Selectively protecting valid links to pages of a web site

• US 9,621,583 B2
• Filed: 10/27/2015
• Issued: 04/11/2017
• Est. Priority Date: 05/29/2014
• Status: Expired due to Fees

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Varadarajan, Subramanian, Call, Justin
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US14/923,603
• Publication Number:
  US 20160050231A1
• Time in Patent Office: 532 Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In an embodiment, a method comprises intercepting, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link; determining that the first link, which references a first target page, is protected; in response to determining the first link is protected: generating a first decoy link that corresponds to the first link, wherein the first decoy link includes data that references a first decoy page which includes false information; rendering a second set of instructions that defines the first decoy link, wherein the second set of instructions is configured to cause a first client computer to hide the first decoy link from the user interface; sending the second set of instructions to the first client computer.

Claims

1. A method comprising:

intercepting, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link;

determining that the first link references a first target page;

determining that the first target page is protected;

in response to determining the first target page is protected, generating a first decoy link that corresponds to the first link;

wherein the first decoy link includes data that references a first decoy page and not the first target page, wherein the first decoy page includes false information;

rendering a second set of instructions define the first decoy link, wherein the second set of instructions are configured to cause a first client computer to hide the first decoy link from the user interface;

sending the second set of instructions to the first client computer;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

intercepting, from the server computer, a third set of instructions that defines the first link;

determining that the first link references the first target page;

determining that the first target page is protected;

in response to determining the first target page is protected, generating a second decoy link that includes data that references a second decoy page and not the first target page, wherein the second decoy link is different than the first decoy link;

rendering a fourth set of instructions define the second decoy link, which is configured to cause the first client computer to hide the second decoy link from the user interface;

sending the fourth set of instructions to the first client computer.

3. The method of claim 1 further comprising:

receiving, from the first client computer, a first request indicating that the first decoy link was selected;

in response to determining the first decoy link was selected, generating a decoy page with one or more decoy links, which when selected generate an additional request for an additional decoy page with one or more additional decoy links;

sending, to the first client computer, the decoy page.

4. The method of claim 1, wherein the first decoy link includes a key, and the method further comprising:

storing the key indicating that the key is invalid;

receiving, from the first client computer, a first request with the key indicating the first decoy link was selected;

determining the key is invalid;

in response to determining that the key is invalid, generating a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

sending the first target page to the first client computer.

5. The method of claim 1 further comprising:

in response to determining the first target page is protected, generating a first protected link that corresponds to the first link and is different than the first decoy link;

wherein the first protected link is different than the first link and includes a key that authenticates a first request that has been generated based on the first protected link and that references the first target page.

6. The method of claim 5, wherein the second set of instructions are configured to cause a first client computer to display the first protected link in the user interface.

7. The method of claim 5 further comprising:

storing the key indicating that the key is valid;

receiving, from the first client computer, the first request with the key indicating the first protected link was selected;

determining the key is valid;

in response to determining the key is valid, sending a second request to the server computer for a set of valid data to generate the first target page;

generating the first target page with the set of valid data;

sending the first target page to the first client computer.

8. The method of claim 7 further comprising:

invalidating the key;

receiving, from a second client computer, a third request with the key;

determining that the key is invalid;

in response to determining that the key is invalid, generating a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

sending, to the second client computer, the decoy page.

9. The method of claim 8, wherein the first client computer and the second client computer are a single computer.

10. A computer system comprising:

a processor;

a memory;

a processing module configured to;

intercept, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link;

determine that the first link references a first target page;

determine that the first target page is protected;

in response to determining the first target page is protected, generate a first decoy link that corresponds to the first link;

wherein the first decoy link includes data that references a first decoy page and not the first target page, wherein the first decoy page includes false information;

render a second set of instructions define the first decoy link, wherein the second set of instructions are configured to cause a first client computer to hide the first decoy link from the user interface;

send the second set of instructions to the first client computer.

11. The computer system of claim 10, wherein the processing module is further configured to:

intercept, from the server computer, a third set of instructions that defines the first link;

determine that the first link references the first target page;

determine that the first target page is protected;

in response to determining the first target page is protected, generate a second decoy link that includes data that references a second decoy page and not the first target page, wherein the second decoy link is different than the first decoy link;

render a fourth set of instructions define the second decoy link, which is configured to cause the first client computer to hide the second decoy link from the user interface;

send the fourth set of instructions to the first client computer.

12. The computer system of claim 10, wherein the processing module is further configured to:

receive, from the first client computer, a first request indicating that the first decoy link was selected;

in response to determining the first decoy link was selected, generate a decoy page with one or more decoy links, which when selected generate an additional request for an additional decoy page with one or more additional decoy links;

sending, to the first client computer, the decoy page.

13. The computer system of claim 10 comprising a storage, wherein the first decoy link includes a key and the processing module is further configured to:

store the key indicating that the key is invalid;

receive, from the first client computer, a first request with the key indicating the first decoy link was selected;

determine the key is invalid;

in response to determining that the key is invalid, generate a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

send the first target page to the first client computer.

14. The computer system of claim 13, wherein the processing module is further configured to:

in response to determining the first target page is protected, generate a first protected link that corresponds to the first link and is different than the first decoy link;

wherein the first protected link is different than the first link and includes a key that authenticates a first request that has been generated based on the first protected link and that references the first target page.

15. The computer system of claim 14, wherein the second set of instructions are configured to cause a first client computer to display the first protected link in the user interface.

16. The computer system of claim 14 comprising a storage, wherein the processing module is further configured to:

store the key indicating that the key is valid;

receive, from the first client computer, the first request with the key indicating the first protected link was selected;

determine the key is valid;

in response to determining the key is valid, send a second request to the server computer for a set of valid data to generate the first target page;

generate the first target page with the set of valid data;

send the first target page to the first client computer.

17. The computer system of claim 16, wherein the processing module is further configured to:

invalidate the key;

receive, from a second client computer, a third request with the key;

determine that the key is invalid;

in response to determining that the key is invalid, generate a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

send, to the second client computer, the decoy page.

18. The computer system of claim 17, wherein the first client computer and the second client computer are a single computer.