance with at least one aspect of the present disclosure. Web traffic system 200b is similar in many respects to web traffic system 200a Figure 2A except that intermediary servers 106 are configured in a defense mode that causes intermediary servers 106 to determine whether requests directed to web server 104 are valid, forward verified requests to web server 104, and suppress forwarding requests that cannot be verified to web server 104. For example, as shown in Figure 2B legitimate requests from client device 102a and client device 102b have been verified and forwarded to web server 104 by intermediary server 106a and intermediary server 106b, respectively. In contrast, intermediary servers 106 are unable to verify the excess requests from corresponding botnets 120. Therefore, intermediary servers 106 do not forward the excess requests from botnets 120 to web server 104. As a result, web server 104 is not overwhelmed by the excess requests from botnets 120 and is able to handle legitimate requests from client devices 102.

[0034] In some aspects, the intermediary servers 106 receive instructions from the web server 104 causing the intermediaries to enter a defense mode based on the web server 104 detecting an increase in incoming web traffic related to an anomaly For example In other aspects, one or more of the intermediary servers 106 can enter a defense mode based on one or more of the intermediary servers 106 detecting an anomaly related to incoming web traffic directed to the web server 104. The intermediary servers 106 can take this action automatically or based on alerting the web server 104 of the detected anomaly and receiving a responsive instruction from the web server 104 to enter a defense mode. In some aspects, one or more of the intermediary servers 106 can selectively enter a defense mode while other ones of the intermediary servers 106 do not enter a defense mode. For example, a web traffic anomaly can be detected that corresponds to traffic passing through only some of the intermediary servers 106. Those intermediary servers 106 can selectively enter a defense mode while other intermediary servers 106 do not enter a defense mode. In some aspects, the intermediary servers 106 can enter a defense mode according to any of the methods 300, 500, 600 described herein with respect to Figure 3 、 Figure 5 and Figure 5 respectively.

[0035] In some aspects, the authentication credentials used for verification can be indirect authentication credentials (IACs) that are generated based on authentication credentials stored in an authentication credential database associated with the web server 104. The IACs can be generated by salting and hashing the authentication credentials from the authentication credential database. In some aspects, the generation of the IACs can be implemented according to any of the methods 300, 500, 600 described herein with respect to Figure 3 、 Figure 5 and Figure 6 respectively. In some aspects, the verification of incoming requests by the intermediary servers 106 can be implemented according to any of the methods 400, 500, 600 described herein with respect to Figure 4 、 Figure 5 and Figure 6 respectively.

[0036] Figure 3 is a flowchart of a method 300 for initializing a DDA based on detecting a potential DDoS attack in accordance with at least one aspect of the present disclosure, which can be implemented by the web traffic system 100 of Figure 1 and / or Figures 2A-2BThe web traffic system 200a / 200b is used for implementation. As will be apparent from the description below, the actions taken to implement method 300 can be performed in any order. According to method 300, web server 104 generates 302 Indirect Authentication Certificate (IAC) database 116 based on authentication certificate database 114. Authentication certificate database 114 can store authentication certificates ( For example Username, password, and token are among the authentication credentials used to authenticate users requesting access to web pages and / or resources provided by web server 104. IAC database 116 may store IACs 302 generated based on authentication credentials from authentication credential database 114.

[0037] According to some aspects of method 300, the IAC database 116 generates 302 by salting and hashing authentication credentials from the authentication credential database 114. For example, the authentication credential database 114 may store usernames and passwords for each of multiple registered user accounts. An IAC can be generated for each account by salting and hashing the first salt (…). For example Salt1) and then the hash function ( For example Hash is applied to the corresponding username to generate a salted and hashed username. For example Hash(Username + Salt1) = the username hashed with salt, and the second salt ( For example Salt2) and a hash function are applied to the corresponding password to generate a salted and hashed password. For example Hash(Password + Salt2) = Salted and hashed password. In some respects, the first and second salts can be the same. In other respects, the first and second salts can be different.

[0038] As another example, the authentication credential database 114 can store tokens for at least some of the registered accounts among multiple registered accounts. Tokens can be stored in addition to or in place of usernames and / or passwords. This can be achieved by adding a salt (…). For example Salt3) and then the hash function ( For example Hash is applied to the corresponding token to generate a salted and hashed token. For example Hash(Token+Salt3) = Salted and hashed token) is used to generate IAC for each account in the account.

[0039] As used in this article, "salting" or "applying salt" can mean appending a data string to the input data. For exampledigits, letters, characters, bits, etc.). The string of data appended to the input data can be referred to as a "salt." The salt can be appended to specific locations of the input data, which can be specified by a salting function and / or salting algorithm used to apply the salt. For example, a salting function can be configured to append the character "%" after the first character of the input data string and the character "$" after the fourth character of the input data string. Applying this example salting function to the input username "abcdefg" can generate the salted username "a%bcd$efg."

[0040] As used herein, a "hash" or "hash function" can refer to any algorithm or function that takes data as input and returns a fixed-size bit string (hash) as output. For example hash) as output.

[0041] According to some aspects of the method 300, the web server 104 can sometimes generate 302 a new IAC database 116. In one aspect, the web server 104 can generate 302 a new IAC database 116 on a periodic basis, such as, for example, once per hour, once per day, once per week, once per month, etc. In another aspect, the web server 104 can generate 302 a new IAC database 116 based on the occurrence of an event. For example, the web server 104 can generate 302 a new IAC database 116 based on detecting 306 an anomaly related to incoming web traffic and / or based on the intermediary server 106 entering a defense mode 308. As another example, the web server 104 can generate 302 a new IAC database 116 at any time a new token is issued. As noted above, the authentication credential database 114 can store tokens associated with user accounts and used to authenticate to the web server 104. New replacement tokens can be periodically generated, issued to users and / or client devices associated with users, and also stored in the authentication credential database 114. The new IAC database 116 can be generated based on the generation, storage, and / or issuance of new tokens.

