Management of dynamic credentials

• US 9,716,702 B2
• Filed: 06/14/2015
• Issued: 07/25/2017
• Est. Priority Date: 05/29/2014
• Status: Active Grant

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Varadarajan, Subramanian, Call, Justin, Hanks, Bryan
• Primary Examiner(s): Abyaneh, Ali
• Application Number:
  US14/738,913
• Publication Number:
  US 20150350181A1
• Time in Patent Office: 772 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 9/008 involving homomorphic encryption
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

In an embodiment, a method comprises intercepting, from a first computer, a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent if executed by a client computer; modifying the first set of instructions to produce a modified set of instructions, which are configured to cause a credential to be included in the one or more requests sent if executed by the client computer; rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing-instructions, wherein the one or more credential-morphing-instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the credential over time if executed; sending the second set of instructions to a second computer.

Claims

1. A method comprising:

generating a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent to a server computer when executed by a client computer;

generating a dynamic credential to be sent to the client computer;

modifying the first set of instructions to produce a modified set of instructions, which are configured to cause the dynamic credential to be included in the one or more requests sent from the client computer when executed by the client computer;

rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the dynamic credential over time when executed;

sending the second set of instructions and the dynamic credential to a particular computer; and

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

receiving a request for data; and

performing a negative responsive action in response to determining the request does not include a valid credential.

3. The method of claim 1 further comprising:

receiving a request for data at a particular time, wherein the request includes the dynamic credential and the dynamic credential corresponds with one or more parameters; and

performing a negative responsive action in response to determining that the one or more parameters are not satisfied based, at least in part, on the particular time.

4. The method of claim 3, wherein performing the negative responsive action comprises sending a configurable response that indicates the request was invalid.

5. The method of claim 1 further comprising:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining that the one or more parameters associated with the dynamic credential are satisfied, and in response;

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request from the particular computer, which includes the new dynamic credential, for data on the server computer; and

sending the data to the particular computer in response to determining the one or more new parameters associated with the new dynamic credential are satisfied.

6. The method of claim 1 further comprising:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining the one or more parameters associated with the dynamic credential are satisfied, and in response;

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the server computer; and

terminating the second request in response to determining the one or more new parameters associated with the new dynamic credential are not satisfied.

7. The method of claim 1, wherein the dynamic credential comprises one or more encrypted parameters, and the method further comprising:

receiving a first request wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response;

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request from the particular computer, which includes the new dynamic credential, for data from the server computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

sending the data to the particular computer in response to determining that the one or more new decrypted parameters are satisfied.

8. The method of claim 1 further comprising:

generating the dynamic credential, which comprises one or more encrypted parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response;

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the server computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

terminating the second request in response to determining that the one or more new decrypted parameters are not satisfied.

9. The method of claim 1 further comprising:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data, from the particular computer, that comprises a modified first dynamic credential; and

sending the data to the particular computer in response to determining that the modified first dynamic credential is valid.

10. The method of claim 1 further comprising:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

terminating the request in response to determining that the modified first dynamic credential is not valid.

11. A computer comprising:

a processor;

non-transitory storage media storing instructions which, when executed by the processor, cause;

generating a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent to the computer when executed by a client computer;

generating, at the computer, a dynamic credential to be sent to the client computer;

modifying the first set of instructions to produce a modified set of instructions, which are configured to cause the dynamic credential to be included in the one or more requests sent from the client computer when executed by the client computer;

rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the dynamic credential received from the computer over time when executed; and

sending the second set of instructions and the dynamic credential to a particular computer.

12. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

receiving a request for data; and

performing a negative responsive action in response to determining the request does not include a valid credential.

13. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

receiving a request for data at a particular time, wherein the request includes the dynamic credential and the dynamic credential corresponds with one or more parameters; and

performing a negative responsive action in response to determining that the one or more parameters are not satisfied based, at least in part, on the particular time.

14. The computer of claim 13, wherein performing the negative responsive action comprises sending a configurable response that indicates the request was invalid.

15. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining that the one or more parameters associated with the dynamic credential are satisfied, and in response;

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, from the particular computer for data from the computer; and

sending the data to the particular computer in response to a determination that the one or more new parameters associated with the dynamic credential are satisfied.

16. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining the one or more parameters associated with the dynamic credential are satisfied, and in response;

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer; and

terminating the second request in response to determining the one or more new parameters associated with the new dynamic credential are not satisfied.

17. The computer of claim 11, wherein the dynamic credential comprises one or more encrypted parameters, and the instructions, when executed by the processor, further cause:

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response;

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

sending the data to the particular computer in response to a determination that the one or more new decrypted parameters associated with the dynamic credential are satisfied.

18. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

generating the dynamic credential, which comprises one or more encrypted parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response;

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

terminating the second request in response to determining that the one or more new decrypted parameters are not satisfied.

19. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

producing the modified set of instructions by adding a seed value; and

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

sending the data to the particular computer in response to a determination that the modified first dynamic credential is valid.

20. The computer of claim 11, wherein the instructions, when executed by the processor, further cause:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

terminating the request in response to determining that the modified first dynamic credential is not valid.