Encrypted Web Interstitials for Low-Latency Bot Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web and mobile applications face significant challenges in distinguishing between legitimate human traffic and malicious automation, leading to ineffective security measures that introduce user friction or delay, such as CAPTCHA, which are easily bypassed by scrapers, and existing interstitial techniques cause undesirable delays.
Innovation Solution
Implementing encrypted interstitial techniques that serve an interstitial page with an encrypted webpage portion and unencrypted link tags, allowing sub-resources to be downloaded while collecting telemetry data and performing threat analysis, reducing user friction by enabling quick access upon authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an interstitial page is used to perform threat analysis and collect telemetry data, then web security is improved, but user experience deteriorates due to loading delays
Solution Approach 1:
The patent applies preliminary action by pre-loading the interstitial page HTML and sub-resources into the client cache before the threat analysis completes. The instrumentation code is executed in advance to collect telemetry data, while the main content is prepared and cached. When authorization is granted, the decryption key is provided and the pre-loaded content is immediately rendered, eliminating the perception of delay for the user.
Solution Approach 2:
The patent uses an intermediary approach by introducing an interstitial page as a mediator between the user's request and the protected resource. This interstitial page serves multiple functions: it collects telemetry data, performs threat analysis, and simultaneously pre-loads necessary resources. The intermediary page acts as a buffer that handles security verification without blocking the user experience, as resources are prepared in the background during this intermediary phase.
2Reliability
If multiple network requests are made for threat analysis and resource loading, then security verification is improved, but network efficiency deteriorates
Solution Approach 1:
The patent applies preliminary action by making network requests for sub-resources and executing instrumentation code to collect telemetry data in parallel before the final authorization decision. Instead of sequential requests that would block each other, the system pre-loads CSS, JavaScript, and other sub-resources while simultaneously gathering security telemetry, consolidating multiple network operations into overlapping parallel executions that complete faster.
Solution Approach 2:
The patent maintains continuity of useful action by ensuring that network requests for sub-resources continue uninterrupted during the threat analysis phase. The interstitial page is designed to load essential resources in the background while security verification proceeds, so that when authorization is granted, the resources are already available or nearly available, eliminating idle waiting time and maintaining continuous productive network utilization.
3Measurement precision
If telemetry data collection and threat analysis are performed before authorization, then fraud detection is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by executing instrumentation code in advance to collect comprehensive telemetry data including browser environment information, device characteristics, and behavioral metrics before the authorization decision is made. This preliminary data collection phase occurs concurrently with resource pre-loading, so while security analysis is thorough and precise, the user perceives no delay because resources are being prepared simultaneously in the background.
Solution Approach 2:
The patent implements partial action by collecting only the essential telemetry data needed for fraud detection rather than comprehensive analysis of all possible parameters. The instrumentation code gathers key metrics such as browser user agent, device information, and basic behavioral patterns that are sufficient for effective threat analysis, avoiding excessive data collection that would prolong processing time without significantly improving detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, non-transitory computer readable medium, device and system intercepts a request for a webpage including a protected resource. The request is sent from a client device to a server device. One or more link tags or other mechanisms corresponding to one or more sub-resources included in the webpage are generated. The webpage is encrypted. An interstitial page is served to the client device that includes an encrypted portion that includes the encrypted webpage, an unencrypted portion that includes the link tags, and instrumentation code that collects telemetry data when executed at the client device. The telemetry data is received from the client device and a threat analysis is performed on the telemetry data. A decryption key is transmitted to the client device in response to determining that the request is allowed, based on the performed threat analysis. The decryption key allows the client device to decrypt the encrypted webpage.