[0042] In some aspects, a different salt can be applied each time a new IAC database 116 is generated. Thus, the IACs stored in each new IAC database 116 can be different than the IACs in a previously generated IAC database 116. Accordingly, generating 302 a new IAC database 116 on a periodic basis or based on the occurrence of an event can help ensure the security of underlying authentication credentials and / or help prevent malicious actors from compiling IACs that can be used to attempt to send seemingly valid requests to the web server 104.

[0043] Still referring to Figure 3According to method 300, web server 104 shares 304 the IAC database 116 with intermediary server 106. As described herein with respect to method 200, sharing 304 the IAC database 116 with intermediary server 106 can include selectively sharing 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. In some aspects, web server 104 can share 304 the IAC database 116 with all servers that can be included in intermediary server 106. In other aspects, web server 104 can selectively share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. Figure 1 As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. For example As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. Figure 2A As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. Figure 2B As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. Figure 3 As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. For example As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106. As further described herein, intermediary server 106 can include a plurality of intermediary servers (e.g., first ISP server 108, second ISP server 110, proxy server 112). As described herein with respect to method 200, web server 104 can share 304 the IAC database 116 with one or more servers that can be included in intermediary server 106.

[0044] According to some aspects of method 300, sharing 304 the IAC database 116 with intermediary server 106 is based on the generation 302 of the IAC database 116. For example, web server 104 can share 304 a new IAC database 116 with intermediary server 106 each time a new IAC database 116 is generated 302. As another example, web server 104 can share 304 the IAC database 116 with intermediary server 106 based on an occurrence of an event. For example, web server 104 can pre-generate the IAC database 116, but wait to share 304 the IAC database 116 with intermediary server 106 based on an occurrence of an event, such as detecting 306 an anomaly related to incoming web traffic and / or based on an indication 308 that intermediary server 106 enters a defensive mode.

[0045] According to method 300, web server 104 detects 306 web traffic from intermediary server 106 that is associated with an IAC database 116. For example, web server 104 can detect 306 web traffic from intermediary server 106 that is associated with a particular IAC database 116 that web server 104 has shared 304 with intermediary server 106. For exampleAn exception related to the incoming request. As noted above, the intermediary server 106 may indicate that it is forwarding the request to one or more servers of the web server 104. In some respects, the detected exception 306 may be based on web traffic from a single intermediary server 106. In other respects, the detected exception 306 may be based on aggregated web traffic from multiple different intermediary servers 106. Based on the detected exception 306 related to web traffic from intermediary server 106, the web server 104 may instruct intermediary server 106 to switch to ( For example (Initiating / Implementing) Defense Mode. Switching to defense mode allows the intermediary server 106 to determine the validity of subsequent requests to the web server 104, for example, based on IAC credentials from the IAC database 116. Depending on several aspects, the intermediary server 106 may implement defense mode according to methods 400 and / or 600, as per [specific details]. Figure 4 and Figure 6 As described.

[0046] According to some aspects of method 300, detecting anomalies 306 related to web traffic from intermediary server 106 may include detecting an increase in the amount of requests forwarded by intermediary server 106 to web server 104. For example, in some aspects, detecting anomalies 306 may be based on an increase in the amount of web traffic satisfying a predetermined threshold. Baseline and / or expected web traffic volumes for a specific time of day, a specific day of week, a specific time of month, and / or a specific time of year can be derived from historical web traffic data. The baseline and / or expected web traffic may vary periodically depending on the nature of the services and / or resources provided by web server 104. For example Users may access streaming services associated with web server 104 in large quantities during nighttime, or users may access online stores associated with web server 104 during specific seasons, etc. Therefore, the predetermined threshold used as the basis for detecting anomalies in web traffic 306 may be, for example, an increase of 50%, 100%, 150%, 200%, 500%, 1000%, or greater than 1000% in the amount of web traffic compared to a baseline and / or expected amount of web traffic for a specific time period.

[0047] As another example, in some aspects, detecting 306 the anomaly can be based on a rate of increase in the amount of web traffic satisfying a predetermined threshold. Thus, the predetermined threshold used as a basis for detecting 306 the anomaly in web traffic can be, for example, a 50% increase, a 100% increase, a 150% increase, a 200% increase, a 500% increase, a 1000% increase, or a greater than 1000% increase in the amount of web traffic over a predetermined period of time. The predetermined period of time can be, for example, an order of seconds For example 1 second, 10 seconds, 30 parts), minutes For example 1 minute, 10 minutes, 30 minutes), or hours.

[0048] According to other aspects of the method 300, detecting 306 the anomaly related to web traffic can include detecting the anomaly via an anomaly detection system executed by the web server 104. The anomaly detection system can be configured to identify any type of unusual or unexpected characteristic of web traffic received by the web server 104. For example, the web server 104 can provide web pages, resources, and / or other characteristics that are not frequently requested by the client device 102 and / or that are expected to be requested by the client device 102 under certain circumstances. The anomaly detection system can identify receipt of an unusual number of requests for these web pages, resources, and / or other characteristics as an anomaly in web traffic.

[0049] Figure 4 is a flow diagram of a method 400 for performing DDA to mitigate potential DDoS attacks in accordance with at least one aspect of the present disclosure, which can be implemented by Figure 1 the web traffic system 100 of Figures 2A-2B the web traffic system 200a / 200b of According to some aspects of the method 400, the intermediary server 106 can be configured to be in a defensive mode, for example, based on detecting 306 the anomaly Figure 3 ). The intermediary server 106 receives 402 a request from the client device 102 directed to the web server 104. The request received 402 by the intermediary server 106 can include an indirect authentication credential (IAC) sent from the client device, which is sometimes referred to herein as a client IAC. In some aspects, the request sent by the client device 102 can include a header and / or code For example HTTP header) containing the client IAC. The client IAC can be generated based on an authentication credential received by the client device 102.

