API Filtering via Unique Endpoint Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in effectively distinguishing between authorized and unauthorized API call requests, particularly in preventing automated attacks that exploit automated access to network resources, leading to economic feasibility for attackers despite high volumes of attempts.
Innovation Solution
An API call filtering system that requires personalized API calls with a unique endpoint identifier (UEID) for each request, verifying user devices through a Public Key Infrastructure (PKI) key pair and challenge messages, and implementing rate limits and out-of-band verification processes to differentiate between legitimate and excessive request iterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional filtering methods are used to block unwanted traffic, then some unauthorized requests are blocked, but automated attackers can still mount cost-effective attacks by sending high volumes of requests
Solution Approach 1:
The patent segments the API access control by introducing device-specific endpoint identifiers (UEIDs) that uniquely identify each user device. This segmentation allows the system to track and control requests at the device level rather than using generic filtering, enabling more precise differentiation between authorized and unauthorized traffic while maintaining system productivity
Solution Approach 2:
The patent implements preliminary action by requiring devices to obtain UEIDs before accessing protected APIs. The endpoint identifier is established in advance and verified with each request, allowing the system to proactively block unauthorized devices before they can mount attacks, rather than reacting to high-volume request patterns after they occur
2Object-affected harmful factors
If rate limiting is applied to prevent automated attacks, then attack volumes are reduced, but legitimate high-volume API usage may be blocked
Solution Approach 1:
By segmenting rate limiting to the device level using UEIDs, the system can apply different rate limits to different devices. Authorized devices with valid UEIDs receive appropriate rate limits that prevent attacks while allowing legitimate usage, whereas unauthorized devices are blocked regardless of their request patterns
Solution Approach 2:
The system uses feedback by monitoring request patterns from each UEID and dynamically adjusting responses. Devices exhibiting attack patterns receive blocking actions, while devices with legitimate usage patterns continue access, allowing the system to adapt to different usage scenarios without manual intervention
3Measurement precision
If device identification is implemented to differentiate authorized and unauthorized requests, then attack filtering improves, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary component that handles UEID verification and device identification. This intermediary layer manages the complexity of device identification and rate limiting logic, keeping the core API service simple while enabling precise request source identification through the UEID verification mechanism
Data Source
AI summary
An API call filtering system filters responses to API call requests received, via a network, from user devices. The API call filtering system is configured to require personalized API call requests wherein each API call (except for some minor exceptions) includes a unique endpoint identifier (“UEID”) of the user device making the request. Using the UEID, the web service or other service protected by the API call filtering system can be secured against excessive request iterations from a set of rogue user devices while allowing for ordinary volumes of requests of requests the user devices, wherein one or more boundaries between what is deemed to be an ordinary volume of requests and what is deemed to be excessive request iterations are determined by predetermined criteria.