Packet watermark with dynamic token validation

1 . A system for mitigating a threat associated with network data packets, the system comprising:

an authentication server comprising at least one memory and at least one hardware processor, that:

receives, from a client, a request for access to a first server; and

authenticates the client, the authentication including providing an authentication token to the client; and

a mitigation device that:

receives, from the client, at least one network packet directed to the first server, the at least one network packet embedding the authentication token in a payload of the at least one network packet;

validates authenticity of the authentication token; and

based on the validation, selectively forwards the at least one network packet to the first server, wherein the authentication token is unique for each network packet;

the system further comprising an administrative module resident in at least one memory and executed by at least one processor, the administrative module configured to provide a shared token generation algorithm and a salt-prefix value to the authentication server and the mitigation device.

2 . A system for mitigating a threat associated with network data packets, the system comprising:

an authentication server comprising at least one memory and at least one hardware processor, that:

receives, from a client, a request for access to a first server; and

authenticates the client, the authentication including providing an authentication token to the client; and

a mitigation device that:

receives, from the client, at least one network packet directed to the first server, the at least one network packet embedding the authentication token in a payload of the at least one network packet;

validates authenticity of the authentication token; and

based on the validation, selectively forwards the at least one network packet to the first server, wherein the authentication token is unique for each network packet; wherein the at least one network packet is a User Datagram Protocol (UDP) packet, and the authentication token is located within a first four bytes of a payload of the UDP packet.

3 . A method for mitigating a threat associated with network data packets, the method comprising:

receiving, from a client, by an authentication server, a request for access to a first server;

authenticating the client by the authentication server, the authentication including providing an authentication token to the client;

receiving, by a mitigation device, from the client, at least one network packet directed to the first server with an authentication token embedded into a payload of the at least one network packet;

validating, by the mitigation device, authenticity of the authentication token; and

based on the validation, selectively forwarding, by the mitigation device, the at least one network packet to the first server, wherein the authentication token is unique for each network packet; wherein

a shared token generation algorithm and a salt-prefix value are provided by an administrative module to the authentication server and mitigation device.

4 . A method for mitigating a threat associated with network data packets, the method comprising:

receiving, from a client, by an authentication server, a request for access to a first server;

authenticating the client by the authentication server, the authentication including providing an authentication token to the client;

receiving, by a mitigation device, from the client, at least one network packet directed to the first server with an authentication token embedded into a payload of the at least one network packet;

validating, by the mitigation device, authenticity of the authentication token; and

based on the validation, selectively forwarding, by the mitigation device, the at least one network packet to the first server, wherein the authentication token is unique for each network packet; wherein

the at least one network packet is a User Datagram Protocol (UDP) packet, and the authentication token is located within a first four bytes of a payload of the UDP packet.

5 . A system for mitigating a threat associated with network data packets, the system comprising:

an authentication server comprising at least one memory and at least one hardware processor, the authentication server configured to:

receive, from a client, a request for access to a first server; and

authenticate the client, the authentication including providing an authentication token to the client;

a mitigation device resident in at least one memory and executed by at least one processor, the mitigation device configured to:

receive, from the client, at least one network packet directed to the first server, the at least one network packet embedding the authentication token in a payload of the at least one network packet;

validate authenticity of the authentication token;

based on the validation, selectively forward the at least one network packet to the first server, wherein the authentication token is unique for each network packet; and

mitigate a threat associated with the at least one network packet if the authentication token fails the validation; and

an administrative module resident in at least one memory and executed by at least one processor, the administrative module configured to:

provide a shared token generation algorithm and a salt-prefix value to the authentication server, mitigation device, and the client.