[0050] In some aspects, the client device 102 generates the client IAC from the authentication credentials based on a hidden field included in the web page data sent by the web server 104 to the client device 102. The hidden field can cause the client IAC to be generated based on the same hash and salt functions used to generate the IAC database 116. For example, the hidden field can cause the authentication credentials to be salted and hashed to generate the client IAC when the user of the client device 102 provides the authentication credentials for accessing the resources of the web server 104. Thus, the client IAC included in the request received 402 by the intermediary server 106 can match the corresponding IAC (which is sometimes referred to herein as a server IAC) included in the IAC database 116.

[0051] Still referring to Figure 4 According to the method 400, the intermediary server 106 validates 404 the request received 402 from the client device 102 based on the IAC database 116. For example, to validate 404 the request, the intermediary server 106 can compare the client IAC included in the request received 402 from the client device 102 to the server IAC included in the IAC database 116. The intermediary server 106 can determine that the request from the client device 102 is valid by identifying the server IAC included in the IAC database 116 that matches the client IAC.

[0052] In some aspects, the intermediary server 106 can receive requests that do not include a client IAC or include an invalid IAC (e.g., from a botnet 120 performing a DDoS attack). Thus, the intermediary server 106 will be unable to validate 404 the request. For example

[0053] Still referring to Figure 4 According to the method, the intermediary server 106 forwards 406 the validated request to the web server 104. Thus, the web server 104 can process the request from the client device 102. However, the intermediary server can refrain from forwarding requests to the web server 104 that will be unable to be validated. Refraining from forwarding requests that will be unable to be validated can prevent the web server 104 from being overwhelmed with extraneous requests associated with a potential DoS attack or DDoS attack. Thus, in various aspects, the method 400 can be used to thwart potential DoS attacks and DDoS attacks.

[0054] Figure 5 is a flowchart of a method 500 for protecting a web server from abnormal web traffic according to at least one aspect of the present disclosure. The method 500 can be performed by the intermediary server 106 described herein with respect to Figures 1-4 ​web server 104 depicted in any of the figures interacting with the intermediary server 106 can be implemented. According to the method 500, the web server 104 receives 502 a client request via the intermediary server 106. Further, the web server 104 detects 504 an anomaly related to the client request.

[0055] According to some aspects of the method 500, the web server 104 detects 504 the anomaly related to the client request based on detecting an increase in the volume of client requests. In other aspects, the web server 104 detects 504 the anomaly related to the client request based on an anomaly detection system of the web server 104 analyzing the client request.

[0056] Still referring to Figure 5 According to the method 500, the web server 104 instructs 506 the intermediary server 106 to validate subsequent client requests. For example, the web server 104 can instruct 506 the intermediary server 106 to validate subsequent client requests based on detecting 504 the anomaly related to the client request. Further, according to the method 500, the web server 104 receives 508 the validated subsequent client requests from the intermediary server 106.

[0057] According to some aspects of the method 500, the web server 104 stores authentication credentials in a first database. The web server 104 can generate inter-server authentication credentials (IACs) based on the authentication credentials stored in the first database. Further, the web server 104 can store the server IACs in a second database. The subsequent client requests can include client IACs, and the intermediary server 106 can validate the subsequent client requests based on comparing the client IACs to the server IACs.

[0058] According to some aspects of the method 500, each of the authentication credentials stored in the first database can include a username and a password. Further, the web server 104 can generate each of the server IACs by salting the username with a first salt to generate a salted username, salting the password with a second salt to generate a salted password, and hashing the salted username and the salted password to generate a hashed and salted username and a hashed and salted password, respectively.

[0059] According to some aspects of the method 500, the web server 104 can periodically generate updated server IACs. The web server 104 can generate each of the updated server IACs based on the updated first salt and the updated second salt. In one aspect, the web server 104 can periodically generate the updated server IACs at least once a day. In another aspect, the web server 104 can periodically generate the updated server IACs each time the web server 104 detects 504 an anomaly related to a client request.

[0060] According to some aspects of the method 500, the web server 104 detects that the anomaly is no longer present and instructs the intermediary server 106 to stop validating subsequent client requests. In another aspect, after instructing 506 the intermediary server 106 to validate subsequent client requests, the web server 104 instructs the intermediary server 106 to stop validating subsequent client requests based on a timer or a predetermined time period.

[0061] According to some aspects of the method 500, the intermediary server 106 comprises an ISP server For example the first ISP server 108, the second ISP server 110 Figure 1 ), a proxy server For example the proxy server 112, or a combination thereof.

[0062] According to some aspects of the method 500, the web server 104 can block subsequent client requests based on detecting the anomaly. For example, the web server 104 can block subsequent client requests for a predetermined time period. According to other aspects of the method 500, the web server can discard web traffic associated with client requests corresponding to the detected anomaly. For example, the web server 104 can forward the discarded web traffic to another server. A security personnel can analyze the discarded web traffic forwarded to the other server to determine a cause of the anomaly.

[0063] Figure 6 is a flowchart of a method 600 for protecting a web server from anomalous web traffic according to at least one aspect of the present disclosure. The method 600 can be performed by the web server 104 described herein with respect to FIG. 1. The method 600 can be performed by the web server 104 described herein with respect to FIG. 1. Figures 1-4described in any of the figures in relation to the web server 104. According to the method 600, the intermediary server 106 receives 602 a client request directed to the web server 104. The intermediary server 106 forwards 604 the client request to the web server. The intermediary server receives 606 instructions from the web server 104 to validate subsequent client requests. The instructions are based on a detected anomaly in relation to the client request. According to some aspects of the method 600, the web server detects the anomaly in relation to the client request. According to other aspects of the method 600, the intermediary server 106 detects the anomaly in relation to the client request.

[0064] Still referring to Figure 6 According to the method 600, the intermediary server 106 receives 608 a subsequent client request and validates 610 the subsequent client request. Further, the intermediary server 106 forwards 612 the validated subsequent client request to the web server 104.

