IP Library Granted Patent US 9,716,702
Granted Patent B2
US 9,716,702 · App. 14/738,913 · Granted Jul 25, 2017

Management of dynamic credentials

Inventors: Justin Call (Santa Clara, CA); Subramanian Varadarajan (San Jose, CA); Bryan Hanks (San Jose, CA)
Assignee: Shape Security, Inc.
H04L63/08G06F21/44H04L9/008H04L9/0891H04L63/0846H04L63/1441H04L63/1466H04L63/162H04L2463/144
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,716,702
App. No.
14/738,913
Granted
Jul 25, 2017
Kind
B2
Abstract

In an embodiment, a method comprises intercepting, from a first computer, a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent if executed by a client computer; modifying the first set of instructions to produce a modified set of instructions, which are configured to cause a credential to be included in the one or more requests sent if executed by the client computer; rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing-instructions, wherein the one or more credential-morphing-instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the credential over time if executed; sending the second set of instructions to a second computer.

Claims (123)

1. A method comprising:

generating a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent to a server computer when executed by a client computer;

generating a dynamic credential to be sent to the client computer;

modifying the first set of instructions to produce a modified set of instructions, which are configured to cause the dynamic credential to be included in the one or more requests sent from the client computer when executed by the client computer;

rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the dynamic credential over time when executed;

sending the second set of instructions and the dynamic credential to a particular computer; and

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

receiving a request for data; and

performing a negative responsive action in response to determining the request does not include a valid credential.

3. The method of claim 1 further comprising:

receiving a request for data at a particular time, wherein the request includes the dynamic credential and the dynamic credential corresponds with one or more parameters; and

performing a negative responsive action in response to determining that the one or more parameters are not satisfied based, at least in part, on the particular time.

4. The method of claim 3 , wherein performing the negative responsive action comprises sending a configurable response that indicates the request was invalid.

5. The method of claim 1 further comprising:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining that the one or more parameters associated with the dynamic credential are satisfied, and in response:

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request from the particular computer, which includes the new dynamic credential, for data on the server computer; and

sending the data to the particular computer in response to determining the one or more new parameters associated with the new dynamic credential are satisfied.

6. The method of claim 1 further comprising:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining the one or more parameters associated with the dynamic credential are satisfied, and in response:

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the server computer; and

terminating the second request in response to determining the one or more new parameters associated with the new dynamic credential are not satisfied.

7. The method of claim 1 , wherein the dynamic credential comprises one or more encrypted parameters, and the method further comprising:

receiving a first request wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response:

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request from the particular computer, which includes the new dynamic credential, for data from the server computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

sending the data to the particular computer in response to determining that the one or more new decrypted parameters are satisfied.

8. The method of claim 1 further comprising:

generating the dynamic credential, which comprises one or more encrypted parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response:

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the server computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

terminating the second request in response to determining that the one or more new decrypted parameters are not satisfied.

9. The method of claim 1 further comprising:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data, from the particular computer, that comprises a modified first dynamic credential; and

sending the data to the particular computer in response to determining that the modified first dynamic credential is valid.

10. The method of claim 1 further comprising:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

terminating the request in response to determining that the modified first dynamic credential is not valid.

11. A computer comprising:

a processor;

non-transitory storage media storing instructions which, when executed by the processor, cause:

generating a first set of instructions that define one or more original operations, which are configured to cause one or more requests to be sent to the computer when executed by a client computer;

generating, at the computer, a dynamic credential to be sent to the client computer;

modifying the first set of instructions to produce a modified set of instructions, which are configured to cause the dynamic credential to be included in the one or more requests sent from the client computer when executed by the client computer;

rendering a second set of instructions comprising the modified set of instructions and one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define one or more credential-morphing operations, which are configured to cause the client computer to update the dynamic credential received from the computer over time when executed; and

sending the second set of instructions and the dynamic credential to a particular computer.

12. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

receiving a request for data; and

performing a negative responsive action in response to determining the request does not include a valid credential.

13. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

receiving a request for data at a particular time, wherein the request includes the dynamic credential and the dynamic credential corresponds with one or more parameters; and

performing a negative responsive action in response to determining that the one or more parameters are not satisfied based, at least in part, on the particular time.

14. The computer of claim 13 , wherein performing the negative responsive action comprises sending a configurable response that indicates the request was invalid.

15. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining that the one or more parameters associated with the dynamic credential are satisfied, and in response:

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, from the particular computer for data from the computer; and

sending the data to the particular computer in response to a determination that the one or more new parameters associated with the dynamic credential are satisfied.

16. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

associating the dynamic credential with one or more parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

determining the one or more parameters associated with the dynamic credential are satisfied, and in response:

generating the new dynamic credential;

associating the new dynamic credential with one or more new parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer; and

terminating the second request in response to determining the one or more new parameters associated with the new dynamic credential are not satisfied.

17. The computer of claim 11 , wherein the dynamic credential comprises one or more encrypted parameters, and the instructions, when executed by the processor, further cause:

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response:

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

sending the data to the particular computer in response to a determination that the one or more new decrypted parameters associated with the dynamic credential are satisfied.

18. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

generating the dynamic credential, which comprises one or more encrypted parameters;

receiving a first request, wherein the first request is for a new dynamic credential and the first request comprises the dynamic credential;

decrypting the one or more encrypted parameters to produce one or more decrypted parameters;

determining that the one or more decrypted parameters are satisfied, and in response:

generating the new dynamic credential, which comprises one or more new encrypted parameters;

sending the new dynamic credential to the particular computer;

receiving a second request, which includes the new dynamic credential, for data from the computer;

decrypting the one or more encrypted parameters to produce one or more new decrypted parameters; and

terminating the second request in response to determining that the one or more new decrypted parameters are not satisfied.

19. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

producing the modified set of instructions by adding a seed value; and

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

sending the data to the particular computer in response to a determination that the modified first dynamic credential is valid.

20. The computer of claim 11 , wherein the instructions, when executed by the processor, further cause:

modifying the first set of instructions to produce the modified set of instructions by adding a seed value;

rendering the second set of instructions comprising the one or more credential-morphing instructions, wherein the one or more credential-morphing instructions define the one or more credential-morphing operations, which are configured to cause the client computer to modify the dynamic credential over time based on the seed value;

receiving a request for data that comprises a modified first dynamic credential; and

terminating the request in response to determining that the modified first dynamic credential is not valid.

Assignments (2)
RELEASE OF SECURITY INTEREST Recorded Mar 5, 2019
From: SILICON VALLEY BANK
To: SHAPE SECURITY, INC.
Reel/Frame 048501/0115 →
SECURITY INTEREST Recorded May 25, 2018
From: SHAPE SECURITY, INC.
To: SILICON VALLEY BANK
Reel/Frame 046243/0254 →
Continuity (2)
Continuation 14290835 · May 29, 2014
Related Publication 20150350181A1 · Dec 3, 2015