Obfuscating HTTP URLs to Block Bot Random Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing protocols for accessing resources are vulnerable to unauthorized access by malicious entities or bots, which can lead to the exposure of sensitive information, as they fail to provide adequate protection against random access attempts.
Innovation Solution
Implementing a system and method that involves a device intermediary between clients and servers, which obfuscates URLs in responses by removing path or directory structure information, and uses client identifiers to validate requests, ensuring only valid requests are processed by the server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If URL information is provided in clear form in HTTP responses, then clients can access resources easily, but malicious entities and bots can obtain directory structure information and perform unauthorized random access
Solution Approach 1:
The patent introduces an intermediary component (ADC - Application Delivery Controller) that sits between the web server and clients. This intermediary obfuscates URL information in HTTP responses by replacing it with randomized strings, preventing bots from obtaining directory structure information while still allowing legitimate clients to access resources through the intermediary's guidance
Solution Approach 2:
The patent changes the form of URL information from clear, structured paths to randomized, obfuscated strings. By transforming the representation of resource locations and removing directory structure information, the system maintains functionality for legitimate users while depriving bots of the structural information they need for random access attacks
2Reliability
If protective mechanisms are configured at points of entry, then authorized users can access resources, but the system fails to provide adequate protection against random access attempts by attackers
Solution Approach 1:
The patent applies protective measures in advance by obfuscating URL information in all HTTP responses before they reach clients. This preliminary action ensures that even if bots attempt random access, the directory structure information is already hidden, providing proactive protection rather than reactive blocking
Solution Approach 2:
The ADC acts as a smart intermediary that provides intelligence-based protection. It analyzes and obfuscates URL information selectively, maintaining protection against random access while preserving legitimate user experience, thereby achieving reliable security without excessive system complexity
3Object-affected harmful factors
If all URL information is obfuscated to prevent bot access, then security is improved, but legitimate clients may experience difficulty navigating to resources
Solution Approach 1:
The patent applies different treatments to different types of clients. Legitimate clients receive guidance through the intermediary's session management and cookie-based tracking, while bots receive only obfuscated URLs. This localized quality ensures that security obfuscation does not hinder legitimate users who have established trusted sessions
4Reliability
If directory structure information is removed from URLs, then bots cannot perform random access, but the system requires additional processing to maintain session state
Solution Approach 1:
The patent uses cookie-based session management where the ADC copies and tracks session state information client-side. This allows the system to maintain session continuity without storing extensive state information on the server, reducing memory overhead while providing robust protection against random access attempts
Data Source
AI summary
Described embodiments provide systems and methods for preventing unauthorized access of information from a resource. A device intermediary between a client and a server in a session can receive a first request from the client that includes a first uniform resource locator (URL) of the server. The device may receive a response from the server that includes a second URL. The device may update the response by including a client identifier for the session in a set-cookie field, obfuscating the second URL into a string, and replacing the second URL in the response with the string. The device may receive a second request that includes a candidate client identifier, and a third URL. The device may determine whether the second request is valid, by at least one of: matching the candidate client identifier with the client identifier, and determining whether the second URL is recoverable using the third URL.