[0065] According to some aspects of the method 600, the intermediary server 106 receives access to an Indirect Authentication Credential (IAC) database (116) associated with the web server 104. Further, the intermediary server 106 can validate 610 the subsequent client request based on the IAC database. For example Figure 3 According to some aspects of the method 600, the IAC database includes server IACs. Further, at least some of the subsequent client requests received 608 by the intermediary server 106 include client IACs. The intermediary server can validate 610 the subsequent client requests based on the IAC database by comparing the client IACs to the server IACs.

[0066] According to some aspects of the method 600, at least some of the subsequent client requests do not include client IACs. The intermediary server 106 can refrain from forwarding at least some of the subsequent client requests that do not include client IACs to the web server 104. For example, at least some of the subsequent client requests that do not include client IACs are sent to the intermediary server 106 by a botnet. By refraining from forwarding at least some of the subsequent client requests that do not include client IACs to the web server 104, the intermediary server 106 can prevent the web server 104 from being overwhelmed by requests from a botnet attempting to perform a DDoS attack on the web server 104.

[0067] According to some aspects of the method 600, at least some of the subsequent client requests do not include client IACs. The intermediary server 106 can refrain from forwarding at least some of the subsequent client requests that do not include client IACs to the web server 104. For example, at least some of the subsequent client requests that do not include client IACs are sent to the intermediary server 106 by a botnet. By refraining from forwarding at least some of the subsequent client requests that do not include client IACs to the web server 104, the intermediary server 106 can prevent the web server 104 from being overwhelmed by requests from a botnet attempting to perform a DDoS attack on the web server 104.

[0068] According to some aspects of the method 600, the intermediary server 106 comprises an ISP server. According to other aspects of the method 600, the intermediary server 106 comprises a proxy server.

[0069] Figure 7 A block diagram of a computer device 3000 including data processing subsystems or components according to at least one aspect of the disclosure. Figure 7 The subsystems in the figure are interconnected via a system bus 3010. Additional subsystems such as a printer 3018, a keyboard 3026, a fixed disk 3028 (or other memory coupled to the computer system), and a monitor 3022 coupled to display adapter 3020 are shown. These devices and other devices are interconnected by input / output (I / O) controller 3012 coupled to the system bus 3010. I / O controller 3012 can be a processor, or other suitable controller, as known in the art. Peripheral devices and input / output (I / O) devices, which couple to I / O controller 3012, can be connected to the computer system by any number of means known in the art, such as serial port 3024. For example, serial port 3024 or external interface 3030 can be used to connect the computer system to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus allows the central processor 3016 to communicate with each subsystem and to control the execution of instructions from system memory 3014 or the fixed disk 3028, as well as the exchange of information between subsystems. The system memory 3014 and / or the fixed disk 3028 can embody a computer readable medium.

[0070] Figure 8 FIG. 1 is a diagram of an example computing system 1000 including a host 1002 within which a set of instructions, for causing a device to perform any one or more of the methodologies discussed herein, can be executed. In various aspects, the host 1002 operates as a standalone device or can be connected (e.g., networked) to other machines in a networked environment. For example In a networked deployment, the host 1002 can operate in the capacity of a server or a client machine in server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The host 1002 can be a computer or a computing device, a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a web appliance, a network router, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, the host 1002 can be configured to function as a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. For exampleA portable hard disk audio device, such as a Moving Picture Experts Group Audio Layer 3 (MP3) player, a network appliance, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0071] Example system 4000 includes a host 4002 running a main operating system (OS) 4004 on one or more processors / processor cores 4006 For example (CPU), a graphics processing unit (GPU), or both), and various memory nodes 4008. Main OS 4004 can include a hypervisor 4010 that is capable of controlling functions and / or communicating with virtual machines ("VMs") 4012 running on machine-readable media. VMs 4012 can also include virtual CPUs or vCPUs 4014. Memory nodes 4008 can be linked or pinned to virtual memory nodes or vNodes 4016. When memory nodes 4008 are linked or pinned to corresponding vNodes 4016, data can then be mapped directly from memory nodes 4008 to corresponding vNodes 4016.

[0072] All of the individual components shown in host 4002 can be connected to and from each other, or communicate with each other, through a bus (not shown) or through other coupling or communication channels or mechanisms. Host 4002 can also include a video display, audio device or other peripheral devices 4018 For example (LCD), an alpha-numeric input device (including For example a keyboard), a cursor control device (including For example a mouse), a voice recognition or biometric verification unit, external drive, signal generation device For exampleThe host 4002 may include a speaker, a persistent storage device 4020 (also referred to as a disk drive unit), and a network interface device 4022. The host 4002 may also include a data encryption module (not shown) for encrypting data. The components disposed in the host 4002 are those commonly found in computer systems suitable for use with aspects of this disclosure, and are intended to represent a broad category of such computer components known in the art. Therefore, the system 4000 may be a server, a minicomputer, a mainframe computer, or any other computer system. The computer may also include different bus configurations, networking platforms, multiprocessor platforms, etc. Various operating systems may be used, including UNIX, LINUX, WINDOWS, QNX ANDROID, IOS, CHROME, TIZEN, and other suitable operating systems.

[0073] The disk drive unit 4024 may also be a solid-state drive (SSD), a hard disk drive (HDD), or other drive including a computer or machine-readable medium on which one or more sets of instructions and data structures embodying or utilizing any one or more of the methods or functions described herein are stored. For example Data / instructions 4026). Data / instructions 4026 may also reside wholly or at least partially within main memory node 4008 and / or processor 4006 during execution by host 4002. This can be achieved via several well-known transport protocols ( For example Network interface device 4022 of any of the Hypertext Transfer Protocol (HTTP) further sends or receives data / instructions 4026 through network 4028.

