System and method for exacting a system resource access cost

• US 7,143,163 B1
• Filed: 07/26/2000
• Issued: 11/28/2006
• Est. Priority Date: 07/26/2000
• Status: Active Grant

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Bleichenbacher, Daniel, Jakobsson, Bjorn M.
• Primary Examiner(s): Winder, Patrice L.
• Application Number:
  US09/625,817
• Time in Patent Office: 2,316 Days
• Field of Search: 709/229, 709/228, 705/27, 705/75, 705/77, 705/80, 705/37, 713/201, 713/181, 707/7, 707/6, 707/2, 707/4, 707/101, 707/3, 707/5, 704/9, 704/2, 704/8, 714/26, 714/47, 706/16, 726/3, 726/6
• US Class Current: 709/225
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A system for, and method of, controlling access to a resource of a computer system. In one embodiment, the system includes: (1) a database of problems and corresponding precalculated solutions, (2) a problem retriever that responds to a request from a client for access to the resource by retrieving one of the problems from the database and transmitting the one of the problems to the client and (3) a solution evaluator that, upon receiving a putative solution from the client, employs the database to validate the putative solution and, if the putative solution is valid, grants the client access to the resource.

Claims

1. A system for controlling access to a resource of a computer system, comprising:

a database of problems and corresponding precalculated solutions;

a problem retriever that responds to a request from a client for access to said resource by retrieving one of said problems from said database and transmitting said one of said problems to said client without allocating resources of said computer system, wherein said problems and said corresponding precalculated solutions exist before said request; and

a solution evaluator that, upon receiving a putative solution from said client, employs said database to validate said putative solution and, if said putative solution is valid, grants said client access to said resource.

2. The system as recited in claim 1 wherein said problems comprise outputs and portions of corresponding inputs to a one-way function.

3. The system as recited in claim 2 wherein said one-way function is a Message Digest-5 function.

4. The system as recited in claim 1 wherein said problem retriever replaces said one of said problems and a corresponding one of said solutions when said putative solution is valid.

5. The system as recited in claim 1 wherein said problem retriever replaces said one of said problems and a corresponding one of said solutions only when said putative solution is valid.

6. The system as recited in claim 1 wherein said solution evaluator grants said client access to said resource by allocating memory associated with said resource to serve said client.

7. The system as recited in claim 1 wherein said resource is selected from the group consisting of:

a network server,

an electronic mail server, and

a main database.

8. The system as recited in claim 1 wherein said problem retriever retrieves said problem employing a pointer and transmits said pointer with said problem to said client and said solution evaluator receives said pointer with said putative solution and employs said pointer for validating said putative solution.

9. The system as recited in claim 1 wherein said problems are independent of said client.

10. A method of controlling access to a resource of a computer system, comprising:

creating a database of problems and corresponding precalculated solutions;

responding to a request from a client for access to said resource by retrieving one of said problems from said database and transmitting said one of said problems to said client without allocating resources of said computer system, wherein said problems and said corresponding precalculated solutions exist before said request;

upon receiving a putative solution from said client, employing said database to validate said putative solution; and

if said putative solution is valid, granting said client access to said resource.

11. The method as recited in claim 10 wherein said problems comprise outputs and portions of corresponding inputs to a one-way function.

12. The method as recited in claim 11 wherein said one-way function is a Message Digest-5 function.

13. The method as recited in claim 10 further comprising replacing said one of said problems and a corresponding one of said solutions when said putative solution is valid.

14. The method as recited in claim 10 further comprising replacing said one of said problems and a corresponding one of said solutions only when said putative solution is valid.

15. The method as recited in claim 10 wherein said granting comprises allocating memory associated with said resource to serve said client.

16. The method as recited in claim 10 wherein said resource is selected from the group consisting of:

a network server,

an electronic mail server, and

a main database.

17. The method as recited in claim 10 further comprising employing a pointer for said retrieving and transmitting said pointer with said problem to said client and receiving said pointer with said putative solution and employing said pointer for said validating.

18. The method as recited in claim 10 wherein said problems are independent of said client.