IP Library Granted Patent US 9,621,583
Granted Patent B2
US 9,621,583 · App. 14/923,603 · Granted Apr 11, 2017

Selectively protecting valid links to pages of a web site

Inventors: Subramanian Varadarajan (San Jose, CA); Justin Call (Santa Clara, CA)
Assignee: SHAPE SECURITY, INC.
H04L63/1491G06F21/50G06F21/6218H04L63/06H04L63/10H04L63/1416H04L67/02G06F2221/2119G06F2221/2123H04L63/168
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,621,583
App. No.
14/923,603
Granted
Apr 11, 2017
Kind
B2
Abstract

In an embodiment, a method comprises intercepting, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link; determining that the first link, which references a first target page, is protected; in response to determining the first link is protected: generating a first decoy link that corresponds to the first link, wherein the first decoy link includes data that references a first decoy page which includes false information; rendering a second set of instructions that defines the first decoy link, wherein the second set of instructions is configured to cause a first client computer to hide the first decoy link from the user interface; sending the second set of instructions to the first client computer.

Claims (90)

1. A method comprising:

intercepting, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link;

determining that the first link references a first target page;

determining that the first target page is protected;

in response to determining the first target page is protected, generating a first decoy link that corresponds to the first link;

wherein the first decoy link includes data that references a first decoy page and not the first target page, wherein the first decoy page includes false information;

rendering a second set of instructions define the first decoy link, wherein the second set of instructions are configured to cause a first client computer to hide the first decoy link from the user interface;

sending the second set of instructions to the first client computer;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising:

intercepting, from the server computer, a third set of instructions that defines the first link;

determining that the first link references the first target page;

determining that the first target page is protected;

in response to determining the first target page is protected, generating a second decoy link that includes data that references a second decoy page and not the first target page, wherein the second decoy link is different than the first decoy link;

rendering a fourth set of instructions define the second decoy link, which is configured to cause the first client computer to hide the second decoy link from the user interface;

sending the fourth set of instructions to the first client computer.

3. The method of claim 1 further comprising:

receiving, from the first client computer, a first request indicating that the first decoy link was selected;

in response to determining the first decoy link was selected, generating a decoy page with one or more decoy links, which when selected generate an additional request for an additional decoy page with one or more additional decoy links;

sending, to the first client computer, the decoy page.

4. The method of claim 1 , wherein the first decoy link includes a key, and the method further comprising:

storing the key indicating that the key is invalid;

receiving, from the first client computer, a first request with the key indicating the first decoy link was selected;

determining the key is invalid;

in response to determining that the key is invalid, generating a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

sending the first target page to the first client computer.

5. The method of claim 1 further comprising:

in response to determining the first target page is protected, generating a first protected link that corresponds to the first link and is different than the first decoy link;

wherein the first protected link is different than the first link and includes a key that authenticates a first request that has been generated based on the first protected link and that references the first target page.

6. The method of claim 5 , wherein the second set of instructions are configured to cause a first client computer to display the first protected link in the user interface.

7. The method of claim 5 further comprising:

storing the key indicating that the key is valid;

receiving, from the first client computer, the first request with the key indicating the first protected link was selected;

determining the key is valid;

in response to determining the key is valid, sending a second request to the server computer for a set of valid data to generate the first target page;

generating the first target page with the set of valid data;

sending the first target page to the first client computer.

8. The method of claim 7 further comprising:

invalidating the key;

receiving, from a second client computer, a third request with the key;

determining that the key is invalid;

in response to determining that the key is invalid, generating a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

sending, to the second client computer, the decoy page.

9. The method of claim 8 , wherein the first client computer and the second client computer are a single computer.

10. A computer system comprising:

a processor;

a memory;

a processing module configured to:

intercept, using a server computer, a first set of instructions that define a user interface and a plurality of links, wherein each link in the plurality of links is associated with a target page, and the plurality of links includes a first link;

determine that the first link references a first target page;

determine that the first target page is protected;

in response to determining the first target page is protected, generate a first decoy link that corresponds to the first link;

wherein the first decoy link includes data that references a first decoy page and not the first target page, wherein the first decoy page includes false information;

render a second set of instructions define the first decoy link, wherein the second set of instructions are configured to cause a first client computer to hide the first decoy link from the user interface;

send the second set of instructions to the first client computer.

11. The computer system of claim 10 , wherein the processing module is further configured to:

intercept, from the server computer, a third set of instructions that defines the first link;

determine that the first link references the first target page;

determine that the first target page is protected;

in response to determining the first target page is protected, generate a second decoy link that includes data that references a second decoy page and not the first target page, wherein the second decoy link is different than the first decoy link;

render a fourth set of instructions define the second decoy link, which is configured to cause the first client computer to hide the second decoy link from the user interface;

send the fourth set of instructions to the first client computer.

12. The computer system of claim 10 , wherein the processing module is further configured to:

receive, from the first client computer, a first request indicating that the first decoy link was selected;

in response to determining the first decoy link was selected, generate a decoy page with one or more decoy links, which when selected generate an additional request for an additional decoy page with one or more additional decoy links;

sending, to the first client computer, the decoy page.

13. The computer system of claim 10 comprising a storage, wherein the first decoy link includes a key and the processing module is further configured to:

store the key indicating that the key is invalid;

receive, from the first client computer, a first request with the key indicating the first decoy link was selected;

determine the key is invalid;

in response to determining that the key is invalid, generate a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

send the first target page to the first client computer.

14. The computer system of claim 13 , wherein the processing module is further configured to:

in response to determining the first target page is protected, generate a first protected link that corresponds to the first link and is different than the first decoy link;

wherein the first protected link is different than the first link and includes a key that authenticates a first request that has been generated based on the first protected link and that references the first target page.

15. The computer system of claim 14 , wherein the second set of instructions are configured to cause a first client computer to display the first protected link in the user interface.

16. The computer system of claim 14 comprising a storage, wherein the processing module is further configured to:

store the key indicating that the key is valid;

receive, from the first client computer, the first request with the key indicating the first protected link was selected;

determine the key is valid;

in response to determining the key is valid, send a second request to the server computer for a set of valid data to generate the first target page;

generate the first target page with the set of valid data;

send the first target page to the first client computer.

17. The computer system of claim 16 , wherein the processing module is further configured to:

invalidate the key;

receive, from a second client computer, a third request with the key;

determine that the key is invalid;

in response to determining that the key is invalid, generate a decoy page with one or more decoy links that are configured to cause generating an additional request for an additional decoy page with one or more additional decoy links;

send, to the second client computer, the decoy page.

18. The computer system of claim 17 , wherein the first client computer and the second client computer are a single computer.

Assignments (2)
RELEASE OF SECURITY INTEREST Recorded Mar 5, 2019
From: SILICON VALLEY BANK
To: SHAPE SECURITY, INC.
Reel/Frame 048501/0115 →
SECURITY INTEREST Recorded May 25, 2018
From: SHAPE SECURITY, INC.
To: SILICON VALLEY BANK
Reel/Frame 046243/0254 →
Continuity (2)
Continuation 14290805 · May 29, 2014
Related Publication 20160050231A1 · Feb 18, 2016