[0074] Processor 4006 and memory node 4008 may also include machine-readable media. The terms "computer-readable media" or "machine-readable media" should be considered as including a single medium or multiple media storing one or more sets of instructions. For exampleThe term "computer readable media" should be taken to include any medium that is deemed equivalently effective for the storage, encoding, or carrying of a set of instructions for execution by the host 4002 and that causes the host 4002 to perform any one or more of the methods of the present application. The term "computer readable media" should therefore be taken to include, but is not limited to, solid state memories, optical and magnetic media, and carrier wave signals. Such media can also include, but is not limited to, hard disks, floppy disks, flash memory cards, digital video disks, random access memories (RAMs), read only memories (ROMs), and the like. The exemplary aspects described herein can be implemented in an operating environment comprising software installed on a computer, in hardware, or in a combination of software and hardware.

[0075] Those skilled in the art will recognize that an internet service can be configured to provide internet access to one or more computing devices coupled to the internet service, and that the computing devices can include one or more processors, buses, memory devices, display devices, input / output devices, and the like. Moreover, those skilled in the art can appreciate that the internet service can be coupled to one or more databases, repositories, servers, and the like, which can be used to implement any of the various aspects of the present disclosure as described herein.

[0076] The computer program instructions can also be loaded onto a computer, server, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0077] For example, a suitable network can include any one or more or interface to any one or more of the following: a local intranet, a PAN (personal area network), a LAN (local area network), a WAN (wide area network), a MAN (metropolitan area network), a virtual private network (VPN), a storage area network (SAN), a frame relay connection, an advanced intelligent network (AIN) connection, a synchronous optical network (SONET) connection, a digital Tl, T3, El, or E3 line, a Digital Data Service (DDS) connection, a DSL (digital subscriber line) connection, an Ethernet connection, an ISDN (integrated services digital network) line, a dial-up port (e.g., V.90, V.34, or V.34bis), a cable modem, an ATM (asynchronous transfer mode) connection, or a FDDI (fiber digital dividend interface) or CDDI (copper digital dividend interface) connection. Furthermore, communications can also include links to any of a variety of wireless networks, including WAP (wireless application protocol), GPRS (general packet radio service), GSM (global system for mobile communication), CDMA (code division multiple access) or TDMA (time division multiple access), cellular phone networks, GPS (global positioning system), CDPD (cell digital packet data), RIM (working environment photo) duplex paging network, Bluetooth radio, or an IEEE 802.11 -based radio frequency network. The network 4028 can further include any one or more or interface to RS-232 serial connection, IEEE- 1394 (Firewire) connection, Fibre Channel connection, IrDA (infrared) port, SCSI (small computer system interface) connection, USB (universal serial bus) connection, or other wired or wireless, digital or analog, interface or connection, mesh or Digi® network connection.

[0078] Generally, a cloud-based computing environment is a resource that typically combines the processing power of a large group of processors (e.g., within a web server) and / or the storage capacity of a large group of computer memories or storage devices. A system that provides cloud-based resources can be utilized only by its owner, or such a system can be accessed by external users who deploy applications within the computing infrastructure to obtain the benefits of large computing or storage resources.

[0079] For example, a cloud is formed from a network of web servers that include a plurality of computing devices (e.g., hosts 4002), where each server 4030 (or at least a plurality thereof) provides processor and / or storage resources. These servers manage workloads provided by a plurality of users (e.g., cloud resource customers or other users). Example For example Typically, each user's workload demand on the cloud is changing in real time, sometimes greatly. The nature and extent of these changes typically depends on the type of business associated with the user.

[0080] Notably, any hardware platform suitable for performing the processing described herein is suitable for use with the technology. As used herein, the term "computer-readable storage medium" and "computer-readable storage media" refers to any one or more medium that participate in providing instructions to a CPU for execution. Such a medium can take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as a fixed, removable disk, or floppy disk. Volatile media includes dynamic memory, such as a system RAM. Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that comprise a bus. Transmission media can also take the form of acoustic or light waves, such as those generated during radio frequency (RF) and infrared (IR) data communications. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, any other magnetic medium, a CD-ROM, digital video disk (DVD), any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, an EPROM, a FLASH- EPROM, any other memory chip or cartridge, a carrier wave, or any other medium from which a computer can read.

[0081] Various forms of computer-readable media can be involved in carrying one or more sequences of one or more instructions to a CPU for execution. A bus can carry the data to a system RAM, from which a CPU retrieves and executes the instructions. The instructions received by system RAM can optionally be stored on a fixed disk either before or after execution by CPU.

[0082] Computer program code for carrying out operations for aspects of the present technology can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, Smalltalk, C++, or the like and conventional procedural programming languages, such as the "C" programming language, Go, Python, or another programming language, including assembly languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0083] Examples of the devices, systems, and methods are provided below in the following numbered clauses. An aspect of any device, method, and / or system of the (multiple) devices, methods, and / or systems can include any one or more of the following numbered clauses recited below and any combination thereof.

[0084] Clause 1 : A computer-implemented method comprising: receiving, by a web server via an intermediary server, a client request; detecting, by the web server, an anomaly related to the client request; instructing, by the web server, the intermediary server to validate a subsequent client request; and receiving, by the web server from the intermediary server, the validated subsequent client request.

[0085] Clause 2: The computer-implemented method of clause 1, further comprising: generating, by the web server, inter-server indirect authentication credentials (IACs) based on authentication credentials stored in a first database; storing, by the web server, the server IACs in a second database; and sharing, by the web server with the intermediary server, the second database, wherein the subsequent client request includes client IACs, and wherein the intermediary server validates the subsequent client request based on comparing the client IACs to the server IACs.

[0086] Clause 3: The computer-implemented method of clause 2, wherein each of the authentication credentials stored in the first database includes a username and a password, and wherein generating the server IACs includes, for each of the authentication credentials stored in the first database: salting, by the web server, the username using a first salt to generate a salted username; salting, by the web server, the password using a second salt to generate a salted password; hashing, by the web server, the salted username to generate a hashed and salted username; and hashing, by the web server, the salted password to generate a hashed and salted password.

