Integrated user challenge presentation for DDoS mitigation service

• US 10,348,760 B2
• Filed: 10/22/2012
• Issued: 07/09/2019
• Est. Priority Date: 10/22/2012
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Teodoro, Mark, Leach, Sean
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US13/657,083
• Publication Number:
  US 20140115669A1
• Time in Patent Office: 2,451 Days
• Field of Search: 713168-174, 713182-186, 713202, 729225, 729229, 726 2- 8, 709225, 709229
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Systems and methods are disclosed for providing distributed denial-of-service (DDoS) mitigation service. The systems and methods may receive a request to access a web server from a user host, generate an integrated user challenge page including a user challenge test and a web page image of the web server, and transmits the integrated user challenge page to the user host. The systems and methods may further receive an answer to the user challenge test from the user host, determine whether the answer to the user challenge test is correct or not. When the answer to the user challenge test is correct, the systems and methods may establish a connection between the user host and the web server.

Claims

1. A system for providing distributed denial-of-service (DDoS) mitigation service, the system comprising:

a memory storing instructions;

a processor, operably connected to the memory, that executes the instructions to perform operations comprising;

receiving, from a web server, an image of a web page of the web server;

intercepting, from a user device, a request to access the web server;

generating an integrated user challenge page comprising a user challenge test and the image of the web page, wherein the image of the web page comprises an image of at least a portion of the web page;

transmitting, prior to establishing any connection between the user device and the web server, the integrated user challenge page to the user device;

processing an answer to the user challenge test received from the user device; and

determining whether the answer is correct.

2. The system of claim 1, wherein the user challenge test is overlaid on and at least partially obscures the image of the web page.

3. The system of claim 1, wherein the image of the web page is blurred in the integrated user challenge page.

4. The system of claim 1, wherein the image of the web page is a static web page.

5. The system of claim 1, wherein the image of the web page is a rendered web page.

6. The system of claim 1, wherein the system further includes instructions that perform operations comprising:

receiving the image of the web page when the system is initialized; and

storing the received web page image in the memory.

7. The system of claim 6, wherein the system further includes instructions that perform operations comprising refreshing the image of the web page.

8. The system of claim 7, wherein the refreshing the image of the web page comprises refreshing the image of the web page at a configurable interval.

9. The system of claim 7, wherein the refreshing the web page image comprises refreshing the image of the web page at a specified time.

10. The system of claim 7, wherein the refreshing the web page image comprises refreshing the image of the web page when a change is observed in a sampled response traffic.

11. The system of claim 7, wherein the refreshing the web page image comprises refreshing the image of the web page on demand by a request.

12. The system of claim 1, wherein the generating the user challenge test only when the user device requesting to access the web server has one of a plurality of predetermined IP addresses.

13. The system of claim 1, wherein the system further includes instructions that perform operations comprising:

determining a type of a browser used by the user device; and

generating the integrated user challenge page in accordance with the browser type of the user device.

28. The system of claim 1, wherein the user challenge test is in front of a transparent or semitransparent version of the web page that the user device is requesting to access.

29. The system of claim 1, wherein the image of the web page comprises a blurred version of the image of at least a portion of the web page that the user device is requesting to access.

30. The system of claim 1, wherein the image of the web page comprises a generic version of the image of at least a portion of the web page that the user device is requesting to access.

31. The system of claim 1, wherein:

the system comprises a distributed denial-of-service (DDoS) mitigation server;

the DDoS mitigation server is separate from the web server and external to the web server;

the request to access the web server is directed to the web server;

the image of the web page in the integrated user challenge page generated by the DDoS mitigation server appears to be displayed by the web server to which the user device requested access; and

the user challenge test in the integrated user challenge page generated by the DDoS mitigation server appears to be presented on the web page of the web server that the user device requested access.

14. A computer-implemented method for providing distributed denial-of-service (DDoS) mitigation service, the method comprising:

receiving, from a web server, a web page image;

intercepting, from a user device, a request to access the web server;

receiving a request to access a web server from a user device;

generating an integrated user challenge page including a user challenge test and the web page image, wherein the web page image comprises an image of at least a portion of a web page that the user device is requesting to access;

transmitting, prior to establishing any connection between the user device and the web server, the integrated user challenge page to the user device;

receiving an answer to the user challenge test from the user device; and

determining whether the answer to the user challenge test is correct.

15. The computer-implemented method of claim 14, wherein the user challenge test is overlaid on the web page image in the integrated user challenge page.

16. The computer-implemented method of claim 14, wherein the web page image is blurred in the integrated user challenge page.

17. The computer-implemented method of claim 14, wherein the web page image is a static web page.

18. The computer-implemented method of claim 14, wherein the web page image is a rendered web page.

19. The computer-implemented method of claim 14, further comprising receiving the web page image, and storing the received web page image in the memory.

20. The computer-implemented method of claim 19, further including refreshing the web page image stored in the memory.

21. The computer-implemented method of claim 20, wherein the web page image is refreshed at a configurable interval.

22. The computer-implemented method of claim 20, wherein the web page image is refreshed at a specified time.

23. The computer-implemented method of claim 20, wherein the web page image is refreshed when a change is observed in sampled response traffic.

24. The computer-implemented method of claim 20, wherein the web page image is refreshed on demand by a request.

25. The computer-implemented method of claim 14, further including:

determining whether an IP address of the user device belongs to a plurality of predetermined IP addresses; and

generating the integrated user challenge page only when the IP address of the user device belongs to the plurality of predetermined IP addresses.

26. The computer-implemented method of claim 14, further including:

determining a type of a browser used by the user device; and

generating the integrated user challenge page in accordance with the browser type of the user device.

27. A non-transitory computer readable medium comprising:

instructions for providing distributed denial-of-service (DDoS) mitigation service that, when executed by one or more processors, control the one or more processors to;

receive, from a web server, a web page image;

receive a request to access the web server from a user device;

generate an integrated user challenge page including a user challenge test and the web page image of the web server, wherein the web page image comprises an image of at least a portion of a web page that the user device is requesting to access;

transmit, prior to establishing any connection between the user device and the web server, the integrated user challenge page to the user device;

receive an answer to the user challenge test from the user device; and

determine whether the answer to the user challenge test is correct.