[0087] Clause 4: The computer-implemented method of clause 3, further comprising: periodically generating, by the web server, updated server IACs, wherein each of the updated server IACs is generated based on an updated first salt and an updated second salt.

[0088] Clause 5: The computer-implemented method of clause 4, wherein periodically generating the updated server IACs includes generating the updated server IACs at least once per day.

[0089] Clause 6: The computer-implemented method of claim 4, wherein periodically generating the updated server IAC includes generating the updated server IAC based on the web server detecting a new anomaly related to the client request.

[0090] Clause 7: The computer-implemented method of any of clauses 1-6, wherein detecting the anomaly related to the client request includes detecting, by the web server, an increase in a volume of the client requests.

[0091] Clause 8: The computer-implemented method of any of clauses 1-7, wherein detecting the anomaly related to the client request includes analyzing, by an anomaly detection system of the web server, the client requests.

[0092] Clause 9: The computer-implemented method of any of clauses 1-8, further comprising: detecting, by the web server, that the anomaly is no longer present; and instructing, by the web server, the intermediary server to stop validating the subsequent client requests.

[0093] Clause 10: The computer-implemented method of any of clauses 1-9, wherein the intermediary server comprises an Internet Service Provider server or a proxy server or a combination thereof.

[0094] Clause 11 : A computer-implemented method comprising: receiving, by an intermediary server, a client request directed to a web server; forwarding, by the intermediary server, the client request to the web server; receiving, by the intermediary server from the web server, instructions to validate subsequent client requests, wherein the instructions are based on a detected anomaly related to the client request; receiving, by the intermediary server, the subsequent client requests; validating, by the intermediary server, the subsequent client requests; and forwarding, by the intermediary server, the validated subsequent client requests to the web server.

[0095] Clause 12: The computer-implemented method of clause 11, further comprising: receiving, by the intermediary server, access to an Indirect Authentication Credential (IAC) database associated with the web server, and wherein the intermediary server validates the subsequent client requests based on the IAC database.

[0096] Clause 13: The computer-implemented method of clause 12, wherein the IAC database comprises server IACs, wherein at least some of the subsequent client requests comprise client IACs, wherein the intermediary server verifies the subsequent client requests based on comparing the client IACs to the server IACs, and wherein the verified subsequent client requests correspond to at least some of the subsequent client requests that comprise the client IACs.

[0097] Clause 14: The computer-implemented method of clause 13, wherein at least some of the subsequent client requests do not comprise the client IACs, the method further comprising suppressing, by the intermediary server, forwarding at least some of the subsequent client requests that do not comprise the client IACs to the web server.

[0098] Clause 15: The computer-implemented method of clause 14, wherein at least some of the subsequent client requests that do not comprise the client IACs are sent to the intermediary server by a botnet.

[0099] Clause 16: The computer-implemented method of any of clauses 11-5, wherein the intermediary server comprises an internet server provider server or a proxy server or a combination thereof.

[0100] Clause 17: A web server comprising: a processor; and a memory comprising instructions executable by the processor to cause the processor to: generate an indirect authentication credential (IAC) based on an authentication credential associated with a user account; share the IAC with an intermediary server, wherein the intermediary server comprises an internet server provider server or a proxy server; detect an anomaly based on web traffic directed to the web server; instruct the intermediary server to verify subsequent web traffic directed to the web server based on the IAC; and receive, via the intermediary server, verified web traffic directed to the web server.

[0101] Clause 18: The web server of clause 17, wherein the instructions to cause the processor to detect the anomaly based on the web traffic directed to the web server comprise instructions to detect the anomaly based on an increase in an amount of the web traffic directed to the web server.

[0102] Clause 19: A web server as described in any one of Clauses 17 to 18, wherein the memory further includes instructions for performing the following operations: causing the processor to discard the web traffic destined for the web server based on the detection of the anomaly, and forwarding the discarded web traffic to another server to determine the cause of the detected anomaly.

[0103] Clause 20: A web server as described in any one of Clauses 17 to 19, wherein the authentication credentials associated with the user account include a token, wherein the instructions for causing the processor to generate the IAC based on the authentication credentials associated with the user account include instructions for salting the token, wherein the verified web traffic includes requests sent by the user device, and wherein said requests include the IAC.

[0104] Furthermore, it should be understood that any one or more of the forms, expressions, and examples described below may be combined with any one or more of the other forms, expressions, and examples described below.

[0105] While several forms have been shown and described, the applicant does not intend to limit or restrict the scope of the appended claims to such details. Many modifications, variations, alterations, substitutions, combinations, and equivalents of those forms can be implemented without departing from the scope of this disclosure, and such modifications, variations, alterations, substitutions, combinations, and equivalents will be apparent to those skilled in the art. Furthermore, the structure of each element associated with a said form can alternatively be described as a device for providing the function performed by said element. Additionally, where materials are disclosed for certain components, other materials may be used. Therefore, it should be understood that the foregoing description and the appended claims are intended to cover all such modifications, combinations, and variations falling within the scope of the disclosed forms. The appended claims are intended to cover all such modifications, variations, alterations, substitutions, modifications, and equivalents.

[0106] As used herein, a “server” can include one or more computing devices, which may be individual, independent machines located in the same or different locations, owned or operated by the same or different entities, and may further be one or more clusters of distributed computers or “virtual” machines housed within a data center. Those skilled in the art will understand and appreciate that the functionality performed by a single “server” may be distributed across multiple different computing devices for various reasons. As used herein, “server” is intended to refer to all such scenarios and should not be construed as or limited to a particular configuration. Furthermore, a server as described herein may, but does not necessarily, reside in (or be operated by) an agent of a merchant, payment network, financial institution, healthcare provider, social media provider, government agency, or any of the aforementioned entities. The term “server” may also refer to or include one or more processors or computers, storage devices, or similar computer arrangements that facilitate multi-party communication and processing through a network environment such as the Internet, but it should be understood that communication may be facilitated through one or more public or private network environments, and various other arrangements are possible. Additionally, multiple computers communicating directly or indirectly in a network environment ( For example Servers or other computerized devices For example Point-of-sale equipment can constitute a "system" (e.g., a merchant's point-of-sale system). As used herein, references to "server" or "processor" can refer to a previously stated server and / or processor, different servers and / or processors, and / or combinations of servers and / or processors, as described herein. For example, as used in the specification and claims, a first server and / or first processor stated to perform a first step or function can refer to the same or different servers and / or processors stated to perform a second step or function.

[0107] The term "system" can refer to one or more computing devices or a combination of computing devices. For example (This includes components such as processors, servers, client devices, software applications, modules, etc.). For example, a system may include multiple computing devices, which include software applications, and these multiple computing devices are connected via a network.

[0108] As used herein, a “server computer” can describe a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers acting in concert. The server computer can be associated with, for example, a payment processing network, a wallet provider, a merchant, an authentication cloud, an acquirer, or an issuer entity. In one example, the server computer can be a database server coupled with a web server. The server computer can be coupled to a database and can include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers. The server computer can comprise one or more computation means and can use any of a number of computer-structures, arrangements, and compilations for servicing the requests from one or more client computers. In some embodiments or aspects, the server computer can provide and / or support a payment network cloud service.

[0109] As used herein, references to “devices,” “servers,” “processors,” and the like can refer to the devices, servers, or processors of the previous recitation that stated to perform the previous step or function, a different server or processor, and / or a combination of servers and / or processors. For example, as used in the specification and claims, a first server or a first processor stated to perform a first step or a first function can refer to the same or different server or the same or different processor stated to perform a second step or a second function.

[0110] One or more components can be referred to herein as being “configured to,” “configurable to,” “operable / operable to,” “adapted to / adaptable to,” “capable of,” “suitable to / suitable for,” “as accessible to” and the like. Those skilled in the art will recognize that “configured to” can generally encompass active- state components and / or inactive-state components and / or pending-state components unless context requires otherwise.

[0111] Those skilled in the art will recognize that, in general, the terms used herein and especially in the appended claims (including the introductory clauses of the claims) are generally intended as “open” terms (e.g., the term “including” and “having” are typically used) to mean including but not limited to. For example Example ​The term "including" should be interpreted as "including but not limited to," the term "having at least," and the term "includes" should be interpreted as "including but not limited to," etc. Those skilled in the art will further understand that if a particular number of the introduced claim statements are intended, then such intent will be expressly stated in the claims, and where no such statement is present, such intent does not exist. For example, to aid understanding, the appended claims may contain the introductory phrases "at least one" and "one or more" to introduce the claim statement. However, the use of such phrases should not be construed as limiting any particular claim containing this introduced claim statement to containing only one such statement, even when the same claim includes the introductory phrases "one or more" or "at least one" and the indefinite article such as "one (a)" or "one (an)." For example For example "A (a)" and / or "an (an)" should generally be interpreted as meaning "at least one" or "one or more"; the same applies to the use of definite articles used to introduce the statement of a claim.

[0112] Unless otherwise stated, the terms “substantially,” “about,” or “approximately” as used in this disclosure mean an acceptable error in a particular value as determined by one of ordinary skill in the art, depending in part on how the value is measured or determined. In some aspects, the terms “substantially,” “about,” or “approximately” mean within 1, 2, 3, or 4 standard deviations. In some aspects, the terms “substantially,” “about,” or “approximately” mean within 50%, 20%, 15%, 10%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0113] Furthermore, even in claims that explicitly state a specific number, those skilled in the art will recognize that such statements should generally be interpreted as meaning at least the stated number ( For example In the absence of other modifiers, simply stating "two statements" generally means at least two statements, or two or more statements. Furthermore, in these cases where conventions such as "at least one of A, B, and C" are used, such a construction is generally expected by a person skilled in the art to reflect the meaning of the convention. For example“a system having at least one of A, B, and C” will include, but not be limited to, a system having A only, B only, C only, both A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). In these instances, as well as similar ones throughout this document, a phrase referring to “at least one of A, B, or C” refers to a system having A, B, C, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.) unless otherwise indicated. In other words, the use of either “or” or “and” in the ​ “a system having at least one of A, B, and C” will include, but not be limited to, a system having A only, B only, C only, both A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). In these instances, as well as similar ones throughout this document, a phrase referring to “at least one of A, B, or C” refers to a system having A, B, C, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.) unless otherwise indicated. In other words, the use of either “or” or “and” in the

[0114] With respect to the appended claims, those skilled in the art will appreciate that the operations therein generally can be performed in any order. Additionally, although various operational flow diagrams are presented in a sequence(s), it should be understood that the various operations can be performed in other orders than those which are illustrated, or can be performed concurrently, unless otherwise indicated herein. Examples of such alternative orderings can include overlapping, interleaved, interrupted, reordered, incremental, preparatory, supplemental, concurrent, reverse, switched, or other variant orderings, unless the context clearly indicates otherwise. Additionally, words like “responsive” or “related,” often mean “associated with” rather than causally related unless the context clearly indicates otherwise.

[0115] Notably, any reference to “one aspect,” “an aspect,” “one example,” “an example,” and the like means that a particular feature, structure, or characteristic described in connection with the aspect is included in at least one aspect. Thus, appearances of the phrases “in one aspect,” “in an aspect,” “in one example,” and “in an example” in various places throughout the specification are not necessarily all referring to the same aspect. Furthermore, the particular features, structures, or characteristics can be combined in any suitable manner in one or more aspects.

[0116] As used herein, the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise.

[0117] Any patent application, patent, non-patent publication, or other disclosure material cited in this specification is incorporated by reference herein to the extent that it is not inconsistent with the present disclosure and for all purposes to the same extent as if each such reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein. Furthermore, articles a / an and the are used herein as referring terms for one or more than one (i.e., in a singular or plural sense) of the cited items. Thus, unless the context clearly indicates otherwise, the use of a singular form of a term in this disclosure is intended to include the plural form of the term, and / or vice versa. To the extent that any meaning or definition of a term in this document conflicts with the meaning or definition of the same term in a document incorporated by reference, the meaning or definition assigned to that term in this document shall control.

[0118] In closing, many of the advantages of the present application have been described herein. The foregoing description has been presented for the purpose of illustration and description. It is not intended to be exhaustive or to limit the form of the application to the precise form disclosed. Modifications or variations are possible in light of the above teachings. The one or more forms described were chosen and described to provide the best illustration of the principles of the application and its practical application to thereby enable one of ordinary skill in the art to utilize the one or more forms in various forms and with various modifications as are suited to the particular use contemplated. Claims appended hereto are intended to define the overall scope of the application.

Claims

1. A computer-implemented method, comprising: The web server receives client requests via an intermediary server; The web server detects any anomalies related to the client request. The web server instructs the intermediary server to verify subsequent client requests; as well as The web server receives the verified subsequent client requests from the intermediary server.

2. The computer-implemented method as described in claim 1, further comprising: The web server generates server indirect authentication credentials (IAC) based on authentication credentials stored in the first database; The web server stores the server IAC in the second database; as well as The web server and the intermediary server share the second database, wherein the subsequent client request includes a client IAC, and wherein the intermediary server verifies the subsequent client request based on comparing the client IAC with the server IAC.

3. The computer-implemented method of claim 2, wherein each authentication credential in the authentication credentials stored in the first database includes a username and a password, and wherein generating the server IAC includes, for each authentication credential in the authentication credentials stored in the first database: The web server uses a first salt to salt the username to generate a salted username; The web server uses a second salt to salt the password to generate a salted password; The web server hashes the salted username to generate a hashed and salted username. as well as The web server hashes the salted password to generate a hashed and salted password.

4. The computer-implemented method as described in claim 3, further comprising: The web server periodically generates updated server IACs, wherein each updated server IAC is generated based on an updated first salt and an updated second salt.

5. The computer-implemented method of claim 4, wherein periodically generating the updated server IAC comprises generating the updated server IAC at least once a day.

6. The computer-implemented method of claim 4, wherein periodically generating the updated server IAC includes generating the updated server IAC based on the web server detecting a new exception related to the client request.

7. The computer-implemented method of claim 1, wherein detecting the anomaly associated with the client request includes the web server detecting an increase in the amount of the client request.

8. The computer-implemented method of claim 1, wherein detecting the anomaly associated with the client request comprises analyzing the client request by an anomaly detection system of the web server.

9. The computer-implemented method of claim 1, further comprising: The web server detects that the anomaly no longer exists; as well as The web server instructs the intermediary server to stop verifying subsequent client requests.

10. The computer-implemented method of claim 1, wherein the intermediary server includes an Internet service provider server or a proxy server or a combination thereof.

11. A computer-implemented method, comprising: The intermediary server receives client requests destined for the web server; The intermediary server forwards the client request to the web server; The intermediary server receives instructions from the web server to verify subsequent client requests, wherein the instructions are based on detected anomalies related to the client request; The intermediary server receives the subsequent client requests; The subsequent client request is verified by the intermediary server; as well as The intermediary server forwards the verified subsequent client requests to the web server.

12. The computer-implemented method of claim 11, further comprising: The intermediary server receives access to an Indirect Authentication Credentials (IAC) database associated with the web server, and the intermediary server verifies subsequent client requests based on the IAC database.

13. The computer-implemented method of claim 12, wherein the IAC database includes a server IAC, wherein at least some of the subsequent client requests in the subsequent client requests include a client IAC, wherein the intermediary server verifies the subsequent client requests based on comparing the client IAC with the server IAC, and wherein the verified subsequent client requests correspond to at least some of the subsequent client requests that include the client IAC.

14. The computer-implemented method of claim 13, wherein at least some of the subsequent client requests in the subsequent client requests do not include the client IAC, the method further comprising the intermediary server suppressing the forwarding of at least some of the subsequent client requests that do not include the client IAC to the web server.

15. The computer-implemented method of claim 14, wherein at least some of the subsequent client requests, excluding the client IAC, are sent to the intermediary server by a botnet.

16. The computer-implemented method of claim 11, wherein the intermediary server includes an Internet server provider server or a proxy server or a combination thereof.

17. A web server, comprising: processor; as well as The memory includes instructions executable by the processor to cause the processor to perform the following operations: Indirect authentication credentials (IAC) are generated based on authentication credentials associated with the user account. The IAC is shared with an intermediary server, wherein the intermediary server includes an Internet server provider server or a proxy server; Anomalies are detected based on web traffic directed to the web server; The intermediary server is instructed to verify subsequent web traffic directed to the web server based on the IAC. and The verified web traffic destined for the web server is received via the intermediary server.

18. The web server of claim 17, wherein the instructions for causing the processor to detect the anomaly based on the web traffic directed to the web server include instructions for detecting the anomaly based on an increase in the amount of web traffic directed to the web server.

19. The web server of claim 17, wherein the memory further includes instructions for performing the following operations: causing the processor to discard the web traffic destined for the web server based on the detection of the anomaly, and forwarding the discarded web traffic to another server to determine the cause of the detected anomaly.

20. The web server of claim 17, wherein the authentication credentials associated with the user account include a token, wherein the instructions for causing the processor to generate the IAC based on the authentication credentials associated with the user account include instructions for salting the token, wherein the verified web traffic includes requests sent by the user device, and wherein the requests include the IAC.

Images